update VERSION for v1.1.1

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Merge remote-tracking branch 'agraf/s390-for-upstream-1.1' into HEAD
2012-07-12 13:36:53 -05:00 · 2012-07-10 14:08:37 -05:00 · 2012-07-10 18:29:29 +02:00 · 2012-06-29 10:22:30 -05:00 · 2012-06-25 10:58:24 -05:00 · 2012-06-25 09:04:33 -05:00
2545 changed files with 106390 additions and 276451 deletions
--- a/.exrc
+++ b/.exrc
@@ -1,7 +0,0 @@
-"VIM settings to match QEMU coding style.  They are activated by adding the
-"following settings (without the " symbol) as last two lines in $HOME/.vimrc:
-"set secure
-"set exrc
-set expandtab
-set shiftwidth=4
-set smarttab
--- a/.gitignore
+++ b/.gitignore
@@ -1,21 +1,19 @@
 config-devices.*
 config-all-devices.*
-config-all-disas.*
 config-host.*
 config-target.*
-trace/generated-tracers.h
-trace/generated-tracers.c
-trace/generated-tracers-dtrace.h
-trace/generated-tracers.dtrace
-trace/generated-events.h
-trace/generated-events.c
-libcacard/trace/generated-tracers.c
+trace.h
+trace.c
+trace-dtrace.h
+trace-dtrace.dtrace
 *-timestamp
 *-softmmu
 *-darwin-user
 *-linux-user
 *-bsd-user
 libdis*
+libhw32
+libhw64
 libuser
 linux-headers/asm
 qapi-generated
@@ -43,15 +41,12 @@ qemu-io
 qemu-ga
 qemu-bridge-helper
 qemu-monitor.texi
-vscclient
 QMP/qmp-commands.txt
 test-coroutine
 test-qmp-input-visitor
 test-qmp-output-visitor
 test-string-input-visitor
 test-string-output-visitor
-test-visitor-serialization
-fsdev/virtfs-proxy-helper
 fsdev/virtfs-proxy-helper.1
 fsdev/virtfs-proxy-helper.pod
 .gdbinit
@@ -73,35 +68,22 @@ fsdev/virtfs-proxy-helper.pod
 *.tp
 *.vr
 *.d
-!scripts/qemu-guest-agent/fsfreeze-hook.d
 *.o
-*.lo
-*.la
-*.pc
-.libs
 *.swp
 *.orig
 .pc
-*.patch
-*.gcda
-*.gcno
 patches
 pc-bios/bios-pq/status
 pc-bios/vgabios-pq/status
-pc-bios/optionrom/linuxboot.asm
 pc-bios/optionrom/linuxboot.bin
 pc-bios/optionrom/linuxboot.raw
 pc-bios/optionrom/linuxboot.img
-pc-bios/optionrom/multiboot.asm
 pc-bios/optionrom/multiboot.bin
 pc-bios/optionrom/multiboot.raw
 pc-bios/optionrom/multiboot.img
-pc-bios/optionrom/kvmvapic.asm
 pc-bios/optionrom/kvmvapic.bin
 pc-bios/optionrom/kvmvapic.raw
 pc-bios/optionrom/kvmvapic.img
-pc-bios/s390-ccw/s390-ccw.elf
-pc-bios/s390-ccw/s390-ccw.img
 .stgit-*
 cscope.*
 tags
--- a/.gitmodules
+++ b/.gitmodules
@@ -19,9 +19,3 @@
 [submodule "roms/sgabios"]
 	path = roms/sgabios
 	url = git://git.qemu.org/sgabios.git
-[submodule "pixman"]
-	path = pixman
-	url = git://anongit.freedesktop.org/pixman
-[submodule "dtc"]
-	path = dtc
-	url = git://git.qemu.org/dtc.git
--- a/38
+++ b/38
@@ -32,7 +32,7 @@ mandatory for VMState fields.

 Don't use Linux kernel internal types like u32, __u32 or __le32.

-Use hwaddr for guest physical addresses except pcibus_t
+Use target_phys_addr_t for guest physical addresses except pcibus_t
 for PCI addresses.  In addition, ram_addr_t is a QEMU internal address
 space that maps guest RAM physical addresses into an intermediate
 address space that can map to host virtual address spaces.  Generally
@@ -78,23 +78,23 @@ avoided.
 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
 use the GLib memory allocation routines g_malloc/g_malloc0/g_new/
-g_new0/g_realloc/g_free or QEMU's qemu_memalign/qemu_blockalign/qemu_vfree
+g_new0/g_realloc/g_free or QEMU's qemu_vmalloc/qemu_memalign/qemu_vfree
 APIs.

 Please note that g_malloc will exit on allocation failure, so there
 is no need to test for failure (as you would have to with malloc).
 Calling g_malloc with a zero size is valid and will return NULL.

-Memory allocated by qemu_memalign or qemu_blockalign must be freed with
-qemu_vfree, since breaking this will cause problems on Win32.
+Memory allocated by qemu_vmalloc or qemu_memalign must be freed with
+qemu_vfree, since breaking this will cause problems on Win32 and user
+emulators.

 4. String manipulation

-Do not use the strncpy function.  As mentioned in the man page, it does *not*
-guarantee a NULL-terminated buffer, which makes it extremely dangerous to use.
-It also zeros trailing destination bytes out to the specified length.  Instead,
-use this similar function when possible, but note its different signature:
-void pstrcpy(char *dest, int dest_buf_size, const char *src)
+Do not use the strncpy function.  According to the man page, it does
+*not* guarantee a NULL-terminated buffer, which makes it extremely dangerous
+to use.  Instead, use functionally equivalent function:
+void pstrcpy(char *buf, int buf_size, const char *str)

 Don't use strcat because it can't check for buffer overflows, but:
 char *pstrcat(char *buf, int buf_size, const char *s)
@@ -122,23 +122,3 @@ gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
-
-6. C standard, implementation defined and undefined behaviors
-
-C code in QEMU should be written to the C99 language specification. A copy
-of the final version of the C99 standard with corrigenda TC1, TC2, and TC3
-included, formatted as a draft, can be downloaded from:
- http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf
-
-The C language specification defines regions of undefined behavior and
-implementation defined behavior (to give compiler authors enough leeway to
-produce better code).  In general, code in QEMU should follow the language
-specification and avoid both undefined and implementation defined
-constructs. ("It works fine on the gcc I tested it with" is not a valid
-argument...) However there are a few areas where we allow ourselves to
-assume certain behaviors because in practice all the platforms we care about
-behave in the same way and writing strictly conformant code would be
-painful. These are:
- * you may assume that integers are 2s complement representation
- * you may assume that right shift of a signed integer duplicates
-   the sign bit (ie it is an arithmetic shift, not a logical shift)
--- a/288
+++ b/288
@@ -59,113 +59,86 @@ Alpha
 M: Richard Henderson <rth@twiddle.net>
 S: Maintained
 F: target-alpha/
-F: hw/alpha/

 ARM
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: target-arm/
-F: hw/arm/
-F: hw/cpu/a*mpcore.c

 CRIS
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: target-cris/
-F: hw/cris/

 LM32
 M: Michael Walle <michael@walle.cc>
 S: Maintained
 F: target-lm32/
-F: hw/lm32/

 M68K
 M: Paul Brook <paul@codesourcery.com>
 S: Odd Fixes
 F: target-m68k/
-F: hw/m68k/

 MicroBlaze
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: target-microblaze/
-F: hw/microblaze/

 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Odd Fixes
 F: target-mips/
-F: hw/mips/
-
-Moxie
-M: Anthony Green <green@moxielogic.com>
-S: Maintained
-F: target-moxie/

 PowerPC
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Maintained
 F: target-ppc/
-F: hw/ppc/

 S390
-M: Richard Henderson <rth@twiddle.net>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: target-s390x/
-F: hw/s390x/

 SH4
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Odd Fixes
 F: target-sh4/
-F: hw/sh4/

 SPARC
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: target-sparc/
-F: hw/sparc/
-F: hw/sparc64/

 UniCore32
 M: Guan Xuetao <gxt@mprc.pku.edu.cn>
 S: Maintained
 F: target-unicore32/
-F: hw/unicore32/

 X86
 M: qemu-devel@nongnu.org
 S: Odd Fixes
 F: target-i386/
-F: hw/i386/

 Xtensa
 M: Max Filippov <jcmvbkbc@gmail.com>
 W: http://wiki.osll.spb.ru/doku.php?id=etc:users:jcmvbkbc:qemu-target-xtensa
 S: Maintained
 F: target-xtensa/
-F: hw/xtensa/

 Guest CPU Cores (KVM):
 ----------------------

 Overall
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
 F: kvm-*
 F: */kvm.*

-ARM
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: target-arm/kvm.c
-
 PPC
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
@@ -177,7 +150,7 @@ S: Maintained
 F: target-s390x/kvm.c

 X86
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
@@ -221,368 +194,270 @@ M: Maksim Kozlov <m.kozlov@samsung.com>
 M: Igor Mitsyanko <i.mitsyanko@samsung.com>
 M: Dmitry Solodkiy <d.solodkiy@samsung.com>
 S: Maintained
-F: hw/*/exynos*
+F: hw/exynos*

 Calxeda Highbank
 M: Mark Langsdorf <mark.langsdorf@calxeda.com>
 S: Supported
-F: hw/arm/highbank.c
-F: hw/net/xgmac.c
+F: hw/highbank.c
+F: hw/xgmac.c

 Gumstix
 M: qemu-devel@nongnu.org
 S: Orphan
-F: hw/arm/gumstix.c
-
-i.MX31
-M: Peter Chubb <peter.chubb@nicta.com.au>
-S: Odd fixes
-F: hw/*/imx*
-F: hw/arm/kzm.c
+F: hw/gumstix.c

 Integrator CP
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
-F: hw/arm/integratorcp.c
+F: hw/integratorcp.c

 Mainstone
 M: qemu-devel@nongnu.org
 S: Orphan
-F: hw/arm/mainstone.c
+F: hw/mainstone.c

 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
 S: Maintained
-F: hw/arm/musicpal.c
+F: hw/musicpal.c

 nSeries
 M: Andrzej Zaborowski <balrogg@gmail.com>
 S: Maintained
-F: hw/arm/nseries.c
+F: hw/nseries.c

 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
 S: Maintained
-F: hw/arm/palm.c
+F: hw/palm.c

 Real View
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
-F: hw/arm/realview*
+F: hw/realview*

 Spitz
 M: Andrzej Zaborowski <balrogg@gmail.com>
 S: Maintained
-F: hw/arm/spitz.c
+F: hw/spitz.c

 Stellaris
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
-F: hw/*/stellaris*
+F: hw/stellaris.c

 Versatile PB
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
-F: hw/*/versatile*
+F: hw/versatilepb.c

 Xilinx Zynq
 M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
 S: Maintained
-F: hw/arm/xilinx_zynq.c
-F: hw/misc/zynq_slcr.c
-F: hw/*/cadence_*
-F: hw/ssi/xilinx_spips.c
+F: hw/xilinx_zynq.c
+F: hw/zynq_slcr.c
+F: hw/cadence_*

 CRIS Machines
 -------------
 Axis Dev88
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
-F: hw/cris/axis_dev88.c
+F: hw/axis_dev88.c

 etraxfs
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
-F: hw/cris/etraxfs.c
+F: hw/etraxfs.c

 LM32 Machines
 -------------
 EVR32 and uclinux BSP
 M: Michael Walle <michael@walle.cc>
 S: Maintained
-F: hw/lm32/lm32_boards.c
+F: hw/lm32_boards.c

 milkymist
 M: Michael Walle <michael@walle.cc>
 S: Maintained
-F: hw/lm32/milkymist.c
+F: hw/milkymist.c

 M68K Machines
 -------------
 an5206
 M: Paul Brook <paul@codesourcery.com>
 S: Maintained
-F: hw/m68k/an5206.c
+F: hw/an5206.c

 dummy_m68k
 M: Paul Brook <paul@codesourcery.com>
 S: Maintained
-F: hw/m68k/dummy_m68k.c
+F: hw/dummy_m68k.c

 mcf5208
 M: Paul Brook <paul@codesourcery.com>
 S: Maintained
-F: hw/m68k/mcf5208.c
+F: hw/mcf5208.c

 MicroBlaze Machines
 -------------------
 petalogix_s3adsp1800
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
-F: hw/microblaze/petalogix_s3adsp1800.c
-
-petalogix_ml605
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-S: Maintained
-F: hw/microblaze/petalogix_ml605_mmu.c
+F: hw/petalogix_s3adsp1800.c

 MIPS Machines
 -------------
 Jazz
 M: Hervé Poussineau <hpoussin@reactos.org>
 S: Maintained
-F: hw/mips/mips_jazz.c
+F: hw/mips_jazz.c

 Malta
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Maintained
-F: hw/mips/mips_malta.c
+F: hw/mips_malta.c

 Mipssim
 M: qemu-devel@nongnu.org
 S: Orphan
-F: hw/mips/mips_mipssim.c
+F: hw/mips_mipssim.c

 R4000
 M: Aurelien Jarno <aurelien@aurel32.net>
 S: Maintained
-F: hw/mips/mips_r4k.c
+F: hw/mips_r4k.c

 PowerPC Machines
 ----------------
 405
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/ppc/ppc405_boards.c
-
-Bamboo
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/ppc/ppc440_bamboo.c
-
-e500
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppc/e500.[hc]
-F: hw/ppc/e500plat.c
-
-mpc8544ds
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppc/mpc8544ds.c
-F: hw/ppc/mpc8544_guts.c
+S: Maintained
+F: hw/ppc405_boards.c

 New World
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_newworld.c
-F: hw/pci/devices/host-uninorth.c
-F: hw/pci/devices/host-dec.[hc]
-F: hw/misc/macio/
+F: hw/ppc_newworld.c
+F: hw/unin_pci.c
+F: hw/dec_pci.[hc]

 Old World
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_oldworld.c
-F: hw/pci/devices/host-grackle.c
-F: hw/misc/macio/
+F: hw/ppc_oldworld.c
+F: hw/grackle_pci.c

 PReP
 M: Andreas Färber <andreas.faerber@web.de>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
-F: hw/ppc/prep.c
-F: hw/pci/devices/host-prep.[hc]
-F: hw/isa/pc87312.[hc]
-
-sPAPR
-M: David Gibson <david@gibson.dropbear.id.au>
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/*/spapr*
-
-virtex_ml507
-M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/pci/virtex_ml507.c
+F: hw/ppc_prep.c
+F: hw/prep_pci.[hc]

 SH4 Machines
 ------------
 R2D
 M: Magnus Damm <magnus.damm@gmail.com>
 S: Maintained
-F: hw/sh/r2d.c
+F: hw/r2d.c

 Shix
 M: Magnus Damm <magnus.damm@gmail.com>
 S: Orphan
-F: hw/sh/shix.c
+F: hw/shix.c

 SPARC Machines
 --------------
 Sun4m
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
-F: hw/sparc/sun4m.c
+F: hw/sun4m.c

 Sun4u
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
-F: hw/sparc64/sun4u.c
-
-Leon3
-M: Fabien Chouteau <chouteau@adacore.com>
-S: Maintained
-F: hw/sparc/leon3.c
-F: hw/*/grlib*
+F: hw/sun4u.c

 S390 Machines
 -------------
 S390 Virtio
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
-F: hw/s390/s390-*.c
-
-S390 Virtio-ccw
-M: Cornelia Huck <cornelia.huck@de.ibm.com>
-M: Alexander Graf <agraf@suse.de>
-S: Supported
-F: hw/s390x/s390-virtio-ccw.c
-F: hw/s390x/css.[hc]
-T: git git://github.com/cohuck/qemu virtio-ccw-upstr
-
-UniCore32 Machines
-------------
-PKUnity-3 SoC initramfs-with-busybox
-M: Guan Xuetao <gxt@mprc.pku.edu.cn>
-S: Maintained
-F: hw/*/puv3*
-F: hw/unicore32/
+F: hw/s390-*.c

 X86 Machines
 ------------
 PC
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
-F: hw/i386/pc.[ch]
-F: hw/i386/pc_piix.c
+F: hw/pc.[ch]
+F: hw/pc_piix.c

 Xtensa Machines
 ---------------
 sim
 M: Max Filippov <jcmvbkbc@gmail.com>
 S: Maintained
-F: hw/xtensa/xtensa_sim.c
+F: hw/xtensa_sim.c

 Avnet LX60
 M: Max Filippov <jcmvbkbc@gmail.com>
 S: Maintained
-F: hw/xtensa/xtensa_lx60.c
+F: hw/xtensa_lx60.c

 Devices
 -------
 IDE
 M: Kevin Wolf <kwolf@redhat.com>
 S: Odd Fixes
-F: include/hw/ide.h
 F: hw/ide/

 OMAP
 M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
-F: hw/*/omap*
+F: hw/omap*

 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
-F: include/hw/pci/*
-F: hw/pci/*
-F: hw/acpi/*
-
-ppc4xx
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/ppc/ppc4*.c
-
-ppce500
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppc/e500_*
+F: hw/pci*
+F: hw/piix*

 SCSI
 M: Paolo Bonzini <pbonzini@redhat.com>
 S: Supported
-F: include/hw/scsi*
-F: hw/scsi/*
+F: hw/virtio-scsi.*
+F: hw/scsi*
 T: git git://github.com/bonzini/qemu.git scsi-next

 LSI53C895A
 M: Paul Brook <paul@codesourcery.com>
 S: Odd Fixes
-F: hw/scsi/lsi53c895a.c
-
-SSI
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-S: Maintained
-F: hw/ssi/*
-F: hw/block/m25p80.c
+F: hw/lsi53c895a.c

 USB
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
-F: hw/usb/*
-
-VFIO
-M: Alex Williamson <alex.williamson@redhat.com>
-S: Supported
-F: hw/pci/vfio.c
+F: hw/usb*

 vhost
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
-F: hw/*/*vhost*
+F: hw/vhost*

 virtio
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
-F: hw/*/virtio*
+F: hw/virtio*

 virtio-9p
 M: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
@@ -593,28 +468,14 @@ T: git git://github.com/kvaneesh/QEMU.git

 virtio-blk
 M: Kevin Wolf <kwolf@redhat.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Supported
-F: hw/block/virtio-blk.c
-
-virtio-ccw
-M: Cornelia Huck <cornelia.huck@de.ibm.com>
-S: Supported
-F: hw/s390x/virtio-ccw.[hc]
-T: git git://github.com/cohuck/qemu virtio-ccw-upstr
+F: hw/virtio-blk*

 virtio-serial
 M: Amit Shah <amit.shah@redhat.com>
 S: Supported
-F: hw/char/virtio-serial-bus.c
-F: hw/char/virtio-console.c
-
-Xilinx EDK
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
-S: Maintained
-F: hw/*/xilinx_*
-F: include/hw/xilinx.h
+F: hw/virtio-serial*
+F: hw/virtio-console*

 Subsystems
 ----------
@@ -622,40 +483,18 @@ Audio
 M: Vassili Karpov (malc) <av1474@comtv.ru>
 S: Maintained
 F: audio/
-F: hw/audio/

 Block
 M: Kevin Wolf <kwolf@redhat.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Supported
 F: block*
 F: block/
-F: hw/block/

 Character Devices
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Maintained
 F: qemu-char.c

-CPU
-M: Andreas Färber <afaerber@suse.de>
-S: Supported
-F: qom/cpu.c
-F: include/qemu/cpu.h
-F: target-i386/cpu.c
-
-ICC Bus
-M: Igor Mammedov <imammedo@redhat.com>
-S: Supported
-F: include/hw/cpu/icc_bus.h
-F: hw/cpu/icc_bus.c
-
-Device Tree
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-M: Alexander Graf <agraf@suse.de>
-S: Maintained
-F: device-tree.[ch]
-
 GDB stub
 M: qemu-devel@nongnu.org
 S: Odd Fixes
@@ -668,7 +507,7 @@ S: Supported
 F: ui/qemu-spice.h
 F: ui/spice-*.c
 F: audio/spiceaudio.c
-F: hw/display/qxl*
+F: hw/qxl*

 Graphics
 M: Anthony Liguori <aliguori@us.ibm.com>
@@ -693,10 +532,9 @@ F: monitor.c

 Network device layer
 M: Anthony Liguori <aliguori@us.ibm.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
+M: Mark McLoughlin <markmc@redhat.com>
 S: Maintained
 F: net/
-T: git git://github.com/stefanha/qemu.git net

 Network Block Device (NBD)
 M: Paolo Bonzini <pbonzini@redhat.com>
@@ -713,7 +551,7 @@ F: slirp/
 T: git git://git.kiszka.org/qemu.git queues/slirp

 Tracing
-M: Stefan Hajnoczi <stefanha@redhat.com>
+M: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
 S: Maintained
 F: trace/
 F: scripts/tracetool.py
--- a/244
+++ b/244
@@ -6,49 +6,24 @@ BUILD_DIR=$(CURDIR)
 # All following code might depend on configuration variables
 ifneq ($(wildcard config-host.mak),)
 # Put the all: rule here so that config-host.mak can contain dependencies.
-all:
+all: build-all
 include config-host.mak
-
-# Check that we're not trying to do an out-of-tree build from
-# a tree that's been used for an in-tree build.
-ifneq ($(realpath $(SRC_PATH)),$(realpath .))
-ifneq ($(wildcard $(SRC_PATH)/config-host.mak),)
-$(error This is an out of tree build but your source tree ($(SRC_PATH)) \
-seems to have been used for an in-tree build. You can fix this by running \
-"make distclean && rm -rf *-linux-user *-softmmu" in your source tree)
-endif
-endif
-
-CONFIG_SOFTMMU := $(if $(filter %-softmmu,$(TARGET_DIRS)),y)
-CONFIG_USER_ONLY := $(if $(filter %-user,$(TARGET_DIRS)),y)
-CONFIG_ALL=y
-include config-all-devices.mak
-include config-all-disas.mak
-
 include $(SRC_PATH)/rules.mak
 config-host.mak: $(SRC_PATH)/configure
 	@echo $@ is out-of-date, running configure
 	@sed -n "/.*Configured with/s/[^:]*: //p" $@ | sh
 else
 config-host.mak:
-ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
 	@echo "Please call configure before running make!"
 	@exit 1
 endif
-endif

-GENERATED_HEADERS = config-host.h qemu-options.def
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c
-
-GENERATED_HEADERS += trace/generated-events.h
-GENERATED_SOURCES += trace/generated-events.c
-
-GENERATED_HEADERS += trace/generated-tracers.h
+GENERATED_HEADERS = config-host.h trace.h qemu-options.def
 ifeq ($(TRACE_BACKEND),dtrace)
-GENERATED_HEADERS += trace/generated-tracers-dtrace.h
+GENERATED_HEADERS += trace-dtrace.h
 endif
-GENERATED_SOURCES += trace/generated-tracers.c
+GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
+GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c trace.c

 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
@@ -56,9 +31,9 @@ Makefile: ;
 configure: ;

 .PHONY: all clean cscope distclean dvi html info install install-doc \
-	pdf recurse-all speed test dist
+	pdf recurse-all speed tar tarbin test build-all

-$(call set-vpath, $(SRC_PATH))
+$(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)

 LIBS+=-lz $(LIBS_TOOLS)

@@ -75,18 +50,10 @@ endif

 SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
 SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
-SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %-config-devices.mak.d, $(TARGET_DIRS))
+SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %/config-devices.mak.d, $(TARGET_DIRS))

-ifeq ($(SUBDIR_DEVICES_MAK),)
-config-all-devices.mak:
-	$(call quiet-command,echo '# no devices' > $@,"  GEN   $@")
-else
 config-all-devices.mak: $(SUBDIR_DEVICES_MAK)
-	$(call quiet-command, sed -n \
-             's|^\([^=]*\)=\(.*\)$$|\1:=$$(findstring y,$$(\1)\2)|p' \
-             $(SUBDIR_DEVICES_MAK) | sort -u > $@, \
-             "  GEN   $@")
-endif
+	$(call quiet-command,cat $(SUBDIR_DEVICES_MAK) | grep =y | sort -u > $@,"  GEN   $@")

 -include $(SUBDIR_DEVICES_MAK_DEP)

@@ -113,15 +80,9 @@ endif
 defconfig:
 	rm -f config-all-devices.mak $(SUBDIR_DEVICES_MAK)

-ifneq ($(wildcard config-host.mak),)
-include $(SRC_PATH)/Makefile.objs
-include $(SRC_PATH)/tests/Makefile
-endif
-ifeq ($(CONFIG_SMARTCARD_NSS),y)
-include $(SRC_PATH)/libcacard/Makefile
-endif
+-include config-all-devices.mak

-all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all
+build-all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all

 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
@@ -129,32 +90,20 @@ qemu-options.def: $(SRC_PATH)/qemu-options.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

 SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
-SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))

-$(SOFTMMU_SUBDIR_RULES): config-all-devices.mak
-
-subdir-%:
+subdir-%: $(GENERATED_HEADERS)
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C $* V="$(V)" TARGET_DIR="$*/" all,)

-subdir-pixman: pixman/Makefile
-	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C pixman V="$(V)" all,)
+ifneq ($(wildcard config-host.mak),)
+include $(SRC_PATH)/Makefile.objs
+endif

-pixman/Makefile: $(SRC_PATH)/pixman/configure
-	(cd pixman; CFLAGS="$(CFLAGS) -fPIC $(extra_cflags) $(extra_ldflags)" $(SRC_PATH)/pixman/configure $(AUTOCONF_HOST) --disable-gtk --disable-shared --enable-static)
+$(universal-obj-y) $(common-obj-y): $(GENERATED_HEADERS)
+subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-timer-common.o

-$(SRC_PATH)/pixman/configure:
-	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
+$(filter %-softmmu,$(SUBDIR_RULES)): $(universal-obj-y) $(trace-obj-y) $(common-obj-y) subdir-libdis

-DTC_MAKE_ARGS=-I$(SRC_PATH)/dtc VPATH=$(SRC_PATH)/dtc -C dtc V="$(V)" LIBFDT_srcdir=$(SRC_PATH)/dtc/libfdt
-DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS) -I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
-
-subdir-dtc:dtc/libfdt dtc/tests
-	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)
-
-dtc/%:
-	mkdir -p $@
-
-$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y)
+$(filter %-user,$(SUBDIR_RULES)): $(GENERATED_HEADERS) $(universal-obj-y) $(trace-obj-y) subdir-libdis-user subdir-libuser

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 romsubdir-%:
@@ -164,103 +113,128 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))

 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)

+audio/audio.o audio/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
+
+QEMU_CFLAGS+=$(CURL_CFLAGS)
+
+QEMU_CFLAGS += -I$(SRC_PATH)/include
+
+ui/cocoa.o: ui/cocoa.m
+
+ui/sdl.o audio/sdlaudio.o ui/sdl_zoom.o baum.o: QEMU_CFLAGS += $(SDL_CFLAGS)
+
+ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+
 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)

-version.o: $(SRC_PATH)/version.rc config-host.h | version.lo
-version.lo: $(SRC_PATH)/version.rc config-host.h
+version.o: $(SRC_PATH)/version.rc config-host.h
+	$(call quiet-command,$(WINDRES) -I. -o $@ $<,"  RC    $(TARGET_DIR)$@")

 version-obj-$(CONFIG_WIN32) += version.o
-version-lobj-$(CONFIG_WIN32) += version.lo
-
-Makefile: $(version-obj-y) $(version-lobj-y)
-
 ######################################################################
-# Build libraries
+# Support building shared library libcacard

-libqemustub.a: $(stub-obj-y)
-libqemuutil.a: $(util-obj-y)
+.PHONY: libcacard.la install-libcacard
+ifeq ($(LIBTOOL),)
+libcacard.la:
+	@echo "libtool is missing, please install and rerun configure"; exit 1

+install-libcacard:
+	@echo "libtool is missing, please install and rerun configure"; exit 1
+else
+libcacard.la: $(GENERATED_HEADERS) $(oslib-obj-y) qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" libcacard.la,)
+
+install-libcacard: libcacard.la
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" install-libcacard,)
+endif
 ######################################################################

 qemu-img.o: qemu-img-cmds.h
+qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o qemu-ga.o: $(GENERATED_HEADERS)

-qemu-img$(EXESUF): qemu-img.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-io$(EXESUF): qemu-io.o cmd.o $(block-obj-y) libqemuutil.a libqemustub.a
+tools-obj-y = $(oslib-obj-y) $(trace-obj-y) qemu-tool.o qemu-timer.o \
+	qemu-timer-common.o main-loop.o notify.o iohandler.o cutils.o async.o
+tools-obj-$(CONFIG_POSIX) += compatfd.o
+
+qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y)
+qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y)
+qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y)

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o
+qemu-bridge-helper.o: $(GENERATED_HEADERS)

-fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o libqemuutil.a libqemustub.a
+fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o oslib-posix.o $(trace-obj-y)
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

+$(qapi-obj-y): $(GENERATED_HEADERS)
+qapi-dir := $(BUILD_DIR)/qapi-generated
 qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)
-qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated
+qemu-ga$(EXESUF): QEMU_CFLAGS += -I $(qapi-dir)

 gen-out-type = $(subst .,-,$(suffix $@))

-qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py
+ifneq ($(wildcard config-host.mak),)
+include $(SRC_PATH)/tests/Makefile
+endif

-qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
-qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
-qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qapi-types.c $(qapi-dir)/qga-qapi-types.h :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qapi-visit.c $(qapi-dir)/qga-qapi-visit.h :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qmp-commands.h $(qapi-dir)/qga-qmp-marshal.c :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")

 qapi-types.c qapi-types.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o "." < $<, "  GEN   $@")
 qapi-visit.c qapi-visit.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o "."  < $<, "  GEN   $@")
 qmp-commands.h qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -m -o "." < $<, "  GEN   $@")

-QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
-$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
+QGALIB_OBJ=$(addprefix $(qapi-dir)/, qga-qapi-types.o qga-qapi-visit.o qga-qmp-marshal.o)
+QGALIB_GEN=$(addprefix $(qapi-dir)/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
+$(QGALIB_OBJ): $(QGALIB_GEN) $(GENERATED_HEADERS)
+$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN) $(GENERATED_HEADERS)

-qemu-ga$(EXESUF): $(qga-obj-y) libqemuutil.a libqemustub.a
-	$(call LINK, $^)
+qemu-ga$(EXESUF): qemu-ga.o $(qga-obj-y) $(tools-obj-y) $(qapi-obj-y) $(qobject-obj-y) $(version-obj-y) $(QGALIB_OBJ)
+
+QEMULIBS=libhw32 libhw64 libuser libdis libdis-user

 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
-	find . -name '*.[oda]' -type f -exec rm -f {} +
-	find . -name '*.l[oa]' -type f -exec rm -f {} +
-	rm -f $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
+	rm -f *.o *.d *.a *.lo $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
 	rm -Rf .libs
+	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d qapi/*.o qapi/*.d qga/*.o qga/*.d
+	rm -f qom/*.o qom/*.d
 	rm -f qemu-img-cmds.h
+	rm -f trace/*.o trace/*.d
+	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
 	@# May not be present in GENERATED_HEADERS
-	rm -f trace/generated-tracers-dtrace.dtrace*
-	rm -f trace/generated-tracers-dtrace.h*
+	rm -f trace-dtrace.h trace-dtrace.h-timestamp
 	rm -f $(foreach f,$(GENERATED_HEADERS),$(f) $(f)-timestamp)
 	rm -f $(foreach f,$(GENERATED_SOURCES),$(f) $(f)-timestamp)
-	rm -rf qapi-generated
-	rm -rf qga/qapi-generated
+	rm -rf $(qapi-dir)
 	$(MAKE) -C tests/tcg clean
-	for d in $(ALL_SUBDIRS); do \
+	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
 	if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
 	rm -f $$d/qemu-options.def; \
        done

-VERSION ?= $(shell cat VERSION)
-
-dist: qemu-$(VERSION).tar.bz2
-
-qemu-%.tar.bz2:
-	$(SRC_PATH)/scripts/make-release "$(SRC_PATH)" "$(patsubst qemu-%.tar.bz2,%,$@)"
-
 distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi
-	rm -f config-all-devices.mak config-all-disas.mak
+	rm -f config-all-devices.mak
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
 	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps qemu-doc.dvi
 	rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys
@@ -269,31 +243,25 @@ distclean: clean
 	rm -f config.log
 	rm -f linux-headers/asm
 	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
-	for d in $(TARGET_DIRS); do \
+	for d in $(TARGET_DIRS) $(QEMULIBS); do \
 	rm -rf $$d || exit 1 ; \
        done
-	if test -f pixman/config.log; then make -C pixman distclean; fi
-	if test -f dtc/version_gen.h; then make $(DTC_MAKE_ARGS) clean; fi

 KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
-common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr \
-bepo
+common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr

 ifdef INSTALL_BLOBS
 BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
-acpi-dsdt.aml q35-acpi-dsdt.aml \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
-efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
-efi-pcnet.rom efi-rtl8139.rom efi-virtio.rom \
 qemu-icon.bmp \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
+mpc8544ds.dtb \
 multiboot.bin linuxboot.bin kvmvapic.bin \
 s390-zipl.rom \
-s390-ccw.img \
 spapr-rtas.bin slof.bin \
 palcode-clipper
 else
@@ -323,6 +291,7 @@ install-confdir:

 install-sysconfig: install-datadir install-confdir
 	$(INSTALL_DATA) $(SRC_PATH)/sysconfigs/target/target-x86_64.conf "$(DESTDIR)$(qemu_confdir)"
+	$(INSTALL_DATA) $(SRC_PATH)/sysconfigs/target/cpus-x86_64.conf "$(DESTDIR)$(qemu_datadir)"

 install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig install-datadir
 	$(INSTALL_DIR) "$(DESTDIR)$(bindir)"
@@ -337,9 +306,6 @@ ifneq ($(BLOBS),)
 	set -e; for x in $(BLOBS); do \
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(qemu_datadir)"; \
 	done
-endif
-ifeq ($(CONFIG_GTK),y)
-	$(MAKE) -C po $@
 endif
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/keymaps"
 	set -e; for x in $(KEYMAPS); do \
@@ -355,8 +321,7 @@ test speed: all

 .PHONY: TAGS
 TAGS:
-	rm -f $@
-	find "$(SRC_PATH)" -name '*.[hc]' -exec etags --append {} +
+	find "$(SRC_PATH)" -name '*.[hc]' -print0 | xargs -0 etags

 cscope:
 	rm -f ./cscope.*
@@ -425,12 +390,15 @@ qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-monitor.texi qemu-img-cmds.texi

-# Add a dependency on the generated files, so that they are always
-# rebuilt before other object files
-ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
-Makefile: $(GENERATED_HEADERS)
-endif
+VERSION ?= $(shell cat VERSION)
+FILE = qemu-$(VERSION)
+
+# tar release (use 'make -k tar' on a checkouted tree)
+tar:
+	rm -rf /tmp/$(FILE)
+	cp -r . /tmp/$(FILE)
+	cd /tmp && tar zcvf ~/$(FILE).tar.gz $(FILE) --exclude CVS --exclude .git --exclude .svn
+	rm -rf /tmp/$(FILE)

 # Include automatically generated dependency files
-# Dependencies in Makefile.objs files come from our recursive subdir rules
-include $(wildcard *.d tests/*.d)
+-include $(wildcard *.d audio/*.d slirp/*.d block/*.d net/*.d ui/*.d qapi/*.d qga/*.d)
--- a/Makefile.dis
+++ b/Makefile.dis
@@ -0,0 +1,23 @@
+# Makefile for disassemblers.
+
+include ../config-host.mak
+include config.mak
+include $(SRC_PATH)/rules.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(libdis-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	rm -f *.o *.d *.a *~
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -0,0 +1,25 @@
+# Makefile for qemu target independent devices.
+
+include ../config-host.mak
+include ../config-all-devices.mak
+include config.mak
+include $(SRC_PATH)/rules.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)
+
+QEMU_CFLAGS+=-I..
+QEMU_CFLAGS += -I$(SRC_PATH)/include
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(hw-obj-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	rm -f *.o */*.o *.d */*.d *.a */*.a *~ */*~
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,107 +1,471 @@
 #######################################################################
-# Common libraries for tools and emulators
-stub-obj-y = stubs/
-util-obj-y = util/ qobject/ qapi/ trace/
+# Target-independent parts used in system and user emulation
+universal-obj-y =
+
+#######################################################################
+# QObject
+qobject-obj-y = qint.o qstring.o qdict.o qlist.o qfloat.o qbool.o
+qobject-obj-y += qjson.o json-lexer.o json-streamer.o json-parser.o
+qobject-obj-y += qerror.o error.o qemu-error.o
+
+universal-obj-y += $(qobject-obj-y)
+
+#######################################################################
+# QOM
+include $(SRC_PATH)/qom/Makefile
+qom-obj-y = $(addprefix qom/, $(qom-y))
+qom-obj-twice-y = $(addprefix qom/, $(qom-twice-y))
+
+universal-obj-y += $(qom-obj-y)
+
+#######################################################################
+# oslib-obj-y is code depending on the OS (win32 vs posix)
+oslib-obj-y = osdep.o
+oslib-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o
+oslib-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o
+
+#######################################################################
+# coroutines
+coroutine-obj-y = qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
+coroutine-obj-y += qemu-coroutine-sleep.o
+ifeq ($(CONFIG_UCONTEXT_COROUTINE),y)
+coroutine-obj-$(CONFIG_POSIX) += coroutine-ucontext.o
+else
+ifeq ($(CONFIG_SIGALTSTACK_COROUTINE),y)
+coroutine-obj-$(CONFIG_POSIX) += coroutine-sigaltstack.o
+else
+coroutine-obj-$(CONFIG_POSIX) += coroutine-gthread.o
+endif
+endif
+coroutine-obj-$(CONFIG_WIN32) += coroutine-win32.o

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = async.o thread-pool.o
-block-obj-y += nbd.o block.o blockjob.o
-block-obj-y += main-loop.o iohandler.o qemu-timer.o
-block-obj-$(CONFIG_POSIX) += aio-posix.o
-block-obj-$(CONFIG_WIN32) += aio-win32.o
-block-obj-y += block/
-block-obj-y += qapi-types.o qapi-visit.o
+block-obj-y = cutils.o cache-utils.o qemu-option.o module.o async.o
+block-obj-y += nbd.o block.o aio.o aes.o qemu-config.o qemu-progress.o qemu-sockets.o
+block-obj-y += $(coroutine-obj-y) $(qobject-obj-y) $(version-obj-y)
+block-obj-$(CONFIG_POSIX) += posix-aio-compat.o
+block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o

-block-obj-y += qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
-block-obj-y += qemu-coroutine-sleep.o
-block-obj-y += coroutine-$(CONFIG_COROUTINE_BACKEND).o
+block-nested-y += raw.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o vvfat.o
+block-nested-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
+block-nested-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
+block-nested-y += qed-check.o
+block-nested-y += parallels.o nbd.o blkdebug.o sheepdog.o blkverify.o
+block-nested-y += stream.o
+block-nested-$(CONFIG_WIN32) += raw-win32.o
+block-nested-$(CONFIG_POSIX) += raw-posix.o
+block-nested-$(CONFIG_LIBISCSI) += iscsi.o
+block-nested-$(CONFIG_CURL) += curl.o
+block-nested-$(CONFIG_RBD) += rbd.o
+
+block-obj-y +=  $(addprefix block/, $(block-nested-y))
+
+net-obj-y = net.o
+net-nested-y = queue.o checksum.o util.o
+net-nested-y += socket.o
+net-nested-y += dump.o
+net-nested-$(CONFIG_POSIX) += tap.o
+net-nested-$(CONFIG_LINUX) += tap-linux.o
+net-nested-$(CONFIG_WIN32) += tap-win32.o
+net-nested-$(CONFIG_BSD) += tap-bsd.o
+net-nested-$(CONFIG_SOLARIS) += tap-solaris.o
+net-nested-$(CONFIG_AIX) += tap-aix.o
+net-nested-$(CONFIG_HAIKU) += tap-haiku.o
+net-nested-$(CONFIG_SLIRP) += slirp.o
+net-nested-$(CONFIG_VDE) += vde.o
+net-obj-y += $(addprefix net/, $(net-nested-y))

 ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS)$(CONFIG_PCI),yyy)
 # Lots of the fsdev/9pcode is pulled in by vl.c via qemu_fsdev_add.
 # only pull in the actual virtio-9p device if we also enabled virtio.
 CONFIG_REALLY_VIRTFS=y
+fsdev-nested-y = qemu-fsdev.o virtio-9p-marshal.o
+else
+fsdev-nested-y = qemu-fsdev-dummy.o
 endif
-
-######################################################################
-# smartcard
-
-libcacard-y += libcacard/cac.o libcacard/event.o
-libcacard-y += libcacard/vcard.o libcacard/vreader.o
-libcacard-y += libcacard/vcard_emul_nss.o
-libcacard-y += libcacard/vcard_emul_type.o
-libcacard-y += libcacard/card_7816.o
-libcacard-y += libcacard/vcardt.o
+fsdev-obj-$(CONFIG_VIRTFS) += $(addprefix fsdev/, $(fsdev-nested-y))

 ######################################################################
 # Target independent part of system emulation. The long term path is to
 # suppress *all* target specific code in case of system emulation, i.e. a
 # single QEMU executable should support all CPUs and machines.

-ifeq ($(CONFIG_SOFTMMU),y)
-common-obj-y = $(block-obj-y) blockdev.o blockdev-nbd.o block/
-common-obj-y += net/
-common-obj-y += readline.o
-common-obj-y += qdev-monitor.o device-hotplug.o
+common-obj-y = $(block-obj-y) blockdev.o
+common-obj-y += $(net-obj-y)
+common-obj-y += $(qom-obj-twice-y)
+common-obj-$(CONFIG_LINUX) += $(fsdev-obj-$(CONFIG_LINUX))
+common-obj-y += readline.o console.o cursor.o
+common-obj-y += $(oslib-obj-y)
 common-obj-$(CONFIG_WIN32) += os-win32.o
 common-obj-$(CONFIG_POSIX) += os-posix.o

-common-obj-$(CONFIG_LINUX) += fsdev/
-
-common-obj-y += migration.o migration-tcp.o
+common-obj-y += tcg-runtime.o host-utils.o main-loop.o
+common-obj-y += irq.o input.o
+common-obj-$(CONFIG_PTIMER) += ptimer.o
+common-obj-$(CONFIG_MAX7310) += max7310.o
+common-obj-$(CONFIG_WM8750) += wm8750.o
+common-obj-$(CONFIG_TWL92230) += twl92230.o
+common-obj-$(CONFIG_TSC2005) += tsc2005.o
+common-obj-$(CONFIG_LM832X) += lm832x.o
+common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_STELLARIS_INPUT) += stellaris_input.o
+common-obj-$(CONFIG_SSD0303) += ssd0303.o
+common-obj-$(CONFIG_SSD0323) += ssd0323.o
+common-obj-$(CONFIG_ADS7846) += ads7846.o
+common-obj-$(CONFIG_MAX111X) += max111x.o
+common-obj-$(CONFIG_DS1338) += ds1338.o
+common-obj-y += i2c.o smbus.o smbus_eeprom.o
+common-obj-y += eeprom93xx.o
+common-obj-y += scsi-disk.o cdrom.o
+common-obj-y += scsi-generic.o scsi-bus.o
+common-obj-y += hid.o
+common-obj-y += usb/core.o usb/bus.o usb/desc.o usb/dev-hub.o
+common-obj-y += usb/host-$(HOST_USB).o
+common-obj-y += usb/dev-hid.o usb/dev-storage.o usb/dev-wacom.o
+common-obj-y += usb/dev-serial.o usb/dev-network.o usb/dev-audio.o
+common-obj-$(CONFIG_SSI) += ssi.o
+common-obj-$(CONFIG_SSI_SD) += ssi-sd.o
+common-obj-$(CONFIG_SD) += sd.o
+common-obj-y += bt.o bt-host.o bt-vhci.o bt-l2cap.o bt-sdp.o bt-hci.o bt-hid.o
+common-obj-y += bt-hci-csr.o usb/dev-bluetooth.o
+common-obj-y += buffered_file.o migration.o migration-tcp.o
 common-obj-y += qemu-char.o #aio.o
-common-obj-y += block-migration.o
-common-obj-y += page_cache.o xbzrle.o
+common-obj-y += msmouse.o ps2.o
+common-obj-y += qdev.o qdev-properties.o qdev-monitor.o
+common-obj-y += block-migration.o iohandler.o
+common-obj-y += pflib.o
+common-obj-y += bitmap.o bitops.o

+common-obj-$(CONFIG_BRLAPI) += baum.o
 common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
+common-obj-$(CONFIG_WIN32) += version.o

-common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
+common-obj-$(CONFIG_SPICE) += ui/spice-core.o ui/spice-input.o ui/spice-display.o spice-qemu-char.o

-common-obj-y += audio/
-common-obj-y += hw/
+audio-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
+audio-obj-$(CONFIG_SDL) += sdlaudio.o
+audio-obj-$(CONFIG_OSS) += ossaudio.o
+audio-obj-$(CONFIG_SPICE) += spiceaudio.o
+audio-obj-$(CONFIG_COREAUDIO) += coreaudio.o
+audio-obj-$(CONFIG_ALSA) += alsaaudio.o
+audio-obj-$(CONFIG_DSOUND) += dsoundaudio.o
+audio-obj-$(CONFIG_FMOD) += fmodaudio.o
+audio-obj-$(CONFIG_ESD) += esdaudio.o
+audio-obj-$(CONFIG_PA) += paaudio.o
+audio-obj-$(CONFIG_WINWAVE) += winwaveaudio.o
+audio-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
+audio-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
+audio-obj-y += wavcapture.o
+common-obj-y += $(addprefix audio/, $(audio-obj-y))

-common-obj-y += ui/
-common-obj-y += bt-host.o bt-vhci.o
+ui-obj-y += keymaps.o
+ui-obj-$(CONFIG_SDL) += sdl.o sdl_zoom.o x_keymap.o
+ui-obj-$(CONFIG_COCOA) += cocoa.o
+ui-obj-$(CONFIG_CURSES) += curses.o
+vnc-obj-y += vnc.o d3des.o
+vnc-obj-y += vnc-enc-zlib.o vnc-enc-hextile.o
+vnc-obj-y += vnc-enc-tight.o vnc-palette.o
+vnc-obj-y += vnc-enc-zrle.o
+vnc-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
+vnc-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
+ifdef CONFIG_VNC_THREAD
+vnc-obj-y += vnc-jobs-async.o
+else
+vnc-obj-y += vnc-jobs-sync.o
+endif
+common-obj-y += $(addprefix ui/, $(ui-obj-y))
+common-obj-$(CONFIG_VNC) += $(addprefix ui/, $(vnc-obj-y))

-common-obj-y += dma-helpers.o
-common-obj-y += vl.o
-common-obj-y += tpm.o
+common-obj-y += iov.o acl.o
+common-obj-$(CONFIG_POSIX) += compatfd.o
+common-obj-y += notify.o event_notifier.o
+common-obj-y += qemu-timer.o qemu-timer-common.o

-common-obj-$(CONFIG_SLIRP) += slirp/
+slirp-obj-y = cksum.o if.o ip_icmp.o ip_input.o ip_output.o
+slirp-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
+slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o arp_table.o
+common-obj-$(CONFIG_SLIRP) += $(addprefix slirp/, $(slirp-obj-y))

-common-obj-y += backends/
+# xen backend driver support
+common-obj-$(CONFIG_XEN_BACKEND) += xen_backend.o xen_devconfig.o
+common-obj-$(CONFIG_XEN_BACKEND) += xen_console.o xenfb.o xen_disk.o xen_nic.o

-common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
+######################################################################
+# libuser

-common-obj-$(CONFIG_SMARTCARD_NSS) += $(libcacard-y)
+user-obj-y =
+user-obj-y += envlist.o path.o
+user-obj-y += tcg-runtime.o host-utils.o
+user-obj-y += cutils.o cache-utils.o
+user-obj-y += module.o
+user-obj-y += qemu-user.o
+user-obj-y += $(trace-obj-y)
+user-obj-y += $(qom-obj-twice-y)
+
+######################################################################
+# libhw
+
+hw-obj-y =
+hw-obj-y += vl.o loader.o
+hw-obj-$(CONFIG_VIRTIO) += virtio-console.o
+hw-obj-y += usb/libhw.o
+hw-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
+hw-obj-y += fw_cfg.o
+hw-obj-$(CONFIG_PCI) += pci.o pci_bridge.o pci_bridge_dev.o
+hw-obj-$(CONFIG_PCI) += msix.o msi.o
+hw-obj-$(CONFIG_PCI) += shpc.o
+hw-obj-$(CONFIG_PCI) += slotid_cap.o
+hw-obj-$(CONFIG_PCI) += pci_host.o pcie_host.o
+hw-obj-$(CONFIG_PCI) += ioh3420.o xio3130_upstream.o xio3130_downstream.o
+hw-obj-y += watchdog.o
+hw-obj-$(CONFIG_ISA_MMIO) += isa_mmio.o
+hw-obj-$(CONFIG_ECC) += ecc.o
+hw-obj-$(CONFIG_NAND) += nand.o
+hw-obj-$(CONFIG_PFLASH_CFI01) += pflash_cfi01.o
+hw-obj-$(CONFIG_PFLASH_CFI02) += pflash_cfi02.o
+
+hw-obj-$(CONFIG_M48T59) += m48t59.o
+hw-obj-$(CONFIG_ESCC) += escc.o
+hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
+
+hw-obj-$(CONFIG_SERIAL) += serial.o
+hw-obj-$(CONFIG_PARALLEL) += parallel.o
+hw-obj-$(CONFIG_I8254) += i8254_common.o i8254.o
+hw-obj-$(CONFIG_PCSPK) += pcspk.o
+hw-obj-$(CONFIG_PCKBD) += pckbd.o
+hw-obj-$(CONFIG_USB_UHCI) += usb/hcd-uhci.o
+hw-obj-$(CONFIG_USB_OHCI) += usb/hcd-ohci.o
+hw-obj-$(CONFIG_USB_EHCI) += usb/hcd-ehci.o
+hw-obj-$(CONFIG_USB_XHCI) += usb/hcd-xhci.o
+hw-obj-$(CONFIG_FDC) += fdc.o
+hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
+hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
+hw-obj-$(CONFIG_DMA) += dma.o
+hw-obj-$(CONFIG_I82374) += i82374.o
+hw-obj-$(CONFIG_HPET) += hpet.o
+hw-obj-$(CONFIG_APPLESMC) += applesmc.o
+hw-obj-$(CONFIG_SMARTCARD) += usb/dev-smartcard-reader.o ccid-card-passthru.o
+hw-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
+hw-obj-$(CONFIG_USB_REDIR) += usb/redirect.o
+hw-obj-$(CONFIG_I8259) += i8259_common.o i8259.o
+
+# PPC devices
+hw-obj-$(CONFIG_PREP_PCI) += prep_pci.o
+hw-obj-$(CONFIG_I82378) += i82378.o
+# Mac shared devices
+hw-obj-$(CONFIG_MACIO) += macio.o
+hw-obj-$(CONFIG_CUDA) += cuda.o
+hw-obj-$(CONFIG_ADB) += adb.o
+hw-obj-$(CONFIG_MAC_NVRAM) += mac_nvram.o
+hw-obj-$(CONFIG_MAC_DBDMA) += mac_dbdma.o
+# OldWorld PowerMac
+hw-obj-$(CONFIG_HEATHROW_PIC) += heathrow_pic.o
+hw-obj-$(CONFIG_GRACKLE_PCI) += grackle_pci.o
+# NewWorld PowerMac
+hw-obj-$(CONFIG_UNIN_PCI) += unin_pci.o
+hw-obj-$(CONFIG_DEC_PCI) += dec_pci.o
+# PowerPC E500 boards
+hw-obj-$(CONFIG_PPCE500_PCI) += ppce500_pci.o
+
+# MIPS devices
+hw-obj-$(CONFIG_PIIX4) += piix4.o
+hw-obj-$(CONFIG_G364FB) += g364fb.o
+hw-obj-$(CONFIG_JAZZ_LED) += jazz_led.o
+
+# PCI watchdog devices
+hw-obj-$(CONFIG_PCI) += wdt_i6300esb.o
+
+hw-obj-$(CONFIG_PCI) += pcie.o pcie_aer.o pcie_port.o
+
+# PCI network cards
+hw-obj-$(CONFIG_NE2000_PCI) += ne2000.o
+hw-obj-$(CONFIG_EEPRO100_PCI) += eepro100.o
+hw-obj-$(CONFIG_PCNET_PCI) += pcnet-pci.o
+hw-obj-$(CONFIG_PCNET_COMMON) += pcnet.o
+hw-obj-$(CONFIG_E1000_PCI) += e1000.o
+hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
+
+hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
+hw-obj-$(CONFIG_LAN9118) += lan9118.o
+hw-obj-$(CONFIG_NE2000_ISA) += ne2000-isa.o
+hw-obj-$(CONFIG_OPENCORES_ETH) += opencores_eth.o
+
+# IDE
+hw-obj-$(CONFIG_IDE_CORE) += ide/core.o ide/atapi.o
+hw-obj-$(CONFIG_IDE_QDEV) += ide/qdev.o
+hw-obj-$(CONFIG_IDE_PCI) += ide/pci.o
+hw-obj-$(CONFIG_IDE_ISA) += ide/isa.o
+hw-obj-$(CONFIG_IDE_PIIX) += ide/piix.o
+hw-obj-$(CONFIG_IDE_CMD646) += ide/cmd646.o
+hw-obj-$(CONFIG_IDE_MACIO) += ide/macio.o
+hw-obj-$(CONFIG_IDE_VIA) += ide/via.o
+hw-obj-$(CONFIG_AHCI) += ide/ahci.o
+hw-obj-$(CONFIG_AHCI) += ide/ich.o
+
+# SCSI layer
+hw-obj-$(CONFIG_LSI_SCSI_PCI) += lsi53c895a.o
+hw-obj-$(CONFIG_ESP) += esp.o
+
+hw-obj-y += dma-helpers.o sysbus.o isa-bus.o
+hw-obj-y += qdev-addr.o
+
+# VGA
+hw-obj-$(CONFIG_VGA_PCI) += vga-pci.o
+hw-obj-$(CONFIG_VGA_ISA) += vga-isa.o
+hw-obj-$(CONFIG_VGA_ISA_MM) += vga-isa-mm.o
+hw-obj-$(CONFIG_VMWARE_VGA) += vmware_vga.o
+hw-obj-$(CONFIG_VMMOUSE) += vmmouse.o
+hw-obj-$(CONFIG_VGA_CIRRUS) += cirrus_vga.o
+
+hw-obj-$(CONFIG_RC4030) += rc4030.o
+hw-obj-$(CONFIG_DP8393X) += dp8393x.o
+hw-obj-$(CONFIG_DS1225Y) += ds1225y.o
+hw-obj-$(CONFIG_MIPSNET) += mipsnet.o
+
+hw-obj-y += qtest.o
+
+# Sound
+sound-obj-y =
+sound-obj-$(CONFIG_SB16) += sb16.o
+sound-obj-$(CONFIG_ES1370) += es1370.o
+sound-obj-$(CONFIG_AC97) += ac97.o
+sound-obj-$(CONFIG_ADLIB) += fmopl.o adlib.o
+sound-obj-$(CONFIG_GUS) += gus.o gusemu_hal.o gusemu_mixer.o
+sound-obj-$(CONFIG_CS4231A) += cs4231a.o
+sound-obj-$(CONFIG_HDA) += intel-hda.o hda-audio.o
+
+adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
+hw-obj-$(CONFIG_SOUND) += $(sound-obj-y)
+
+9pfs-nested-$(CONFIG_VIRTFS)  = virtio-9p.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-coth.o cofs.o codir.o cofile.o
+9pfs-nested-$(CONFIG_VIRTFS) += coxattr.o virtio-9p-synth.o
+9pfs-nested-$(CONFIG_OPEN_BY_HANDLE) +=  virtio-9p-handle.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-proxy.o
+
+hw-obj-$(CONFIG_REALLY_VIRTFS) += $(addprefix 9pfs/, $(9pfs-nested-y))
+
+######################################################################
+# libdis
+# NOTE: the disassembler code is only needed for debugging
+
+libdis-y =
+libdis-$(CONFIG_ALPHA_DIS) += alpha-dis.o
+libdis-$(CONFIG_ARM_DIS) += arm-dis.o
+libdis-$(CONFIG_CRIS_DIS) += cris-dis.o
+libdis-$(CONFIG_HPPA_DIS) += hppa-dis.o
+libdis-$(CONFIG_I386_DIS) += i386-dis.o
+libdis-$(CONFIG_IA64_DIS) += ia64-dis.o
+libdis-$(CONFIG_M68K_DIS) += m68k-dis.o
+libdis-$(CONFIG_MICROBLAZE_DIS) += microblaze-dis.o
+libdis-$(CONFIG_MIPS_DIS) += mips-dis.o
+libdis-$(CONFIG_PPC_DIS) += ppc-dis.o
+libdis-$(CONFIG_S390_DIS) += s390-dis.o
+libdis-$(CONFIG_SH4_DIS) += sh4-dis.o
+libdis-$(CONFIG_SPARC_DIS) += sparc-dis.o
+libdis-$(CONFIG_LM32_DIS) += lm32-dis.o
+
+######################################################################
+# trace
+
+ifeq ($(TRACE_BACKEND),dtrace)
+TRACE_H_EXTRA_DEPS=trace-dtrace.h
+endif
+trace.h: trace.h-timestamp $(TRACE_H_EXTRA_DEPS)
+trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=h \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.h")
+	@cmp -s $@ trace.h || cp $@ trace.h
+
+trace.c: trace.c-timestamp
+trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=c \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.c")
+	@cmp -s $@ trace.c || cp $@ trace.c
+
+trace.o: trace.c $(GENERATED_HEADERS)
+
+trace-dtrace.h: trace-dtrace.dtrace
+	$(call quiet-command,dtrace -o $@ -h -s $<, "  GEN   trace-dtrace.h")
+
+# Normal practice is to name DTrace probe file with a '.d' extension
+# but that gets picked up by QEMU's Makefile as an external dependency
+# rule file. So we use '.dtrace' instead
+trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=d \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace-dtrace.dtrace")
+	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
+
+trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
+	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN   trace-dtrace.o")
+
+ifeq ($(LIBTOOL),)
+trace-dtrace.lo: trace-dtrace.dtrace
+	@echo "missing libtool. please install and rerun configure."; exit 1
+else
+trace-dtrace.lo: trace-dtrace.dtrace
+	$(call quiet-command,$(LIBTOOL) --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
+endif
+
+trace/simple.o: trace/simple.c $(GENERATED_HEADERS)
+
+trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace.o
+ifneq ($(TRACE_BACKEND),dtrace)
+trace-obj-y = trace.o
+endif
+
+trace-nested-$(CONFIG_TRACE_DEFAULT) += default.o
+
+trace-nested-$(CONFIG_TRACE_SIMPLE) += simple.o
+trace-obj-$(CONFIG_TRACE_SIMPLE) += qemu-timer-common.o
+
+trace-nested-$(CONFIG_TRACE_STDERR) += stderr.o
+
+trace-nested-y += control.o
+
+trace-obj-y += $(addprefix trace/, $(trace-nested-y))
+
+$(trace-obj-y): $(GENERATED_HEADERS)
+
+######################################################################
+# smartcard
+
+libcacard-y = cac.o event.o vcard.o vreader.o vcard_emul_nss.o vcard_emul_type.o card_7816.o

 ######################################################################
 # qapi

-common-obj-y += qmp-marshal.o
+qapi-nested-y = qapi-visit-core.o qapi-dealloc-visitor.o qmp-input-visitor.o
+qapi-nested-y += qmp-output-visitor.o qmp-registry.o qmp-dispatch.o
+qapi-nested-y += string-input-visitor.o string-output-visitor.o
+qapi-obj-y = $(addprefix qapi/, $(qapi-nested-y))
+
+common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o
 common-obj-y += qmp.o hmp.o
-endif

-######################################################################
-# some qapi visitors are used by both system and user emulation:
-
-common-obj-y += qapi-visit.o qapi-types.o
-
-#######################################################################
-# Target-independent parts used in system and user emulation
-common-obj-y += qemu-log.o
-common-obj-y += tcg-runtime.o
-common-obj-y += hw/
-common-obj-y += qom/
-common-obj-y += disas/
+universal-obj-y += $(qapi-obj-y)

 ######################################################################
 # guest agent

-# FIXME: a few definitions from qapi-types.o/qapi-visit.o are needed
-# by libqemuutil.a.  These should be moved to a separate .json schema.
-qga-obj-y = qga/ qapi-types.o qapi-visit.o
+qga-nested-y = commands.o guest-agent-command-state.o
+qga-nested-$(CONFIG_POSIX) += commands-posix.o channel-posix.o
+qga-nested-$(CONFIG_WIN32) += commands-win32.o channel-win32.o service-win32.o
+qga-obj-y = $(addprefix qga/, $(qga-nested-y))
+qga-obj-y += qemu-ga.o module.o
+qga-obj-$(CONFIG_WIN32) += oslib-win32.o
+qga-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-sockets.o qemu-option.o

 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

@@ -109,10 +473,3 @@ vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)

 QEMU_CFLAGS+=$(GLIB_CFLAGS)

-nested-vars += \
-	stub-obj-y \
-	util-obj-y \
-	qga-obj-y \
-	block-obj-y \
-	common-obj-y
-dummy := $(call unnest-vars)
--- a/Makefile.target
+++ b/Makefile.target
@@ -1,15 +1,26 @@
 # -*- Mode: makefile -*-

-include ../config-host.mak
-include config-target.mak
-include config-devices.mak
-include $(SRC_PATH)/rules.mak
+GENERATED_HEADERS = config-target.h
+CONFIG_NO_PCI = $(if $(subst n,,$(CONFIG_PCI)),n,y)
+CONFIG_NO_KVM = $(if $(subst n,,$(CONFIG_KVM)),n,y)
+CONFIG_NO_XEN = $(if $(subst n,,$(CONFIG_XEN)),n,y)

-$(call set-vpath, $(SRC_PATH))
+include ../config-host.mak
+include config-devices.mak
+include config-target.mak
+include $(SRC_PATH)/rules.mak
+ifneq ($(HWDIR),)
+include $(HWDIR)/config.mak
+endif
+
+TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
+$(call set-vpath, $(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw)
 ifdef CONFIG_LINUX
 QEMU_CFLAGS += -I../linux-headers
 endif
-QEMU_CFLAGS += -I.. -I$(SRC_PATH)/target-$(TARGET_BASE_ARCH) -DNEED_CPU_H
+QEMU_CFLAGS += -I.. -I$(TARGET_PATH) -DNEED_CPU_H
+
+include $(SRC_PATH)/Makefile.objs

 QEMU_CFLAGS+=-I$(SRC_PATH)/include

@@ -18,7 +29,7 @@ ifdef CONFIG_USER_ONLY
 QEMU_PROG=qemu-$(TARGET_ARCH2)
 else
 # system emulator name
-ifneq (,$(findstring -mwindows,$(libs_softmmu)))
+ifneq (,$(findstring -mwindows,$(LIBS)))
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_ARCH2)w$(EXESUF)
 endif # windows executable
@@ -31,6 +42,10 @@ PROGS+=$(QEMU_PROGW)
 endif
 STPFILES=

+ifndef CONFIG_HAIKU
+LIBS+=-lm
+endif
+
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

@@ -50,7 +65,7 @@ $(QEMU_PROG).stp: $(SRC_PATH)/trace-events
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-arch=$(TARGET_ARCH) \
 		--target-type=$(TARGET_TYPE) \
-		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG).stp")
+		< $< > $@,"  GEN   $(QEMU_PROG).stp")
 else
 stap:
 endif
@@ -60,33 +75,80 @@ all: $(PROGS) stap
 # Dummy command so that make thinks it has done something
 	@true

-CONFIG_NO_PCI = $(if $(subst n,,$(CONFIG_PCI)),n,y)
-CONFIG_NO_KVM = $(if $(subst n,,$(CONFIG_KVM)),n,y)
-CONFIG_NO_XEN = $(if $(subst n,,$(CONFIG_XEN)),n,y)
-CONFIG_NO_GET_MEMORY_MAPPING = $(if $(subst n,,$(CONFIG_HAVE_GET_MEMORY_MAPPING)),n,y)
-CONFIG_NO_CORE_DUMP = $(if $(subst n,,$(CONFIG_HAVE_CORE_DUMP)),n,y)
-
 #########################################################
 # cpu emulator library
-obj-y = exec.o translate-all.o cpu-exec.o
-obj-y += tcg/tcg.o tcg/optimize.o
-obj-$(CONFIG_TCG_INTERPRETER) += tci.o
-obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
-obj-y += fpu/softfloat.o
-obj-y += target-$(TARGET_BASE_ARCH)/
-obj-y += disas.o
-obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o
-obj-$(CONFIG_NO_KVM) += kvm-stub.o
+libobj-y = exec.o translate-all.o cpu-exec.o translate.o
+libobj-y += tcg/tcg.o tcg/optimize.o
+libobj-$(CONFIG_TCG_INTERPRETER) += tci.o
+libobj-y += fpu/softfloat.o
+ifneq ($(TARGET_BASE_ARCH), sparc)
+ifneq ($(TARGET_BASE_ARCH), alpha)
+libobj-y += op_helper.o
+endif
+endif
+libobj-y += helper.o
+ifneq ($(TARGET_BASE_ARCH), ppc)
+libobj-y += cpu.o
+endif
+libobj-$(TARGET_SPARC64) += vis_helper.o
+libobj-$(CONFIG_NEED_MMU) += mmu.o
+libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
+ifeq ($(TARGET_BASE_ARCH), sparc)
+libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
+endif
+libobj-$(TARGET_SPARC) += int32_helper.o
+libobj-$(TARGET_SPARC64) += int64_helper.o
+libobj-$(TARGET_ALPHA) += int_helper.o fpu_helper.o sys_helper.o mem_helper.o
+
+libobj-y += disas.o
+libobj-$(CONFIG_TCI_DIS) += tci-dis.o
+
+tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci
+
+$(libobj-y): $(GENERATED_HEADERS)
+
+# HELPER_CFLAGS is used for all the legacy code compiled with static register
+# variables
+ifneq ($(TARGET_BASE_ARCH), sparc)
+op_helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+endif
+user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+
+# Note: this is a workaround. The real fix is to avoid compiling
+# cpu_signal_handler() in user-exec.c.
+signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)

 #########################################################
 # Linux user emulator target

 ifdef CONFIG_LINUX_USER

-QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
+$(call set-vpath, $(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR))

-obj-y += linux-user/
-obj-y += gdbstub.o thunk.o user-exec.o
+QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
+obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
+      elfload.o linuxload.o uaccess.o gdbstub.o cpu-uname.o \
+      user-exec.o $(oslib-obj-y)
+
+obj-$(TARGET_HAS_BFLT) += flatload.o
+
+obj-$(TARGET_I386) += vm86.o
+
+obj-i386-y += ioport-user.o
+
+nwfpe-obj-y = fpa11.o fpa11_cpdo.o fpa11_cpdt.o fpa11_cprt.o fpopcode.o
+nwfpe-obj-y += single_cpdo.o double_cpdo.o extended_cpdo.o
+obj-arm-y +=  $(addprefix nwfpe/, $(nwfpe-obj-y))
+obj-arm-y += arm-semi.o
+
+obj-m68k-y += m68k-sim.o m68k-semi.o
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../, $(universal-obj-y))
+obj-y += $(addprefix ../libuser/, $(user-obj-y))
+obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+obj-y += $(libobj-y)

 endif #CONFIG_LINUX_USER

@@ -95,68 +157,269 @@ endif #CONFIG_LINUX_USER

 ifdef CONFIG_BSD_USER

+$(call set-vpath, $(SRC_PATH)/bsd-user)
+
 QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)

-obj-y += bsd-user/
-obj-y += gdbstub.o user-exec.o
+obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
+        gdbstub.o uaccess.o user-exec.o
+
+obj-i386-y += ioport-user.o
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../, $(universal-obj-y))
+obj-y += $(addprefix ../libuser/, $(user-obj-y))
+obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+obj-y += $(libobj-y)

 endif #CONFIG_BSD_USER

 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
-obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o
-obj-y += qtest.o
-obj-y += hw/
-obj-$(CONFIG_FDT) += device_tree.o
-obj-$(CONFIG_KVM) += kvm-all.o
+
+obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o ioport.o
+# virtio has to be here due to weird dependency between PCI and virtio-net.
+# need to fix this properly
+obj-$(CONFIG_NO_PCI) += pci-stub.o
+obj-$(CONFIG_VIRTIO) += virtio.o virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial-bus.o
+obj-$(CONFIG_VIRTIO) += virtio-scsi.o
+obj-y += vhost_net.o
+obj-$(CONFIG_VHOST_NET) += vhost.o
+obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p-device.o
+obj-$(CONFIG_KVM) += kvm.o kvm-all.o
+obj-$(CONFIG_NO_KVM) += kvm-stub.o
+obj-$(CONFIG_VGA) += vga.o
 obj-y += memory.o savevm.o cputlb.o
-obj-$(CONFIG_HAVE_GET_MEMORY_MAPPING) += memory_mapping.o
-obj-$(CONFIG_HAVE_CORE_DUMP) += dump.o
-obj-$(CONFIG_NO_GET_MEMORY_MAPPING) += memory_mapping-stub.o
-obj-$(CONFIG_NO_CORE_DUMP) += dump-stub.o
-LIBS+=$(libs_softmmu)
+LIBS+=-lz
+
+obj-i386-$(CONFIG_KVM) += hyperv.o
+
+QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
+QEMU_CFLAGS += $(VNC_JPEG_CFLAGS)
+QEMU_CFLAGS += $(VNC_PNG_CFLAGS)

 # xen support
-obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
+obj-$(CONFIG_XEN) += xen-all.o xen_machine_pv.o xen_domainbuild.o xen-mapcache.o
 obj-$(CONFIG_NO_XEN) += xen-stub.o

