Update VERSION for 2.0.2 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
audio: fmopl: drop INLINE macro
2014-08-18 11:00:53 -05:00 · 2014-08-17 11:43:40 -05:00 · 2014-08-17 11:42:00 -05:00 · 2014-08-15 15:51:19 -05:00 · 2014-08-07 17:59:15 -05:00 · 2014-08-07 17:42:39 -05:00
1305 changed files with 34966 additions and 80812 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@
 /config-host.*
 /config-target.*
 /config.status
-/config-temp
 /trace/generated-tracers.h
 /trace/generated-tracers.c
 /trace/generated-tracers-dtrace.h
@@ -19,14 +18,13 @@
 /*-darwin-user
 /*-linux-user
 /*-bsd-user
-/libdis*
-/libuser
+libdis*
+libuser
 /linux-headers/asm
 /qga/qapi-generated
 /qapi-generated
 /qapi-types.[ch]
 /qapi-visit.[ch]
-/qapi-event.[ch]
 /qmp-commands.h
 /qmp-marshal.c
 /qemu-doc.html
@@ -51,9 +49,19 @@
 /qemu-monitor.texi
 /qmp-commands.txt
 /vscclient
+/test-bitops
+/test-coroutine
+/test-int128
+/test-opts-visitor
+/test-qmp-input-visitor
+/test-qmp-output-visitor
+/test-string-input-visitor
+/test-string-output-visitor
+/test-visitor-serialization
 /fsdev/virtfs-proxy-helper
 /fsdev/virtfs-proxy-helper.1
 /fsdev/virtfs-proxy-helper.pod
+/.gdbinit
 *.a
 *.aux
 *.cp
@@ -82,8 +90,12 @@
 *.pc
 .libs
 .sdk
+*.swp
+*.orig
+.pc
 *.gcda
 *.gcno
+patches
 /pc-bios/bios-pq/status
 /pc-bios/vgabios-pq/status
 /pc-bios/optionrom/linuxboot.asm
--- a/.gitmodules
+++ b/.gitmodules
@@ -28,6 +28,3 @@
 [submodule "dtc"]
 	path = dtc
 	url = git://git.qemu-project.org/dtc.git
-[submodule "roms/u-boot"]
-	path = roms/u-boot
-	url = git://git.qemu-project.org/u-boot.git
--- a/.travis.yml
+++ b/.travis.yml
@@ -66,16 +66,16 @@ matrix:
      compiler: gcc
    # All the trace backends (apart from dtrace)
    - env: TARGETS=i386-softmmu,x86_64-softmmu
-           EXTRA_CONFIG="--enable-trace-backends=stderr"
+           EXTRA_CONFIG="--enable-trace-backend=stderr"
      compiler: gcc
    - env: TARGETS=i386-softmmu,x86_64-softmmu
-           EXTRA_CONFIG="--enable-trace-backends=simple"
+           EXTRA_CONFIG="--enable-trace-backend=simple"
      compiler: gcc
    - env: TARGETS=i386-softmmu,x86_64-softmmu
-           EXTRA_CONFIG="--enable-trace-backends=ftrace"
+           EXTRA_CONFIG="--enable-trace-backend=ftrace"
           TEST_CMD=""
      compiler: gcc
    - env: TARGETS=i386-softmmu,x86_64-softmmu
          EXTRA_PKGS="liblttng-ust-dev liburcu-dev"
-          EXTRA_CONFIG="--enable-trace-backends=ust"
+          EXTRA_CONFIG="--enable-trace-backend=ust"
      compiler: gcc
--- a/52
+++ b/52
@@ -52,13 +52,6 @@ General Project Administration
 ------------------------------
 M: Anthony Liguori <aliguori@amazon.com>

-Responsible Disclosure, Reporting Security Issues
------------------------------
-W: http://wiki.qemu.org/SecurityProcess
-M: Michael S. Tsirkin <mst@redhat.com>
-M: Anthony Liguori <aliguori@amazon.com>
-L: secalert@redhat.com
-
 Guest CPU cores (TCG):
 ----------------------
 Alpha
@@ -176,11 +169,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: target-arm/kvm.c

-MIPS
-M: James Hogan <james.hogan@imgtec.com>
-S: Maintained
-F: target-mips/kvm.c
-
 PPC
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
@@ -248,8 +236,8 @@ S: Maintained
 F: hw/*/exynos*

 Calxeda Highbank
-M: Rob Herring <robh@kernel.org>
-S: Maintained
+M: Mark Langsdorf <mark.langsdorf@calxeda.com>
+S: Supported
 F: hw/arm/highbank.c
 F: hw/net/xgmac.c

@@ -563,7 +551,6 @@ Devices
 -------
 IDE
 M: Kevin Wolf <kwolf@redhat.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Odd Fixes
 F: include/hw/ide.h
 F: hw/ide/
@@ -614,7 +601,6 @@ USB
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: hw/usb/*
-F: tests/usb-hcd-ehci-test.c

 VFIO
 M: Alex Williamson <alex.williamson@redhat.com>
@@ -665,12 +651,6 @@ S: Supported
 F: hw/block/nvme*
 F: tests/nvme-test.c

-megasas
-M: Hannes Reinecke <hare@suse.de>
-S: Supported
-F: hw/scsi/megasas.c
-F: hw/scsi/mfi.h
-
 Xilinx EDK
 M: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -686,9 +666,6 @@ M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: audio/
 F: hw/audio/
-F: tests/ac97-test.c
-F: tests/es1370-test.c
-F: tests/intel-hda-test.c

 Block
 M: Kevin Wolf <kwolf@redhat.com>
@@ -697,8 +674,6 @@ S: Supported
 F: block*
 F: block/
 F: hw/block/
-F: qemu-img*
-F: qemu-io*
 T: git git://repo.or.cz/qemu/kevin.git block
 T: git git://github.com/stefanha/qemu.git block

@@ -732,16 +707,6 @@ S: Odd Fixes
 F: gdbstub*
 F: gdb-xml/

-Memory API
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Supported
-F: include/exec/ioport.h
-F: ioport.c
-F: include/exec/memory.h
-F: memory.c
-F: include/exec/memory-internal.h
-F: exec.c
-
 SPICE
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Supported
@@ -813,17 +778,6 @@ S: Supported
 F: qapi-schema.json
 T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp

-QOM
-M: Anthony Liguori <aliguori@amazon.com>
-M: Andreas Färber <afaerber@suse.de>
-S: Supported
-T: git git://github.com/afaerber/qemu-cpu.git qom-next
-F: include/qom/
-X: include/qom/cpu.h
-F: qom/
-X: qom/cpu.c
-F: tests/qom-test.c
-
 QMP
 M: Luiz Capitulino <lcapitulino@redhat.com>
 S: Maintained
@@ -854,7 +808,7 @@ S: Odd Fixes
 F: scripts/checkpatch.pl

 Seccomp
-M: Eduardo Otubo <eduardo.otubo@profitbricks.com>
+M: Eduardo Otubo <otubo@linux.vnet.ibm.com>
 S: Supported
 F: qemu-seccomp.c
 F: include/sysemu/seccomp.h
--- a/70
+++ b/70
@@ -45,19 +45,19 @@ endif
 endif

 GENERATED_HEADERS = config-host.h qemu-options.def
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h qapi-event.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c qapi-event.c
+GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
+GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c

 GENERATED_HEADERS += trace/generated-events.h
 GENERATED_SOURCES += trace/generated-events.c

 GENERATED_HEADERS += trace/generated-tracers.h
-ifeq ($(findstring dtrace,$(TRACE_BACKENDS)),dtrace)
+ifeq ($(TRACE_BACKEND),dtrace)
 GENERATED_HEADERS += trace/generated-tracers-dtrace.h
 endif
 GENERATED_SOURCES += trace/generated-tracers.c

-ifeq ($(findstring ust,$(TRACE_BACKENDS)),ust)
+ifeq ($(TRACE_BACKEND),ust)
 GENERATED_HEADERS += trace/generated-ust-provider.h
 GENERATED_SOURCES += trace/generated-ust.c
 endif
@@ -148,6 +148,10 @@ endif

 all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules

+vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)
+
+vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)
+
 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
 qemu-options.def: $(SRC_PATH)/qemu-options.hx
@@ -191,6 +195,8 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))

 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)

+bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)
+
 $(BUILD_DIR)/version.o: $(SRC_PATH)/version.rc $(BUILD_DIR)/config-host.h | $(BUILD_DIR)/version.lo
 	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"  RC    version.o")
 $(BUILD_DIR)/version.lo: $(SRC_PATH)/version.rc $(BUILD_DIR)/config-host.h
@@ -202,7 +208,7 @@ Makefile: $(version-obj-y) $(version-lobj-y)
 # Build libraries

 libqemustub.a: $(stub-obj-y)
-libqemuutil.a: $(util-obj-y) qapi-types.o qapi-visit.o qapi-event.o
+libqemuutil.a: $(util-obj-y) qapi-types.o qapi-visit.o

 block-modules = $(foreach o,$(block-obj-m),"$(basename $(subst /,-,$o))",) NULL
 util/module.o-cflags = -D'CONFIG_BLOCK_MODULES=$(block-modules)'
@@ -232,44 +238,23 @@ qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py

 qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
-		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
-		"  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
 qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
-		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
-		"  GEN   $@")
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
 qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
-		$(gen-out-type) -o qga/qapi-generated -p "qga-" -i $<, \
-		"  GEN   $@")
-
-qapi-modules = $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/qapi/common.json \
-               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
-               $(SRC_PATH)/qapi/event.json
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")

 qapi-types.c qapi-types.h :\
-$(qapi-modules) $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
-		$(gen-out-type) -o "." -b -i $<, \
-		"  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o "." -b < $<, "  GEN   $@")
 qapi-visit.c qapi-visit.h :\
-$(qapi-modules) $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
-		$(gen-out-type) -o "." -b -i $<, \
-		"  GEN   $@")
-qapi-event.c qapi-event.h :\
-$(qapi-modules) $(SRC_PATH)/scripts/qapi-event.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-event.py \
-		$(gen-out-type) -o "." -b -i $<, \
-		"  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o "." -b < $<, "  GEN   $@")
 qmp-commands.h qmp-marshal.c :\
-$(qapi-modules) $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
-		$(gen-out-type) -o "." -m -i $<, \
-		"  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -m -o "." < $<, "  GEN   $@")

 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
@@ -344,8 +329,7 @@ multiboot.bin linuxboot.bin kvmvapic.bin \
 s390-zipl.rom \
 s390-ccw.img \
 spapr-rtas.bin slof.bin \
-palcode-clipper \
-u-boot.e500
+palcode-clipper
 else
 BLOBS=
 endif
@@ -386,19 +370,19 @@ install-sysconfig: install-datadir install-confdir

 install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig \
 install-datadir install-localstatedir
+	$(INSTALL_DIR) "$(DESTDIR)$(bindir)"
 ifneq ($(TOOLS),)
-	$(call install-prog,$(TOOLS),$(DESTDIR)$(bindir))
+	$(INSTALL_PROG) $(STRIP_OPT) $(TOOLS) "$(DESTDIR)$(bindir)"
 endif
 ifneq ($(CONFIG_MODULES),)
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_moddir)"
-	for s in $(modules-m:.mo=$(DSOSUF)); do \
-		t="$(DESTDIR)$(qemu_moddir)/$$(echo $$s | tr / -)"; \
-		$(INSTALL_LIB) $$s "$$t"; \
-		test -z "$(STRIP)" || $(STRIP) "$$t"; \
+	for s in $(patsubst %.mo,%$(DSOSUF),$(modules-m)); do \
+		$(INSTALL_PROG) $(STRIP_OPT) $$s "$(DESTDIR)$(qemu_moddir)/$$(echo $$s | tr / -)"; \
 	done
 endif
 ifneq ($(HELPERS-y),)
-	$(call install-prog,$(HELPERS-y),$(DESTDIR)$(libexecdir))
+	$(INSTALL_DIR) "$(DESTDIR)$(libexecdir)"
+	$(INSTALL_PROG) $(STRIP_OPT) $(HELPERS-y) "$(DESTDIR)$(libexecdir)"
 endif
 ifneq ($(BLOBS),)
 	set -e; for x in $(BLOBS); do \
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -12,7 +12,7 @@ block-obj-y += main-loop.o iohandler.o qemu-timer.o
 block-obj-$(CONFIG_POSIX) += aio-posix.o
 block-obj-$(CONFIG_WIN32) += aio-win32.o
 block-obj-y += block/
-block-obj-y += qapi-types.o qapi-visit.o qapi-event.o
+block-obj-y += qapi-types.o qapi-visit.o
 block-obj-y += qemu-io-cmds.o