-# Hardware support
-ifeq ($(TARGET_ARCH), sparc64)
-obj-y += hw/sparc64/
-else
-obj-y += hw/$(TARGET_BASE_ARCH)/
+obj-i386-$(CONFIG_XEN) += xen_platform.o xen_apic.o
+
+# Inter-VM PCI shared memory
+CONFIG_IVSHMEM =
+ifeq ($(CONFIG_KVM), y)
+  ifeq ($(CONFIG_PCI), y)
+    CONFIG_IVSHMEM = y
+  endif
 endif
+obj-$(CONFIG_IVSHMEM) += ivshmem.o
+
+# Generic hotplugging
+obj-y += device-hotplug.o
+
+# Hardware support
+obj-i386-y += mc146818rtc.o pc.o
+obj-i386-y += apic_common.o apic.o kvmvapic.o
+obj-i386-y += sga.o ioapic_common.o ioapic.o piix_pci.o
+obj-i386-y += vmport.o
+obj-i386-y += pci-hotplug.o smbios.o wdt_ib700.o
+obj-i386-y += debugcon.o multiboot.o
+obj-i386-y += pc_piix.o
+obj-i386-y += pc_sysfw.o
+obj-i386-$(CONFIG_KVM) += kvm/clock.o kvm/apic.o kvm/i8259.o kvm/ioapic.o kvm/i8254.o
+obj-i386-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o
+
+# shared objects
+obj-ppc-y = ppc.o ppc_booke.o
+# PREP target
+obj-ppc-y += mc146818rtc.o
+obj-ppc-y += ppc_prep.o
+# OldWorld PowerMac
+obj-ppc-y += ppc_oldworld.o
+# NewWorld PowerMac
+obj-ppc-y += ppc_newworld.o
+# IBM pSeries (sPAPR)
+obj-ppc-$(CONFIG_PSERIES) += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
+obj-ppc-$(CONFIG_PSERIES) += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
+obj-ppc-$(CONFIG_PSERIES) += spapr_pci.o device-hotplug.o pci-hotplug.o
+# PowerPC 4xx boards
+obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
+obj-ppc-y += ppc440_bamboo.o
+# PowerPC E500 boards
+obj-ppc-y += ppce500_mpc8544ds.o mpc8544_guts.o ppce500_spin.o
+# PowerPC 440 Xilinx ML507 reference board.
+obj-ppc-y += virtex_ml507.o
+obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
+obj-ppc-$(CONFIG_FDT) += device_tree.o
+# PowerPC OpenPIC
+obj-ppc-y += openpic.o
+
+# Xilinx PPC peripherals
+obj-ppc-y += xilinx_intc.o
+obj-ppc-y += xilinx_timer.o
+obj-ppc-y += xilinx_uartlite.o
+obj-ppc-y += xilinx_ethlite.o
+
+# LM32 boards
+obj-lm32-y += lm32_boards.o
+obj-lm32-y += milkymist.o
+
+# LM32 peripherals
+obj-lm32-y += lm32_pic.o
+obj-lm32-y += lm32_juart.o
+obj-lm32-y += lm32_timer.o
+obj-lm32-y += lm32_uart.o
+obj-lm32-y += lm32_sys.o
+obj-lm32-y += milkymist-ac97.o
+obj-lm32-y += milkymist-hpdmc.o
+obj-lm32-y += milkymist-memcard.o
+obj-lm32-y += milkymist-minimac2.o
+obj-lm32-y += milkymist-pfpu.o
+obj-lm32-y += milkymist-softusb.o
+obj-lm32-y += milkymist-sysctl.o
+obj-lm32-$(CONFIG_OPENGL) += milkymist-tmu2.o
+obj-lm32-y += milkymist-uart.o
+obj-lm32-y += milkymist-vgafb.o
+obj-lm32-y += framebuffer.o
+
+obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
+obj-mips-y += mips_addr.o mips_timer.o mips_int.o
+obj-mips-y += gt64xxx.o mc146818rtc.o
+obj-mips-$(CONFIG_FULONG) += bonito.o vt82c686.o mips_fulong2e.o
+
+obj-microblaze-y = petalogix_s3adsp1800_mmu.o
+obj-microblaze-y += petalogix_ml605_mmu.o
+obj-microblaze-y += microblaze_boot.o
+
+obj-microblaze-y += microblaze_pic_cpu.o
+obj-microblaze-y += xilinx_intc.o
+obj-microblaze-y += xilinx_timer.o
+obj-microblaze-y += xilinx_uartlite.o
+obj-microblaze-y += xilinx_ethlite.o
+obj-microblaze-y += xilinx_axidma.o
+obj-microblaze-y += xilinx_axienet.o
+
+obj-microblaze-$(CONFIG_FDT) += device_tree.o
+
+# Boards
+obj-cris-y = cris_pic_cpu.o
+obj-cris-y += cris-boot.o
+obj-cris-y += axis_dev88.o
+
+# IO blocks
+obj-cris-y += etraxfs_dma.o
+obj-cris-y += etraxfs_pic.o
+obj-cris-y += etraxfs_eth.o
+obj-cris-y += etraxfs_timer.o
+obj-cris-y += etraxfs_ser.o
+
+ifeq ($(TARGET_ARCH), sparc64)
+obj-sparc-y = sun4u.o apb_pci.o
+obj-sparc-y += mc146818rtc.o
+else
+obj-sparc-y = sun4m.o lance.o tcx.o sun4m_iommu.o slavio_intctl.o
+obj-sparc-y += slavio_timer.o slavio_misc.o sparc32_dma.o
+obj-sparc-y += cs4231.o eccmemctl.o sbi.o sun4c_intctl.o leon3.o
+
+# GRLIB
+obj-sparc-y += grlib_gptimer.o grlib_irqmp.o grlib_apbuart.o
+endif
+
+obj-arm-y = integratorcp.o versatilepb.o arm_pic.o arm_timer.o
+obj-arm-y += arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
+obj-arm-y += versatile_pci.o
+obj-arm-y += versatile_i2c.o
+obj-arm-y += cadence_uart.o
+obj-arm-y += cadence_ttc.o
+obj-arm-y += cadence_gem.o
+obj-arm-y += xilinx_zynq.o zynq_slcr.o
+obj-arm-y += arm_gic.o
+obj-arm-y += realview_gic.o realview.o arm_sysctl.o arm11mpcore.o a9mpcore.o
+obj-arm-y += exynos4210_gic.o exynos4210_combiner.o exynos4210.o
+obj-arm-y += exynos4_boards.o exynos4210_uart.o exynos4210_pwm.o
+obj-arm-y += exynos4210_pmu.o exynos4210_mct.o exynos4210_fimd.o
+obj-arm-y += arm_l2x0.o
+obj-arm-y += arm_mptimer.o a15mpcore.o
+obj-arm-y += armv7m.o armv7m_nvic.o stellaris.o pl022.o stellaris_enet.o
+obj-arm-y += highbank.o
+obj-arm-y += pl061.o
+obj-arm-y += xgmac.o
+obj-arm-y += arm-semi.o
+obj-arm-y += pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
+obj-arm-y += pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o pxa2xx_keypad.o
+obj-arm-y += gumstix.o
+obj-arm-y += zaurus.o ide/microdrive.o spitz.o tosa.o tc6393xb.o
+obj-arm-y += omap1.o omap_lcdc.o omap_dma.o omap_clk.o omap_mmc.o omap_i2c.o \
+		omap_gpio.o omap_intc.o omap_uart.o
+obj-arm-y += omap2.o omap_dss.o soc_dma.o omap_gptimer.o omap_synctimer.o \
+		omap_gpmc.o omap_sdrc.o omap_spi.o omap_tap.o omap_l4.o
+obj-arm-y += omap_sx1.o palm.o tsc210x.o
+obj-arm-y += nseries.o blizzard.o onenand.o cbus.o tusb6010.o usb/hcd-musb.o
+obj-arm-y += mst_fpga.o mainstone.o
+obj-arm-y += z2.o
+obj-arm-y += musicpal.o bitbang_i2c.o marvell_88w8618_audio.o
+obj-arm-y += framebuffer.o
+obj-arm-y += vexpress.o
+obj-arm-y += strongarm.o
+obj-arm-y += collie.o
+obj-arm-y += pl041.o lm4549.o
+obj-arm-$(CONFIG_FDT) += device_tree.o
+
+obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
+obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o
+obj-sh4-y += ide/mmio.o
+
+obj-m68k-y = an5206.o mcf5206.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
+obj-m68k-y += m68k-semi.o dummy_m68k.o
+
+obj-s390x-y = s390-virtio-bus.o s390-virtio.o
+
+obj-alpha-y = mc146818rtc.o
+obj-alpha-y += alpha_pci.o alpha_dp264.o alpha_typhoon.o
+
+obj-xtensa-y += xtensa_pic.o
+obj-xtensa-y += xtensa_sim.o
+obj-xtensa-y += xtensa_lx60.o
+obj-xtensa-y += xtensa-semi.o
+obj-xtensa-y += core-dc232b.o
+obj-xtensa-y += core-dc233c.o
+obj-xtensa-y += core-fsf.o

 main.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

-GENERATED_HEADERS += hmp-commands.h qmp-commands-old.h
+monitor.o: hmp-commands.h qmp-commands-old.h
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../, $(universal-obj-y))
+obj-y += $(addprefix ../, $(common-obj-y))
+obj-y += $(addprefix ../libdis/, $(libdis-y))
+obj-y += $(libobj-y)
+obj-y += $(addprefix $(HWDIR)/, $(hw-obj-y))
+obj-y += $(addprefix ../, $(trace-obj-y))

 endif # CONFIG_SOFTMMU

-# Workaround for http://gcc.gnu.org/PR55489, see configure.
-%/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
+ifndef CONFIG_LINUX_USER
+ifndef CONFIG_BSD_USER
+# libcacard needs qemu-thread support, and besides is only needed by devices
+# so not requires with linux-user / bsd-user targets
+obj-$(CONFIG_SMARTCARD_NSS) += $(addprefix ../libcacard/, $(libcacard-y))
+endif # CONFIG_BSD_USER
+endif # CONFIG_LINUX_USER

-nested-vars += obj-y
-
-# This resolves all nested paths, so it must come last
-include $(SRC_PATH)/Makefile.objs
-
-all-obj-y = $(obj-y)
-all-obj-y += $(addprefix ../, $(common-obj-y))
-
-ifndef CONFIG_HAIKU
-LIBS+=-lm
-endif
+obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o

 ifdef QEMU_PROGW
 # The linker builds a windows executable. Make also a console executable.
-$(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+$(QEMU_PROGW): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y)
 	$(call LINK,$^)
 $(QEMU_PROG): $(QEMU_PROGW)
 	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
 else
-$(QEMU_PROG): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+$(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y)
 	$(call LINK,$^)
 endif

@@ -170,8 +433,8 @@ qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

 clean:
-	rm -f *.a *~ $(PROGS)
-	rm -f $(shell find . -name '*.[od]')
+	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
+	rm -f *.d */*.d tcg/*.o ide/*.o 9pfs/*.o kvm/*.o
 	rm -f hmp-commands.h qmp-commands-old.h gdbstub-xml.c
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
@@ -189,5 +452,5 @@ ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DATA) $(QEMU_PROG).stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
 endif

-GENERATED_HEADERS += config-target.h
-Makefile: $(GENERATED_HEADERS)
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.user
+++ b/Makefile.user
@@ -0,0 +1,26 @@
+# Makefile for qemu target independent user files.
+
+include ../config-host.mak
+include $(SRC_PATH)/rules.mak
+-include config.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+QEMU_CFLAGS += -I$(SRC_PATH)/include
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(user-obj-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	for d in . trace; do \
+	rm -f $$d/*.o $$d/*.d $$d/*.a $$d/*~; \
+	done
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/QMP/qemu-ga-client
+++ b/QMP/qemu-ga-client
@@ -1,299 +0,0 @@
-#!/usr/bin/python
-
-# QEMU Guest Agent Client
-#
-# Copyright (C) 2012 Ryota Ozaki <ozaki.ryota@gmail.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2.  See
-# the COPYING file in the top-level directory.
-#
-# Usage:
-#
-# Start QEMU with:
-#
-# # qemu [...] -chardev socket,path=/tmp/qga.sock,server,nowait,id=qga0 \
-#   -device virtio-serial -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
-#
-# Run the script:
-#
-# $ qemu-ga-client --address=/tmp/qga.sock <command> [args...]
-#
-# or
-#
-# $ export QGA_CLIENT_ADDRESS=/tmp/qga.sock
-# $ qemu-ga-client <command> [args...]
-#
-# For example:
-#
-# $ qemu-ga-client cat /etc/resolv.conf
-# # Generated by NetworkManager
-# nameserver 10.0.2.3
-# $ qemu-ga-client fsfreeze status
-# thawed
-# $ qemu-ga-client fsfreeze freeze
-# 2 filesystems frozen
-#
-# See also: http://wiki.qemu.org/Features/QAPI/GuestAgent
-#
-
-import base64
-import random
-
-import qmp
-
-
-class QemuGuestAgent(qmp.QEMUMonitorProtocol):
-    def __getattr__(self, name):
-        def wrapper(**kwds):
-            return self.command('guest-' + name.replace('_', '-'), **kwds)
-        return wrapper
-
-
-class QemuGuestAgentClient:
-    error = QemuGuestAgent.error
-
-    def __init__(self, address):
-        self.qga = QemuGuestAgent(address)
-        self.qga.connect(negotiate=False)
-
-    def sync(self, timeout=3):
-        # Avoid being blocked forever
-        if not self.ping(timeout):
-            raise EnvironmentError('Agent seems not alive')
-        uid = random.randint(0, (1 << 32) - 1)
-        while True:
-            ret = self.qga.sync(id=uid)
-            if isinstance(ret, int) and int(ret) == uid:
-                break
-
-    def __file_read_all(self, handle):
-        eof = False
-        data = ''
-        while not eof:
-            ret = self.qga.file_read(handle=handle, count=1024)
-            _data = base64.b64decode(ret['buf-b64'])
-            data += _data
-            eof = ret['eof']
-        return data
-
-    def read(self, path):
-        handle = self.qga.file_open(path=path)
-        try:
-            data = self.__file_read_all(handle)
-        finally:
-            self.qga.file_close(handle=handle)
-        return data
-
-    def info(self):
-        info = self.qga.info()
-
-        msgs = []
-        msgs.append('version: ' + info['version'])
-        msgs.append('supported_commands:')
-        enabled = [c['name'] for c in info['supported_commands'] if c['enabled']]
-        msgs.append('\tenabled: ' + ', '.join(enabled))
-        disabled = [c['name'] for c in info['supported_commands'] if not c['enabled']]
-        msgs.append('\tdisabled: ' + ', '.join(disabled))
-
-        return '\n'.join(msgs)
-
-    def __gen_ipv4_netmask(self, prefixlen):
-        mask = int('1' * prefixlen + '0' * (32 - prefixlen), 2)
-        return '.'.join([str(mask >> 24),
-                         str((mask >> 16) & 0xff),
-                         str((mask >> 8) & 0xff),
-                         str(mask & 0xff)])
-
-    def ifconfig(self):
-        nifs = self.qga.network_get_interfaces()
-
-        msgs = []
-        for nif in nifs:
-            msgs.append(nif['name'] + ':')
-            if 'ip-addresses' in nif:
-                for ipaddr in nif['ip-addresses']:
-                    if ipaddr['ip-address-type'] == 'ipv4':
-                        addr = ipaddr['ip-address']
-                        mask = self.__gen_ipv4_netmask(int(ipaddr['prefix']))
-                        msgs.append("\tinet %s  netmask %s" % (addr, mask))
-                    elif ipaddr['ip-address-type'] == 'ipv6':
-                        addr = ipaddr['ip-address']
-                        prefix = ipaddr['prefix']
-                        msgs.append("\tinet6 %s  prefixlen %s" % (addr, prefix))
-            if nif['hardware-address'] != '00:00:00:00:00:00':
-                msgs.append("\tether " + nif['hardware-address'])
-
-        return '\n'.join(msgs)
-
-    def ping(self, timeout):
-        self.qga.settimeout(timeout)
-        try:
-            self.qga.ping()
-        except self.qga.timeout:
-            return False
-        return True
-
-    def fsfreeze(self, cmd):
-        if cmd not in ['status', 'freeze', 'thaw']:
-            raise StandardError('Invalid command: ' + cmd)
-
-        return getattr(self.qga, 'fsfreeze' + '_' + cmd)()
-
-    def fstrim(self, minimum=0):
-        return getattr(self.qga, 'fstrim')(minimum=minimum)
-
-    def suspend(self, mode):
-        if mode not in ['disk', 'ram', 'hybrid']:
-            raise StandardError('Invalid mode: ' + mode)
-
-        try:
-            getattr(self.qga, 'suspend' + '_' + mode)()
-            # On error exception will raise
-        except self.qga.timeout:
-            # On success command will timed out
-            return
-
-    def shutdown(self, mode='powerdown'):
-        if mode not in ['powerdown', 'halt', 'reboot']:
-            raise StandardError('Invalid mode: ' + mode)
-
-        try:
-            self.qga.shutdown(mode=mode)
-        except self.qga.timeout:
-            return
-
-
-def _cmd_cat(client, args):
-    if len(args) != 1:
-        print('Invalid argument')
-        print('Usage: cat <file>')
-        sys.exit(1)
-    print(client.read(args[0]))
-
-
-def _cmd_fsfreeze(client, args):
-    usage = 'Usage: fsfreeze status|freeze|thaw'
-    if len(args) != 1:
-        print('Invalid argument')
-        print(usage)
-        sys.exit(1)
-    if args[0] not in ['status', 'freeze', 'thaw']:
-        print('Invalid command: ' + args[0])
-        print(usage)
-        sys.exit(1)
-    cmd = args[0]
-    ret = client.fsfreeze(cmd)
-    if cmd == 'status':
-        print(ret)
-    elif cmd == 'freeze':
-        print("%d filesystems frozen" % ret)
-    else:
-        print("%d filesystems thawed" % ret)
-
-
-def _cmd_fstrim(client, args):
-    if len(args) == 0:
-        minimum = 0
-    else:
-        minimum = int(args[0])
-    print(client.fstrim(minimum))
-
-
-def _cmd_ifconfig(client, args):
-    print(client.ifconfig())
-
-
-def _cmd_info(client, args):
-    print(client.info())
-
-
-def _cmd_ping(client, args):
-    if len(args) == 0:
-        timeout = 3
-    else:
-        timeout = float(args[0])
-    alive = client.ping(timeout)
-    if not alive:
-        print("Not responded in %s sec" % args[0])
-        sys.exit(1)
-
-
-def _cmd_suspend(client, args):
-    usage = 'Usage: suspend disk|ram|hybrid'
-    if len(args) != 1:
-        print('Less argument')
-        print(usage)
-        sys.exit(1)
-    if args[0] not in ['disk', 'ram', 'hybrid']:
-        print('Invalid command: ' + args[0])
-        print(usage)
-        sys.exit(1)
-    client.suspend(args[0])
-
-
-def _cmd_shutdown(client, args):
-    client.shutdown()
-_cmd_powerdown = _cmd_shutdown
-
-
-def _cmd_halt(client, args):
-    client.shutdown('halt')
-
-
-def _cmd_reboot(client, args):
-    client.shutdown('reboot')
-
-
-commands = [m.replace('_cmd_', '') for m in dir() if '_cmd_' in m]
-
-
-def main(address, cmd, args):
-    if not os.path.exists(address):
-        print('%s not found' % address)
-        sys.exit(1)
-
-    if cmd not in commands:
-        print('Invalid command: ' + cmd)
-        print('Available commands: ' + ', '.join(commands))
-        sys.exit(1)
-
-    try:
-        client = QemuGuestAgentClient(address)
-    except QemuGuestAgent.error, e:
-        import errno
-
-        print(e)
-        if e.errno == errno.ECONNREFUSED:
-            print('Hint: qemu is not running?')
-        sys.exit(1)
-
-    if cmd != 'ping':
-        client.sync()
-
-    globals()['_cmd_' + cmd](client, args)
-
-
-if __name__ == '__main__':
-    import sys
-    import os
-    import optparse
-
-    address = os.environ['QGA_CLIENT_ADDRESS'] if 'QGA_CLIENT_ADDRESS' in os.environ else None
-
-    usage = "%prog [--address=<unix_path>|<ipv4_address>] <command> [args...]\n"
-    usage += '<command>: ' + ', '.join(commands)
-    parser = optparse.OptionParser(usage=usage)
-    parser.add_option('--address', action='store', type='string',
-                      default=address, help='Specify a ip:port pair or a unix socket path')
-    options, args = parser.parse_args()
-
-    address = options.address
-    if address is None:
-        parser.error('address is not specified')
-        sys.exit(1)
-
-    if len(args) == 0:
-        parser.error('Less argument')
-        sys.exit(1)
-
-    main(address, args[0], args[1:])
--- a/QMP/qmp-events.txt
+++ b/QMP/qmp-events.txt
@@ -1,23 +1,6 @@
                   QEMU Monitor Protocol Events
                   ============================

-BALLOON_CHANGE
--------------
-
-Emitted when the guest changes the actual BALLOON level. This
-value is equivalent to the 'actual' field return by the
-'query-balloon' command
-
-Data:
-
- "actual": actual level of the guest memory balloon in bytes (json-number)
-
-Example:
-
-{ "event": "BALLOON_CHANGE",
-    "data": { "actual": 944766976 },
-    "timestamp": { "seconds": 1267020223, "microseconds": 435656 } }
-
 BLOCK_IO_ERROR
 --------------

@@ -43,117 +26,6 @@ Example:
 Note: If action is "stop", a STOP event will eventually follow the
 BLOCK_IO_ERROR event.

-BLOCK_JOB_CANCELLED
-------------------
-
-Emitted when a block job has been cancelled.
-
-Data:
-
- "type":     Job type (json-string; "stream" for image streaming
-                                     "commit" for block commit)
- "device":   Device name (json-string)
- "len":      Maximum progress value (json-int)
- "offset":   Current progress value (json-int)
-              On success this is equal to len.
-              On failure this is less than len.
- "speed":    Rate limit, bytes per second (json-int)
-
-Example:
-
-{ "event": "BLOCK_JOB_CANCELLED",
-     "data": { "type": "stream", "device": "virtio-disk0",
-               "len": 10737418240, "offset": 134217728,
-               "speed": 0 },
-     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
-
-BLOCK_JOB_COMPLETED
-------------------
-
-Emitted when a block job has completed.
-
-Data:
-
- "type":     Job type (json-string; "stream" for image streaming
-                                     "commit" for block commit)
- "device":   Device name (json-string)
- "len":      Maximum progress value (json-int)
- "offset":   Current progress value (json-int)
-              On success this is equal to len.
-              On failure this is less than len.
- "speed":    Rate limit, bytes per second (json-int)
- "error":    Error message (json-string, optional)
-              Only present on failure.  This field contains a human-readable
-              error message.  There are no semantics other than that streaming
-              has failed and clients should not try to interpret the error
-              string.
-
-Example:
-
-{ "event": "BLOCK_JOB_COMPLETED",
-     "data": { "type": "stream", "device": "virtio-disk0",
-               "len": 10737418240, "offset": 10737418240,
-               "speed": 0 },
-     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
-
-BLOCK_JOB_ERROR
---------------
-
-Emitted when a block job encounters an error.
-
-Data:
-
- "device": device name (json-string)
- "operation": I/O operation (json-string, "read" or "write")
- "action": action that has been taken, it's one of the following (json-string):
-    "ignore": error has been ignored, the job may fail later
-    "report": error will be reported and the job canceled
-    "stop": error caused job to be paused
-
-Example:
-
-{ "event": "BLOCK_JOB_ERROR",
-    "data": { "device": "ide0-hd1",
-              "operation": "write",
-              "action": "stop" },
-    "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
-BLOCK_JOB_READY
---------------
-
-Emitted when a block job is ready to complete.
-
-Data:
-
- "device": device name (json-string)
-
-Example:
-
-{ "event": "BLOCK_JOB_READY",
-    "data": { "device": "ide0-hd1" },
-    "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
-Note: The "ready to complete" status is always reset by a BLOCK_JOB_ERROR
-event.
-
-DEVICE_DELETED
-----------------
-
-Emitted whenever the device removal completion is acknowledged
-by the guest.
-At this point, it's safe to reuse the specified device ID.
-Device removal can be initiated by the guest or by HMP/QMP commands.
-
-Data:
-
- "device": device name (json-string, optional)
- "path": device path (json-string)
-
-{ "event": "DEVICE_DELETED",
-  "data": { "device": "virtio-net-pci-0",
-            "path": "/machine/peripheral/virtio-net-pci-0" },
-  "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
 DEVICE_TRAY_MOVED
 -----------------

@@ -226,68 +98,6 @@ Example:
 Note: If the command-line option "-no-shutdown" has been specified, a STOP
 event will eventually follow the SHUTDOWN event.

-SPICE_CONNECTED, SPICE_DISCONNECTED
-----------------------------------
-
-Emitted when a SPICE client connects or disconnects.
-
-Data:
-
- "server": Server information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
- "client": Client information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-
-Example:
-
-{ "timestamp": {"seconds": 1290688046, "microseconds": 388707},
-  "event": "SPICE_CONNECTED",
-  "data": {
-    "server": { "port": "5920", "family": "ipv4", "host": "127.0.0.1"},
-    "client": {"port": "52873", "family": "ipv4", "host": "127.0.0.1"}
-}}
-
-SPICE_INITIALIZED
-----------------
-
-Emitted after initial handshake and authentication takes place (if any)
-and the SPICE channel is up'n'running
-
-Data:
-
- "server": Server information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-  - "auth": authentication method (json-string, optional)
- "client": Client information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-  - "connection-id": spice connection id.  All channels with the same id
-                     belong to the same spice session (json-int)
-  - "channel-type": channel type.  "1" is the main control channel, filter for
-                    this one if you want track spice sessions only (json-int)
-  - "channel-id": channel id.  Usually "0", might be different needed when
-                  multiple channels of the same type exist, such as multiple
-                  display channels in a multihead setup (json-int)
-  - "tls": whevener the channel is encrypted (json-bool)
-
-Example:
-
-{ "timestamp": {"seconds": 1290688046, "microseconds": 417172},
-  "event": "SPICE_INITIALIZED",
-  "data": {"server": {"auth": "spice", "port": "5921",
-                      "family": "ipv4", "host": "127.0.0.1"},
-           "client": {"port": "49004", "family": "ipv4", "channel-type": 3,
-                      "connection-id": 1804289383, "host": "127.0.0.1",
-                      "channel-id": 0, "tls": true}
-}}
-
 STOP
 ----

@@ -300,32 +110,6 @@ Example:
 { "event": "STOP",
    "timestamp": { "seconds": 1267041730, "microseconds": 281295 } }

-SUSPEND
-------
-
-Emitted when guest enters S3 state.
-
-Data: None.
-
-Example:
-
-{ "event": "SUSPEND",
-     "timestamp": { "seconds": 1344456160, "microseconds": 309119 } }
-
-SUSPEND_DISK
------------
-
-Emitted when the guest makes a request to enter S4 state.
-
-Data: None.
-
-Example:
-
-{ "event": "SUSPEND_DISK",
-     "timestamp": { "seconds": 1344456160, "microseconds": 309119 } }
-
-Note: QEMU shuts down when entering S4 state.
-
 VNC_CONNECTED
 -------------

@@ -416,17 +200,69 @@ Example:
                    "host": "127.0.0.1", "sasl_username": "luiz" } },
        "timestamp": { "seconds": 1263475302, "microseconds": 150772 } }

-WAKEUP
------
+SPICE_CONNECTED, SPICE_DISCONNECTED
+-----------------------------------

-Emitted when the guest has woken up from S3 and is running.
+Emitted when a SPICE client connects or disconnects.

-Data: None.
+Data:
+
+- "server": Server information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+- "client": Client information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")

 Example:

-{ "event": "WATCHDOG",
-     "timestamp": { "seconds": 1344522075, "microseconds": 745528 } }
+{ "timestamp": {"seconds": 1290688046, "microseconds": 388707},
+  "event": "SPICE_CONNECTED",
+  "data": {
+    "server": { "port": "5920", "family": "ipv4", "host": "127.0.0.1"},
+    "client": {"port": "52873", "family": "ipv4", "host": "127.0.0.1"}
+}}
+
+
+SPICE_INITIALIZED
+-----------------
+
+Emitted after initial handshake and authentication takes place (if any)
+and the SPICE channel is up'n'running
+
+Data:
+
+- "server": Server information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+  - "auth": authentication method (json-string, optional)
+- "client": Client information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+  - "connection-id": spice connection id.  All channels with the same id
+                     belong to the same spice session (json-int)
+  - "channel-type": channel type.  "1" is the main control channel, filter for
+                    this one if you want track spice sessions only (json-int)
+  - "channel-id": channel id.  Usually "0", might be different needed when
+                  multiple channels of the same type exist, such as multiple
+                  display channels in a multihead setup (json-int)
+  - "tls": whevener the channel is encrypted (json-bool)
+
+Example:
+
+{ "timestamp": {"seconds": 1290688046, "microseconds": 417172},
+  "event": "SPICE_INITIALIZED",
+  "data": {"server": {"auth": "spice", "port": "5921",
+                      "family": "ipv4", "host": "127.0.0.1"},
+           "client": {"port": "49004", "family": "ipv4", "channel-type": 3,
+                      "connection-id": 1804289383, "host": "127.0.0.1",
+                      "channel-id": 0, "tls": true}
+}}
+

 WATCHDOG
 --------
@@ -447,16 +283,55 @@ Example:
 Note: If action is "reset", "shutdown", or "pause" the WATCHDOG event is
 followed respectively by the RESET, SHUTDOWN, or STOP events.

-GUEST_PANICKED
--------------

-Emitted when guest OS panic is detected.
+BLOCK_JOB_COMPLETED
+-------------------
+
+Emitted when a block job has completed.

 Data:

- "action": Action that has been taken (json-string, currently always "pause").
+- "type":     Job type ("stream" for image streaming, json-string)
+- "device":   Device name (json-string)
+- "len":      Maximum progress value (json-int)
+- "offset":   Current progress value (json-int)
+              On success this is equal to len.
+              On failure this is less than len.
+- "speed":    Rate limit, bytes per second (json-int)
+- "error":    Error message (json-string, optional)
+              Only present on failure.  This field contains a human-readable
+              error message.  There are no semantics other than that streaming
+              has failed and clients should not try to interpret the error
+              string.

 Example:

-{ "event": "GUEST_PANICKED",
-     "data": { "action": "pause" } }
+{ "event": "BLOCK_JOB_COMPLETED",
+     "data": { "type": "stream", "device": "virtio-disk0",
+               "len": 10737418240, "offset": 10737418240,
+               "speed": 0 },
+     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
+
+
+BLOCK_JOB_CANCELLED
+-------------------
+
+Emitted when a block job has been cancelled.
+
+Data:
+
+- "type":     Job type ("stream" for image streaming, json-string)
+- "device":   Device name (json-string)
+- "len":      Maximum progress value (json-int)
+- "offset":   Current progress value (json-int)
+              On success this is equal to len.
+              On failure this is less than len.
+- "speed":    Rate limit, bytes per second (json-int)
+
+Example:
+
+{ "event": "BLOCK_JOB_CANCELLED",
+     "data": { "type": "stream", "device": "virtio-disk0",
+               "len": 10737418240, "offset": 134217728,
+               "speed": 0 },
+     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
--- a/QMP/qmp-shell
+++ b/QMP/qmp-shell
@@ -33,7 +33,6 @@
 import qmp
 import readline
 import sys
-import pprint

 class QMPCompleter(list):
    def complete(self, text, state):
@@ -53,11 +52,10 @@ class QMPShellBadPort(QMPShellError):
 # TODO: QMPShell's interface is a bit ugly (eg. _fill_completion() and
 #       _execute_cmd()). Let's design a better one.
 class QMPShell(qmp.QEMUMonitorProtocol):
-    def __init__(self, address, pp=None):
+    def __init__(self, address):
        qmp.QEMUMonitorProtocol.__init__(self, self.__get_address(address))
        self._greeting = None
        self._completer = None
-        self._pp = pp

    def __get_address(self, arg):
        """
@@ -99,16 +97,9 @@ class QMPShell(qmp.QEMUMonitorProtocol):
        for arg in cmdargs[1:]:
            opt = arg.split('=')
            try:
-                if(len(opt) > 2):
-                    opt[1] = '='.join(opt[1:])
                value = int(opt[1])
            except ValueError:
-                if opt[1] == 'true':
-                    value = True
-                elif opt[1] == 'false':
-                    value = False
-                else:
-                    value = opt[1]
+                value = opt[1]
            qmpcmd['arguments'][opt[0]] = value
        return qmpcmd

@@ -123,11 +114,7 @@ class QMPShell(qmp.QEMUMonitorProtocol):
        if resp is None:
            print 'Disconnected'
            return False
-
-        if self._pp is not None:
-            self._pp.pprint(resp)
-        else:
-            print resp
+        print resp
        return True

    def connect(self):
@@ -235,36 +222,22 @@ def die(msg):
 def fail_cmdline(option=None):
    if option:
        sys.stderr.write('ERROR: bad command-line option \'%s\'\n' % option)
-    sys.stderr.write('qemu-shell [ -p ] [ -H ] < UNIX socket path> | < TCP address:port >\n')
+    sys.stderr.write('qemu-shell [ -H ] < UNIX socket path> | < TCP address:port >\n')
    sys.exit(1)

 def main():
    addr = ''
-    qemu = None
-    hmp = False
-    pp = None
-
    try:
-        for arg in sys.argv[1:]:
-            if arg == "-H":
-                if qemu is not None:
-                    fail_cmdline(arg)
-                hmp = True
-            elif arg == "-p":
-                if pp is not None:
-                    fail_cmdline(arg)
-                pp = pprint.PrettyPrinter(indent=4)
-            else:
-                if qemu is not None:
-                    fail_cmdline(arg)
-                if hmp:
-                    qemu = HMPShell(arg)
-                else:
-                    qemu = QMPShell(arg, pp)
-                addr = arg
-
-        if qemu is None:
-            fail_cmdline()
+        if len(sys.argv) == 2:
+            qemu = QMPShell(sys.argv[1])
+            addr = sys.argv[1]
+        elif len(sys.argv) == 3:
+            if sys.argv[1] != '-H':
+                fail_cmdline(sys.argv[1])
+            qemu = HMPShell(sys.argv[2])
+            addr = sys.argv[2]
+        else:
+                fail_cmdline()
    except QMPShellBadPort:
        die('bad port number in command-line')

--- a/QMP/qmp-spec.txt
+++ b/QMP/qmp-spec.txt
@@ -106,11 +106,14 @@ completed because of an error condition.

 The format is:

-{ "error": { "class": json-string, "desc": json-string }, "id": json-value }
+{ "error": { "class": json-string, "data": json-object, "desc": json-string },
+  "id": json-value }

 Where,

- The "class" member contains the error class name (eg. "GenericError")
+- The "class" member contains the error class name (eg. "ServiceUnavailable")
+- The "data" member contains specific error data and is defined in a
+  per-command basis, it will be an empty json-object if the error has no data
 - The "desc" member is a human-readable error message. Clients should
  not attempt to parse this message.
 - The "id" member contains the transaction identification associated with
@@ -170,7 +173,8 @@ S: {"return": {"enabled": true, "present": true}, "id": "example"}
 ------------------

 C: { "execute": }
-S: {"error": {"class": "GenericError", "desc": "Invalid JSON syntax" } }
+S: {"error": {"class": "JSONParsing", "desc": "Invalid JSON syntax", "data":
+{}}}

 3.5 Powerdown event
 -------------------
--- a/QMP/qmp.py
+++ b/QMP/qmp.py
@@ -49,6 +49,7 @@ class QEMUMonitorProtocol:
        return socket.socket(family, socket.SOCK_STREAM)

    def __negotiate_capabilities(self):
+        self.__sockfile = self.__sock.makefile()
        greeting = self.__json_read()
        if greeting is None or not greeting.has_key('QMP'):
            raise QMPConnectError
@@ -72,7 +73,7 @@ class QEMUMonitorProtocol:

    error = socket.error

-    def connect(self, negotiate=True):
+    def connect(self):
        """
        Connect to the QMP Monitor and perform capabilities negotiation.

@@ -82,9 +83,7 @@ class QEMUMonitorProtocol:
        @raise QMPCapabilitiesError if fails to negotiate capabilities
        """
        self.__sock.connect(self.__address)
-        self.__sockfile = self.__sock.makefile()
-        if negotiate:
-            return self.__negotiate_capabilities()
+        return self.__negotiate_capabilities()

    def accept(self):
        """
@@ -96,7 +95,6 @@ class QEMUMonitorProtocol:
        @raise QMPCapabilitiesError if fails to negotiate capabilities
        """
        self.__sock, _ = self.__sock.accept()
-        self.__sockfile = self.__sock.makefile()
        return self.__negotiate_capabilities()

    def cmd_obj(self, qmp_cmd):
@@ -136,26 +134,6 @@ class QEMUMonitorProtocol:
            raise Exception(ret['error']['desc'])
        return ret['return']

-    def pull_event(self, wait=False):
-        """
-        Get and delete the first available QMP event.
-
-        @param wait: block until an event is available (bool)
-        """
-        self.__sock.setblocking(0)
-        try:
-            self.__json_read()
-        except socket.error, err:
-            if err[0] == errno.EAGAIN:
-                # No data available
-                pass
-        self.__sock.setblocking(1)
-        if not self.__events and wait:
-            self.__json_read(only_event=True)
-        event = self.__events[0]
-        del self.__events[0]
-        return event
-
    def get_events(self, wait=False):
        """
        Get a list of available QMP events.
@@ -183,8 +161,3 @@ class QEMUMonitorProtocol:
    def close(self):
        self.__sock.close()
        self.__sockfile.close()
-
-    timeout = socket.timeout
-
-    def settimeout(self, timeout):
-        self.__sock.settimeout(timeout)
--- a/37
+++ b/37
@@ -0,0 +1,37 @@
+General:
+-------
+- cycle counter for all archs
+- cpu_interrupt() win32/SMP fix
+- merge PIC spurious interrupt patch
+- warning for OS/2: must not use 128 MB memory (merge bochs cmos patch ?)
+- config file (at least for windows/Mac OS X)
+- update doc: PCI infos.
+- basic VGA optimizations
+- better code fetch
+- do not resize vga if invalid size.
+- TLB code protection support for PPC
+- disable SMC handling for ARM/SPARC/PPC (not finished)
+- see undefined flags for BTx insn
+- keyboard output buffer filling timing emulation
+- tests for each target CPU
+- fix all remaining thread lock issues (must put TBs in a specific invalid
+  state, find a solution for tb_flush()).
+
+ppc specific:
+------------
+- TLB invalidate not needed if msr_pr changes
+- enable shift optimizations ?
+
+linux-user specific:
+-------------------
+- remove threading support as it cannot work at this point
+- improve IPC syscalls
+- more syscalls (in particular all 64 bit ones, IPCs, fix 64 bit
+  issues, fix 16 bit uid issues)
+- use kernel traps for unaligned accesses on ARM ?
+
+
+lower priority:
+--------------
+- int15 ah=86: use better timing
+- use -msoft-float on ARM
--- a/2
+++ b/2
@@ -1 +1 @@
-1.5.0
+1.1.1
--- a/a.out.h
+++ b/a.out.h
@@ -0,0 +1,430 @@
+/* a.out.h
+
+   Copyright 1997, 1998, 1999, 2001 Red Hat, Inc.
+
+This file is part of Cygwin.
+
+This software is a copyrighted work licensed under the terms of the
+Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
+details. */
+
+#ifndef _A_OUT_H_
+#define _A_OUT_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+#define COFF_IMAGE_WITH_PE
+#define COFF_LONG_SECTION_NAMES
+
+/*** coff information for Intel 386/486.  */
+
+
+/********************** FILE HEADER **********************/
+
+struct external_filehdr {
+  short f_magic;	/* magic number			*/
+  short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  short f_opthdr;	/* sizeof(optional hdr)		*/
+  short f_flags;	/* flags			*/
+};
+
+/* Bits for f_flags:
+ *	F_RELFLG	relocation info stripped from file
+ *	F_EXEC		file is executable (no unresolved external references)
+ *	F_LNNO		line numbers stripped from file
+ *	F_LSYMS		local symbols stripped from file
+ *	F_AR32WR	file has byte ordering of an AR32WR machine (e.g. vax)
+ */
+
+#define F_RELFLG	(0x0001)
+#define F_EXEC		(0x0002)
+#define F_LNNO		(0x0004)
+#define F_LSYMS		(0x0008)
+
+
+
+#define	I386MAGIC	0x14c
+#define I386PTXMAGIC	0x154
+#define I386AIXMAGIC	0x175
+
+/* This is Lynx's all-platform magic number for executables. */
+
+#define LYNXCOFFMAGIC	0415
+
+#define I386BADMAG(x) (((x).f_magic != I386MAGIC) \
+		       && (x).f_magic != I386AIXMAGIC \
+		       && (x).f_magic != I386PTXMAGIC \
+		       && (x).f_magic != LYNXCOFFMAGIC)
+
+#define	FILHDR	struct external_filehdr
+#define	FILHSZ	20
+
+
+/********************** AOUT "OPTIONAL HEADER"=
+ **********************/
+
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of data used for this file=
+ */
+}
+AOUTHDR;
+
+#define AOUTSZ 28
+#define AOUTHDRSZ 28
+
+#define OMAGIC          0404    /* object files, eg as output */
+#define ZMAGIC          0413    /* demand load format, eg normal ld output */
+#define STMAGIC		0401	/* target shlib */
+#define SHMAGIC		0443	/* host   shlib */
+
+
+/* define some NT default values */
+/*  #define NT_IMAGE_BASE        0x400000 moved to internal.h */
+#define NT_SECTION_ALIGNMENT 0x1000
+#define NT_FILE_ALIGNMENT    0x200
+#define NT_DEF_RESERVE       0x100000
+#define NT_DEF_COMMIT        0x1000
+
+/********************** SECTION HEADER **********************/
+
+
+struct external_scnhdr {
+  char		s_name[8];	/* section name			*/
+  host_ulong	s_paddr;	/* physical address, offset
+				   of last addr in scn */
+  host_ulong	s_vaddr;	/* virtual address		*/
+  host_ulong	s_size;		/* section size			*/
+  host_ulong	s_scnptr;	/* file ptr to raw data for section */
+  host_ulong	s_relptr;	/* file ptr to relocation	*/
+  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
+  unsigned short s_nreloc;	/* number of relocation entries	*/
+  unsigned short s_nlnno;	/* number of line number entries*/
+  host_ulong	s_flags;	/* flags			*/
+};
+
+#define	SCNHDR	struct external_scnhdr
+#define	SCNHSZ	40
+
+/*
+ * names of "special" sections
+ */
+#define _TEXT	".text"
+#define _DATA	".data"
+#define _BSS	".bss"
+#define _COMMENT ".comment"
+#define _LIB ".lib"
+
+/********************** LINE NUMBERS **********************/
+
+/* 1 line number entry for every "breakpointable" source line in a section.
+ * Line numbers are grouped on a per function basis; first entry in a function
+ * grouping will have l_lnno = 0 and in place of physical address will be the
+ * symbol table index of the function name.
+ */
+struct external_lineno {
+  union {
+    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
+    host_ulong l_paddr;	/* (physical) address of line number	*/
+  } l_addr;
+  unsigned short l_lnno;	/* line number		*/
+};
+
+#define	LINENO	struct external_lineno
+#define	LINESZ	6
+
+/********************** SYMBOLS **********************/
+
+#define E_SYMNMLEN	8	/* # characters in a symbol name	*/
+#define E_FILNMLEN	14	/* # characters in a file name		*/
+#define E_DIMNUM	4	/* # array dimensions in auxiliary entry */
+
+struct QEMU_PACKED external_syment
+{
+  union {
+    char e_name[E_SYMNMLEN];
+    struct {
+      host_ulong e_zeroes;
+      host_ulong e_offset;
+    } e;
+  } e;
+  host_ulong e_value;
+  unsigned short e_scnum;
+  unsigned short e_type;
+  char e_sclass[1];
+  char e_numaux[1];
+};
+
+#define N_BTMASK	(0xf)
+#define N_TMASK		(0x30)
+#define N_BTSHFT	(4)
+#define N_TSHIFT	(2)
+
+union external_auxent {
+  struct {
+    host_ulong x_tagndx;	/* str, un, or enum tag indx */
+    union {
+      struct {
+	unsigned short  x_lnno; /* declaration line number */
+	unsigned short  x_size; /* str/union/array size */
+      } x_lnsz;
+      host_ulong x_fsize;	/* size of function */
+    } x_misc;
+    union {
+      struct {			/* if ISFCN, tag, or .bb */
+	host_ulong x_lnnoptr;/* ptr to fcn line # */
+	host_ulong x_endndx;	/* entry ndx past block end */
+      } x_fcn;
+      struct {			/* if ISARY, up to 4 dimen. */
+	char x_dimen[E_DIMNUM][2];
+      } x_ary;
+    } x_fcnary;
+    unsigned short x_tvndx;	/* tv index */
+  } x_sym;
+
+  union {
+    char x_fname[E_FILNMLEN];
+    struct {
+      host_ulong x_zeroes;
+      host_ulong x_offset;
+    } x_n;
+  } x_file;
+
+  struct {
+    host_ulong x_scnlen;	/* section length */
+    unsigned short x_nreloc;	/* # relocation entries */
+    unsigned short x_nlinno;	/* # line numbers */
+    host_ulong x_checksum;	/* section COMDAT checksum */
+    unsigned short x_associated;/* COMDAT associated section index */
+    char x_comdat[1];		/* COMDAT selection number */
+  } x_scn;
+
+  struct {
+    host_ulong x_tvfill;	/* tv fill value */
+    unsigned short x_tvlen;	/* length of .tv */
+    char x_tvran[2][2];		/* tv range */
+  } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
+
+};
+
+#define	SYMENT	struct external_syment
+#define	SYMESZ	18
+#define	AUXENT	union external_auxent
+#define	AUXESZ	18
+
+#define _ETEXT	"etext"
+
+/********************** RELOCATION DIRECTIVES **********************/
+
+struct external_reloc {
+  char r_vaddr[4];
+  char r_symndx[4];
+  char r_type[2];
+};
+
+#define RELOC struct external_reloc
+#define RELSZ 10
+
+/* end of coff/i386.h */
+
+/* PE COFF header information */
+
+#ifndef _PE_H
+#define _PE_H
+
+/* NT specific file attributes */
+#define IMAGE_FILE_RELOCS_STRIPPED           0x0001
+#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
+#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
+#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
+#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
+#define IMAGE_FILE_32BIT_MACHINE             0x0100
+#define IMAGE_FILE_DEBUG_STRIPPED            0x0200
+#define IMAGE_FILE_SYSTEM                    0x1000
+#define IMAGE_FILE_DLL                       0x2000
+#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
+
+/* additional flags to be set for section headers to allow the NT loader to
+   read and write to the section data (to replace the addresses of data in
+   dlls for one thing); also to execute the section in .text's case=
+ */
+#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
+#define IMAGE_SCN_MEM_EXECUTE     0x20000000
+#define IMAGE_SCN_MEM_READ        0x40000000
+#define IMAGE_SCN_MEM_WRITE       0x80000000
+
+/*
+ * Section characteristics added for ppc-nt
+ */
+
+#define IMAGE_SCN_TYPE_NO_PAD                0x00000008  /* Reserved.  */
+
+#define IMAGE_SCN_CNT_CODE                   0x00000020  /* Section contains code. */
+#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  /* Section contains initialized data. */
+#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  /* Section contains uninitialized data. */
+
+#define IMAGE_SCN_LNK_OTHER                  0x00000100  /* Reserved.  */
+#define IMAGE_SCN_LNK_INFO                   0x00000200  /* Section contains comments or some other type of information. */
+#define IMAGE_SCN_LNK_REMOVE                 0x00000800  /* Section contents will not become part of image. */
+#define IMAGE_SCN_LNK_COMDAT                 0x00001000  /* Section contents comdat. */
+
+#define IMAGE_SCN_MEM_FARDATA                0x00008000
+
+#define IMAGE_SCN_MEM_PURGEABLE              0x00020000
+#define IMAGE_SCN_MEM_16BIT                  0x00020000
+#define IMAGE_SCN_MEM_LOCKED                 0x00040000
+#define IMAGE_SCN_MEM_PRELOAD                0x00080000
+
+#define IMAGE_SCN_ALIGN_1BYTES               0x00100000
+#define IMAGE_SCN_ALIGN_2BYTES               0x00200000
+#define IMAGE_SCN_ALIGN_4BYTES               0x00300000
+#define IMAGE_SCN_ALIGN_8BYTES               0x00400000
+#define IMAGE_SCN_ALIGN_16BYTES              0x00500000  /* Default alignment if no others are specified. */
+#define IMAGE_SCN_ALIGN_32BYTES              0x00600000
+#define IMAGE_SCN_ALIGN_64BYTES              0x00700000
+
+
+#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  /* Section contains extended relocations. */
+#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  /* Section is not cachable.               */
+#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  /* Section is not pageable.               */
+#define IMAGE_SCN_MEM_SHARED                 0x10000000  /* Section is shareable.                  */
+
+/* COMDAT selection codes.  */
+
+#define IMAGE_COMDAT_SELECT_NODUPLICATES     (1) /* Warn if duplicates.  */
+#define IMAGE_COMDAT_SELECT_ANY		     (2) /* No warning.  */
+#define IMAGE_COMDAT_SELECT_SAME_SIZE	     (3) /* Warn if different size.  */
+#define IMAGE_COMDAT_SELECT_EXACT_MATCH	     (4) /* Warn if different.  */
+#define IMAGE_COMDAT_SELECT_ASSOCIATIVE	     (5) /* Base on other section.  */
+
+/* Magic values that are true for all dos/nt implementations */
+#define DOSMAGIC       0x5a4d
+#define NT_SIGNATURE   0x00004550
+
+/* NT allows long filenames, we want to accommodate this.  This may break
+     some of the bfd functions */
+#undef  FILNMLEN
+#define FILNMLEN	18	/* # characters in a file name		*/
+
+
+#ifdef COFF_IMAGE_WITH_PE
+/* The filehdr is only weired in images */
+
+#undef FILHDR
+struct external_PE_filehdr
+{
+  /* DOS header fields */
+  unsigned short e_magic;	/* Magic number, 0x5a4d */
+  unsigned short e_cblp;	/* Bytes on last page of file, 0x90 */
+  unsigned short e_cp;		/* Pages in file, 0x3 */
+  unsigned short e_crlc;	/* Relocations, 0x0 */
+  unsigned short e_cparhdr;	/* Size of header in paragraphs, 0x4 */
+  unsigned short e_minalloc;	/* Minimum extra paragraphs needed, 0x0 */
+  unsigned short e_maxalloc;	/* Maximum extra paragraphs needed, 0xFFFF */
+  unsigned short e_ss;		/* Initial (relative) SS value, 0x0 */
+  unsigned short e_sp;		/* Initial SP value, 0xb8 */
+  unsigned short e_csum;	/* Checksum, 0x0 */
+  unsigned short e_ip;		/* Initial IP value, 0x0 */
+  unsigned short e_cs;		/* Initial (relative) CS value, 0x0 */
+  unsigned short e_lfarlc;	/* File address of relocation table, 0x40 */
+  unsigned short e_ovno;	/* Overlay number, 0x0 */
+  char e_res[4][2];		/* Reserved words, all 0x0 */
+  unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
+  unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
+  char e_res2[10][2];		/* Reserved words, all 0x0 */
+  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
+  char dos_message[16][4];	/* other stuff, always follow DOS header */
+  unsigned int nt_signature;	/* required NT signature, 0x4550 */
+
+  /* From standard header */
+
+  unsigned short f_magic;	/* magic number			*/
+  unsigned short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
+  unsigned short f_flags;	/* flags			*/
+};
+
+
+#define FILHDR struct external_PE_filehdr
+#undef FILHSZ
+#define FILHSZ 152
+
+#endif
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of all data used for this file */
+
+  /* NT extra fields; see internal.h for descriptions */
+  host_ulong  ImageBase;
+  host_ulong  SectionAlignment;
+  host_ulong  FileAlignment;
+  unsigned short  MajorOperatingSystemVersion;
+  unsigned short  MinorOperatingSystemVersion;
+  unsigned short  MajorImageVersion;
+  unsigned short  MinorImageVersion;
+  unsigned short  MajorSubsystemVersion;
+  unsigned short  MinorSubsystemVersion;
+  char  Reserved1[4];
+  host_ulong  SizeOfImage;
+  host_ulong  SizeOfHeaders;
+  host_ulong  CheckSum;
+  unsigned short Subsystem;
+  unsigned short DllCharacteristics;
+  host_ulong  SizeOfStackReserve;
+  host_ulong  SizeOfStackCommit;
+  host_ulong  SizeOfHeapReserve;
+  host_ulong  SizeOfHeapCommit;
+  host_ulong  LoaderFlags;
+  host_ulong  NumberOfRvaAndSizes;
+  /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
+  char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
+
+} PEAOUTHDR;
+
+
+#undef AOUTSZ
+#define AOUTSZ (AOUTHDRSZ + 196)
+
+#undef  E_FILNMLEN
+#define E_FILNMLEN	18	/* # characters in a file name		*/
+#endif
+
+/* end of coff/pe.h */
+
+#define DT_NON		(0)	/* no derived type */
+#define DT_PTR		(1)	/* pointer */
+#define DT_FCN		(2)	/* function */
+#define DT_ARY		(3)	/* array */
+
+#define ISPTR(x)	(((x) & N_TMASK) == (DT_PTR << N_BTSHFT))
+#define ISFCN(x)	(((x) & N_TMASK) == (DT_FCN << N_BTSHFT))
+#define ISARY(x)	(((x) & N_TMASK) == (DT_ARY << N_BTSHFT))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _A_OUT_H_ */
--- a/util/acl.c
+++ b/util/acl.c
@@ -24,7 +24,7 @@


 #include "qemu-common.h"
-#include "qemu/acl.h"
+#include "acl.h"

 #ifdef CONFIG_FNMATCH
 #include <fnmatch.h>
@@ -103,8 +103,8 @@ void qemu_acl_reset(qemu_acl *acl)
    acl->defaultDeny = 1;
    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
-        g_free(entry->match);
-        g_free(entry);
+        free(entry->match);
+        free(entry);
    }
    acl->nentries = 0;
 }
@@ -168,9 +168,6 @@ int qemu_acl_remove(qemu_acl *acl,
        i++;
        if (strcmp(entry->match, match) == 0) {
            QTAILQ_REMOVE(&acl->entries, entry, next);
-            acl->nentries--;
-            g_free(entry->match);
-            g_free(entry);
            return i;
        }
    }
--- a/include/qemu/acl.h
+++ b/include/qemu/acl.h
@@ -25,7 +25,7 @@
 #ifndef __QEMU_ACL_H__
 #define __QEMU_ACL_H__

-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef struct qemu_acl_entry qemu_acl_entry;
 typedef struct qemu_acl qemu_acl;
--- a/util/aes.c
+++ b/util/aes.c
@@ -28,7 +28,7 @@
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "qemu-common.h"
-#include "qemu/aes.h"
+#include "aes.h"

 #ifndef NDEBUG
 #define NDEBUG
@@ -44,20 +44,20 @@ typedef uint8_t u8;
 # define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); (ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }

 /*
-AES_Te0[x] = S [x].[02, 01, 01, 03];
-AES_Te1[x] = S [x].[03, 02, 01, 01];
-AES_Te2[x] = S [x].[01, 03, 02, 01];
-AES_Te3[x] = S [x].[01, 01, 03, 02];
-AES_Te4[x] = S [x].[01, 01, 01, 01];
+Te0[x] = S [x].[02, 01, 01, 03];
+Te1[x] = S [x].[03, 02, 01, 01];
+Te2[x] = S [x].[01, 03, 02, 01];
+Te3[x] = S [x].[01, 01, 03, 02];
+Te4[x] = S [x].[01, 01, 01, 01];

-AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
-AES_Td1[x] = Si[x].[0b, 0e, 09, 0d];
-AES_Td2[x] = Si[x].[0d, 0b, 0e, 09];
-AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
-AES_Td4[x] = Si[x].[01, 01, 01, 01];
+Td0[x] = Si[x].[0e, 09, 0d, 0b];
+Td1[x] = Si[x].[0b, 0e, 09, 0d];
+Td2[x] = Si[x].[0d, 0b, 0e, 09];
+Td3[x] = Si[x].[09, 0d, 0b, 0e];
+Td4[x] = Si[x].[01, 01, 01, 01];
 */

-const uint32_t AES_Te0[256] = {
+static const u32 Te0[256] = {
    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -123,7 +123,7 @@ const uint32_t AES_Te0[256] = {
    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
 };
-const uint32_t AES_Te1[256] = {
+static const u32 Te1[256] = {
    0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
    0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
    0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
@@ -189,7 +189,7 @@ const uint32_t AES_Te1[256] = {
    0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
    0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
 };
-const uint32_t AES_Te2[256] = {
+static const u32 Te2[256] = {
    0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
    0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
    0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
@@ -255,7 +255,7 @@ const uint32_t AES_Te2[256] = {
    0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
    0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
 };
-const uint32_t AES_Te3[256] = {
+static const u32 Te3[256] = {

    0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
    0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
@@ -322,7 +322,7 @@ const uint32_t AES_Te3[256] = {
    0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
    0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
 };
-const uint32_t AES_Te4[256] = {
+static const u32 Te4[256] = {
    0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
    0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
    0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
@@ -388,7 +388,7 @@ const uint32_t AES_Te4[256] = {
    0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
    0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
-const uint32_t AES_Td0[256] = {
+static const u32 Td0[256] = {
    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
@@ -454,7 +454,7 @@ const uint32_t AES_Td0[256] = {
    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
 };
-const uint32_t AES_Td1[256] = {
+static const u32 Td1[256] = {
    0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
    0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
    0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
@@ -520,7 +520,7 @@ const uint32_t AES_Td1[256] = {
    0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
    0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
 };
-const uint32_t AES_Td2[256] = {
+static const u32 Td2[256] = {
    0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
    0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
    0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
@@ -587,7 +587,7 @@ const uint32_t AES_Td2[256] = {
    0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
    0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
 };
-const uint32_t AES_Td3[256] = {
+static const u32 Td3[256] = {
    0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
    0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
    0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
@@ -653,7 +653,7 @@ const uint32_t AES_Td3[256] = {
    0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
    0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
 };
-const uint32_t AES_Td4[256] = {
+static const u32 Td4[256] = {
    0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
    0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
    0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
@@ -757,10 +757,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 		while (1) {
 			temp  = rk[3];
 			rk[4] = rk[0] ^
-                                (AES_Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (AES_Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (AES_Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (AES_Te4[(temp >> 24)       ] & 0x000000ff) ^
+				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
+				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
+				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
+				(Te4[(temp >> 24)       ] & 0x000000ff) ^
 				rcon[i];
 			rk[5] = rk[1] ^ rk[4];
 			rk[6] = rk[2] ^ rk[5];
@@ -777,10 +777,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 		while (1) {
 			temp = rk[ 5];
 			rk[ 6] = rk[ 0] ^
-                                (AES_Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (AES_Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (AES_Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (AES_Te4[(temp >> 24)       ] & 0x000000ff) ^
+				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
+				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
+				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
+				(Te4[(temp >> 24)       ] & 0x000000ff) ^
 				rcon[i];
 			rk[ 7] = rk[ 1] ^ rk[ 6];
 			rk[ 8] = rk[ 2] ^ rk[ 7];
@@ -799,10 +799,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 		while (1) {
 			temp = rk[ 7];
 			rk[ 8] = rk[ 0] ^
-                                (AES_Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-                                (AES_Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-                                (AES_Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-                                (AES_Te4[(temp >> 24)       ] & 0x000000ff) ^
+				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
+				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
+				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
+				(Te4[(temp >> 24)       ] & 0x000000ff) ^
 				rcon[i];
 			rk[ 9] = rk[ 1] ^ rk[ 8];
 			rk[10] = rk[ 2] ^ rk[ 9];
@@ -812,10 +812,10 @@ int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 			}
 			temp = rk[11];
 			rk[12] = rk[ 4] ^
-                                (AES_Te4[(temp >> 24)       ] & 0xff000000) ^
-                                (AES_Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
-                                (AES_Te4[(temp >>  8) & 0xff] & 0x0000ff00) ^
-                                (AES_Te4[(temp      ) & 0xff] & 0x000000ff);
+				(Te4[(temp >> 24)       ] & 0xff000000) ^
+				(Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
+				(Te4[(temp >>  8) & 0xff] & 0x0000ff00) ^
+				(Te4[(temp      ) & 0xff] & 0x000000ff);
 			rk[13] = rk[ 5] ^ rk[12];
 			rk[14] = rk[ 6] ^ rk[13];
 			rk[15] = rk[ 7] ^ rk[14];
@@ -854,25 +854,25 @@ int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 	for (i = 1; i < (key->rounds); i++) {
 		rk += 4;
 		rk[0] =
-                        AES_Td0[AES_Te4[(rk[0] >> 24)       ] & 0xff] ^
-                        AES_Td1[AES_Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
-                        AES_Td2[AES_Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
-                        AES_Td3[AES_Te4[(rk[0]      ) & 0xff] & 0xff];
+			Td0[Te4[(rk[0] >> 24)       ] & 0xff] ^
+			Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
+			Td2[Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
+			Td3[Te4[(rk[0]      ) & 0xff] & 0xff];
 		rk[1] =
-                        AES_Td0[AES_Te4[(rk[1] >> 24)       ] & 0xff] ^
-                        AES_Td1[AES_Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
-                        AES_Td2[AES_Te4[(rk[1] >>  8) & 0xff] & 0xff] ^
-                        AES_Td3[AES_Te4[(rk[1]      ) & 0xff] & 0xff];
+			Td0[Te4[(rk[1] >> 24)       ] & 0xff] ^
+			Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
+			Td2[Te4[(rk[1] >>  8) & 0xff] & 0xff] ^
+			Td3[Te4[(rk[1]      ) & 0xff] & 0xff];
 		rk[2] =
-                        AES_Td0[AES_Te4[(rk[2] >> 24)       ] & 0xff] ^
-                        AES_Td1[AES_Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
-                        AES_Td2[AES_Te4[(rk[2] >>  8) & 0xff] & 0xff] ^
-                        AES_Td3[AES_Te4[(rk[2]      ) & 0xff] & 0xff];
+			Td0[Te4[(rk[2] >> 24)       ] & 0xff] ^
+			Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
+			Td2[Te4[(rk[2] >>  8) & 0xff] & 0xff] ^
+			Td3[Te4[(rk[2]      ) & 0xff] & 0xff];
 		rk[3] =
-                        AES_Td0[AES_Te4[(rk[3] >> 24)       ] & 0xff] ^
-                        AES_Td1[AES_Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
-                        AES_Td2[AES_Te4[(rk[3] >>  8) & 0xff] & 0xff] ^
-                        AES_Td3[AES_Te4[(rk[3]      ) & 0xff] & 0xff];
+			Td0[Te4[(rk[3] >> 24)       ] & 0xff] ^
+			Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
+			Td2[Te4[(rk[3] >>  8) & 0xff] & 0xff] ^
+			Td3[Te4[(rk[3]      ) & 0xff] & 0xff];
 	}
 	return 0;
 }
@@ -904,72 +904,72 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
 	s3 = GETU32(in + 12) ^ rk[3];
 #ifdef FULL_UNROLL
 	/* round 1: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[ 4];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[ 5];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[ 6];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[ 7];
+   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
+   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
+   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
+   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
   	/* round 2: */
-        s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[ 8];
-        s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[ 9];
-        s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[10];
-        s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[11];
+   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
+   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
+   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
+   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
 	/* round 3: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[12];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[13];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[14];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[15];
+   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
+   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
+   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
+   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
   	/* round 4: */
-        s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[16];
-        s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[17];
-        s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[18];
-        s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[19];
+   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
+   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
+   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
+   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
 	/* round 5: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[20];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[21];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[22];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[23];
+   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
+   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
+   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
+   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
   	/* round 6: */
-        s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[24];
-        s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[25];
-        s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[26];
-        s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[27];
+   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
+   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
+   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
+   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
 	/* round 7: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[28];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[29];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[30];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[31];
+   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
+   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
+   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
+   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
   	/* round 8: */
-        s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[32];
-        s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[33];
-        s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[34];
-        s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[35];
+   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
+   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
+   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
+   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
 	/* round 9: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[36];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[37];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[38];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[39];
+   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
+   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
+   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
+   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
    if (key->rounds > 10) {
        /* round 10: */
-        s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[40];
-        s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[41];
-        s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[42];
-        s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[43];
+        s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
+        s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[41];
+        s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[42];
+        s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[43];
        /* round 11: */
-        t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[44];
-        t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[45];
-        t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[46];
-        t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[47];
+        t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[44];
+        t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[45];
+        t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[46];
+        t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[47];
        if (key->rounds > 12) {
            /* round 12: */
-            s0 = AES_Te0[t0 >> 24] ^ AES_Te1[(t1 >> 16) & 0xff] ^ AES_Te2[(t2 >>  8) & 0xff] ^ AES_Te3[t3 & 0xff] ^ rk[48];
-            s1 = AES_Te0[t1 >> 24] ^ AES_Te1[(t2 >> 16) & 0xff] ^ AES_Te2[(t3 >>  8) & 0xff] ^ AES_Te3[t0 & 0xff] ^ rk[49];
-            s2 = AES_Te0[t2 >> 24] ^ AES_Te1[(t3 >> 16) & 0xff] ^ AES_Te2[(t0 >>  8) & 0xff] ^ AES_Te3[t1 & 0xff] ^ rk[50];
-            s3 = AES_Te0[t3 >> 24] ^ AES_Te1[(t0 >> 16) & 0xff] ^ AES_Te2[(t1 >>  8) & 0xff] ^ AES_Te3[t2 & 0xff] ^ rk[51];
+            s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[48];
+            s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[49];
+            s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[50];
+            s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[51];
            /* round 13: */
-            t0 = AES_Te0[s0 >> 24] ^ AES_Te1[(s1 >> 16) & 0xff] ^ AES_Te2[(s2 >>  8) & 0xff] ^ AES_Te3[s3 & 0xff] ^ rk[52];
-            t1 = AES_Te0[s1 >> 24] ^ AES_Te1[(s2 >> 16) & 0xff] ^ AES_Te2[(s3 >>  8) & 0xff] ^ AES_Te3[s0 & 0xff] ^ rk[53];
-            t2 = AES_Te0[s2 >> 24] ^ AES_Te1[(s3 >> 16) & 0xff] ^ AES_Te2[(s0 >>  8) & 0xff] ^ AES_Te3[s1 & 0xff] ^ rk[54];
-            t3 = AES_Te0[s3 >> 24] ^ AES_Te1[(s0 >> 16) & 0xff] ^ AES_Te2[(s1 >>  8) & 0xff] ^ AES_Te3[s2 & 0xff] ^ rk[55];
+            t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[52];
+            t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[53];
+            t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[54];
+            t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[55];
        }
    }
    rk += key->rounds << 2;
@@ -980,28 +980,28 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
    r = key->rounds >> 1;
    for (;;) {
        t0 =
-            AES_Te0[(s0 >> 24)       ] ^
-            AES_Te1[(s1 >> 16) & 0xff] ^
-            AES_Te2[(s2 >>  8) & 0xff] ^
-            AES_Te3[(s3      ) & 0xff] ^
+            Te0[(s0 >> 24)       ] ^
+            Te1[(s1 >> 16) & 0xff] ^
+            Te2[(s2 >>  8) & 0xff] ^
+            Te3[(s3      ) & 0xff] ^
            rk[4];
        t1 =
-            AES_Te0[(s1 >> 24)       ] ^
-            AES_Te1[(s2 >> 16) & 0xff] ^
-            AES_Te2[(s3 >>  8) & 0xff] ^
-            AES_Te3[(s0      ) & 0xff] ^
+            Te0[(s1 >> 24)       ] ^
+            Te1[(s2 >> 16) & 0xff] ^
+            Te2[(s3 >>  8) & 0xff] ^
+            Te3[(s0      ) & 0xff] ^
            rk[5];
        t2 =
-            AES_Te0[(s2 >> 24)       ] ^
-            AES_Te1[(s3 >> 16) & 0xff] ^
-            AES_Te2[(s0 >>  8) & 0xff] ^
-            AES_Te3[(s1      ) & 0xff] ^
+            Te0[(s2 >> 24)       ] ^
+            Te1[(s3 >> 16) & 0xff] ^
+            Te2[(s0 >>  8) & 0xff] ^
+            Te3[(s1      ) & 0xff] ^
            rk[6];
        t3 =
-            AES_Te0[(s3 >> 24)       ] ^
-            AES_Te1[(s0 >> 16) & 0xff] ^
-            AES_Te2[(s1 >>  8) & 0xff] ^
-            AES_Te3[(s2      ) & 0xff] ^
+            Te0[(s3 >> 24)       ] ^
+            Te1[(s0 >> 16) & 0xff] ^
+            Te2[(s1 >>  8) & 0xff] ^
+            Te3[(s2      ) & 0xff] ^
            rk[7];

        rk += 8;
@@ -1010,28 +1010,28 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
        }

        s0 =
-            AES_Te0[(t0 >> 24)       ] ^
-            AES_Te1[(t1 >> 16) & 0xff] ^
-            AES_Te2[(t2 >>  8) & 0xff] ^
-            AES_Te3[(t3      ) & 0xff] ^
+            Te0[(t0 >> 24)       ] ^
+            Te1[(t1 >> 16) & 0xff] ^
+            Te2[(t2 >>  8) & 0xff] ^
+            Te3[(t3      ) & 0xff] ^
            rk[0];
        s1 =
-            AES_Te0[(t1 >> 24)       ] ^
-            AES_Te1[(t2 >> 16) & 0xff] ^
-            AES_Te2[(t3 >>  8) & 0xff] ^
-            AES_Te3[(t0      ) & 0xff] ^
+            Te0[(t1 >> 24)       ] ^
+            Te1[(t2 >> 16) & 0xff] ^
+            Te2[(t3 >>  8) & 0xff] ^
+            Te3[(t0      ) & 0xff] ^
            rk[1];
        s2 =
-            AES_Te0[(t2 >> 24)       ] ^
-            AES_Te1[(t3 >> 16) & 0xff] ^
-            AES_Te2[(t0 >>  8) & 0xff] ^
-            AES_Te3[(t1      ) & 0xff] ^
+            Te0[(t2 >> 24)       ] ^
+            Te1[(t3 >> 16) & 0xff] ^
+            Te2[(t0 >>  8) & 0xff] ^
+            Te3[(t1      ) & 0xff] ^
            rk[2];
        s3 =
-            AES_Te0[(t3 >> 24)       ] ^
-            AES_Te1[(t0 >> 16) & 0xff] ^
-            AES_Te2[(t1 >>  8) & 0xff] ^
-            AES_Te3[(t2      ) & 0xff] ^
+            Te0[(t3 >> 24)       ] ^
+            Te1[(t0 >> 16) & 0xff] ^
+            Te2[(t1 >>  8) & 0xff] ^
+            Te3[(t2      ) & 0xff] ^
            rk[3];
    }
 #endif /* ?FULL_UNROLL */
@@ -1040,31 +1040,31 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
 	 * map cipher state to byte array block:
 	 */
 	s0 =
-                (AES_Te4[(t0 >> 24)       ] & 0xff000000) ^
-                (AES_Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Te4[(t3      ) & 0xff] & 0x000000ff) ^
+		(Te4[(t0 >> 24)       ] & 0xff000000) ^
+		(Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
+		(Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
+		(Te4[(t3      ) & 0xff] & 0x000000ff) ^
 		rk[0];
 	PUTU32(out     , s0);
 	s1 =
-                (AES_Te4[(t1 >> 24)       ] & 0xff000000) ^
-                (AES_Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Te4[(t0      ) & 0xff] & 0x000000ff) ^
+		(Te4[(t1 >> 24)       ] & 0xff000000) ^
+		(Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
+		(Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
+		(Te4[(t0      ) & 0xff] & 0x000000ff) ^
 		rk[1];
 	PUTU32(out +  4, s1);
 	s2 =
-                (AES_Te4[(t2 >> 24)       ] & 0xff000000) ^
-                (AES_Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Te4[(t1      ) & 0xff] & 0x000000ff) ^
+		(Te4[(t2 >> 24)       ] & 0xff000000) ^
+		(Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
+		(Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
+		(Te4[(t1      ) & 0xff] & 0x000000ff) ^
 		rk[2];
 	PUTU32(out +  8, s2);
 	s3 =
-                (AES_Te4[(t3 >> 24)       ] & 0xff000000) ^
-                (AES_Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Te4[(t2      ) & 0xff] & 0x000000ff) ^
+		(Te4[(t3 >> 24)       ] & 0xff000000) ^
+		(Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
+		(Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
+		(Te4[(t2      ) & 0xff] & 0x000000ff) ^
 		rk[3];
 	PUTU32(out + 12, s3);
 }
@@ -1095,72 +1095,72 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
    s3 = GETU32(in + 12) ^ rk[3];
 #ifdef FULL_UNROLL
    /* round 1: */
-    t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[ 4];
-    t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[ 5];
-    t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[ 6];
-    t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[ 7];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[ 4];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[ 5];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[ 6];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[ 7];
    /* round 2: */
-    s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[ 8];
-    s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[ 9];
-    s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[10];
-    s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[11];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[ 8];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[ 9];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[10];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[11];
    /* round 3: */
-    t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[12];
-    t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[13];
-    t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[14];
-    t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[15];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[12];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[13];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[14];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[15];
    /* round 4: */
-    s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[16];
-    s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[17];
-    s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[18];
-    s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[19];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[16];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[17];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[18];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[19];
    /* round 5: */
-    t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[20];
-    t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[21];
-    t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[22];
-    t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[23];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[20];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[21];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[22];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[23];
    /* round 6: */
-    s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[24];
-    s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[25];
-    s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[26];
-    s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[27];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[24];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[25];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[26];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[27];
    /* round 7: */
-    t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[28];
-    t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[29];
-    t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[30];
-    t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[31];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[28];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[29];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[30];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[31];
    /* round 8: */
-    s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[32];
-    s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[33];
-    s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[34];
-    s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[35];
+    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[32];
+    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[33];
+    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[34];
+    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[35];
    /* round 9: */
-    t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[36];
-    t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[37];
-    t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[38];
-    t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[39];
+    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[36];
+    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[37];
+    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[38];
+    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[39];
    if (key->rounds > 10) {
        /* round 10: */
-        s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[40];
-        s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[41];
-        s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[42];
-        s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[43];
+        s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[40];
+        s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[41];
+        s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[42];
+        s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[43];
        /* round 11: */
-        t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[44];
-        t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[45];
-        t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[46];
-        t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[47];
+        t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[44];
+        t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[45];
+        t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[46];
+        t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[47];
        if (key->rounds > 12) {
            /* round 12: */
-            s0 = AES_Td0[t0 >> 24] ^ AES_Td1[(t3 >> 16) & 0xff] ^ AES_Td2[(t2 >>  8) & 0xff] ^ AES_Td3[t1 & 0xff] ^ rk[48];
-            s1 = AES_Td0[t1 >> 24] ^ AES_Td1[(t0 >> 16) & 0xff] ^ AES_Td2[(t3 >>  8) & 0xff] ^ AES_Td3[t2 & 0xff] ^ rk[49];
-            s2 = AES_Td0[t2 >> 24] ^ AES_Td1[(t1 >> 16) & 0xff] ^ AES_Td2[(t0 >>  8) & 0xff] ^ AES_Td3[t3 & 0xff] ^ rk[50];
-            s3 = AES_Td0[t3 >> 24] ^ AES_Td1[(t2 >> 16) & 0xff] ^ AES_Td2[(t1 >>  8) & 0xff] ^ AES_Td3[t0 & 0xff] ^ rk[51];
+            s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[48];
+            s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[49];
+            s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[50];
+            s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[51];
            /* round 13: */
-            t0 = AES_Td0[s0 >> 24] ^ AES_Td1[(s3 >> 16) & 0xff] ^ AES_Td2[(s2 >>  8) & 0xff] ^ AES_Td3[s1 & 0xff] ^ rk[52];
-            t1 = AES_Td0[s1 >> 24] ^ AES_Td1[(s0 >> 16) & 0xff] ^ AES_Td2[(s3 >>  8) & 0xff] ^ AES_Td3[s2 & 0xff] ^ rk[53];
-            t2 = AES_Td0[s2 >> 24] ^ AES_Td1[(s1 >> 16) & 0xff] ^ AES_Td2[(s0 >>  8) & 0xff] ^ AES_Td3[s3 & 0xff] ^ rk[54];
-            t3 = AES_Td0[s3 >> 24] ^ AES_Td1[(s2 >> 16) & 0xff] ^ AES_Td2[(s1 >>  8) & 0xff] ^ AES_Td3[s0 & 0xff] ^ rk[55];
+            t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[52];
+            t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[53];
+            t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[54];
+            t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[55];
        }
    }
 	rk += key->rounds << 2;
@@ -1171,28 +1171,28 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
    r = key->rounds >> 1;
    for (;;) {
        t0 =
-            AES_Td0[(s0 >> 24)       ] ^
-            AES_Td1[(s3 >> 16) & 0xff] ^
-            AES_Td2[(s2 >>  8) & 0xff] ^
-            AES_Td3[(s1      ) & 0xff] ^
+            Td0[(s0 >> 24)       ] ^
+            Td1[(s3 >> 16) & 0xff] ^
+            Td2[(s2 >>  8) & 0xff] ^
+            Td3[(s1      ) & 0xff] ^
            rk[4];
        t1 =
-            AES_Td0[(s1 >> 24)       ] ^
-            AES_Td1[(s0 >> 16) & 0xff] ^
-            AES_Td2[(s3 >>  8) & 0xff] ^
-            AES_Td3[(s2      ) & 0xff] ^
+            Td0[(s1 >> 24)       ] ^
+            Td1[(s0 >> 16) & 0xff] ^
+            Td2[(s3 >>  8) & 0xff] ^
+            Td3[(s2      ) & 0xff] ^
            rk[5];
        t2 =
-            AES_Td0[(s2 >> 24)       ] ^
-            AES_Td1[(s1 >> 16) & 0xff] ^
-            AES_Td2[(s0 >>  8) & 0xff] ^
-            AES_Td3[(s3      ) & 0xff] ^
+            Td0[(s2 >> 24)       ] ^
+            Td1[(s1 >> 16) & 0xff] ^
+            Td2[(s0 >>  8) & 0xff] ^
+            Td3[(s3      ) & 0xff] ^
            rk[6];
        t3 =
-            AES_Td0[(s3 >> 24)       ] ^
-            AES_Td1[(s2 >> 16) & 0xff] ^
-            AES_Td2[(s1 >>  8) & 0xff] ^
-            AES_Td3[(s0      ) & 0xff] ^
+            Td0[(s3 >> 24)       ] ^
+            Td1[(s2 >> 16) & 0xff] ^
+            Td2[(s1 >>  8) & 0xff] ^
+            Td3[(s0      ) & 0xff] ^
            rk[7];

        rk += 8;
@@ -1201,28 +1201,28 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
        }

        s0 =
-            AES_Td0[(t0 >> 24)       ] ^
-            AES_Td1[(t3 >> 16) & 0xff] ^
-            AES_Td2[(t2 >>  8) & 0xff] ^
-            AES_Td3[(t1      ) & 0xff] ^
+            Td0[(t0 >> 24)       ] ^
+            Td1[(t3 >> 16) & 0xff] ^
+            Td2[(t2 >>  8) & 0xff] ^
+            Td3[(t1      ) & 0xff] ^
            rk[0];
        s1 =
-            AES_Td0[(t1 >> 24)       ] ^
-            AES_Td1[(t0 >> 16) & 0xff] ^
-            AES_Td2[(t3 >>  8) & 0xff] ^
-            AES_Td3[(t2      ) & 0xff] ^
+            Td0[(t1 >> 24)       ] ^
+            Td1[(t0 >> 16) & 0xff] ^
+            Td2[(t3 >>  8) & 0xff] ^
+            Td3[(t2      ) & 0xff] ^
            rk[1];
        s2 =
-            AES_Td0[(t2 >> 24)       ] ^
-            AES_Td1[(t1 >> 16) & 0xff] ^
-            AES_Td2[(t0 >>  8) & 0xff] ^
-            AES_Td3[(t3      ) & 0xff] ^
+            Td0[(t2 >> 24)       ] ^
+            Td1[(t1 >> 16) & 0xff] ^
+            Td2[(t0 >>  8) & 0xff] ^
+            Td3[(t3      ) & 0xff] ^
            rk[2];
        s3 =
-            AES_Td0[(t3 >> 24)       ] ^
-            AES_Td1[(t2 >> 16) & 0xff] ^
-            AES_Td2[(t1 >>  8) & 0xff] ^
-            AES_Td3[(t0      ) & 0xff] ^
+            Td0[(t3 >> 24)       ] ^
+            Td1[(t2 >> 16) & 0xff] ^
+            Td2[(t1 >>  8) & 0xff] ^
+            Td3[(t0      ) & 0xff] ^
            rk[3];
    }
 #endif /* ?FULL_UNROLL */
@@ -1231,31 +1231,31 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 	 * map cipher state to byte array block:
 	 */
   	s0 =
-                (AES_Td4[(t0 >> 24)       ] & 0xff000000) ^
-                (AES_Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Td4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Td4[(t1      ) & 0xff] & 0x000000ff) ^
+   		(Td4[(t0 >> 24)       ] & 0xff000000) ^
+   		(Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
+   		(Td4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
+   		(Td4[(t1      ) & 0xff] & 0x000000ff) ^
   		rk[0];
 	PUTU32(out     , s0);
   	s1 =
-                (AES_Td4[(t1 >> 24)       ] & 0xff000000) ^
-                (AES_Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Td4[(t2      ) & 0xff] & 0x000000ff) ^
+   		(Td4[(t1 >> 24)       ] & 0xff000000) ^
+   		(Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
+   		(Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
+   		(Td4[(t2      ) & 0xff] & 0x000000ff) ^
   		rk[1];
 	PUTU32(out +  4, s1);
   	s2 =
-                (AES_Td4[(t2 >> 24)       ] & 0xff000000) ^
-                (AES_Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Td4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Td4[(t3      ) & 0xff] & 0x000000ff) ^
+   		(Td4[(t2 >> 24)       ] & 0xff000000) ^
+   		(Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
+   		(Td4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
+   		(Td4[(t3      ) & 0xff] & 0x000000ff) ^
   		rk[2];
 	PUTU32(out +  8, s2);
   	s3 =
-                (AES_Td4[(t3 >> 24)       ] & 0xff000000) ^
-                (AES_Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-                (AES_Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-                (AES_Td4[(t0      ) & 0xff] & 0x000000ff) ^
+   		(Td4[(t3 >> 24)       ] & 0xff000000) ^
+   		(Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
+   		(Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
+   		(Td4[(t0      ) & 0xff] & 0x000000ff) ^
   		rk[3];
 	PUTU32(out + 12, s3);
 }
--- a/include/qemu/aes.h
+++ b/include/qemu/aes.h
@@ -23,23 +23,4 @@ void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 		     const unsigned long length, const AES_KEY *key,
 		     unsigned char *ivec, const int enc);

-/*
-AES_Te0[x] = S [x].[02, 01, 01, 03];
-AES_Te1[x] = S [x].[03, 02, 01, 01];
-AES_Te2[x] = S [x].[01, 03, 02, 01];
-AES_Te3[x] = S [x].[01, 01, 03, 02];
-AES_Te4[x] = S [x].[01, 01, 01, 01];
-
-AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
-AES_Td1[x] = Si[x].[0b, 0e, 09, 0d];
-AES_Td2[x] = Si[x].[0d, 0b, 0e, 09];
-AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
-AES_Td4[x] = Si[x].[01, 01, 01, 01];
-*/
-
-extern const uint32_t AES_Te0[256], AES_Te1[256], AES_Te2[256],
-                      AES_Te3[256], AES_Te4[256];
-extern const uint32_t AES_Td0[256], AES_Td1[256], AES_Td2[256],
-                      AES_Td3[256], AES_Td4[256];
-
 #endif
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -1,255 +0,0 @@
-/*
- * QEMU aio implementation
- *
- * Copyright IBM, Corp. 2008
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
-
-struct AioHandler
-{
-    GPollFD pfd;
-    IOHandler *io_read;
-    IOHandler *io_write;
-    AioFlushHandler *io_flush;
-    int deleted;
-    int pollfds_idx;
-    void *opaque;
-    QLIST_ENTRY(AioHandler) node;
-};
-
-static AioHandler *find_aio_handler(AioContext *ctx, int fd)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->pfd.fd == fd)
-            if (!node->deleted)
-                return node;
-    }
-
-    return NULL;
-}
-
-void aio_set_fd_handler(AioContext *ctx,
-                        int fd,
-                        IOHandler *io_read,
-                        IOHandler *io_write,
-                        AioFlushHandler *io_flush,
-                        void *opaque)
-{
-    AioHandler *node;
-
-    node = find_aio_handler(ctx, fd);
-
-    /* Are we deleting the fd handler? */
-    if (!io_read && !io_write) {
-        if (node) {
-            g_source_remove_poll(&ctx->source, &node->pfd);
-
-            /* If the lock is held, just mark the node as deleted */
-            if (ctx->walking_handlers) {
-                node->deleted = 1;
-                node->pfd.revents = 0;
-            } else {
-                /* Otherwise, delete it for real.  We can't just mark it as
-                 * deleted because deleted nodes are only cleaned up after
-                 * releasing the walking_handlers lock.
-                 */
-                QLIST_REMOVE(node, node);
-                g_free(node);
-            }
-        }
-    } else {
-        if (node == NULL) {
-            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
-            node->pfd.fd = fd;
-            QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
-
-            g_source_add_poll(&ctx->source, &node->pfd);
-        }
-        /* Update handler with latest information */
-        node->io_read = io_read;
-        node->io_write = io_write;
-        node->io_flush = io_flush;
-        node->opaque = opaque;
-        node->pollfds_idx = -1;
-
-        node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0);
-        node->pfd.events |= (io_write ? G_IO_OUT | G_IO_ERR : 0);
-    }
-
-    aio_notify(ctx);
-}
-
-void aio_set_event_notifier(AioContext *ctx,
-                            EventNotifier *notifier,
-                            EventNotifierHandler *io_read,
-                            AioFlushEventNotifierHandler *io_flush)
-{
-    aio_set_fd_handler(ctx, event_notifier_get_fd(notifier),
-                       (IOHandler *)io_read, NULL,
-                       (AioFlushHandler *)io_flush, notifier);
-}
-
-bool aio_pending(AioContext *ctx)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        int revents;
-
-        revents = node->pfd.revents & node->pfd.events;
-        if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
-            return true;
-        }
-        if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-static bool aio_dispatch(AioContext *ctx)
-{
-    AioHandler *node;
-    bool progress = false;
-
-    /*
-     * We have to walk very carefully in case qemu_aio_set_fd_handler is
-     * called while we're walking.
-     */
-    node = QLIST_FIRST(&ctx->aio_handlers);
-    while (node) {
-        AioHandler *tmp;
-        int revents;
-
-        ctx->walking_handlers++;
-
-        revents = node->pfd.revents & node->pfd.events;
-        node->pfd.revents = 0;
-
-        if (!node->deleted &&
-            (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) &&
-            node->io_read) {
-            node->io_read(node->opaque);
-            progress = true;
-        }
-        if (!node->deleted &&
-            (revents & (G_IO_OUT | G_IO_ERR)) &&
-            node->io_write) {
-            node->io_write(node->opaque);
-            progress = true;
-        }
-
-        tmp = node;
-        node = QLIST_NEXT(node, node);
-
-        ctx->walking_handlers--;
-
-        if (!ctx->walking_handlers && tmp->deleted) {
-            QLIST_REMOVE(tmp, node);
-            g_free(tmp);
-        }
-    }
-    return progress;
-}
-
-bool aio_poll(AioContext *ctx, bool blocking)
-{
-    AioHandler *node;
-    int ret;
-    bool busy, progress;
-
-    progress = false;
-
-    /*
-     * If there are callbacks left that have been queued, we need to call them.
-     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for qemu_aio_wait loops).
-     */
-    if (aio_bh_poll(ctx)) {
-        blocking = false;
-        progress = true;
-    }
-
-    if (aio_dispatch(ctx)) {
-        progress = true;
-    }
-
-    if (progress && !blocking) {
-        return true;
-    }
-
-    ctx->walking_handlers++;
-
-    g_array_set_size(ctx->pollfds, 0);
-
-    /* fill pollfds */
-    busy = false;
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        node->pollfds_idx = -1;
-
-        /* If there aren't pending AIO operations, don't invoke callbacks.
-         * Otherwise, if there are no AIO requests, qemu_aio_wait() would
-         * wait indefinitely.
-         */
-        if (!node->deleted && node->io_flush) {
-            if (node->io_flush(node->opaque) == 0) {
-                continue;
-            }
-            busy = true;
-        }
-        if (!node->deleted && node->pfd.events) {
-            GPollFD pfd = {
-                .fd = node->pfd.fd,
-                .events = node->pfd.events,
-            };
-            node->pollfds_idx = ctx->pollfds->len;
-            g_array_append_val(ctx->pollfds, pfd);
-        }
-    }
-
-    ctx->walking_handlers--;
-
-    /* No AIO operations?  Get us out of here */
-    if (!busy) {
-        return progress;
-    }
-
-    /* wait until next event */
-    ret = g_poll((GPollFD *)ctx->pollfds->data,
-                 ctx->pollfds->len,
-                 blocking ? -1 : 0);
-
-    /* if we have any readable fds, dispatch event */
-    if (ret > 0) {
-        QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-            if (node->pollfds_idx != -1) {
-                GPollFD *pfd = &g_array_index(ctx->pollfds, GPollFD,
-                                              node->pollfds_idx);
-                node->pfd.revents = pfd->revents;
-            }
-        }
-        if (aio_dispatch(ctx)) {
-            progress = true;
-        }
-    }
-
-    assert(progress || busy);
-    return true;
-}
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -1,219 +0,0 @@
-/*
- * QEMU aio implementation
- *
- * Copyright IBM Corp., 2008
- * Copyright Red Hat Inc., 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *  Paolo Bonzini     <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
-
-struct AioHandler {
-    EventNotifier *e;
-    EventNotifierHandler *io_notify;
-    AioFlushEventNotifierHandler *io_flush;
-    GPollFD pfd;
-    int deleted;
-    QLIST_ENTRY(AioHandler) node;
-};
-
-void aio_set_event_notifier(AioContext *ctx,
-                            EventNotifier *e,
-                            EventNotifierHandler *io_notify,
-                            AioFlushEventNotifierHandler *io_flush)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->e == e && !node->deleted) {
-            break;
-        }
-    }
-
-    /* Are we deleting the fd handler? */
-    if (!io_notify) {
-        if (node) {
-            g_source_remove_poll(&ctx->source, &node->pfd);
-
-            /* If the lock is held, just mark the node as deleted */
-            if (ctx->walking_handlers) {
-                node->deleted = 1;
-                node->pfd.revents = 0;
-            } else {
-                /* Otherwise, delete it for real.  We can't just mark it as
-                 * deleted because deleted nodes are only cleaned up after
-                 * releasing the walking_handlers lock.
-                 */
-                QLIST_REMOVE(node, node);
-                g_free(node);
-            }
-        }
-    } else {
-        if (node == NULL) {
-            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
-            node->e = e;
-            node->pfd.fd = (uintptr_t)event_notifier_get_handle(e);
-            node->pfd.events = G_IO_IN;
-            QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
-
-            g_source_add_poll(&ctx->source, &node->pfd);
-        }
-        /* Update handler with latest information */
-        node->io_notify = io_notify;
-        node->io_flush = io_flush;
-    }
-
-    aio_notify(ctx);
-}
-
-bool aio_pending(AioContext *ctx)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->pfd.revents && node->io_notify) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-bool aio_poll(AioContext *ctx, bool blocking)
-{
-    AioHandler *node;
-    HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
-    bool busy, progress;
-    int count;
-
-    progress = false;
-
-    /*
-     * If there are callbacks left that have been queued, we need to call then.
-     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for qemu_aio_wait loops).
-     */
-    if (aio_bh_poll(ctx)) {
-        blocking = false;
-        progress = true;
-    }
-
-    /*
-     * Then dispatch any pending callbacks from the GSource.
-     *
-     * We have to walk very carefully in case qemu_aio_set_fd_handler is
-     * called while we're walking.
-     */
-    node = QLIST_FIRST(&ctx->aio_handlers);
-    while (node) {
-        AioHandler *tmp;
-
-        ctx->walking_handlers++;
-
-        if (node->pfd.revents && node->io_notify) {
-            node->pfd.revents = 0;
-            node->io_notify(node->e);
-            progress = true;
-        }
-
-        tmp = node;
-        node = QLIST_NEXT(node, node);
-
-        ctx->walking_handlers--;
-
-        if (!ctx->walking_handlers && tmp->deleted) {
-            QLIST_REMOVE(tmp, node);
-            g_free(tmp);
-        }
-    }
-
-    if (progress && !blocking) {
-        return true;
-    }
-
-    ctx->walking_handlers++;
-
-    /* fill fd sets */
-    busy = false;
-    count = 0;
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        /* If there aren't pending AIO operations, don't invoke callbacks.
-         * Otherwise, if there are no AIO requests, qemu_aio_wait() would
-         * wait indefinitely.
-         */
-        if (!node->deleted && node->io_flush) {
-            if (node->io_flush(node->e) == 0) {
-                continue;
-            }
-            busy = true;
-        }
-        if (!node->deleted && node->io_notify) {
-            events[count++] = event_notifier_get_handle(node->e);
-        }
-    }
-
-    ctx->walking_handlers--;
-
-    /* No AIO operations?  Get us out of here */
-    if (!busy) {
-        return progress;
-    }
-
-    /* wait until next event */
-    while (count > 0) {
-        int timeout = blocking ? INFINITE : 0;
-        int ret = WaitForMultipleObjects(count, events, FALSE, timeout);
-
-        /* if we have any signaled events, dispatch event */
-        if ((DWORD) (ret - WAIT_OBJECT_0) >= count) {
-            break;
-        }
-
-        blocking = false;
-
-        /* we have to walk very carefully in case
-         * qemu_aio_set_fd_handler is called while we're walking */
-        node = QLIST_FIRST(&ctx->aio_handlers);
-        while (node) {
-            AioHandler *tmp;
-
-            ctx->walking_handlers++;
-
-            if (!node->deleted &&
-                event_notifier_get_handle(node->e) == events[ret - WAIT_OBJECT_0] &&
-                node->io_notify) {
-                node->io_notify(node->e);
-                progress = true;
-            }
-
-            tmp = node;
-            node = QLIST_NEXT(node, node);
-
-            ctx->walking_handlers--;
-
-            if (!ctx->walking_handlers && tmp->deleted) {
-                QLIST_REMOVE(tmp, node);
-                g_free(tmp);
-            }
-        }
-
-        /* Try again, but only call each handler once.  */
-        events[ret - WAIT_OBJECT_0] = events[--count];
-    }
-
-    assert(progress || busy);
-    return true;
-}
--- a/aio.c
+++ b/aio.c
@@ -0,0 +1,194 @@
+/*
+ * QEMU aio implementation
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu-common.h"
+#include "block.h"
+#include "qemu-queue.h"
+#include "qemu_socket.h"
+
+typedef struct AioHandler AioHandler;
+
+/* The list of registered AIO handlers */
+static QLIST_HEAD(, AioHandler) aio_handlers;
+
+/* This is a simple lock used to protect the aio_handlers list.  Specifically,
+ * it's used to ensure that no callbacks are removed while we're walking and
+ * dispatching callbacks.
+ */
+static int walking_handlers;
+
+struct AioHandler
+{
+    int fd;
+    IOHandler *io_read;
+    IOHandler *io_write;
+    AioFlushHandler *io_flush;
+    int deleted;
+    void *opaque;
+    QLIST_ENTRY(AioHandler) node;
+};
+
+static AioHandler *find_aio_handler(int fd)
+{
+    AioHandler *node;
+
+    QLIST_FOREACH(node, &aio_handlers, node) {
+        if (node->fd == fd)
+            if (!node->deleted)
+                return node;
+    }
+
+    return NULL;
+}
+
+int qemu_aio_set_fd_handler(int fd,
+                            IOHandler *io_read,
+                            IOHandler *io_write,
+                            AioFlushHandler *io_flush,
+                            void *opaque)
+{
+    AioHandler *node;
+
+    node = find_aio_handler(fd);
+
+    /* Are we deleting the fd handler? */
+    if (!io_read && !io_write) {
+        if (node) {
+            /* If the lock is held, just mark the node as deleted */
+            if (walking_handlers)
+                node->deleted = 1;
+            else {
+                /* Otherwise, delete it for real.  We can't just mark it as
+                 * deleted because deleted nodes are only cleaned up after
+                 * releasing the walking_handlers lock.
+                 */
+                QLIST_REMOVE(node, node);
+                g_free(node);
+            }
+        }
+    } else {
+        if (node == NULL) {
+            /* Alloc and insert if it's not already there */
+            node = g_malloc0(sizeof(AioHandler));
+            node->fd = fd;
+            QLIST_INSERT_HEAD(&aio_handlers, node, node);
+        }
+        /* Update handler with latest information */
+        node->io_read = io_read;
+        node->io_write = io_write;
+        node->io_flush = io_flush;
+        node->opaque = opaque;
+    }
+
+    qemu_set_fd_handler2(fd, NULL, io_read, io_write, opaque);
+
+    return 0;
+}
+
+void qemu_aio_flush(void)
+{
+    while (qemu_aio_wait());
+}
+
+bool qemu_aio_wait(void)
+{
+    AioHandler *node;
+    fd_set rdfds, wrfds;
+    int max_fd = -1;
+    int ret;
+    bool busy;
+
+    /*
+     * If there are callbacks left that have been queued, we need to call then.
+     * Do not call select in this case, because it is possible that the caller
+     * does not need a complete flush (as is the case for qemu_aio_wait loops).
+     */
+    if (qemu_bh_poll()) {
+        return true;
+    }
+
+    walking_handlers = 1;
+
+    FD_ZERO(&rdfds);
+    FD_ZERO(&wrfds);
+
+    /* fill fd sets */
+    busy = false;
+    QLIST_FOREACH(node, &aio_handlers, node) {
+        /* If there aren't pending AIO operations, don't invoke callbacks.
+         * Otherwise, if there are no AIO requests, qemu_aio_wait() would
+         * wait indefinitely.
+         */
+        if (node->io_flush) {
+            if (node->io_flush(node->opaque) == 0) {
+                continue;
+            }
+            busy = true;
+        }
+        if (!node->deleted && node->io_read) {
+            FD_SET(node->fd, &rdfds);
+            max_fd = MAX(max_fd, node->fd + 1);
+        }
+        if (!node->deleted && node->io_write) {
+            FD_SET(node->fd, &wrfds);
+            max_fd = MAX(max_fd, node->fd + 1);
+        }
+    }
+
+    walking_handlers = 0;
+
+    /* No AIO operations?  Get us out of here */
+    if (!busy) {
+        return false;
+    }
+
+    /* wait until next event */
+    ret = select(max_fd, &rdfds, &wrfds, NULL, NULL);
+
+    /* if we have any readable fds, dispatch event */
+    if (ret > 0) {
+        walking_handlers = 1;
+
+        /* we have to walk very carefully in case
+         * qemu_aio_set_fd_handler is called while we're walking */
+        node = QLIST_FIRST(&aio_handlers);
+        while (node) {
+            AioHandler *tmp;
+
+            if (!node->deleted &&
+                FD_ISSET(node->fd, &rdfds) &&
+                node->io_read) {
+                node->io_read(node->opaque);
+            }
+            if (!node->deleted &&
+                FD_ISSET(node->fd, &wrfds) &&
+                node->io_write) {
+                node->io_write(node->opaque);
+            }
+
+            tmp = node;
+            node = QLIST_NEXT(node, node);
+
+            if (tmp->deleted) {
+                QLIST_REMOVE(tmp, node);
+                g_free(tmp);
+            }
+        }
+
+        walking_handlers = 0;
+    }
+
+    return true;
+}
--- a/disas/alpha.c
+++ b/disas/alpha.c
@@ -20,7 +20,7 @@ along with this file; see the file COPYING.  If not, see
 <http://www.gnu.org/licenses/>. */

 #include <stdio.h>
-#include "disas/bfd.h"
+#include "dis-asm.h"

 /* MAX is redefined below, so remove any previous definition. */
 #undef MAX
--- a/ldscripts/alpha.ld
+++ b/ldscripts/alpha.ld
--- a/arch_init.c
+++ b/arch_init.c
--- a/include/sysemu/arch_init.h
+++ b/include/sysemu/arch_init.h
@@ -1,9 +1,6 @@
 #ifndef QEMU_ARCH_INIT_H
 #define QEMU_ARCH_INIT_H

-#include "qmp-commands.h"
-#include "qemu/option.h"
-
 enum {
    QEMU_ARCH_ALL = -1,
    QEMU_ARCH_ALPHA = 1,
@@ -19,22 +16,18 @@ enum {
    QEMU_ARCH_SH4 = 1024,
    QEMU_ARCH_SPARC = 2048,
    QEMU_ARCH_XTENSA = 4096,
-    QEMU_ARCH_OPENRISC = 8192,
-    QEMU_ARCH_UNICORE32 = 0x4000,
-    QEMU_ARCH_MOXIE = 0x8000,
 };

 extern const uint32_t arch_type;

 void select_soundhw(const char *optarg);
-void do_acpitable_option(const QemuOpts *opts);
+void do_acpitable_option(const char *optarg);
 void do_smbios_option(const char *optarg);
 void cpudef_init(void);
-void audio_init(void);
+int audio_available(void);
+void audio_init(ISABus *isa_bus, PCIBus *pci_bus);
 int tcg_available(void);
 int kvm_available(void);
 int xen_available(void);

-CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp);
-
 #endif
--- a/disas/arm.c
+++ b/disas/arm.c
@@ -22,7 +22,7 @@
 /* Start of qemu specific additions.  Mostly this is stub definitions
   for things we don't care about.  */

-#include "disas/bfd.h"
+#include "dis-asm.h"
 #define ATTRIBUTE_UNUSED __attribute__((unused))
 #define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')

@@ -819,10 +819,6 @@ static const struct opcode32 arm_opcodes[] =
  {ARM_EXT_V3M, 0x00800090, 0x0fa000f0, "%22?sumull%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},
  {ARM_EXT_V3M, 0x00a00090, 0x0fa000f0, "%22?sumlal%20's%c\t%12-15r, %16-19r, %0-3r, %8-11r"},

-  /* IDIV instructions.  */
-  {ARM_EXT_DIV, 0x0710f010, 0x0ff0f0f0, "sdiv%c\t%16-19r, %0-3r, %8-11r"},
-  {ARM_EXT_DIV, 0x0730f010, 0x0ff0f0f0, "udiv%c\t%16-19r, %0-3r, %8-11r"},
-
  /* V7 instructions.  */
  {ARM_EXT_V7, 0xf450f000, 0xfd70f000, "pli\t%P"},
  {ARM_EXT_V7, 0x0320f0f0, 0x0ffffff0, "dbg%c\t#%0-3d"},
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -33,8 +33,8 @@
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
 #include "qemu-common.h"
-#include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
+#include "gdbstub.h"
+#include "hw/arm-misc.h"
 #endif

 #define TARGET_SYS_OPEN        0x01
@@ -113,7 +113,7 @@ static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
    return code;
 }

-#include "exec/softmmu-semi.h"
+#include "softmmu-semi.h"
 #endif

 static target_ulong arm_semi_syscall_len;
@@ -166,20 +166,17 @@ static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_ulong er
 #endif
 }

-/* Read the input value from the argument block; fail the semihosting
- * call if the memory read fails.
- */
-#define GET_ARG(n) do {                                 \
-    if (get_user_ual(arg ## n, args + (n) * 4)) {       \
-        return (uint32_t)-1;                            \
-    }                                                   \
-} while (0)
-
+#define ARG(n)					\
+({						\
+    target_ulong __arg;				\
+    /* FIXME - handle get_user() failure */	\
+    get_user_ual(__arg, args + (n) * 4);	\
+    __arg;					\
+})
 #define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
 uint32_t do_arm_semihosting(CPUARMState *env)
 {
    target_ulong args;
-    target_ulong arg0, arg1, arg2, arg3;
    char * s;
    int nr;
    uint32_t ret;
@@ -194,39 +191,32 @@ uint32_t do_arm_semihosting(CPUARMState *env)
    args = env->regs[1];
    switch (nr) {
    case TARGET_SYS_OPEN:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        s = lock_user_string(arg0);
-        if (!s) {
+        if (!(s = lock_user_string(ARG(0))))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
-        }
-        if (arg1 >= 12) {
-            unlock_user(s, arg0, 0);
+        if (ARG(1) >= 12)
            return (uint32_t)-1;
-        }
        if (strcmp(s, ":tt") == 0) {
-            int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
-            unlock_user(s, arg0, 0);
-            return result_fileno;
+            if (ARG(1) < 4)
+                return STDIN_FILENO;
+            else
+                return STDOUT_FILENO;
        }
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", arg0,
-                           (int)arg2+1, gdb_open_modeflags[arg1]);
-            ret = env->regs[0];
-        } else {
-            ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
-        }
-        unlock_user(s, arg0, 0);
-        return ret;
-    case TARGET_SYS_CLOSE:
-        GET_ARG(0);
-        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "close,%x", arg0);
+            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
+			   (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
            return env->regs[0];
        } else {
-            return set_swi_errno(ts, close(arg0));
+            ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
+        }
+        unlock_user(s, ARG(0), 0);
+        return ret;
+    case TARGET_SYS_CLOSE:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "close,%x", ARG(0));
+            return env->regs[0];
+        } else {
+            return set_swi_errno(ts, close(ARG(0)));
        }
    case TARGET_SYS_WRITEC:
        {
@@ -257,81 +247,67 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        unlock_user(s, args, 0);
        return ret;
    case TARGET_SYS_WRITE:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        len = arg2;
+        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
-            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", arg0, arg1, len);
+            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
-            s = lock_user(VERIFY_READ, arg1, len, 1);
-            if (!s) {
+            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
-            ret = set_swi_errno(ts, write(arg0, s, len));
-            unlock_user(s, arg1, 0);
+            ret = set_swi_errno(ts, write(ARG(0), s, len));
+            unlock_user(s, ARG(1), 0);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case TARGET_SYS_READ:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        len = arg2;
+        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
-            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", arg0, arg1, len);
+            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
-            s = lock_user(VERIFY_WRITE, arg1, len, 0);
-            if (!s) {
+            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
-            do {
-                ret = set_swi_errno(ts, read(arg0, s, len));
-            } while (ret == -1 && errno == EINTR);
-            unlock_user(s, arg1, len);
+            do
+              ret = set_swi_errno(ts, read(ARG(0), s, len));
+            while (ret == -1 && errno == EINTR);
+            unlock_user(s, ARG(1), len);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case TARGET_SYS_READC:
-       /* XXX: Read from debug console. Not implemented.  */
+       /* XXX: Read from debug cosole. Not implemented.  */
        return 0;
    case TARGET_SYS_ISTTY:
-        GET_ARG(0);
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "isatty,%x", arg0);
+            gdb_do_syscall(arm_semi_cb, "isatty,%x", ARG(0));
            return env->regs[0];
        } else {
-            return isatty(arg0);
+            return isatty(ARG(0));
        }
    case TARGET_SYS_SEEK:
-        GET_ARG(0);
-        GET_ARG(1);
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", arg0, arg1);
+            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", ARG(0), ARG(1));
            return env->regs[0];
        } else {
-            ret = set_swi_errno(ts, lseek(arg0, arg1, SEEK_SET));
+            ret = set_swi_errno(ts, lseek(ARG(0), ARG(1), SEEK_SET));
            if (ret == (uint32_t)-1)
              return -1;
            return 0;
        }
    case TARGET_SYS_FLEN:
-        GET_ARG(0);
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_flen_cb, "fstat,%x,%x",
-                           arg0, env->regs[13]-64);
+			   ARG(0), env->regs[13]-64);
            return env->regs[0];
        } else {
            struct stat buf;
-            ret = set_swi_errno(ts, fstat(arg0, &buf));
+            ret = set_swi_errno(ts, fstat(ARG(0), &buf));
            if (ret == (uint32_t)-1)
                return -1;
            return buf.st_size;
@@ -340,43 +316,35 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        /* XXX: Not implemented.  */
        return -1;
    case TARGET_SYS_REMOVE:
-        GET_ARG(0);
-        GET_ARG(1);
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "unlink,%s", arg0, (int)arg1+1);
+            gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
            ret = env->regs[0];
        } else {
-            s = lock_user_string(arg0);
-            if (!s) {
+            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ret =  set_swi_errno(ts, remove(s));
-            unlock_user(s, arg0, 0);
+            unlock_user(s, ARG(0), 0);
        }
        return ret;
    case TARGET_SYS_RENAME:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        GET_ARG(3);
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "rename,%s,%s",
-                           arg0, (int)arg1+1, arg2, (int)arg3+1);
+                           ARG(0), (int)ARG(1)+1, ARG(2), (int)ARG(3)+1);
            return env->regs[0];
        } else {
            char *s2;
-            s = lock_user_string(arg0);
-            s2 = lock_user_string(arg2);
+            s = lock_user_string(ARG(0));
+            s2 = lock_user_string(ARG(2));
            if (!s || !s2)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                ret = (uint32_t)-1;
            else
                ret = set_swi_errno(ts, rename(s, s2));
            if (s2)
-                unlock_user(s2, arg2, 0);
+                unlock_user(s2, ARG(2), 0);
            if (s)
-                unlock_user(s, arg0, 0);
+                unlock_user(s, ARG(0), 0);
            return ret;
        }
    case TARGET_SYS_CLOCK:
@@ -384,19 +352,15 @@ uint32_t do_arm_semihosting(CPUARMState *env)
    case TARGET_SYS_TIME:
        return set_swi_errno(ts, time(NULL));
    case TARGET_SYS_SYSTEM:
-        GET_ARG(0);
-        GET_ARG(1);
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "system,%s", arg0, (int)arg1+1);
+            gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
            return env->regs[0];
        } else {
-            s = lock_user_string(arg0);
-            if (!s) {
+            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ret = set_swi_errno(ts, system(s));
-            unlock_user(s, arg0, 0);
+            unlock_user(s, ARG(0), 0);
            return ret;
        }
    case TARGET_SYS_ERRNO:
@@ -410,24 +374,22 @@ uint32_t do_arm_semihosting(CPUARMState *env)
            /* Build a command-line from the original argv.
             *
             * The inputs are:
-             *     * arg0, pointer to a buffer of at least the size
-             *               specified in arg1.
-             *     * arg1, size of the buffer pointed to by arg0 in
+             *     * ARG(0), pointer to a buffer of at least the size
+             *               specified in ARG(1).
+             *     * ARG(1), size of the buffer pointed to by ARG(0) in
             *               bytes.
             *
             * The outputs are:
-             *     * arg0, pointer to null-terminated string of the
+             *     * ARG(0), pointer to null-terminated string of the
             *               command line.
-             *     * arg1, length of the string pointed to by arg0.
+             *     * ARG(1), length of the string pointed to by ARG(0).
             */

            char *output_buffer;
-            size_t input_size;
+            size_t input_size = ARG(1);
            size_t output_size;
            int status = 0;
-            GET_ARG(0);
-            GET_ARG(1);
-            input_size = arg1;
+
            /* Compute the size of the output string.  */
 #if !defined(CONFIG_USER_ONLY)
            output_size = strlen(ts->boot_info->kernel_filename)
@@ -451,13 +413,10 @@ uint32_t do_arm_semihosting(CPUARMState *env)
            }

            /* Adjust the command-line length.  */
-            if (SET_ARG(1, output_size - 1)) {
-                /* Couldn't write back to argument block */
-                return -1;
-            }
+            SET_ARG(1, output_size - 1);

            /* Lock the buffer on the ARM side.  */
-            output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
+            output_buffer = lock_user(VERIFY_WRITE, ARG(0), output_size, 0);
            if (!output_buffer) {
                return -1;
            }
@@ -489,7 +448,7 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        out:
 #endif
            /* Unlock the buffer on the ARM side.  */
-            unlock_user(output_buffer, arg0, output_size);
+            unlock_user(output_buffer, ARG(0), output_size);

            return status;
        }
@@ -497,7 +456,6 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        {
            uint32_t *ptr;
            uint32_t limit;
-            GET_ARG(0);

 #ifdef CONFIG_USER_ONLY
            /* Some C libraries assume the heap immediately follows .bss, so
@@ -518,29 +476,25 @@ uint32_t do_arm_semihosting(CPUARMState *env)
                ts->heap_limit = limit;
            }

-            ptr = lock_user(VERIFY_WRITE, arg0, 16, 0);
-            if (!ptr) {
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ptr[0] = tswap32(ts->heap_base);
            ptr[1] = tswap32(ts->heap_limit);
            ptr[2] = tswap32(ts->stack_base);
            ptr[3] = tswap32(0); /* Stack limit.  */
-            unlock_user(ptr, arg0, 16);
+            unlock_user(ptr, ARG(0), 16);
 #else
            limit = ram_size;
-            ptr = lock_user(VERIFY_WRITE, arg0, 16, 0);
-            if (!ptr) {
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            /* TODO: Make this use the limit of the loaded application.  */
            ptr[0] = tswap32(limit / 2);
            ptr[1] = tswap32(limit);
            ptr[2] = tswap32(limit); /* Stack base */
            ptr[3] = tswap32(0); /* Stack limit.  */
-            unlock_user(ptr, arg0, 16);
+            unlock_user(ptr, ARG(0), 16);
 #endif
            return 0;
        }
--- a/ldscripts/arm.ld
+++ b/ldscripts/arm.ld
--- a/async.c
+++ b/async.c
@@ -23,15 +23,16 @@
 */

 #include "qemu-common.h"
-#include "block/aio.h"
-#include "block/thread-pool.h"
-#include "qemu/main-loop.h"
+#include "qemu-aio.h"
+#include "main-loop.h"
+
+/* Anchor of the list of Bottom Halves belonging to the context */
+static struct QEMUBH *first_bh;

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */

 struct QEMUBH {
-    AioContext *ctx;
    QEMUBHFunc *cb;
    void *opaque;
    QEMUBH *next;
@@ -40,27 +41,27 @@ struct QEMUBH {
    bool deleted;
 };

-QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
    bh = g_malloc0(sizeof(QEMUBH));
-    bh->ctx = ctx;
    bh->cb = cb;
    bh->opaque = opaque;
-    bh->next = ctx->first_bh;
-    ctx->first_bh = bh;
+    bh->next = first_bh;
+    first_bh = bh;
    return bh;
 }

-int aio_bh_poll(AioContext *ctx)
+int qemu_bh_poll(void)
 {
    QEMUBH *bh, **bhp, *next;
    int ret;
+    static int nesting = 0;

-    ctx->walking_bh++;
+    nesting++;

    ret = 0;
-    for (bh = ctx->first_bh; bh; bh = next) {
+    for (bh = first_bh; bh; bh = next) {
        next = bh->next;
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
@@ -71,11 +72,11 @@ int aio_bh_poll(AioContext *ctx)
        }
    }

-    ctx->walking_bh--;
+    nesting--;

    /* remove deleted bhs */
-    if (!ctx->walking_bh) {
-        bhp = &ctx->first_bh;
+    if (!nesting) {
+        bhp = &first_bh;
        while (*bhp) {
            bh = *bhp;
            if (bh->deleted) {
@@ -104,7 +105,8 @@ void qemu_bh_schedule(QEMUBH *bh)
        return;
    bh->scheduled = 1;
    bh->idle = 0;
-    aio_notify(bh->ctx);
+    /* stop the currently executing CPU to execute the BH ASAP */
+    qemu_notify_event();
 }

 void qemu_bh_cancel(QEMUBH *bh)
@@ -118,113 +120,23 @@ void qemu_bh_delete(QEMUBH *bh)
    bh->deleted = 1;
 }

-static gboolean
-aio_ctx_prepare(GSource *source, gint    *timeout)
+void qemu_bh_update_timeout(uint32_t *timeout)
 {
-    AioContext *ctx = (AioContext *) source;
    QEMUBH *bh;

-    for (bh = ctx->first_bh; bh; bh = bh->next) {
+    for (bh = first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
                 * every 10ms */
-                *timeout = 10;
+                *timeout = MIN(10, *timeout);
            } else {
                /* non-idle bottom halves will be executed
                 * immediately */
                *timeout = 0;
-                return true;
+                break;
            }
        }
    }
-
-    return false;
 }

-static gboolean
-aio_ctx_check(GSource *source)
-{
-    AioContext *ctx = (AioContext *) source;
-    QEMUBH *bh;
-
-    for (bh = ctx->first_bh; bh; bh = bh->next) {
-        if (!bh->deleted && bh->scheduled) {
-            return true;
-	}
-    }
-    return aio_pending(ctx);
-}
-
-static gboolean
-aio_ctx_dispatch(GSource     *source,
-                 GSourceFunc  callback,
-                 gpointer     user_data)
-{
-    AioContext *ctx = (AioContext *) source;
-
-    assert(callback == NULL);
-    aio_poll(ctx, false);
-    return true;
-}
-
-static void
-aio_ctx_finalize(GSource     *source)
-{
-    AioContext *ctx = (AioContext *) source;
-
-    thread_pool_free(ctx->thread_pool);
-    aio_set_event_notifier(ctx, &ctx->notifier, NULL, NULL);
-    event_notifier_cleanup(&ctx->notifier);
-    g_array_free(ctx->pollfds, TRUE);
-}
-
-static GSourceFuncs aio_source_funcs = {
-    aio_ctx_prepare,
-    aio_ctx_check,
-    aio_ctx_dispatch,
-    aio_ctx_finalize
-};
-
-GSource *aio_get_g_source(AioContext *ctx)
-{
-    g_source_ref(&ctx->source);
-    return &ctx->source;
-}
-
-ThreadPool *aio_get_thread_pool(AioContext *ctx)
-{
-    if (!ctx->thread_pool) {
-        ctx->thread_pool = thread_pool_new(ctx);
-    }
-    return ctx->thread_pool;
-}
-
-void aio_notify(AioContext *ctx)
-{
-    event_notifier_set(&ctx->notifier);
-}
-
-AioContext *aio_context_new(void)
-{
-    AioContext *ctx;
-    ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext));
-    ctx->pollfds = g_array_new(FALSE, FALSE, sizeof(GPollFD));
-    ctx->thread_pool = NULL;
-    event_notifier_init(&ctx->notifier, false);
-    aio_set_event_notifier(ctx, &ctx->notifier, 
-                           (EventNotifierHandler *)
-                           event_notifier_test_and_clear, NULL);
-
-    return ctx;
-}
-
-void aio_context_ref(AioContext *ctx)
-{
-    g_source_ref(&ctx->source);
-}
-
-void aio_context_unref(AioContext *ctx)
-{
-    g_source_unref(&ctx->source);
-}
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,17 +0,0 @@
-common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
-common-obj-$(CONFIG_SDL) += sdlaudio.o
-common-obj-$(CONFIG_OSS) += ossaudio.o
-common-obj-$(CONFIG_SPICE) += spiceaudio.o
-common-obj-$(CONFIG_COREAUDIO) += coreaudio.o
-common-obj-$(CONFIG_ALSA) += alsaaudio.o
-common-obj-$(CONFIG_DSOUND) += dsoundaudio.o
-common-obj-$(CONFIG_FMOD) += fmodaudio.o
-common-obj-$(CONFIG_ESD) += esdaudio.o
-common-obj-$(CONFIG_PA) += paaudio.o
-common-obj-$(CONFIG_WINWAVE) += winwaveaudio.o
-common-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
-common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
-common-obj-y += wavcapture.o
-
-$(obj)/audio.o $(obj)/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
-$(obj)/sdlaudio.o: QEMU_CFLAGS += $(SDL_CFLAGS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -23,7 +23,7 @@
 */
 #include <alsa/asoundlib.h>
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
+#include "qemu-char.h"
 #include "audio.h"

 #if QEMU_GNUC_PREREQ(4, 3)
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -23,9 +23,9 @@
 */
 #include "hw/hw.h"
 #include "audio.h"
-#include "monitor/monitor.h"
-#include "qemu/timer.h"
-#include "sysemu/sysemu.h"
+#include "monitor.h"
+#include "qemu-timer.h"
+#include "sysemu.h"

 #define AUDIO_CAP "audio"
 #include "audio_int.h"
@@ -818,7 +818,6 @@ static int audio_attach_capture (HWVoiceOut *hw)
        sw->active = hw->enabled;
        sw->conv = noop_conv;
        sw->ratio = ((int64_t) hw_cap->info.freq << 32) / sw->info.freq;
-        sw->vol = nominal_volume;
        sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
        if (!sw->rate) {
            dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
@@ -828,9 +827,8 @@ static int audio_attach_capture (HWVoiceOut *hw)
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
        QLIST_INSERT_HEAD (&hw->cap_head, sc, entries);
 #ifdef DEBUG_CAPTURE
-        sw->name = g_strdup_printf ("for %p %d,%d,%d",
-                                    hw, sw->info.freq, sw->info.bits,
-                                    sw->info.nchannels);
+        asprintf (&sw->name, "for %p %d,%d,%d",
+                  hw, sw->info.freq, sw->info.bits, sw->info.nchannels);
        dolog ("Added %s active = %d\n", sw->name, sw->active);
 #endif
        if (sw->active) {
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -25,7 +25,7 @@
 #define QEMU_AUDIO_H

 #include "config-host.h"
-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef void (*audio_callback_fn) (void *opaque, int avail);

--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -410,15 +410,15 @@ SW *glue (AUD_open_, TYPE) (
    SW *old_sw = NULL;
 #endif

+    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
+            name, as->freq, as->nchannels, as->fmt);
+
    if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
               card, name, callback_fn, as);
        goto fail;
    }

-    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
-            name, as->freq, as->nchannels, as->fmt);
-
    if (audio_bug (AUDIO_FUNC, audio_validate_settings (as))) {
        audio_print_settings (as);
        goto fail;
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -23,7 +23,7 @@
 */
 #include "qemu-common.h"
 #include "audio.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"

 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -31,8 +31,8 @@
 #include <sys/soundcard.h>
 #endif
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
-#include "qemu/host-utils.h"
+#include "host-utils.h"
+#include "qemu-char.h"
 #include "audio.h"

 #define AUDIO_CAP "oss"
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -18,7 +18,7 @@
 */

 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "ui/qemu-spice.h"

 #define AUDIO_CAP "spice"
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "audio.h"

 #define AUDIO_CAP "wav"
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,5 +1,5 @@
 #include "hw/hw.h"
-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "audio.h"

 typedef struct {
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -1,7 +1,7 @@
 /* public domain */

 #include "qemu-common.h"
-#include "sysemu/sysemu.h"
+#include "sysemu.h"
 #include "audio.h"

 #define AUDIO_CAP "winwave"
@@ -72,7 +72,7 @@ static void winwave_log_mmresult (MMRESULT mr)
        break;

    case MMSYSERR_NOMEM:
-        str = "Unable to allocate or lock memory";
+        str = "Unable to allocate or locl memory";
        break;

    case WAVERR_SYNC:
@@ -349,15 +349,21 @@ static int winwave_ctl_out (HWVoiceOut *hw, int cmd, ...)
            else {
                hw->poll_mode = 0;
            }
-            wave->paused = 0;
+            if (wave->paused) {
+                mr = waveOutRestart (wave->hwo);
+                if (mr != MMSYSERR_NOERROR) {
+                    winwave_logerr (mr, "waveOutRestart");
+                }
+                wave->paused = 0;
+            }
        }
        return 0;

    case VOICE_DISABLE:
        if (!wave->paused) {
-            mr = waveOutReset (wave->hwo);
+            mr = waveOutPause (wave->hwo);
            if (mr != MMSYSERR_NOERROR) {
-                winwave_logerr (mr, "waveOutReset");
+                winwave_logerr (mr, "waveOutPause");
            }
            else {
                wave->paused = 1;
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -1,8 +0,0 @@
-common-obj-y += rng.o rng-egd.o
-common-obj-$(CONFIG_POSIX) += rng-random.o
-
-common-obj-y += msmouse.o
-common-obj-$(CONFIG_BRLAPI) += baum.o
-$(obj)/baum.o: QEMU_CFLAGS += $(SDL_CFLAGS) 
-
-common-obj-$(CONFIG_TPM) += tpm.o
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -1,230 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "sysemu/rng.h"
-#include "sysemu/char.h"
-#include "qapi/qmp/qerror.h"
-#include "hw/qdev.h" /* just for DEFINE_PROP_CHR */
-
-#define TYPE_RNG_EGD "rng-egd"
-#define RNG_EGD(obj) OBJECT_CHECK(RngEgd, (obj), TYPE_RNG_EGD)
-
-typedef struct RngEgd
-{
-    RngBackend parent;
-
-    CharDriverState *chr;
-    char *chr_name;
-
-    GSList *requests;
-} RngEgd;
-
-typedef struct RngRequest
-{
-    EntropyReceiveFunc *receive_entropy;
-    uint8_t *data;
-    void *opaque;
-    size_t offset;
-    size_t size;
-} RngRequest;
-
-static void rng_egd_request_entropy(RngBackend *b, size_t size,
-                                    EntropyReceiveFunc *receive_entropy,
-                                    void *opaque)
-{
-    RngEgd *s = RNG_EGD(b);
-    RngRequest *req;
-
-    req = g_malloc(sizeof(*req));
-
-    req->offset = 0;
-    req->size = size;
-    req->receive_entropy = receive_entropy;
-    req->opaque = opaque;
-    req->data = g_malloc(req->size);
-
-    while (size > 0) {
-        uint8_t header[2];
-        uint8_t len = MIN(size, 255);
-
-        /* synchronous entropy request */
-        header[0] = 0x02;
-        header[1] = len;
-
-        qemu_chr_fe_write(s->chr, header, sizeof(header));
-
-        size -= len;
-    }
-
-    s->requests = g_slist_append(s->requests, req);
-}
-
-static void rng_egd_free_request(RngRequest *req)
-{
-    g_free(req->data);
-    g_free(req);
-}
-
-static int rng_egd_chr_can_read(void *opaque)
-{
-    RngEgd *s = RNG_EGD(opaque);
-    GSList *i;
-    int size = 0;
-
-    for (i = s->requests; i; i = i->next) {
-        RngRequest *req = i->data;
-        size += req->size - req->offset;
-    }
-
-    return size;
-}
-
-static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
-{
-    RngEgd *s = RNG_EGD(opaque);
-
-    while (size > 0 && s->requests) {
-        RngRequest *req = s->requests->data;
-        int len = MIN(size, req->size - req->offset);
-
-        memcpy(req->data + req->offset, buf, len);
-        req->offset += len;
-        size -= len;
-
-        if (req->offset == req->size) {
-            s->requests = g_slist_remove_link(s->requests, s->requests);
-
-            req->receive_entropy(req->opaque, req->data, req->size);
-
-            rng_egd_free_request(req);
-        }
-    }
-}
-
-static void rng_egd_free_requests(RngEgd *s)
-{
-    GSList *i;
-
-    for (i = s->requests; i; i = i->next) {
-        rng_egd_free_request(i->data);
-    }
-
-    g_slist_free(s->requests);
-    s->requests = NULL;
-}
-
-static void rng_egd_cancel_requests(RngBackend *b)
-{
-    RngEgd *s = RNG_EGD(b);
-
-    /* We simply delete the list of pending requests.  If there is data in the 
-     * queue waiting to be read, this is okay, because there will always be
-     * more data than we requested originally
-     */
-    rng_egd_free_requests(s);
-}
-
-static void rng_egd_opened(RngBackend *b, Error **errp)
-{
-    RngEgd *s = RNG_EGD(b);
-
-    if (s->chr_name == NULL) {
-        error_set(errp, QERR_INVALID_PARAMETER_VALUE,
-                  "chardev", "a valid character device");
-        return;
-    }
-
-    s->chr = qemu_chr_find(s->chr_name);
-    if (s->chr == NULL) {
-        error_set(errp, QERR_DEVICE_NOT_FOUND, s->chr_name);
-        return;
-    }
-
-    if (qemu_chr_fe_claim(s->chr) != 0) {
-        error_set(errp, QERR_DEVICE_IN_USE, s->chr_name);
-        return;
-    }
-
-    /* FIXME we should resubmit pending requests when the CDS reconnects. */
-    qemu_chr_add_handlers(s->chr, rng_egd_chr_can_read, rng_egd_chr_read,
-                          NULL, s);
-}
-
-static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
-{
-    RngBackend *b = RNG_BACKEND(obj);
-    RngEgd *s = RNG_EGD(b);
-
-    if (b->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-    } else {
-        g_free(s->chr_name);
-        s->chr_name = g_strdup(value);
-    }
-}
-
-static char *rng_egd_get_chardev(Object *obj, Error **errp)
-{
-    RngEgd *s = RNG_EGD(obj);
-
-    if (s->chr && s->chr->label) {
-        return g_strdup(s->chr->label);
-    }
-
-    return NULL;
-}
-
-static void rng_egd_init(Object *obj)
-{
-    object_property_add_str(obj, "chardev",
-                            rng_egd_get_chardev, rng_egd_set_chardev,
-                            NULL);
-}
-
-static void rng_egd_finalize(Object *obj)
-{
-    RngEgd *s = RNG_EGD(obj);
-
-    if (s->chr) {
-        qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL);
-        qemu_chr_fe_release(s->chr);
-    }
-
-    g_free(s->chr_name);
-
-    rng_egd_free_requests(s);
-}
-
-static void rng_egd_class_init(ObjectClass *klass, void *data)
-{
-    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
-
-    rbc->request_entropy = rng_egd_request_entropy;
-    rbc->cancel_requests = rng_egd_cancel_requests;
-    rbc->opened = rng_egd_opened;
-}
-
-static const TypeInfo rng_egd_info = {
-    .name = TYPE_RNG_EGD,
-    .parent = TYPE_RNG_BACKEND,
-    .instance_size = sizeof(RngEgd),
-    .class_init = rng_egd_class_init,
-    .instance_init = rng_egd_init,
-    .instance_finalize = rng_egd_finalize,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_egd_info);
-}
-
-type_init(register_types);
--- a/backends/rng-random.c
+++ b/backends/rng-random.c
@@ -1,164 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "sysemu/rng-random.h"
-#include "sysemu/rng.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/main-loop.h"
-
-struct RndRandom
-{
-    RngBackend parent;
-
-    int fd;
-    char *filename;
-
-    EntropyReceiveFunc *receive_func;
-    void *opaque;
-    size_t size;
-};
-
-/**
- * A simple and incomplete backend to request entropy from /dev/random.
- *
- * This backend exposes an additional "filename" property that can be used to
- * set the filename to use to open the backend.
- */
-
-static void entropy_available(void *opaque)
-{
-    RndRandom *s = RNG_RANDOM(opaque);
-    uint8_t buffer[s->size];
-    ssize_t len;
-
-    len = read(s->fd, buffer, s->size);
-    if (len < 0 && errno == EAGAIN) {
-        return;
-    }
-    g_assert(len != -1);
-
-    s->receive_func(s->opaque, buffer, len);
-    s->receive_func = NULL;
-
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-}
-
-static void rng_random_request_entropy(RngBackend *b, size_t size,
-                                        EntropyReceiveFunc *receive_entropy,
-                                        void *opaque)
-{
-    RndRandom *s = RNG_RANDOM(b);
-
-    if (s->receive_func) {
-        s->receive_func(s->opaque, NULL, 0);
-    }
-
-    s->receive_func = receive_entropy;
-    s->opaque = opaque;
-    s->size = size;
-
-    qemu_set_fd_handler(s->fd, entropy_available, NULL, s);
-}
-
-static void rng_random_opened(RngBackend *b, Error **errp)
-{
-    RndRandom *s = RNG_RANDOM(b);
-
-    if (s->filename == NULL) {
-        error_set(errp, QERR_INVALID_PARAMETER_VALUE,
-                  "filename", "a valid filename");
-    } else {
-        s->fd = qemu_open(s->filename, O_RDONLY | O_NONBLOCK);
-
-        if (s->fd == -1) {
-            error_set(errp, QERR_OPEN_FILE_FAILED, s->filename);
-        }
-    }
-}
-
-static char *rng_random_get_filename(Object *obj, Error **errp)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    if (s->filename) {
-        return g_strdup(s->filename);
-    }
-
-    return NULL;
-}
-
-static void rng_random_set_filename(Object *obj, const char *filename,
-                                 Error **errp)
-{
-    RngBackend *b = RNG_BACKEND(obj);
-    RndRandom *s = RNG_RANDOM(obj);
-
-    if (b->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-        return;
-    }
-
-    if (s->filename) {
-        g_free(s->filename);
-    }
-
-    s->filename = g_strdup(filename);
-}
-
-static void rng_random_init(Object *obj)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    object_property_add_str(obj, "filename",
-                            rng_random_get_filename,
-                            rng_random_set_filename,
-                            NULL);
-
-    s->filename = g_strdup("/dev/random");
-}
-
-static void rng_random_finalize(Object *obj)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-
-    if (s->fd != -1) {
-        qemu_close(s->fd);
-    }
-
-    g_free(s->filename);
-}
-
-static void rng_random_class_init(ObjectClass *klass, void *data)
-{
-    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
-
-    rbc->request_entropy = rng_random_request_entropy;
-    rbc->opened = rng_random_opened;
-}
-
-static const TypeInfo rng_random_info = {
-    .name = TYPE_RNG_RANDOM,
-    .parent = TYPE_RNG_BACKEND,
-    .instance_size = sizeof(RndRandom),
-    .class_init = rng_random_class_init,
-    .instance_init = rng_random_init,
-    .instance_finalize = rng_random_finalize,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_random_info);
-}
-
-type_init(register_types);
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -1,93 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "sysemu/rng.h"
-#include "qapi/qmp/qerror.h"
-
-void rng_backend_request_entropy(RngBackend *s, size_t size,
-                                 EntropyReceiveFunc *receive_entropy,
-                                 void *opaque)
-{
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (k->request_entropy) {
-        k->request_entropy(s, size, receive_entropy, opaque);
-    }
-}
-
-void rng_backend_cancel_requests(RngBackend *s)
-{
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (k->cancel_requests) {
-        k->cancel_requests(s);
-    }
-}
-
-static bool rng_backend_prop_get_opened(Object *obj, Error **errp)
-{
-    RngBackend *s = RNG_BACKEND(obj);
-
-    return s->opened;
-}
-
-void rng_backend_open(RngBackend *s, Error **errp)
-{
-    object_property_set_bool(OBJECT(s), true, "opened", errp);
-}
-
-static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
-{
-    RngBackend *s = RNG_BACKEND(obj);
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (value == s->opened) {
-        return;
-    }
-
-    if (!value && s->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-        return;
-    }
-
-    if (k->opened) {
-        k->opened(s, errp);
-    }
-
-    if (!error_is_set(errp)) {
-        s->opened = value;
-    }
-}
-
-static void rng_backend_init(Object *obj)
-{
-    object_property_add_bool(obj, "opened",
-                             rng_backend_prop_get_opened,
-                             rng_backend_prop_set_opened,
-                             NULL);
-}
-
-static const TypeInfo rng_backend_info = {
-    .name = TYPE_RNG_BACKEND,
-    .parent = TYPE_OBJECT,
-    .instance_size = sizeof(RngBackend),
-    .instance_init = rng_backend_init,
-    .class_size = sizeof(RngBackendClass),
-    .abstract = true,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_backend_info);
-}
-
-type_init(register_types);
--- a/backends/tpm.c
+++ b/backends/tpm.c
@@ -1,190 +0,0 @@
-/*
- * QEMU TPM Backend
- *
- * Copyright IBM, Corp. 2013
- *
- * Authors:
- *  Stefan Berger   <stefanb@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- * Based on backends/rng.c by Anthony Liguori
- */
-
-#include "sysemu/tpm_backend.h"
-#include "qapi/qmp/qerror.h"
-#include "sysemu/tpm.h"
-#include "qemu/thread.h"
-#include "sysemu/tpm_backend_int.h"
-
-enum TpmType tpm_backend_get_type(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->type;
-}
-
-const char *tpm_backend_get_desc(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->desc();
-}
-
-void tpm_backend_destroy(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->destroy(s);
-}
-
-int tpm_backend_init(TPMBackend *s, TPMState *state,
-                     TPMRecvDataCB *datacb)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->init(s, state, datacb);
-}
-
-int tpm_backend_startup_tpm(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->startup_tpm(s);
-}
-
-bool tpm_backend_had_startup_error(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->had_startup_error(s);
-}
-
-size_t tpm_backend_realloc_buffer(TPMBackend *s, TPMSizedBuffer *sb)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->realloc_buffer(sb);
-}
-
-void tpm_backend_deliver_request(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    k->ops->deliver_request(s);
-}
-
-void tpm_backend_reset(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    k->ops->reset(s);
-}
-
-void tpm_backend_cancel_cmd(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    k->ops->cancel_cmd(s);
-}
-
-bool tpm_backend_get_tpm_established_flag(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->ops->get_tpm_established_flag(s);
-}
-
-static bool tpm_backend_prop_get_opened(Object *obj, Error **errp)
-{
-    TPMBackend *s = TPM_BACKEND(obj);
-
-    return s->opened;
-}
-
-void tpm_backend_open(TPMBackend *s, Error **errp)
-{
-    object_property_set_bool(OBJECT(s), true, "opened", errp);
-}
-
-static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
-{
-    TPMBackend *s = TPM_BACKEND(obj);
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    if (value == s->opened) {
-        return;
-    }
-
-    if (!value && s->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-        return;
-    }
-
-    if (k->opened) {
-        k->opened(s, errp);
-    }
-
-    if (!error_is_set(errp)) {
-        s->opened = value;
-    }
-}
-
-static void tpm_backend_instance_init(Object *obj)
-{
-    object_property_add_bool(obj, "opened",
-                             tpm_backend_prop_get_opened,
-                             tpm_backend_prop_set_opened,
-                             NULL);
-}
-
-void tpm_backend_thread_deliver_request(TPMBackendThread *tbt)
-{
-   g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_PROCESS_CMD, NULL);
-}
-
-void tpm_backend_thread_create(TPMBackendThread *tbt,
-                               GFunc func, gpointer user_data)
-{
-    if (!tbt->pool) {
-        tbt->pool = g_thread_pool_new(func, user_data, 1, TRUE, NULL);
-        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_INIT, NULL);
-    }
-}
-
-void tpm_backend_thread_end(TPMBackendThread *tbt)
-{
-    if (tbt->pool) {
-        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_END, NULL);
-        g_thread_pool_free(tbt->pool, FALSE, TRUE);
-        tbt->pool = NULL;
-    }
-}
-
-void tpm_backend_thread_tpm_reset(TPMBackendThread *tbt,
-                                  GFunc func, gpointer user_data)
-{
-    if (!tbt->pool) {
-        tpm_backend_thread_create(tbt, func, user_data);
-    } else {
-        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_TPM_RESET,
-                           NULL);
-    }
-}
-
-static const TypeInfo tpm_backend_info = {
-    .name = TYPE_TPM_BACKEND,
-    .parent = TYPE_OBJECT,
-    .instance_size = sizeof(TPMBackend),
-    .instance_init = tpm_backend_instance_init,
-    .class_size = sizeof(TPMBackendClass),
-    .abstract = true,
-};
-
-static void register_types(void)
-{
-    type_register_static(&tpm_backend_info);
-}
-
-type_init(register_types);
--- a/balloon.c
+++ b/balloon.c
@@ -24,13 +24,12 @@
 * THE SOFTWARE.
 */

-#include "monitor/monitor.h"
-#include "exec/cpu-common.h"
-#include "sysemu/kvm.h"
-#include "sysemu/balloon.h"
+#include "monitor.h"
+#include "cpu-common.h"
+#include "kvm.h"
+#include "balloon.h"
 #include "trace.h"
 #include "qmp-commands.h"
-#include "qapi/qmp/qjson.h"

 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
@@ -81,19 +80,6 @@ static int qemu_balloon_status(BalloonInfo *info)
    return 1;
 }

-void qemu_balloon_changed(int64_t actual)
-{
-    QObject *data;
-
-    data = qobject_from_jsonf("{ 'actual': %" PRId64 " }",
-                              actual);
-
-    monitor_protocol_event(QEVENT_BALLOON_CHANGE, data);
-
-    qobject_decref(data);
-}
-
-
 BalloonInfo *qmp_query_balloon(Error **errp)
 {
    BalloonInfo *info;
--- a/include/sysemu/balloon.h
+++ b/include/sysemu/balloon.h
@@ -14,7 +14,7 @@
 #ifndef _QEMU_BALLOON_H
 #define _QEMU_BALLOON_H

-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "qapi-types.h"

 typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
@@ -24,6 +24,4 @@ int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
 			     QEMUBalloonStatus *stat_func, void *opaque);
 void qemu_remove_balloon_handler(void *opaque);

-void qemu_balloon_changed(int64_t actual);
-
 #endif
--- a/util/bitmap.c
+++ b/util/bitmap.c
@@ -9,8 +9,8 @@
 * Version 2.
 */

-#include "qemu/bitops.h"
-#include "qemu/bitmap.h"
+#include "bitops.h"
+#include "bitmap.h"

 /*
 * bitmaps provide an array of bits, implemented using an an
--- a/include/qemu/bitmap.h
+++ b/include/qemu/bitmap.h
@@ -13,7 +13,7 @@
 #define BITMAP_H

 #include "qemu-common.h"
-#include "qemu/bitops.h"
+#include "bitops.h"

 /*
 * The available bitmap operations and their rough meaning in the
--- a/util/bitops.c
+++ b/util/bitops.c
@@ -11,7 +11,7 @@
 * 2 of the License, or (at your option) any later version.
 */

-#include "qemu/bitops.h"
+#include "bitops.h"

 #define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)

@@ -42,23 +42,7 @@ unsigned long find_next_bit(const unsigned long *addr, unsigned long size,
        size -= BITS_PER_LONG;
        result += BITS_PER_LONG;
    }
-    while (size >= 4*BITS_PER_LONG) {
-        unsigned long d1, d2, d3;
-        tmp = *p;
-        d1 = *(p+1);
-        d2 = *(p+2);
-        d3 = *(p+3);
-        if (tmp) {
-            goto found_middle;
-        }
-        if (d1 | d2 | d3) {
-            break;
-        }
-        p += 4;
-        result += 4*BITS_PER_LONG;
-        size -= 4*BITS_PER_LONG;
-    }
-    while (size >= BITS_PER_LONG) {
+    while (size & ~(BITS_PER_LONG-1)) {
        if ((tmp = *(p++))) {
            goto found_middle;
        }
@@ -76,7 +60,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + ctzl(tmp);
+    return result + bitops_ffsl(tmp);
 }

 /*
@@ -125,7 +109,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + ctzl(~tmp);
+    return result + ffz(tmp);
 }

 unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
@@ -149,7 +133,7 @@ unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
        tmp = addr[--words];
        if (tmp) {
        found:
-            return words * BITS_PER_LONG + BITS_PER_LONG - 1 - clzl(tmp);
+            return words * BITS_PER_LONG + bitops_flsl(tmp);
        }
    }

--- a/bitops.h
+++ b/bitops.h
@@ -0,0 +1,272 @@
+/*
+ * Bitops Module
+ *
+ * Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
+ *
+ * Mostly inspired by (stolen from) linux/bitmap.h and linux/bitops.h
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#ifndef BITOPS_H
+#define BITOPS_H
+
+#include "qemu-common.h"
+
+#define BITS_PER_BYTE           CHAR_BIT
+#define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
+
+#define BIT(nr)			(1UL << (nr))
+#define BIT_MASK(nr)		(1UL << ((nr) % BITS_PER_LONG))
+#define BIT_WORD(nr)		((nr) / BITS_PER_LONG)
+#define BITS_TO_LONGS(nr)	DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+
+/**
+ * bitops_ffs - find first bit in word.
+ * @word: The word to search
+ *
+ * Undefined if no bit exists, so code should check against 0 first.
+ */
+static unsigned long bitops_ffsl(unsigned long word)
+{
+	int num = 0;
+
+#if LONG_MAX > 0x7FFFFFFF
+	if ((word & 0xffffffff) == 0) {
+		num += 32;
+		word >>= 32;
+	}
+#endif
+	if ((word & 0xffff) == 0) {
+		num += 16;
+		word >>= 16;
+	}
+	if ((word & 0xff) == 0) {
+		num += 8;
+		word >>= 8;
+	}
+	if ((word & 0xf) == 0) {
+		num += 4;
+		word >>= 4;
+	}
+	if ((word & 0x3) == 0) {
+		num += 2;
+		word >>= 2;
+	}
+	if ((word & 0x1) == 0) {
+		num += 1;
+        }
+	return num;
+}
+
+/**
+ * bitops_fls - find last (most-significant) set bit in a long word
+ * @word: the word to search
+ *
+ * Undefined if no set bit exists, so code should check against 0 first.
+ */
+static inline unsigned long bitops_flsl(unsigned long word)
+{
+	int num = BITS_PER_LONG - 1;
+
+#if LONG_MAX > 0x7FFFFFFF
+	if (!(word & (~0ul << 32))) {
+		num -= 32;
+		word <<= 32;
+	}
+#endif
+	if (!(word & (~0ul << (BITS_PER_LONG-16)))) {
+		num -= 16;
+		word <<= 16;
+	}
+	if (!(word & (~0ul << (BITS_PER_LONG-8)))) {
+		num -= 8;
+		word <<= 8;
+	}
+	if (!(word & (~0ul << (BITS_PER_LONG-4)))) {
+		num -= 4;
+		word <<= 4;
+	}
+	if (!(word & (~0ul << (BITS_PER_LONG-2)))) {
+		num -= 2;
+
+		word <<= 2;
+	}
+	if (!(word & (~0ul << (BITS_PER_LONG-1))))
+		num -= 1;
+	return num;
+}
+
+/**
+ * ffz - find first zero in word.
+ * @word: The word to search
+ *
+ * Undefined if no zero exists, so code should check against ~0UL first.
+ */
+static inline unsigned long ffz(unsigned long word)
+{
+    return bitops_ffsl(~word);
+}
+
+/**
+ * set_bit - Set a bit in memory
+ * @nr: the bit to set
+ * @addr: the address to start counting from
+ */
+static inline void set_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+
+	*p  |= mask;
+}
+
+/**
+ * clear_bit - Clears a bit in memory
+ * @nr: Bit to clear
+ * @addr: Address to start counting from
+ */
+static inline void clear_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+
+	*p &= ~mask;
+}
+
+/**
+ * change_bit - Toggle a bit in memory
+ * @nr: Bit to change
+ * @addr: Address to start counting from
+ */
+static inline void change_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+
+	*p ^= mask;
+}
+
+/**
+ * test_and_set_bit - Set a bit and return its old value
+ * @nr: Bit to set
+ * @addr: Address to count from
+ */
+static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+	unsigned long old = *p;
+
+	*p = old | mask;
+	return (old & mask) != 0;
+}
+
+/**
+ * test_and_clear_bit - Clear a bit and return its old value
+ * @nr: Bit to clear
+ * @addr: Address to count from
+ */
+static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+	unsigned long old = *p;
+
+	*p = old & ~mask;
+	return (old & mask) != 0;
+}
+
+/**
+ * test_and_change_bit - Change a bit and return its old value
+ * @nr: Bit to change
+ * @addr: Address to count from
+ */
+static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
+{
+	unsigned long mask = BIT_MASK(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
+	unsigned long old = *p;
+
+	*p = old ^ mask;
+	return (old & mask) != 0;
+}
+
+/**
+ * test_bit - Determine whether a bit is set
+ * @nr: bit number to test
+ * @addr: Address to start counting from
+ */
+static inline int test_bit(int nr, const volatile unsigned long *addr)
+{
+	return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1)));
+}
+
+/**
+ * find_last_bit - find the last set bit in a memory region
+ * @addr: The address to start the search at
+ * @size: The maximum size to search
+ *
+ * Returns the bit number of the first set bit, or size.
+ */
+unsigned long find_last_bit(const unsigned long *addr,
+                            unsigned long size);
+
+/**
+ * find_next_bit - find the next set bit in a memory region
+ * @addr: The address to base the search on
+ * @offset: The bitnumber to start searching at
+ * @size: The bitmap size in bits
+ */
+unsigned long find_next_bit(const unsigned long *addr,
+				   unsigned long size, unsigned long offset);
+
+/**
+ * find_next_zero_bit - find the next cleared bit in a memory region
+ * @addr: The address to base the search on
+ * @offset: The bitnumber to start searching at
+ * @size: The bitmap size in bits
+ */
+
+unsigned long find_next_zero_bit(const unsigned long *addr,
+                                 unsigned long size,
+                                 unsigned long offset);
+
+/**
+ * find_first_bit - find the first set bit in a memory region
+ * @addr: The address to start the search at
+ * @size: The maximum size to search
+ *
+ * Returns the bit number of the first set bit.
+ */
+static inline unsigned long find_first_bit(const unsigned long *addr,
+                                           unsigned long size)
+{
+    return find_next_bit(addr, size, 0);
+}
+
+/**
+ * find_first_zero_bit - find the first cleared bit in a memory region
+ * @addr: The address to start the search at
+ * @size: The maximum size to search
+ *
+ * Returns the bit number of the first cleared bit.
+ */
+static inline unsigned long find_first_zero_bit(const unsigned long *addr,
+                                                unsigned long size)
+{
+    return find_next_zero_bit(addr, size, 0);
+}
+
+static inline unsigned long hweight_long(unsigned long w)
+{
+    unsigned long count;
+
+    for (count = 0; w; w >>= 1) {
+        count += w & 1;
+    }
+    return count;
+}
+
+#endif
--- a/block-migration.c
+++ b/block-migration.c
@@ -14,17 +14,16 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "hw/hw.h"
-#include "qemu/queue.h"
-#include "qemu/timer.h"
-#include "migration/block.h"
-#include "migration/migration.h"
-#include "sysemu/blockdev.h"
+#include "qemu-queue.h"
+#include "qemu-timer.h"
+#include "block-migration.h"
+#include "migration.h"
+#include "blockdev.h"
 #include <assert.h>

-#define BLOCK_SIZE                       (1 << 20)
-#define BDRV_SECTORS_PER_DIRTY_CHUNK     (BLOCK_SIZE >> BDRV_SECTOR_BITS)
+#define BLOCK_SIZE (BDRV_SECTORS_PER_DIRTY_CHUNK << BDRV_SECTOR_BITS)