 block-obj-y += qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
@@ -31,8 +31,6 @@ libcacard-y += libcacard/vcard_emul_nss.o
 libcacard-y += libcacard/vcard_emul_type.o
 libcacard-y += libcacard/card_7816.o
 libcacard-y += libcacard/vcardt.o
-libcacard/vcard_emul_nss.o-cflags := $(NSS_CFLAGS)
-libcacard/vcard_emul_nss.o-libs := $(NSS_LIBS)

 ######################################################################
 # Target independent part of system emulation. The long term path is to
@@ -66,11 +64,9 @@ common-obj-y += hw/

 common-obj-y += ui/
 common-obj-y += bt-host.o bt-vhci.o
-bt-host.o-cflags := $(BLUEZ_CFLAGS)

 common-obj-y += dma-helpers.o
 common-obj-y += vl.o
-vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-y += tpm.o

 common-obj-$(CONFIG_SLIRP) += slirp/
--- a/Makefile.target
+++ b/Makefile.target
@@ -16,22 +16,19 @@ QEMU_CFLAGS+=-I$(SRC_PATH)/include
 ifdef CONFIG_USER_ONLY
 # user emulator name
 QEMU_PROG=qemu-$(TARGET_NAME)
-QEMU_PROG_BUILD = $(QEMU_PROG)
 else
 # system emulator name
-QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
 ifneq (,$(findstring -mwindows,$(libs_softmmu)))
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
-$(QEMU_PROG): $(QEMU_PROGW)
-	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
-QEMU_PROG_BUILD = $(QEMU_PROGW)
-else
-QEMU_PROG_BUILD = $(QEMU_PROG)
-endif
+endif # windows executable
+QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
 endif

-PROGS=$(QEMU_PROG) $(QEMU_PROGW)
+PROGS=$(QEMU_PROG)
+ifdef QEMU_PROGW
+PROGS+=$(QEMU_PROGW)
+endif
 STPFILES=

 config-target.h: config-target.h-timestamp
@@ -49,7 +46,7 @@ endif
 $(QEMU_PROG).stp-installed: $(SRC_PATH)/trace-events
 	$(call quiet-command,$(TRACETOOL) \
 		--format=stap \
-		--backends=$(TRACE_BACKENDS) \
+		--backend=$(TRACE_BACKEND) \
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
@@ -58,7 +55,7 @@ $(QEMU_PROG).stp-installed: $(SRC_PATH)/trace-events
 $(QEMU_PROG).stp: $(SRC_PATH)/trace-events
 	$(call quiet-command,$(TRACETOOL) \
 		--format=stap \
-		--backends=$(TRACE_BACKENDS) \
+		--backend=$(TRACE_BACKEND) \
 		--binary=$(realpath .)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
@@ -85,12 +82,6 @@ obj-y += disas.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
 obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o

-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decContext.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decNumber.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal32.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal64.o
-obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal128.o
-
 #########################################################
 # Linux user emulator target

@@ -108,8 +99,7 @@ endif #CONFIG_LINUX_USER

 ifdef CONFIG_BSD_USER

-QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ABI_DIR) \
-			 -I$(SRC_PATH)/bsd-user/$(HOST_VARIANT_DIR)
+QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ABI_DIR)

 obj-y += bsd-user/
 obj-y += gdbstub.o user-exec.o
@@ -119,7 +109,7 @@ endif #CONFIG_BSD_USER
 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
-obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
+obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o
 obj-y += qtest.o
 obj-y += hw/
 obj-$(CONFIG_FDT) += device_tree.o
@@ -130,10 +120,8 @@ obj-y += dump.o
 LIBS+=$(libs_softmmu)

 # xen support
-obj-$(CONFIG_XEN) += xen-common.o
-obj-$(CONFIG_XEN_I386) += xen-hvm.o xen-mapcache.o
-obj-$(call lnot,$(CONFIG_XEN)) += xen-common-stub.o
-obj-$(call lnot,$(CONFIG_XEN_I386)) += xen-hvm-stub.o
+obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
+obj-$(call lnot,$(CONFIG_XEN)) += xen-stub.o

 # Hardware support
 ifeq ($(TARGET_NAME), sparc64)
@@ -150,7 +138,10 @@ endif # CONFIG_SOFTMMU
 %/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)

 dummy := $(call unnest-vars,,obj-y)
-all-obj-y := $(obj-y)
+
+# we are making another call to unnest-vars with different vars, protect obj-y,
+# it can be overriden in subdir Makefile.objs
+obj-y-save := $(obj-y)

 block-obj-y :=
 common-obj-y :=
@@ -160,12 +151,27 @@ dummy := $(call unnest-vars,.., \
               block-obj-m \
               common-obj-y \
               common-obj-m)
-all-obj-y += $(common-obj-y)
+
+# Now restore obj-y
+obj-y := $(obj-y-save)
+
+all-obj-y = $(obj-y) $(common-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y)

-# build either PROG or PROGW
-$(QEMU_PROG_BUILD): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+ifndef CONFIG_HAIKU
+LIBS+=-lm
+endif
+
+ifdef QEMU_PROGW
+# The linker builds a windows executable. Make also a console executable.
+$(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
 	$(call LINK,$^)
+$(QEMU_PROG): $(QEMU_PROGW)
+	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
+else
+$(QEMU_PROG): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+	$(call LINK,$^)
+endif