 #define BLK_MIG_FLAG_DEVICE_BLOCK       0x01
 #define BLK_MIG_FLAG_EOS                0x02
@@ -43,24 +42,19 @@
 #endif

 typedef struct BlkMigDevState {
-    /* Written during setup phase.  Can be read without a lock.  */
    BlockDriverState *bs;
-    int shared_base;
-    int64_t total_sectors;
-    QSIMPLEQ_ENTRY(BlkMigDevState) entry;
-
-    /* Only used by migration thread.  Does not need a lock.  */
    int bulk_completed;
+    int shared_base;
    int64_t cur_sector;
    int64_t cur_dirty;
-
-    /* Protected by block migration lock.  */
-    unsigned long *aio_bitmap;
    int64_t completed_sectors;
+    int64_t total_sectors;
+    int64_t dirty;
+    QSIMPLEQ_ENTRY(BlkMigDevState) entry;
+    unsigned long *aio_bitmap;
 } BlkMigDevState;

 typedef struct BlkMigBlock {
-    /* Only used by migration thread.  */
    uint8_t *buf;
    BlkMigDevState *bmds;
    int64_t sector;
@@ -68,49 +62,28 @@ typedef struct BlkMigBlock {
    struct iovec iov;
    QEMUIOVector qiov;
    BlockDriverAIOCB *aiocb;
-
-    /* Protected by block migration lock.  */
    int ret;
    QSIMPLEQ_ENTRY(BlkMigBlock) entry;
 } BlkMigBlock;

 typedef struct BlkMigState {
-    /* Written during setup phase.  Can be read without a lock.  */
    int blk_enable;
    int shared_base;
    QSIMPLEQ_HEAD(bmds_list, BlkMigDevState) bmds_list;
-    int64_t total_sector_sum;
-
-    /* Protected by lock.  */
    QSIMPLEQ_HEAD(blk_list, BlkMigBlock) blk_list;
    int submitted;
    int read_done;
-
-    /* Only used by migration thread.  Does not need a lock.  */
    int transferred;
+    int64_t total_sector_sum;
    int prev_progress;
    int bulk_completed;
-
-    /* Lock must be taken _inside_ the iothread lock.  */
-    QemuMutex lock;
+    long double total_time;
+    long double prev_time_offset;
+    int reads;
 } BlkMigState;

 static BlkMigState block_mig_state;

-static void blk_mig_lock(void)
-{
-    qemu_mutex_lock(&block_mig_state.lock);
-}
-
-static void blk_mig_unlock(void)
-{
-    qemu_mutex_unlock(&block_mig_state.lock);
-}
-
-/* Must run outside of the iothread lock during the bulk phase,
- * or the VM will stall.
- */
-
 static void blk_send(QEMUFile *f, BlkMigBlock * blk)
 {
    int len;
@@ -137,11 +110,9 @@ uint64_t blk_mig_bytes_transferred(void)
    BlkMigDevState *bmds;
    uint64_t sum = 0;

-    blk_mig_lock();
    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        sum += bmds->completed_sectors;
    }
-    blk_mig_unlock();
    return sum << BDRV_SECTOR_BITS;
 }

@@ -161,8 +132,11 @@ uint64_t blk_mig_bytes_total(void)
    return sum << BDRV_SECTOR_BITS;
 }

-
-/* Called with migration lock held.  */
+static inline long double compute_read_bwidth(void)
+{
+    assert(block_mig_state.total_time != 0);
+    return (block_mig_state.reads / block_mig_state.total_time) * BLOCK_SIZE;
+}

 static int bmds_aio_inflight(BlkMigDevState *bmds, int64_t sector)
 {
@@ -176,8 +150,6 @@ static int bmds_aio_inflight(BlkMigDevState *bmds, int64_t sector)
    }
 }

-/* Called with migration lock held.  */
-
 static void bmds_set_aio_inflight(BlkMigDevState *bmds, int64_t sector_num,
                             int nb_sectors, int set)
 {
@@ -212,26 +184,25 @@ static void alloc_aio_bitmap(BlkMigDevState *bmds)
    bmds->aio_bitmap = g_malloc0(bitmap_size);
 }

-/* Never hold migration lock when yielding to the main loop!  */
-
 static void blk_mig_read_cb(void *opaque, int ret)
 {
+    long double curr_time = qemu_get_clock_ns(rt_clock);
    BlkMigBlock *blk = opaque;

-    blk_mig_lock();
    blk->ret = ret;

+    block_mig_state.reads++;
+    block_mig_state.total_time += (curr_time - block_mig_state.prev_time_offset);
+    block_mig_state.prev_time_offset = curr_time;
+
    QSIMPLEQ_INSERT_TAIL(&block_mig_state.blk_list, blk, entry);
    bmds_set_aio_inflight(blk->bmds, blk->sector, blk->nr_sectors, 0);

    block_mig_state.submitted--;
    block_mig_state.read_done++;
    assert(block_mig_state.submitted >= 0);
-    blk_mig_unlock();
 }

-/* Called with no lock taken.  */
-
 static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
 {
    int64_t total_sectors = bmds->total_sectors;
@@ -241,13 +212,11 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
    int nr_sectors;

    if (bmds->shared_base) {
-        qemu_mutex_lock_iothread();
        while (cur_sector < total_sectors &&
               !bdrv_is_allocated(bs, cur_sector, MAX_IS_ALLOCATED_SEARCH,
                                  &nr_sectors)) {
            cur_sector += nr_sectors;
        }
-        qemu_mutex_unlock_iothread();
    }

    if (cur_sector >= total_sectors) {
@@ -276,29 +245,26 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
    blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
    qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);

-    blk_mig_lock();
-    block_mig_state.submitted++;
-    blk_mig_unlock();
+    if (block_mig_state.submitted == 0) {
+        block_mig_state.prev_time_offset = qemu_get_clock_ns(rt_clock);
+    }

-    qemu_mutex_lock_iothread();
    blk->aiocb = bdrv_aio_readv(bs, cur_sector, &blk->qiov,
                                nr_sectors, blk_mig_read_cb, blk);
+    block_mig_state.submitted++;

    bdrv_reset_dirty(bs, cur_sector, nr_sectors);
-    qemu_mutex_unlock_iothread();
-
    bmds->cur_sector = cur_sector + nr_sectors;
+
    return (bmds->cur_sector >= total_sectors);
 }

-/* Called with iothread lock taken.  */
-
 static void set_dirty_tracking(int enable)
 {
    BlkMigDevState *bmds;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bdrv_set_dirty_tracking(bmds->bs, enable ? BLOCK_SIZE : 0);
+        bdrv_set_dirty_tracking(bmds->bs, enable);
    }
 }

@@ -344,12 +310,12 @@ static void init_blk_migration(QEMUFile *f)
    block_mig_state.total_sector_sum = 0;
    block_mig_state.prev_progress = -1;
    block_mig_state.bulk_completed = 0;
+    block_mig_state.total_time = 0;
+    block_mig_state.reads = 0;

    bdrv_iterate(init_blk_migration_it, NULL);
 }

-/* Called with no lock taken.  */
-
 static int blk_mig_save_bulked_block(QEMUFile *f)
 {
    int64_t completed_sector_sum = 0;
@@ -396,8 +362,6 @@ static void blk_mig_reset_dirty_cursor(void)
    }
 }

-/* Called with iothread lock taken.  */
-
 static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
                                 int is_async)
 {
@@ -408,12 +372,8 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
    int ret = -EIO;

    for (sector = bmds->cur_dirty; sector < bmds->total_sectors;) {
-        blk_mig_lock();
        if (bmds_aio_inflight(bmds, sector)) {
-            blk_mig_unlock();
            bdrv_drain_all();
-        } else {
-            blk_mig_unlock();
        }
        if (bdrv_get_dirty(bmds->bs, sector)) {

@@ -433,13 +393,14 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
                blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
                qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);

+                if (block_mig_state.submitted == 0) {
+                    block_mig_state.prev_time_offset = qemu_get_clock_ns(rt_clock);
+                }
+
                blk->aiocb = bdrv_aio_readv(bmds->bs, sector, &blk->qiov,
                                            nr_sectors, blk_mig_read_cb, blk);
-
-                blk_mig_lock();
                block_mig_state.submitted++;
                bmds_set_aio_inflight(bmds, sector, nr_sectors, 1);
-                blk_mig_unlock();
            } else {
                ret = bdrv_read(bmds->bs, sector, blk->buf, nr_sectors);
                if (ret < 0) {
@@ -462,25 +423,20 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,

 error:
    DPRINTF("Error reading sector %" PRId64 "\n", sector);
+    qemu_file_set_error(f, ret);
    g_free(blk->buf);
    g_free(blk);
-    return ret;
+    return 0;
 }

-/* Called with iothread lock taken.
- *
- * return value:
- * 0: too much data for max_downtime
- * 1: few enough data for max_downtime
-*/
 static int blk_mig_save_dirty_block(QEMUFile *f, int is_async)
 {
    BlkMigDevState *bmds;
-    int ret = 1;
+    int ret = 0;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        ret = mig_save_device_dirty(f, bmds, is_async);
-        if (ret <= 0) {
+        if (mig_save_device_dirty(f, bmds, is_async) == 0) {
+            ret = 1;
            break;
        }
    }
@@ -488,32 +444,25 @@ static int blk_mig_save_dirty_block(QEMUFile *f, int is_async)
    return ret;
 }

-/* Called with no locks taken.  */
-
-static int flush_blks(QEMUFile *f)
+static void flush_blks(QEMUFile* f)
 {
    BlkMigBlock *blk;
-    int ret = 0;

    DPRINTF("%s Enter submitted %d read_done %d transferred %d\n",
            __FUNCTION__, block_mig_state.submitted, block_mig_state.read_done,
            block_mig_state.transferred);

-    blk_mig_lock();
    while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
        if (qemu_file_rate_limit(f)) {
            break;
        }
        if (blk->ret < 0) {
-            ret = blk->ret;
+            qemu_file_set_error(f, blk->ret);
            break;
        }
+        blk_send(f, blk);

        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        blk_mig_unlock();
-        blk_send(f, blk);
-        blk_mig_lock();
-
        g_free(blk->buf);
        g_free(blk);

@@ -521,16 +470,12 @@ static int flush_blks(QEMUFile *f)
        block_mig_state.transferred++;
        assert(block_mig_state.read_done >= 0);
    }
-    blk_mig_unlock();

    DPRINTF("%s Exit submitted %d read_done %d transferred %d\n", __FUNCTION__,
            block_mig_state.submitted, block_mig_state.read_done,
            block_mig_state.transferred);
-    return ret;
 }

-/* Called with iothread lock taken.  */
-
 static int64_t get_remaining_dirty(void)
 {
    BlkMigDevState *bmds;
@@ -540,21 +485,42 @@ static int64_t get_remaining_dirty(void)
        dirty += bdrv_get_dirty_count(bmds->bs);
    }

-    return dirty << BDRV_SECTOR_BITS;
+    return dirty * BLOCK_SIZE;
 }

-/* Called with iothread lock taken.  */
+static int is_stage2_completed(void)
+{
+    int64_t remaining_dirty;
+    long double bwidth;
+
+    if (block_mig_state.bulk_completed == 1) {
+
+        remaining_dirty = get_remaining_dirty();
+        if (remaining_dirty == 0) {
+            return 1;
+        }
+
+        bwidth = compute_read_bwidth();
+
+        if ((remaining_dirty / bwidth) <=
+            migrate_max_downtime()) {
+            /* finish stage2 because we think that we can finish remaining work
+               below max_downtime */
+
+            return 1;
+        }
+    }
+
+    return 0;
+}

 static void blk_mig_cleanup(void)
 {
    BlkMigDevState *bmds;
    BlkMigBlock *blk;

-    bdrv_drain_all();
-
    set_dirty_tracking(0);

-    blk_mig_lock();
    while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
        bdrv_set_in_use(bmds->bs, 0);
@@ -568,151 +534,93 @@ static void blk_mig_cleanup(void)
        g_free(blk->buf);
        g_free(blk);
    }
-    blk_mig_unlock();
 }

-static void block_migration_cancel(void *opaque)
-{
-    blk_mig_cleanup();
-}
-
-static int block_save_setup(QEMUFile *f, void *opaque)
+static int block_save_live(QEMUFile *f, int stage, void *opaque)
 {
    int ret;

-    DPRINTF("Enter save live setup submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
+    DPRINTF("Enter save live stage %d submitted %d transferred %d\n",
+            stage, block_mig_state.submitted, block_mig_state.transferred);

-    qemu_mutex_lock_iothread();
-    init_blk_migration(f);
+    if (stage < 0) {
+        blk_mig_cleanup();
+        return 0;
+    }

-    /* start track dirty blocks */
-    set_dirty_tracking(1);
-    qemu_mutex_unlock_iothread();
+    if (block_mig_state.blk_enable != 1) {
+        /* no need to migrate storage */
+        qemu_put_be64(f, BLK_MIG_FLAG_EOS);
+        return 1;
+    }

-    ret = flush_blks(f);
-    blk_mig_reset_dirty_cursor();
-    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
+    if (stage == 1) {
+        init_blk_migration(f);

-    return ret;
-}
+        /* start track dirty blocks */
+        set_dirty_tracking(1);
+    }

-static int block_save_iterate(QEMUFile *f, void *opaque)
-{
-    int ret;
-    int64_t last_ftell = qemu_ftell(f);
+    flush_blks(f);

-    DPRINTF("Enter save live iterate submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
-
-    ret = flush_blks(f);
+    ret = qemu_file_get_error(f);
    if (ret) {
+        blk_mig_cleanup();
        return ret;
    }

    blk_mig_reset_dirty_cursor();

-    /* control the rate of transfer */
-    blk_mig_lock();
-    while ((block_mig_state.submitted +
-            block_mig_state.read_done) * BLOCK_SIZE <
-           qemu_file_get_rate_limit(f)) {
-        blk_mig_unlock();
-        if (block_mig_state.bulk_completed == 0) {
-            /* first finish the bulk phase */
-            if (blk_mig_save_bulked_block(f) == 0) {
-                /* finished saving bulk on all devices */
-                block_mig_state.bulk_completed = 1;
+    if (stage == 2) {
+        /* control the rate of transfer */
+        while ((block_mig_state.submitted +
+                block_mig_state.read_done) * BLOCK_SIZE <
+               qemu_file_get_rate_limit(f)) {
+            if (block_mig_state.bulk_completed == 0) {
+                /* first finish the bulk phase */
+                if (blk_mig_save_bulked_block(f) == 0) {
+                    /* finished saving bulk on all devices */
+                    block_mig_state.bulk_completed = 1;
+                }
+            } else {
+                if (blk_mig_save_dirty_block(f, 1) == 0) {
+                    /* no more dirty blocks */
+                    break;
+                }
            }
-            ret = 0;
-        } else {
-            /* Always called with iothread lock taken for
-             * simplicity, block_save_complete also calls it.
-             */
-            qemu_mutex_lock_iothread();
-            ret = blk_mig_save_dirty_block(f, 1);
-            qemu_mutex_unlock_iothread();
        }
-        if (ret < 0) {
+
+        flush_blks(f);
+
+        ret = qemu_file_get_error(f);
+        if (ret) {
+            blk_mig_cleanup();
            return ret;
        }
-        blk_mig_lock();
-        if (ret != 0) {
-            /* no more dirty blocks */
-            break;
-        }
    }
-    blk_mig_unlock();

-    ret = flush_blks(f);
-    if (ret) {
-        return ret;
+    if (stage == 3) {
+        /* we know for sure that save bulk is completed and
+           all async read completed */
+        assert(block_mig_state.submitted == 0);
+
+        while (blk_mig_save_dirty_block(f, 0) != 0);
+        blk_mig_cleanup();
+
+        /* report completion */
+        qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);
+
+        ret = qemu_file_get_error(f);
+        if (ret) {
+            return ret;
+        }
+
+        DPRINTF("Block migration completed\n");
    }

    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
-    return qemu_ftell(f) - last_ftell;
-}

-/* Called with iothread lock taken.  */
-
-static int block_save_complete(QEMUFile *f, void *opaque)
-{
-    int ret;
-
-    DPRINTF("Enter save live complete submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
-
-    ret = flush_blks(f);
-    if (ret) {
-        return ret;
-    }
-
-    blk_mig_reset_dirty_cursor();
-
-    /* we know for sure that save bulk is completed and
-       all async read completed */
-    blk_mig_lock();
-    assert(block_mig_state.submitted == 0);
-    blk_mig_unlock();
-
-    do {
-        ret = blk_mig_save_dirty_block(f, 0);
-        if (ret < 0) {
-            return ret;
-        }
-    } while (ret == 0);
-
-    /* report completion */
-    qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);
-
-    DPRINTF("Block migration completed\n");
-
-    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
-
-    blk_mig_cleanup();
-    return 0;
-}
-
-static uint64_t block_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)
-{
-    /* Estimate pending number of bytes to send */
-    uint64_t pending;
-
-    qemu_mutex_lock_iothread();
-    blk_mig_lock();
-    pending = get_remaining_dirty() +
-                       block_mig_state.submitted * BLOCK_SIZE +
-                       block_mig_state.read_done * BLOCK_SIZE;
-
-    /* Report at least one block pending during bulk phase */
-    if (pending == 0 && !block_mig_state.bulk_completed) {
-        pending = BLOCK_SIZE;
-    }
-    blk_mig_unlock();
-    qemu_mutex_unlock_iothread();
-
-    DPRINTF("Enter save live pending  %" PRIu64 "\n", pending);
-    return pending;
+    return ((stage == 2) && is_stage2_completed());
 }

 static int block_load(QEMUFile *f, void *opaque, int version_id)
@@ -780,7 +688,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                   (addr == 100) ? '\n' : '\r');
            fflush(stdout);
        } else if (!(flags & BLK_MIG_FLAG_EOS)) {
-            fprintf(stderr, "Unknown block migration flags: %#x\n", flags);
+            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
        ret = qemu_file_get_error(f);
@@ -792,37 +700,20 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void block_set_params(const MigrationParams *params, void *opaque)
+static void block_set_params(int blk_enable, int shared_base, void *opaque)
 {
-    block_mig_state.blk_enable = params->blk;
-    block_mig_state.shared_base = params->shared;
+    block_mig_state.blk_enable = blk_enable;
+    block_mig_state.shared_base = shared_base;

    /* shared base means that blk_enable = 1 */
-    block_mig_state.blk_enable |= params->shared;
+    block_mig_state.blk_enable |= shared_base;
 }

-static bool block_is_active(void *opaque)
-{
-    return block_mig_state.blk_enable == 1;
-}
-
-SaveVMHandlers savevm_block_handlers = {
-    .set_params = block_set_params,
-    .save_live_setup = block_save_setup,
-    .save_live_iterate = block_save_iterate,
-    .save_live_complete = block_save_complete,
-    .save_live_pending = block_save_pending,
-    .load_state = block_load,
-    .cancel = block_migration_cancel,
-    .is_active = block_is_active,
-};
-
 void blk_mig_init(void)
 {
    QSIMPLEQ_INIT(&block_mig_state.bmds_list);
    QSIMPLEQ_INIT(&block_mig_state.blk_list);
-    qemu_mutex_init(&block_mig_state.lock);

-    register_savevm_live(NULL, "block", 0, 1, &savevm_block_handlers,
-                         &block_mig_state);
+    register_savevm_live(NULL, "block", 0, 1, block_set_params,
+                         block_save_live, NULL, block_load, &block_mig_state);
 }
--- a/include/migration/block.h
+++ b/include/migration/block.h
--- a/block.c
+++ b/block.c
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -1,16 +1,14 @@
 #ifndef BLOCK_H
 #define BLOCK_H

-#include "block/aio.h"
+#include "qemu-aio.h"
 #include "qemu-common.h"
-#include "qemu/option.h"
-#include "block/coroutine.h"
-#include "qapi/qmp/qobject.h"
-#include "qapi-types.h"
+#include "qemu-option.h"
+#include "qemu-coroutine.h"
+#include "qobject.h"

 /* block.c */
 typedef struct BlockDriver BlockDriver;
-typedef struct BlockJob BlockJob;

 typedef struct BlockDriverInfo {
    /* in bytes, 0 if irrelevant */
@@ -24,7 +22,6 @@ typedef struct BlockFragInfo {
    uint64_t allocated_clusters;
    uint64_t total_clusters;
    uint64_t fragmented_clusters;
-    uint64_t compressed_clusters;
 } BlockFragInfo;

 typedef struct QEMUSnapshotInfo {
@@ -82,9 +79,6 @@ typedef struct BlockDevOps {
 #define BDRV_O_NO_FLUSH    0x0200 /* disable flushing on this disk */
 #define BDRV_O_COPY_ON_READ 0x0400 /* copy read backing sectors into image */
 #define BDRV_O_INCOMING    0x0800  /* consistency hint for incoming migration */
-#define BDRV_O_CHECK       0x1000  /* open solely for consistency check */
-#define BDRV_O_ALLOW_RDWR  0x2000  /* allow reopen to change from r/o to r/w */
-#define BDRV_O_UNMAP       0x4000  /* execute guest UNMAP/TRIM operations */

 #define BDRV_O_CACHE_MASK  (BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH)

@@ -93,23 +87,21 @@ typedef struct BlockDevOps {
 #define BDRV_SECTOR_MASK   ~(BDRV_SECTOR_SIZE - 1)

 typedef enum {
-    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
+    BLOCK_ERR_REPORT, BLOCK_ERR_IGNORE, BLOCK_ERR_STOP_ENOSPC,
+    BLOCK_ERR_STOP_ANY
 } BlockErrorAction;

-typedef QSIMPLEQ_HEAD(BlockReopenQueue, BlockReopenQueueEntry) BlockReopenQueue;
-
-typedef struct BDRVReopenState {
-    BlockDriverState *bs;
-    int flags;
-    void *opaque;
-} BDRVReopenState;
-
+typedef enum {
+    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
+} BlockQMPEventAction;

 void bdrv_iostatus_enable(BlockDriverState *bs);
 void bdrv_iostatus_reset(BlockDriverState *bs);
 void bdrv_iostatus_disable(BlockDriverState *bs);
 bool bdrv_iostatus_is_enabled(const BlockDriverState *bs);
 void bdrv_iostatus_set_err(BlockDriverState *bs, int error);
+void bdrv_emit_qmp_error_event(const BlockDriverState *bdrv,
+                               BlockQMPEventAction action, int is_read);
 void bdrv_info_print(Monitor *mon, const QObject *data);
 void bdrv_info(Monitor *mon, QObject **ret_data);
 void bdrv_stats_print(Monitor *mon, const QObject *data);
@@ -130,26 +122,13 @@ int bdrv_create(BlockDriver *drv, const char* filename,
 int bdrv_create_file(const char* filename, QEMUOptionParameter *options);
 BlockDriverState *bdrv_new(const char *device_name);
 void bdrv_make_anon(BlockDriverState *bs);
-void bdrv_swap(BlockDriverState *bs_new, BlockDriverState *bs_old);
 void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top);
 void bdrv_delete(BlockDriverState *bs);
 int bdrv_parse_cache_flags(const char *mode, int *flags);
-int bdrv_parse_discard_flags(const char *mode, int *flags);
-int bdrv_file_open(BlockDriverState **pbs, const char *filename,
-                   QDict *options, int flags);
-int bdrv_open_backing_file(BlockDriverState *bs, QDict *options);
-int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
-              int flags, BlockDriver *drv);
-BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
-                                    BlockDriverState *bs, int flags);
-int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
-int bdrv_reopen(BlockDriverState *bs, int bdrv_flags, Error **errp);
-int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
-                        BlockReopenQueue *queue, Error **errp);
-void bdrv_reopen_commit(BDRVReopenState *reopen_state);
-void bdrv_reopen_abort(BDRVReopenState *reopen_state);
+int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
+int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
+              BlockDriver *drv);
 void bdrv_close(BlockDriverState *bs);
-void bdrv_add_close_notifier(BlockDriverState *bs, Notifier *notify);
 int bdrv_attach_dev(BlockDriverState *bs, void *dev);
 void bdrv_attach_dev_nofail(BlockDriverState *bs, void *dev);
 void bdrv_detach_dev(BlockDriverState *bs, void *dev);
@@ -162,16 +141,12 @@ bool bdrv_dev_is_tray_open(BlockDriverState *bs);
 bool bdrv_dev_is_medium_locked(BlockDriverState *bs);
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
              uint8_t *buf, int nb_sectors);
-int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
-                          uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
               const uint8_t *buf, int nb_sectors);
-int bdrv_writev(BlockDriverState *bs, int64_t sector_num, QEMUIOVector *qiov);
 int bdrv_pread(BlockDriverState *bs, int64_t offset,
               void *buf, int count);
 int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
                const void *buf, int count);
-int bdrv_pwritev(BlockDriverState *bs, int64_t offset, QEMUIOVector *qiov);
 int bdrv_pwrite_sync(BlockDriverState *bs, int64_t offset,
    const void *buf, int count);
 int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
@@ -190,45 +165,28 @@ int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors);
 int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors, int *pnum);
-int coroutine_fn bdrv_co_is_allocated_above(BlockDriverState *top,
-                                            BlockDriverState *base,
-                                            int64_t sector_num,
-                                            int nb_sectors, int *pnum);
 BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
    const char *backing_file);
-int bdrv_get_backing_file_depth(BlockDriverState *bs);
 int bdrv_truncate(BlockDriverState *bs, int64_t offset);
 int64_t bdrv_getlength(BlockDriverState *bs);
 int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
+void bdrv_guess_geometry(BlockDriverState *bs, int *pcyls, int *pheads, int *psecs);
 int bdrv_commit(BlockDriverState *bs);
 int bdrv_commit_all(void);
 int bdrv_change_backing_file(BlockDriverState *bs,
    const char *backing_file, const char *backing_fmt);
 void bdrv_register(BlockDriver *bdrv);
-int bdrv_drop_intermediate(BlockDriverState *active, BlockDriverState *top,
-                           BlockDriverState *base);
-BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
-                                    BlockDriverState *bs);
-BlockDriverState *bdrv_find_base(BlockDriverState *bs);


 typedef struct BdrvCheckResult {
    int corruptions;
    int leaks;
    int check_errors;
-    int corruptions_fixed;
-    int leaks_fixed;
-    int64_t image_end_offset;
    BlockFragInfo bfi;
 } BdrvCheckResult;

-typedef enum {
-    BDRV_FIX_LEAKS    = 1,
-    BDRV_FIX_ERRORS   = 2,
-} BdrvCheckMode;
-
-int bdrv_check(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix);
+int bdrv_check(BlockDriverState *bs, BdrvCheckResult *res);

 /* async block I/O */
 typedef void BlockDriverDirtyHandler(BlockDriverState *bs, int64_t sector,
@@ -285,24 +243,48 @@ int bdrv_co_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
 int bdrv_has_zero_init(BlockDriverState *bs);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
                      int *pnum);
-int bdrv_is_allocated_above(BlockDriverState *top, BlockDriverState *base,
-                            int64_t sector_num, int nb_sectors, int *pnum);

-void bdrv_set_on_error(BlockDriverState *bs, BlockdevOnError on_read_error,
-                       BlockdevOnError on_write_error);
-BlockdevOnError bdrv_get_on_error(BlockDriverState *bs, bool is_read);
-BlockErrorAction bdrv_get_error_action(BlockDriverState *bs, bool is_read, int error);
-void bdrv_error_action(BlockDriverState *bs, BlockErrorAction action,
-                       bool is_read, int error);
+#define BIOS_ATA_TRANSLATION_AUTO   0
+#define BIOS_ATA_TRANSLATION_NONE   1
+#define BIOS_ATA_TRANSLATION_LBA    2
+#define BIOS_ATA_TRANSLATION_LARGE  3
+#define BIOS_ATA_TRANSLATION_RECHS  4
+
+void bdrv_set_geometry_hint(BlockDriverState *bs,
+                            int cyls, int heads, int secs);
+void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
+void bdrv_get_geometry_hint(BlockDriverState *bs,
+                            int *pcyls, int *pheads, int *psecs);
+typedef enum FDriveType {
+    FDRIVE_DRV_144  = 0x00,   /* 1.44 MB 3"5 drive      */
+    FDRIVE_DRV_288  = 0x01,   /* 2.88 MB 3"5 drive      */
+    FDRIVE_DRV_120  = 0x02,   /* 1.2  MB 5"25 drive     */
+    FDRIVE_DRV_NONE = 0x03,   /* No drive connected     */
+} FDriveType;
+
+typedef enum FDriveRate {
+    FDRIVE_RATE_500K = 0x00,  /* 500 Kbps */
+    FDRIVE_RATE_300K = 0x01,  /* 300 Kbps */
+    FDRIVE_RATE_250K = 0x02,  /* 250 Kbps */
+    FDRIVE_RATE_1M   = 0x03,  /*   1 Mbps */
+} FDriveRate;
+
+void bdrv_get_floppy_geometry_hint(BlockDriverState *bs, int *nb_heads,
+                                   int *max_track, int *last_sect,
+                                   FDriveType drive_in, FDriveType *drive,
+                                   FDriveRate *rate);
+int bdrv_get_translation_hint(BlockDriverState *bs);
+void bdrv_set_on_error(BlockDriverState *bs, BlockErrorAction on_read_error,
+                       BlockErrorAction on_write_error);
+BlockErrorAction bdrv_get_on_error(BlockDriverState *bs, int is_read);
 int bdrv_is_read_only(BlockDriverState *bs);
 int bdrv_is_sg(BlockDriverState *bs);
 int bdrv_enable_write_cache(BlockDriverState *bs);
-void bdrv_set_enable_write_cache(BlockDriverState *bs, bool wce);
 int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
 void bdrv_lock_medium(BlockDriverState *bs, bool locked);
 void bdrv_eject(BlockDriverState *bs, bool eject_flag);
-const char *bdrv_get_format_name(BlockDriverState *bs);
+void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
 BlockDriverState *bdrv_find(const char *name);
 BlockDriverState *bdrv_next(BlockDriverState *bs);
 void bdrv_iterate(void (*it)(void *opaque, BlockDriverState *bs),
@@ -314,22 +296,15 @@ int bdrv_query_missing_keys(void);
 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
                         void *opaque);
 const char *bdrv_get_device_name(BlockDriverState *bs);
-int bdrv_get_flags(BlockDriverState *bs);
 int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
-void bdrv_round_to_clusters(BlockDriverState *bs,
-                            int64_t sector_num, int nb_sectors,
-                            int64_t *cluster_sector_num,
-                            int *cluster_nb_sectors);

 const char *bdrv_get_encrypted_filename(BlockDriverState *bs);
 void bdrv_get_backing_filename(BlockDriverState *bs,
                               char *filename, int filename_size);
 void bdrv_get_full_backing_filename(BlockDriverState *bs,
                                    char *dest, size_t sz);
-BlockInfo *bdrv_query_info(BlockDriverState *s);
-BlockStats *bdrv_query_stats(const BlockDriverState *bs);
 int bdrv_can_snapshot(BlockDriverState *bs);
 int bdrv_is_snapshot(BlockDriverState *bs);
 BlockDriverState *bdrv_snapshots(void);
@@ -350,28 +325,25 @@ void path_combine(char *dest, int dest_size,
                  const char *base_path,
                  const char *filename);

-int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos);
 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
                      int64_t pos, int size);

 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size);

-void bdrv_img_create(const char *filename, const char *fmt,
-                     const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags,
-                     Error **errp, bool quiet);
+int bdrv_img_create(const char *filename, const char *fmt,
+                    const char *base_filename, const char *base_fmt,
+                    char *options, uint64_t img_size, int flags);

 void bdrv_set_buffer_alignment(BlockDriverState *bs, int align);
 void *qemu_blockalign(BlockDriverState *bs, size_t size);
-bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov);

-struct HBitmapIter;
-void bdrv_set_dirty_tracking(BlockDriverState *bs, int granularity);
+#define BDRV_SECTORS_PER_DIRTY_CHUNK 2048
+
+void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
 int bdrv_get_dirty(BlockDriverState *bs, int64_t sector);
-void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
-void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
-void bdrv_dirty_iter_init(BlockDriverState *bs, struct HBitmapIter *hbi);
+void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector,
+                      int nr_sectors);
 int64_t bdrv_get_dirty_count(BlockDriverState *bs);

 void bdrv_enable_copy_on_read(BlockDriverState *bs);
@@ -380,15 +352,6 @@ void bdrv_disable_copy_on_read(BlockDriverState *bs);
 void bdrv_set_in_use(BlockDriverState *bs, int in_use);
 int bdrv_in_use(BlockDriverState *bs);

-#ifdef CONFIG_LINUX_AIO
-int raw_get_aio_fd(BlockDriverState *bs);
-#else
-static inline int raw_get_aio_fd(BlockDriverState *bs)
-{
-    return -ENOTSUP;
-}
-#endif
-
 enum BlockAcctType {
    BDRV_ACCT_READ,
    BDRV_ACCT_WRITE,
@@ -419,7 +382,9 @@ typedef enum {
    BLKDBG_L2_ALLOC_COW_READ,
    BLKDBG_L2_ALLOC_WRITE,

+    BLKDBG_READ,
    BLKDBG_READ_AIO,
+    BLKDBG_READ_BACKING,
    BLKDBG_READ_BACKING_AIO,
    BLKDBG_READ_COMPRESSED,

@@ -455,9 +420,43 @@ typedef enum {
 #define BLKDBG_EVENT(bs, evt) bdrv_debug_event(bs, evt)
 void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event);

-int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
-                           const char *tag);
-int bdrv_debug_resume(BlockDriverState *bs, const char *tag);
-bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag);
+
+/* Convenience for block device models */
+
+typedef struct BlockConf {
+    BlockDriverState *bs;
+    uint16_t physical_block_size;
+    uint16_t logical_block_size;
+    uint16_t min_io_size;
+    uint32_t opt_io_size;
+    int32_t bootindex;
+    uint32_t discard_granularity;
+} BlockConf;
+
+static inline unsigned int get_physical_block_exp(BlockConf *conf)
+{
+    unsigned int exp = 0, size;
+
+    for (size = conf->physical_block_size;
+        size > conf->logical_block_size;
+        size >>= 1) {
+        exp++;
+    }
+
+    return exp;
+}
+
+#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
+    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
+    DEFINE_PROP_BLOCKSIZE("logical_block_size", _state,                 \
+                          _conf.logical_block_size, 512),               \
+    DEFINE_PROP_BLOCKSIZE("physical_block_size", _state,                \
+                          _conf.physical_block_size, 512),              \
+    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
+    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
+    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
+    DEFINE_PROP_UINT32("discard_granularity", _state, \
+                       _conf.discard_granularity, 0)

 #endif
+
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -1,24 +0,0 @@
-block-obj-y += raw.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o vvfat.o
-block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
-block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
-block-obj-y += qed-check.o
-block-obj-y += vhdx.o
-block-obj-y += parallels.o blkdebug.o blkverify.o
-block-obj-$(CONFIG_WIN32) += raw-win32.o win32-aio.o
-block-obj-$(CONFIG_POSIX) += raw-posix.o
-block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
-
-ifeq ($(CONFIG_POSIX),y)
-block-obj-y += nbd.o sheepdog.o
-block-obj-$(CONFIG_LIBISCSI) += iscsi.o
-block-obj-$(CONFIG_CURL) += curl.o
-block-obj-$(CONFIG_RBD) += rbd.o
-block-obj-$(CONFIG_GLUSTERFS) += gluster.o
-block-obj-$(CONFIG_LIBSSH2) += ssh.o
-endif
-
-common-obj-y += stream.o
-common-obj-y += commit.o
-common-obj-y += mirror.o
-
-$(obj)/curl.o: QEMU_CFLAGS+=$(CURL_CFLAGS)
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -23,17 +23,27 @@
 */

 #include "qemu-common.h"
-#include "qemu/config-file.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
+
+typedef struct BlkdebugVars {
+    int state;
+
+    /* If inject_errno != 0, an error is injected for requests */
+    int inject_errno;
+
+    /* Decides if all future requests fail (false) or only the next one and
+     * after the next request inject_errno is reset to 0 (true) */
+    bool inject_once;
+
+    /* Decides if aio_readv/writev fails right away (true) or returns an error
+     * return value only in the callback (false) */
+    bool inject_immediately;
+} BlkdebugVars;

 typedef struct BDRVBlkdebugState {
-    int state;
-    int new_state;
-
-    QLIST_HEAD(, BlkdebugRule) rules[BLKDBG_EVENT_MAX];
-    QSIMPLEQ_HEAD(, BlkdebugRule) active_rules;
-    QLIST_HEAD(, BlkdebugSuspendedReq) suspended_reqs;
+    BlkdebugVars vars;
+    QLIST_HEAD(list, BlkdebugRule) rules[BLKDBG_EVENT_MAX];
 } BDRVBlkdebugState;

 typedef struct BlkdebugAIOCB {
@@ -42,15 +52,9 @@ typedef struct BlkdebugAIOCB {
    int ret;
 } BlkdebugAIOCB;

-typedef struct BlkdebugSuspendedReq {
-    Coroutine *co;
-    char *tag;
-    QLIST_ENTRY(BlkdebugSuspendedReq) next;
-} BlkdebugSuspendedReq;
-
 static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb);

-static const AIOCBInfo blkdebug_aiocb_info = {
+static AIOPool blkdebug_aio_pool = {
    .aiocb_size = sizeof(BlkdebugAIOCB),
    .cancel     = blkdebug_aio_cancel,
 };
@@ -58,7 +62,6 @@ static const AIOCBInfo blkdebug_aiocb_info = {
 enum {
    ACTION_INJECT_ERROR,
    ACTION_SET_STATE,
-    ACTION_SUSPEND,
 };

 typedef struct BlkdebugRule {
@@ -70,17 +73,12 @@ typedef struct BlkdebugRule {
            int error;
            int immediately;
            int once;
-            int64_t sector;
        } inject;
        struct {
            int new_state;
        } set_state;
-        struct {
-            char *tag;
-        } suspend;
    } options;
    QLIST_ENTRY(BlkdebugRule) next;
-    QSIMPLEQ_ENTRY(BlkdebugRule) active_next;
 } BlkdebugRule;

 static QemuOptsList inject_error_opts = {
@@ -99,10 +97,6 @@ static QemuOptsList inject_error_opts = {
            .name = "errno",
            .type = QEMU_OPT_NUMBER,
        },
-        {
-            .name = "sector",
-            .type = QEMU_OPT_NUMBER,
-        },
        {
            .name = "once",
            .type = QEMU_OPT_BOOL,
@@ -153,7 +147,9 @@ static const char *event_names[BLKDBG_EVENT_MAX] = {
    [BLKDBG_L2_ALLOC_COW_READ]              = "l2_alloc.cow_read",
    [BLKDBG_L2_ALLOC_WRITE]                 = "l2_alloc.write",

+    [BLKDBG_READ]                           = "read",
    [BLKDBG_READ_AIO]                       = "read_aio",
+    [BLKDBG_READ_BACKING]                   = "read_backing",
    [BLKDBG_READ_BACKING_AIO]               = "read_backing_aio",
    [BLKDBG_READ_COMPRESSED]                = "read_compressed",

@@ -232,18 +228,12 @@ static int add_rule(QemuOpts *opts, void *opaque)
        rule->options.inject.once  = qemu_opt_get_bool(opts, "once", 0);
        rule->options.inject.immediately =
            qemu_opt_get_bool(opts, "immediately", 0);
-        rule->options.inject.sector = qemu_opt_get_number(opts, "sector", -1);
        break;

    case ACTION_SET_STATE:
        rule->options.set_state.new_state =
            qemu_opt_get_number(opts, "new_state", 0);
        break;
-
-    case ACTION_SUSPEND:
-        rule->options.suspend.tag =
-            g_strdup(qemu_opt_get(opts, "tag"));
-        break;
    };

    /* Add the rule */
@@ -252,21 +242,6 @@ static int add_rule(QemuOpts *opts, void *opaque)
    return 0;
 }

-static void remove_rule(BlkdebugRule *rule)
-{
-    switch (rule->action) {
-    case ACTION_INJECT_ERROR:
-    case ACTION_SET_STATE:
-        break;
-    case ACTION_SUSPEND:
-        g_free(rule->options.suspend.tag);
-        break;
-    }
-
-    QLIST_REMOVE(rule, next);
-    g_free(rule);
-}
-
 static int read_config(BDRVBlkdebugState *s, const char *filename)
 {
    FILE *f;
@@ -299,98 +274,43 @@ fail:
 }

 /* Valid blkdebug filenames look like blkdebug:path/to/config:path/to/image */
-static void blkdebug_parse_filename(const char *filename, QDict *options,
-                                    Error **errp)
-{
-    const char *c;
-
-    /* Parse the blkdebug: prefix */
-    if (!strstart(filename, "blkdebug:", &filename)) {
-        error_setg(errp, "File name string must start with 'blkdebug:'");
-        return;
-    }
-
-    /* Parse config file path */
-    c = strchr(filename, ':');
-    if (c == NULL) {
-        error_setg(errp, "blkdebug requires both config file and image path");
-        return;
-    }
-
-    if (c != filename) {
-        QString *config_path;
-        config_path = qstring_from_substr(filename, 0, c - filename - 1);
-        qdict_put(options, "config", config_path);
-    }
-
-    /* TODO Allow multi-level nesting and set file.filename here */
-    filename = c + 1;
-    qdict_put(options, "x-image", qstring_from_str(filename));
-}
-
-static QemuOptsList runtime_opts = {
-    .name = "blkdebug",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "config",
-            .type = QEMU_OPT_STRING,
-            .help = "Path to the configuration file",
-        },
-        {
-            .name = "x-image",
-            .type = QEMU_OPT_STRING,
-            .help = "[internal use only, will be removed]",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags)
+static int blkdebug_open(BlockDriverState *bs, const char *filename, int flags)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *filename, *config;
    int ret;
+    char *config, *c;

-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto fail;
+    /* Parse the blkdebug: prefix */
+    if (strncmp(filename, "blkdebug:", strlen("blkdebug:"))) {
+        return -EINVAL;
    }
+    filename += strlen("blkdebug:");

    /* Read rules from config file */
-    config = qemu_opt_get(opts, "config");
-    if (config) {
-        ret = read_config(s, config);
-        if (ret < 0) {
-            goto fail;
-        }
+    c = strchr(filename, ':');
+    if (c == NULL) {
+        return -EINVAL;
    }

+    config = g_strdup(filename);
+    config[c - filename] = '\0';
+    ret = read_config(s, config);
+    g_free(config);
+    if (ret < 0) {
+        return ret;
+    }
+    filename = c + 1;
+
    /* Set initial state */
-    s->state = 1;
+    s->vars.state = 1;

    /* Open the backing file */
-    filename = qemu_opt_get(opts, "x-image");
-    if (filename == NULL) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = bdrv_file_open(&bs->file, filename, NULL, flags);
+    ret = bdrv_file_open(&bs->file, filename, flags);
    if (ret < 0) {
-        goto fail;
+        return ret;
    }

-    ret = 0;
-fail:
-    qemu_opts_del(opts);
-    return ret;
+    return 0;
 }

 static void error_callback_bh(void *opaque)
@@ -408,22 +328,22 @@ static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb)
 }

 static BlockDriverAIOCB *inject_error(BlockDriverState *bs,
-    BlockDriverCompletionFunc *cb, void *opaque, BlkdebugRule *rule)
+    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    int error = rule->options.inject.error;
+    int error = s->vars.inject_errno;
    struct BlkdebugAIOCB *acb;
    QEMUBH *bh;

-    if (rule->options.inject.once) {
-        QSIMPLEQ_INIT(&s->active_rules);
+    if (s->vars.inject_once) {
+        s->vars.inject_errno = 0;
    }

-    if (rule->options.inject.immediately) {
+    if (s->vars.inject_immediately) {
        return NULL;
    }

-    acb = qemu_aio_get(&blkdebug_aiocb_info, bs, cb, opaque);
+    acb = qemu_aio_get(&blkdebug_aio_pool, bs, cb, opaque);
    acb->ret = -error;

    bh = qemu_bh_new(error_callback_bh, acb);
@@ -438,21 +358,14 @@ static BlockDriverAIOCB *blkdebug_aio_readv(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugRule *rule = NULL;

-    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
-        if (rule->options.inject.sector == -1 ||
-            (rule->options.inject.sector >= sector_num &&
-             rule->options.inject.sector < sector_num + nb_sectors)) {
-            break;
-        }
+    if (s->vars.inject_errno) {
+        return inject_error(bs, cb, opaque);
    }

-    if (rule && rule->options.inject.error) {
-        return inject_error(bs, cb, opaque, rule);
-    }
-
-    return bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    BlockDriverAIOCB *acb =
+        bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    return acb;
 }

 static BlockDriverAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
@@ -460,24 +373,16 @@ static BlockDriverAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugRule *rule = NULL;

-    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
-        if (rule->options.inject.sector == -1 ||
-            (rule->options.inject.sector >= sector_num &&
-             rule->options.inject.sector < sector_num + nb_sectors)) {
-            break;
-        }
+    if (s->vars.inject_errno) {
+        return inject_error(bs, cb, opaque);
    }

-    if (rule && rule->options.inject.error) {
-        return inject_error(bs, cb, opaque, rule);
-    }
-
-    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    BlockDriverAIOCB *acb =
+        bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    return acb;
 }

-
 static void blkdebug_close(BlockDriverState *bs)
 {
    BDRVBlkdebugState *s = bs->opaque;
@@ -486,154 +391,63 @@ static void blkdebug_close(BlockDriverState *bs)

    for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
-            remove_rule(rule);
+            QLIST_REMOVE(rule, next);
+            g_free(rule);
        }
    }
 }

-static void suspend_request(BlockDriverState *bs, BlkdebugRule *rule)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq r;
-
-    r = (BlkdebugSuspendedReq) {
-        .co         = qemu_coroutine_self(),
-        .tag        = g_strdup(rule->options.suspend.tag),
-    };
-
-    remove_rule(rule);
-    QLIST_INSERT_HEAD(&s->suspended_reqs, &r, next);
-
-    printf("blkdebug: Suspended request '%s'\n", r.tag);
-    qemu_coroutine_yield();
-    printf("blkdebug: Resuming request '%s'\n", r.tag);
-
-    QLIST_REMOVE(&r, next);
-    g_free(r.tag);
-}
-
-static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
-    bool injected)
+static void process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
+    BlkdebugVars *old_vars)
 {
    BDRVBlkdebugState *s = bs->opaque;
+    BlkdebugVars *vars = &s->vars;

    /* Only process rules for the current state */
-    if (rule->state && rule->state != s->state) {
-        return injected;
+    if (rule->state && rule->state != old_vars->state) {
+        return;
    }

    /* Take the action */
    switch (rule->action) {
    case ACTION_INJECT_ERROR:
-        if (!injected) {
-            QSIMPLEQ_INIT(&s->active_rules);
-            injected = true;
-        }
-        QSIMPLEQ_INSERT_HEAD(&s->active_rules, rule, active_next);
+        vars->inject_errno       = rule->options.inject.error;
+        vars->inject_once        = rule->options.inject.once;
+        vars->inject_immediately = rule->options.inject.immediately;
        break;

    case ACTION_SET_STATE:
-        s->new_state = rule->options.set_state.new_state;
-        break;
-
-    case ACTION_SUSPEND:
-        suspend_request(bs, rule);
+        vars->state              = rule->options.set_state.new_state;
        break;
    }
-    return injected;
 }

 static void blkdebug_debug_event(BlockDriverState *bs, BlkDebugEvent event)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule, *next;
-    bool injected;
+    struct BlkdebugRule *rule;
+    BlkdebugVars old_vars = s->vars;

    assert((int)event >= 0 && event < BLKDBG_EVENT_MAX);

-    injected = false;
-    s->new_state = s->state;
-    QLIST_FOREACH_SAFE(rule, &s->rules[event], next, next) {
-        injected = process_rule(bs, rule, injected);
+    QLIST_FOREACH(rule, &s->rules[event], next) {
+        process_rule(bs, rule, &old_vars);
    }
-    s->state = s->new_state;
-}
-
-static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
-                                     const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule;
-    BlkDebugEvent blkdebug_event;
-
-    if (get_event_by_name(event, &blkdebug_event) < 0) {
-        return -ENOENT;
-    }
-
-
-    rule = g_malloc(sizeof(*rule));
-    *rule = (struct BlkdebugRule) {
-        .event  = blkdebug_event,
-        .action = ACTION_SUSPEND,
-        .state  = 0,
-        .options.suspend.tag = g_strdup(tag),
-    };
-
-    QLIST_INSERT_HEAD(&s->rules[blkdebug_event], rule, next);
-
-    return 0;
-}
-
-static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            qemu_coroutine_enter(r->co, NULL);
-            return 0;
-        }
-    }
-    return -ENOENT;
-}
-
-
-static bool blkdebug_debug_is_suspended(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            return true;
-        }
-    }
-    return false;
-}
-
-static int64_t blkdebug_getlength(BlockDriverState *bs)
-{
-    return bdrv_getlength(bs->file);
 }

 static BlockDriver bdrv_blkdebug = {
-    .format_name            = "blkdebug",
-    .protocol_name          = "blkdebug",
-    .instance_size          = sizeof(BDRVBlkdebugState),
+    .format_name        = "blkdebug",
+    .protocol_name      = "blkdebug",

-    .bdrv_parse_filename    = blkdebug_parse_filename,
-    .bdrv_file_open         = blkdebug_open,
-    .bdrv_close             = blkdebug_close,
-    .bdrv_getlength         = blkdebug_getlength,
+    .instance_size      = sizeof(BDRVBlkdebugState),

-    .bdrv_aio_readv         = blkdebug_aio_readv,
-    .bdrv_aio_writev        = blkdebug_aio_writev,
+    .bdrv_file_open     = blkdebug_open,
+    .bdrv_close         = blkdebug_close,

-    .bdrv_debug_event           = blkdebug_debug_event,
-    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
-    .bdrv_debug_resume          = blkdebug_debug_resume,
-    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
+    .bdrv_aio_readv     = blkdebug_aio_readv,
+    .bdrv_aio_writev    = blkdebug_aio_writev,
+
+    .bdrv_debug_event   = blkdebug_debug_event,
 };

 static void bdrv_blkdebug_init(void)
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -8,8 +8,8 @@
 */

 #include <stdarg.h>
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
-#include "block/block_int.h"
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
+#include "block_int.h"

 typedef struct {
    BlockDriverState *test_file;
@@ -48,7 +48,7 @@ static void blkverify_aio_cancel(BlockDriverAIOCB *blockacb)
    }
 }

-static const AIOCBInfo blkverify_aiocb_info = {
+static AIOPool blkverify_aio_pool = {
    .aiocb_size         = sizeof(BlkverifyAIOCB),
    .cancel             = blkverify_aio_cancel,
 };
@@ -69,100 +69,43 @@ static void GCC_FMT_ATTR(2, 3) blkverify_err(BlkverifyAIOCB *acb,
 }

 /* Valid blkverify filenames look like blkverify:path/to/raw_image:path/to/image */
-static void blkverify_parse_filename(const char *filename, QDict *options,
-                                     Error **errp)
+static int blkverify_open(BlockDriverState *bs, const char *filename, int flags)
 {
-    const char *c;
-    QString *raw_path;
-
+    BDRVBlkverifyState *s = bs->opaque;
+    int ret;
+    char *raw, *c;

    /* Parse the blkverify: prefix */
-    if (!strstart(filename, "blkverify:", &filename)) {
-        error_setg(errp, "File name string must start with 'blkverify:'");
-        return;
+    if (strncmp(filename, "blkverify:", strlen("blkverify:"))) {
+        return -EINVAL;
    }
+    filename += strlen("blkverify:");

    /* Parse the raw image filename */
    c = strchr(filename, ':');
    if (c == NULL) {
-        error_setg(errp, "blkverify requires raw copy and original image path");
-        return;
+        return -EINVAL;
    }

-    /* TODO Implement option pass-through and set raw.filename here */
-    raw_path = qstring_from_substr(filename, 0, c - filename - 1);
-    qdict_put(options, "x-raw", raw_path);
-
-    /* TODO Allow multi-level nesting and set file.filename here */
-    filename = c + 1;
-    qdict_put(options, "x-image", qstring_from_str(filename));
-}
-
-static QemuOptsList runtime_opts = {
-    .name = "blkverify",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "x-raw",
-            .type = QEMU_OPT_STRING,
-            .help = "[internal use only, will be removed]",
-        },
-        {
-            .name = "x-image",
-            .type = QEMU_OPT_STRING,
-            .help = "[internal use only, will be removed]",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int blkverify_open(BlockDriverState *bs, QDict *options, int flags)
-{
-    BDRVBlkverifyState *s = bs->opaque;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *filename, *raw;
-    int ret;
-
-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    /* Parse the raw image filename */
-    raw = qemu_opt_get(opts, "x-raw");
-    if (raw == NULL) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = bdrv_file_open(&bs->file, raw, NULL, flags);
+    raw = g_strdup(filename);
+    raw[c - filename] = '\0';
+    ret = bdrv_file_open(&bs->file, raw, flags);
+    g_free(raw);
    if (ret < 0) {
-        goto fail;
+        return ret;
    }
+    filename = c + 1;

    /* Open the test file */
-    filename = qemu_opt_get(opts, "x-image");
-    if (filename == NULL) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
    s->test_file = bdrv_new("");
-    ret = bdrv_open(s->test_file, filename, NULL, flags, NULL);
+    ret = bdrv_open(s->test_file, filename, flags, NULL);
    if (ret < 0) {
        bdrv_delete(s->test_file);
        s->test_file = NULL;
-        goto fail;
+        return ret;
    }

-    ret = 0;
-fail:
-    return ret;
+    return 0;
 }

 static void blkverify_close(BlockDriverState *bs)
@@ -290,7 +233,7 @@ static BlkverifyAIOCB *blkverify_aio_get(BlockDriverState *bs, bool is_write,
                                         BlockDriverCompletionFunc *cb,
                                         void *opaque)
 {
-    BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aiocb_info, bs, cb, opaque);
+    BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aio_pool, bs, cb, opaque);

    acb->bh = NULL;
    acb->is_write = is_write;
@@ -400,18 +343,19 @@ static BlockDriverAIOCB *blkverify_aio_flush(BlockDriverState *bs,
 }

 static BlockDriver bdrv_blkverify = {
-    .format_name            = "blkverify",
-    .protocol_name          = "blkverify",
-    .instance_size          = sizeof(BDRVBlkverifyState),
+    .format_name        = "blkverify",
+    .protocol_name      = "blkverify",

-    .bdrv_parse_filename    = blkverify_parse_filename,
-    .bdrv_file_open         = blkverify_open,
-    .bdrv_close             = blkverify_close,
-    .bdrv_getlength         = blkverify_getlength,
+    .instance_size      = sizeof(BDRVBlkverifyState),

-    .bdrv_aio_readv         = blkverify_aio_readv,
-    .bdrv_aio_writev        = blkverify_aio_writev,
-    .bdrv_aio_flush         = blkverify_aio_flush,
+    .bdrv_getlength     = blkverify_getlength,
+
+    .bdrv_file_open     = blkverify_open,
+    .bdrv_close         = blkverify_close,
+
+    .bdrv_aio_readv     = blkverify_aio_readv,
+    .bdrv_aio_writev    = blkverify_aio_writev,
+    .bdrv_aio_flush     = blkverify_aio_flush,
 };

 static void bdrv_blkverify_init(void)
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -23,8 +23,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -108,19 +108,17 @@ static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }

-static int bochs_open(BlockDriverState *bs, QDict *options, int flags)
+static int bochs_open(BlockDriverState *bs, int flags)
 {
    BDRVBochsState *s = bs->opaque;
    int i;
    struct bochs_header bochs;
    struct bochs_header_v1 header_v1;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 0, &bochs, sizeof(bochs)) != sizeof(bochs)) {
+        goto fail;
    }

    if (strcmp(bochs.magic, HEADER_MAGIC) ||
@@ -128,7 +126,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags)
        strcmp(bochs.subtype, GROWING_TYPE) ||
 	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
 	(le32_to_cpu(bochs.version) != HEADER_V1))) {
-        return -EMEDIUMTYPE;
+        goto fail;
    }

    if (le32_to_cpu(bochs.version) == HEADER_V1) {
@@ -140,13 +138,9 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags)

    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
-                     s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
+                   s->catalog_size * 4) != s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

@@ -159,10 +153,8 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags)

    qemu_co_mutex_init(&s->lock);
    return 0;
-
-fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+ fail:
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVCloopState {
@@ -53,36 +53,31 @@ static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }

-static int cloop_open(BlockDriverState *bs, QDict *options, int flags)
+static int cloop_open(BlockDriverState *bs, int flags)
 {
    BDRVCloopState *s = bs->opaque;
    uint32_t offsets_size, max_compressed_block_size = 1, i;
-    int ret;

    bs->read_only = 1;

    /* read header */
-    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128, &s->block_size, 4) < 4) {
+        goto cloop_close;
    }
    s->block_size = be32_to_cpu(s->block_size);

-    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4) < 4) {
+        goto cloop_close;
    }
    s->n_blocks = be32_to_cpu(s->n_blocks);

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
    s->offsets = g_malloc(offsets_size);
-
-    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
-    if (ret < 0) {
-        goto fail;
+    if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
+            offsets_size) {
+        goto cloop_close;
    }
-
    for(i=0;i<s->n_blocks;i++) {
        s->offsets[i] = be64_to_cpu(s->offsets[i]);
        if (i > 0) {
@@ -97,8 +92,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags)
    s->compressed_block = g_malloc(max_compressed_block_size + 1);
    s->uncompressed_block = g_malloc(s->block_size);
    if (inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
+        goto cloop_close;
    }
    s->current_block = s->n_blocks;

@@ -107,11 +101,8 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags)
    qemu_co_mutex_init(&s->lock);
    return 0;

-fail:
-    g_free(s->offsets);
-    g_free(s->compressed_block);
-    g_free(s->uncompressed_block);
-    return ret;
+cloop_close:
+    return -1;
 }

 static inline int cloop_read_block(BlockDriverState *bs, int block_num)
--- a/block/commit.c
+++ b/block/commit.c
@@ -1,258 +0,0 @@
-/*
- * Live block commit
- *
- * Copyright Red Hat, Inc. 2012
- *
- * Authors:
- *  Jeff Cody   <jcody@redhat.com>
- *  Based on stream.c by Stefan Hajnoczi
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#include "trace.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
-#include "qemu/ratelimit.h"
-
-enum {
-    /*
-     * Size of data buffer for populating the image file.  This should be large
-     * enough to process multiple clusters in a single call, so that populating
-     * contiguous regions of the image is efficient.
-     */
-    COMMIT_BUFFER_SIZE = 512 * 1024, /* in bytes */
-};
-
-#define SLICE_TIME 100000000ULL /* ns */
-
-typedef struct CommitBlockJob {
-    BlockJob common;
-    RateLimit limit;
-    BlockDriverState *active;
-    BlockDriverState *top;
-    BlockDriverState *base;
-    BlockdevOnError on_error;
-    int base_flags;
-    int orig_overlay_flags;
-} CommitBlockJob;
-
-static int coroutine_fn commit_populate(BlockDriverState *bs,
-                                        BlockDriverState *base,
-                                        int64_t sector_num, int nb_sectors,
-                                        void *buf)
-{
-    int ret = 0;
-
-    ret = bdrv_read(bs, sector_num, buf, nb_sectors);
-    if (ret) {
-        return ret;
-    }
-
-    ret = bdrv_write(base, sector_num, buf, nb_sectors);
-    if (ret) {
-        return ret;
-    }
-
-    return 0;
-}
-
-static void coroutine_fn commit_run(void *opaque)
-{
-    CommitBlockJob *s = opaque;
-    BlockDriverState *active = s->active;
-    BlockDriverState *top = s->top;
-    BlockDriverState *base = s->base;
-    BlockDriverState *overlay_bs;
-    int64_t sector_num, end;
-    int ret = 0;
-    int n = 0;
-    void *buf;
-    int bytes_written = 0;
-    int64_t base_len;
-
-    ret = s->common.len = bdrv_getlength(top);
-
-
-    if (s->common.len < 0) {
-        goto exit_restore_reopen;
-    }
-
-    ret = base_len = bdrv_getlength(base);
-    if (base_len < 0) {
-        goto exit_restore_reopen;
-    }
-
-    if (base_len < s->common.len) {
-        ret = bdrv_truncate(base, s->common.len);
-        if (ret) {
-            goto exit_restore_reopen;
-        }
-    }
-
-    end = s->common.len >> BDRV_SECTOR_BITS;
-    buf = qemu_blockalign(top, COMMIT_BUFFER_SIZE);
-
-    for (sector_num = 0; sector_num < end; sector_num += n) {
-        uint64_t delay_ns = 0;
-        bool copy;
-
-wait:
-        /* Note that even when no rate limit is applied we need to yield
-         * with no pending I/O here so that bdrv_drain_all() returns.
-         */
-        block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-        if (block_job_is_cancelled(&s->common)) {
-            break;
-        }
-        /* Copy if allocated above the base */
-        ret = bdrv_co_is_allocated_above(top, base, sector_num,
-                                         COMMIT_BUFFER_SIZE / BDRV_SECTOR_SIZE,
-                                         &n);
-        copy = (ret == 1);
-        trace_commit_one_iteration(s, sector_num, n, ret);
-        if (copy) {
-            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, n);
-                if (delay_ns > 0) {
-                    goto wait;
-                }
-            }
-            ret = commit_populate(top, base, sector_num, n, buf);
-            bytes_written += n * BDRV_SECTOR_SIZE;
-        }
-        if (ret < 0) {
-            if (s->on_error == BLOCKDEV_ON_ERROR_STOP ||
-                s->on_error == BLOCKDEV_ON_ERROR_REPORT||
-                (s->on_error == BLOCKDEV_ON_ERROR_ENOSPC && ret == -ENOSPC)) {
-                goto exit_free_buf;
-            } else {
-                n = 0;
-                continue;
-            }
-        }
-        /* Publish progress */
-        s->common.offset += n * BDRV_SECTOR_SIZE;
-    }
-
-    ret = 0;
-
-    if (!block_job_is_cancelled(&s->common) && sector_num == end) {
-        /* success */
-        ret = bdrv_drop_intermediate(active, top, base);
-    }
-
-exit_free_buf:
-    qemu_vfree(buf);
-
-exit_restore_reopen:
-    /* restore base open flags here if appropriate (e.g., change the base back
-     * to r/o). These reopens do not need to be atomic, since we won't abort
-     * even on failure here */
-    if (s->base_flags != bdrv_get_flags(base)) {
-        bdrv_reopen(base, s->base_flags, NULL);
-    }
-    overlay_bs = bdrv_find_overlay(active, top);
-    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
-        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
-    }
-
-    block_job_completed(&s->common, ret);
-}
-
-static void commit_set_speed(BlockJob *job, int64_t speed, Error **errp)
-{
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common);
-
-    if (speed < 0) {
-        error_set(errp, QERR_INVALID_PARAMETER, "speed");
-        return;
-    }
-    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
-}
-
-static BlockJobType commit_job_type = {
-    .instance_size = sizeof(CommitBlockJob),
-    .job_type      = "commit",
-    .set_speed     = commit_set_speed,
-};
-
-void commit_start(BlockDriverState *bs, BlockDriverState *base,
-                  BlockDriverState *top, int64_t speed,
-                  BlockdevOnError on_error, BlockDriverCompletionFunc *cb,
-                  void *opaque, Error **errp)
-{
-    CommitBlockJob *s;
-    BlockReopenQueue *reopen_queue = NULL;
-    int orig_overlay_flags;
-    int orig_base_flags;
-    BlockDriverState *overlay_bs;
-    Error *local_err = NULL;
-
-    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
-         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER_COMBINATION);
-        return;
-    }
-
-    /* Once we support top == active layer, remove this check */
-    if (top == bs) {
-        error_setg(errp,
-                   "Top image as the active layer is currently unsupported");
-        return;
-    }
-
-    if (top == base) {
-        error_setg(errp, "Invalid files for merge: top and base are the same");
-        return;
-    }
-
-    overlay_bs = bdrv_find_overlay(bs, top);
-
-    if (overlay_bs == NULL) {
-        error_setg(errp, "Could not find overlay image for %s:", top->filename);
-        return;
-    }
-
-    orig_base_flags    = bdrv_get_flags(base);
-    orig_overlay_flags = bdrv_get_flags(overlay_bs);
-
-    /* convert base & overlay_bs to r/w, if necessary */
-    if (!(orig_base_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, base,
-                                         orig_base_flags | BDRV_O_RDWR);
-    }
-    if (!(orig_overlay_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs,
-                                         orig_overlay_flags | BDRV_O_RDWR);
-    }
-    if (reopen_queue) {
-        bdrv_reopen_multiple(reopen_queue, &local_err);
-        if (local_err != NULL) {
-            error_propagate(errp, local_err);
-            return;
-        }
-    }
-
-
-    s = block_job_create(&commit_job_type, bs, speed, cb, opaque, errp);
-    if (!s) {
-        return;
-    }
-
-    s->base   = base;
-    s->top    = top;
-    s->active = bs;
-
-    s->base_flags          = orig_base_flags;
-    s->orig_overlay_flags  = orig_overlay_flags;
-
-    s->on_error = on_error;
-    s->common.co = qemu_coroutine_create(commit_run);
-
-    trace_commit_start(bs, base, top, s, s->common.co, opaque);
-    qemu_coroutine_enter(s->common.co, s);
-}
--- a/block/cow.c
+++ b/block/cow.c
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/
 /* COW block driver using file system holes */
@@ -58,7 +58,7 @@ static int cow_probe(const uint8_t *buf, int buf_size, const char *filename)
        return 0;
 }

-static int cow_open(BlockDriverState *bs, QDict *options, int flags)
+static int cow_open(BlockDriverState *bs, int flags)
 {
    BDRVCowState *s = bs->opaque;
    struct cow_header_v2 cow_header;
@@ -73,7 +73,7 @@ static int cow_open(BlockDriverState *bs, QDict *options, int flags)
    }

    if (be32_to_cpu(cow_header.magic) != COW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }

@@ -279,7 +279,7 @@ static int cow_create(const char *filename, QEMUOptionParameter *options)
        return ret;
    }

-    ret = bdrv_file_open(&cow_bs, filename, NULL, BDRV_O_RDWR);
+    ret = bdrv_file_open(&cow_bs, filename, BDRV_O_RDWR);
    if (ret < 0) {
        return ret;
    }
--- a/block/curl.c
+++ b/block/curl.c
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include <curl/curl.h>

 // #define DEBUG
@@ -34,10 +34,6 @@
 #define DPRINTF(fmt, ...) do { } while (0)
 #endif

-#define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
-                   CURLPROTO_FTP | CURLPROTO_FTPS | \
-                   CURLPROTO_TFTP)
-
 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
 #define SECTOR_SIZE     512
@@ -144,8 +140,8 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
            continue;

        if ((s->buf_off >= acb->end)) {
-            qemu_iovec_from_buf(acb->qiov, 0, s->orig_buf + acb->start,
-                                acb->end - acb->start);
+            qemu_iovec_from_buffer(acb->qiov, s->orig_buf + acb->start,
+                                   acb->end - acb->start);
            acb->common.cb(acb->common.opaque, 0);
            qemu_aio_release(acb);
            s->acb[i] = NULL;
@@ -180,7 +176,7 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
        {
            char *buf = state->orig_buf + (start - state->buf_start);

-            qemu_iovec_from_buf(acb->qiov, 0, buf, len);
+            qemu_iovec_from_buffer(acb->qiov, buf, len);
            acb->common.cb(acb->common.opaque, 0);

            return FIND_RET_OK;
@@ -306,17 +302,6 @@ static CURLState *curl_init_state(BDRVCURLState *s)
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);

-    /* Restrict supported protocols to avoid security issues in the more
-     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
-     * CVE-2013-0249.
-     *
-     * Restricting protocols is only supported from 7.19.4 upwards.
-     */
-#if LIBCURL_VERSION_NUM >= 0x071304
-    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
-#endif
-
 #ifdef DEBUG_VERBOSE
    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
@@ -335,9 +320,11 @@ static void curl_clean_state(CURLState *s)
    s->in_use = 0;
 }

-static void curl_parse_filename(const char *filename, QDict *options,
-                                Error **errp)
+static int curl_open(BlockDriverState *bs, const char *filename, int flags)
 {
+    BDRVCURLState *s = bs->opaque;
+    CURLState *state = NULL;
+    double d;

    #define RA_OPTSTR ":readahead="
    char *file;
@@ -345,17 +332,19 @@ static void curl_parse_filename(const char *filename, QDict *options,
    const char *ra_val;
    int parse_state = 0;

+    static int inited = 0;
+
    file = g_strdup(filename);
+    s->readahead_size = READ_AHEAD_SIZE;

    /* Parse a trailing ":readahead=#:" param, if present. */
    ra = file + strlen(file) - 1;
    while (ra >= file) {
        if (parse_state == 0) {
-            if (*ra == ':') {
+            if (*ra == ':')
                parse_state++;
-            } else {
+            else
                break;
-            }
        } else if (parse_state == 1) {
            if (*ra > '9' || *ra < '0') {
                char *opt_start = ra - strlen(RA_OPTSTR) + 1;
@@ -364,77 +353,29 @@ static void curl_parse_filename(const char *filename, QDict *options,
                    ra_val = ra + 1;
                    ra -= strlen(RA_OPTSTR) - 1;
                    *ra = '\0';
-                    qdict_put(options, "readahead", qstring_from_str(ra_val));
+                    s->readahead_size = atoi(ra_val);
+                    break;
+                } else {
+                    break;
                }
-                break;
            }
        }
        ra--;
    }

-    qdict_put(options, "url", qstring_from_str(file));
-
-    g_free(file);
-}
-
-static QemuOptsList runtime_opts = {
-    .name = "curl",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "url",
-            .type = QEMU_OPT_STRING,
-            .help = "URL to open",
-        },
-        {
-            .name = "readahead",
-            .type = QEMU_OPT_SIZE,
-            .help = "Readahead size",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int curl_open(BlockDriverState *bs, QDict *options, int flags)
-{
-    BDRVCURLState *s = bs->opaque;
-    CURLState *state = NULL;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *file;
-    double d;
-
-    static int inited = 0;
-
-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        goto out_noclean;
-    }
-
-    s->readahead_size = qemu_opt_get_size(opts, "readahead", READ_AHEAD_SIZE);
    if ((s->readahead_size & 0x1ff) != 0) {
        fprintf(stderr, "HTTP_READAHEAD_SIZE %zd is not a multiple of 512\n",
                s->readahead_size);
        goto out_noclean;
    }

-    file = qemu_opt_get(opts, "url");
-    if (file == NULL) {
-        qerror_report(ERROR_CLASS_GENERIC_ERROR, "curl block driver requires "
-                      "an 'url' option");
-        goto out_noclean;
-    }
-
    if (!inited) {
        curl_global_init(CURL_GLOBAL_ALL);
        inited = 1;
    }

    DPRINTF("CURL: Opening %s\n", file);
-    s->url = g_strdup(file);
+    s->url = file;
    state = curl_init_state(s);
    if (!state)
        goto out_noclean;
@@ -466,7 +407,6 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags)
    curl_multi_setopt( s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb ); 
    curl_multi_do(s);

-    qemu_opts_del(opts);
    return 0;

 out:
@@ -474,8 +414,7 @@ out:
    curl_easy_cleanup(state->curl);
    state->curl = NULL;
 out_noclean:
-    g_free(s->url);
-    qemu_opts_del(opts);
+    g_free(file);
    return -EINVAL;
 }

@@ -499,7 +438,7 @@ static void curl_aio_cancel(BlockDriverAIOCB *blockacb)
    // Do we have to implement canceling? Seems to work without...
 }

-static const AIOCBInfo curl_aiocb_info = {
+static AIOPool curl_aio_pool = {
    .aiocb_size         = sizeof(CURLAIOCB),
    .cancel             = curl_aio_cancel,
 };
@@ -566,7 +505,7 @@ static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
 {
    CURLAIOCB *acb;

-    acb = qemu_aio_get(&curl_aiocb_info, bs, cb, opaque);
+    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);

    acb->qiov = qiov;
    acb->sector_num = sector_num;
@@ -603,7 +542,8 @@ static void curl_close(BlockDriverState *bs)
    }
    if (s->multi)
        curl_multi_cleanup(s->multi);
-    g_free(s->url);
+    if (s->url)
+        free(s->url);
 }

 static int64_t curl_getlength(BlockDriverState *bs)
@@ -613,68 +553,63 @@ static int64_t curl_getlength(BlockDriverState *bs)
 }

 static BlockDriver bdrv_http = {
-    .format_name            = "http",
-    .protocol_name          = "http",
+    .format_name     = "http",
+    .protocol_name   = "http",

-    .instance_size          = sizeof(BDRVCURLState),
-    .bdrv_parse_filename    = curl_parse_filename,
-    .bdrv_file_open         = curl_open,
-    .bdrv_close             = curl_close,
-    .bdrv_getlength         = curl_getlength,
+    .instance_size   = sizeof(BDRVCURLState),
+    .bdrv_file_open  = curl_open,
+    .bdrv_close      = curl_close,
+    .bdrv_getlength  = curl_getlength,

-    .bdrv_aio_readv         = curl_aio_readv,
+    .bdrv_aio_readv  = curl_aio_readv,
 };

 static BlockDriver bdrv_https = {
-    .format_name            = "https",
-    .protocol_name          = "https",
+    .format_name     = "https",
+    .protocol_name   = "https",

-    .instance_size          = sizeof(BDRVCURLState),
-    .bdrv_parse_filename    = curl_parse_filename,
-    .bdrv_file_open         = curl_open,
-    .bdrv_close             = curl_close,
-    .bdrv_getlength         = curl_getlength,
+    .instance_size   = sizeof(BDRVCURLState),
+    .bdrv_file_open  = curl_open,
+    .bdrv_close      = curl_close,
+    .bdrv_getlength  = curl_getlength,

-    .bdrv_aio_readv         = curl_aio_readv,
+    .bdrv_aio_readv  = curl_aio_readv,
 };

 static BlockDriver bdrv_ftp = {
-    .format_name            = "ftp",
-    .protocol_name          = "ftp",
+    .format_name     = "ftp",
+    .protocol_name   = "ftp",

-    .instance_size          = sizeof(BDRVCURLState),
-    .bdrv_parse_filename    = curl_parse_filename,
-    .bdrv_file_open         = curl_open,
-    .bdrv_close             = curl_close,
-    .bdrv_getlength         = curl_getlength,
+    .instance_size   = sizeof(BDRVCURLState),
+    .bdrv_file_open  = curl_open,
+    .bdrv_close      = curl_close,
+    .bdrv_getlength  = curl_getlength,

-    .bdrv_aio_readv         = curl_aio_readv,
+    .bdrv_aio_readv  = curl_aio_readv,
 };

 static BlockDriver bdrv_ftps = {
-    .format_name            = "ftps",
-    .protocol_name          = "ftps",
+    .format_name     = "ftps",
+    .protocol_name   = "ftps",

-    .instance_size          = sizeof(BDRVCURLState),
-    .bdrv_parse_filename    = curl_parse_filename,
-    .bdrv_file_open         = curl_open,
-    .bdrv_close             = curl_close,
-    .bdrv_getlength         = curl_getlength,
+    .instance_size   = sizeof(BDRVCURLState),
+    .bdrv_file_open  = curl_open,
+    .bdrv_close      = curl_close,
+    .bdrv_getlength  = curl_getlength,

-    .bdrv_aio_readv         = curl_aio_readv,
+    .bdrv_aio_readv  = curl_aio_readv,
 };

 static BlockDriver bdrv_tftp = {
-    .format_name            = "tftp",
-    .protocol_name          = "tftp",
+    .format_name     = "tftp",
+    .protocol_name   = "tftp",

-    .instance_size          = sizeof(BDRVCURLState),
-    .bdrv_parse_filename    = curl_parse_filename,
-    .bdrv_file_open         = curl_open,
-    .bdrv_close             = curl_close,
-    .bdrv_getlength         = curl_getlength,
+    .instance_size   = sizeof(BDRVCURLState),
+    .bdrv_file_open  = curl_open,
+    .bdrv_close      = curl_close,
+    .bdrv_getlength  = curl_getlength,

-    .bdrv_aio_readv         = curl_aio_readv,
+    .bdrv_aio_readv  = curl_aio_readv,
 };

 static void curl_block_init(void)
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -22,9 +22,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/bswap.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "bswap.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVDMGState {
@@ -51,55 +51,35 @@ typedef struct BDRVDMGState {

 static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
-    int len;
-
-    if (!filename) {
-        return 0;
-    }
-
-    len = strlen(filename);
-    if (len > 4 && !strcmp(filename + len - 4, ".dmg")) {
-        return 2;
-    }
+    int len=strlen(filename);
+    if(len>4 && !strcmp(filename+len-4,".dmg"))
+	return 2;
    return 0;
 }

-static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
+static off_t read_off(BlockDriverState *bs, int64_t offset)
 {
-    uint64_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 8);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be64_to_cpu(buffer);
-    return 0;
+	uint64_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 8) < 8)
+		return 0;
+	return be64_to_cpu(buffer);
 }

-static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
+static off_t read_uint32(BlockDriverState *bs, int64_t offset)
 {
-    uint32_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 4);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be32_to_cpu(buffer);
-    return 0;
+	uint32_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 4) < 4)
+		return 0;
+	return be32_to_cpu(buffer);
 }

-static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
+static int dmg_open(BlockDriverState *bs, int flags)
 {
    BDRVDMGState *s = bs->opaque;
-    uint64_t info_begin,info_end,last_in_offset,last_out_offset;
-    uint32_t count, tmp;
+    off_t info_begin,info_end,last_in_offset,last_out_offset;
+    uint32_t count;
    uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;
    int64_t offset;
-    int ret;

    bs->read_only = 1;
    s->n_chunks = 0;
@@ -108,32 +88,21 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
    /* read offset of info blocks */
    offset = bdrv_getlength(bs->file);
    if (offset < 0) {
-        ret = offset;
        goto fail;
    }
    offset -= 0x1d8;

-    ret = read_uint64(bs, offset, &info_begin);
-    if (ret < 0) {
-        goto fail;
-    } else if (info_begin == 0) {
-        ret = -EINVAL;
+    info_begin = read_off(bs, offset);
+    if (info_begin == 0) {
+	goto fail;
+    }
+
+    if (read_uint32(bs, info_begin) != 0x100) {
        goto fail;
    }

-    ret = read_uint32(bs, info_begin, &tmp);
-    if (ret < 0) {
-        goto fail;
-    } else if (tmp != 0x100) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = read_uint32(bs, info_begin + 4, &count);
-    if (ret < 0) {
-        goto fail;
-    } else if (count == 0) {
-        ret = -EINVAL;
+    count = read_uint32(bs, info_begin + 4);
+    if (count == 0) {
        goto fail;
    }
    info_end = info_begin + count;
@@ -145,20 +114,12 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
    while (offset < info_end) {
        uint32_t type;

-        ret = read_uint32(bs, offset, &count);
-        if (ret < 0) {
-            goto fail;
-        } else if (count == 0) {
-            ret = -EINVAL;
-            goto fail;
-        }
+	count = read_uint32(bs, offset);
+	if(count==0)
+	    goto fail;
        offset += 4;

-        ret = read_uint32(bs, offset, &type);
-        if (ret < 0) {
-            goto fail;
-        }
-
+	type = read_uint32(bs, offset);
 	if (type == 0x6d697368 && count >= 244) {
 	    int new_size, chunk_count;

@@ -173,11 +134,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
 	    s->sectors = g_realloc(s->sectors, new_size);
 	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);

-            for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
-                ret = read_uint32(bs, offset, &s->types[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
+	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
+		s->types[i] = read_uint32(bs, offset);
 		offset += 4;
 		if(s->types[i]!=0x80000005 && s->types[i]!=1 && s->types[i]!=2) {
 		    if(s->types[i]==0xffffffff) {
@@ -191,31 +149,17 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
 		}
 		offset += 4;

-                ret = read_uint64(bs, offset, &s->sectors[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->sectors[i] += last_out_offset;
-                offset += 8;
+		s->sectors[i] = last_out_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->sectorcounts[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->sectorcounts[i] = read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->offsets[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->offsets[i] += last_in_offset;
-                offset += 8;
+		s->offsets[i] = last_in_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->lengths[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->lengths[i] = read_off(bs, offset);
+		offset += 8;

 		if(s->lengths[i]>max_compressed_size)
 		    max_compressed_size = s->lengths[i];
@@ -229,25 +173,15 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags)
    /* initialize zlib engine */
    s->compressed_chunk = g_malloc(max_compressed_size+1);
    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
-    if(inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
-    }
+    if(inflateInit(&s->zstream) != Z_OK)
+	goto fail;

    s->current_chunk = s->n_chunks;

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-    return ret;
+    return -1;
 }

 static inline int is_sector_in_chunk(BDRVDMGState* s,
@@ -362,15 +296,15 @@ static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
 static void dmg_close(BlockDriverState *bs)
 {
    BDRVDMGState *s = bs->opaque;
-
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-
+    if(s->n_chunks>0) {
+	free(s->types);
+	free(s->offsets);
+	free(s->lengths);
+	free(s->sectors);
+	free(s->sectorcounts);
+    }
+    free(s->compressed_chunk);
+    free(s->uncompressed_chunk);
    inflateEnd(&s->zstream);
 }

--- a/block/gluster.c
+++ b/block/gluster.c
@@ -1,654 +0,0 @@
-/*
- * GlusterFS backend for QEMU
- *
- * Copyright (C) 2012 Bharata B Rao <bharata@linux.vnet.ibm.com>
- *
- * Pipe handling mechanism in AIO implementation is derived from
- * block/rbd.c. Hence,
- *
- * Copyright (C) 2010-2011 Christian Brunner <chb@muc.de>,
- *                         Josh Durgin <josh.durgin@dreamhost.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-#include <glusterfs/api/glfs.h>
-#include "block/block_int.h"
-#include "qemu/sockets.h"
-#include "qemu/uri.h"
-
-typedef struct GlusterAIOCB {
-    BlockDriverAIOCB common;
-    int64_t size;
-    int ret;
-    bool *finished;
-    QEMUBH *bh;
-} GlusterAIOCB;
-
-typedef struct BDRVGlusterState {
-    struct glfs *glfs;
-    int fds[2];
-    struct glfs_fd *fd;
-    int qemu_aio_count;
-    int event_reader_pos;
-    GlusterAIOCB *event_acb;
-} BDRVGlusterState;
-
-#define GLUSTER_FD_READ  0
-#define GLUSTER_FD_WRITE 1
-
-typedef struct GlusterConf {
-    char *server;
-    int port;
-    char *volname;
-    char *image;
-    char *transport;
-} GlusterConf;
-
-static void qemu_gluster_gconf_free(GlusterConf *gconf)
-{
-    g_free(gconf->server);
-    g_free(gconf->volname);
-    g_free(gconf->image);
-    g_free(gconf->transport);
-    g_free(gconf);
-}
-
-static int parse_volume_options(GlusterConf *gconf, char *path)
-{
-    char *p, *q;
-
-    if (!path) {
-        return -EINVAL;
-    }
-
-    /* volume */
-    p = q = path + strspn(path, "/");
-    p += strcspn(p, "/");
-    if (*p == '\0') {
-        return -EINVAL;
-    }
-    gconf->volname = g_strndup(q, p - q);
-
-    /* image */
-    p += strspn(p, "/");
-    if (*p == '\0') {
-        return -EINVAL;
-    }
-    gconf->image = g_strdup(p);
-    return 0;
-}
-
-/*
- * file=gluster[+transport]://[server[:port]]/volname/image[?socket=...]
- *
- * 'gluster' is the protocol.
- *
- * 'transport' specifies the transport type used to connect to gluster
- * management daemon (glusterd). Valid transport types are
- * tcp, unix and rdma. If a transport type isn't specified, then tcp
- * type is assumed.
- *
- * 'server' specifies the server where the volume file specification for
- * the given volume resides. This can be either hostname, ipv4 address
- * or ipv6 address. ipv6 address needs to be within square brackets [ ].
- * If transport type is 'unix', then 'server' field should not be specifed.
- * The 'socket' field needs to be populated with the path to unix domain
- * socket.
- *
- * 'port' is the port number on which glusterd is listening. This is optional
- * and if not specified, QEMU will send 0 which will make gluster to use the
- * default port. If the transport type is unix, then 'port' should not be
- * specified.
- *
- * 'volname' is the name of the gluster volume which contains the VM image.
- *
- * 'image' is the path to the actual VM image that resides on gluster volume.
- *
- * Examples:
- *
- * file=gluster://1.2.3.4/testvol/a.img
- * file=gluster+tcp://1.2.3.4/testvol/a.img
- * file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
- * file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
- * file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
- * file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
- * file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
- * file=gluster+rdma://1.2.3.4:24007/testvol/a.img
- */
-static int qemu_gluster_parseuri(GlusterConf *gconf, const char *filename)
-{
-    URI *uri;
-    QueryParams *qp = NULL;
-    bool is_unix = false;
-    int ret = 0;
-
-    uri = uri_parse(filename);
-    if (!uri) {
-        return -EINVAL;
-    }
-
-    /* transport */
-    if (!strcmp(uri->scheme, "gluster")) {
-        gconf->transport = g_strdup("tcp");
-    } else if (!strcmp(uri->scheme, "gluster+tcp")) {
-        gconf->transport = g_strdup("tcp");
-    } else if (!strcmp(uri->scheme, "gluster+unix")) {
-        gconf->transport = g_strdup("unix");
-        is_unix = true;
-    } else if (!strcmp(uri->scheme, "gluster+rdma")) {
-        gconf->transport = g_strdup("rdma");
-    } else {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    ret = parse_volume_options(gconf, uri->path);
-    if (ret < 0) {
-        goto out;
-    }
-
-    qp = query_params_parse(uri->query);
-    if (qp->n > 1 || (is_unix && !qp->n) || (!is_unix && qp->n)) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    if (is_unix) {
-        if (uri->server || uri->port) {
-            ret = -EINVAL;
-            goto out;
-        }
-        if (strcmp(qp->p[0].name, "socket")) {
-            ret = -EINVAL;
-            goto out;
-        }
-        gconf->server = g_strdup(qp->p[0].value);
-    } else {
-        gconf->server = g_strdup(uri->server);
-        gconf->port = uri->port;
-    }
-
-out:
-    if (qp) {
-        query_params_free(qp);
-    }
-    uri_free(uri);
-    return ret;
-}
-
-static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename)
-{
-    struct glfs *glfs = NULL;
-    int ret;
-    int old_errno;
-
-    ret = qemu_gluster_parseuri(gconf, filename);
-    if (ret < 0) {
-        error_report("Usage: file=gluster[+transport]://[server[:port]]/"
-            "volname/image[?socket=...]");
-        errno = -ret;
-        goto out;
-    }
-
-    glfs = glfs_new(gconf->volname);
-    if (!glfs) {
-        goto out;
-    }
-
-    ret = glfs_set_volfile_server(glfs, gconf->transport, gconf->server,
-            gconf->port);
-    if (ret < 0) {
-        goto out;
-    }
-
-    /*
-     * TODO: Use GF_LOG_ERROR instead of hard code value of 4 here when
-     * GlusterFS makes GF_LOG_* macros available to libgfapi users.
-     */
-    ret = glfs_set_logging(glfs, "-", 4);
-    if (ret < 0) {
-        goto out;
-    }
-
-    ret = glfs_init(glfs);
-    if (ret) {
-        error_report("Gluster connection failed for server=%s port=%d "
-             "volume=%s image=%s transport=%s", gconf->server, gconf->port,
-             gconf->volname, gconf->image, gconf->transport);
-        goto out;
-    }
-    return glfs;
-
-out:
-    if (glfs) {
-        old_errno = errno;
-        glfs_fini(glfs);
-        errno = old_errno;
-    }
-    return NULL;
-}
-
-static void qemu_gluster_complete_aio(GlusterAIOCB *acb, BDRVGlusterState *s)
-{
-    int ret;
-    bool *finished = acb->finished;
-    BlockDriverCompletionFunc *cb = acb->common.cb;
-    void *opaque = acb->common.opaque;
-
-    if (!acb->ret || acb->ret == acb->size) {
-        ret = 0; /* Success */
-    } else if (acb->ret < 0) {
-        ret = acb->ret; /* Read/Write failed */
-    } else {
-        ret = -EIO; /* Partial read/write - fail it */
-    }
-
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    cb(opaque, ret);
-    if (finished) {
-        *finished = true;
-    }
-}
-
-static void qemu_gluster_aio_event_reader(void *opaque)
-{
-    BDRVGlusterState *s = opaque;
-    ssize_t ret;
-
-    do {
-        char *p = (char *)&s->event_acb;
-
-        ret = read(s->fds[GLUSTER_FD_READ], p + s->event_reader_pos,
-                   sizeof(s->event_acb) - s->event_reader_pos);
-        if (ret > 0) {
-            s->event_reader_pos += ret;
-            if (s->event_reader_pos == sizeof(s->event_acb)) {
-                s->event_reader_pos = 0;
-                qemu_gluster_complete_aio(s->event_acb, s);
-            }
-        }
-    } while (ret < 0 && errno == EINTR);
-}
-
-static int qemu_gluster_aio_flush_cb(void *opaque)
-{
-    BDRVGlusterState *s = opaque;
-
-    return (s->qemu_aio_count > 0);
-}
-
-/* TODO Convert to fine grained options */
-static QemuOptsList runtime_opts = {
-    .name = "gluster",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "filename",
-            .type = QEMU_OPT_STRING,
-            .help = "URL to the gluster image",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int qemu_gluster_open(BlockDriverState *bs,  QDict *options,
-                             int bdrv_flags)
-{
-    BDRVGlusterState *s = bs->opaque;
-    int open_flags = O_BINARY;
-    int ret = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *filename;
-
-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto out;
-    }
-
-    filename = qemu_opt_get(opts, "filename");
-
-
-    s->glfs = qemu_gluster_init(gconf, filename);
-    if (!s->glfs) {
-        ret = -errno;
-        goto out;
-    }
-
-    if (bdrv_flags & BDRV_O_RDWR) {
-        open_flags |= O_RDWR;
-    } else {
-        open_flags |= O_RDONLY;
-    }
-
-    if ((bdrv_flags & BDRV_O_NOCACHE)) {
-        open_flags |= O_DIRECT;
-    }
-
-    s->fd = glfs_open(s->glfs, gconf->image, open_flags);
-    if (!s->fd) {
-        ret = -errno;
-        goto out;
-    }
-
-    ret = qemu_pipe(s->fds);
-    if (ret < 0) {
-        ret = -errno;
-        goto out;
-    }
-    fcntl(s->fds[GLUSTER_FD_READ], F_SETFL, O_NONBLOCK);
-    qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ],
-        qemu_gluster_aio_event_reader, NULL, qemu_gluster_aio_flush_cb, s);
-
-out:
-    qemu_opts_del(opts);
-    qemu_gluster_gconf_free(gconf);
-    if (!ret) {
-        return ret;
-    }
-    if (s->fd) {
-        glfs_close(s->fd);
-    }
-    if (s->glfs) {
-        glfs_fini(s->glfs);
-    }
-    return ret;
-}
-
-static int qemu_gluster_create(const char *filename,
-        QEMUOptionParameter *options)
-{
-    struct glfs *glfs;
-    struct glfs_fd *fd;
-    int ret = 0;
-    int64_t total_size = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
-
-    glfs = qemu_gluster_init(gconf, filename);
-    if (!glfs) {
-        ret = -errno;
-        goto out;
-    }
-
-    while (options && options->name) {
-        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
-            total_size = options->value.n / BDRV_SECTOR_SIZE;
-        }
-        options++;
-    }
-
-    fd = glfs_creat(glfs, gconf->image,
-        O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
-    if (!fd) {
-        ret = -errno;
-    } else {
-        if (glfs_ftruncate(fd, total_size * BDRV_SECTOR_SIZE) != 0) {
-            ret = -errno;
-        }
-        if (glfs_close(fd) != 0) {
-            ret = -errno;
-        }
-    }
-out:
-    qemu_gluster_gconf_free(gconf);
-    if (glfs) {
-        glfs_fini(glfs);
-    }
-    return ret;
-}
-
-static void qemu_gluster_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-    GlusterAIOCB *acb = (GlusterAIOCB *)blockacb;
-    bool finished = false;
-
-    acb->finished = &finished;
-    while (!finished) {
-        qemu_aio_wait();
-    }
-}
-
-static const AIOCBInfo gluster_aiocb_info = {
-    .aiocb_size = sizeof(GlusterAIOCB),
-    .cancel = qemu_gluster_aio_cancel,
-};
-
-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
-{
-    GlusterAIOCB *acb = (GlusterAIOCB *)arg;
-    BlockDriverState *bs = acb->common.bs;
-    BDRVGlusterState *s = bs->opaque;
-    int retval;
-
-    acb->ret = ret;
-    retval = qemu_write_full(s->fds[GLUSTER_FD_WRITE], &acb, sizeof(acb));
-    if (retval != sizeof(acb)) {
-        /*
-         * Gluster AIO callback thread failed to notify the waiting
-         * QEMU thread about IO completion.
-         *
-         * Complete this IO request and make the disk inaccessible for
-         * subsequent reads and writes.
-         */
-        error_report("Gluster failed to notify QEMU about IO completion");
-
-        qemu_mutex_lock_iothread(); /* We are in gluster thread context */
-        acb->common.cb(acb->common.opaque, -EIO);
-        qemu_aio_release(acb);
-        s->qemu_aio_count--;
-        close(s->fds[GLUSTER_FD_READ]);
-        close(s->fds[GLUSTER_FD_WRITE]);
-        qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ], NULL, NULL, NULL,
-            NULL);
-        bs->drv = NULL; /* Make the disk inaccessible */
-        qemu_mutex_unlock_iothread();
-    }
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_rw(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int write)
-{
-    int ret;
-    GlusterAIOCB *acb;
-    BDRVGlusterState *s = bs->opaque;
-    size_t size;
-    off_t offset;
-
-    offset = sector_num * BDRV_SECTOR_SIZE;
-    size = nb_sectors * BDRV_SECTOR_SIZE;
-    s->qemu_aio_count++;
-
-    acb = qemu_aio_get(&gluster_aiocb_info, bs, cb, opaque);
-    acb->size = size;
-    acb->ret = 0;
-    acb->finished = NULL;
-
-    if (write) {
-        ret = glfs_pwritev_async(s->fd, qiov->iov, qiov->niov, offset, 0,
-            &gluster_finish_aiocb, acb);
-    } else {
-        ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
-            &gluster_finish_aiocb, acb);
-    }
-
-    if (ret < 0) {
-        goto out;
-    }
-    return &acb->common;
-
-out:
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    return NULL;
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_readv(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    return qemu_gluster_aio_rw(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_writev(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    return qemu_gluster_aio_rw(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_flush(BlockDriverState *bs,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    int ret;
-    GlusterAIOCB *acb;
-    BDRVGlusterState *s = bs->opaque;
-
-    acb = qemu_aio_get(&gluster_aiocb_info, bs, cb, opaque);
-    acb->size = 0;
-    acb->ret = 0;
-    acb->finished = NULL;
-    s->qemu_aio_count++;
-
-    ret = glfs_fsync_async(s->fd, &gluster_finish_aiocb, acb);
-    if (ret < 0) {
-        goto out;
-    }
-    return &acb->common;
-
-out:
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    return NULL;
-}
-
-static int64_t qemu_gluster_getlength(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-    int64_t ret;
-
-    ret = glfs_lseek(s->fd, 0, SEEK_END);
-    if (ret < 0) {
-        return -errno;
-    } else {
-        return ret;
-    }
-}
-
-static int64_t qemu_gluster_allocated_file_size(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-    struct stat st;
-    int ret;
-
-    ret = glfs_fstat(s->fd, &st);
-    if (ret < 0) {
-        return -errno;
-    } else {
-        return st.st_blocks * 512;
-    }
-}
-
-static void qemu_gluster_close(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-
-    close(s->fds[GLUSTER_FD_READ]);
-    close(s->fds[GLUSTER_FD_WRITE]);
-    qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ], NULL, NULL, NULL, NULL);
-
-    if (s->fd) {
-        glfs_close(s->fd);
-        s->fd = NULL;
-    }
-    glfs_fini(s->glfs);
-}
-
-static QEMUOptionParameter qemu_gluster_create_options[] = {
-    {
-        .name = BLOCK_OPT_SIZE,
-        .type = OPT_SIZE,
-        .help = "Virtual disk size"
-    },
-    { NULL }
-};
-
-static BlockDriver bdrv_gluster = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_tcp = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+tcp",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_unix = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+unix",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_rdma = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+rdma",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static void bdrv_gluster_init(void)
-{
-    bdrv_register(&bdrv_gluster_rdma);
-    bdrv_register(&bdrv_gluster_unix);
-    bdrv_register(&bdrv_gluster_tcp);
-    bdrv_register(&bdrv_gluster);
-}
-
-block_init(bdrv_gluster_init);
--- a/block/iscsi.c
+++ b/block/iscsi.c
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -1,584 +0,0 @@
-/*
- * Image mirroring
- *
- * Copyright Red Hat, Inc. 2012
- *
- * Authors:
- *  Paolo Bonzini  <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#include "trace.h"
-#include "block/blockjob.h"
-#include "block/block_int.h"
-#include "qemu/ratelimit.h"
-#include "qemu/bitmap.h"
-
-#define SLICE_TIME    100000000ULL /* ns */
-#define MAX_IN_FLIGHT 16
-
-/* The mirroring buffer is a list of granularity-sized chunks.
- * Free chunks are organized in a list.
- */
-typedef struct MirrorBuffer {
-    QSIMPLEQ_ENTRY(MirrorBuffer) next;
-} MirrorBuffer;
-
-typedef struct MirrorBlockJob {
-    BlockJob common;
-    RateLimit limit;
-    BlockDriverState *target;
-    MirrorSyncMode mode;
-    BlockdevOnError on_source_error, on_target_error;
-    bool synced;
-    bool should_complete;
-    int64_t sector_num;
-    int64_t granularity;
-    size_t buf_size;
-    unsigned long *cow_bitmap;
-    HBitmapIter hbi;
-    uint8_t *buf;
-    QSIMPLEQ_HEAD(, MirrorBuffer) buf_free;
-    int buf_free_count;
-
-    unsigned long *in_flight_bitmap;
-    int in_flight;
-    int ret;
-} MirrorBlockJob;
-
-typedef struct MirrorOp {
-    MirrorBlockJob *s;
-    QEMUIOVector qiov;
-    int64_t sector_num;
-    int nb_sectors;
-} MirrorOp;
-
-static BlockErrorAction mirror_error_action(MirrorBlockJob *s, bool read,
-                                            int error)
-{
-    s->synced = false;
-    if (read) {
-        return block_job_error_action(&s->common, s->common.bs,
-                                      s->on_source_error, true, error);
-    } else {
-        return block_job_error_action(&s->common, s->target,
-                                      s->on_target_error, false, error);
-    }
-}
-
-static void mirror_iteration_done(MirrorOp *op, int ret)
-{
-    MirrorBlockJob *s = op->s;
-    struct iovec *iov;
-    int64_t chunk_num;
-    int i, nb_chunks, sectors_per_chunk;
-
-    trace_mirror_iteration_done(s, op->sector_num, op->nb_sectors, ret);
-
-    s->in_flight--;
-    iov = op->qiov.iov;
-    for (i = 0; i < op->qiov.niov; i++) {
-        MirrorBuffer *buf = (MirrorBuffer *) iov[i].iov_base;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, buf, next);
-        s->buf_free_count++;
-    }
-
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    chunk_num = op->sector_num / sectors_per_chunk;
-    nb_chunks = op->nb_sectors / sectors_per_chunk;
-    bitmap_clear(s->in_flight_bitmap, chunk_num, nb_chunks);
-    if (s->cow_bitmap && ret >= 0) {
-        bitmap_set(s->cow_bitmap, chunk_num, nb_chunks);
-    }
-
-    g_slice_free(MirrorOp, op);
-    qemu_coroutine_enter(s->common.co, NULL);
-}
-
-static void mirror_write_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, false, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-    }
-    mirror_iteration_done(op, ret);
-}
-
-static void mirror_read_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, true, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-
-        mirror_iteration_done(op, ret);
-        return;
-    }
-    bdrv_aio_writev(s->target, op->sector_num, &op->qiov, op->nb_sectors,
-                    mirror_write_complete, op);
-}
-
-static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
-{
-    BlockDriverState *source = s->common.bs;
-    int nb_sectors, sectors_per_chunk, nb_chunks;
-    int64_t end, sector_num, next_chunk, next_sector, hbitmap_next_sector;
-    MirrorOp *op;
-
-    s->sector_num = hbitmap_iter_next(&s->hbi);
-    if (s->sector_num < 0) {
-        bdrv_dirty_iter_init(source, &s->hbi);
-        s->sector_num = hbitmap_iter_next(&s->hbi);
-        trace_mirror_restart_iter(s, bdrv_get_dirty_count(source));
-        assert(s->sector_num >= 0);
-    }
-
-    hbitmap_next_sector = s->sector_num;
-    sector_num = s->sector_num;
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    end = s->common.len >> BDRV_SECTOR_BITS;
-
-    /* Extend the QEMUIOVector to include all adjacent blocks that will
-     * be copied in this operation.
-     *
-     * We have to do this if we have no backing file yet in the destination,
-     * and the cluster size is very large.  Then we need to do COW ourselves.
-     * The first time a cluster is copied, copy it entirely.  Note that,
-     * because both the granularity and the cluster size are powers of two,
-     * the number of sectors to copy cannot exceed one cluster.
-     *
-     * We also want to extend the QEMUIOVector to include more adjacent
-     * dirty blocks if possible, to limit the number of I/O operations and
-     * run efficiently even with a small granularity.
-     */
-    nb_chunks = 0;
-    nb_sectors = 0;
-    next_sector = sector_num;
-    next_chunk = sector_num / sectors_per_chunk;
-
-    /* Wait for I/O to this cluster (from a previous iteration) to be done.  */
-    while (test_bit(next_chunk, s->in_flight_bitmap)) {
-        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
-        qemu_coroutine_yield();
-    }
-
-    do {
-        int added_sectors, added_chunks;
-
-        if (!bdrv_get_dirty(source, next_sector) ||
-            test_bit(next_chunk, s->in_flight_bitmap)) {
-            assert(nb_sectors > 0);
-            break;
-        }
-
-        added_sectors = sectors_per_chunk;
-        if (s->cow_bitmap && !test_bit(next_chunk, s->cow_bitmap)) {
-            bdrv_round_to_clusters(s->target,
-                                   next_sector, added_sectors,
-                                   &next_sector, &added_sectors);
-
-            /* On the first iteration, the rounding may make us copy
-             * sectors before the first dirty one.
-             */
-            if (next_sector < sector_num) {
-                assert(nb_sectors == 0);
-                sector_num = next_sector;
-                next_chunk = next_sector / sectors_per_chunk;
-            }
-        }
-
-        added_sectors = MIN(added_sectors, end - (sector_num + nb_sectors));
-        added_chunks = (added_sectors + sectors_per_chunk - 1) / sectors_per_chunk;
-
-        /* When doing COW, it may happen that there is not enough space for
-         * a full cluster.  Wait if that is the case.
-         */
-        while (nb_chunks == 0 && s->buf_free_count < added_chunks) {
-            trace_mirror_yield_buf_busy(s, nb_chunks, s->in_flight);
-            qemu_coroutine_yield();
-        }
-        if (s->buf_free_count < nb_chunks + added_chunks) {
-            trace_mirror_break_buf_busy(s, nb_chunks, s->in_flight);
-            break;
-        }
-
-        /* We have enough free space to copy these sectors.  */
-        bitmap_set(s->in_flight_bitmap, next_chunk, added_chunks);
-
-        nb_sectors += added_sectors;
-        nb_chunks += added_chunks;
-        next_sector += added_sectors;
-        next_chunk += added_chunks;
-    } while (next_sector < end);
-
-    /* Allocate a MirrorOp that is used as an AIO callback.  */
-    op = g_slice_new(MirrorOp);
-    op->s = s;
-    op->sector_num = sector_num;
-    op->nb_sectors = nb_sectors;
-
-    /* Now make a QEMUIOVector taking enough granularity-sized chunks
-     * from s->buf_free.
-     */
-    qemu_iovec_init(&op->qiov, nb_chunks);
-    next_sector = sector_num;
-    while (nb_chunks-- > 0) {
-        MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
-        QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
-        s->buf_free_count--;
-        qemu_iovec_add(&op->qiov, buf, s->granularity);
-
-        /* Advance the HBitmapIter in parallel, so that we do not examine
-         * the same sector twice.
-         */
-        if (next_sector > hbitmap_next_sector && bdrv_get_dirty(source, next_sector)) {
-            hbitmap_next_sector = hbitmap_iter_next(&s->hbi);
-        }
-
-        next_sector += sectors_per_chunk;
-    }
-
-    bdrv_reset_dirty(source, sector_num, nb_sectors);
-
-    /* Copy the dirty cluster.  */
-    s->in_flight++;
-    trace_mirror_one_iteration(s, sector_num, nb_sectors);
-    bdrv_aio_readv(source, sector_num, &op->qiov, nb_sectors,
-                   mirror_read_complete, op);
-}
-
-static void mirror_free_init(MirrorBlockJob *s)
-{
-    int granularity = s->granularity;
-    size_t buf_size = s->buf_size;
-    uint8_t *buf = s->buf;
-
-    assert(s->buf_free_count == 0);
-    QSIMPLEQ_INIT(&s->buf_free);
-    while (buf_size != 0) {
-        MirrorBuffer *cur = (MirrorBuffer *)buf;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, cur, next);
-        s->buf_free_count++;
-        buf_size -= granularity;
-        buf += granularity;
-    }
-}
-
-static void mirror_drain(MirrorBlockJob *s)
-{
-    while (s->in_flight > 0) {
-        qemu_coroutine_yield();
-    }
-}
-
-static void coroutine_fn mirror_run(void *opaque)
-{
-    MirrorBlockJob *s = opaque;
-    BlockDriverState *bs = s->common.bs;
-    int64_t sector_num, end, sectors_per_chunk, length;
-    uint64_t last_pause_ns;
-    BlockDriverInfo bdi;
-    char backing_filename[1024];
-    int ret = 0;
-    int n;
-
-    if (block_job_is_cancelled(&s->common)) {
-        goto immediate_exit;
-    }
-
-    s->common.len = bdrv_getlength(bs);
-    if (s->common.len <= 0) {
-        block_job_completed(&s->common, s->common.len);
-        return;
-    }
-
-    length = (bdrv_getlength(bs) + s->granularity - 1) / s->granularity;
-    s->in_flight_bitmap = bitmap_new(length);
-
-    /* If we have no backing file yet in the destination, we cannot let
-     * the destination do COW.  Instead, we copy sectors around the
-     * dirty data if needed.  We need a bitmap to do that.
-     */
-    bdrv_get_backing_filename(s->target, backing_filename,
-                              sizeof(backing_filename));
-    if (backing_filename[0] && !s->target->backing_hd) {
-        bdrv_get_info(s->target, &bdi);
-        if (s->granularity < bdi.cluster_size) {
-            s->buf_size = MAX(s->buf_size, bdi.cluster_size);
-            s->cow_bitmap = bitmap_new(length);
-        }
-    }
-
-    end = s->common.len >> BDRV_SECTOR_BITS;
-    s->buf = qemu_blockalign(bs, s->buf_size);
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    mirror_free_init(s);
-
-    if (s->mode != MIRROR_SYNC_MODE_NONE) {
-        /* First part, loop on the sectors and initialize the dirty bitmap.  */
-        BlockDriverState *base;
-        base = s->mode == MIRROR_SYNC_MODE_FULL ? NULL : bs->backing_hd;
-        for (sector_num = 0; sector_num < end; ) {
-            int64_t next = (sector_num | (sectors_per_chunk - 1)) + 1;
-            ret = bdrv_co_is_allocated_above(bs, base,
-                                             sector_num, next - sector_num, &n);
-
-            if (ret < 0) {
-                goto immediate_exit;
-            }
-
-            assert(n > 0);
-            if (ret == 1) {
-                bdrv_set_dirty(bs, sector_num, n);
-                sector_num = next;
-            } else {
-                sector_num += n;
-            }
-        }
-    }
-
-    bdrv_dirty_iter_init(bs, &s->hbi);
-    last_pause_ns = qemu_get_clock_ns(rt_clock);
-    for (;;) {
-        uint64_t delay_ns;
-        int64_t cnt;
-        bool should_complete;
-
-        if (s->ret < 0) {
-            ret = s->ret;
-            goto immediate_exit;
-        }
-
-        cnt = bdrv_get_dirty_count(bs);
-
-        /* Note that even when no rate limit is applied we need to yield
-         * periodically with no pending I/O so that qemu_aio_flush() returns.
-         * We do so every SLICE_TIME nanoseconds, or when there is an error,
-         * or when the source is clean, whichever comes first.
-         */
-        if (qemu_get_clock_ns(rt_clock) - last_pause_ns < SLICE_TIME &&
-            s->common.iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
-            if (s->in_flight == MAX_IN_FLIGHT || s->buf_free_count == 0 ||
-                (cnt == 0 && s->in_flight > 0)) {
-                trace_mirror_yield(s, s->in_flight, s->buf_free_count, cnt);
-                qemu_coroutine_yield();
-                continue;
-            } else if (cnt != 0) {
-                mirror_iteration(s);
-                continue;
-            }
-        }
-
-        should_complete = false;
-        if (s->in_flight == 0 && cnt == 0) {
-            trace_mirror_before_flush(s);
-            ret = bdrv_flush(s->target);
-            if (ret < 0) {
-                if (mirror_error_action(s, false, -ret) == BDRV_ACTION_REPORT) {
-                    goto immediate_exit;
-                }
-            } else {
-                /* We're out of the streaming phase.  From now on, if the job
-                 * is cancelled we will actually complete all pending I/O and
-                 * report completion.  This way, block-job-cancel will leave
-                 * the target in a consistent state.
-                 */
-                s->common.offset = end * BDRV_SECTOR_SIZE;
-                if (!s->synced) {
-                    block_job_ready(&s->common);
-                    s->synced = true;
-                }
-
-                should_complete = s->should_complete ||
-                    block_job_is_cancelled(&s->common);
-                cnt = bdrv_get_dirty_count(bs);
-            }
-        }
-
-        if (cnt == 0 && should_complete) {
-            /* The dirty bitmap is not updated while operations are pending.
-             * If we're about to exit, wait for pending operations before
-             * calling bdrv_get_dirty_count(bs), or we may exit while the
-             * source has dirty data to copy!
-             *
-             * Note that I/O can be submitted by the guest while
-             * mirror_populate runs.
-             */
-            trace_mirror_before_drain(s, cnt);
-            bdrv_drain_all();
-            cnt = bdrv_get_dirty_count(bs);
-        }
-
-        ret = 0;
-        trace_mirror_before_sleep(s, cnt, s->synced);
-        if (!s->synced) {
-            /* Publish progress */
-            s->common.offset = (end - cnt) * BDRV_SECTOR_SIZE;
-
-            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, sectors_per_chunk);
-            } else {
-                delay_ns = 0;
-            }
-
-            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-            if (block_job_is_cancelled(&s->common)) {
-                break;
-            }
-        } else if (!should_complete) {
-            delay_ns = (s->in_flight == 0 && cnt == 0 ? SLICE_TIME : 0);
-            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-        } else if (cnt == 0) {
-            /* The two disks are in sync.  Exit and report successful
-             * completion.
-             */
-            assert(QLIST_EMPTY(&bs->tracked_requests));
-            s->common.cancelled = false;
-            break;
-        }
-        last_pause_ns = qemu_get_clock_ns(rt_clock);
-    }
-
-immediate_exit:
-    if (s->in_flight > 0) {
-        /* We get here only if something went wrong.  Either the job failed,
-         * or it was cancelled prematurely so that we do not guarantee that
-         * the target is a copy of the source.
-         */
-        assert(ret < 0 || (!s->synced && block_job_is_cancelled(&s->common)));
-        mirror_drain(s);
-    }
-
-    assert(s->in_flight == 0);
-    qemu_vfree(s->buf);
-    g_free(s->cow_bitmap);
-    g_free(s->in_flight_bitmap);
-    bdrv_set_dirty_tracking(bs, 0);
-    bdrv_iostatus_disable(s->target);
-    if (s->should_complete && ret == 0) {
-        if (bdrv_get_flags(s->target) != bdrv_get_flags(s->common.bs)) {
-            bdrv_reopen(s->target, bdrv_get_flags(s->common.bs), NULL);
-        }
-        bdrv_swap(s->target, s->common.bs);
-    }
-    bdrv_close(s->target);
-    bdrv_delete(s->target);
-    block_job_completed(&s->common, ret);
-}
-
-static void mirror_set_speed(BlockJob *job, int64_t speed, Error **errp)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    if (speed < 0) {
-        error_set(errp, QERR_INVALID_PARAMETER, "speed");
-        return;
-    }
-    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
-}
-
-static void mirror_iostatus_reset(BlockJob *job)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    bdrv_iostatus_reset(s->target);
-}
-
-static void mirror_complete(BlockJob *job, Error **errp)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-    int ret;
-
-    ret = bdrv_open_backing_file(s->target, NULL);
-    if (ret < 0) {
-        char backing_filename[PATH_MAX];
-        bdrv_get_full_backing_filename(s->target, backing_filename,
-                                       sizeof(backing_filename));
-        error_set(errp, QERR_OPEN_FILE_FAILED, backing_filename);
-        return;
-    }
-    if (!s->synced) {
-        error_set(errp, QERR_BLOCK_JOB_NOT_READY, job->bs->device_name);
-        return;
-    }
-
-    s->should_complete = true;
-    block_job_resume(job);
-}
-
-static BlockJobType mirror_job_type = {
-    .instance_size = sizeof(MirrorBlockJob),
-    .job_type      = "mirror",
-    .set_speed     = mirror_set_speed,
-    .iostatus_reset= mirror_iostatus_reset,
-    .complete      = mirror_complete,
-};
-
-void mirror_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed, int64_t granularity, int64_t buf_size,
-                  MirrorSyncMode mode, BlockdevOnError on_source_error,
-                  BlockdevOnError on_target_error,
-                  BlockDriverCompletionFunc *cb,
-                  void *opaque, Error **errp)
-{
-    MirrorBlockJob *s;
-
-    if (granularity == 0) {
-        /* Choose the default granularity based on the target file's cluster
-         * size, clamped between 4k and 64k.  */
-        BlockDriverInfo bdi;
-        if (bdrv_get_info(target, &bdi) >= 0 && bdi.cluster_size != 0) {
-            granularity = MAX(4096, bdi.cluster_size);
-            granularity = MIN(65536, granularity);
-        } else {
-            granularity = 65536;
-        }
-    }
-
-    assert ((granularity & (granularity - 1)) == 0);
-
-    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
-         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER, "on-source-error");
-        return;
-    }
-
-    s = block_job_create(&mirror_job_type, bs, speed, cb, opaque, errp);
-    if (!s) {
-        return;
-    }
-
-    s->on_source_error = on_source_error;
-    s->on_target_error = on_target_error;
-    s->target = target;
-    s->mode = mode;
-    s->granularity = granularity;
-    s->buf_size = MAX(buf_size, granularity);
-
-    bdrv_set_dirty_tracking(bs, granularity);
-    bdrv_set_enable_write_cache(s->target, true);
-    bdrv_set_on_error(s->target, on_target_error, on_target_error);
-    bdrv_iostatus_enable(s->target);
-    s->common.co = qemu_coroutine_create(mirror_run);
-    trace_mirror_start(bs, s, s->common.co, opaque);
-    qemu_coroutine_enter(s->common.co, s);
-}
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -27,13 +27,10 @@
 */

 #include "qemu-common.h"
-#include "block/nbd.h"
-#include "qemu/uri.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "qemu/sockets.h"
-#include "qapi/qmp/qjson.h"
-#include "qapi/qmp/qint.h"
+#include "nbd.h"
+#include "block_int.h"
+#include "module.h"
+#include "qemu_socket.h"

 #include <sys/types.h>
 #include <unistd.h>
@@ -58,6 +55,7 @@ typedef struct BDRVNBDState {
    uint32_t nbdflags;
    off_t size;
    size_t blocksize;
+    char *export_name; /* An NBD server may export several devices */

    CoMutex send_mutex;
    CoMutex free_sema;
@@ -67,103 +65,19 @@ typedef struct BDRVNBDState {
    Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
    struct nbd_reply reply;

-    bool is_unix;
-    QemuOpts *socket_opts;
-
-    char *export_name; /* An NBD server may export several devices */
+    /* If it begins with  '/', this is a UNIX domain socket. Otherwise,
+     * it's a string of the form <hostname|ip4|\[ip6\]>:port
+     */
+    char *host_spec;
 } BDRVNBDState;

-static int nbd_parse_uri(const char *filename, QDict *options)
-{
-    URI *uri;
-    const char *p;
-    QueryParams *qp = NULL;
-    int ret = 0;
-    bool is_unix;
-
-    uri = uri_parse(filename);
-    if (!uri) {
-        return -EINVAL;
-    }
-
-    /* transport */
-    if (!strcmp(uri->scheme, "nbd")) {
-        is_unix = false;
-    } else if (!strcmp(uri->scheme, "nbd+tcp")) {
-        is_unix = false;
-    } else if (!strcmp(uri->scheme, "nbd+unix")) {
-        is_unix = true;
-    } else {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    p = uri->path ? uri->path : "/";
-    p += strspn(p, "/");
-    if (p[0]) {
-        qdict_put(options, "export", qstring_from_str(p));
-    }
-
-    qp = query_params_parse(uri->query);
-    if (qp->n > 1 || (is_unix && !qp->n) || (!is_unix && qp->n)) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    if (is_unix) {
-        /* nbd+unix:///export?socket=path */
-        if (uri->server || uri->port || strcmp(qp->p[0].name, "socket")) {
-            ret = -EINVAL;
-            goto out;
-        }
-        qdict_put(options, "path", qstring_from_str(qp->p[0].value));
-    } else {
-        /* nbd[+tcp]://host[:port]/export */
-        if (!uri->server) {
-            ret = -EINVAL;
-            goto out;
-        }
-
-        qdict_put(options, "host", qstring_from_str(uri->server));
-        if (uri->port) {
-            char* port_str = g_strdup_printf("%d", uri->port);
-            qdict_put(options, "port", qstring_from_str(port_str));
-            g_free(port_str);
-        }
-    }
-
-out:
-    if (qp) {
-        query_params_free(qp);
-    }
-    uri_free(uri);
-    return ret;
-}
-
-static void nbd_parse_filename(const char *filename, QDict *options,
-                               Error **errp)
+static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
 {
    char *file;
    char *export_name;
    const char *host_spec;
    const char *unixpath;
-
-    if (qdict_haskey(options, "host")
-        || qdict_haskey(options, "port")
-        || qdict_haskey(options, "path"))
-    {
-        error_setg(errp, "host/port/path and a file name may not be specified "
-                         "at the same time");
-        return;
-    }
-
-    if (strstr(filename, "://")) {
-        int ret = nbd_parse_uri(filename, options);
-        if (ret < 0) {
-            error_setg(errp, "No valid URL specified");
-        }
-        return;
-    }
+    int err = -EINVAL;

    file = g_strdup(filename);

@@ -174,79 +88,35 @@ static void nbd_parse_filename(const char *filename, QDict *options,
        }
        export_name[0] = 0; /* truncate 'file' */
        export_name += strlen(EN_OPTSTR);
-
-        qdict_put(options, "export", qstring_from_str(export_name));
+        s->export_name = g_strdup(export_name);
    }

    /* extract the host_spec - fail if it's not nbd:... */
    if (!strstart(file, "nbd:", &host_spec)) {
-        error_setg(errp, "File name string for NBD must start with 'nbd:'");
-        goto out;
-    }
-
-    if (!*host_spec) {
        goto out;
    }

    /* are we a UNIX or TCP socket? */
    if (strstart(host_spec, "unix:", &unixpath)) {
-        qdict_put(options, "path", qstring_from_str(unixpath));
-    } else {
-        InetSocketAddress *addr = NULL;
-
-        addr = inet_parse(host_spec, errp);
-        if (error_is_set(errp)) {
+        if (unixpath[0] != '/') { /* We demand  an absolute path*/
            goto out;
        }
-
-        qdict_put(options, "host", qstring_from_str(addr->host));
-        qdict_put(options, "port", qstring_from_str(addr->port));
-        qapi_free_InetSocketAddress(addr);
+        s->host_spec = g_strdup(unixpath);
+    } else {
+        s->host_spec = g_strdup(host_spec);
    }

+    err = 0;
+
 out:
    g_free(file);
+    if (err != 0) {
+        g_free(s->export_name);
+        g_free(s->host_spec);
+    }
+    return err;
 }

-static int nbd_config(BDRVNBDState *s, QDict *options)
-{
-    Error *local_err = NULL;
-
-    if (qdict_haskey(options, "path")) {
-        if (qdict_haskey(options, "host")) {
-            qerror_report(ERROR_CLASS_GENERIC_ERROR, "path and host may not "
-                          "be used at the same time.");
-            return -EINVAL;
-        }
-        s->is_unix = true;
-    } else if (qdict_haskey(options, "host")) {
-        s->is_unix = false;
-    } else {
-        return -EINVAL;
-    }
-
-    s->socket_opts = qemu_opts_create_nofail(&socket_optslist);
-
-    qemu_opts_absorb_qdict(s->socket_opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        return -EINVAL;
-    }
-
-    if (!qemu_opt_get(s->socket_opts, "port")) {
-        qemu_opt_set_number(s->socket_opts, "port", NBD_DEFAULT_PORT);
-    }
-
-    s->export_name = g_strdup(qdict_get_try_str(options, "export"));
-    if (s->export_name) {
-        qdict_del(options, "export");
-    }
-
-    return 0;
-}
-
-
 static void nbd_coroutine_start(BDRVNBDState *s, struct nbd_request *request)
 {
    int i;
@@ -326,7 +196,7 @@ static void nbd_restart_write(void *opaque)
 }

 static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
-                               QEMUIOVector *qiov, int offset)
+                               struct iovec *iov, int offset)
 {
    int rc, ret;

@@ -334,23 +204,12 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
    s->send_coroutine = qemu_coroutine_self();
    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write,
                            nbd_have_request, s);
-    if (qiov) {
-        if (!s->is_unix) {
-            socket_set_cork(s->sock, 1);
+    rc = nbd_send_request(s->sock, request);
+    if (rc >= 0 && iov) {
+        ret = qemu_co_sendv(s->sock, iov, request->len, offset);
+        if (ret != request->len) {
+            return -EIO;
        }
-        rc = nbd_send_request(s->sock, request);
-        if (rc >= 0) {
-            ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
-                                offset, request->len);
-            if (ret != request->len) {
-                rc = -EIO;
-            }
-        }
-        if (!s->is_unix) {
-            socket_set_cork(s->sock, 0);
-        }
-    } else {
-        rc = nbd_send_request(s->sock, request);
    }
    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
                            nbd_have_request, s);
@@ -361,7 +220,7 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,

 static void nbd_co_receive_reply(BDRVNBDState *s, struct nbd_request *request,
                                 struct nbd_reply *reply,
-                                 QEMUIOVector *qiov, int offset)
+                                 struct iovec *iov, int offset)
 {
    int ret;

@@ -372,9 +231,8 @@ static void nbd_co_receive_reply(BDRVNBDState *s, struct nbd_request *request,
    if (reply->handle != request->handle) {
        reply->error = EIO;
    } else {
-        if (qiov && reply->error == 0) {
-            ret = qemu_co_recvv(s->sock, qiov->iov, qiov->niov,
-                                offset, request->len);
+        if (iov && reply->error == 0) {
+            ret = qemu_co_recvv(s->sock, iov, request->len, offset);
            if (ret != request->len) {
                reply->error = EIO;
            }
@@ -402,13 +260,10 @@ static int nbd_establish_connection(BlockDriverState *bs)
    off_t size;
    size_t blocksize;

-    if (s->is_unix) {
-        sock = unix_socket_outgoing(qemu_opt_get(s->socket_opts, "path"));
+    if (s->host_spec[0] == '/') {
+        sock = unix_socket_outgoing(s->host_spec);
    } else {
-        sock = tcp_socket_outgoing_opts(s->socket_opts);
-        if (sock >= 0) {
-            socket_set_nodelay(sock);
-        }
+        sock = tcp_socket_outgoing_spec(s->host_spec);
    }

    /* Failed to establish connection */
@@ -428,7 +283,7 @@ static int nbd_establish_connection(BlockDriverState *bs)

    /* Now that we're connected, set the socket to be non-blocking and
     * kick the reply mechanism.  */
-    qemu_set_nonblock(sock);
+    socket_set_nonblock(sock);
    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL,
                            nbd_have_request, s);

@@ -454,7 +309,7 @@ static void nbd_teardown_connection(BlockDriverState *bs)
    closesocket(s->sock);
 }

-static int nbd_open(BlockDriverState *bs, QDict *options, int flags)
+static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
 {
    BDRVNBDState *s = bs->opaque;
    int result;
@@ -463,7 +318,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags)
    qemu_co_mutex_init(&s->free_sema);

    /* Pop the config into our state object. Exit if invalid. */
-    result = nbd_config(s, options);
+    result = nbd_config(s, filename, flags);
    if (result != 0) {
        return result;
    }
@@ -494,7 +349,7 @@ static int nbd_co_readv_1(BlockDriverState *bs, int64_t sector_num,
    if (ret < 0) {
        reply.error = -ret;
    } else {
-        nbd_co_receive_reply(s, &request, &reply, qiov, offset);
+        nbd_co_receive_reply(s, &request, &reply, qiov->iov, offset);
    }
    nbd_coroutine_end(s, &request);
    return -reply.error;
@@ -519,7 +374,7 @@ static int nbd_co_writev_1(BlockDriverState *bs, int64_t sector_num,
    request.len = nb_sectors * 512;

    nbd_coroutine_start(s, &request);
-    ret = nbd_co_send_request(s, &request, qiov, offset);
+    ret = nbd_co_send_request(s, &request, qiov->iov, offset);
    if (ret < 0) {
        reply.error = -ret;
    } else {
@@ -609,7 +464,7 @@ static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,
        return 0;
    }
    request.type = NBD_CMD_TRIM;
-    request.from = sector_num * 512;
+    request.from = sector_num * 512;;
    request.len = nb_sectors * 512;

    nbd_coroutine_start(s, &request);
@@ -627,7 +482,7 @@ static void nbd_close(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;
    g_free(s->export_name);
-    qemu_opts_del(s->socket_opts);
+    g_free(s->host_spec);

    nbd_teardown_connection(bs);
 }
@@ -641,51 +496,20 @@ static int64_t nbd_getlength(BlockDriverState *bs)

 static BlockDriver bdrv_nbd = {
    .format_name         = "nbd",
+    .instance_size       = sizeof(BDRVNBDState),
+    .bdrv_file_open      = nbd_open,
+    .bdrv_co_readv       = nbd_co_readv,
+    .bdrv_co_writev      = nbd_co_writev,
+    .bdrv_close          = nbd_close,
+    .bdrv_co_flush_to_os = nbd_co_flush,
+    .bdrv_co_discard     = nbd_co_discard,
+    .bdrv_getlength      = nbd_getlength,
    .protocol_name       = "nbd",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_parse_filename = nbd_parse_filename,
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
-};
-
-static BlockDriver bdrv_nbd_tcp = {
-    .format_name         = "nbd",
-    .protocol_name       = "nbd+tcp",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_parse_filename = nbd_parse_filename,
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
-};
-
-static BlockDriver bdrv_nbd_unix = {
-    .format_name         = "nbd",
-    .protocol_name       = "nbd+unix",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_parse_filename = nbd_parse_filename,
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
 };

 static void bdrv_nbd_init(void)
 {
    bdrv_register(&bdrv_nbd);
-    bdrv_register(&bdrv_nbd_tcp);
-    bdrv_register(&bdrv_nbd_unix);
 }

 block_init(bdrv_nbd_init);
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -24,8 +24,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -68,23 +68,19 @@ static int parallels_probe(const uint8_t *buf, int buf_size, const char *filenam
    return 0;
 }

-static int parallels_open(BlockDriverState *bs, QDict *options, int flags)
+static int parallels_open(BlockDriverState *bs, int flags)
 {
    BDRVParallelsState *s = bs->opaque;
    int i;
    struct parallels_header ph;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, &ph, sizeof(ph)) != sizeof(ph))
        goto fail;
-    }

    if (memcmp(ph.magic, HEADER_MAGIC, 16) ||
-        (le32_to_cpu(ph.version) != HEADER_VERSION)) {
-        ret = -EMEDIUMTYPE;
+	(le32_to_cpu(ph.version) != HEADER_VERSION)) {
        goto fail;
    }

@@ -94,21 +90,18 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags)

    s->catalog_size = le32_to_cpu(ph.catalog_entries);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
+	s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+    if (s->catalog_bitmap)
+	g_free(s->catalog_bitmap);
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -22,11 +22,11 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>
-#include "qemu/aes.h"
-#include "migration/migration.h"
+#include "aes.h"
+#include "migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -92,7 +92,7 @@ static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
        return 0;
 }

-static int qcow_open(BlockDriverState *bs, QDict *options, int flags)
+static int qcow_open(BlockDriverState *bs, int flags)
 {
    BDRVQcowState *s = bs->opaque;
    int len, i, shift, ret;
@@ -112,7 +112,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags)
    be64_to_cpus(&header.l1_table_offset);

    if (header.magic != QCOW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }
    if (header.version != QCOW_VERSION) {
@@ -197,15 +197,6 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags)
    return ret;
 }

-
-/* We have nothing to do for QCOW reopen, stubs just return
- * success */
-static int qcow_reopen_prepare(BDRVReopenState *state,
-                               BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
-}
-
 static int qcow_set_key(BlockDriverState *bs, const char *key)
 {
    BDRVQcowState *s = bs->opaque;
@@ -549,7 +540,7 @@ done:
    qemu_co_mutex_unlock(&s->lock);

    if (qiov->niov > 1) {
-        qemu_iovec_from_buf(qiov, 0, orig_buf, qiov->size);
+        qemu_iovec_from_buffer(qiov, orig_buf, qiov->size);
        qemu_vfree(orig_buf);
    }

@@ -578,7 +569,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,

    if (qiov->niov > 1) {
        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-        qemu_iovec_to_buf(qiov, 0, buf, qiov->size);
+        qemu_iovec_to_buffer(qiov, buf);
    } else {
        orig_buf = NULL;
        buf = (uint8_t *)qiov->iov->iov_base;
@@ -679,7 +670,7 @@ static int qcow_create(const char *filename, QEMUOptionParameter *options)
        return ret;
    }

-    ret = bdrv_file_open(&qcow_bs, filename, NULL, BDRV_O_RDWR);
+    ret = bdrv_file_open(&qcow_bs, filename, BDRV_O_RDWR);
    if (ret < 0) {
        return ret;
    }
@@ -787,21 +778,8 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
    uint8_t *out_buf;
    uint64_t cluster_offset;

-    if (nb_sectors != s->cluster_sectors) {
-        ret = -EINVAL;
-
-        /* Zero-pad last write if image size is not cluster aligned */
-        if (sector_num + nb_sectors == bs->total_sectors &&
-            nb_sectors < s->cluster_sectors) {
-            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
-            memset(pad_buf, 0, s->cluster_size);
-            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
-            ret = qcow_write_compressed(bs, sector_num,
-                                        pad_buf, s->cluster_sectors);
-            qemu_vfree(pad_buf);
-        }
-        return ret;
-    }
+    if (nb_sectors != s->cluster_sectors)
+        return -EINVAL;

    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);

@@ -890,7 +868,6 @@ static BlockDriver bdrv_qcow = {
    .bdrv_probe		= qcow_probe,
    .bdrv_open		= qcow_open,
    .bdrv_close		= qcow_close,
-    .bdrv_reopen_prepare = qcow_reopen_prepare,
    .bdrv_create	= qcow_create,

    .bdrv_co_readv          = qcow_co_readv,
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */

-#include "block/block_int.h"
+#include "block_int.h"
 #include "qemu-common.h"
 #include "qcow2.h"
 #include "trace.h"
@@ -40,9 +40,11 @@ struct Qcow2Cache {
    struct Qcow2Cache*      depends;
    int                     size;
    bool                    depends_on_flush;
+    bool                    writethrough;
 };

-Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)
+Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
+    bool writethrough)
 {
    BDRVQcowState *s = bs->opaque;
    Qcow2Cache *c;
@@ -51,6 +53,7 @@ Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)
    c = g_malloc0(sizeof(*c));
    c->size = num_tables;
    c->entries = g_malloc0(sizeof(*c->entries) * num_tables);
+    c->writethrough = writethrough;

    for (i = 0; i < c->size; i++) {
        c->entries[i].table = qemu_blockalign(bs, s->cluster_size);
@@ -304,7 +307,12 @@ found:
    *table = NULL;

    assert(c->entries[i].ref >= 0);
-    return 0;
+
+    if (c->writethrough) {
+        return qcow2_cache_entry_flush(bs, c, i);
+    } else {
+        return 0;
+    }
 }

 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table)
@@ -321,3 +329,16 @@ void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table)
 found:
    c->entries[i].dirty = true;
 }
+
+bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
+    bool enable)
+{
+    bool old = c->writethrough;
+
+    if (!old && enable) {
+        qcow2_cache_flush(bs, c);
+    }
+
+    c->writethrough = enable;
+    return old;
+}
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -25,17 +25,16 @@
 #include <zlib.h>

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"
 #include "trace.h"

-int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
-                        bool exact_size)
+int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
 {
    BDRVQcowState *s = bs->opaque;
-    int new_l1_size2, ret, i;
+    int new_l1_size, new_l1_size2, ret, i;
    uint64_t *new_l1_table;
-    int64_t new_l1_table_offset, new_l1_size;
+    int64_t new_l1_table_offset;
    uint8_t data[12];

    if (min_size <= s->l1_size)
@@ -54,13 +53,8 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
        }
    }

-    if (new_l1_size > INT_MAX) {
-        return -EFBIG;
-    }
-
 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "grow l1_table from %d to %" PRId64 "\n",
-            s->l1_size, new_l1_size);
+    fprintf(stderr, "grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
 #endif

    new_l1_size2 = sizeof(uint64_t) * new_l1_size;
@@ -397,8 +391,8 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *cluster_offset)
 {
    BDRVQcowState *s = bs->opaque;
-    unsigned int l2_index;
-    uint64_t l1_index, l2_offset, *l2_table;
+    unsigned int l1_index, l2_index;
+    uint64_t l2_offset, *l2_table;
    int l1_bits, c;
    unsigned int index_in_cluster, nb_clusters;
    uint64_t nb_available, nb_needed;
@@ -460,9 +454,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
        *cluster_offset &= L2E_COMPRESSED_OFFSET_SIZE_MASK;
        break;
    case QCOW2_CLUSTER_ZERO:
-        if (s->qcow_version < 3) {
-            return -EIO;
-        }
        c = count_contiguous_clusters(nb_clusters, s->cluster_size,
                &l2_table[l2_index], 0,
                QCOW_OFLAG_COMPRESSED | QCOW_OFLAG_ZERO);
@@ -513,8 +504,8 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
                             int *new_l2_index)
 {
    BDRVQcowState *s = bs->opaque;
-    unsigned int l2_index;
-    uint64_t l1_index, l2_offset;
+    unsigned int l1_index, l2_index;
+    uint64_t l2_offset;
    uint64_t *l2_table = NULL;
    int ret;

@@ -528,7 +519,6 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
        }
    }

-    assert(l1_index < s->l1_size);
    l2_offset = s->l1_table[l1_index] & L1E_OFFSET_MASK;

    /* seek the l2 table of the given l2 offset */
@@ -550,6 +540,7 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
        if (l2_offset) {
            qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
        }
+        l2_offset = s->l1_table[l1_index] & L1E_OFFSET_MASK;
    }

    /* find the cluster offset for the given disk offset */
@@ -625,67 +616,55 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    return cluster_offset;
 }

-static int perform_cow(BlockDriverState *bs, QCowL2Meta *m, Qcow2COWRegion *r)
-{
-    BDRVQcowState *s = bs->opaque;
-    int ret;
-
-    if (r->nb_sectors == 0) {
-        return 0;
-    }
-
-    qemu_co_mutex_unlock(&s->lock);
-    ret = copy_sectors(bs, m->offset / BDRV_SECTOR_SIZE, m->alloc_offset,
-                       r->offset / BDRV_SECTOR_SIZE,
-                       r->offset / BDRV_SECTOR_SIZE + r->nb_sectors);
-    qemu_co_mutex_lock(&s->lock);
-
-    if (ret < 0) {
-        return ret;
-    }
-
-    /*
-     * Before we update the L2 table to actually point to the new cluster, we
-     * need to be sure that the refcounts have been increased and COW was
-     * handled.
-     */
-    qcow2_cache_depends_on_flush(s->l2_table_cache);
-
-    return 0;
-}
-
 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
 {
    BDRVQcowState *s = bs->opaque;
    int i, j = 0, l2_index, ret;
-    uint64_t *old_cluster, *l2_table;
+    uint64_t *old_cluster, start_sect, *l2_table;
    uint64_t cluster_offset = m->alloc_offset;
+    bool cow = false;

    trace_qcow2_cluster_link_l2(qemu_coroutine_self(), m->nb_clusters);
-    assert(m->nb_clusters > 0);
+
+    if (m->nb_clusters == 0)
+        return 0;

    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));

    /* copy content of unmodified sectors */
-    ret = perform_cow(bs, m, &m->cow_start);
-    if (ret < 0) {
-        goto err;
+    start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
+    if (m->n_start) {
+        cow = true;
+        qemu_co_mutex_unlock(&s->lock);
+        ret = copy_sectors(bs, start_sect, cluster_offset, 0, m->n_start);
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0)
+            goto err;
    }

-    ret = perform_cow(bs, m, &m->cow_end);
-    if (ret < 0) {
-        goto err;
+    if (m->nb_available & (s->cluster_sectors - 1)) {
+        uint64_t end = m->nb_available & ~(uint64_t)(s->cluster_sectors - 1);
+        cow = true;
+        qemu_co_mutex_unlock(&s->lock);
+        ret = copy_sectors(bs, start_sect + end, cluster_offset + (end << 9),
+                m->nb_available - end, s->cluster_sectors);
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0)
+            goto err;
    }

-    /* Update L2 table. */
-    if (s->use_lazy_refcounts) {
-        qcow2_mark_dirty(bs);
-    }
-    if (qcow2_need_accurate_refcounts(s)) {
-        qcow2_cache_set_dependency(bs, s->l2_table_cache,
-                                   s->refcount_block_cache);
+    /*
+     * Update L2 table.
+     *
+     * Before we update the L2 table to actually point to the new cluster, we
+     * need to be sure that the refcounts have been increased and COW was
+     * handled.
+     */
+    if (cow) {
+        qcow2_cache_depends_on_flush(s->l2_table_cache);
    }

+    qcow2_cache_set_dependency(bs, s->l2_table_cache, s->refcount_block_cache);
    ret = get_cluster_table(bs, m->offset, &l2_table, &l2_index);
    if (ret < 0) {
        goto err;
@@ -762,175 +741,6 @@ out:
    return i;
 }

-/*
- * Check if there already is an AIO write request in flight which allocates
- * the same cluster. In this case we need to wait until the previous
- * request has completed and updated the L2 table accordingly.
- *
- * Returns:
- *   0       if there was no dependency. *cur_bytes indicates the number of
- *           bytes from guest_offset that can be read before the next
- *           dependency must be processed (or the request is complete)
- *
- *   -EAGAIN if we had to wait for another request, previously gathered
- *           information on cluster allocation may be invalid now. The caller
- *           must start over anyway, so consider *cur_bytes undefined.
- */
-static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
-    uint64_t *cur_bytes, QCowL2Meta **m)
-{
-    BDRVQcowState *s = bs->opaque;
-    QCowL2Meta *old_alloc;
-    uint64_t bytes = *cur_bytes;
-
-    QLIST_FOREACH(old_alloc, &s->cluster_allocs, next_in_flight) {
-
-        uint64_t start = guest_offset;
-        uint64_t end = start + bytes;
-        uint64_t old_start = l2meta_cow_start(old_alloc);
-        uint64_t old_end = l2meta_cow_end(old_alloc);
-
-        if (end <= old_start || start >= old_end) {
-            /* No intersection */
-        } else {
-            if (start < old_start) {
-                /* Stop at the start of a running allocation */
-                bytes = old_start - start;
-            } else {
-                bytes = 0;
-            }
-
-            /* Stop if already an l2meta exists. After yielding, it wouldn't
-             * be valid any more, so we'd have to clean up the old L2Metas
-             * and deal with requests depending on them before starting to
-             * gather new ones. Not worth the trouble. */
-            if (bytes == 0 && *m) {
-                *cur_bytes = 0;
-                return 0;
-            }
-
-            if (bytes == 0) {
-                /* Wait for the dependency to complete. We need to recheck
-                 * the free/allocated clusters when we continue. */
-                qemu_co_mutex_unlock(&s->lock);
-                qemu_co_queue_wait(&old_alloc->dependent_requests);
-                qemu_co_mutex_lock(&s->lock);
-                return -EAGAIN;
-            }
-        }
-    }
-
-    /* Make sure that existing clusters and new allocations are only used up to
-     * the next dependency if we shortened the request above */
-    *cur_bytes = bytes;
-
-    return 0;
-}
-
-/*
- * Checks how many already allocated clusters that don't require a copy on
- * write there are at the given guest_offset (up to *bytes). If
- * *host_offset is not zero, only physically contiguous clusters beginning at
- * this host offset are counted.
- *
- * Note that guest_offset may not be cluster aligned. In this case, the
- * returned *host_offset points to exact byte referenced by guest_offset and
- * therefore isn't cluster aligned as well.
- *
- * Returns:
- *   0:     if no allocated clusters are available at the given offset.
- *          *bytes is normally unchanged. It is set to 0 if the cluster
- *          is allocated and doesn't need COW, but doesn't have the right
- *          physical offset.
- *
- *   1:     if allocated clusters that don't require a COW are available at
- *          the requested offset. *bytes may have decreased and describes
- *          the length of the area that can be written to.
- *
- *  -errno: in error cases
- */
-static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,
-    uint64_t *host_offset, uint64_t *bytes, QCowL2Meta **m)
-{
-    BDRVQcowState *s = bs->opaque;
-    int l2_index;
-    uint64_t cluster_offset;
-    uint64_t *l2_table;
-    unsigned int nb_clusters;
-    unsigned int keep_clusters;
-    int ret, pret;
-
-    trace_qcow2_handle_copied(qemu_coroutine_self(), guest_offset, *host_offset,
-                              *bytes);
-
-    assert(*host_offset == 0 ||    offset_into_cluster(s, guest_offset)
-                                == offset_into_cluster(s, *host_offset));
-
-    /*
-     * Calculate the number of clusters to look for. We stop at L2 table
-     * boundaries to keep things simple.
-     */
-    nb_clusters =
-        size_to_clusters(s, offset_into_cluster(s, guest_offset) + *bytes);
-
-    l2_index = offset_to_l2_index(s, guest_offset);
-    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-
-    /* Find L2 entry for the first involved cluster */
-    ret = get_cluster_table(bs, guest_offset, &l2_table, &l2_index);
-    if (ret < 0) {
-        return ret;
-    }
-
-    cluster_offset = be64_to_cpu(l2_table[l2_index]);
-
-    /* Check how many clusters are already allocated and don't need COW */
-    if (qcow2_get_cluster_type(cluster_offset) == QCOW2_CLUSTER_NORMAL
-        && (cluster_offset & QCOW_OFLAG_COPIED))
-    {
-        /* If a specific host_offset is required, check it */
-        bool offset_matches =
-            (cluster_offset & L2E_OFFSET_MASK) == *host_offset;
-
-        if (*host_offset != 0 && !offset_matches) {
-            *bytes = 0;
-            ret = 0;
-            goto out;
-        }
-
-        /* We keep all QCOW_OFLAG_COPIED clusters */
-        keep_clusters =
-            count_contiguous_clusters(nb_clusters, s->cluster_size,
-                                      &l2_table[l2_index], 0,
-                                      QCOW_OFLAG_COPIED | QCOW_OFLAG_ZERO);
-        assert(keep_clusters <= nb_clusters);
-
-        *bytes = MIN(*bytes,
-                 keep_clusters * s->cluster_size
-                 - offset_into_cluster(s, guest_offset));
-
-        ret = 1;
-    } else {
-        ret = 0;
-    }
-
-    /* Cleanup */
-out:
-    pret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-    if (pret < 0) {
-        return pret;
-    }
-
-    /* Only return a host offset if we actually made progress. Otherwise we
-     * would make requirements for handle_alloc() that it can't fulfill */
-    if (ret) {
-        *host_offset = (cluster_offset & L2E_OFFSET_MASK)
-                     + offset_into_cluster(s, guest_offset);
-    }
-
-    return ret;
-}
-
 /*
 * Allocates new clusters for the given guest_offset.
 *
@@ -954,10 +764,48 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
    uint64_t *host_offset, unsigned int *nb_clusters)
 {
    BDRVQcowState *s = bs->opaque;
+    QCowL2Meta *old_alloc;

    trace_qcow2_do_alloc_clusters_offset(qemu_coroutine_self(), guest_offset,
                                         *host_offset, *nb_clusters);

+    /*
+     * Check if there already is an AIO write request in flight which allocates
+     * the same cluster. In this case we need to wait until the previous
+     * request has completed and updated the L2 table accordingly.
+     */
+    QLIST_FOREACH(old_alloc, &s->cluster_allocs, next_in_flight) {
+
+        uint64_t start = guest_offset >> s->cluster_bits;
+        uint64_t end = start + *nb_clusters;
+        uint64_t old_start = old_alloc->offset >> s->cluster_bits;
+        uint64_t old_end = old_start + old_alloc->nb_clusters;
+
+        if (end < old_start || start > old_end) {
+            /* No intersection */
+        } else {
+            if (start < old_start) {
+                /* Stop at the start of a running allocation */
+                *nb_clusters = old_start - start;
+            } else {
+                *nb_clusters = 0;
+            }
+
+            if (*nb_clusters == 0) {
+                /* Wait for the dependency to complete. We need to recheck
+                 * the free/allocated clusters when we continue. */
+                qemu_co_mutex_unlock(&s->lock);
+                qemu_co_queue_wait(&old_alloc->dependent_requests);
+                qemu_co_mutex_lock(&s->lock);
+                return -EAGAIN;
+            }
+        }
+    }
+
+    if (!*nb_clusters) {
+        abort();
+    }
+
    /* Allocate new clusters */
    trace_qcow2_cluster_alloc_phys(qemu_coroutine_self());
    if (*host_offset == 0) {
@@ -978,151 +826,6 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
    }
 }