 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")
@@ -186,7 +192,10 @@ endif

 install: all
 ifneq ($(PROGS),)
-	$(call install-prog,$(PROGS),$(DESTDIR)$(bindir))
+	$(INSTALL) -m 755 $(PROGS) "$(DESTDIR)$(bindir)"
+ifneq ($(STRIP),)
+	$(STRIP) $(patsubst %,"$(DESTDIR)$(bindir)/%",$(PROGS))
+endif
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
--- a/2
+++ b/2
@@ -1 +1 @@
-2.1.0
+2.0.2
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -125,7 +125,7 @@ static bool aio_dispatch(AioContext *ctx)
    bool progress = false;

    /*
-     * We have to walk very carefully in case aio_set_fd_handler is
+     * We have to walk very carefully in case qemu_aio_set_fd_handler is
     * called while we're walking.
     */
    node = QLIST_FIRST(&ctx->aio_handlers);
@@ -175,56 +175,27 @@ static bool aio_dispatch(AioContext *ctx)
 bool aio_poll(AioContext *ctx, bool blocking)
 {
    AioHandler *node;
-    bool was_dispatching;
    int ret;
    bool progress;

-    was_dispatching = ctx->dispatching;
    progress = false;

-    /* aio_notify can avoid the expensive event_notifier_set if
-     * everything (file descriptors, bottom halves, timers) will
-     * be re-evaluated before the next blocking poll().  This happens
-     * in two cases:
-     *
-     * 1) when aio_poll is called with blocking == false
-     *
-     * 2) when we are called after poll().  If we are called before
-     *    poll(), bottom halves will not be re-evaluated and we need
-     *    aio_notify() if blocking == true.
-     *
-     * The first aio_dispatch() only does something when AioContext is
-     * running as a GSource, and in that case aio_poll is used only
-     * with blocking == false, so this optimization is already quite
-     * effective.  However, the code is ugly and should be restructured
-     * to have a single aio_dispatch() call.  To do this, we need to
-     * reorganize aio_poll into a prepare/poll/dispatch model like
-     * glib's.
-     *
-     * If we're in a nested event loop, ctx->dispatching might be true.
-     * In that case we can restore it just before returning, but we
-     * have to clear it now.
-     */
-    aio_set_dispatching(ctx, !blocking);
-
    /*
     * If there are callbacks left that have been queued, we need to call them.
     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for aio_poll loops).
+     * does not need a complete flush (as is the case for qemu_aio_wait loops).
     */
    if (aio_bh_poll(ctx)) {
        blocking = false;
        progress = true;
    }

-    /* Re-evaluate condition (1) above.  */
-    aio_set_dispatching(ctx, !blocking);
    if (aio_dispatch(ctx)) {
        progress = true;
    }

    if (progress && !blocking) {
-        goto out;
+        return true;
    }

    ctx->walking_handlers++;
@@ -263,12 +234,9 @@ bool aio_poll(AioContext *ctx, bool blocking)
    }

    /* Run dispatch even if there were no readable fds to run timers */
-    aio_set_dispatching(ctx, true);
    if (aio_dispatch(ctx)) {
        progress = true;
    }

-out:
-    aio_set_dispatching(ctx, was_dispatching);
    return progress;
 }
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -102,7 +102,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
    /*
     * If there are callbacks left that have been queued, we need to call then.
     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for aio_poll loops).
+     * does not need a complete flush (as is the case for qemu_aio_wait loops).
     */
    if (aio_bh_poll(ctx)) {
        blocking = false;
@@ -115,7 +115,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
    /*
     * Then dispatch any pending callbacks from the GSource.
     *
-     * We have to walk very carefully in case aio_set_fd_handler is
+     * We have to walk very carefully in case qemu_aio_set_fd_handler is
     * called while we're walking.
     */
    node = QLIST_FIRST(&ctx->aio_handlers);
@@ -177,7 +177,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
        blocking = false;

        /* we have to walk very carefully in case
-         * aio_set_fd_handler is called while we're walking */
+         * qemu_aio_set_fd_handler is called while we're walking */
        node = QLIST_FIRST(&ctx->aio_handlers);
        while (node) {
            AioHandler *tmp;
--- a/arch_init.c
+++ b/arch_init.c
@@ -45,7 +45,6 @@
 #include "hw/audio/pcspk.h"
 #include "migration/page_cache.h"
 #include "qemu/config-file.h"
-#include "qemu/error-report.h"
 #include "qmp-commands.h"
 #include "trace.h"
 #include "exec/cpu-all.h"
@@ -111,8 +110,6 @@ static bool mig_throttle_on;
 static int dirty_rate_high_cnt;
 static void check_guest_throttling(void);

-static uint64_t bitmap_sync_count;
-
 /***********************************************************/
 /* ram save/restore */

@@ -170,8 +167,11 @@ static struct {
    /* Cache for XBZRLE, Protected by lock. */
    PageCache *cache;
    QemuMutex lock;
-} XBZRLE;
-
+} XBZRLE = {
+    .encoded_buf = NULL,
+    .current_buf = NULL,
+    .cache = NULL,
+};
 /* buffer used for XBZRLE decoding */
 static uint8_t *xbzrle_decoded_buf;

@@ -187,44 +187,41 @@ static void XBZRLE_cache_unlock(void)
        qemu_mutex_unlock(&XBZRLE.lock);
 }

-/*
- * called from qmp_migrate_set_cache_size in main thread, possibly while
- * a migration is in progress.
- * A running migration maybe using the cache and might finish during this
- * call, hence changes to the cache are protected by XBZRLE.lock().
- */
 int64_t xbzrle_cache_resize(int64_t new_size)
 {
-    PageCache *new_cache;
-    int64_t ret;
+    PageCache *new_cache, *cache_to_free;

    if (new_size < TARGET_PAGE_SIZE) {
        return -1;
    }

-    XBZRLE_cache_lock();
-
+    /* no need to lock, the current thread holds qemu big lock */
    if (XBZRLE.cache != NULL) {
+        /* check XBZRLE.cache again later */
        if (pow2floor(new_size) == migrate_xbzrle_cache_size()) {
-            goto out_new_size;
+            return pow2floor(new_size);
        }
        new_cache = cache_init(new_size / TARGET_PAGE_SIZE,
                                        TARGET_PAGE_SIZE);
        if (!new_cache) {
-            error_report("Error creating cache");
-            ret = -1;
-            goto out;
+            DPRINTF("Error creating cache\n");
+            return -1;
        }