-/*
- * Allocates new clusters for an area that either is yet unallocated or needs a
- * copy on write. If *host_offset is non-zero, clusters are only allocated if
- * the new allocation can match the specified host offset.
- *
- * Note that guest_offset may not be cluster aligned. In this case, the
- * returned *host_offset points to exact byte referenced by guest_offset and
- * therefore isn't cluster aligned as well.
- *
- * Returns:
- *   0:     if no clusters could be allocated. *bytes is set to 0,
- *          *host_offset is left unchanged.
- *
- *   1:     if new clusters were allocated. *bytes may be decreased if the
- *          new allocation doesn't cover all of the requested area.
- *          *host_offset is updated to contain the host offset of the first
- *          newly allocated cluster.
- *
- *  -errno: in error cases
- */
-static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
-    uint64_t *host_offset, uint64_t *bytes, QCowL2Meta **m)
-{
-    BDRVQcowState *s = bs->opaque;
-    int l2_index;
-    uint64_t *l2_table;
-    uint64_t entry;
-    unsigned int nb_clusters;
-    int ret;
-
-    uint64_t alloc_cluster_offset;
-
-    trace_qcow2_handle_alloc(qemu_coroutine_self(), guest_offset, *host_offset,
-                             *bytes);
-    assert(*bytes > 0);
-
-    /*
-     * Calculate the number of clusters to look for. We stop at L2 table
-     * boundaries to keep things simple.
-     */
-    nb_clusters =
-        size_to_clusters(s, offset_into_cluster(s, guest_offset) + *bytes);
-
-    l2_index = offset_to_l2_index(s, guest_offset);
-    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
-
-    /* Find L2 entry for the first involved cluster */
-    ret = get_cluster_table(bs, guest_offset, &l2_table, &l2_index);
-    if (ret < 0) {
-        return ret;
-    }
-
-    entry = be64_to_cpu(l2_table[l2_index]);
-
-    /* For the moment, overwrite compressed clusters one by one */
-    if (entry & QCOW_OFLAG_COMPRESSED) {
-        nb_clusters = 1;
-    } else {
-        nb_clusters = count_cow_clusters(s, nb_clusters, l2_table, l2_index);
-    }
-
-    /* This function is only called when there were no non-COW clusters, so if
-     * we can't find any unallocated or COW clusters either, something is
-     * wrong with our code. */
-    assert(nb_clusters > 0);
-
-    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-    if (ret < 0) {
-        return ret;
-    }
-
-    /* Allocate, if necessary at a given offset in the image file */
-    alloc_cluster_offset = start_of_cluster(s, *host_offset);
-    ret = do_alloc_cluster_offset(bs, guest_offset, &alloc_cluster_offset,
-                                  &nb_clusters);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    /* Can't extend contiguous allocation */
-    if (nb_clusters == 0) {
-        *bytes = 0;
-        return 0;
-    }
-
-    /*
-     * Save info needed for meta data update.
-     *
-     * requested_sectors: Number of sectors from the start of the first
-     * newly allocated cluster to the end of the (possibly shortened
-     * before) write request.
-     *
-     * avail_sectors: Number of sectors from the start of the first
-     * newly allocated to the end of the last newly allocated cluster.
-     *
-     * nb_sectors: The number of sectors from the start of the first
-     * newly allocated cluster to the end of the area that the write
-     * request actually writes to (excluding COW at the end)
-     */
-    int requested_sectors =
-        (*bytes + offset_into_cluster(s, guest_offset))
-        >> BDRV_SECTOR_BITS;
-    int avail_sectors = nb_clusters
-                        << (s->cluster_bits - BDRV_SECTOR_BITS);
-    int alloc_n_start = offset_into_cluster(s, guest_offset)
-                        >> BDRV_SECTOR_BITS;
-    int nb_sectors = MIN(requested_sectors, avail_sectors);
-    QCowL2Meta *old_m = *m;
-
-    *m = g_malloc0(sizeof(**m));
-
-    **m = (QCowL2Meta) {
-        .next           = old_m,
-
-        .alloc_offset   = alloc_cluster_offset,
-        .offset         = start_of_cluster(s, guest_offset),
-        .nb_clusters    = nb_clusters,
-        .nb_available   = nb_sectors,
-
-        .cow_start = {
-            .offset     = 0,
-            .nb_sectors = alloc_n_start,
-        },
-        .cow_end = {
-            .offset     = nb_sectors * BDRV_SECTOR_SIZE,
-            .nb_sectors = avail_sectors - nb_sectors,
-        },
-    };
-    qemu_co_queue_init(&(*m)->dependent_requests);
-    QLIST_INSERT_HEAD(&s->cluster_allocs, *m, next_in_flight);
-
-    *host_offset = alloc_cluster_offset + offset_into_cluster(s, guest_offset);
-    *bytes = MIN(*bytes, (nb_sectors * BDRV_SECTOR_SIZE)
-                         - offset_into_cluster(s, guest_offset));
-    assert(*bytes != 0);
-
-    return 1;
-
-fail:
-    if (*m && (*m)->nb_clusters > 0) {
-        QLIST_REMOVE(*m, next_in_flight);
-    }
-    return ret;
-}
-
 /*
 * alloc_cluster_offset
 *
@@ -1143,113 +846,143 @@ fail:
 * Return 0 on success and -errno in error cases
 */
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
-    int n_start, int n_end, int *num, uint64_t *host_offset, QCowL2Meta **m)
+    int n_start, int n_end, int *num, QCowL2Meta *m)
 {
    BDRVQcowState *s = bs->opaque;
-    uint64_t start, remaining;
+    int l2_index, ret, sectors;
+    uint64_t *l2_table;
+    unsigned int nb_clusters, keep_clusters;
    uint64_t cluster_offset;
-    uint64_t cur_bytes;
-    int ret;

    trace_qcow2_alloc_clusters_offset(qemu_coroutine_self(), offset,
                                      n_start, n_end);

-    assert(n_start * BDRV_SECTOR_SIZE == offset_into_cluster(s, offset));
-    offset = start_of_cluster(s, offset);
-
+    /* Find L2 entry for the first involved cluster */
 again:
-    start = offset + (n_start << BDRV_SECTOR_BITS);
-    remaining = (n_end - n_start) << BDRV_SECTOR_BITS;
-    cluster_offset = 0;
-    *host_offset = 0;
-    cur_bytes = 0;
-    *m = NULL;
+    ret = get_cluster_table(bs, offset, &l2_table, &l2_index);
+    if (ret < 0) {
+        return ret;
+    }

-    while (true) {
+    /*
+     * Calculate the number of clusters to look for. We stop at L2 table
+     * boundaries to keep things simple.
+     */
+    nb_clusters = MIN(size_to_clusters(s, n_end << BDRV_SECTOR_BITS),
+                      s->l2_size - l2_index);

-        if (!*host_offset) {
-            *host_offset = start_of_cluster(s, cluster_offset);
-        }
+    cluster_offset = be64_to_cpu(l2_table[l2_index]);

-        assert(remaining >= cur_bytes);
+    /*
+     * Check how many clusters are already allocated and don't need COW, and how
+     * many need a new allocation.
+     */
+    if (qcow2_get_cluster_type(cluster_offset) == QCOW2_CLUSTER_NORMAL
+        && (cluster_offset & QCOW_OFLAG_COPIED))
+    {
+        /* We keep all QCOW_OFLAG_COPIED clusters */
+        keep_clusters =
+            count_contiguous_clusters(nb_clusters, s->cluster_size,
+                                      &l2_table[l2_index], 0,
+                                      QCOW_OFLAG_COPIED | QCOW_OFLAG_ZERO);
+        assert(keep_clusters <= nb_clusters);
+        nb_clusters -= keep_clusters;
+    } else {
+        keep_clusters = 0;
+        cluster_offset = 0;
+    }

-        start           += cur_bytes;
-        remaining       -= cur_bytes;
-        cluster_offset  += cur_bytes;
-
-        if (remaining == 0) {
-            break;
-        }
-
-        cur_bytes = remaining;
-
-        /*
-         * Now start gathering as many contiguous clusters as possible:
-         *
-         * 1. Check for overlaps with in-flight allocations
-         *
-         *      a) Overlap not in the first cluster -> shorten this request and
-         *         let the caller handle the rest in its next loop iteration.
-         *
-         *      b) Real overlaps of two requests. Yield and restart the search
-         *         for contiguous clusters (the situation could have changed
-         *         while we were sleeping)
-         *
-         *      c) TODO: Request starts in the same cluster as the in-flight
-         *         allocation ends. Shorten the COW of the in-fight allocation,
-         *         set cluster_offset to write to the same cluster and set up
-         *         the right synchronisation between the in-flight request and
-         *         the new one.
-         */
-        ret = handle_dependencies(bs, start, &cur_bytes, m);
-        if (ret == -EAGAIN) {
-            /* Currently handle_dependencies() doesn't yield if we already had
-             * an allocation. If it did, we would have to clean up the L2Meta
-             * structs before starting over. */
-            assert(*m == NULL);
-            goto again;
-        } else if (ret < 0) {
-            return ret;
-        } else if (cur_bytes == 0) {
-            break;
+    if (nb_clusters > 0) {
+        /* For the moment, overwrite compressed clusters one by one */
+        uint64_t entry = be64_to_cpu(l2_table[l2_index + keep_clusters]);
+        if (entry & QCOW_OFLAG_COMPRESSED) {
+            nb_clusters = 1;
        } else {
-            /* handle_dependencies() may have decreased cur_bytes (shortened
-             * the allocations below) so that the next dependency is processed
-             * correctly during the next loop iteration. */
-        }
-
-        /*
-         * 2. Count contiguous COPIED clusters.
-         */
-        ret = handle_copied(bs, start, &cluster_offset, &cur_bytes, m);
-        if (ret < 0) {
-            return ret;
-        } else if (ret) {
-            continue;
-        } else if (cur_bytes == 0) {
-            break;
-        }
-
-        /*
-         * 3. If the request still hasn't completed, allocate new clusters,
-         *    considering any cluster_offset of steps 1c or 2.
-         */
-        ret = handle_alloc(bs, start, &cluster_offset, &cur_bytes, m);
-        if (ret < 0) {
-            return ret;
-        } else if (ret) {
-            continue;
-        } else {
-            assert(cur_bytes == 0);
-            break;
+            nb_clusters = count_cow_clusters(s, nb_clusters, l2_table,
+                                             l2_index + keep_clusters);
        }
    }

-    *num = (n_end - n_start) - (remaining >> BDRV_SECTOR_BITS);
-    assert(*num > 0);
-    assert(*host_offset != 0);
+    cluster_offset &= L2E_OFFSET_MASK;
+
+    /*
+     * The L2 table isn't used any more after this. As long as the cache works
+     * synchronously, it's important to release it before calling
+     * do_alloc_cluster_offset, which may yield if we need to wait for another
+     * request to complete. If we still had the reference, we could use up the
+     * whole cache with sleeping requests.
+     */
+    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
+    if (ret < 0) {
+        return ret;
+    }
+
+    /* If there is something left to allocate, do that now */
+    *m = (QCowL2Meta) {
+        .cluster_offset     = cluster_offset,
+        .nb_clusters        = 0,
+    };
+    qemu_co_queue_init(&m->dependent_requests);
+
+    if (nb_clusters > 0) {
+        uint64_t alloc_offset;
+        uint64_t alloc_cluster_offset;
+        uint64_t keep_bytes = keep_clusters * s->cluster_size;
+
+        /* Calculate start and size of allocation */
+        alloc_offset = offset + keep_bytes;
+
+        if (keep_clusters == 0) {
+            alloc_cluster_offset = 0;
+        } else {
+            alloc_cluster_offset = cluster_offset + keep_bytes;
+        }
+
+        /* Allocate, if necessary at a given offset in the image file */
+        ret = do_alloc_cluster_offset(bs, alloc_offset, &alloc_cluster_offset,
+                                      &nb_clusters);
+        if (ret == -EAGAIN) {
+            goto again;
+        } else if (ret < 0) {
+            goto fail;
+        }
+
+        /* save info needed for meta data update */
+        if (nb_clusters > 0) {
+            int requested_sectors = n_end - keep_clusters * s->cluster_sectors;
+            int avail_sectors = (keep_clusters + nb_clusters)
+                                << (s->cluster_bits - BDRV_SECTOR_BITS);
+
+            *m = (QCowL2Meta) {
+                .cluster_offset = keep_clusters == 0 ?
+                                  alloc_cluster_offset : cluster_offset,
+                .alloc_offset   = alloc_cluster_offset,
+                .offset         = alloc_offset,
+                .n_start        = keep_clusters == 0 ? n_start : 0,
+                .nb_clusters    = nb_clusters,
+                .nb_available   = MIN(requested_sectors, avail_sectors),
+            };
+            qemu_co_queue_init(&m->dependent_requests);
+            QLIST_INSERT_HEAD(&s->cluster_allocs, m, next_in_flight);
+        }
+    }
+
+    /* Some cleanup work */
+    sectors = (keep_clusters + nb_clusters) << (s->cluster_bits - 9);
+    if (sectors > n_end) {
+        sectors = n_end;
+    }
+
+    assert(sectors > n_start);
+    *num = sectors - n_start;

    return 0;
+
+fail:
+    if (m->nb_clusters > 0) {
+        QLIST_REMOVE(m, next_in_flight);
+    }
+    return ret;
 }

 static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size);
@@ -201,10 +201,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    *refcount_block = NULL;

    /* We write to the refcount table, so we might depend on L2 tables */
-    ret = qcow2_cache_flush(bs, s->l2_table_cache);
-    if (ret < 0) {
-        return ret;
-    }
+    qcow2_cache_flush(bs, s->l2_table_cache);

    /* Allocate the refcount block itself and mark it as used */
    int64_t new_block = alloc_clusters_noref(bs, s->cluster_size);
@@ -240,10 +237,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
            goto fail_block;
        }

-        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
-        if (ret < 0) {
-            goto fail_block;
-        }
+        bdrv_flush(bs->file);

        /* Initialize the new refcount block only after updating its refcount,
         * update_refcount uses the refcount cache itself */
@@ -307,8 +301,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t last_table_size;
    uint64_t blocks_clusters;
    do {
-        uint64_t table_clusters =
-            size_to_clusters(s, table_size * sizeof(uint64_t));
+        uint64_t table_clusters = size_to_clusters(s, table_size);
        blocks_clusters = 1 +
            ((table_clusters + refcount_block_clusters - 1)
            / refcount_block_clusters);
@@ -532,6 +525,8 @@ static int update_cluster_refcount(BlockDriverState *bs,
        return ret;
    }

+    bdrv_flush(bs->file);
+
    return get_refcount(bs, cluster_index);
 }

@@ -632,11 +627,10 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
    assert(size > 0 && size <= s->cluster_size);
    if (s->free_byte_offset == 0) {
-        offset = qcow2_alloc_clusters(bs, s->cluster_size);
-        if (offset < 0) {
-            return offset;
+        s->free_byte_offset = qcow2_alloc_clusters(bs, s->cluster_size);
+        if (s->free_byte_offset < 0) {
+            return s->free_byte_offset;
        }
-        s->free_byte_offset = offset;
    }
 redo:
    free_in_cluster = s->cluster_size -
@@ -667,11 +661,7 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
        }
    }

-    /* The cluster refcount was incremented, either by qcow2_alloc_clusters()
-     * or explicitly by update_cluster_refcount().  Refcount blocks must be
-     * flushed before the caller's L2 table updates.
-     */
-    qcow2_cache_set_dependency(bs, s->l2_table_cache, s->refcount_block_cache);
+    bdrv_flush(bs->file);
    return offset;
 }

@@ -736,6 +726,13 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t old_offset, old_l2_offset;
    int i, j, l1_modified = 0, nb_csectors, refcount;
    int ret;
+    bool old_l2_writethrough, old_refcount_writethrough;
+
+    /* Switch caches to writeback mode during update */
+    old_l2_writethrough =
+        qcow2_cache_set_writethrough(bs, s->l2_table_cache, false);
+    old_refcount_writethrough =
+        qcow2_cache_set_writethrough(bs, s->refcount_block_cache, false);

    l2_table = NULL;
    l1_table = NULL;
@@ -745,11 +742,16 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
     * l1_table_offset when it is the current s->l1_table_offset! Be careful
     * when changing this! */
    if (l1_table_offset != s->l1_table_offset) {
-        l1_table = g_malloc0(align_offset(l1_size2, 512));
+        if (l1_size2 != 0) {
+            l1_table = g_malloc0(align_offset(l1_size2, 512));
+        } else {
+            l1_table = NULL;
+        }
        l1_allocated = 1;
-
-        ret = bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, l1_table_offset,
+                       l1_table, l1_size2) != l1_size2)
+        {
+            ret = -EIO;
            goto fail;
        }

@@ -789,6 +791,10 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                            if (ret < 0) {
                                goto fail;
                            }
+
+                            /* TODO Flushing once for the whole function should
+                             * be enough */
+                            bdrv_flush(bs->file);
                        }
                        /* compressed clusters are never modified */
                        refcount = 2;
@@ -801,7 +807,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                        }

                        if (refcount < 0) {
-                            ret = refcount;
+                            ret = -EIO;
                            goto fail;
                        }
                    }
@@ -832,7 +838,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
            }
            if (refcount < 0) {
-                ret = refcount;
+                ret = -EIO;
                goto fail;
            } else if (refcount == 1) {
                l2_offset |= QCOW_OFLAG_COPIED;
@@ -844,23 +850,26 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
        }
    }

-    ret = bdrv_flush(bs);
+    ret = 0;
 fail:
    if (l2_table) {
        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
    }

+    /* Enable writethrough cache mode again */
+    qcow2_cache_set_writethrough(bs, s->l2_table_cache, old_l2_writethrough);
+    qcow2_cache_set_writethrough(bs, s->refcount_block_cache,
+        old_refcount_writethrough);
+
    /* Update L1 only if it isn't deleted anyway (addend = -1) */
-    if (ret == 0 && addend >= 0 && l1_modified) {
-        for (i = 0; i < l1_size; i++) {
+    if (addend >= 0 && l1_modified) {
+        for(i = 0; i < l1_size; i++)
            cpu_to_be64s(&l1_table[i]);
-        }
-
-        ret = bdrv_pwrite_sync(bs->file, l1_table_offset, l1_table, l1_size2);
-
-        for (i = 0; i < l1_size; i++) {
+        if (bdrv_pwrite_sync(bs->file, l1_table_offset, l1_table,
+                        l1_size2) < 0)
+            goto fail;
+        for(i = 0; i < l1_size; i++)
            be64_to_cpus(&l1_table[i]);
-        }
    }
    if (l1_allocated)
        g_free(l1_table);
@@ -919,12 +928,6 @@ static void inc_refcounts(BlockDriverState *bs,
    }
 }

-/* Flags for check_refcounts_l1() and check_refcounts_l2() */
-enum {
-    CHECK_OFLAG_COPIED = 0x1,   /* check QCOW_OFLAG_COPIED matches refcount */
-    CHECK_FRAG_INFO = 0x2,      /* update BlockFragInfo counters */
-};
-
 /*
 * Increases the refcount in the given refcount table for the all clusters
 * referenced in the L2 table. While doing so, performs some checks on L2
@@ -935,11 +938,10 @@ enum {
 */
 static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
    uint16_t *refcount_table, int refcount_table_size, int64_t l2_offset,
-    int flags)
+    int check_copied)
 {
    BDRVQcowState *s = bs->opaque;
    uint64_t *l2_table, l2_entry;
-    uint64_t next_contiguous_offset = 0;
    int i, l2_size, nb_csectors, refcount;

    /* Read L2 table from disk */
@@ -970,18 +972,6 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            l2_entry &= s->cluster_offset_mask;
            inc_refcounts(bs, res, refcount_table, refcount_table_size,
                l2_entry & ~511, nb_csectors * 512);
-
-            if (flags & CHECK_FRAG_INFO) {
-                res->bfi.allocated_clusters++;
-                res->bfi.compressed_clusters++;
-
-                /* Compressed clusters are fragmented by nature.  Since they
-                 * take up sub-sector space but we only have sector granularity
-                 * I/O we need to re-read the same sectors even for adjacent
-                 * compressed clusters.
-                 */
-                res->bfi.fragmented_clusters++;
-            }
            break;

        case QCOW2_CLUSTER_ZERO:
@@ -995,7 +985,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
            uint64_t offset = l2_entry & L2E_OFFSET_MASK;

-            if (flags & CHECK_OFLAG_COPIED) {
+            if (check_copied) {
                refcount = get_refcount(bs, offset >> s->cluster_bits);
                if (refcount < 0) {
                    fprintf(stderr, "Can't get refcount for offset %"
@@ -1009,15 +999,6 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
                }
            }

-            if (flags & CHECK_FRAG_INFO) {
-                res->bfi.allocated_clusters++;
-                if (next_contiguous_offset &&
-                    offset != next_contiguous_offset) {
-                    res->bfi.fragmented_clusters++;
-                }
-                next_contiguous_offset = offset + s->cluster_size;
-            }
-
            /* Mark cluster as used */
            inc_refcounts(bs, res, refcount_table,refcount_table_size,
                offset, s->cluster_size);
@@ -1061,7 +1042,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
                              uint16_t *refcount_table,
                              int refcount_table_size,
                              int64_t l1_table_offset, int l1_size,
-                              int flags)
+                              int check_copied)
 {
    BDRVQcowState *s = bs->opaque;
    uint64_t *l1_table, l2_offset, l1_size2;
@@ -1090,7 +1071,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
        l2_offset = l1_table[i];
        if (l2_offset) {
            /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
-            if (flags & CHECK_OFLAG_COPIED) {
+            if (check_copied) {
                refcount = get_refcount(bs, (l2_offset & ~QCOW_OFLAG_COPIED)
                    >> s->cluster_bits);
                if (refcount < 0) {
@@ -1119,7 +1100,7 @@ static int check_refcounts_l1(BlockDriverState *bs,

            /* Process and check L2 entries */
            ret = check_refcounts_l2(bs, res, refcount_table,
-                                     refcount_table_size, l2_offset, flags);
+                refcount_table_size, l2_offset, check_copied);
            if (ret < 0) {
                goto fail;
            }
@@ -1141,12 +1122,11 @@ fail:
 * Returns 0 if no errors are found, the number of errors in case the image is
 * detected as corrupted, and -errno when an internal error occurred.
 */
-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix)
+int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
 {
    BDRVQcowState *s = bs->opaque;
-    int64_t size, i, highest_cluster;
-    int nb_clusters, refcount1, refcount2;
+    int64_t size;
+    int nb_clusters, refcount1, refcount2, i;
    QCowSnapshot *sn;
    uint16_t *refcount_table;
    int ret;
@@ -1155,17 +1135,13 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    nb_clusters = size_to_clusters(s, size);
    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));

-    res->bfi.total_clusters =
-        size_to_clusters(s, bs->total_sectors * BDRV_SECTOR_SIZE);
-
    /* header */
    inc_refcounts(bs, res, refcount_table, nb_clusters,
        0, s->cluster_size);

    /* current L1 table */
    ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
-                             s->l1_table_offset, s->l1_size,
-                             CHECK_OFLAG_COPIED | CHECK_FRAG_INFO);
+                       s->l1_table_offset, s->l1_size, 1);
    if (ret < 0) {
        goto fail;
    }
@@ -1194,15 +1170,14 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,

        /* Refcount blocks are cluster aligned */
        if (offset & (s->cluster_size - 1)) {
-            fprintf(stderr, "ERROR refcount block %" PRId64 " is not "
+            fprintf(stderr, "ERROR refcount block %d is not "
                "cluster aligned; refcount table entry corrupted\n", i);
            res->corruptions++;
            continue;
        }

        if (cluster >= nb_clusters) {
-            fprintf(stderr, "ERROR refcount block %" PRId64
-                    " is outside image\n", i);
+            fprintf(stderr, "ERROR refcount block %d is outside image\n", i);
            res->corruptions++;
            continue;
        }
@@ -1211,8 +1186,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
            inc_refcounts(bs, res, refcount_table, nb_clusters,
                offset, s->cluster_size);
            if (refcount_table[cluster] != 1) {
-                fprintf(stderr, "ERROR refcount block %" PRId64
-                    " refcount=%d\n",
+                fprintf(stderr, "ERROR refcount block %d refcount=%d\n",
                    i, refcount_table[cluster]);
                res->corruptions++;
            }
@@ -1220,47 +1194,20 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    }

    /* compare ref counts */
-    for (i = 0, highest_cluster = 0; i < nb_clusters; i++) {
+    for(i = 0; i < nb_clusters; i++) {
        refcount1 = get_refcount(bs, i);
        if (refcount1 < 0) {
-            fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
+            fprintf(stderr, "Can't get refcount for cluster %d: %s\n",
                i, strerror(-refcount1));
            res->check_errors++;
            continue;
        }

        refcount2 = refcount_table[i];
-
-        if (refcount1 > 0 || refcount2 > 0) {
-            highest_cluster = i;
-        }
-
        if (refcount1 != refcount2) {
-
-            /* Check if we're allowed to fix the mismatch */
-            int *num_fixed = NULL;
-            if (refcount1 > refcount2 && (fix & BDRV_FIX_LEAKS)) {
-                num_fixed = &res->leaks_fixed;
-            } else if (refcount1 < refcount2 && (fix & BDRV_FIX_ERRORS)) {
-                num_fixed = &res->corruptions_fixed;
-            }
-
-            fprintf(stderr, "%s cluster %" PRId64 " refcount=%d reference=%d\n",
-                   num_fixed != NULL     ? "Repairing" :
-                   refcount1 < refcount2 ? "ERROR" :
-                                           "Leaked",
+            fprintf(stderr, "%s cluster %d refcount=%d reference=%d\n",
+                   refcount1 < refcount2 ? "ERROR" : "Leaked",
                   i, refcount1, refcount2);
-
-            if (num_fixed) {
-                ret = update_refcount(bs, i << s->cluster_bits, 1,
-                                      refcount2 - refcount1);
-                if (ret >= 0) {
-                    (*num_fixed)++;
-                    continue;
-                }
-            }
-
-            /* And if we couldn't, print an error */
            if (refcount1 < refcount2) {
                res->corruptions++;
            } else {
@@ -1269,7 +1216,6 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
        }
    }

-    res->image_end_offset = (highest_cluster + 1) * s->cluster_size;
    ret = 0;

 fail:
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 typedef struct QEMU_PACKED QCowSnapshotHeader {
@@ -180,14 +180,11 @@ static int qcow2_write_snapshots(BlockDriverState *bs)

    /* Allocate space for the new snapshot list */
    snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
+    bdrv_flush(bs->file);
    offset = snapshots_offset;
    if (offset < 0) {
        return offset;
    }
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        return ret;
-    }

    /* Write all snapshots to the new list */
    for(i = 0; i < s->nb_snapshots; i++) {
@@ -381,6 +378,11 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        goto fail;
    }

+    ret = bdrv_flush(bs);
+    if (ret < 0) {
+        goto fail;
+    }
+
    /* Append the new snapshot to the snapshot list */
    new_snapshot_list = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
    if (s->snapshots) {
@@ -403,7 +405,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 #ifdef DEBUG_ALLOC
    {
      BdrvCheckResult result = {0};
-      qcow2_check_refcounts(bs, &result, 0);
+      qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
@@ -520,7 +522,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 #ifdef DEBUG_ALLOC
    {
        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result, 0);
+        qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
@@ -580,7 +582,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
 #ifdef DEBUG_ALLOC
    {
        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result, 0);
+        qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -22,14 +22,13 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>
-#include "qemu/aes.h"
+#include "aes.h"
 #include "block/qcow2.h"
-#include "qemu/error-report.h"
-#include "qapi/qmp/qerror.h"
-#include "qapi/qmp/qbool.h"
+#include "qemu-error.h"
+#include "qerror.h"
 #include "trace.h"

 /*
@@ -53,7 +52,6 @@ typedef struct {
    uint32_t magic;
    uint32_t len;
 } QCowExtension;
-
 #define  QCOW2_EXT_MAGIC_END 0
 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xE2792ACA
 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
@@ -216,98 +214,13 @@ static void report_unsupported_feature(BlockDriverState *bs,
    }
 }

-/*
- * Sets the dirty bit and flushes afterwards if necessary.
- *
- * The incompatible_features bit is only set if the image file header was
- * updated successfully.  Therefore it is not required to check the return
- * value of this function.
- */
-int qcow2_mark_dirty(BlockDriverState *bs)
-{
-    BDRVQcowState *s = bs->opaque;
-    uint64_t val;
-    int ret;
-
-    assert(s->qcow_version >= 3);
-
-    if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
-        return 0; /* already dirty */
-    }
-
-    val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
-    ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
-                      &val, sizeof(val));
-    if (ret < 0) {
-        return ret;
-    }
-    ret = bdrv_flush(bs->file);
-    if (ret < 0) {
-        return ret;
-    }
-
-    /* Only treat image as dirty if the header was updated successfully */
-    s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
-    return 0;
-}
-
-/*
- * Clears the dirty bit and flushes before if necessary.  Only call this
- * function when there are no pending requests, it does not guard against
- * concurrent requests dirtying the image.
- */
-static int qcow2_mark_clean(BlockDriverState *bs)
-{
-    BDRVQcowState *s = bs->opaque;
-
-    if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
-        int ret = bdrv_flush(bs);
-        if (ret < 0) {
-            return ret;
-        }
-
-        s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
-        return qcow2_update_header(bs);
-    }
-    return 0;
-}
-
-static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result,
-                       BdrvCheckMode fix)
-{
-    int ret = qcow2_check_refcounts(bs, result, fix);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (fix && result->check_errors == 0 && result->corruptions == 0) {
-        return qcow2_mark_clean(bs);
-    }
-    return ret;
-}
-
-static QemuOptsList qcow2_runtime_opts = {
-    .name = "qcow2",
-    .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
-    .desc = {
-        {
-            .name = "lazy_refcounts",
-            .type = QEMU_OPT_BOOL,
-            .help = "Postpone refcount updates",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
+static int qcow2_open(BlockDriverState *bs, int flags)
 {
    BDRVQcowState *s = bs->opaque;
    int len, i, ret = 0;
    QCowHeader header;
-    QemuOpts *opts;
-    Error *local_err = NULL;
    uint64_t ext_end;
-    uint64_t l1_vm_state_index;
+    bool writethrough;

    ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
    if (ret < 0) {
@@ -328,7 +241,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
    be32_to_cpus(&header.nb_snapshots);

    if (header.magic != QCOW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }
    if (header.version < 2 || header.version > 3) {
@@ -375,13 +288,12 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
    s->compatible_features      = header.compatible_features;
    s->autoclear_features       = header.autoclear_features;

-    if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
+    if (s->incompatible_features != 0) {
        void *feature_table = NULL;
        qcow2_read_extensions(bs, header.header_length, ext_end,
                              &feature_table);
        report_unsupported_feature(bs, feature_table,
-                                   s->incompatible_features &
-                                   ~QCOW2_INCOMPAT_MASK);
+                                   s->incompatible_features);
        ret = -ENOTSUP;
        goto fail;
    }
@@ -425,14 +337,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)

    /* read the level 1 table */
    s->l1_size = header.l1_size;
-
-    l1_vm_state_index = size_to_l1(s, header.size);
-    if (l1_vm_state_index > INT_MAX) {
-        ret = -EFBIG;
-        goto fail;
-    }
-    s->l1_vm_state_index = l1_vm_state_index;
-
+    s->l1_vm_state_index = size_to_l1(s, header.size);
    /* the L1 table must contain at least enough entries to put
       header.size bytes */
    if (s->l1_size < s->l1_vm_state_index) {
@@ -454,8 +359,10 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
    }

    /* alloc L2 table/refcount block cache */
-    s->l2_table_cache = qcow2_cache_create(bs, L2_CACHE_SIZE);
-    s->refcount_block_cache = qcow2_cache_create(bs, REFCOUNT_CACHE_SIZE);
+    writethrough = ((flags & BDRV_O_CACHE_WB) == 0);
+    s->l2_table_cache = qcow2_cache_create(bs, L2_CACHE_SIZE, writethrough);
+    s->refcount_block_cache = qcow2_cache_create(bs, REFCOUNT_CACHE_SIZE,
+        writethrough);

    s->cluster_cache = g_malloc(s->cluster_size);
    /* one more sector for decompressed data alignment */
@@ -508,43 +415,10 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags)
    /* Initialise locks */
    qemu_co_mutex_init(&s->lock);

-    /* Repair image if dirty */
-    if (!(flags & BDRV_O_CHECK) && !bs->read_only &&
-        (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
-        BdrvCheckResult result = {0};
-
-        ret = qcow2_check(bs, &result, BDRV_FIX_ERRORS);
-        if (ret < 0) {
-            goto fail;
-        }
-    }
-
-    /* Enable lazy_refcounts according to image and command line options */
-    opts = qemu_opts_create_nofail(&qcow2_runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    s->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
-        (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
-
-    qemu_opts_del(opts);
-
-    if (s->use_lazy_refcounts && s->qcow_version < 3) {
-        qerror_report(ERROR_CLASS_GENERIC_ERROR, "Lazy refcounts require "
-            "a qcow2 image with at least qemu 1.1 compatibility level");
-        ret = -EINVAL;
-        goto fail;
-    }
-
 #ifdef DEBUG_ALLOC
    {
        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result, 0);
+        qcow2_check_refcounts(bs, &result);
    }
 #endif
    return ret;
@@ -605,14 +479,6 @@ static int qcow2_set_key(BlockDriverState *bs, const char *key)
    return 0;
 }

-/* We have nothing to do for QCOW2 reopen, stubs just return
- * success */
-static int qcow2_reopen_prepare(BDRVReopenState *state,
-                                BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
-}
-
 static int coroutine_fn qcow2_co_is_allocated(BlockDriverState *bs,
        int64_t sector_num, int nb_sectors, int *pnum)
 {
@@ -630,7 +496,7 @@ static int coroutine_fn qcow2_co_is_allocated(BlockDriverState *bs,
        *pnum = 0;
    }

-    return (cluster_offset != 0) || (ret == QCOW2_CLUSTER_ZERO);
+    return (cluster_offset != 0);
 }

 /* handle reading after the end of the backing file */
@@ -645,7 +511,7 @@ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
    else
        n1 = bs->total_sectors - sector_num;

-    qemu_iovec_memset(qiov, 512 * n1, 0, 512 * (nb_sectors - n1));
+    qemu_iovec_memset_skip(qiov, 0, 512 * (nb_sectors - n1), 512 * n1);

    return n1;
 }
@@ -684,7 +550,7 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
        index_in_cluster = sector_num & (s->cluster_sectors - 1);

        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
+        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
            cur_nr_sectors * 512);

        switch (ret) {
@@ -706,12 +572,16 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
                }
            } else {
                /* Note: in this case, no need to wait */
-                qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
+                qemu_iovec_memset(&hd_qiov, 0, 512 * cur_nr_sectors);
            }
            break;

        case QCOW2_CLUSTER_ZERO:
-            qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
+            if (s->qcow_version < 3) {
+                ret = -EIO;
+                goto fail;
+            }
+            qemu_iovec_memset(&hd_qiov, 0, 512 * cur_nr_sectors);
            break;

        case QCOW2_CLUSTER_COMPRESSED:
@@ -721,7 +591,7 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
                goto fail;
            }

-            qemu_iovec_from_buf(&hd_qiov, 0,
+            qemu_iovec_from_buffer(&hd_qiov,
                s->cluster_cache + index_in_cluster * 512,
                512 * cur_nr_sectors);
            break;
@@ -761,8 +631,11 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
            if (s->crypt_method) {
                qcow2_encrypt_sectors(s, sector_num,  cluster_data,
                    cluster_data, cur_nr_sectors, 0, &s->aes_decrypt_key);
-                qemu_iovec_from_buf(qiov, bytes_done,
-                    cluster_data, 512 * cur_nr_sectors);
+                qemu_iovec_reset(&hd_qiov);
+                qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
+                    cur_nr_sectors * 512);
+                qemu_iovec_from_buffer(&hd_qiov, cluster_data,
+                    512 * cur_nr_sectors);
            }
            break;

@@ -787,6 +660,21 @@ fail:
    return ret;
 }

+static void run_dependent_requests(BDRVQcowState *s, QCowL2Meta *m)
+{
+    /* Take the request off the list of running requests */
+    if (m->nb_clusters != 0) {
+        QLIST_REMOVE(m, next_in_flight);
+    }
+
+    /* Restart all dependent requests */
+    if (!qemu_co_queue_empty(&m->dependent_requests)) {
+        qemu_co_mutex_unlock(&s->lock);
+        qemu_co_queue_restart_all(&m->dependent_requests);
+        qemu_co_mutex_lock(&s->lock);
+    }
+}
+
 static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
                           int64_t sector_num,
                           int remaining_sectors,
@@ -801,11 +689,15 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
    QEMUIOVector hd_qiov;
    uint64_t bytes_done = 0;
    uint8_t *cluster_data = NULL;
-    QCowL2Meta *l2meta = NULL;
+    QCowL2Meta l2meta = {
+        .nb_clusters = 0,
+    };

    trace_qcow2_writev_start_req(qemu_coroutine_self(), sector_num,
                                 remaining_sectors);

+    qemu_co_queue_init(&l2meta.dependent_requests);
+
    qemu_iovec_init(&hd_qiov, qiov->niov);

    s->cluster_cache_offset = -1; /* disable compressed cache */
@@ -814,8 +706,6 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,

    while (remaining_sectors != 0) {

-        l2meta = NULL;
-
        trace_qcow2_writev_start_part(qemu_coroutine_self());
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
        n_end = index_in_cluster + remaining_sectors;
@@ -825,15 +715,16 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
        }

        ret = qcow2_alloc_cluster_offset(bs, sector_num << 9,
-            index_in_cluster, n_end, &cur_nr_sectors, &cluster_offset, &l2meta);
+            index_in_cluster, n_end, &cur_nr_sectors, &l2meta);
        if (ret < 0) {
            goto fail;
        }

+        cluster_offset = l2meta.cluster_offset;
        assert((cluster_offset & 511) == 0);

        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_concat(&hd_qiov, qiov, bytes_done,
+        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
            cur_nr_sectors * 512);

        if (s->crypt_method) {
@@ -844,7 +735,7 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,

            assert(hd_qiov.size <=
                   QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-            qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size);
+            qemu_iovec_to_buffer(&hd_qiov, cluster_data);

            qcow2_encrypt_sectors(s, sector_num, cluster_data,
                cluster_data, cur_nr_sectors, 1, &s->aes_encrypt_key);
@@ -854,8 +745,8 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
                cur_nr_sectors * 512);
        }

-        qemu_co_mutex_unlock(&s->lock);
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+        qemu_co_mutex_unlock(&s->lock);
        trace_qcow2_writev_data(qemu_coroutine_self(),
                                (cluster_offset >> 9) + index_in_cluster);
        ret = bdrv_co_writev(bs->file,
@@ -866,26 +757,13 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
            goto fail;
        }

-        while (l2meta != NULL) {
-            QCowL2Meta *next;
-
-            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
-            if (ret < 0) {
-                goto fail;
-            }
-
-            /* Take the request off the list of running requests */
-            if (l2meta->nb_clusters != 0) {
-                QLIST_REMOVE(l2meta, next_in_flight);
-            }
-
-            qemu_co_queue_restart_all(&l2meta->dependent_requests);
-
-            next = l2meta->next;
-            g_free(l2meta);
-            l2meta = next;
+        ret = qcow2_alloc_cluster_link_l2(bs, &l2meta);
+        if (ret < 0) {
+            goto fail;
        }

+        run_dependent_requests(s, &l2meta);
+
        remaining_sectors -= cur_nr_sectors;
        sector_num += cur_nr_sectors;
        bytes_done += cur_nr_sectors * 512;
@@ -894,21 +772,10 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
    ret = 0;

 fail:
+    run_dependent_requests(s, &l2meta);
+
    qemu_co_mutex_unlock(&s->lock);

-    while (l2meta != NULL) {
-        QCowL2Meta *next;
-
-        if (l2meta->nb_clusters != 0) {
-            QLIST_REMOVE(l2meta, next_in_flight);
-        }
-        qemu_co_queue_restart_all(&l2meta->dependent_requests);
-
-        next = l2meta->next;
-        g_free(l2meta);
-        l2meta = next;
-    }
-
    qemu_iovec_destroy(&hd_qiov);
    qemu_vfree(cluster_data);
    trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
@@ -924,8 +791,6 @@ static void qcow2_close(BlockDriverState *bs)
    qcow2_cache_flush(bs, s->l2_table_cache);
    qcow2_cache_flush(bs, s->refcount_block_cache);

-    qcow2_mark_clean(bs);
-
    qcow2_cache_destroy(bs, s->l2_table_cache);
    qcow2_cache_destroy(bs, s->refcount_block_cache);

@@ -945,7 +810,6 @@ static void qcow2_invalidate_cache(BlockDriverState *bs)
    AES_KEY aes_encrypt_key;
    AES_KEY aes_decrypt_key;
    uint32_t crypt_method = 0;
-    QDict *options;

    /*
     * Backing files are read-only which makes all of their metadata immutable,
@@ -960,14 +824,8 @@ static void qcow2_invalidate_cache(BlockDriverState *bs)

    qcow2_close(bs);

-    options = qdict_new();
-    qdict_put(options, QCOW2_OPT_LAZY_REFCOUNTS,
-              qbool_from_int(s->use_lazy_refcounts));
-
    memset(s, 0, sizeof(BDRVQcowState));
-    qcow2_open(bs, options, flags);
-
-    QDECREF(options);
+    qcow2_open(bs, flags);

    if (crypt_method) {
        s->crypt_method = crypt_method;
@@ -1097,16 +955,7 @@ int qcow2_update_header(BlockDriverState *bs)

    /* Feature table */
    Qcow2Feature features[] = {
-        {
-            .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
-            .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
-            .name = "dirty bit",
-        },
-        {
-            .type = QCOW2_FEAT_TYPE_COMPATIBLE,
-            .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
-            .name = "lazy refcounts",
-        },
+        /* no feature defined yet */
    };

    ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
@@ -1146,7 +995,6 @@ int qcow2_update_header(BlockDriverState *bs)
            goto fail;
        }

-        /* Using strncpy is ok here, since buf is not NUL-terminated. */
        strncpy(buf, bs->backing_file, buflen);

        header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
@@ -1178,33 +1026,31 @@ static int preallocate(BlockDriverState *bs)
 {
    uint64_t nb_sectors;
    uint64_t offset;
-    uint64_t host_offset = 0;
    int num;
    int ret;
-    QCowL2Meta *meta;
+    QCowL2Meta meta;

    nb_sectors = bdrv_getlength(bs) >> 9;
    offset = 0;
+    qemu_co_queue_init(&meta.dependent_requests);
+    meta.cluster_offset = 0;

    while (nb_sectors) {
        num = MIN(nb_sectors, INT_MAX >> 9);
-        ret = qcow2_alloc_cluster_offset(bs, offset, 0, num, &num,
-                                         &host_offset, &meta);
+        ret = qcow2_alloc_cluster_offset(bs, offset, 0, num, &num, &meta);
        if (ret < 0) {
            return ret;
        }

-        ret = qcow2_alloc_cluster_link_l2(bs, meta);
+        ret = qcow2_alloc_cluster_link_l2(bs, &meta);
        if (ret < 0) {
-            qcow2_free_any_clusters(bs, meta->alloc_offset, meta->nb_clusters);
+            qcow2_free_any_clusters(bs, meta.cluster_offset, meta.nb_clusters);
            return ret;
        }

        /* There are no dependent requests, but we need to remove our request
         * from the list of in-flight requests */
-        if (meta != NULL) {
-            QLIST_REMOVE(meta, next_in_flight);
-        }
+        run_dependent_requests(bs->opaque, &meta);

        /* TODO Preallocate data if requested */

@@ -1217,10 +1063,10 @@ static int preallocate(BlockDriverState *bs)
     * all of the allocated clusters (otherwise we get failing reads after
     * EOF). Extend the image to the last allocated sector.
     */
-    if (host_offset != 0) {
+    if (meta.cluster_offset != 0) {
        uint8_t buf[512];
        memset(buf, 0, 512);
-        ret = bdrv_write(bs->file, (host_offset >> 9) + num - 1, buf, 1);
+        ret = bdrv_write(bs->file, (meta.cluster_offset >> 9) + num - 1, buf, 1);
        if (ret < 0) {
            return ret;
        }
@@ -1268,7 +1114,7 @@ static int qcow2_create2(const char *filename, int64_t total_size,
        return ret;
    }

-    ret = bdrv_file_open(&bs, filename, NULL, BDRV_O_RDWR);
+    ret = bdrv_file_open(&bs, filename, BDRV_O_RDWR);
    if (ret < 0) {
        return ret;
    }
@@ -1292,11 +1138,6 @@ static int qcow2_create2(const char *filename, int64_t total_size,
        header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
    }

-    if (flags & BLOCK_FLAG_LAZY_REFCOUNTS) {
-        header.compatible_features |=
-            cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
-    }
-
    ret = bdrv_pwrite(bs, 0, &header, sizeof(header));
    if (ret < 0) {
        goto out;
@@ -1320,7 +1161,7 @@ static int qcow2_create2(const char *filename, int64_t total_size,
     */
    BlockDriver* drv = bdrv_find_format("qcow2");
    assert(drv != NULL);
-    ret = bdrv_open(bs, filename, NULL,
+    ret = bdrv_open(bs, filename,
        BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH, drv);
    if (ret < 0) {
        goto out;
@@ -1410,8 +1251,6 @@ static int qcow2_create(const char *filename, QEMUOptionParameter *options)
                    options->value.s);
                return -EINVAL;
            }
-        } else if (!strcmp(options->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
-            flags |= options->value.n ? BLOCK_FLAG_LAZY_REFCOUNTS : 0;
        }
        options++;
    }
@@ -1422,12 +1261,6 @@ static int qcow2_create(const char *filename, QEMUOptionParameter *options)
        return -EINVAL;
    }

-    if (version < 3 && (flags & BLOCK_FLAG_LAZY_REFCOUNTS)) {
-        fprintf(stderr, "Lazy refcounts only supported with compatibility "
-                "level 1.1 and above (use compat=1.1 or greater)\n");
-        return -EINVAL;
-    }
-
    return qcow2_create2(filename, sectors, backing_file, backing_fmt, flags,
                         cluster_size, prealloc, options, version);
 }
@@ -1488,8 +1321,7 @@ static coroutine_fn int qcow2_co_discard(BlockDriverState *bs,
 static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVQcowState *s = bs->opaque;
-    int64_t new_l1_size;
-    int ret;
+    int ret, new_l1_size;

    if (offset & 511) {
        error_report("The new size must be a multiple of 512");
@@ -1546,21 +1378,8 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
        return 0;
    }

-    if (nb_sectors != s->cluster_sectors) {
-        ret = -EINVAL;
-
-        /* Zero-pad last write if image size is not cluster aligned */
-        if (sector_num + nb_sectors == bs->total_sectors &&
-            nb_sectors < s->cluster_sectors) {
-            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
-            memset(pad_buf, 0, s->cluster_size);
-            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
-            ret = qcow2_write_compressed(bs, sector_num,
-                                         pad_buf, s->cluster_sectors);
-            qemu_vfree(pad_buf);
-        }
-        return ret;
-    }
+    if (nb_sectors != s->cluster_sectors)
+        return -EINVAL;

    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);

@@ -1628,12 +1447,10 @@ static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
        return ret;
    }

-    if (qcow2_need_accurate_refcounts(s)) {
-        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
-        if (ret < 0) {
-            qemu_co_mutex_unlock(&s->lock);
-            return ret;
-        }
+    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
+    if (ret < 0) {
+        qemu_co_mutex_unlock(&s->lock);
+        return ret;
    }
    qemu_co_mutex_unlock(&s->lock);

@@ -1653,6 +1470,12 @@ static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return 0;
 }

+
+static int qcow2_check(BlockDriverState *bs, BdrvCheckResult *result)
+{
+    return qcow2_check_refcounts(bs, result);
+}
+
 #if 0
 static void dump_refcounts(BlockDriverState *bs)
 {
@@ -1674,8 +1497,8 @@ static void dump_refcounts(BlockDriverState *bs)
 }
 #endif

-static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
-                              int64_t pos)
+static int qcow2_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
+                              int64_t pos, int size)
 {
    BDRVQcowState *s = bs->opaque;
    int growable = bs->growable;
@@ -1683,7 +1506,7 @@ static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,

    BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
    bs->growable = 1;
-    ret = bdrv_pwritev(bs, qcow2_vm_state_offset(s) + pos, qiov);
+    ret = bdrv_pwrite(bs, qcow2_vm_state_offset(s) + pos, buf, size);
    bs->growable = growable;

    return ret;
@@ -1741,11 +1564,6 @@ static QEMUOptionParameter qcow2_create_options[] = {
        .type = OPT_STRING,
        .help = "Preallocation mode (allowed values: off, metadata)"
    },
-    {
-        .name = BLOCK_OPT_LAZY_REFCOUNTS,
-        .type = OPT_FLAG,
-        .help = "Postpone refcount updates",
-    },
    { NULL }
 };

@@ -1755,7 +1573,6 @@ static BlockDriver bdrv_qcow2 = {
    .bdrv_probe         = qcow2_probe,
    .bdrv_open          = qcow2_open,
    .bdrv_close         = qcow2_close,
-    .bdrv_reopen_prepare  = qcow2_reopen_prepare,
    .bdrv_create        = qcow2_create,
    .bdrv_co_is_allocated = qcow2_co_is_allocated,
    .bdrv_set_key       = qcow2_set_key,
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -25,8 +25,8 @@
 #ifndef BLOCK_QCOW2_H
 #define BLOCK_QCOW2_H

-#include "qemu/aes.h"
-#include "block/coroutine.h"
+#include "aes.h"
+#include "qemu-coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -58,9 +58,6 @@

 #define DEFAULT_CLUSTER_SIZE 65536

-
-#define QCOW2_OPT_LAZY_REFCOUNTS "lazy_refcounts"
-
 typedef struct QCowHeader {
    uint32_t magic;
    uint32_t version;
@@ -113,22 +110,6 @@ enum {
    QCOW2_FEAT_TYPE_AUTOCLEAR       = 2,
 };

-/* Incompatible feature bits */
-enum {
-    QCOW2_INCOMPAT_DIRTY_BITNR   = 0,
-    QCOW2_INCOMPAT_DIRTY         = 1 << QCOW2_INCOMPAT_DIRTY_BITNR,
-
-    QCOW2_INCOMPAT_MASK          = QCOW2_INCOMPAT_DIRTY,
-};
-
-/* Compatible feature bits */
-enum {
-    QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR = 0,
-    QCOW2_COMPAT_LAZY_REFCOUNTS       = 1 << QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
-
-    QCOW2_COMPAT_FEAT_MASK            = QCOW2_COMPAT_LAZY_REFCOUNTS,
-};
-
 typedef struct Qcow2Feature {
    uint8_t type;
    uint8_t bit;
@@ -176,7 +157,6 @@ typedef struct BDRVQcowState {

    int flags;
    int qcow_version;
-    bool use_lazy_refcounts;

    uint64_t incompatible_features;
    uint64_t compatible_features;
@@ -200,59 +180,17 @@ typedef struct QCowCreateState {

 struct QCowAIOCB;

-typedef struct Qcow2COWRegion {
-    /**
-     * Offset of the COW region in bytes from the start of the first cluster
-     * touched by the request.
-     */
-    uint64_t    offset;
-
-    /** Number of sectors to copy */
-    int         nb_sectors;
-} Qcow2COWRegion;
-
-/**
- * Describes an in-flight (part of a) write request that writes to clusters
- * that are not referenced in their L2 table yet.
- */
+/* XXX This could be private for qcow2-cluster.c */
 typedef struct QCowL2Meta
 {
-    /** Guest offset of the first newly allocated cluster */
    uint64_t offset;
-
-    /** Host offset of the first newly allocated cluster */
+    uint64_t cluster_offset;
    uint64_t alloc_offset;
-
-    /**
-     * Number of sectors from the start of the first allocated cluster to
-     * the end of the (possibly shortened) request
-     */
+    int n_start;
    int nb_available;
-
-    /** Number of newly allocated clusters */
    int nb_clusters;
-
-    /**
-     * Requests that overlap with this allocation and wait to be restarted
-     * when the allocating request has completed.
-     */
    CoQueue dependent_requests;

-    /**
-     * The COW Region between the start of the first allocated cluster and the
-     * area the guest actually writes to.
-     */
-    Qcow2COWRegion cow_start;
-
-    /**
-     * The COW Region between the area the guest actually writes to and the
-     * end of the last allocated cluster.
-     */
-    Qcow2COWRegion cow_end;
-
-    /** Pointer to next L2Meta of the same write request */
-    struct QCowL2Meta *next;
-
    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;

@@ -269,32 +207,17 @@ enum {

 #define REFT_OFFSET_MASK 0xffffffffffffff00ULL

-static inline int64_t start_of_cluster(BDRVQcowState *s, int64_t offset)
-{
-    return offset & ~(s->cluster_size - 1);
-}
-
-static inline int64_t offset_into_cluster(BDRVQcowState *s, int64_t offset)
-{
-    return offset & (s->cluster_size - 1);
-}
-
 static inline int size_to_clusters(BDRVQcowState *s, int64_t size)
 {
    return (size + (s->cluster_size - 1)) >> s->cluster_bits;
 }

-static inline int64_t size_to_l1(BDRVQcowState *s, int64_t size)
+static inline int size_to_l1(BDRVQcowState *s, int64_t size)
 {
    int shift = s->cluster_bits + s->l2_bits;
    return (size + (1ULL << shift) - 1) >> shift;
 }

-static inline int offset_to_l2_index(BDRVQcowState *s, int64_t offset)
-{
-    return (offset >> s->cluster_bits) & (s->l2_size - 1);
-}
-
 static inline int64_t align_offset(int64_t offset, int n)
 {
    offset = (offset + n - 1) & ~(n - 1);
@@ -314,30 +237,12 @@ static inline int qcow2_get_cluster_type(uint64_t l2_entry)
    }
 }

-/* Check whether refcounts are eager or lazy */
-static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
-{
-    return !(s->incompatible_features & QCOW2_INCOMPAT_DIRTY);
-}
-
-static inline uint64_t l2meta_cow_start(QCowL2Meta *m)
-{
-    return m->offset + m->cow_start.offset;
-}
-
-static inline uint64_t l2meta_cow_end(QCowL2Meta *m)
-{
-    return m->offset + m->cow_end.offset
-        + (m->cow_end.nb_sectors << BDRV_SECTOR_BITS);
-}

 // FIXME Need qcow2_ prefix to global functions

 /* qcow2.c functions */
 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors);
-
-int qcow2_mark_dirty(BlockDriverState *bs);
 int qcow2_update_header(BlockDriverState *bs);

 /* qcow2-refcount.c functions */
@@ -356,12 +261,10 @@ void qcow2_free_any_clusters(BlockDriverState *bs,
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend);

-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix);
+int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res);

 /* qcow2-cluster.c functions */
-int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
-                        bool exact_size);
+int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size);
 void qcow2_l2_cache_reset(BlockDriverState *bs);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
@@ -372,7 +275,7 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *cluster_offset);
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
-    int n_start, int n_end, int *num, uint64_t *host_offset, QCowL2Meta **m);
+    int n_start, int n_end, int *num, QCowL2Meta *m);
 uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
                                         uint64_t offset,
                                         int compressed_size);
@@ -393,8 +296,11 @@ void qcow2_free_snapshots(BlockDriverState *bs);
 int qcow2_read_snapshots(BlockDriverState *bs);

 /* qcow2-cache.c functions */
-Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables);
+Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
+    bool writethrough);
 int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c);
+bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
+    bool enable);

 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table);
 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c);
--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -87,7 +87,6 @@ static unsigned int qed_check_l2_table(QEDCheck *check, QEDTable *table)
        if (!qed_check_cluster_offset(s, offset)) {
            if (check->fix) {
                table->offsets[i] = 0;
-                check->result->corruptions_fixed++;
            } else {
                check->result->corruptions++;
            }
@@ -128,7 +127,6 @@ static int qed_check_l1_table(QEDCheck *check, QEDTable *table)
            /* Clear invalid offset */
            if (check->fix) {
                table->offsets[i] = 0;
-                check->result->corruptions_fixed++;
            } else {
                check->result->corruptions++;
            }
@@ -194,28 +192,6 @@ static void qed_check_for_leaks(QEDCheck *check)
    }
 }

-/**
- * Mark an image clean once it passes check or has been repaired
- */
-static void qed_check_mark_clean(BDRVQEDState *s, BdrvCheckResult *result)
-{
-    /* Skip if there were unfixable corruptions or I/O errors */
-    if (result->corruptions > 0 || result->check_errors > 0) {
-        return;
-    }
-
-    /* Skip if image is already marked clean */
-    if (!(s->header.features & QED_F_NEED_CHECK)) {
-        return;
-    }
-
-    /* Ensure fixes reach storage before clearing check bit */
-    bdrv_flush(s->bs);
-
-    s->header.features &= ~QED_F_NEED_CHECK;
-    qed_write_header_sync(s);
-}
-
 int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
 {
    QEDCheck check = {
@@ -237,10 +213,6 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
    if (ret == 0) {
        /* Only check for leaks if entire image was scanned successfully */
        qed_check_for_leaks(&check);
-
-        if (fix) {
-            qed_check_mark_clean(s, result);
-        }
    }

    g_free(check.used_clusters);
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -13,7 +13,7 @@
 */

 #include "trace.h"
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
 #include "qed.h"

 typedef struct {
@@ -103,6 +103,7 @@ static void qed_write_table_cb(void *opaque, int ret)
 out:
    qemu_vfree(write_table_cb->table);
    gencb_complete(&write_table_cb->gencb, ret);
+    return;
 }

 /**
--- a/block/qed.c
+++ b/block/qed.c
@@ -12,11 +12,11 @@
 *
 */

-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "trace.h"
 #include "qed.h"
-#include "qapi/qmp/qerror.h"
-#include "migration/migration.h"
+#include "qerror.h"
+#include "migration.h"

 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -30,7 +30,7 @@ static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
    }
 }

-static const AIOCBInfo qed_aiocb_info = {
+static AIOPool qed_aio_pool = {
    .aiocb_size         = sizeof(QEDAIOCB),
    .cancel             = qed_aio_cancel,
 };
@@ -89,7 +89,7 @@ static void qed_header_cpu_to_le(const QEDHeader *cpu, QEDHeader *le)
    le->backing_filename_size = cpu_to_le32(cpu->backing_filename_size);
 }

-int qed_write_header_sync(BDRVQEDState *s)
+static int qed_write_header_sync(BDRVQEDState *s)
 {
    QEDHeader le;
    int ret;
@@ -373,7 +373,7 @@ static void bdrv_qed_rebind(BlockDriverState *bs)
    s->bs = bs;
 }

-static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags)
+static int bdrv_qed_open(BlockDriverState *bs, int flags)
 {
    BDRVQEDState *s = bs->opaque;
    QEDHeader le_header;
@@ -390,7 +390,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags)
    qed_header_le_to_cpu(&le_header, &s->header);

    if (s->header.magic != QED_MAGIC) {
-        return -EMEDIUMTYPE;
+        return -EINVAL;
    }
    if (s->header.features & ~QED_FEATURE_MASK) {
        /* image uses unsupported feature bits */
@@ -477,7 +477,7 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags)
    }

    /* If image was not closed cleanly, check consistency */
-    if (!(flags & BDRV_O_CHECK) && (s->header.features & QED_F_NEED_CHECK)) {
+    if (s->header.features & QED_F_NEED_CHECK) {
        /* Read-only images cannot be fixed.  There is no risk of corruption
         * since write operations are not possible.  Therefore, allow
         * potentially inconsistent images to be opened read-only.  This can
@@ -491,6 +491,13 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags)
            if (ret) {
                goto out;
            }
+            if (!result.corruptions && !result.check_errors) {
+                /* Ensure fixes reach storage before clearing check bit */
+                bdrv_flush(s->bs);
+
+                s->header.features &= ~QED_F_NEED_CHECK;
+                qed_write_header_sync(s);
+            }
        }
    }

@@ -505,14 +512,6 @@ out:
    return ret;
 }

-/* We have nothing to do for QED reopen, stubs just return
- * success */
-static int bdrv_qed_reopen_prepare(BDRVReopenState *state,
-                                   BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
-}
-
 static void bdrv_qed_close(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;
@@ -558,7 +557,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,
        return ret;
    }

-    ret = bdrv_file_open(&bs, filename, NULL, BDRV_O_RDWR | BDRV_O_CACHE_WB);
+    ret = bdrv_file_open(&bs, filename, BDRV_O_RDWR | BDRV_O_CACHE_WB);
    if (ret < 0) {
        return ret;
    }
@@ -737,7 +736,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* Zero all sectors if reading beyond the end of the backing file */
    if (pos >= backing_length ||
        pos + qiov->size > backing_length) {
-        qemu_iovec_memset(qiov, 0, 0, qiov->size);
+        qemu_iovec_memset(qiov, 0, qiov->size);
    }

    /* Complete now if there are no backing file sectors to read */
@@ -749,7 +748,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* If the read straddles the end of the backing file, shorten it */
    size = MIN((uint64_t)backing_length - pos, qiov->size);

-    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
+    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING);
    bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
                   qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
 }
@@ -1132,7 +1131,7 @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)

    acb->cur_nclusters = qed_bytes_to_clusters(s,
            qed_offset_into_cluster(s, acb->cur_pos) + len);
-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    if (acb->flags & QED_AIOCB_ZERO) {
        /* Skip ahead if the clusters are already zero */
@@ -1178,7 +1177,7 @@ static void qed_aio_write_inplace(QEDAIOCB *acb, uint64_t offset, size_t len)

    /* Calculate the I/O vector */
    acb->cur_cluster = offset;
-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    /* Do the actual write */
    qed_aio_write_main(acb, 0);
@@ -1248,11 +1247,11 @@ static void qed_aio_read_data(void *opaque, int ret,
        goto err;
    }

-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    /* Handle zero cluster and backing file reads */
    if (ret == QED_CLUSTER_ZERO) {
-        qemu_iovec_memset(&acb->cur_qiov, 0, 0, acb->cur_qiov.size);
+        qemu_iovec_memset(&acb->cur_qiov, 0, acb->cur_qiov.size);
        qed_aio_next_io(acb, 0);
        return;
    } else if (ret != QED_CLUSTER_FOUND) {
@@ -1311,7 +1310,7 @@ static BlockDriverAIOCB *qed_aio_setup(BlockDriverState *bs,
                                       BlockDriverCompletionFunc *cb,
                                       void *opaque, int flags)
 {
-    QEDAIOCB *acb = qemu_aio_get(&qed_aiocb_info, bs, cb, opaque);
+    QEDAIOCB *acb = qemu_aio_get(&qed_aio_pool, bs, cb, opaque);

    trace_qed_aio_setup(bs->opaque, acb, sector_num, nb_sectors,
                        opaque, flags);
@@ -1371,21 +1370,10 @@ static int coroutine_fn bdrv_qed_co_write_zeroes(BlockDriverState *bs,
                                                 int nb_sectors)
 {
    BlockDriverAIOCB *blockacb;
-    BDRVQEDState *s = bs->opaque;
    QEDWriteZeroesCB cb = { .done = false };
    QEMUIOVector qiov;
    struct iovec iov;

-    /* Refuse if there are untouched backing file sectors */
-    if (bs->backing_hd) {
-        if (qed_offset_into_cluster(s, sector_num * BDRV_SECTOR_SIZE) != 0) {
-            return -ENOTSUP;
-        }
-        if (qed_offset_into_cluster(s, nb_sectors * BDRV_SECTOR_SIZE) != 0) {
-            return -ENOTSUP;
-        }
-    }
-
    /* Zero writes start without an I/O buffer.  If a buffer becomes necessary
     * then it will be allocated during request processing.
     */
@@ -1526,15 +1514,14 @@ static void bdrv_qed_invalidate_cache(BlockDriverState *bs)

    bdrv_qed_close(bs);
    memset(s, 0, sizeof(BDRVQEDState));
-    bdrv_qed_open(bs, NULL, bs->open_flags);
+    bdrv_qed_open(bs, bs->open_flags);
 }

-static int bdrv_qed_check(BlockDriverState *bs, BdrvCheckResult *result,
-                          BdrvCheckMode fix)
+static int bdrv_qed_check(BlockDriverState *bs, BdrvCheckResult *result)
 {
    BDRVQEDState *s = bs->opaque;

-    return qed_check(s, result, !!fix);
+    return qed_check(s, result, false);
 }

 static QEMUOptionParameter qed_create_options[] = {
@@ -1572,7 +1559,6 @@ static BlockDriver bdrv_qed = {
    .bdrv_rebind              = bdrv_qed_rebind,
    .bdrv_open                = bdrv_qed_open,
    .bdrv_close               = bdrv_qed_close,
-    .bdrv_reopen_prepare      = bdrv_qed_reopen_prepare,
    .bdrv_create              = bdrv_qed_create,
    .bdrv_co_is_allocated     = bdrv_qed_co_is_allocated,
    .bdrv_make_empty          = bdrv_qed_make_empty,
--- a/block/qed.h
+++ b/block/qed.h
@@ -15,7 +15,7 @@
 #ifndef BLOCK_QED_H
 #define BLOCK_QED_H

-#include "block/block_int.h"
+#include "block_int.h"

 /* The layout of a QED file is as follows:
 *
@@ -210,11 +210,6 @@ typedef struct {
 void *gencb_alloc(size_t len, BlockDriverCompletionFunc *cb, void *opaque);
 void gencb_complete(void *opaque, int ret);

-/**
- * Header functions
- */
-int qed_write_header_sync(BDRVQEDState *s);
-
 /**
 * L2 cache functions
 */
--- a/block/raw-posix-aio.h
+++ b/block/raw-posix-aio.h
@@ -1,5 +1,5 @@
 /*
- * Declarations for AIO in the raw protocol
+ * QEMU Posix block I/O backend AIO support
 *
 * Copyright IBM, Corp. 2008
 *
@@ -12,40 +12,34 @@
 * Contributions after 2012-01-13 are licensed under the terms of the
 * GNU GPL, version 2 or (at your option) any later version.
 */
-#ifndef QEMU_RAW_AIO_H
-#define QEMU_RAW_AIO_H
+#ifndef QEMU_RAW_POSIX_AIO_H
+#define QEMU_RAW_POSIX_AIO_H

 /* AIO request types */
 #define QEMU_AIO_READ         0x0001
 #define QEMU_AIO_WRITE        0x0002
 #define QEMU_AIO_IOCTL        0x0004
 #define QEMU_AIO_FLUSH        0x0008
-#define QEMU_AIO_DISCARD      0x0010
 #define QEMU_AIO_TYPE_MASK \
-        (QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH| \
-         QEMU_AIO_DISCARD)
+	(QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH)

 /* AIO flags */
 #define QEMU_AIO_MISALIGNED   0x1000
-#define QEMU_AIO_BLKDEV       0x2000


+/* posix-aio-compat.c - thread pool based implementation */
+int paio_init(void);
+BlockDriverAIOCB *paio_submit(BlockDriverState *bs, int fd,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque, int type);
+BlockDriverAIOCB *paio_ioctl(BlockDriverState *bs, int fd,
+        unsigned long int req, void *buf,
+        BlockDriverCompletionFunc *cb, void *opaque);
+
 /* linux-aio.c - Linux native implementation */
-#ifdef CONFIG_LINUX_AIO
 void *laio_init(void);
 BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type);
-#endif

-#ifdef _WIN32
-typedef struct QEMUWin32AIOState QEMUWin32AIOState;
-QEMUWin32AIOState *win32_aio_init(void);
-int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile);
-BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
-        QEMUWin32AIOState *aio, HANDLE hfile,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int type);
-#endif
-
-#endif /* QEMU_RAW_AIO_H */
+#endif /* QEMU_RAW_POSIX_AIO_H */
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -22,13 +22,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "qemu/timer.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "raw-aio.h"
-#include "trace.h"
-#include "block/thread-pool.h"
-#include "qemu/iov.h"
+#include "qemu-timer.h"
+#include "block_int.h"
+#include "module.h"
 #include <windows.h>
 #include <winioctl.h>

@@ -36,132 +32,12 @@
 #define FTYPE_CD     1
 #define FTYPE_HARDDISK 2

-static QEMUWin32AIOState *aio;
-
-typedef struct RawWin32AIOData {
-    BlockDriverState *bs;
-    HANDLE hfile;
-    struct iovec *aio_iov;
-    int aio_niov;
-    size_t aio_nbytes;
-    off64_t aio_offset;
-    int aio_type;
-} RawWin32AIOData;
-
 typedef struct BDRVRawState {
    HANDLE hfile;
    int type;
    char drive_path[16]; /* format: "d:\" */
-    QEMUWin32AIOState *aio;
 } BDRVRawState;

-/*
- * Read/writes the data to/from a given linear buffer.
- *
- * Returns the number of bytes handles or -errno in case of an error. Short
- * reads are only returned if the end of the file is reached.
- */
-static size_t handle_aiocb_rw(RawWin32AIOData *aiocb)
-{
-    size_t offset = 0;
-    int i;
-
-    for (i = 0; i < aiocb->aio_niov; i++) {
-        OVERLAPPED ov;
-        DWORD ret, ret_count, len;
-
-        memset(&ov, 0, sizeof(ov));
-        ov.Offset = (aiocb->aio_offset + offset);
-        ov.OffsetHigh = (aiocb->aio_offset + offset) >> 32;
-        len = aiocb->aio_iov[i].iov_len;
-        if (aiocb->aio_type & QEMU_AIO_WRITE) {
-            ret = WriteFile(aiocb->hfile, aiocb->aio_iov[i].iov_base,
-                            len, &ret_count, &ov);
-        } else {
-            ret = ReadFile(aiocb->hfile, aiocb->aio_iov[i].iov_base,
-                           len, &ret_count, &ov);
-        }
-        if (!ret) {
-            ret_count = 0;
-        }
-        if (ret_count != len) {
-            break;
-        }
-        offset += len;
-    }
-
-    return offset;
-}
-
-static int aio_worker(void *arg)
-{
-    RawWin32AIOData *aiocb = arg;
-    ssize_t ret = 0;
-    size_t count;
-
-    switch (aiocb->aio_type & QEMU_AIO_TYPE_MASK) {
-    case QEMU_AIO_READ:
-        count = handle_aiocb_rw(aiocb);
-        if (count < aiocb->aio_nbytes && aiocb->bs->growable) {
-            /* A short read means that we have reached EOF. Pad the buffer
-             * with zeros for bytes after EOF. */
-            iov_memset(aiocb->aio_iov, aiocb->aio_niov, count,
-                      0, aiocb->aio_nbytes - count);
-
-            count = aiocb->aio_nbytes;
-        }
-        if (count == aiocb->aio_nbytes) {
-            ret = 0;
-        } else {
-            ret = -EINVAL;
-        }
-        break;
-    case QEMU_AIO_WRITE:
-        count = handle_aiocb_rw(aiocb);
-        if (count == aiocb->aio_nbytes) {
-            count = 0;
-        } else {
-            count = -EINVAL;
-        }
-        break;
-    case QEMU_AIO_FLUSH:
-        if (!FlushFileBuffers(aiocb->hfile)) {
-            return -EIO;
-        }
-        break;
-    default:
-        fprintf(stderr, "invalid aio request (0x%x)\n", aiocb->aio_type);
-        ret = -EINVAL;
-        break;
-    }
-
-    g_slice_free(RawWin32AIOData, aiocb);
-    return ret;
-}
-
-static BlockDriverAIOCB *paio_submit(BlockDriverState *bs, HANDLE hfile,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int type)
-{
-    RawWin32AIOData *acb = g_slice_new(RawWin32AIOData);
-    ThreadPool *pool;
-
-    acb->bs = bs;
-    acb->hfile = hfile;
-    acb->aio_type = type;
-
-    if (qiov) {
-        acb->aio_iov = qiov->iov;
-        acb->aio_niov = qiov->niov;
-    }
-    acb->aio_nbytes = nb_sectors * 512;
-    acb->aio_offset = sector_num * 512;
-
-    trace_paio_submit(acb, opaque, sector_num, nb_sectors, type);
-    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
-    return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);
-}
-
 int qemu_ftruncate64(int fd, int64_t length)
 {
    LARGE_INTEGER li;
@@ -201,134 +77,91 @@ static int set_sparse(int fd)
 				 NULL, 0, NULL, 0, &returned, NULL);
 }

-static void raw_parse_flags(int flags, int *access_flags, DWORD *overlapped)
-{
-    assert(access_flags != NULL);
-    assert(overlapped != NULL);
-
-    if (flags & BDRV_O_RDWR) {
-        *access_flags = GENERIC_READ | GENERIC_WRITE;
-    } else {
-        *access_flags = GENERIC_READ;
-    }
-
-    *overlapped = FILE_ATTRIBUTE_NORMAL;
-    if (flags & BDRV_O_NATIVE_AIO) {
-        *overlapped |= FILE_FLAG_OVERLAPPED;
-    }
-    if (flags & BDRV_O_NOCACHE) {
-        *overlapped |= FILE_FLAG_NO_BUFFERING;
-    }
-}
-
-static QemuOptsList raw_runtime_opts = {
-    .name = "raw",
-    .head = QTAILQ_HEAD_INITIALIZER(raw_runtime_opts.head),
-    .desc = {
-        {
-            .name = "filename",
-            .type = QEMU_OPT_STRING,
-            .help = "File name of the image",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int raw_open(BlockDriverState *bs, QDict *options, int flags)
+static int raw_open(BlockDriverState *bs, const char *filename, int flags)
 {
    BDRVRawState *s = bs->opaque;
    int access_flags;
    DWORD overlapped;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *filename;
-    int ret;

    s->type = FTYPE_FILE;

-    opts = qemu_opts_create_nofail(&raw_runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    filename = qemu_opt_get(opts, "filename");
-
-    raw_parse_flags(flags, &access_flags, &overlapped);
-
-    if ((flags & BDRV_O_NATIVE_AIO) && aio == NULL) {
-        aio = win32_aio_init();
-        if (aio == NULL) {
-            ret = -EINVAL;
-            goto fail;
-        }
+    if (flags & BDRV_O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
    }

+    overlapped = FILE_ATTRIBUTE_NORMAL;
+    if (flags & BDRV_O_NOCACHE)
+        overlapped |= FILE_FLAG_NO_BUFFERING;
+    if (!(flags & BDRV_O_CACHE_WB))
+        overlapped |= FILE_FLAG_WRITE_THROUGH;
    s->hfile = CreateFile(filename, access_flags,
                          FILE_SHARE_READ, NULL,
                          OPEN_EXISTING, overlapped, NULL);
    if (s->hfile == INVALID_HANDLE_VALUE) {
        int err = GetLastError();

-        if (err == ERROR_ACCESS_DENIED) {
-            ret = -EACCES;
-        } else {
-            ret = -EINVAL;
-        }
-        goto fail;
+        if (err == ERROR_ACCESS_DENIED)
+            return -EACCES;
+        return -1;
    }
-
-    if (flags & BDRV_O_NATIVE_AIO) {
-        ret = win32_aio_attach(aio, s->hfile);
-        if (ret < 0) {
-            CloseHandle(s->hfile);
-            goto fail;
-        }
-        s->aio = aio;
-    }
-
-    ret = 0;
-fail:
-    qemu_opts_del(opts);
-    return ret;
+    return 0;
 }