-        cache_fini(XBZRLE.cache);
-        XBZRLE.cache = new_cache;
+        XBZRLE_cache_lock();
+        /* the XBZRLE.cache may have be destroyed, check it again */
+        if (XBZRLE.cache != NULL) {
+            cache_to_free = XBZRLE.cache;
+            XBZRLE.cache = new_cache;
+        } else {
+            cache_to_free = new_cache;
+        }
+        XBZRLE_cache_unlock();
+
+        cache_fini(cache_to_free);
    }

-out_new_size:
-    ret = pow2floor(new_size);
-out:
-    XBZRLE_cache_unlock();
-    return ret;
+    return pow2floor(new_size);
 }

 /* accounting for migration statistics */
@@ -236,7 +233,6 @@ typedef struct AccountingInfo {
    uint64_t xbzrle_bytes;
    uint64_t xbzrle_pages;
    uint64_t xbzrle_cache_miss;
-    double xbzrle_cache_miss_rate;
    uint64_t xbzrle_overflows;
 } AccountingInfo;

@@ -292,11 +288,6 @@ uint64_t xbzrle_mig_pages_cache_miss(void)
    return acct_info.xbzrle_cache_miss;
 }

-double xbzrle_mig_cache_miss_rate(void)
-{
-    return acct_info.xbzrle_cache_miss_rate;
-}
-
 uint64_t xbzrle_mig_pages_overflow(void)
 {
    return acct_info.xbzrle_overflows;
@@ -349,7 +340,7 @@ static void xbzrle_cache_zero_page(ram_addr_t current_addr)

 #define ENCODING_FLAG_XBZRLE 0x1

-static int save_xbzrle_page(QEMUFile *f, uint8_t **current_data,
+static int save_xbzrle_page(QEMUFile *f, uint8_t *current_data,
                            ram_addr_t current_addr, RAMBlock *block,
                            ram_addr_t offset, int cont, bool last_stage)
 {
@@ -357,23 +348,19 @@ static int save_xbzrle_page(QEMUFile *f, uint8_t **current_data,
    uint8_t *prev_cached_page;

    if (!cache_is_cached(XBZRLE.cache, current_addr)) {
-        acct_info.xbzrle_cache_miss++;
        if (!last_stage) {
-            if (cache_insert(XBZRLE.cache, current_addr, *current_data) == -1) {
+            if (cache_insert(XBZRLE.cache, current_addr, current_data) == -1) {
                return -1;
-            } else {
-                /* update *current_data when the page has been
-                   inserted into cache */
-                *current_data = get_cached_data(XBZRLE.cache, current_addr);
            }
        }
+        acct_info.xbzrle_cache_miss++;
        return -1;
    }

    prev_cached_page = get_cached_data(XBZRLE.cache, current_addr);

    /* save current buffer into memory */
-    memcpy(XBZRLE.current_buf, *current_data, TARGET_PAGE_SIZE);
+    memcpy(XBZRLE.current_buf, current_data, TARGET_PAGE_SIZE);

    /* XBZRLE encoding (if there is no overflow) */
    encoded_len = xbzrle_encode_buffer(prev_cached_page, XBZRLE.current_buf,
@@ -386,10 +373,7 @@ static int save_xbzrle_page(QEMUFile *f, uint8_t **current_data,
        DPRINTF("Overflow\n");
        acct_info.xbzrle_overflows++;
        /* update data in the cache */
-        if (!last_stage) {
-            memcpy(prev_cached_page, *current_data, TARGET_PAGE_SIZE);
-            *current_data = prev_cached_page;
-        }
+        memcpy(prev_cached_page, current_data, TARGET_PAGE_SIZE);
        return -1;
    }

@@ -495,10 +479,6 @@ static void migration_bitmap_sync(void)
    static int64_t num_dirty_pages_period;
    int64_t end_time;
    int64_t bytes_xfer_now;
-    static uint64_t xbzrle_cache_miss_prev;
-    static uint64_t iterations_prev;
-
-    bitmap_sync_count++;

    if (!bytes_xfer_prev) {
        bytes_xfer_prev = ram_bytes_transferred();
@@ -540,113 +520,29 @@ static void migration_bitmap_sync(void)
        } else {
             mig_throttle_on = false;
        }
-        if (migrate_use_xbzrle()) {
-            if (iterations_prev != 0) {
-                acct_info.xbzrle_cache_miss_rate =
-                   (double)(acct_info.xbzrle_cache_miss -
-                            xbzrle_cache_miss_prev) /
-                   (acct_info.iterations - iterations_prev);
-            }
-            iterations_prev = acct_info.iterations;
-            xbzrle_cache_miss_prev = acct_info.xbzrle_cache_miss;
-        }
        s->dirty_pages_rate = num_dirty_pages_period * 1000
            / (end_time - start_time);
        s->dirty_bytes_rate = s->dirty_pages_rate * TARGET_PAGE_SIZE;
        start_time = end_time;
        num_dirty_pages_period = 0;
-        s->dirty_sync_count = bitmap_sync_count;
    }
 }

 /*
- * ram_save_page: Send the given page to the stream
- *
- * Returns: Number of bytes written.
- */
-static int ram_save_page(QEMUFile *f, RAMBlock* block, ram_addr_t offset,
-                         bool last_stage)
-{
-    int bytes_sent;
-    int cont;
-    ram_addr_t current_addr;
-    MemoryRegion *mr = block->mr;
-    uint8_t *p;
-    int ret;
-    bool send_async = true;
-
-    cont = (block == last_sent_block) ? RAM_SAVE_FLAG_CONTINUE : 0;
-
-    p = memory_region_get_ram_ptr(mr) + offset;
-
-    /* In doubt sent page as normal */
-    bytes_sent = -1;
-    ret = ram_control_save_page(f, block->offset,
-                           offset, TARGET_PAGE_SIZE, &bytes_sent);
-
-    XBZRLE_cache_lock();
-
-    current_addr = block->offset + offset;
-    if (ret != RAM_SAVE_CONTROL_NOT_SUPP) {
-        if (ret != RAM_SAVE_CONTROL_DELAYED) {
-            if (bytes_sent > 0) {
-                acct_info.norm_pages++;
-            } else if (bytes_sent == 0) {
-                acct_info.dup_pages++;
-            }
-        }
-    } else if (is_zero_range(p, TARGET_PAGE_SIZE)) {
-        acct_info.dup_pages++;
-        bytes_sent = save_block_hdr(f, block, offset, cont,
-                                    RAM_SAVE_FLAG_COMPRESS);
-        qemu_put_byte(f, 0);
-        bytes_sent++;
-        /* Must let xbzrle know, otherwise a previous (now 0'd) cached
-         * page would be stale
-         */
-        xbzrle_cache_zero_page(current_addr);
-    } else if (!ram_bulk_stage && migrate_use_xbzrle()) {
-        bytes_sent = save_xbzrle_page(f, &p, current_addr, block,
-                                      offset, cont, last_stage);
-        if (!last_stage) {
-            /* Can't send this cached data async, since the cache page
-             * might get updated before it gets to the wire
-             */
-            send_async = false;
-        }
-    }
-
-    /* XBZRLE overflow or normal page */
-    if (bytes_sent == -1) {
-        bytes_sent = save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_PAGE);
-        if (send_async) {
-            qemu_put_buffer_async(f, p, TARGET_PAGE_SIZE);
-        } else {
-            qemu_put_buffer(f, p, TARGET_PAGE_SIZE);
-        }
-        bytes_sent += TARGET_PAGE_SIZE;
-        acct_info.norm_pages++;
-    }
-
-    XBZRLE_cache_unlock();
-
-    return bytes_sent;
-}
-
-/*
- * ram_find_and_save_block: Finds a page to send and sends it to f
+ * ram_save_block: Writes a page of memory to the stream f
 *
 * Returns:  The number of bytes written.
 *           0 means no dirty pages
 */

-static int ram_find_and_save_block(QEMUFile *f, bool last_stage)
+static int ram_save_block(QEMUFile *f, bool last_stage)
 {
    RAMBlock *block = last_seen_block;
    ram_addr_t offset = last_offset;
    bool complete_round = false;
    int bytes_sent = 0;
    MemoryRegion *mr;
+    ram_addr_t current_addr;

    if (!block)
        block = QTAILQ_FIRST(&ram_list.blocks);
@@ -667,8 +563,70 @@ static int ram_find_and_save_block(QEMUFile *f, bool last_stage)
                ram_bulk_stage = false;
            }
        } else {
-            bytes_sent = ram_save_page(f, block, offset, last_stage);
+            int ret;
+            uint8_t *p;
+            bool send_async = true;
+            int cont = (block == last_sent_block) ?
+                RAM_SAVE_FLAG_CONTINUE : 0;

+            p = memory_region_get_ram_ptr(mr) + offset;
+
+            /* In doubt sent page as normal */
+            bytes_sent = -1;
+            ret = ram_control_save_page(f, block->offset,
+                               offset, TARGET_PAGE_SIZE, &bytes_sent);
+
+            XBZRLE_cache_lock();
+
+            current_addr = block->offset + offset;
+            if (ret != RAM_SAVE_CONTROL_NOT_SUPP) {
+                if (ret != RAM_SAVE_CONTROL_DELAYED) {
+                    if (bytes_sent > 0) {
+                        acct_info.norm_pages++;
+                    } else if (bytes_sent == 0) {
+                        acct_info.dup_pages++;
+                    }
+                }
+            } else if (is_zero_range(p, TARGET_PAGE_SIZE)) {
+                acct_info.dup_pages++;
+                bytes_sent = save_block_hdr(f, block, offset, cont,
+                                            RAM_SAVE_FLAG_COMPRESS);
+                qemu_put_byte(f, 0);
+                bytes_sent++;
+                /* Must let xbzrle know, otherwise a previous (now 0'd) cached
+                 * page would be stale
+                 */
+                xbzrle_cache_zero_page(current_addr);
+            } else if (!ram_bulk_stage && migrate_use_xbzrle()) {
+                bytes_sent = save_xbzrle_page(f, p, current_addr, block,
+                                              offset, cont, last_stage);
+                if (!last_stage) {
+                    /* We must send exactly what's in the xbzrle cache
+                     * even if the page wasn't xbzrle compressed, so that
+                     * it's right next time.
+                     */
+                    p = get_cached_data(XBZRLE.cache, current_addr);
+
+                    /* Can't send this cached data async, since the cache page
+                     * might get updated before it gets to the wire
+                     */
+                    send_async = false;
+                }
+            }
+
+            /* XBZRLE overflow or normal page */
+            if (bytes_sent == -1) {
+                bytes_sent = save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_PAGE);
+                if (send_async) {
+                    qemu_put_buffer_async(f, p, TARGET_PAGE_SIZE);
+                } else {
+                    qemu_put_buffer(f, p, TARGET_PAGE_SIZE);
+                }
+                bytes_sent += TARGET_PAGE_SIZE;
+                acct_info.norm_pages++;
+            }
+
+            XBZRLE_cache_unlock();
            /* if page is unmodified, continue to the next */
            if (bytes_sent > 0) {
                last_sent_block = block;
@@ -739,6 +697,7 @@ static void migration_end(void)
    XBZRLE_cache_lock();
    if (XBZRLE.cache) {
        cache_fini(XBZRLE.cache);
+        g_free(XBZRLE.cache);
        g_free(XBZRLE.encoded_buf);
        g_free(XBZRLE.current_buf);
        XBZRLE.cache = NULL;
@@ -767,34 +726,37 @@ static void reset_ram_globals(void)
 static int ram_save_setup(QEMUFile *f, void *opaque)
 {
    RAMBlock *block;
-    int64_t ram_bitmap_pages; /* Size of bitmap in pages, including gaps */
+    int64_t ram_pages = last_ram_offset() >> TARGET_PAGE_BITS;