-static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
-                         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-                         BlockDriverCompletionFunc *cb, void *opaque)
+static int raw_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
 {
    BDRVRawState *s = bs->opaque;
-    if (s->aio) {
-        return win32_aio_submit(bs, s->aio, s->hfile, sector_num, qiov,
-                                nb_sectors, cb, opaque, QEMU_AIO_READ); 
-    } else {
-        return paio_submit(bs, s->hfile, sector_num, qiov, nb_sectors,
-                           cb, opaque, QEMU_AIO_READ);
-    }
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+    int64_t offset = sector_num * 512;
+    int count = nb_sectors * 512;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = ReadFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret)
+        return ret_count;
+    if (ret_count == count)
+        ret_count = 0;
+    return ret_count;
 }

-static BlockDriverAIOCB *raw_aio_writev(BlockDriverState *bs,
-                          int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-                          BlockDriverCompletionFunc *cb, void *opaque)
+static int raw_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
 {
    BDRVRawState *s = bs->opaque;
-    if (s->aio) {
-        return win32_aio_submit(bs, s->aio, s->hfile, sector_num, qiov,
-                                nb_sectors, cb, opaque, QEMU_AIO_WRITE); 
-    } else {
-        return paio_submit(bs, s->hfile, sector_num, qiov, nb_sectors,
-                           cb, opaque, QEMU_AIO_WRITE);
-    }
+    OVERLAPPED ov;
+    DWORD ret_count;
+    int ret;
+    int64_t offset = sector_num * 512;
+    int count = nb_sectors * 512;
+
+    memset(&ov, 0, sizeof(ov));
+    ov.Offset = offset;
+    ov.OffsetHigh = offset >> 32;
+    ret = WriteFile(s->hfile, buf, count, &ret_count, &ov);
+    if (!ret)
+        return ret_count;
+    if (ret_count == count)
+        ret_count = 0;
+    return ret_count;
 }

-static BlockDriverAIOCB *raw_aio_flush(BlockDriverState *bs,
-                         BlockDriverCompletionFunc *cb, void *opaque)
+static int raw_flush(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
-    return paio_submit(bs, s->hfile, 0, NULL, 0, cb, opaque, QEMU_AIO_FLUSH);
+    int ret;
+
+    ret = FlushFileBuffers(s->hfile);
+    if (ret == 0) {
+        return -EIO;
+    }
+
+    return 0;
 }

 static void raw_close(BlockDriverState *bs)
@@ -341,24 +174,13 @@ static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
    LONG low, high;
-    DWORD dwPtrLow;

    low = offset;
    high = offset >> 32;
-
-    /*
-     * An error has occurred if the return value is INVALID_SET_FILE_POINTER
-     * and GetLastError doesn't return NO_ERROR.
-     */
-    dwPtrLow = SetFilePointer(s->hfile, low, &high, FILE_BEGIN);
-    if (dwPtrLow == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        fprintf(stderr, "SetFilePointer error: %lu\n", GetLastError());
+    if (!SetFilePointer(s->hfile, low, &high, FILE_BEGIN))
+	return -EIO;
+    if (!SetEndOfFile(s->hfile))
        return -EIO;
-    }
-    if (SetEndOfFile(s->hfile) == 0) {
-        fprintf(stderr, "SetEndOfFile error: %lu\n", GetLastError());
-        return -EIO;
-    }
    return 0;
 }

@@ -433,13 +255,13 @@ static int raw_create(const char *filename, QEMUOptionParameter *options)
        options++;
    }

-    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
-                   0644);
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
    if (fd < 0)
        return -EIO;
    set_sparse(fd);
    ftruncate(fd, total_size * 512);
-    qemu_close(fd);
+    close(fd);
    return 0;
 }

@@ -460,9 +282,9 @@ static BlockDriver bdrv_file = {
    .bdrv_close		= raw_close,
    .bdrv_create	= raw_create,

-    .bdrv_aio_readv     = raw_aio_readv,
-    .bdrv_aio_writev    = raw_aio_writev,
-    .bdrv_aio_flush     = raw_aio_flush,
+    .bdrv_read              = raw_read,
+    .bdrv_write             = raw_write,
+    .bdrv_co_flush_to_disk  = raw_flush,

    .bdrv_truncate	= raw_truncate,
    .bdrv_getlength	= raw_getlength,
@@ -530,13 +352,12 @@ static int hdev_probe_device(const char *filename)
    return 0;
 }

-static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
+static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
    BDRVRawState *s = bs->opaque;
    int access_flags, create_flags;
    DWORD overlapped;
    char device_name[64];
-    const char *filename = qdict_get_str(options, "filename");

    if (strstart(filename, "/dev/cdrom", NULL)) {
        if (find_cdrom(device_name, sizeof(device_name)) < 0)
@@ -553,10 +374,18 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
    }
    s->type = find_device_type(bs, filename);

-    raw_parse_flags(flags, &access_flags, &overlapped);
-
+    if (flags & BDRV_O_RDWR) {
+        access_flags = GENERIC_READ | GENERIC_WRITE;
+    } else {
+        access_flags = GENERIC_READ;
+    }
    create_flags = OPEN_EXISTING;

+    overlapped = FILE_ATTRIBUTE_NORMAL;
+    if (flags & BDRV_O_NOCACHE)
+        overlapped |= FILE_FLAG_NO_BUFFERING;
+    if (!(flags & BDRV_O_CACHE_WB))
+        overlapped |= FILE_FLAG_WRITE_THROUGH;
    s->hfile = CreateFile(filename, access_flags,
                          FILE_SHARE_READ, NULL,
                          create_flags, overlapped, NULL);
@@ -584,9 +413,9 @@ static BlockDriver bdrv_host_device = {
    .bdrv_close		= raw_close,
    .bdrv_has_zero_init = hdev_has_zero_init,

-    .bdrv_aio_readv     = raw_aio_readv,
-    .bdrv_aio_writev    = raw_aio_writev,
-    .bdrv_aio_flush     = raw_aio_flush,
+    .bdrv_read              = raw_read,
+    .bdrv_write             = raw_write,
+    .bdrv_co_flush_to_disk  = raw_flush,

    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
--- a/block/raw.c
+++ b/block/raw.c
@@ -1,33 +1,23 @@

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

-static int raw_open(BlockDriverState *bs, QDict *options, int flags)
+static int raw_open(BlockDriverState *bs, int flags)
 {
    bs->sg = bs->file->sg;
    return 0;
 }

-/* We have nothing to do for raw reopen, stubs just return
- * success */
-static int raw_reopen_prepare(BDRVReopenState *state,
-                              BlockReopenQueue *queue,  Error **errp)
-{
-    return 0;
-}
-
 static int coroutine_fn raw_co_readv(BlockDriverState *bs, int64_t sector_num,
                                     int nb_sectors, QEMUIOVector *qiov)
 {
-    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
    return bdrv_co_readv(bs->file, sector_num, nb_sectors, qiov);
 }

 static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
                                      int nb_sectors, QEMUIOVector *qiov)
 {
-    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
    return bdrv_co_writev(bs->file, sector_num, nb_sectors, qiov);
 }

@@ -35,13 +25,6 @@ static void raw_close(BlockDriverState *bs)
 {
 }

-static int coroutine_fn raw_co_is_allocated(BlockDriverState *bs,
-                                            int64_t sector_num,
-                                            int nb_sectors, int *pnum)
-{
-    return bdrv_co_is_allocated(bs->file, sector_num, nb_sectors, pnum);
-}
-
 static int64_t raw_getlength(BlockDriverState *bs)
 {
    return bdrv_getlength(bs->file);
@@ -123,11 +106,8 @@ static BlockDriver bdrv_raw = {
    .bdrv_open          = raw_open,
    .bdrv_close         = raw_close,

-    .bdrv_reopen_prepare  = raw_reopen_prepare,
-
    .bdrv_co_readv          = raw_co_readv,
    .bdrv_co_writev         = raw_co_writev,
-    .bdrv_co_is_allocated   = raw_co_is_allocated,
    .bdrv_co_discard        = raw_co_discard,

    .bdrv_probe         = raw_probe,
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -14,8 +14,8 @@
 #include <inttypes.h>

 #include "qemu-common.h"
-#include "qemu/error-report.h"
-#include "block/block_int.h"
+#include "qemu-error.h"
+#include "block_int.h"

 #include <rbd/librbd.h>

@@ -63,14 +63,13 @@
 typedef enum {
    RBD_AIO_READ,
    RBD_AIO_WRITE,
-    RBD_AIO_DISCARD,
-    RBD_AIO_FLUSH
+    RBD_AIO_DISCARD
 } RBDAIOCmd;

 typedef struct RBDAIOCB {
    BlockDriverAIOCB common;
    QEMUBH *bh;
-    int64_t ret;
+    int ret;
    QEMUIOVector *qiov;
    char *bounce;
    RBDAIOCmd cmd;
@@ -78,7 +77,6 @@ typedef struct RBDAIOCB {
    int error;
    struct BDRVRBDState *s;
    int cancelled;
-    int status;
 } RBDAIOCB;

 typedef struct RADOSCB {
@@ -88,7 +86,7 @@ typedef struct RADOSCB {
    int done;
    int64_t size;
    char *buf;
-    int64_t ret;
+    int ret;
 } RADOSCB;

 #define RBD_FD_READ 0
@@ -378,9 +376,16 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
    RBDAIOCB *acb = rcb->acb;
    int64_t r;

+    if (acb->cancelled) {
+        qemu_vfree(acb->bounce);
+        qemu_aio_release(acb);
+        goto done;
+    }
+
    r = rcb->ret;

-    if (acb->cmd != RBD_AIO_READ) {
+    if (acb->cmd == RBD_AIO_WRITE ||
+        acb->cmd == RBD_AIO_DISCARD) {
        if (r < 0) {
            acb->ret = r;
            acb->error = 1;
@@ -404,6 +409,7 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
    /* Note that acb->bh can be NULL in case where the aio was cancelled */
    acb->bh = qemu_bh_new(rbd_aio_bh_cb, acb);
    qemu_bh_schedule(acb->bh);
+done:
    g_free(rcb);
 }

@@ -441,21 +447,7 @@ static int qemu_rbd_aio_flush_cb(void *opaque)
    return (s->qemu_aio_count > 0);
 }

-/* TODO Convert to fine grained options */
-static QemuOptsList runtime_opts = {
-    .name = "rbd",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "filename",
-            .type = QEMU_OPT_STRING,
-            .help = "Specification of the rbd image",
-        },
-        { /* end of list */ }
-    },
-};
-
-static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags)
+static int qemu_rbd_open(BlockDriverState *bs, const char *filename, int flags)
 {
    BDRVRBDState *s = bs->opaque;
    char pool[RBD_MAX_POOL_NAME_SIZE];
@@ -463,35 +455,20 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags)
    char conf[RBD_MAX_CONF_SIZE];
    char clientname_buf[RBD_MAX_CONF_SIZE];
    char *clientname;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    const char *filename;
    int r;

-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        qemu_opts_del(opts);
-        return -EINVAL;
-    }
-
-    filename = qemu_opt_get(opts, "filename");
-
    if (qemu_rbd_parsename(filename, pool, sizeof(pool),
                           snap_buf, sizeof(snap_buf),
                           s->name, sizeof(s->name),
                           conf, sizeof(conf)) < 0) {
-        r = -EINVAL;
-        goto failed_opts;
+        return -EINVAL;
    }

    clientname = qemu_rbd_parse_clientname(conf, clientname_buf);
    r = rados_create(&s->cluster, clientname);
    if (r < 0) {
        error_report("error initializing");
-        goto failed_opts;
+        return r;
    }

    s->snap = NULL;
@@ -499,19 +476,6 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags)
        s->snap = g_strdup(snap_buf);
    }

-    /*
-     * Fallback to more conservative semantics if setting cache
-     * options fails. Ignore errors from setting rbd_cache because the
-     * only possible error is that the option does not exist, and
-     * librbd defaults to no caching. If write through caching cannot
-     * be set up, fall back to no caching.
-     */
-    if (flags & BDRV_O_NOCACHE) {
-        rados_conf_set(s->cluster, "rbd_cache", "false");
-    } else {
-        rados_conf_set(s->cluster, "rbd_cache", "true");
-    }
-
    if (strstr(conf, "conf=") == NULL) {
        /* try default location, but ignore failure */
        rados_conf_read_file(s->cluster, NULL);
@@ -557,7 +521,6 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags)
                            NULL, qemu_rbd_aio_flush_cb, s);


-    qemu_opts_del(opts);
    return 0;

 failed:
@@ -567,8 +530,6 @@ failed_open:
 failed_shutdown:
    rados_shutdown(s->cluster);
    g_free(s->snap);
-failed_opts:
-    qemu_opts_del(opts);
    return r;
 }

@@ -594,15 +555,9 @@ static void qemu_rbd_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    RBDAIOCB *acb = (RBDAIOCB *) blockacb;
    acb->cancelled = 1;
-
-    while (acb->status == -EINPROGRESS) {
-        qemu_aio_wait();
-    }
-
-    qemu_aio_release(acb);
 }

-static const AIOCBInfo rbd_aiocb_info = {
+static AIOPool rbd_aio_pool = {
    .aiocb_size = sizeof(RBDAIOCB),
    .cancel = qemu_rbd_aio_cancel,
 };
@@ -665,17 +620,14 @@ static void rbd_aio_bh_cb(void *opaque)
    RBDAIOCB *acb = opaque;

    if (acb->cmd == RBD_AIO_READ) {
-        qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
+        qemu_iovec_from_buffer(acb->qiov, acb->bounce, acb->qiov->size);
    }
    qemu_vfree(acb->bounce);
    acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
    qemu_bh_delete(acb->bh);
    acb->bh = NULL;
-    acb->status = 0;

-    if (!acb->cancelled) {
-        qemu_aio_release(acb);
-    }
+    qemu_aio_release(acb);
 }

 static int rbd_aio_discard_wrapper(rbd_image_t image,
@@ -690,16 +642,6 @@ static int rbd_aio_discard_wrapper(rbd_image_t image,
 #endif
 }

-static int rbd_aio_flush_wrapper(rbd_image_t image,
-                                 rbd_completion_t comp)
-{
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-    return rbd_aio_flush(image, comp);
-#else
-    return -ENOTSUP;
-#endif
-}
-
 static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
                                       int64_t sector_num,
                                       QEMUIOVector *qiov,
@@ -717,10 +659,10 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,

    BDRVRBDState *s = bs->opaque;

-    acb = qemu_aio_get(&rbd_aiocb_info, bs, cb, opaque);
+    acb = qemu_aio_get(&rbd_aio_pool, bs, cb, opaque);
    acb->cmd = cmd;
    acb->qiov = qiov;
-    if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
+    if (cmd == RBD_AIO_DISCARD) {
        acb->bounce = NULL;
    } else {
        acb->bounce = qemu_blockalign(bs, qiov->size);
@@ -730,10 +672,9 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    acb->s = s;
    acb->cancelled = 0;
    acb->bh = NULL;
-    acb->status = -EINPROGRESS;

    if (cmd == RBD_AIO_WRITE) {
-        qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
+        qemu_iovec_to_buffer(acb->qiov, acb->bounce);
    }

    buf = acb->bounce;
@@ -764,9 +705,6 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    case RBD_AIO_DISCARD:
        r = rbd_aio_discard_wrapper(s->image, off, size, c);
        break;
-    case RBD_AIO_FLUSH:
-        r = rbd_aio_flush_wrapper(s->image, c);
-        break;
    default:
        r = -EINVAL;
    }
@@ -806,16 +744,6 @@ static BlockDriverAIOCB *qemu_rbd_aio_writev(BlockDriverState *bs,
                         RBD_AIO_WRITE);
 }

-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-static BlockDriverAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
-                                            BlockDriverCompletionFunc *cb,
-                                            void *opaque)
-{
-    return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
-}
-
-#else
-
 static int qemu_rbd_co_flush(BlockDriverState *bs)
 {
 #if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 1)
@@ -826,7 +754,6 @@ static int qemu_rbd_co_flush(BlockDriverState *bs)
    return 0;
 #endif
 }
-#endif

 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
@@ -1004,12 +931,7 @@ static BlockDriver bdrv_rbd = {

    .bdrv_aio_readv         = qemu_rbd_aio_readv,
    .bdrv_aio_writev        = qemu_rbd_aio_writev,
-
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-    .bdrv_aio_flush         = qemu_rbd_aio_flush,
-#else
    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
-#endif

 #ifdef LIBRBD_SUPPORTS_DISCARD
    .bdrv_aio_discard       = qemu_rbd_aio_discard,
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
--- a/block/ssh.c
+++ b/block/ssh.c
--- a/block/stream.c
+++ b/block/stream.c
@@ -12,9 +12,7 @@
 */

 #include "trace.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
-#include "qemu/ratelimit.h"
+#include "block_int.h"

 enum {
    /*
@@ -27,11 +25,38 @@ enum {

 #define SLICE_TIME 100000000ULL /* ns */

+typedef struct {
+    int64_t next_slice_time;
+    uint64_t slice_quota;
+    uint64_t dispatched;
+} RateLimit;
+
+static int64_t ratelimit_calculate_delay(RateLimit *limit, uint64_t n)
+{
+    int64_t now = qemu_get_clock_ns(rt_clock);
+
+    if (limit->next_slice_time < now) {
+        limit->next_slice_time = now + SLICE_TIME;
+        limit->dispatched = 0;
+    }
+    if (limit->dispatched == 0 || limit->dispatched + n <= limit->slice_quota) {
+        limit->dispatched += n;
+        return 0;
+    } else {
+        limit->dispatched = n;
+        return limit->next_slice_time - now;
+    }
+}
+
+static void ratelimit_set_speed(RateLimit *limit, uint64_t speed)
+{
+    limit->slice_quota = speed / (1000000000ULL / SLICE_TIME);
+}
+
 typedef struct StreamBlockJob {
    BlockJob common;
    RateLimit limit;
    BlockDriverState *base;
-    BlockdevOnError on_error;
    char backing_file_id[1024];
 } StreamBlockJob;

@@ -73,20 +98,80 @@ static void close_unused_images(BlockDriverState *top, BlockDriverState *base,
    top->backing_hd = base;
 }

+/*
+ * Given an image chain: [BASE] -> [INTER1] -> [INTER2] -> [TOP]
+ *
+ * Return true if the given sector is allocated in top.
+ * Return false if the given sector is allocated in intermediate images.
+ * Return true otherwise.
+ *
+ * 'pnum' is set to the number of sectors (including and immediately following
+ *  the specified sector) that are known to be in the same
+ *  allocated/unallocated state.
+ *
+ */
+static int coroutine_fn is_allocated_base(BlockDriverState *top,
+                                          BlockDriverState *base,
+                                          int64_t sector_num,
+                                          int nb_sectors, int *pnum)
+{
+    BlockDriverState *intermediate;
+    int ret, n;
+
+    ret = bdrv_co_is_allocated(top, sector_num, nb_sectors, &n);
+    if (ret) {
+        *pnum = n;
+        return ret;
+    }
+
+    /*
+     * Is the unallocated chunk [sector_num, n] also
+     * unallocated between base and top?
+     */
+    intermediate = top->backing_hd;
+
+    while (intermediate != base) {
+        int pnum_inter;
+
+        ret = bdrv_co_is_allocated(intermediate, sector_num, nb_sectors,
+                                   &pnum_inter);
+        if (ret < 0) {
+            return ret;
+        } else if (ret) {
+            *pnum = pnum_inter;
+            return 0;
+        }
+
+        /*
+         * [sector_num, nb_sectors] is unallocated on top but intermediate
+         * might have
+         *
+         * [sector_num+x, nr_sectors] allocated.
+         */
+        if (n > pnum_inter) {
+            n = pnum_inter;
+        }
+
+        intermediate = intermediate->backing_hd;
+    }
+
+    *pnum = n;
+    return 1;
+}
+
 static void coroutine_fn stream_run(void *opaque)
 {
    StreamBlockJob *s = opaque;
    BlockDriverState *bs = s->common.bs;
    BlockDriverState *base = s->base;
    int64_t sector_num, end;
-    int error = 0;
    int ret = 0;
    int n = 0;
    void *buf;

    s->common.len = bdrv_getlength(bs);
    if (s->common.len < 0) {
-        block_job_completed(&s->common, s->common.len);
+        block_job_complete(&s->common, s->common.len);
        return;
    }

@@ -104,37 +189,20 @@ static void coroutine_fn stream_run(void *opaque)

    for (sector_num = 0; sector_num < end; sector_num += n) {
        uint64_t delay_ns = 0;
-        bool copy;

 wait:
        /* Note that even when no rate limit is applied we need to yield
-         * with no pending I/O here so that bdrv_drain_all() returns.
+         * with no pending I/O here so that qemu_aio_flush() returns.
         */
        block_job_sleep_ns(&s->common, rt_clock, delay_ns);
        if (block_job_is_cancelled(&s->common)) {
            break;
        }

-        ret = bdrv_co_is_allocated(bs, sector_num,
-                                   STREAM_BUFFER_SIZE / BDRV_SECTOR_SIZE, &n);
-        if (ret == 1) {
-            /* Allocated in the top, no need to copy.  */
-            copy = false;
-        } else {
-            /* Copy if allocated in the intermediate images.  Limit to the
-             * known-unallocated area [sector_num, sector_num+n).  */
-            ret = bdrv_co_is_allocated_above(bs->backing_hd, base,
-                                             sector_num, n, &n);
-
-            /* Finish early if end of backing file has been reached */
-            if (ret == 0 && n == 0) {
-                n = end - sector_num;
-            }
-
-            copy = (ret == 1);
-        }
+        ret = is_allocated_base(bs, base, sector_num,
+                                STREAM_BUFFER_SIZE / BDRV_SECTOR_SIZE, &n);
        trace_stream_one_iteration(s, sector_num, n, ret);
-        if (ret >= 0 && copy) {
+        if (ret == 0) {
            if (s->common.speed) {
                delay_ns = ratelimit_calculate_delay(&s->limit, n);
                if (delay_ns > 0) {
@@ -144,19 +212,7 @@ wait:
            ret = stream_populate(bs, sector_num, n, buf);
        }
        if (ret < 0) {
-            BlockErrorAction action =
-                block_job_error_action(&s->common, s->common.bs, s->on_error,
-                                       true, -ret);
-            if (action == BDRV_ACTION_STOP) {
-                n = 0;
-                continue;
-            }
-            if (error == 0) {
-                error = ret;
-            }
-            if (action == BDRV_ACTION_REPORT) {
-                break;
-            }
+            break;
        }
        ret = 0;

@@ -168,9 +224,6 @@ wait:
        bdrv_disable_copy_on_read(bs);
    }

-    /* Do not remove the backing file if an error was there but ignored.  */
-    ret = error;
-
    if (!block_job_is_cancelled(&s->common) && sector_num == end && ret == 0) {
        const char *base_id = NULL, *base_fmt = NULL;
        if (base) {
@@ -184,7 +237,7 @@ wait:
    }

    qemu_vfree(buf);
-    block_job_completed(&s->common, ret);
+    block_job_complete(&s->common, ret);
 }

 static void stream_set_speed(BlockJob *job, int64_t speed, Error **errp)
@@ -195,7 +248,7 @@ static void stream_set_speed(BlockJob *job, int64_t speed, Error **errp)
        error_set(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
-    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE);
 }

 static BlockJobType stream_job_type = {
@@ -206,19 +259,11 @@ static BlockJobType stream_job_type = {

 void stream_start(BlockDriverState *bs, BlockDriverState *base,
                  const char *base_id, int64_t speed,
-                  BlockdevOnError on_error,
                  BlockDriverCompletionFunc *cb,
                  void *opaque, Error **errp)
 {
    StreamBlockJob *s;

-    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
-         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER, "on-error");
-        return;
-    }
-
    s = block_job_create(&stream_job_type, bs, speed, cb, opaque, errp);
    if (!s) {
        return;
@@ -229,7 +274,6 @@ void stream_start(BlockDriverState *bs, BlockDriverState *base,
        pstrcpy(s->backing_file_id, sizeof(s->backing_file_id), base_id);
    }

-    s->on_error = on_error;
    s->common.co = qemu_coroutine_create(stream_run);
    trace_stream_start(bs, base, s, s->common.co, opaque);
    qemu_coroutine_enter(s->common.co, s);
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -50,16 +50,19 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
 #else
 /* TODO: move uuid emulation to some central place in QEMU. */
-#include "sysemu/sysemu.h"     /* UUID_FMT */
+#include "sysemu.h"     /* UUID_FMT */
 typedef unsigned char uuid_t[16];
+void uuid_generate(uuid_t out);
+int uuid_is_null(const uuid_t uu);
+void uuid_unparse(const uuid_t uu, char *out);
 #endif

 /* Code configuration options. */
@@ -121,18 +124,18 @@ typedef unsigned char uuid_t[16];
 #define VDI_IS_ALLOCATED(X) ((X) < VDI_DISCARDED)

 #if !defined(CONFIG_UUID)
-static inline void uuid_generate(uuid_t out)
+void uuid_generate(uuid_t out)
 {
    memset(out, 0, sizeof(uuid_t));
 }

-static inline int uuid_is_null(const uuid_t uu)
+int uuid_is_null(const uuid_t uu)
 {
    uuid_t null_uuid = { 0 };
    return memcmp(uu, null_uuid, sizeof(uuid_t)) == 0;
 }

-static inline void uuid_unparse(const uuid_t uu, char *out)
+void uuid_unparse(const uuid_t uu, char *out)
 {
    snprintf(out, 37, UUID_FMT,
            uu[0], uu[1], uu[2], uu[3], uu[4], uu[5], uu[6], uu[7],
@@ -246,7 +249,7 @@ static void vdi_header_print(VdiHeader *header)
 {
    char uuid[37];
    logout("text        %s", header->text);
-    logout("signature   0x%08x\n", header->signature);
+    logout("signature   0x%04x\n", header->signature);
    logout("header size 0x%04x\n", header->header_size);
    logout("image type  0x%04x\n", header->image_type);
    logout("image flags 0x%04x\n", header->image_flags);
@@ -274,8 +277,7 @@ static void vdi_header_print(VdiHeader *header)
 }
 #endif

-static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res,
-                     BdrvCheckMode fix)
+static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res)
 {
    /* TODO: additional checks possible. */
    BDRVVdiState *s = (BDRVVdiState *)bs->opaque;
@@ -284,10 +286,6 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res,
    uint32_t *bmap;
    logout("\n");

-    if (fix) {
-        return -ENOTSUP;
-    }
-
    bmap = g_malloc(s->header.blocks_in_image * sizeof(uint32_t));
    memset(bmap, 0xff, s->header.blocks_in_image * sizeof(uint32_t));

@@ -364,17 +362,15 @@ static int vdi_probe(const uint8_t *buf, int buf_size, const char *filename)
    return result;
 }

-static int vdi_open(BlockDriverState *bs, QDict *options, int flags)
+static int vdi_open(BlockDriverState *bs, int flags)
 {
    BDRVVdiState *s = bs->opaque;
    VdiHeader header;
    size_t bmap_size;
-    int ret;

    logout("\n");

-    ret = bdrv_read(bs->file, 0, (uint8_t *)&header, 1);
-    if (ret < 0) {
+    if (bdrv_read(bs->file, 0, (uint8_t *)&header, 1) < 0) {
        goto fail;
    }

@@ -392,45 +388,33 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags)
        header.disk_size &= ~(SECTOR_SIZE - 1);
    }

-    if (header.signature != VDI_SIGNATURE) {
-        logout("bad vdi signature %08x\n", header.signature);
-        ret = -EMEDIUMTYPE;
-        goto fail;
-    } else if (header.version != VDI_VERSION_1_1) {
+    if (header.version != VDI_VERSION_1_1) {
        logout("unsupported version %u.%u\n",
               header.version >> 16, header.version & 0xffff);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_bmap % SECTOR_SIZE != 0) {
        /* We only support block maps which start on a sector boundary. */
        logout("unsupported block map offset 0x%x B\n", header.offset_bmap);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_data % SECTOR_SIZE != 0) {
        /* We only support data blocks which start on a sector boundary. */
        logout("unsupported data offset 0x%x B\n", header.offset_data);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.sector_size != SECTOR_SIZE) {
        logout("unsupported sector size %u B\n", header.sector_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.block_size != 1 * MiB) {
        logout("unsupported block size %u B\n", header.block_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.disk_size >
               (uint64_t)header.blocks_in_image * header.block_size) {
        logout("unsupported disk size %" PRIu64 " B\n", header.disk_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (!uuid_is_null(header.uuid_link)) {
        logout("link uuid != 0, unsupported\n");
-        ret = -ENOTSUP;
        goto fail;
    } else if (!uuid_is_null(header.uuid_parent)) {
        logout("parent uuid != 0, unsupported\n");
-        ret = -ENOTSUP;
        goto fail;
    }

@@ -443,9 +427,10 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags)

    bmap_size = header.blocks_in_image * sizeof(uint32_t);
    bmap_size = (bmap_size + SECTOR_SIZE - 1) / SECTOR_SIZE;
-    s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
-    ret = bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size);
-    if (ret < 0) {
+    if (bmap_size > 0) {
+        s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
+    }
+    if (bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size) < 0) {
        goto fail_free_bmap;
    }

@@ -461,13 +446,7 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags)
    g_free(s->bmap);

 fail:
-    return ret;
-}
-
-static int vdi_reopen_prepare(BDRVReopenState *state,
-                              BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
+    return -1;
 }

 static int coroutine_fn vdi_co_is_allocated(BlockDriverState *bs,
@@ -644,6 +623,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
    VdiHeader header;
    size_t i;
    size_t bmap_size;
+    uint32_t *bmap;

    logout("\n");

@@ -668,9 +648,8 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
        options++;
    }

-    fd = qemu_open(filename,
-                   O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
-                   0644);
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
+              0644);
    if (fd < 0) {
        return -errno;
    }
@@ -708,21 +687,21 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
        result = -errno;
    }

+    bmap = NULL;
    if (bmap_size > 0) {
-        uint32_t *bmap = g_malloc0(bmap_size);
-        for (i = 0; i < blocks; i++) {
-            if (image_type == VDI_TYPE_STATIC) {
-                bmap[i] = i;
-            } else {
-                bmap[i] = VDI_UNALLOCATED;
-            }
-        }
-        if (write(fd, bmap, bmap_size) < 0) {
-            result = -errno;
-        }
-        g_free(bmap);
+        bmap = (uint32_t *)g_malloc0(bmap_size);
    }
-
+    for (i = 0; i < blocks; i++) {
+        if (image_type == VDI_TYPE_STATIC) {
+            bmap[i] = i;
+        } else {
+            bmap[i] = VDI_UNALLOCATED;
+        }
+    }
+    if (write(fd, bmap, bmap_size) < 0) {
+        result = -errno;
+    }
+    g_free(bmap);
    if (image_type == VDI_TYPE_STATIC) {
        if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
            result = -errno;
@@ -777,7 +756,6 @@ static BlockDriver bdrv_vdi = {
    .bdrv_probe = vdi_probe,
    .bdrv_open = vdi_open,
    .bdrv_close = vdi_close,
-    .bdrv_reopen_prepare = vdi_reopen_prepare,
    .bdrv_create = vdi_create,
    .bdrv_co_is_allocated = vdi_co_is_allocated,
    .bdrv_make_empty = vdi_make_empty,
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -1,972 +0,0 @@
-/*
- * Block driver for Hyper-V VHDX Images
- *
- * Copyright (c) 2013 Red Hat, Inc.,
- *
- * Authors:
- *  Jeff Cody <jcody@redhat.com>
- *
- *  This is based on the "VHDX Format Specification v0.95", published 4/12/2012
- *  by Microsoft:
- *      https://www.microsoft.com/en-us/download/details.aspx?id=29681
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "qemu/crc32c.h"
-#include "block/vhdx.h"
-
-
-/* Several metadata and region table data entries are identified by
- * guids in  a MS-specific GUID format. */
-
-
-/* ------- Known Region Table GUIDs ---------------------- */
-static const MSGUID bat_guid =      { .data1 = 0x2dc27766,
-                                      .data2 = 0xf623,
-                                      .data3 = 0x4200,
-                                      .data4 = { 0x9d, 0x64, 0x11, 0x5e,
-                                                 0x9b, 0xfd, 0x4a, 0x08} };
-
-static const MSGUID metadata_guid = { .data1 = 0x8b7ca206,
-                                      .data2 = 0x4790,
-                                      .data3 = 0x4b9a,
-                                      .data4 = { 0xb8, 0xfe, 0x57, 0x5f,
-                                                 0x05, 0x0f, 0x88, 0x6e} };
-
-
-
-/* ------- Known Metadata Entry GUIDs ---------------------- */
-static const MSGUID file_param_guid =   { .data1 = 0xcaa16737,
-                                          .data2 = 0xfa36,
-                                          .data3 = 0x4d43,
-                                          .data4 = { 0xb3, 0xb6, 0x33, 0xf0,
-                                                     0xaa, 0x44, 0xe7, 0x6b} };
-
-static const MSGUID virtual_size_guid = { .data1 = 0x2FA54224,
-                                          .data2 = 0xcd1b,
-                                          .data3 = 0x4876,
-                                          .data4 = { 0xb2, 0x11, 0x5d, 0xbe,
-                                                     0xd8, 0x3b, 0xf4, 0xb8} };
-
-static const MSGUID page83_guid =       { .data1 = 0xbeca12ab,
-                                          .data2 = 0xb2e6,
-                                          .data3 = 0x4523,
-                                          .data4 = { 0x93, 0xef, 0xc3, 0x09,
-                                                     0xe0, 0x00, 0xc7, 0x46} };
-
-
-static const MSGUID phys_sector_guid =  { .data1 = 0xcda348c7,
-                                          .data2 = 0x445d,
-                                          .data3 = 0x4471,
-                                          .data4 = { 0x9c, 0xc9, 0xe9, 0x88,
-                                                     0x52, 0x51, 0xc5, 0x56} };
-
-static const MSGUID parent_locator_guid = { .data1 = 0xa8d35f2d,
-                                            .data2 = 0xb30b,
-                                            .data3 = 0x454d,
-                                            .data4 = { 0xab, 0xf7, 0xd3,
-                                                       0xd8, 0x48, 0x34,
-                                                       0xab, 0x0c} };
-
-static const MSGUID logical_sector_guid = { .data1 = 0x8141bf1d,
-                                            .data2 = 0xa96f,
-                                            .data3 = 0x4709,
-                                            .data4 = { 0xba, 0x47, 0xf2,
-                                                       0x33, 0xa8, 0xfa,
-                                                       0xab, 0x5f} };
-
-/* Each parent type must have a valid GUID; this is for parent images
- * of type 'VHDX'.  If we were to allow e.g. a QCOW2 parent, we would
- * need to make up our own QCOW2 GUID type */
-static const MSGUID parent_vhdx_guid = { .data1 = 0xb04aefb7,
-                                         .data2 = 0xd19e,
-                                         .data3 = 0x4a81,
-                                         .data4 = { 0xb7, 0x89, 0x25, 0xb8,
-                                                    0xe9, 0x44, 0x59, 0x13} };
-
-
-#define META_FILE_PARAMETER_PRESENT      0x01
-#define META_VIRTUAL_DISK_SIZE_PRESENT   0x02
-#define META_PAGE_83_PRESENT             0x04
-#define META_LOGICAL_SECTOR_SIZE_PRESENT 0x08
-#define META_PHYS_SECTOR_SIZE_PRESENT    0x10
-#define META_PARENT_LOCATOR_PRESENT      0x20
-
-#define META_ALL_PRESENT    \
-    (META_FILE_PARAMETER_PRESENT | META_VIRTUAL_DISK_SIZE_PRESENT | \
-     META_PAGE_83_PRESENT | META_LOGICAL_SECTOR_SIZE_PRESENT | \
-     META_PHYS_SECTOR_SIZE_PRESENT)
-
-typedef struct VHDXMetadataEntries {
-    VHDXMetadataTableEntry file_parameters_entry;
-    VHDXMetadataTableEntry virtual_disk_size_entry;
-    VHDXMetadataTableEntry page83_data_entry;
-    VHDXMetadataTableEntry logical_sector_size_entry;
-    VHDXMetadataTableEntry phys_sector_size_entry;
-    VHDXMetadataTableEntry parent_locator_entry;
-    uint16_t present;
-} VHDXMetadataEntries;
-
-
-typedef struct VHDXSectorInfo {
-    uint32_t bat_idx;       /* BAT entry index */
-    uint32_t sectors_avail; /* sectors available in payload block */
-    uint32_t bytes_left;    /* bytes left in the block after data to r/w */
-    uint32_t bytes_avail;   /* bytes available in payload block */
-    uint64_t file_offset;   /* absolute offset in bytes, in file */
-    uint64_t block_offset;  /* block offset, in bytes */
-} VHDXSectorInfo;
-
-
-
-typedef struct BDRVVHDXState {
-    CoMutex lock;
-
-    int curr_header;
-    VHDXHeader *headers[2];
-
-    VHDXRegionTableHeader rt;
-    VHDXRegionTableEntry bat_rt;         /* region table for the BAT */
-    VHDXRegionTableEntry metadata_rt;    /* region table for the metadata */
-
-    VHDXMetadataTableHeader metadata_hdr;
-    VHDXMetadataEntries metadata_entries;
-
-    VHDXFileParameters params;
-    uint32_t block_size;
-    uint32_t block_size_bits;
-    uint32_t sectors_per_block;
-    uint32_t sectors_per_block_bits;
-
-    uint64_t virtual_disk_size;
-    uint32_t logical_sector_size;
-    uint32_t physical_sector_size;
-
-    uint64_t chunk_ratio;
-    uint32_t chunk_ratio_bits;
-    uint32_t logical_sector_size_bits;
-
-    uint32_t bat_entries;
-    VHDXBatEntry *bat;
-    uint64_t bat_offset;
-
-    VHDXParentLocatorHeader parent_header;
-    VHDXParentLocatorEntry *parent_entries;
-
-} BDRVVHDXState;
-
-uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
-                            int crc_offset)
-{
-    uint32_t crc_new;
-    uint32_t crc_orig;
-    assert(buf != NULL);
-
-    if (crc_offset > 0) {
-        memcpy(&crc_orig, buf + crc_offset, sizeof(crc_orig));
-        memset(buf + crc_offset, 0, sizeof(crc_orig));
-    }
-
-    crc_new = crc32c(crc, buf, size);
-    if (crc_offset > 0) {
-        memcpy(buf + crc_offset, &crc_orig, sizeof(crc_orig));
-    }
-
-    return crc_new;
-}
-
-/* Validates the checksum of the buffer, with an in-place CRC.
- *
- * Zero is substituted during crc calculation for the original crc field,
- * and the crc field is restored afterwards.  But the buffer will be modifed
- * during the calculation, so this may not be not suitable for multi-threaded
- * use.
- *
- * crc_offset: byte offset in buf of the buffer crc
- * buf: buffer pointer
- * size: size of buffer (must be > crc_offset+4)
- *
- * returns true if checksum is valid, false otherwise
- */
-bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset)
-{
-    uint32_t crc_orig;
-    uint32_t crc;
-
-    assert(buf != NULL);
-    assert(size > (crc_offset + 4));
-
-    memcpy(&crc_orig, buf + crc_offset, sizeof(crc_orig));
-    crc_orig = le32_to_cpu(crc_orig);
-
-    crc = vhdx_checksum_calc(0xffffffff, buf, size, crc_offset);
-
-    return crc == crc_orig;
-}
-
-
-/*
- * Per the MS VHDX Specification, for every VHDX file:
- *      - The header section is fixed size - 1 MB
- *      - The header section is always the first "object"
- *      - The first 64KB of the header is the File Identifier
- *      - The first uint64 (8 bytes) is the VHDX Signature ("vhdxfile")
- *      - The following 512 bytes constitute a UTF-16 string identifiying the
- *        software that created the file, and is optional and diagnostic only.
- *
- *  Therefore, we probe by looking for the vhdxfile signature "vhdxfile"
- */
-static int vhdx_probe(const uint8_t *buf, int buf_size, const char *filename)
-{
-    if (buf_size >= 8 && !memcmp(buf, "vhdxfile", 8)) {
-        return 100;
-    }
-    return 0;
-}
-
-/* All VHDX structures on disk are little endian */
-static void vhdx_header_le_import(VHDXHeader *h)
-{
-    assert(h != NULL);
-
-    le32_to_cpus(&h->signature);
-    le32_to_cpus(&h->checksum);
-    le64_to_cpus(&h->sequence_number);
-
-    leguid_to_cpus(&h->file_write_guid);
-    leguid_to_cpus(&h->data_write_guid);
-    leguid_to_cpus(&h->log_guid);
-
-    le16_to_cpus(&h->log_version);
-    le16_to_cpus(&h->version);
-    le32_to_cpus(&h->log_length);
-    le64_to_cpus(&h->log_offset);
-}
-
-
-/* opens the specified header block from the VHDX file header section */
-static int vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s)
-{
-    int ret = 0;
-    VHDXHeader *header1;
-    VHDXHeader *header2;
-    bool h1_valid = false;
-    bool h2_valid = false;
-    uint64_t h1_seq = 0;
-    uint64_t h2_seq = 0;
-    uint8_t *buffer;
-
-    header1 = qemu_blockalign(bs, sizeof(VHDXHeader));
-    header2 = qemu_blockalign(bs, sizeof(VHDXHeader));
-
-    buffer = qemu_blockalign(bs, VHDX_HEADER_SIZE);
-
-    s->headers[0] = header1;
-    s->headers[1] = header2;
-
-    /* We have to read the whole VHDX_HEADER_SIZE instead of
-     * sizeof(VHDXHeader), because the checksum is over the whole
-     * region */
-    ret = bdrv_pread(bs->file, VHDX_HEADER1_OFFSET, buffer, VHDX_HEADER_SIZE);
-    if (ret < 0) {
-        goto fail;
-    }
-    /* copy over just the relevant portion that we need */
-    memcpy(header1, buffer, sizeof(VHDXHeader));
-    vhdx_header_le_import(header1);
-
-    if (vhdx_checksum_is_valid(buffer, VHDX_HEADER_SIZE, 4) &&
-        !memcmp(&header1->signature, "head", 4)             &&
-        header1->version == 1) {
-        h1_seq = header1->sequence_number;
-        h1_valid = true;
-    }
-
-    ret = bdrv_pread(bs->file, VHDX_HEADER2_OFFSET, buffer, VHDX_HEADER_SIZE);
-    if (ret < 0) {
-        goto fail;
-    }
-    /* copy over just the relevant portion that we need */
-    memcpy(header2, buffer, sizeof(VHDXHeader));
-    vhdx_header_le_import(header2);
-
-    if (vhdx_checksum_is_valid(buffer, VHDX_HEADER_SIZE, 4) &&
-        !memcmp(&header2->signature, "head", 4)             &&
-        header2->version == 1) {
-        h2_seq = header2->sequence_number;
-        h2_valid = true;
-    }
-
-    /* If there is only 1 valid header (or no valid headers), we
-     * don't care what the sequence numbers are */
-    if (h1_valid && !h2_valid) {
-        s->curr_header = 0;
-    } else if (!h1_valid && h2_valid) {
-        s->curr_header = 1;
-    } else if (!h1_valid && !h2_valid) {
-        ret = -EINVAL;
-        goto fail;
-    } else {
-        /* If both headers are valid, then we choose the active one by the
-         * highest sequence number.  If the sequence numbers are equal, that is
-         * invalid */
-        if (h1_seq > h2_seq) {
-            s->curr_header = 0;
-        } else if (h2_seq > h1_seq) {
-            s->curr_header = 1;
-        } else {
-            ret = -EINVAL;
-            goto fail;
-        }
-    }
-
-    ret = 0;
-
-    goto exit;
-
-fail:
-    qerror_report(ERROR_CLASS_GENERIC_ERROR, "No valid VHDX header found");
-    qemu_vfree(header1);
-    qemu_vfree(header2);
-    s->headers[0] = NULL;
-    s->headers[1] = NULL;
-exit:
-    qemu_vfree(buffer);
-    return ret;
-}
-
-
-static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
-{
-    int ret = 0;
-    uint8_t *buffer;
-    int offset = 0;
-    VHDXRegionTableEntry rt_entry;
-    uint32_t i;
-    bool bat_rt_found = false;
-    bool metadata_rt_found = false;
-
-    /* We have to read the whole 64KB block, because the crc32 is over the
-     * whole block */
-    buffer = qemu_blockalign(bs, VHDX_HEADER_BLOCK_SIZE);
-
-    ret = bdrv_pread(bs->file, VHDX_REGION_TABLE_OFFSET, buffer,
-                     VHDX_HEADER_BLOCK_SIZE);
-    if (ret < 0) {
-        goto fail;
-    }
-    memcpy(&s->rt, buffer, sizeof(s->rt));
-    le32_to_cpus(&s->rt.signature);
-    le32_to_cpus(&s->rt.checksum);
-    le32_to_cpus(&s->rt.entry_count);
-    le32_to_cpus(&s->rt.reserved);
-    offset += sizeof(s->rt);
-
-    if (!vhdx_checksum_is_valid(buffer, VHDX_HEADER_BLOCK_SIZE, 4) ||
-        memcmp(&s->rt.signature, "regi", 4)) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    /* Per spec, maximum region table entry count is 2047 */
-    if (s->rt.entry_count > 2047) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    for (i = 0; i < s->rt.entry_count; i++) {
-        memcpy(&rt_entry, buffer + offset, sizeof(rt_entry));
-        offset += sizeof(rt_entry);
-
-        leguid_to_cpus(&rt_entry.guid);
-        le64_to_cpus(&rt_entry.file_offset);
-        le32_to_cpus(&rt_entry.length);
-        le32_to_cpus(&rt_entry.data_bits);
-
-        /* see if we recognize the entry */
-        if (guid_eq(rt_entry.guid, bat_guid)) {
-            /* must be unique; if we have already found it this is invalid */
-            if (bat_rt_found) {
-                ret = -EINVAL;
-                goto fail;
-            }
-            bat_rt_found = true;
-            s->bat_rt = rt_entry;
-            continue;
-        }
-
-        if (guid_eq(rt_entry.guid, metadata_guid)) {
-            /* must be unique; if we have already found it this is invalid */
-            if (metadata_rt_found) {
-                ret = -EINVAL;
-                goto fail;
-            }
-            metadata_rt_found = true;
-            s->metadata_rt = rt_entry;
-            continue;
-        }
-
-        if (rt_entry.data_bits & VHDX_REGION_ENTRY_REQUIRED) {
-            /* cannot read vhdx file - required region table entry that
-             * we do not understand.  per spec, we must fail to open */
-            ret = -ENOTSUP;
-            goto fail;
-        }
-    }
-    ret = 0;
-
-fail:
-    qemu_vfree(buffer);
-    return ret;
-}
-
-
-
-/* Metadata initial parser
- *
- * This loads all the metadata entry fields.  This may cause additional
- * fields to be processed (e.g. parent locator, etc..).
- *
- * There are 5 Metadata items that are always required:
- *      - File Parameters (block size, has a parent)
- *      - Virtual Disk Size (size, in bytes, of the virtual drive)
- *      - Page 83 Data (scsi page 83 guid)
- *      - Logical Sector Size (logical sector size in bytes, either 512 or
- *                             4096.  We only support 512 currently)
- *      - Physical Sector Size (512 or 4096)
- *
- * Also, if the File Parameters indicate this is a differencing file,
- * we must also look for the Parent Locator metadata item.
- */
-static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
-{
-    int ret = 0;
-    uint8_t *buffer;
-    int offset = 0;
-    uint32_t i = 0;
-    VHDXMetadataTableEntry md_entry;
-
-    buffer = qemu_blockalign(bs, VHDX_METADATA_TABLE_MAX_SIZE);
-
-    ret = bdrv_pread(bs->file, s->metadata_rt.file_offset, buffer,
-                     VHDX_METADATA_TABLE_MAX_SIZE);
-    if (ret < 0) {
-        goto exit;
-    }
-    memcpy(&s->metadata_hdr, buffer, sizeof(s->metadata_hdr));
-    offset += sizeof(s->metadata_hdr);
-
-    le64_to_cpus(&s->metadata_hdr.signature);
-    le16_to_cpus(&s->metadata_hdr.reserved);
-    le16_to_cpus(&s->metadata_hdr.entry_count);
-
-    if (memcmp(&s->metadata_hdr.signature, "metadata", 8)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    s->metadata_entries.present = 0;
-
-    if ((s->metadata_hdr.entry_count * sizeof(md_entry)) >
-        (VHDX_METADATA_TABLE_MAX_SIZE - offset)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    for (i = 0; i < s->metadata_hdr.entry_count; i++) {
-        memcpy(&md_entry, buffer + offset, sizeof(md_entry));
-        offset += sizeof(md_entry);
-
-        leguid_to_cpus(&md_entry.item_id);
-        le32_to_cpus(&md_entry.offset);
-        le32_to_cpus(&md_entry.length);
-        le32_to_cpus(&md_entry.data_bits);
-        le32_to_cpus(&md_entry.reserved2);
-
-        if (guid_eq(md_entry.item_id, file_param_guid)) {
-            if (s->metadata_entries.present & META_FILE_PARAMETER_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.file_parameters_entry = md_entry;
-            s->metadata_entries.present |= META_FILE_PARAMETER_PRESENT;
-            continue;
-        }
-
-        if (guid_eq(md_entry.item_id, virtual_size_guid)) {
-            if (s->metadata_entries.present & META_VIRTUAL_DISK_SIZE_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.virtual_disk_size_entry = md_entry;
-            s->metadata_entries.present |= META_VIRTUAL_DISK_SIZE_PRESENT;
-            continue;
-        }
-
-        if (guid_eq(md_entry.item_id, page83_guid)) {
-            if (s->metadata_entries.present & META_PAGE_83_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.page83_data_entry = md_entry;
-            s->metadata_entries.present |= META_PAGE_83_PRESENT;
-            continue;
-        }
-
-        if (guid_eq(md_entry.item_id, logical_sector_guid)) {
-            if (s->metadata_entries.present &
-                META_LOGICAL_SECTOR_SIZE_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.logical_sector_size_entry = md_entry;
-            s->metadata_entries.present |= META_LOGICAL_SECTOR_SIZE_PRESENT;
-            continue;
-        }
-
-        if (guid_eq(md_entry.item_id, phys_sector_guid)) {
-            if (s->metadata_entries.present & META_PHYS_SECTOR_SIZE_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.phys_sector_size_entry = md_entry;
-            s->metadata_entries.present |= META_PHYS_SECTOR_SIZE_PRESENT;
-            continue;
-        }
-
-        if (guid_eq(md_entry.item_id, parent_locator_guid)) {
-            if (s->metadata_entries.present & META_PARENT_LOCATOR_PRESENT) {
-                ret = -EINVAL;
-                goto exit;
-            }
-            s->metadata_entries.parent_locator_entry = md_entry;
-            s->metadata_entries.present |= META_PARENT_LOCATOR_PRESENT;
-            continue;
-        }
-
-        if (md_entry.data_bits & VHDX_META_FLAGS_IS_REQUIRED) {
-            /* cannot read vhdx file - required region table entry that
-             * we do not understand.  per spec, we must fail to open */
-            ret = -ENOTSUP;
-            goto exit;
-        }
-    }
-
-    if (s->metadata_entries.present != META_ALL_PRESENT) {
-        ret = -ENOTSUP;
-        goto exit;
-    }
-
-    ret = bdrv_pread(bs->file,
-                     s->metadata_entries.file_parameters_entry.offset
-                                         + s->metadata_rt.file_offset,
-                     &s->params,
-                     sizeof(s->params));
-
-    if (ret < 0) {
-        goto exit;
-    }
-
-    le32_to_cpus(&s->params.block_size);
-    le32_to_cpus(&s->params.data_bits);
-
-
-    /* We now have the file parameters, so we can tell if this is a
-     * differencing file (i.e.. has_parent), is dynamic or fixed
-     * sized (leave_blocks_allocated), and the block size */
-
-    /* The parent locator required iff the file parameters has_parent set */
-    if (s->params.data_bits & VHDX_PARAMS_HAS_PARENT) {
-        if (s->metadata_entries.present & META_PARENT_LOCATOR_PRESENT) {
-            /* TODO: parse  parent locator fields */
-            ret = -ENOTSUP; /* temp, until differencing files are supported */
-            goto exit;
-        } else {
-            /* if has_parent is set, but there is not parent locator present,
-             * then that is an invalid combination */
-            ret = -EINVAL;
-            goto exit;
-        }
-    }
-
-    /* determine virtual disk size, logical sector size,
-     * and phys sector size */
-
-    ret = bdrv_pread(bs->file,
-                     s->metadata_entries.virtual_disk_size_entry.offset
-                                           + s->metadata_rt.file_offset,
-                     &s->virtual_disk_size,
-                     sizeof(uint64_t));
-    if (ret < 0) {
-        goto exit;
-    }
-    ret = bdrv_pread(bs->file,
-                     s->metadata_entries.logical_sector_size_entry.offset
-                                             + s->metadata_rt.file_offset,
-                     &s->logical_sector_size,
-                     sizeof(uint32_t));
-    if (ret < 0) {
-        goto exit;
-    }
-    ret = bdrv_pread(bs->file,
-                     s->metadata_entries.phys_sector_size_entry.offset
-                                          + s->metadata_rt.file_offset,
-                     &s->physical_sector_size,
-                     sizeof(uint32_t));
-    if (ret < 0) {
-        goto exit;
-    }
-
-    le64_to_cpus(&s->virtual_disk_size);
-    le32_to_cpus(&s->logical_sector_size);
-    le32_to_cpus(&s->physical_sector_size);
-
-    if (s->logical_sector_size == 0 || s->params.block_size == 0) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    /* both block_size and sector_size are guaranteed powers of 2 */
-    s->sectors_per_block = s->params.block_size / s->logical_sector_size;
-    s->chunk_ratio = (VHDX_MAX_SECTORS_PER_BLOCK) *
-                     (uint64_t)s->logical_sector_size /
-                     (uint64_t)s->params.block_size;
-
-    /* These values are ones we will want to use for division / multiplication
-     * later on, and they are all guaranteed (per the spec) to be powers of 2,
-     * so we can take advantage of that for shift operations during
-     * reads/writes */
-    if (s->logical_sector_size & (s->logical_sector_size - 1)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-    if (s->sectors_per_block & (s->sectors_per_block - 1)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-    if (s->chunk_ratio & (s->chunk_ratio - 1)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-    s->block_size = s->params.block_size;
-    if (s->block_size & (s->block_size - 1)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    s->logical_sector_size_bits = 31 - clz32(s->logical_sector_size);
-    s->sectors_per_block_bits =   31 - clz32(s->sectors_per_block);
-    s->chunk_ratio_bits =         63 - clz64(s->chunk_ratio);
-    s->block_size_bits =          31 - clz32(s->block_size);
-
-    ret = 0;
-
-exit:
-    qemu_vfree(buffer);
-    return ret;
-}
-
-/* Parse the replay log.  Per the VHDX spec, if the log is present
- * it must be replayed prior to opening the file, even read-only.
- *
- * If read-only, we must replay the log in RAM (or refuse to open
- * a dirty VHDX file read-only */
-static int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s)
-{
-    int ret = 0;
-    int i;
-    VHDXHeader *hdr;
-
-    hdr = s->headers[s->curr_header];
-
-    /* either the log guid, or log length is zero,
-     * then a replay log is present */
-    for (i = 0; i < sizeof(hdr->log_guid.data4); i++) {
-        ret |= hdr->log_guid.data4[i];
-    }
-    if (hdr->log_guid.data1 == 0 &&
-        hdr->log_guid.data2 == 0 &&
-        hdr->log_guid.data3 == 0 &&
-        ret == 0) {
-        goto exit;
-    }
-
-    /* per spec, only log version of 0 is supported */
-    if (hdr->log_version != 0) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    if (hdr->log_length == 0) {
-        goto exit;
-    }
-
-    /* We currently do not support images with logs to replay */
-    ret = -ENOTSUP;
-
-exit:
-    return ret;
-}
-
-
-static int vhdx_open(BlockDriverState *bs, QDict *options, int flags)
-{
-    BDRVVHDXState *s = bs->opaque;
-    int ret = 0;
-    uint32_t i;
-    uint64_t signature;
-    uint32_t data_blocks_cnt, bitmap_blocks_cnt;
-
-
-    s->bat = NULL;
-
-    qemu_co_mutex_init(&s->lock);
-
-    /* validate the file signature */
-    ret = bdrv_pread(bs->file, 0, &signature, sizeof(uint64_t));
-    if (ret < 0) {
-        goto fail;
-    }
-    if (memcmp(&signature, "vhdxfile", 8)) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = vhdx_parse_header(bs, s);
-    if (ret) {
-        goto fail;
-    }
-
-    ret = vhdx_parse_log(bs, s);
-    if (ret) {
-        goto fail;
-    }
-
-    ret = vhdx_open_region_tables(bs, s);
-    if (ret) {
-        goto fail;
-    }
-
-    ret = vhdx_parse_metadata(bs, s);
-    if (ret) {
-        goto fail;
-    }
-    s->block_size = s->params.block_size;
-
-    /* the VHDX spec dictates that virtual_disk_size is always a multiple of
-     * logical_sector_size */
-    bs->total_sectors = s->virtual_disk_size >> s->logical_sector_size_bits;
-
-    data_blocks_cnt = s->virtual_disk_size >> s->block_size_bits;
-    if (s->virtual_disk_size - (data_blocks_cnt << s->block_size_bits)) {
-        data_blocks_cnt++;
-    }
-    bitmap_blocks_cnt = data_blocks_cnt >> s->chunk_ratio_bits;
-    if (data_blocks_cnt - (bitmap_blocks_cnt << s->chunk_ratio_bits)) {
-        bitmap_blocks_cnt++;
-    }
-
-    if (s->parent_entries) {
-        s->bat_entries = bitmap_blocks_cnt * (s->chunk_ratio + 1);
-    } else {
-        s->bat_entries = data_blocks_cnt +
-                         ((data_blocks_cnt - 1) >> s->chunk_ratio_bits);
-    }
-
-    s->bat_offset = s->bat_rt.file_offset;
-
-    if (s->bat_entries > s->bat_rt.length / sizeof(VHDXBatEntry)) {
-        /* BAT allocation is not large enough for all entries */
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    s->bat = qemu_blockalign(bs, s->bat_rt.length);
-
-    ret = bdrv_pread(bs->file, s->bat_offset, s->bat, s->bat_rt.length);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    for (i = 0; i < s->bat_entries; i++) {
-        le64_to_cpus(&s->bat[i]);
-    }
-
-    if (flags & BDRV_O_RDWR) {
-        ret = -ENOTSUP;
-        goto fail;
-    }
-
-    /* TODO: differencing files, write */
-
-    return 0;
-fail:
-    qemu_vfree(s->headers[0]);
-    qemu_vfree(s->headers[1]);
-    qemu_vfree(s->bat);
-    qemu_vfree(s->parent_entries);
-    return ret;
-}
-
-static int vhdx_reopen_prepare(BDRVReopenState *state,
-                               BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
-}
-
-
-/*
- * Perform sector to block offset translations, to get various
- * sector and file offsets into the image.  See VHDXSectorInfo
- */
-static void vhdx_block_translate(BDRVVHDXState *s, int64_t sector_num,
-                                 int nb_sectors, VHDXSectorInfo *sinfo)
-{
-    uint32_t block_offset;
-
-    sinfo->bat_idx = sector_num >> s->sectors_per_block_bits;
-    /* effectively a modulo - this gives us the offset into the block
-     * (in sector sizes) for our sector number */
-    block_offset = sector_num - (sinfo->bat_idx << s->sectors_per_block_bits);
-    /* the chunk ratio gives us the interleaving of the sector
-     * bitmaps, so we need to advance our page block index by the
-     * sector bitmaps entry number */
-    sinfo->bat_idx += sinfo->bat_idx >> s->chunk_ratio_bits;
-
-    /* the number of sectors we can read/write in this cycle */
-    sinfo->sectors_avail = s->sectors_per_block - block_offset;
-
-    sinfo->bytes_left = sinfo->sectors_avail << s->logical_sector_size_bits;
-
-    if (sinfo->sectors_avail > nb_sectors) {
-        sinfo->sectors_avail = nb_sectors;
-    }
-
-    sinfo->bytes_avail = sinfo->sectors_avail << s->logical_sector_size_bits;
-
-    sinfo->file_offset = s->bat[sinfo->bat_idx] >> VHDX_BAT_FILE_OFF_BITS;
-
-    sinfo->block_offset = block_offset << s->logical_sector_size_bits;
-
-    /* The file offset must be past the header section, so must be > 0 */
-    if (sinfo->file_offset == 0) {
-        return;
-    }
-
-    /* block offset is the offset in vhdx logical sectors, in
-     * the payload data block. Convert that to a byte offset
-     * in the block, and add in the payload data block offset
-     * in the file, in bytes, to get the final read address */
-
-    sinfo->file_offset <<= 20;  /* now in bytes, rather than 1MB units */
-    sinfo->file_offset += sinfo->block_offset;
-}
-
-
-
-static coroutine_fn int vhdx_co_readv(BlockDriverState *bs, int64_t sector_num,
-                                      int nb_sectors, QEMUIOVector *qiov)
-{
-    BDRVVHDXState *s = bs->opaque;
-    int ret = 0;
-    VHDXSectorInfo sinfo;
-    uint64_t bytes_done = 0;
-    QEMUIOVector hd_qiov;
-
-    qemu_iovec_init(&hd_qiov, qiov->niov);
-
-    qemu_co_mutex_lock(&s->lock);
-
-    while (nb_sectors > 0) {
-        /* We are a differencing file, so we need to inspect the sector bitmap
-         * to see if we have the data or not */
-        if (s->params.data_bits & VHDX_PARAMS_HAS_PARENT) {
-            /* not supported yet */
-            ret = -ENOTSUP;
-            goto exit;
-        } else {
-            vhdx_block_translate(s, sector_num, nb_sectors, &sinfo);
-
-            qemu_iovec_reset(&hd_qiov);
-            qemu_iovec_concat(&hd_qiov, qiov,  bytes_done, sinfo.bytes_avail);
-
-            /* check the payload block state */
-            switch (s->bat[sinfo.bat_idx] & VHDX_BAT_STATE_BIT_MASK) {
-            case PAYLOAD_BLOCK_NOT_PRESENT: /* fall through */
-            case PAYLOAD_BLOCK_UNDEFINED:   /* fall through */
-            case PAYLOAD_BLOCK_UNMAPPED:    /* fall through */
-            case PAYLOAD_BLOCK_ZERO:
-                /* return zero */
-                qemu_iovec_memset(&hd_qiov, 0, 0, sinfo.bytes_avail);
-                break;
-            case PAYLOAD_BLOCK_FULL_PRESENT:
-                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_readv(bs->file,
-                                    sinfo.file_offset >> BDRV_SECTOR_BITS,
-                                    sinfo.sectors_avail, &hd_qiov);
-                qemu_co_mutex_lock(&s->lock);
-                if (ret < 0) {
-                    goto exit;
-                }
-                break;
-            case PAYLOAD_BLOCK_PARTIALLY_PRESENT:
-                /* we don't yet support difference files, fall through
-                 * to error */
-            default:
-                ret = -EIO;
-                goto exit;
-                break;
-            }
-            nb_sectors -= sinfo.sectors_avail;
-            sector_num += sinfo.sectors_avail;
-            bytes_done += sinfo.bytes_avail;
-        }
-    }
-    ret = 0;
-exit:
-    qemu_co_mutex_unlock(&s->lock);
-    qemu_iovec_destroy(&hd_qiov);
-    return ret;
-}
-
-
-
-static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
-                                      int nb_sectors, QEMUIOVector *qiov)
-{
-    return -ENOTSUP;
-}
-
-
-static void vhdx_close(BlockDriverState *bs)
-{
-    BDRVVHDXState *s = bs->opaque;
-    qemu_vfree(s->headers[0]);
-    qemu_vfree(s->headers[1]);
-    qemu_vfree(s->bat);
-    qemu_vfree(s->parent_entries);
-}
-
-static BlockDriver bdrv_vhdx = {
-    .format_name            = "vhdx",
-    .instance_size          = sizeof(BDRVVHDXState),
-    .bdrv_probe             = vhdx_probe,
-    .bdrv_open              = vhdx_open,
-    .bdrv_close             = vhdx_close,
-    .bdrv_reopen_prepare    = vhdx_reopen_prepare,
-    .bdrv_co_readv          = vhdx_co_readv,
-    .bdrv_co_writev         = vhdx_co_writev,
-};
-
-static void bdrv_vhdx_init(void)
-{
-    bdrv_register(&bdrv_vhdx);
-}
-
-block_init(bdrv_vhdx_init);
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -1,325 +0,0 @@
-/*
- * Block driver for Hyper-V VHDX Images
- *
- * Copyright (c) 2013 Red Hat, Inc.,
- *
- * Authors:
- *  Jeff Cody <jcody@redhat.com>
- *
- *  This is based on the "VHDX Format Specification v0.95", published 4/12/2012
- *  by Microsoft:
- *      https://www.microsoft.com/en-us/download/details.aspx?id=29681
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#ifndef BLOCK_VHDX_H
-#define BLOCK_VHDX_H
-
-/* Structures and fields present in the VHDX file */
-
-/* The header section has the following blocks,
- * each block is 64KB:
- *
- * _____________________________________________________________________________
- * | File Id. |   Header 1    | Header 2   | Region Table |  Reserved (768KB)  |
- * |----------|---------------|------------|--------------|--------------------|
- * |          |               |            |              |                    |
- * 0.........64KB...........128KB........192KB..........256KB................1MB
- */
-
-#define VHDX_HEADER_BLOCK_SIZE      (64*1024)
-
-#define VHDX_FILE_ID_OFFSET         0
-#define VHDX_HEADER1_OFFSET         (VHDX_HEADER_BLOCK_SIZE*1)
-#define VHDX_HEADER2_OFFSET         (VHDX_HEADER_BLOCK_SIZE*2)
-#define VHDX_REGION_TABLE_OFFSET    (VHDX_HEADER_BLOCK_SIZE*3)
-
-
-/*
- * A note on the use of MS-GUID fields.  For more details on the GUID,
- * please see: https://en.wikipedia.org/wiki/Globally_unique_identifier.
- *
- * The VHDX specification only states that these are MS GUIDs, and which
- * bytes are data1-data4. It makes no mention of what algorithm should be used
- * to generate the GUID, nor what standard.  However, looking at the specified
- * known GUID fields, it appears the GUIDs are:
- *  Standard/DCE GUID type  (noted by 10b in the MSB of byte 0 of .data4)
- *  Random algorithm        (noted by 0x4XXX for .data3)
- */
-
-/* ---- HEADER SECTION STRUCTURES ---- */
-
-/* These structures are ones that are defined in the VHDX specification
- * document */
-
-typedef struct VHDXFileIdentifier {
-    uint64_t    signature;              /* "vhdxfile" in ASCII */
-    uint16_t    creator[256];           /* optional; utf-16 string to identify
-                                           the vhdx file creator.  Diagnotistic
-                                           only */
-} VHDXFileIdentifier;
-
-
-/* the guid is a 16 byte unique ID - the definition for this used by
- * Microsoft is not just 16 bytes though - it is a structure that is defined,
- * so we need to follow it here so that endianness does not trip us up */
-
-typedef struct MSGUID {
-    uint32_t  data1;
-    uint16_t  data2;
-    uint16_t  data3;
-    uint8_t   data4[8];
-} MSGUID;
-
-#define guid_eq(a, b) \
-    (memcmp(&(a), &(b), sizeof(MSGUID)) == 0)
-
-#define VHDX_HEADER_SIZE (4*1024)   /* although the vhdx_header struct in disk
-                                       is only 582 bytes, for purposes of crc
-                                       the header is the first 4KB of the 64KB
-                                       block */
-
-/* The full header is 4KB, although the actual header data is much smaller.
- * But for the checksum calculation, it is over the entire 4KB structure,
- * not just the defined portion of it */
-typedef struct QEMU_PACKED VHDXHeader {
-    uint32_t    signature;              /* "head" in ASCII */
-    uint32_t    checksum;               /* CRC-32C hash of the whole header */
-    uint64_t    sequence_number;        /* Seq number of this header.  Each
-                                           VHDX file has 2 of these headers,
-                                           and only the header with the highest
-                                           sequence number is valid */
-    MSGUID      file_write_guid;       /* 128 bit unique identifier. Must be
-                                           updated to new, unique value before
-                                           the first modification is made to
-                                           file */
-    MSGUID      data_write_guid;        /* 128 bit unique identifier. Must be
-                                           updated to new, unique value before
-                                           the first modification is made to
-                                           visible data.   Visbile data is
-                                           defined as:
-                                                    - system & user metadata
-                                                    - raw block data
-                                                    - disk size
-                                                    - any change that will
-                                                      cause the virtual disk
-                                                      sector read to differ
-
-                                           This does not need to change if
-                                           blocks are re-arranged */
-    MSGUID      log_guid;               /* 128 bit unique identifier. If zero,
-                                           there is no valid log. If non-zero,
-                                           log entries with this guid are
-                                           valid. */
-    uint16_t    log_version;            /* version of the log format. Mustn't be
-                                           zero, unless log_guid is also zero */
-    uint16_t    version;                /* version of th evhdx file.  Currently,
-                                           only supported version is "1" */
-    uint32_t    log_length;             /* length of the log.  Must be multiple
-                                           of 1MB */
-    uint64_t    log_offset;             /* byte offset in the file of the log.
-                                           Must also be a multiple of 1MB */
-} VHDXHeader;
-
-/* Header for the region table block */
-typedef struct QEMU_PACKED VHDXRegionTableHeader {
-    uint32_t    signature;              /* "regi" in ASCII */
-    uint32_t    checksum;               /* CRC-32C hash of the 64KB table */
-    uint32_t    entry_count;            /* number of valid entries */
-    uint32_t    reserved;
-} VHDXRegionTableHeader;
-
-/* Individual region table entry.  There may be a maximum of 2047 of these
- *
- *  There are two known region table properties.  Both are required.
- *  BAT (block allocation table):  2DC27766F62342009D64115E9BFD4A08
- *  Metadata:                      8B7CA20647904B9AB8FE575F050F886E
- */
-#define VHDX_REGION_ENTRY_REQUIRED  0x01    /* if set, parser must understand
-                                               this entry in order to open
-                                               file */
-typedef struct QEMU_PACKED VHDXRegionTableEntry {
-    MSGUID      guid;                   /* 128-bit unique identifier */
-    uint64_t    file_offset;            /* offset of the object in the file.
-                                           Must be multiple of 1MB */
-    uint32_t    length;                 /* length, in bytes, of the object */
-    uint32_t    data_bits;
-} VHDXRegionTableEntry;
-
-
-/* ---- LOG ENTRY STRUCTURES ---- */
-#define VHDX_LOG_HDR_SIZE 64
-typedef struct QEMU_PACKED VHDXLogEntryHeader {
-    uint32_t    signature;              /* "loge" in ASCII */
-    uint32_t    checksum;               /* CRC-32C hash of the 64KB table */
-    uint32_t    entry_length;           /* length in bytes, multiple of 1MB */
-    uint32_t    tail;                   /* byte offset of first log entry of a
-                                           seq, where this entry is the last
-                                           entry */
-    uint64_t    sequence_number;        /* incremented with each log entry.
-                                           May not be zero. */
-    uint32_t    descriptor_count;       /* number of descriptors in this log
-                                           entry, must be >= 0 */
-    uint32_t    reserved;
-    MSGUID      log_guid;               /* value of the log_guid from
-                                           vhdx_header.  If not found in
-                                           vhdx_header, it is invalid */
-    uint64_t    flushed_file_offset;    /* see spec for full details - this
-                                           sould be vhdx file size in bytes */
-    uint64_t    last_file_offset;       /* size in bytes that all allocated
-                                           file structures fit into */
-} VHDXLogEntryHeader;
-
-#define VHDX_LOG_DESC_SIZE 32
-
-typedef struct QEMU_PACKED VHDXLogDescriptor {
-    uint32_t    signature;              /* "zero" or "desc" in ASCII */
-    union  {
-        uint32_t    reserved;           /* zero desc */
-        uint32_t    trailing_bytes;     /* data desc: bytes 4092-4096 of the
-                                           data sector */
-    };
-    union {
-        uint64_t    zero_length;        /* zero desc: length of the section to
-                                           zero */
-        uint64_t    leading_bytes;      /* data desc: bytes 0-7 of the data
-                                           sector */
-    };
-    uint64_t    file_offset;            /* file offset to write zeros - multiple
-                                           of 4kB */
-    uint64_t    sequence_number;        /* must match same field in
-                                           vhdx_log_entry_header */
-} VHDXLogDescriptor;
-
-typedef struct QEMU_PACKED VHDXLogDataSector {
-    uint32_t    data_signature;         /* "data" in ASCII */
-    uint32_t    sequence_high;          /* 4 MSB of 8 byte sequence_number */
-    uint8_t     data[4084];             /* raw data, bytes 8-4091 (inclusive).
-                                           see the data descriptor field for the
-                                           other mising bytes */
-    uint32_t    sequence_low;           /* 4 LSB of 8 byte sequence_number */
-} VHDXLogDataSector;
-
-
-
-/* block states - different state values depending on whether it is a
- * payload block, or a sector block. */
-
-#define PAYLOAD_BLOCK_NOT_PRESENT       0
-#define PAYLOAD_BLOCK_UNDEFINED         1
-#define PAYLOAD_BLOCK_ZERO              2
-#define PAYLOAD_BLOCK_UNMAPPED          5
-#define PAYLOAD_BLOCK_FULL_PRESENT      6
-#define PAYLOAD_BLOCK_PARTIALLY_PRESENT 7
-
-#define SB_BLOCK_NOT_PRESENT    0
-#define SB_BLOCK_PRESENT        6
-
-/* per the spec */
-#define VHDX_MAX_SECTORS_PER_BLOCK  (1<<23)
-
-/* upper 44 bits are the file offset in 1MB units lower 3 bits are the state
-   other bits are reserved */
-#define VHDX_BAT_STATE_BIT_MASK 0x07
-#define VHDX_BAT_FILE_OFF_BITS (64-44)
-typedef uint64_t VHDXBatEntry;
-
-/* ---- METADATA REGION STRUCTURES ---- */
-
-#define VHDX_METADATA_ENTRY_SIZE 32
-#define VHDX_METADATA_MAX_ENTRIES 2047  /* not including the header */
-#define VHDX_METADATA_TABLE_MAX_SIZE \
-    (VHDX_METADATA_ENTRY_SIZE * (VHDX_METADATA_MAX_ENTRIES+1))
-typedef struct QEMU_PACKED VHDXMetadataTableHeader {
-    uint64_t    signature;              /* "metadata" in ASCII */
-    uint16_t    reserved;
-    uint16_t    entry_count;            /* number table entries. <= 2047 */
-    uint32_t    reserved2[5];
-} VHDXMetadataTableHeader;
-
-#define VHDX_META_FLAGS_IS_USER         0x01    /* max 1024 entries */
-#define VHDX_META_FLAGS_IS_VIRTUAL_DISK 0x02    /* virtual disk metadata if set,
-                                                   otherwise file metdata */
-#define VHDX_META_FLAGS_IS_REQUIRED     0x04    /* parse must understand this
-                                                   entry to open the file */
-typedef struct QEMU_PACKED VHDXMetadataTableEntry {
-    MSGUID      item_id;                /* 128-bit identifier for metadata */
-    uint32_t    offset;                 /* byte offset of the metadata.  At
-                                           least 64kB.  Relative to start of
-                                           metadata region */
-                                        /* note: if length = 0, so is offset */
-    uint32_t    length;                 /* length of metadata. <= 1MB. */
-    uint32_t    data_bits;      /* least-significant 3 bits are flags, the
-                                   rest are reserved (see above) */
-    uint32_t    reserved2;
-} VHDXMetadataTableEntry;
-
-#define VHDX_PARAMS_LEAVE_BLOCKS_ALLOCED 0x01   /* Do not change any blocks to
-                                                   be BLOCK_NOT_PRESENT.
-                                                   If set indicates a fixed
-                                                   size VHDX file */
-#define VHDX_PARAMS_HAS_PARENT           0x02    /* has parent / backing file */
-typedef struct QEMU_PACKED VHDXFileParameters {
-    uint32_t    block_size;             /* size of each payload block, always
-                                           power of 2, <= 256MB and >= 1MB. */
-    uint32_t data_bits;     /* least-significant 2 bits are flags, the rest
-                               are reserved (see above) */
-} VHDXFileParameters;
-
-typedef struct QEMU_PACKED VHDXVirtualDiskSize {
-    uint64_t    virtual_disk_size;      /* Size of the virtual disk, in bytes.
-                                           Must be multiple of the sector size,
-                                           max of 64TB */
-} VHDXVirtualDiskSize;
-
-typedef struct QEMU_PACKED VHDXPage83Data {
-    MSGUID      page_83_data[16];       /* unique id for scsi devices that
-                                           support page 0x83 */
-} VHDXPage83Data;
-
-typedef struct QEMU_PACKED VHDXVirtualDiskLogicalSectorSize {
-    uint32_t    logical_sector_size;    /* virtual disk sector size (in bytes).
-                                           Can only be 512 or 4096 bytes */
-} VHDXVirtualDiskLogicalSectorSize;
-
-typedef struct QEMU_PACKED VHDXVirtualDiskPhysicalSectorSize {
-    uint32_t    physical_sector_size;   /* physical sector size (in bytes).
-                                           Can only be 512 or 4096 bytes */
-} VHDXVirtualDiskPhysicalSectorSize;
-
-typedef struct QEMU_PACKED VHDXParentLocatorHeader {
-    MSGUID      locator_type[16];       /* type of the parent virtual disk. */
-    uint16_t    reserved;
-    uint16_t    key_value_count;        /* number of key/value pairs for this
-                                           locator */
-} VHDXParentLocatorHeader;
-
-/* key and value strings are UNICODE strings, UTF-16 LE encoding, no NULs */
-typedef struct QEMU_PACKED VHDXParentLocatorEntry {
-    uint32_t    key_offset;             /* offset in metadata for key, > 0 */
-    uint32_t    value_offset;           /* offset in metadata for value, >0 */
-    uint16_t    key_length;             /* length of entry key, > 0 */
-    uint16_t    value_length;           /* length of entry value, > 0 */
-} VHDXParentLocatorEntry;
-
-
-/* ----- END VHDX SPECIFICATION STRUCTURES ---- */
-
-
-uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
-                            int crc_offset);
-
-bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset);
-
-
-static void leguid_to_cpus(MSGUID *guid)
-{
-    le32_to_cpus(&guid->data1);
-    le16_to_cpus(&guid->data2);
-    le16_to_cpus(&guid->data3);
-}
-
-#endif
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -24,32 +24,17 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"
 #include <zlib.h>