+    migration_bitmap = bitmap_new(ram_pages);
+    bitmap_set(migration_bitmap, 0, ram_pages);
+    migration_dirty_pages = ram_pages;
    mig_throttle_on = false;
    dirty_rate_high_cnt = 0;
-    bitmap_sync_count = 0;

    if (migrate_use_xbzrle()) {
-        XBZRLE_cache_lock();
+        qemu_mutex_lock_iothread();
        XBZRLE.cache = cache_init(migrate_xbzrle_cache_size() /
                                  TARGET_PAGE_SIZE,
                                  TARGET_PAGE_SIZE);
        if (!XBZRLE.cache) {
-            XBZRLE_cache_unlock();
-            error_report("Error creating cache");
+            qemu_mutex_unlock_iothread();
+            DPRINTF("Error creating cache\n");
            return -1;
        }
-        XBZRLE_cache_unlock();
+        qemu_mutex_init(&XBZRLE.lock);
+        qemu_mutex_unlock_iothread();

        /* We prefer not to abort if there is no memory */
        XBZRLE.encoded_buf = g_try_malloc0(TARGET_PAGE_SIZE);
        if (!XBZRLE.encoded_buf) {
-            error_report("Error allocating encoded_buf");
+            DPRINTF("Error allocating encoded_buf\n");
            return -1;
        }

        XBZRLE.current_buf = g_try_malloc(TARGET_PAGE_SIZE);
        if (!XBZRLE.current_buf) {
-            error_report("Error allocating current_buf");
+            DPRINTF("Error allocating current_buf\n");
            g_free(XBZRLE.encoded_buf);
            XBZRLE.encoded_buf = NULL;
            return -1;
@@ -808,22 +770,6 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
    bytes_transferred = 0;
    reset_ram_globals();

-    ram_bitmap_pages = last_ram_offset() >> TARGET_PAGE_BITS;
-    migration_bitmap = bitmap_new(ram_bitmap_pages);
-    bitmap_set(migration_bitmap, 0, ram_bitmap_pages);
-
-    /*
-     * Count the total number of pages used by ram blocks not including any
-     * gaps due to alignment or unplugs.
-     */
-    migration_dirty_pages = 0;
-    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
-        uint64_t block_pages;
-
-        block_pages = block->length >> TARGET_PAGE_BITS;
-        migration_dirty_pages += block_pages;
-    }
-
    memory_global_dirty_log_start();
    migration_bitmap_sync();
    qemu_mutex_unlock_iothread();
@@ -866,7 +812,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
    while ((ret = qemu_file_rate_limit(f)) == 0) {
        int bytes_sent;

-        bytes_sent = ram_find_and_save_block(f, false);
+        bytes_sent = ram_save_block(f, false);
        /* no more blocks to sent */
        if (bytes_sent == 0) {
            break;
@@ -928,7 +874,7 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
    while (true) {
        int bytes_sent;

-        bytes_sent = ram_find_and_save_block(f, true);
+        bytes_sent = ram_save_block(f, true);
        /* no more blocks to sent */
        if (bytes_sent == 0) {
            break;
@@ -962,6 +908,7 @@ static uint64_t ram_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)

 static int load_xbzrle(QEMUFile *f, ram_addr_t addr, void *host)
 {
+    int ret, rc = 0;
    unsigned int xh_len;
    int xh_flags;

@@ -974,25 +921,30 @@ static int load_xbzrle(QEMUFile *f, ram_addr_t addr, void *host)
    xh_len = qemu_get_be16(f);

    if (xh_flags != ENCODING_FLAG_XBZRLE) {
-        error_report("Failed to load XBZRLE page - wrong compression!");
+        fprintf(stderr, "Failed to load XBZRLE page - wrong compression!\n");
        return -1;
    }

    if (xh_len > TARGET_PAGE_SIZE) {
-        error_report("Failed to load XBZRLE page - len overflow!");
+        fprintf(stderr, "Failed to load XBZRLE page - len overflow!\n");
        return -1;
    }
    /* load data and decode */
    qemu_get_buffer(f, xbzrle_decoded_buf, xh_len);

    /* decode RLE */
-    if (xbzrle_decode_buffer(xbzrle_decoded_buf, xh_len, host,
-                             TARGET_PAGE_SIZE) == -1) {
-        error_report("Failed to load XBZRLE page - decode error!");
-        return -1;
+    ret = xbzrle_decode_buffer(xbzrle_decoded_buf, xh_len, host,
+                               TARGET_PAGE_SIZE);
+    if (ret == -1) {
+        fprintf(stderr, "Failed to load XBZRLE page - decode error!\n");
+        rc = -1;
+    } else  if (ret > TARGET_PAGE_SIZE) {
+        fprintf(stderr, "Failed to load XBZRLE page - size %d exceeds %d!\n",
+                ret, TARGET_PAGE_SIZE);
+        abort();
    }

-    return 0;
+    return rc;
 }

 static inline void *host_from_stream_offset(QEMUFile *f,
@@ -1005,7 +957,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,

    if (flags & RAM_SAVE_FLAG_CONTINUE) {
        if (!block) {
-            error_report("Ack, bad migration stream!");
+            fprintf(stderr, "Ack, bad migration stream!\n");
            return NULL;
        }

@@ -1021,7 +973,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,
            return memory_region_get_ram_ptr(block->mr) + offset;
    }

-    error_report("Can't find block %s!", id);
+    fprintf(stderr, "Can't find block %s!\n", id);
    return NULL;
 }

@@ -1072,9 +1024,10 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                QTAILQ_FOREACH(block, &ram_list.blocks, next) {
                    if (!strncmp(id, block->idstr, sizeof(id))) {
                        if (block->length != length) {
-                            error_report("Length mismatch: %s: " RAM_ADDR_FMT
-                                         " in != " RAM_ADDR_FMT, id, length,
-                                         block->length);
+                            fprintf(stderr,
+                                    "Length mismatch: %s: " RAM_ADDR_FMT
+                                    " in != " RAM_ADDR_FMT "\n", id, length,
+                                    block->length);
                            ret =  -EINVAL;
                        }
                        break;
@@ -1082,8 +1035,8 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                }

                if (!block) {
-                    error_report("Unknown ramblock \"%s\", cannot "
-                                 "accept migration", id);
+                    fprintf(stderr, "Unknown ramblock \"%s\", cannot "
+                            "accept migration\n", id);
                    ret = -EINVAL;
                }
                if (ret) {
@@ -1148,7 +1101,7 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
    return ret;
 }