 #define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')
 #define VMDK4_MAGIC (('K' << 24) | ('D' << 16) | ('M' << 8) | 'V')
 #define VMDK4_COMPRESSION_DEFLATE 1
-#define VMDK4_FLAG_NL_DETECT (1 << 0)
 #define VMDK4_FLAG_RGD (1 << 1)
-/* Zeroed-grain enable bit */
-#define VMDK4_FLAG_ZERO_GRAIN   (1 << 2)
 #define VMDK4_FLAG_COMPRESS (1 << 16)
 #define VMDK4_FLAG_MARKER (1 << 17)
-#define VMDK4_GD_AT_END 0xffffffffffffffffULL
-
-#define VMDK_GTE_ZEROED 0x1
-
-/* VMDK internal error codes */
-#define VMDK_OK      0
-#define VMDK_ERROR   (-1)
-/* Cluster not allocated */
-#define VMDK_UNALLOC (-2)
-#define VMDK_ZEROED  (-3)
-
-#define BLOCK_OPT_ZEROED_GRAIN "zeroed_grain"

 typedef struct {
    uint32_t version;
@@ -72,8 +57,8 @@ typedef struct {
    int64_t desc_offset;
    int64_t desc_size;
    int32_t num_gtes_per_gte;
-    int64_t rgd_offset;
    int64_t gd_offset;
+    int64_t rgd_offset;
    int64_t grain_offset;
    char filler[1];
    char check_bytes[4];
@@ -87,8 +72,6 @@ typedef struct VmdkExtent {
    bool flat;
    bool compressed;
    bool has_marker;
-    bool has_zero_grain;
-    int version;
    int64_t sectors;
    int64_t end_sector;
    int64_t flat_start_offset;
@@ -124,7 +107,6 @@ typedef struct VmdkMetaData {
    unsigned int l2_index;
    unsigned int l2_offset;
    int valid;
-    uint32_t *l2_cache_entry;
 } VmdkMetaData;

 typedef struct VmdkGrainMarker {
@@ -133,13 +115,6 @@ typedef struct VmdkGrainMarker {
    uint8_t  data[0];
 } VmdkGrainMarker;

-enum {
-    MARKER_END_OF_STREAM    = 0,
-    MARKER_GRAIN_TABLE      = 1,
-    MARKER_GRAIN_DIRECTORY  = 2,
-    MARKER_FOOTER           = 3,
-};
-
 static int vmdk_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    uint32_t magic;
@@ -317,40 +292,6 @@ static int vmdk_is_cid_valid(BlockDriverState *bs)
    return 1;
 }

-/* Queue extents, if any, for reopen() */
-static int vmdk_reopen_prepare(BDRVReopenState *state,
-                               BlockReopenQueue *queue, Error **errp)
-{
-    BDRVVmdkState *s;
-    int ret = -1;
-    int i;
-    VmdkExtent *e;
-
-    assert(state != NULL);
-    assert(state->bs != NULL);
-
-    if (queue == NULL) {
-        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
-                 "No reopen queue for VMDK extents");
-        goto exit;
-    }
-
-    s = state->bs->opaque;
-
-    assert(s != NULL);
-
-    for (i = 0; i < s->num_extents; i++) {
-        e = &s->extents[i];
-        if (e->file != state->bs->file) {
-            bdrv_reopen_queue(queue, e->file, state->flags);
-        }
-    }
-    ret = 0;
-
-exit:
-    return ret;
-}
-
 static int vmdk_parent_open(BlockDriverState *bs)
 {
    char *p_name;
@@ -510,54 +451,6 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    if (header.capacity == 0 && header.desc_offset) {
        return vmdk_open_desc_file(bs, flags, header.desc_offset << 9);
    }
-
-    if (le64_to_cpu(header.gd_offset) == VMDK4_GD_AT_END) {
-        /*
-         * The footer takes precedence over the header, so read it in. The
-         * footer starts at offset -1024 from the end: One sector for the
-         * footer, and another one for the end-of-stream marker.
-         */
-        struct {
-            struct {
-                uint64_t val;
-                uint32_t size;
-                uint32_t type;
-                uint8_t pad[512 - 16];
-            } QEMU_PACKED footer_marker;
-
-            uint32_t magic;
-            VMDK4Header header;
-            uint8_t pad[512 - 4 - sizeof(VMDK4Header)];
-
-            struct {
-                uint64_t val;
-                uint32_t size;
-                uint32_t type;
-                uint8_t pad[512 - 16];
-            } QEMU_PACKED eos_marker;
-        } QEMU_PACKED footer;
-
-        ret = bdrv_pread(file,
-            bs->file->total_sectors * 512 - 1536,
-            &footer, sizeof(footer));
-        if (ret < 0) {
-            return ret;
-        }
-
-        /* Some sanity checks for the footer */
-        if (be32_to_cpu(footer.magic) != VMDK4_MAGIC ||
-            le32_to_cpu(footer.footer_marker.size) != 0  ||
-            le32_to_cpu(footer.footer_marker.type) != MARKER_FOOTER ||
-            le64_to_cpu(footer.eos_marker.val) != 0  ||
-            le32_to_cpu(footer.eos_marker.size) != 0  ||
-            le32_to_cpu(footer.eos_marker.type) != MARKER_END_OF_STREAM)
-        {
-            return -EINVAL;
-        }
-
-        header = footer.header;
-    }
-
    l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte)
                        * le64_to_cpu(header.granularity);
    if (l1_entry_sectors == 0) {
@@ -578,8 +471,6 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    extent->compressed =
        le16_to_cpu(header.compressAlgorithm) == VMDK4_COMPRESSION_DEFLATE;
    extent->has_marker = le32_to_cpu(header.flags) & VMDK4_FLAG_MARKER;
-    extent->version = le32_to_cpu(header.version);
-    extent->has_zero_grain = le32_to_cpu(header.flags) & VMDK4_FLAG_ZERO_GRAIN;
    ret = vmdk_init_tables(bs, extent);
    if (ret) {
        /* free extent allocated by vmdk_add_extent */
@@ -597,22 +488,22 @@ static int vmdk_parse_description(const char *desc, const char *opt_name,

    opt_pos = strstr(desc, opt_name);
    if (!opt_pos) {
-        return VMDK_ERROR;
+        return -1;
    }
    /* Skip "=\"" following opt_name */
    opt_pos += strlen(opt_name) + 2;
    if (opt_pos >= end) {
-        return VMDK_ERROR;
+        return -1;
    }
    opt_end = opt_pos;
    while (opt_end < end && *opt_end != '"') {
        opt_end++;
    }
    if (opt_end == end || buf_size < opt_end - opt_pos + 1) {
-        return VMDK_ERROR;
+        return -1;
    }
    pstrcpy(buf, opt_end - opt_pos + 1, opt_pos);
-    return VMDK_OK;
+    return 0;
 }

 /* Open an extent file and append to bs array */
@@ -635,7 +526,7 @@ static int vmdk_open_sparse(BlockDriverState *bs,
            return vmdk_open_vmdk4(bs, file, flags);
            break;
        default:
-            return -EMEDIUMTYPE;
+            return -EINVAL;
            break;
    }
 }
@@ -660,7 +551,7 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
         * RW [size in sectors] SPARSE "file-name.vmdk"
         */
        flat_offset = -1;
-        ret = sscanf(p, "%10s %" SCNd64 " %10s \"%511[^\n\r\"]\" %" SCNd64,
+        ret = sscanf(p, "%10s %" SCNd64 " %10s %511s %" SCNd64,
                access, &sectors, type, fname, &flat_offset);
        if (ret < 4 || strcmp(access, "RW")) {
            goto next_line;
@@ -672,6 +563,14 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            return -EINVAL;
        }

+        /* trim the quotation marks around */
+        if (fname[0] == '"') {
+            memmove(fname, fname + 1, strlen(fname));
+            if (strlen(fname) <= 1 || fname[strlen(fname) - 1] != '"') {
+                return -EINVAL;
+            }
+            fname[strlen(fname) - 1] = '\0';
+        }
        if (sectors <= 0 ||
            (strcmp(type, "FLAT") && strcmp(type, "SPARSE")) ||
            (strcmp(access, "RW"))) {
@@ -680,7 +579,7 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,

        path_combine(extent_path, sizeof(extent_path),
                desc_file_path, fname);
-        ret = bdrv_file_open(&extent_file, extent_path, NULL, bs->open_flags);
+        ret = bdrv_file_open(&extent_file, extent_path, bs->open_flags);
        if (ret) {
            return ret;
        }
@@ -729,7 +628,7 @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
    }
    buf[2047] = '\0';
    if (vmdk_parse_description(buf, "createType", ct, sizeof(ct))) {
-        return -EMEDIUMTYPE;
+        return -EINVAL;
    }
    if (strcmp(ct, "monolithicFlat") &&
        strcmp(ct, "twoGbMaxExtentSparse") &&
@@ -742,7 +641,7 @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
    return vmdk_parse_extents(buf, bs, bs->file->filename);
 }

-static int vmdk_open(BlockDriverState *bs, QDict *options, int flags)
+static int vmdk_open(BlockDriverState *bs, int flags)
 {
    int ret;
    BDRVVmdkState *s = bs->opaque;
@@ -791,7 +690,7 @@ static int get_whole_cluster(BlockDriverState *bs,
        int ret;

        if (!vmdk_is_cid_valid(bs)) {
-            return VMDK_ERROR;
+            return -1;
        }

        /* floor offset to cluster */
@@ -799,31 +698,30 @@ static int get_whole_cluster(BlockDriverState *bs,
        ret = bdrv_read(bs->backing_hd, offset >> 9, whole_grain,
                extent->cluster_sectors);
        if (ret < 0) {
-            return VMDK_ERROR;
+            return -1;
        }

        /* Write grain only into the active image */
        ret = bdrv_write(extent->file, cluster_offset, whole_grain,
                extent->cluster_sectors);
        if (ret < 0) {
-            return VMDK_ERROR;
+            return -1;
        }
    }
-    return VMDK_OK;
+    return 0;
 }

 static int vmdk_L2update(VmdkExtent *extent, VmdkMetaData *m_data)
 {
-    uint32_t offset;
-    QEMU_BUILD_BUG_ON(sizeof(offset) != sizeof(m_data->offset));
-    offset = cpu_to_le32(m_data->offset);
    /* update L2 table */
    if (bdrv_pwrite_sync(
                extent->file,
                ((int64_t)m_data->l2_offset * 512)
                    + (m_data->l2_index * sizeof(m_data->offset)),
-                &offset, sizeof(offset)) < 0) {
-        return VMDK_ERROR;
+                &(m_data->offset),
+                sizeof(m_data->offset)
+            ) < 0) {
+        return -1;
    }
    /* update backup L2 table */
    if (extent->l1_backup_table_offset != 0) {
@@ -832,15 +730,13 @@ static int vmdk_L2update(VmdkExtent *extent, VmdkMetaData *m_data)
                    extent->file,
                    ((int64_t)m_data->l2_offset * 512)
                        + (m_data->l2_index * sizeof(m_data->offset)),
-                    &offset, sizeof(offset)) < 0) {
-            return VMDK_ERROR;
+                    &(m_data->offset), sizeof(m_data->offset)
+                ) < 0) {
+            return -1;
        }
    }
-    if (m_data->l2_cache_entry) {
-        *m_data->l2_cache_entry = offset;
-    }

-    return VMDK_OK;
+    return 0;
 }

 static int get_cluster_offset(BlockDriverState *bs,
@@ -852,25 +748,24 @@ static int get_cluster_offset(BlockDriverState *bs,
 {
    unsigned int l1_index, l2_offset, l2_index;
    int min_index, i, j;
-    uint32_t min_count, *l2_table;
-    bool zeroed = false;
+    uint32_t min_count, *l2_table, tmp = 0;

    if (m_data) {
        m_data->valid = 0;
    }
    if (extent->flat) {
        *cluster_offset = extent->flat_start_offset;
-        return VMDK_OK;
+        return 0;
    }

    offset -= (extent->end_sector - extent->sectors) * SECTOR_SIZE;
    l1_index = (offset >> 9) / extent->l1_entry_sectors;
    if (l1_index >= extent->l1_size) {
-        return VMDK_ERROR;
+        return -1;
    }
    l2_offset = extent->l1_table[l1_index];
    if (!l2_offset) {
-        return VMDK_UNALLOC;
+        return -1;
    }
    for (i = 0; i < L2_CACHE_SIZE; i++) {
        if (l2_offset == extent->l2_cache_offsets[i]) {
@@ -900,7 +795,7 @@ static int get_cluster_offset(BlockDriverState *bs,
                l2_table,
                extent->l2_size * sizeof(uint32_t)
            ) != extent->l2_size * sizeof(uint32_t)) {
-        return VMDK_ERROR;
+        return -1;
    }

    extent->l2_cache_offsets[min_index] = l2_offset;
@@ -909,21 +804,9 @@ static int get_cluster_offset(BlockDriverState *bs,
    l2_index = ((offset >> 9) / extent->cluster_sectors) % extent->l2_size;
    *cluster_offset = le32_to_cpu(l2_table[l2_index]);

-    if (m_data) {
-        m_data->valid = 1;
-        m_data->l1_index = l1_index;
-        m_data->l2_index = l2_index;
-        m_data->offset = *cluster_offset;
-        m_data->l2_offset = l2_offset;
-        m_data->l2_cache_entry = &l2_table[l2_index];
-    }
-    if (extent->has_zero_grain && *cluster_offset == VMDK_GTE_ZEROED) {
-        zeroed = true;
-    }
-
-    if (!*cluster_offset || zeroed) {
+    if (!*cluster_offset) {
        if (!allocate) {
-            return zeroed ? VMDK_ZEROED : VMDK_UNALLOC;
+            return -1;
        }

        /* Avoid the L2 tables update for the images that have snapshots. */
@@ -936,7 +819,8 @@ static int get_cluster_offset(BlockDriverState *bs,
        }

        *cluster_offset >>= 9;
-        l2_table[l2_index] = cpu_to_le32(*cluster_offset);
+        tmp = cpu_to_le32(*cluster_offset);
+        l2_table[l2_index] = tmp;

        /* First of all we write grain itself, to avoid race condition
         * that may to corrupt the image.
@@ -945,15 +829,19 @@ static int get_cluster_offset(BlockDriverState *bs,
         */
        if (get_whole_cluster(
                bs, extent, *cluster_offset, offset, allocate) == -1) {
-            return VMDK_ERROR;
+            return -1;
        }

        if (m_data) {
-            m_data->offset = *cluster_offset;
+            m_data->offset = tmp;
+            m_data->l1_index = l1_index;
+            m_data->l2_index = l2_index;
+            m_data->l2_offset = l2_offset;
+            m_data->valid = 1;
        }
    }
    *cluster_offset <<= 9;
-    return VMDK_OK;
+    return 0;
 }

 static VmdkExtent *find_extent(BDRVVmdkState *s,
@@ -989,8 +877,8 @@ static int coroutine_fn vmdk_co_is_allocated(BlockDriverState *bs,
    ret = get_cluster_offset(bs, extent, NULL,
                            sector_num * 512, 0, &offset);
    qemu_co_mutex_unlock(&s->lock);
-
-    ret = (ret == VMDK_OK || ret == VMDK_ZEROED);
+    /* get_cluster_offset returning 0 means success */
+    ret = !ret;

    index_in_cluster = sector_num % extent->cluster_sectors;
    n = extent->cluster_sectors - index_in_cluster;
@@ -1114,7 +1002,6 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
    BDRVVmdkState *s = bs->opaque;
    int ret;
    uint64_t n, index_in_cluster;
-    uint64_t extent_begin_sector, extent_relative_sector_num;
    VmdkExtent *extent = NULL;
    uint64_t cluster_offset;

@@ -1126,16 +1013,14 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
        ret = get_cluster_offset(
                            bs, extent, NULL,
                            sector_num << 9, 0, &cluster_offset);
-        extent_begin_sector = extent->end_sector - extent->sectors;
-        extent_relative_sector_num = sector_num - extent_begin_sector;
-        index_in_cluster = extent_relative_sector_num % extent->cluster_sectors;
+        index_in_cluster = sector_num % extent->cluster_sectors;
        n = extent->cluster_sectors - index_in_cluster;
        if (n > nb_sectors) {
            n = nb_sectors;
        }
-        if (ret != VMDK_OK) {
+        if (ret) {
            /* if not allocated, try to read from parent image, if exist */
-            if (bs->backing_hd && ret != VMDK_ZEROED) {
+            if (bs->backing_hd) {
                if (!vmdk_is_cid_valid(bs)) {
                    return -EINVAL;
                }
@@ -1172,23 +1057,13 @@ static coroutine_fn int vmdk_co_read(BlockDriverState *bs, int64_t sector_num,
    return ret;
 }

-/**
- * vmdk_write:
- * @zeroed:       buf is ignored (data is zero), use zeroed_grain GTE feature
- * if possible, otherwise return -ENOTSUP.
- * @zero_dry_run: used for zeroed == true only, don't update L2 table, just
- *
- * Returns: error code with 0 for success.
- */
 static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
-                      const uint8_t *buf, int nb_sectors,
-                      bool zeroed, bool zero_dry_run)
+                     const uint8_t *buf, int nb_sectors)
 {
    BDRVVmdkState *s = bs->opaque;
    VmdkExtent *extent = NULL;
    int n, ret;
    int64_t index_in_cluster;
-    uint64_t extent_begin_sector, extent_relative_sector_num;
    uint64_t cluster_offset;
    VmdkMetaData m_data;

@@ -1212,7 +1087,7 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
                                sector_num << 9, !extent->compressed,
                                &cluster_offset);
        if (extent->compressed) {
-            if (ret == VMDK_OK) {
+            if (ret == 0) {
                /* Refuse write to allocated cluster for streamOptimized */
                fprintf(stderr,
                        "VMDK: can't write to allocated cluster"
@@ -1228,44 +1103,25 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
                                        &cluster_offset);
            }
        }
-        if (ret == VMDK_ERROR) {
+        if (ret) {
            return -EINVAL;
        }
-        extent_begin_sector = extent->end_sector - extent->sectors;
-        extent_relative_sector_num = sector_num - extent_begin_sector;
-        index_in_cluster = extent_relative_sector_num % extent->cluster_sectors;
+        index_in_cluster = sector_num % extent->cluster_sectors;
        n = extent->cluster_sectors - index_in_cluster;
        if (n > nb_sectors) {
            n = nb_sectors;
        }
-        if (zeroed) {
-            /* Do zeroed write, buf is ignored */
-            if (extent->has_zero_grain &&
-                    index_in_cluster == 0 &&
-                    n >= extent->cluster_sectors) {
-                n = extent->cluster_sectors;
-                if (!zero_dry_run) {
-                    m_data.offset = VMDK_GTE_ZEROED;
-                    /* update L2 tables */
-                    if (vmdk_L2update(extent, &m_data) != VMDK_OK) {
-                        return -EIO;
-                    }
-                }
-            } else {
-                return -ENOTSUP;
-            }
-        } else {
-            ret = vmdk_write_extent(extent,
-                            cluster_offset, index_in_cluster * 512,
-                            buf, n, sector_num);
-            if (ret) {
-                return ret;
-            }
-            if (m_data.valid) {
-                /* update L2 tables */
-                if (vmdk_L2update(extent, &m_data) != VMDK_OK) {
-                    return -EIO;
-                }
+
+        ret = vmdk_write_extent(extent,
+                        cluster_offset, index_in_cluster * 512,
+                        buf, n, sector_num);
+        if (ret) {
+            return ret;
+        }
+        if (m_data.valid) {
+            /* update L2 tables */
+            if (vmdk_L2update(extent, &m_data) == -1) {
+                return -EIO;
            }
        }
        nb_sectors -= n;
@@ -1291,38 +1147,24 @@ static coroutine_fn int vmdk_co_write(BlockDriverState *bs, int64_t sector_num,
    int ret;
    BDRVVmdkState *s = bs->opaque;
    qemu_co_mutex_lock(&s->lock);
-    ret = vmdk_write(bs, sector_num, buf, nb_sectors, false, false);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
-static int coroutine_fn vmdk_co_write_zeroes(BlockDriverState *bs,
-                                             int64_t sector_num,
-                                             int nb_sectors)
-{
-    int ret;
-    BDRVVmdkState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vmdk_write(bs, sector_num, NULL, nb_sectors, true, true);
-    if (!ret) {
-        ret = vmdk_write(bs, sector_num, NULL, nb_sectors, true, false);
-    }
+    ret = vmdk_write(bs, sector_num, buf, nb_sectors);
    qemu_co_mutex_unlock(&s->lock);
    return ret;
 }


 static int vmdk_create_extent(const char *filename, int64_t filesize,
-                              bool flat, bool compress, bool zeroed_grain)
+                              bool flat, bool compress)
 {
    int ret, i;
    int fd = 0;
    VMDK4Header header;
    uint32_t tmp, magic, grains, gd_size, gt_size, gt_count;

-    fd = qemu_open(filename,
-                   O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
-                   0644);
+    fd = open(
+        filename,
+        O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
+        0644);
    if (fd < 0) {
        return -errno;
    }
@@ -1335,10 +1177,9 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
    }
    magic = cpu_to_be32(VMDK4_MAGIC);
    memset(&header, 0, sizeof(header));
-    header.version = zeroed_grain ? 2 : 1;
-    header.flags = VMDK4_FLAG_RGD | VMDK4_FLAG_NL_DETECT
-                   | (compress ? VMDK4_FLAG_COMPRESS | VMDK4_FLAG_MARKER : 0)
-                   | (zeroed_grain ? VMDK4_FLAG_ZERO_GRAIN : 0);
+    header.version = 1;
+    header.flags =
+        3 | (compress ? VMDK4_FLAG_COMPRESS | VMDK4_FLAG_MARKER : 0);
    header.compressAlgorithm = compress ? VMDK4_COMPRESSION_DEFLATE : 0;
    header.capacity = filesize / 512;
    header.granularity = 128;
@@ -1418,7 +1259,7 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,

    ret = 0;
 exit:
-    qemu_close(fd);
+    close(fd);
    return ret;
 }

@@ -1429,7 +1270,7 @@ static int filename_decompose(const char *filename, char *path, char *prefix,

    if (filename == NULL || !strlen(filename)) {
        fprintf(stderr, "Vmdk: no filename provided.\n");
-        return VMDK_ERROR;
+        return -1;
    }
    p = strrchr(filename, '/');
    if (p == NULL) {
@@ -1441,7 +1282,7 @@ static int filename_decompose(const char *filename, char *path, char *prefix,
    if (p != NULL) {
        p++;
        if (p - filename >= buf_len) {
-            return VMDK_ERROR;
+            return -1;
        }
        pstrcpy(path, p - filename + 1, filename);
    } else {
@@ -1454,12 +1295,12 @@ static int filename_decompose(const char *filename, char *path, char *prefix,
        postfix[0] = '\0';
    } else {
        if (q - p >= buf_len) {
-            return VMDK_ERROR;
+            return -1;
        }
        pstrcpy(prefix, q - p + 1, p);
        pstrcpy(postfix, buf_len, q);
    }
-    return VMDK_OK;
+    return 0;
 }

 static int relative_path(char *dest, int dest_size,
@@ -1475,11 +1316,12 @@ static int relative_path(char *dest, int dest_size,
 #endif

    if (!(dest && base && target)) {
-        return VMDK_ERROR;
+        return -1;
    }
    if (path_is_absolute(target)) {
-        pstrcpy(dest, dest_size, target);
-        return VMDK_OK;
+        dest[dest_size - 1] = '\0';
+        strncpy(dest, target, dest_size - 1);
+        return 0;
    }
    while (base[i] == target[i]) {
        i++;
@@ -1498,7 +1340,7 @@ static int relative_path(char *dest, int dest_size,
        pstrcat(dest, dest_size, sep);
    }
    pstrcat(dest, dest_size, q);
-    return VMDK_OK;
+    return 0;
 }

 static int vmdk_create(const char *filename, QEMUOptionParameter *options)
@@ -1506,7 +1348,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    int fd, idx = 0;
    char desc[BUF_SIZE];
    int64_t total_size = 0, filesize;
-    const char *adapter_type = NULL;
    const char *backing_file = NULL;
    const char *fmt = NULL;
    int flags = 0;
@@ -1518,8 +1359,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    const char *desc_extent_line;
    char parent_desc_line[BUF_SIZE] = "";
    uint32_t parent_cid = 0xffffffff;
-    uint32_t number_heads = 16;
-    bool zeroed_grain = false;
    const char desc_template[] =
        "# Disk DescriptorFile\n"
        "version=1\n"
@@ -1536,9 +1375,9 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
        "\n"
        "ddb.virtualHWVersion = \"%d\"\n"
        "ddb.geometry.cylinders = \"%" PRId64 "\"\n"
-        "ddb.geometry.heads = \"%d\"\n"
+        "ddb.geometry.heads = \"16\"\n"
        "ddb.geometry.sectors = \"63\"\n"
-        "ddb.adapterType = \"%s\"\n";
+        "ddb.adapterType = \"ide\"\n";

    if (filename_decompose(filename, path, prefix, postfix, PATH_MAX)) {
        return -EINVAL;
@@ -1547,33 +1386,15 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    while (options && options->name) {
        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
            total_size = options->value.n;
-        } else if (!strcmp(options->name, BLOCK_OPT_ADAPTER_TYPE)) {
-            adapter_type = options->value.s;
        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
            backing_file = options->value.s;
        } else if (!strcmp(options->name, BLOCK_OPT_COMPAT6)) {
            flags |= options->value.n ? BLOCK_FLAG_COMPAT6 : 0;
        } else if (!strcmp(options->name, BLOCK_OPT_SUBFMT)) {
            fmt = options->value.s;
-        } else if (!strcmp(options->name, BLOCK_OPT_ZEROED_GRAIN)) {
-            zeroed_grain |= options->value.n;
        }
        options++;
    }
-    if (!adapter_type) {
-        adapter_type = "ide";
-    } else if (strcmp(adapter_type, "ide") &&
-               strcmp(adapter_type, "buslogic") &&
-               strcmp(adapter_type, "lsilogic") &&
-               strcmp(adapter_type, "legacyESX")) {
-        fprintf(stderr, "VMDK: Unknown adapter type: '%s'.\n", adapter_type);
-        return -EINVAL;
-    }
-    if (strcmp(adapter_type, "ide") != 0) {
-        /* that's the number of heads with which vmware operates when
-           creating, exporting, etc. vmdk files with a non-ide adapter type */
-        number_heads = 255;
-    }
    if (!fmt) {
        /* Default format to monolithicSparse */
        fmt = "monolithicSparse";
@@ -1602,7 +1423,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    if (backing_file) {
        char parent_filename[PATH_MAX];
        BlockDriverState *bs = bdrv_new("");
-        ret = bdrv_open(bs, backing_file, NULL, 0, NULL);
+        ret = bdrv_open(bs, backing_file, 0, NULL);
        if (ret != 0) {
            bdrv_delete(bs);
            return ret;
@@ -1643,8 +1464,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
        snprintf(ext_filename, sizeof(ext_filename), "%s%s",
                path, desc_filename);

-        if (vmdk_create_extent(ext_filename, size,
-                               flat, compress, zeroed_grain)) {
+        if (vmdk_create_extent(ext_filename, size, flat, compress)) {
            return -EINVAL;
        }
        filesize -= size;
@@ -1662,16 +1482,17 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
            parent_desc_line,
            ext_desc_lines,
            (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4),
-            total_size / (int64_t)(63 * number_heads * 512), number_heads,
-                adapter_type);
+            total_size / (int64_t)(63 * 16 * 512));
    if (split || flat) {
-        fd = qemu_open(filename,
-                       O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
-                       0644);
+        fd = open(
+                filename,
+                O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
+                0644);
    } else {
-        fd = qemu_open(filename,
-                       O_WRONLY | O_BINARY | O_LARGEFILE,
-                       0644);
+        fd = open(
+                filename,
+                O_WRONLY | O_BINARY | O_LARGEFILE,
+                0644);
    }
    if (fd < 0) {
        return -errno;
@@ -1688,7 +1509,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    }
    ret = 0;
 exit:
-    qemu_close(fd);
+    close(fd);
    return ret;
 }

@@ -1747,12 +1568,6 @@ static QEMUOptionParameter vmdk_create_options[] = {
        .type = OPT_SIZE,
        .help = "Virtual disk size"
    },
-    {
-        .name = BLOCK_OPT_ADAPTER_TYPE,
-        .type = OPT_STRING,
-        .help = "Virtual adapter type, can be one of "
-                "ide (default), lsilogic, buslogic or legacyESX"
-    },
    {
        .name = BLOCK_OPT_BACKING_FILE,
        .type = OPT_STRING,
@@ -1770,11 +1585,6 @@ static QEMUOptionParameter vmdk_create_options[] = {
            "VMDK flat extent format, can be one of "
            "{monolithicSparse (default) | monolithicFlat | twoGbMaxExtentSparse | twoGbMaxExtentFlat | streamOptimized} "
    },
-    {
-        .name = BLOCK_OPT_ZEROED_GRAIN,
-        .type = OPT_FLAG,
-        .help = "Enable efficient zero writes using the zeroed-grain GTE feature"
-    },
    { NULL }
 };

@@ -1783,10 +1593,8 @@ static BlockDriver bdrv_vmdk = {
    .instance_size  = sizeof(BDRVVmdkState),
    .bdrv_probe     = vmdk_probe,
    .bdrv_open      = vmdk_open,
-    .bdrv_reopen_prepare = vmdk_reopen_prepare,
    .bdrv_read      = vmdk_co_read,
    .bdrv_write     = vmdk_co_write,
-    .bdrv_co_write_zeroes = vmdk_co_write_zeroes,
    .bdrv_close     = vmdk_close,
    .bdrv_create    = vmdk_create,
    .bdrv_co_flush_to_disk  = vmdk_co_flush,
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -23,12 +23,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
-#if defined(CONFIG_UUID)
-#include <uuid/uuid.h>
-#endif
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 /**************************************************************/

@@ -155,7 +152,7 @@ static int vpc_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }

-static int vpc_open(BlockDriverState *bs, QDict *options, int flags)
+static int vpc_open(BlockDriverState *bs, int flags)
 {
    BDRVVPCState *s = bs->opaque;
    int i;
@@ -163,33 +160,24 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags)
    struct vhd_dyndisk_header* dyndisk_header;
    uint8_t buf[HEADER_SIZE];
    uint32_t checksum;
+    int err = -1;
    int disk_type = VHD_DYNAMIC;
-    int ret;

-    ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE) != HEADER_SIZE)
        goto fail;
-    }

    footer = (struct vhd_footer*) s->footer_buf;
    if (strncmp(footer->creator, "conectix", 8)) {
        int64_t offset = bdrv_getlength(bs->file);
-        if (offset < 0) {
-            ret = offset;
-            goto fail;
-        } else if (offset < HEADER_SIZE) {
-            ret = -EINVAL;
+        if (offset < HEADER_SIZE) {
            goto fail;
        }
-
        /* If a fixed disk, the footer is found only at the end of the file */
-        ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
-                         HEADER_SIZE);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf, HEADER_SIZE)
+                != HEADER_SIZE) {
            goto fail;
        }
        if (strncmp(footer->creator, "conectix", 8)) {
-            ret = -EMEDIUMTYPE;
            goto fail;
        }
        disk_type = VHD_FIXED;
@@ -210,23 +198,20 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags)
    bs->total_sectors = (int64_t)
        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;

-    /* Allow a maximum disk size of approximately 2 TB */
-    if (bs->total_sectors >= 65535LL * 255 * 255) {
-        ret = -EFBIG;
+    if (bs->total_sectors >= 65535 * 16 * 255) {
+        err = -EFBIG;
        goto fail;
    }

    if (disk_type == VHD_DYNAMIC) {
-        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
-                         HEADER_SIZE);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
+                HEADER_SIZE) != HEADER_SIZE) {
            goto fail;
        }

        dyndisk_header = (struct vhd_dyndisk_header *) buf;

        if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
-            ret = -EINVAL;
            goto fail;
        }

@@ -237,10 +222,8 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags)
        s->pagetable = g_malloc(s->max_table_entries * 4);

        s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
-
-        ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
-                         s->max_table_entries * 4);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
+                s->max_table_entries * 4) != s->max_table_entries * 4) {
            goto fail;
        }

@@ -278,19 +261,8 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags)
    migrate_add_blocker(s->migration_blocker);

    return 0;
-
-fail:
-    g_free(s->pagetable);
-#ifdef CACHE
-    g_free(s->pageentry_u8);
-#endif
-    return ret;
-}
-
-static int vpc_reopen_prepare(BDRVReopenState *state,
-                              BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
+ fail:
+    return err;
 }

 /*
@@ -546,27 +518,19 @@ static coroutine_fn int vpc_co_write(BlockDriverState *bs, int64_t sector_num,
 * Note that the geometry doesn't always exactly match total_sectors but
 * may round it down.
 *
- * Returns 0 on success, -EFBIG if the size is larger than ~2 TB. Override
- * the hardware EIDE and ATA-2 limit of 16 heads (max disk size of 127 GB)
- * and instead allow up to 255 heads.
+ * Returns 0 on success, -EFBIG if the size is larger than 127 GB
 */
 static int calculate_geometry(int64_t total_sectors, uint16_t* cyls,
    uint8_t* heads, uint8_t* secs_per_cyl)
 {
    uint32_t cyls_times_heads;

-    /* Allow a maximum disk size of approximately 2 TB */
-    if (total_sectors > 65535LL * 255 * 255) {
+    if (total_sectors > 65535 * 16 * 255)
        return -EFBIG;
-    }

    if (total_sectors > 65535 * 16 * 63) {
        *secs_per_cyl = 255;
-        if (total_sectors > 65535 * 16 * 255) {
-            *heads = 255;
-        } else {
-            *heads = 16;
-        }
+        *heads = 16;
        cyls_times_heads = total_sectors / *secs_per_cyl;
    } else {
        *secs_per_cyl = 17;
@@ -714,7 +678,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
    }

    /* Create the file */
-    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
    if (fd < 0) {
        return -EIO;
    }
@@ -769,9 +733,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)

    footer->type = be32_to_cpu(disk_type);

-#if defined(CONFIG_UUID)
-    uuid_generate(footer->uuid);
-#endif
+    /* TODO uuid is missing */

    footer->checksum = be32_to_cpu(vpc_checksum(buf, HEADER_SIZE));

@@ -782,7 +744,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
    }

 fail:
-    qemu_close(fd);
+    close(fd);
    return ret;
 }

@@ -821,7 +783,6 @@ static BlockDriver bdrv_vpc = {
    .bdrv_probe     = vpc_probe,
    .bdrv_open      = vpc_open,
    .bdrv_close     = vpc_close,
-    .bdrv_reopen_prepare = vpc_reopen_prepare,
    .bdrv_create    = vpc_create,

    .bdrv_read              = vpc_co_read,
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -1,4 +1,4 @@
-/* vim:set shiftwidth=4 ts=4: */
+/* vim:set shiftwidth=4 ts=8: */
 /*
 * QEMU Block driver for virtual VFAT (shadows a local directory)
 *
@@ -25,11 +25,9 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
-#include "qapi/qmp/qint.h"
-#include "qapi/qmp/qbool.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 #ifndef S_IWGRP
 #define S_IWGRP 0
@@ -361,12 +359,11 @@ typedef struct BDRVVVFATState {
 * if the position is outside the specified geometry, fill maximum value for CHS
 * and return 1 to signal overflow.
 */
-static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
-{
+static int sector2CHS(BlockDriverState* bs, mbr_chs_t * chs, int spos){
    int head,sector;
-    sector   = spos % secs;  spos /= secs;
-    head     = spos % heads; spos /= heads;
-    if (spos >= cyls) {
+    sector   = spos % (bs->secs);  spos/= bs->secs;
+    head     = spos % (bs->heads); spos/= bs->heads;
+    if(spos >= bs->cyls){
        /* Overflow,
        it happens if 32bit sector positions are used, while CHS is only 24bit.
        Windows/Dos is said to take 1023/255/63 as nonrepresentable CHS */
@@ -381,7 +378,7 @@ static int sector2CHS(mbr_chs_t *chs, int spos, int cyls, int heads, int secs)
    return 0;
 }

-static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
+static void init_mbr(BDRVVVFATState* s)
 {
    /* TODO: if the files mbr.img and bootsect.img exist, use them */
    mbr_t* real_mbr=(mbr_t*)s->first_sectors;
@@ -396,15 +393,12 @@ static void init_mbr(BDRVVVFATState *s, int cyls, int heads, int secs)
    partition->attributes=0x80; /* bootable */

    /* LBA is used when partition is outside the CHS geometry */
-    lba  = sector2CHS(&partition->start_CHS, s->first_sectors_number - 1,
-                     cyls, heads, secs);
-    lba |= sector2CHS(&partition->end_CHS,   s->bs->total_sectors - 1,
-                     cyls, heads, secs);
+    lba = sector2CHS(s->bs, &partition->start_CHS, s->first_sectors_number-1);
+    lba|= sector2CHS(s->bs, &partition->end_CHS,   s->sector_count);

    /*LBA partitions are identified only by start/length_sector_long not by CHS*/
-    partition->start_sector_long  = cpu_to_le32(s->first_sectors_number - 1);
-    partition->length_sector_long = cpu_to_le32(s->bs->total_sectors
-                                                - s->first_sectors_number + 1);
+    partition->start_sector_long =cpu_to_le32(s->first_sectors_number-1);
+    partition->length_sector_long=cpu_to_le32(s->sector_count - s->first_sectors_number+1);

    /* FAT12/FAT16/FAT32 */
    /* DOS uses different types when partition is LBA,
@@ -531,9 +525,13 @@ static inline uint8_t fat_chksum(const direntry_t* entry)
 /* if return_time==0, this returns the fat_date, else the fat_time */
 static uint16_t fat_datetime(time_t time,int return_time) {
    struct tm* t;
+#ifdef _WIN32
+    t=localtime(&time); /* this is not thread safe */
+#else
    struct tm t1;
    t = &t1;
    localtime_r(&time,t);
+#endif
    if(return_time)
 	return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
    return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
@@ -832,7 +830,7 @@ static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
 }

 static int init_directories(BDRVVVFATState* s,
-                            const char *dirname, int heads, int secs)
+	const char* dirname)
 {
    bootsector_t* bootsector;
    mapping_t* mapping;
@@ -959,8 +957,8 @@ static int init_directories(BDRVVVFATState* s,
    bootsector->media_type=(s->first_sectors_number>1?0xf8:0xf0); /* media descriptor (f8=hd, f0=3.5 fd)*/
    s->fat.pointer[0] = bootsector->media_type;
    bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
-    bootsector->sectors_per_track = cpu_to_le16(secs);
-    bootsector->number_of_heads = cpu_to_le16(heads);
+    bootsector->sectors_per_track=cpu_to_le16(s->bs->secs);
+    bootsector->number_of_heads=cpu_to_le16(s->bs->heads);
    bootsector->hidden_sectors=cpu_to_le32(s->first_sectors_number==1?0:0x3f);
    bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);

@@ -990,90 +988,10 @@ static void vvfat_rebind(BlockDriverState *bs)
    s->bs = bs;
 }

-static QemuOptsList runtime_opts = {
-    .name = "vvfat",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "dir",
-            .type = QEMU_OPT_STRING,
-            .help = "Host directory to map to the vvfat device",
-        },
-        {
-            .name = "fat-type",
-            .type = QEMU_OPT_NUMBER,
-            .help = "FAT type (12, 16 or 32)",
-        },
-        {
-            .name = "floppy",
-            .type = QEMU_OPT_BOOL,
-            .help = "Create a floppy rather than a hard disk image",
-        },
-        {
-            .name = "rw",
-            .type = QEMU_OPT_BOOL,
-            .help = "Make the image writable",
-        },
-        { /* end of list */ }
-    },
-};
-
-static void vvfat_parse_filename(const char *filename, QDict *options,
-                                 Error **errp)
-{
-    int fat_type = 0;
-    bool floppy = false;
-    bool rw = false;
-    int i;
-
-    if (!strstart(filename, "fat:", NULL)) {
-        error_setg(errp, "File name string must start with 'fat:'");
-        return;
-    }
-
-    /* Parse options */
-    if (strstr(filename, ":32:")) {
-        fat_type = 32;
-    } else if (strstr(filename, ":16:")) {
-        fat_type = 16;
-    } else if (strstr(filename, ":12:")) {
-        fat_type = 12;
-    }
-
-    if (strstr(filename, ":floppy:")) {
-        floppy = true;
-    }
-
-    if (strstr(filename, ":rw:")) {
-        rw = true;
-    }
-
-    /* Get the directory name without options */
-    i = strrchr(filename, ':') - filename;
-    assert(i >= 3);
-    if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
-        /* workaround for DOS drive names */
-        filename += i - 1;
-    } else {
-        filename += i + 1;
-    }
-
-    /* Fill in the options QDict */
-    qdict_put(options, "dir", qstring_from_str(filename));
-    qdict_put(options, "fat-type", qint_from_int(fat_type));
-    qdict_put(options, "floppy", qbool_from_int(floppy));
-    qdict_put(options, "rw", qbool_from_int(rw));
-}
-
-static int vvfat_open(BlockDriverState *bs, QDict *options, int flags)
+static int vvfat_open(BlockDriverState *bs, const char* dirname, int flags)
 {
    BDRVVVFATState *s = bs->opaque;
-    int cyls, heads, secs;
-    bool floppy;
-    const char *dirname;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    int ret;
+    int i;

 #ifdef DEBUG
    vvv = s;
@@ -1084,65 +1002,6 @@ DLOG(if (stderr == NULL) {
    setbuf(stderr, NULL);
 })

-    opts = qemu_opts_create_nofail(&runtime_opts);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (error_is_set(&local_err)) {
-        qerror_report_err(local_err);
-        error_free(local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    dirname = qemu_opt_get(opts, "dir");
-    if (!dirname) {
-        qerror_report(ERROR_CLASS_GENERIC_ERROR, "vvfat block driver requires "
-                      "a 'dir' option");
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
-    floppy = qemu_opt_get_bool(opts, "floppy", false);
-
-    if (floppy) {
-        /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
-        if (!s->fat_type) {
-            s->fat_type = 12;
-            secs = 36;
-            s->sectors_per_cluster = 2;
-        } else {
-            secs = s->fat_type == 12 ? 18 : 36;
-            s->sectors_per_cluster = 1;
-        }
-        s->first_sectors_number = 1;
-        cyls = 80;
-        heads = 2;
-    } else {
-        /* 32MB or 504MB disk*/
-        if (!s->fat_type) {
-            s->fat_type = 16;
-        }
-        cyls = s->fat_type == 12 ? 64 : 1024;
-        heads = 16;
-        secs = 63;
-    }
-
-    switch (s->fat_type) {
-    case 32:
-	    fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. "
-                "You are welcome to do so!\n");
-        break;
-    case 16:
-    case 12:
-        break;
-    default:
-        qerror_report(ERROR_CLASS_GENERIC_ERROR, "Valid FAT types are only "
-                      "12, 16 and 32");
-        ret = -EINVAL;
-        goto fail;
-    }
-
-
    s->bs = bs;

    /* LATER TODO: if FAT32, adjust */
@@ -1158,30 +1017,67 @@ DLOG(if (stderr == NULL) {
    s->fat2 = NULL;
    s->downcase_short_names = 1;

-    fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
-            dirname, cyls, heads, secs);
+    if (!strstart(dirname, "fat:", NULL))
+	return -1;

-    s->sector_count = cyls * heads * secs - (s->first_sectors_number - 1);
-
-    if (qemu_opt_get_bool(opts, "rw", false)) {
-        if (enable_write_target(s)) {
-            ret = -EIO;
-            goto fail;
-        }
-        bs->read_only = 0;
+    if (strstr(dirname, ":32:")) {
+	fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. You are welcome to do so!\n");
+	s->fat_type = 32;
+    } else if (strstr(dirname, ":16:")) {
+	s->fat_type = 16;
+    } else if (strstr(dirname, ":12:")) {
+	s->fat_type = 12;
    }

-    bs->total_sectors = cyls * heads * secs;
-
-    if (init_directories(s, dirname, heads, secs)) {
-        ret = -EIO;
-        goto fail;
+    if (strstr(dirname, ":floppy:")) {
+	/* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
+	if (!s->fat_type) {
+	    s->fat_type = 12;
+	    bs->secs = 36;
+	    s->sectors_per_cluster=2;
+	} else {
+	    bs->secs=(s->fat_type == 12 ? 18 : 36);
+	    s->sectors_per_cluster=1;
+	}
+	s->first_sectors_number = 1;
+	bs->cyls=80; bs->heads=2;
+    } else {
+	/* 32MB or 504MB disk*/
+	if (!s->fat_type) {
+	    s->fat_type = 16;
+	}
+	bs->cyls=(s->fat_type == 12 ? 64 : 1024);
+	bs->heads=16; bs->secs=63;
    }

+    s->sector_count=bs->cyls*bs->heads*bs->secs-(s->first_sectors_number-1);
+
+    if (strstr(dirname, ":rw:")) {
+	if (enable_write_target(s))
+	    return -1;
+	bs->read_only = 0;
+    }
+
+    i = strrchr(dirname, ':') - dirname;
+    assert(i >= 3);
+    if (dirname[i-2] == ':' && qemu_isalpha(dirname[i-1]))
+	/* workaround for DOS drive names */
+	dirname += i-1;
+    else
+	dirname += i+1;
+
+    bs->total_sectors=bs->cyls*bs->heads*bs->secs;
+
+    if(init_directories(s, dirname))
+	return -1;
+
    s->sector_count = s->faked_sectors + s->sectors_per_cluster*s->cluster_count;

-    if (s->first_sectors_number == 0x40) {
-        init_mbr(s, cyls, heads, secs);
+    if(s->first_sectors_number==0x40)
+	init_mbr(s);
+    else {
+        /* MS-DOS does not like to know about CHS (?). */
+	bs->heads = bs->cyls = bs->secs = 0;
    }

    //    assert(is_consistent(s));
@@ -1195,10 +1091,7 @@ DLOG(if (stderr == NULL) {
        migrate_add_blocker(s->migration_blocker);
    }

-    ret = 0;
-fail:
-    qemu_opts_del(opts);
-    return ret;
+    return 0;
 }

 static inline void vvfat_close_current_file(BDRVVVFATState *s)
@@ -1206,7 +1099,7 @@ static inline void vvfat_close_current_file(BDRVVVFATState *s)
    if(s->current_mapping) {
 	s->current_mapping = NULL;
 	if (s->current_fd) {
-		qemu_close(s->current_fd);
+		close(s->current_fd);
 		s->current_fd = 0;
 	}
    }
@@ -1263,7 +1156,7 @@ static int open_file(BDRVVVFATState* s,mapping_t* mapping)
    if(!s->current_mapping ||
 	    strcmp(s->current_mapping->path,mapping->path)) {
 	/* open file */
-	int fd = qemu_open(mapping->path, O_RDONLY | O_BINARY | O_LARGEFILE);
+	int fd = open(mapping->path, O_RDONLY | O_BINARY | O_LARGEFILE);
 	if(fd<0)
 	    return -1;
 	vvfat_close_current_file(s);
@@ -2322,7 +2215,7 @@ static int commit_one_file(BDRVVVFATState* s,
    for (i = s->cluster_size; i < offset; i += s->cluster_size)
 	c = modified_fat_get(s, c);

-    fd = qemu_open(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
+    fd = open(mapping->path, O_RDWR | O_CREAT | O_BINARY, 0666);
    if (fd < 0) {
 	fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
 		strerror(errno), errno);
@@ -2331,7 +2224,7 @@ static int commit_one_file(BDRVVVFATState* s,
    }
    if (offset > 0) {
        if (lseek(fd, offset, SEEK_SET) != offset) {
-            qemu_close(fd);
+            close(fd);
            g_free(cluster);
            return -3;
        }
@@ -2352,13 +2245,13 @@ static int commit_one_file(BDRVVVFATState* s,
 	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);

        if (ret < 0) {
-            qemu_close(fd);
+            close(fd);
            g_free(cluster);
            return ret;
        }

        if (write(fd, cluster, rest_size) < 0) {
-            qemu_close(fd);
+            close(fd);
            g_free(cluster);
            return -2;
        }
@@ -2369,11 +2262,11 @@ static int commit_one_file(BDRVVVFATState* s,

    if (ftruncate(fd, size)) {
        perror("ftruncate()");
-        qemu_close(fd);
+        close(fd);
        g_free(cluster);
        return -4;
    }
-    qemu_close(fd);
+    close(fd);
    g_free(cluster);

    return commit_mappings(s, first_cluster, dir_index);
@@ -2935,7 +2828,7 @@ static int enable_write_target(BDRVVVFATState *s)
        return -1;
    }

-    ret = bdrv_open(s->qcow, s->qcow_filename, NULL,
+    ret = bdrv_open(s->qcow, s->qcow_filename,
            BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH, bdrv_qcow);
    if (ret < 0) {
 	return ret;
@@ -2970,18 +2863,15 @@ static void vvfat_close(BlockDriverState *bs)
 }

 static BlockDriver bdrv_vvfat = {
-    .format_name            = "vvfat",
-    .protocol_name          = "fat",
-    .instance_size          = sizeof(BDRVVVFATState),
-
-    .bdrv_parse_filename    = vvfat_parse_filename,
-    .bdrv_file_open         = vvfat_open,
-    .bdrv_close             = vvfat_close,
-    .bdrv_rebind            = vvfat_rebind,
-
-    .bdrv_read              = vvfat_co_read,
-    .bdrv_write             = vvfat_co_write,
-    .bdrv_co_is_allocated   = vvfat_co_is_allocated,
+    .format_name	= "vvfat",
+    .instance_size	= sizeof(BDRVVVFATState),
+    .bdrv_file_open	= vvfat_open,
+    .bdrv_rebind	= vvfat_rebind,
+    .bdrv_read          = vvfat_co_read,
+    .bdrv_write         = vvfat_co_write,
+    .bdrv_close		= vvfat_close,
+    .bdrv_co_is_allocated = vvfat_co_is_allocated,
+    .protocol_name	= "fat",
 };

 static void bdrv_vvfat_init(void)
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -1,215 +0,0 @@
-/*
- * Block driver for RAW files (win32)
- *
- * Copyright (c) 2006 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu-common.h"
-#include "qemu/timer.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "qemu-common.h"
-#include "block/aio.h"
-#include "raw-aio.h"
-#include "qemu/event_notifier.h"
-#include "qemu/iov.h"
-#include <windows.h>
-#include <winioctl.h>
-
-#define FTYPE_FILE 0
-#define FTYPE_CD     1
-#define FTYPE_HARDDISK 2
-
-struct QEMUWin32AIOState {
-    HANDLE hIOCP;
-    EventNotifier e;
-    int count;
-};
-
-typedef struct QEMUWin32AIOCB {
-    BlockDriverAIOCB common;
-    struct QEMUWin32AIOState *ctx;
-    int nbytes;
-    OVERLAPPED ov;
-    QEMUIOVector *qiov;
-    void *buf;
-    bool is_read;
-    bool is_linear;
-} QEMUWin32AIOCB;
-
-/*
- * Completes an AIO request (calls the callback and frees the ACB).
- */
-static void win32_aio_process_completion(QEMUWin32AIOState *s,
-    QEMUWin32AIOCB *waiocb, DWORD count)
-{
-    int ret;
-    s->count--;
-
-    if (waiocb->ov.Internal != 0) {
-        ret = -EIO;
-    } else {
-        ret = 0;
-        if (count < waiocb->nbytes) {
-            /* Short reads mean EOF, pad with zeros. */
-            if (waiocb->is_read) {
-                qemu_iovec_memset(waiocb->qiov, count, 0,
-                    waiocb->qiov->size - count);
-            } else {
-                ret = -EINVAL;
-            }
-       }
-    }
-
-    if (!waiocb->is_linear) {
-        if (ret == 0 && waiocb->is_read) {
-            QEMUIOVector *qiov = waiocb->qiov;
-            iov_from_buf(qiov->iov, qiov->niov, 0, waiocb->buf, qiov->size);
-        }
-        qemu_vfree(waiocb->buf);
-    }
-
-
-    waiocb->common.cb(waiocb->common.opaque, ret);
-    qemu_aio_release(waiocb);
-}
-
-static void win32_aio_completion_cb(EventNotifier *e)
-{
-    QEMUWin32AIOState *s = container_of(e, QEMUWin32AIOState, e);
-    DWORD count;
-    ULONG_PTR key;
-    OVERLAPPED *ov;
-
-    event_notifier_test_and_clear(&s->e);
-    while (GetQueuedCompletionStatus(s->hIOCP, &count, &key, &ov, 0)) {
-        QEMUWin32AIOCB *waiocb = container_of(ov, QEMUWin32AIOCB, ov);
-
-        win32_aio_process_completion(s, waiocb, count);
-    }
-}
-
-static int win32_aio_flush_cb(EventNotifier *e)
-{
-    QEMUWin32AIOState *s = container_of(e, QEMUWin32AIOState, e);
-
-    return (s->count > 0) ? 1 : 0;
-}
-
-static void win32_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-    QEMUWin32AIOCB *waiocb = (QEMUWin32AIOCB *)blockacb;
-
-    /*
-     * CancelIoEx is only supported in Vista and newer.  For now, just
-     * wait for completion.
-     */
-    while (!HasOverlappedIoCompleted(&waiocb->ov)) {
-        qemu_aio_wait();
-    }
-}
-
-static const AIOCBInfo win32_aiocb_info = {
-    .aiocb_size         = sizeof(QEMUWin32AIOCB),
-    .cancel             = win32_aio_cancel,
-};
-
-BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
-        QEMUWin32AIOState *aio, HANDLE hfile,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int type)
-{
-    struct QEMUWin32AIOCB *waiocb;
-    uint64_t offset = sector_num * 512;
-    DWORD rc;
-
-    waiocb = qemu_aio_get(&win32_aiocb_info, bs, cb, opaque);
-    waiocb->nbytes = nb_sectors * 512;
-    waiocb->qiov = qiov;
-    waiocb->is_read = (type == QEMU_AIO_READ);
-
-    if (qiov->niov > 1) {
-        waiocb->buf = qemu_blockalign(bs, qiov->size);
-        if (type & QEMU_AIO_WRITE) {
-            iov_to_buf(qiov->iov, qiov->niov, 0, waiocb->buf, qiov->size);
-        }
-        waiocb->is_linear = false;
-    } else {
-        waiocb->buf = qiov->iov[0].iov_base;
-        waiocb->is_linear = true;
-    }
-
-    memset(&waiocb->ov, 0, sizeof(waiocb->ov));
-    waiocb->ov.Offset = (DWORD)offset;
-    waiocb->ov.OffsetHigh = (DWORD)(offset >> 32);
-    waiocb->ov.hEvent = event_notifier_get_handle(&aio->e);
-
-    aio->count++;
-
-    if (type & QEMU_AIO_READ) {
-        rc = ReadFile(hfile, waiocb->buf, waiocb->nbytes, NULL, &waiocb->ov);
-    } else {
-        rc = WriteFile(hfile, waiocb->buf, waiocb->nbytes, NULL, &waiocb->ov);
-    }
-    if(rc == 0 && GetLastError() != ERROR_IO_PENDING) {
-        goto out_dec_count;
-    }
-    return &waiocb->common;
-
-out_dec_count:
-    aio->count--;
-    qemu_aio_release(waiocb);
-    return NULL;
-}
-
-int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile)
-{
-    if (CreateIoCompletionPort(hfile, aio->hIOCP, (ULONG_PTR) 0, 0) == NULL) {
-        return -EINVAL;
-    } else {
-        return 0;
-    }
-}
-
-QEMUWin32AIOState *win32_aio_init(void)
-{
-    QEMUWin32AIOState *s;
-
-    s = g_malloc0(sizeof(*s));
-    if (event_notifier_init(&s->e, false) < 0) {
-        goto out_free_state;
-    }
-
-    s->hIOCP = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, 0, 0);
-    if (s->hIOCP == NULL) {
-        goto out_close_efd;
-    }
-
-    qemu_aio_set_event_notifier(&s->e, win32_aio_completion_cb,
-                                win32_aio_flush_cb);
-
-    return s;
-
-out_close_efd:
-    event_notifier_cleanup(&s->e);
-out_free_state:
-    g_free(s);
-    return NULL;
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Michael Roth	785adb09b9	update VERSION for v1.1.1 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-07-12 13:36:53 -05:00
Michael Roth	f52d0d639e	Merge remote-tracking branch 'agraf/s390-for-upstream-1.1' into HEAD	2012-07-10 14:08:37 -05:00
Alexander Graf	4082e889ee	s390x: fix s390 virtio aliases Some of the virtio devices have the same frontend name, but actually implement different devices behind the scenes through aliases. The indicator which device type to use is the architecture. On s390, we want s390 virtio devices. On everything else, we want PCI devices. Reflect this in the alias selection code. This way we fix commands like -device virtio-blk on s390x which with this patch applied select the correct virtio-blk-s390 device rather than virtio-blk-pci. Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de>	2012-07-10 18:29:29 +02:00
Jason Wang	b7093f294c	rtl8139: validate rx ring before receiving packets Commit `ff71f2e8ca` prevent the possible crash during initialization of linux driver by checking the operating mode.This seems too strict as: - the real card could still work in mode other than normal - some buggy driver who does not set correct opmode after eeprom access So, considering rx ring address were reset to zero (which could be safely trated as an address not intened to DMA to), in order to both letting old guest work and preventing the unexpected DMA to guest, we can forbid packet receiving when rx ring address is zero. Tested-by: Avi Kivity <avi@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `fcce6fd25f`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-29 10:22:30 -05:00
Daniel Verkamp	cd63a77e99	ahci: SATA FIS is 20 bytes, not 0x20 As in the SATA and AHCI specifications, a FIS is 5 Dwords of 4 bytes each, which comes to 20 bytes (decimal), not 0x20. Signed-off-by: Daniel Verkamp <daniel@drv.nu> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `4bb9c939a5`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 10:58:24 -05:00
Stefan Hajnoczi	8456852657	qemu-img: document qed format on qemu-img man page The qemu-img.1 man page is missing the qed format from its list of supported formats. Document the image creation options for qed. Suggested-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `f085800e24`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 09:04:33 -05:00
Stefan Weil	7d440f20bd	virtio: Fix compiler warning for non Linux hosts The local variables ret, i are only used if __linux__ is defined. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `47ce9ef7f8`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 09:04:04 -05:00
MORITA Kazutaka	feba8ae20b	sheepdog: fix return value of do_load_save_vm_state bdrv_save_vmstate and bdrv_load_vmstate should return the vmstate size on success, and -errno on error. Signed-off-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `6f3c714eb7`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 09:03:33 -05:00
Jan Beulich	c9c2479289	qemu/xendisk: set maximum number of grants to be used Legacy (non-pvops) gntdev drivers may require this to be done when the number of grants intended to be used simultaneously exceeds a certain driver specific default limit. Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit `64c27e5b1f`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 09:00:42 -05:00
Bruce Rogers	4c45bf61d3	build: install qmp-commands.txt File is targeted for install, but is never installed. Signed-off-by: Bruce Rogers <brogers@suse.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> (cherry picked from commit `0cd23fcc0a`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:50 -05:00
Pavel Hrdina	70d582074f	fdc: fix implied seek while there is no media in drive The Windows uses 'READ' command at the start of an instalation without checking the 'dir' register. We have to abort the transfer with an abnormal termination if there is no media in the drive. Signed-off-by: Pavel Hrdina <phrdina@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `c52acf60b6`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:44 -05:00
Stefan Hajnoczi	0da4c07322	qcow2: fix autoclear image header update The autoclear feature bits can be used for qcow2 file format features that are safe to "drop" by old programs that do not understand the feature. Upon opening the image file unknown autoclear feature bits are cleared and the image file header is rewritten, but this was happening too early in the code when critical header fields were not yet loaded. Process autoclear feature bits after all necessary header information has been loaded. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `af7b708db2`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:38 -05:00
Pavel Dovgaluk	ee7735fa63	Prevent disk data loss when closing qemu Prevent disk data loss when closing qemu console window under Windows 7. v3. Comment for Sleep() parameter was updated. Signed-off-by: Pavel Dovgalyuk<pavel.dovgaluk@gmail.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `b75a02829d`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:33 -05:00
Zhi Yong Wu	02fe741375	qcow2: fix endianness conversion Signed-off-by: Zhi Yong Wu <wuzhy@linux.vnet.ibm.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `87267753a3`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:25 -05:00
Jason Baron	dbe4ac16bb	pci_bridge_dev: fix error path in pci_bridge_dev_initfn() Currently, we do not properly cleanup, if pci_bridge_dev_initfn fails to initialize properly. Make sure to call pci_bridge_exitfn() in the error path. Signed-off-by: Jason Baron <jbaron@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `80aa796bf3`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:19 -05:00
Jason Baron	f63e60327b	qdev: release parent properties on dc->init failure While looking into hot-plugging bridges, I can create a qemu segfault via: $ device_add pci-bridge Bridge chassis not specified. Each bridge is required to be assigned a unique chassis id > 0. ** ERROR:qom/object.c:389:object_delete: assertion failed: (obj->ref == 0) I'm proposing to fix this by adding a call to 'object_unparent()', before the call to qdev_free(). I see there is already a precedent for this usage pattern as seen in qdev_simple_unplug_cb(): /* can be used as ->unplug() callback for the simple cases / int qdev_simple_unplug_cb(DeviceState dev) { /* just zap it */ object_unparent(OBJECT(dev)); qdev_free(dev); return 0; } Signed-off-by: Jason Baron <jbaron@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `266ca11a04`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:12 -05:00
Jan Kiszka	0ec3907571	intel-hda: Fix reset of MSI function Call msi_reset on device reset as still required by the core. CC: Gerd Hoffmann <kraxel@redhat.com> CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `8e729e3b52`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:06 -05:00
Jan Kiszka	1658e3cd89	ahci: Fix reset of MSI function Call msi_reset on device reset as still required by the core. CC: Alexander Graf <agraf@suse.de> CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `868a1a5226`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:55:00 -05:00
Fernando Luis Vazquez Cao	065436479b	rtl8139: honor RxOverflow flag in can_receive method Some drivers (Linux' 8139too among them) rely on the NIC injecting an interrupt in the event of a receive buffer overflow and, accordingly, set the RxOverflow bit in the interrupt mask. Unfortunately rtl8139's can_receive method ignores the RxOverflow flag, which may lead to a situation where rtl8139 stops receiving packets (can_receive returns 0) when the receive buffer becomes full. If the driver eventually read from the receive buffer or reset the card the emulator could recover from this situation. However some implementations only do this upon receiving an interrupt with either RxOK or RxOverflow set in the ISR; interrupt that will never come because QEMU's flow control mechanisms would prevent rtl8139 from receiving any packet. Letting packets go through when the overflow interrupt is enabled makes the QEMU emulator compliant to the spec and solves the problem. This patch should fix a relatively common (in our experience) network stall observed when running enterprise distros with rtl8139 as the NIC; in some cases the 8139too device driver gets loaded and when under heavy load the network eventually stops working. Reported-by: Hayato Kakuta <kakuta.hayato@oss.ntt.co.jp> Tested-by: Hayato Kakuta <kakuta.hayato@oss.ntt.co.jp> Acked-by: Igor Kovalenko <igor.v.kovalenko@gmail.com> Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `fee9d348ff`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:54:55 -05:00
Stefan Weil	f6db26e4f8	configure: Fix build for some versions of glibc (9pfs) Some versions declare open_by_handle_at, but don't define AT_EMPTY_PATH. Extend the check in configure to test both preconditions. Signed-off-by: Stefan Weil <sw@weilnetz.de> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Acked-by: Serge Hallyn <serge.hallyn@ubuntu.com> (cherry picked from commit `acc55ba8b1`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:54:44 -05:00
Stefan Weil	c49dd1bf64	monitor: Fix memory leak with readline completion Each string which is shown during readline completion in the QEMU monitor is allocated dynamically but currently never deallocated. Add the missing loop which calls g_free for the allocated strings. Signed-off-by: Stefan Weil <sw@weilnetz.de> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit `fc9fa4bd0a`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:53:25 -05:00
Kevin Wolf	b4fcb4b499	qcow2: Silence false warning Some gcc versions seem not to be able to figure out that the switch statement covers all possible values and that c is therefore always initialised. Add a default branch for them. Reported-by: malc <av1474@comtv.ru> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: malc <av1474@comtv.ru> (cherry picked from commit `1417d7e40e`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:53:20 -05:00
Jan Kiszka	7672b714b2	kvm: i8254: Fix conversion of in-kernel to userspace state Due to a offset between the clock used to generate the in-kernel count_load_time (CLOCK_MONOTONIC) and the clock used for processing this in userspace (vm_clock), reading back the output of PIT channel 2 via port 0x61 was broken. One use cases that suffered from it was the CPU frequency calibration of SeaBIOS, which also affected IDE/AHCI timeouts. This fixes it by calibrating the offset between both clocks on kvm_pit_get and adjusting the kernel value before saving it in the userspace state. As the calibration only works while the vm_clock is running, we cache the in-kernel state across stopped phases. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Avi Kivity <avi@redhat.com> (cherry picked from commit `0cdd3d1444`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:53:13 -05:00
Jim Meyering	ca09717e8e	kvm/apic: correct short memset kvm_put_apic_state's attempt to clear kapic before setting its bits cleared sizeof(void) bytes (no more than 8) rather than the intended 1024 (KVM_APIC_REG_SIZE) bytes. Spotted by coverity. Signed-off-by: Jim Meyering <meyering@redhat.com> Signed-off-by: Avi Kivity <avi@redhat.com> (cherry picked from commit `0614cb82ca`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:53:05 -05:00
Harsh Prateek Bora	0cc21de484	configure: report missing libraries for virtfs Signed-off-by: Harsh Prateek Bora <harsh@linux.vnet.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit `263ddcc81b`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:52:57 -05:00
Harsh Prateek Bora	08375616a0	trace/simple.c: fix deprecated glib2 interface Signed-off-by: Harsh Prateek Bora <harsh@linux.vnet.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit `0d665005c7`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:52:44 -05:00
Max Filippov	b993b863e7	target-xtensa: fix CCOUNT for conditional branches Taken conditional branches fail to update CCOUNT register because accumulated ccount_delta is reset during translation of non-taken branch. To fix it only update CCOUNT once per conditional branch instruction translation. This fixes guest linux freeze on LTP waitpid06 test. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `d865f30739`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:56 -05:00
Max Filippov	07ff37597b	exec: fix TB invalidation after breakpoint insertion/deletion tb_invalidate_phys_addr has to be called with the exact physical address of the breakpoint we add/remove, not just the page's base address. Otherwise we easily fail to flush the right TB. This breakage was introduced by the commit `f3705d5329` "memory: make phys_page_find() return an unadjusted". This appeared to work for some guest architectures because their cpu_get_phys_page_debug implementation returns full translated physical address, not just the base of the TARGET_PAGE_SIZE-sized page. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `9d70c4b7b8`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:46 -05:00
Max Filippov	e77326d99c	target-xtensa: add MMU pagewalking tests Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `c305e32f43`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:38 -05:00
Max Filippov	8b3ac66120	target-xtensa: control page table lookup explicitly Hardware pagetable walking may not be nested. Stop guessing and pass explicit flag to the get_physical_addr_mmu function that controls page table lookup. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `57705a676c`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:31 -05:00
Max Filippov	2eb4d314ce	target-xtensa: update autorefill TLB entries conditionally This is to avoid interference of internal QEMU helpers (cpu_get_phys_page_debug, tb_invalidate_virtual_addr) with guest-visible TLB state. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `ae4e7982e6`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:23 -05:00
Max Filippov	adda59173c	target-xtensa: extract TLB entry setting method Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `16bde77a29`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:13 -05:00
Max Filippov	b696aeab6a	target-xtensa: update EXCVADDR in case of page table lookup According to ISA, 4.4.2.6, EXCVADDR may be changed by any TLB miss, even if the miss is handled entirely by processor hardware. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `39e7d37f0f`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:48:06 -05:00
Max Filippov	6514fe5047	target-xtensa: flush TLB page for new MMU mapping Both old and new mappings need flushing because their VPN may be different in MMU case. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `e323bdeff2`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:47:58 -05:00
Christian Borntraeger	c63c453889	virtio-blk: Fix geometry sector calculation Currently the sector value for the geometry is masked, even if the user usesa command line parameter that explicitely gives a number. This breaks dasd devices on s390. A dasd device can have a physical block size of 4096 (== same for logical block size) and a typcial geometry of 15 heads and 12 sectors per cyl. The ibm partition detection relies on a correct geometry reported by the device. Unfortunately the current code changes 12 to 8. This would be necessary if the total size is not a multiple of logical sector size, but for dasd this is not the case. This patch checks the device size and only applies sector mask if necessary. Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com> CC: Christoph Hellwig <hch@lst.de> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `136be99e6e`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2012-06-25 08:47:47 -05:00
@@ -1 +1 @@
 .5.0
 .1.1