-static SaveVMHandlers savevm_ram_handlers = {
+SaveVMHandlers savevm_ram_handlers = {
    .save_live_setup = ram_save_setup,
    .save_live_iterate = ram_save_iterate,
    .save_live_complete = ram_save_complete,
@@ -1157,12 +1110,6 @@ static SaveVMHandlers savevm_ram_handlers = {
    .cancel = ram_migration_cancel,
 };

-void ram_mig_init(void)
-{
-    qemu_mutex_init(&XBZRLE.lock);
-    register_savevm_live(NULL, "ram", 0, 4, &savevm_ram_handlers, NULL);
-}
-
 struct soundhw {
    const char *name;
    const char *descr;
@@ -1245,11 +1192,12 @@ void select_soundhw(const char *optarg)

            if (!c->name) {
                if (l > 80) {
-                    error_report("Unknown sound card name (too big to show)");
+                    fprintf(stderr,
+                            "Unknown sound card name (too big to show)\n");
                }
                else {
-                    error_report("Unknown sound card name `%.*s'",
-                                 (int) l, p);
+                    fprintf(stderr, "Unknown sound card name `%.*s'\n",
+                            (int) l, p);
                }
                bad_card = 1;
            }
@@ -1272,13 +1220,13 @@ void audio_init(void)
        if (c->enabled) {
            if (c->isa) {
                if (!isa_bus) {
-                    error_report("ISA bus not available for %s", c->name);
+                    fprintf(stderr, "ISA bus not available for %s\n", c->name);
                    exit(1);
                }
                c->init.init_isa(isa_bus);
            } else {
                if (!pci_bus) {
-                    error_report("PCI bus not available for %s", c->name);
+                    fprintf(stderr, "PCI bus not available for %s\n", c->name);
                    exit(1);
                }
                c->init.init_pci(pci_bus);
--- a/async.c
+++ b/async.c
@@ -26,7 +26,6 @@
 #include "block/aio.h"
 #include "block/thread-pool.h"
 #include "qemu/main-loop.h"
-#include "qemu/atomic.h"

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
@@ -248,25 +247,9 @@ ThreadPool *aio_get_thread_pool(AioContext *ctx)
    return ctx->thread_pool;
 }

-void aio_set_dispatching(AioContext *ctx, bool dispatching)
-{
-    ctx->dispatching = dispatching;
-    if (!dispatching) {
-        /* Write ctx->dispatching before reading e.g. bh->scheduled.
-         * Optimization: this is only needed when we're entering the "unsafe"
-         * phase where other threads must call event_notifier_set.
-         */
-        smp_mb();
-    }
-}
-
 void aio_notify(AioContext *ctx)
 {
-    /* Write e.g. bh->scheduled before reading ctx->dispatching.  */
-    smp_mb();
-    if (!ctx->dispatching) {
-        event_notifier_set(&ctx->notifier);
-    }
+    event_notifier_set(&ctx->notifier);
 }

 static void aio_timerlist_notify(void *opaque)
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -14,4 +14,4 @@ common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o

 $(obj)/audio.o $(obj)/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
-sdlaudio.o-cflags := $(SDL_CFLAGS)
+$(obj)/sdlaudio.o: QEMU_CFLAGS += $(SDL_CFLAGS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -815,8 +815,10 @@ static void alsa_fini_out (HWVoiceOut *hw)
    ldebug ("alsa_fini\n");
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

-    g_free(alsa->pcm_buf);
-    alsa->pcm_buf = NULL;
+    if (alsa->pcm_buf) {
+        g_free (alsa->pcm_buf);
+        alsa->pcm_buf = NULL;
+    }
 }

 static int alsa_init_out (HWVoiceOut *hw, struct audsettings *as)
@@ -976,8 +978,10 @@ static void alsa_fini_in (HWVoiceIn *hw)

    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

-    g_free(alsa->pcm_buf);
-    alsa->pcm_buf = NULL;
+    if (alsa->pcm_buf) {
+        g_free (alsa->pcm_buf);
+        alsa->pcm_buf = NULL;
+    }
 }

 static int alsa_run_in (HWVoiceIn *hw)
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1812,7 +1812,8 @@ static const VMStateDescription vmstate_audio = {
    .name = "audio",
    .version_id = 1,
    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
        VMSTATE_END_OF_LIST()
    }
 };
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -71,7 +71,10 @@ static void glue (audio_init_nb_voices_, TYPE) (struct audio_driver *drv)

 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
-    g_free (HWBUF);
+    if (HWBUF) {
+        g_free (HWBUF);
+    }
+
    HWBUF = NULL;
 }

@@ -89,7 +92,9 @@ static int glue (audio_pcm_hw_alloc_resources_, TYPE) (HW *hw)

 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
-    g_free (sw->buf);
+    if (sw->buf) {
+        g_free (sw->buf);
+    }

    if (sw->rate) {
        st_rate_stop (sw->rate);
@@ -167,8 +172,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
 static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
 {
    glue (audio_pcm_sw_free_resources_, TYPE) (sw);
-    g_free (sw->name);
-    sw->name = NULL;
+    if (sw->name) {
+        g_free (sw->name);
+        sw->name = NULL;
+    }
 }

 static void glue (audio_pcm_hw_add_sw_, TYPE) (HW *hw, SW *sw)
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -736,8 +736,10 @@ static void oss_fini_in (HWVoiceIn *hw)

    oss_anal_close (&oss->fd);

-    g_free(oss->pcm_buf);
-    oss->pcm_buf = NULL;
+    if (oss->pcm_buf) {
+        g_free (oss->pcm_buf);
+        oss->pcm_buf = NULL;
+    }
 }

 static int oss_run_in (HWVoiceIn *hw)
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -105,7 +105,7 @@ static int rate_get_samples (struct audio_pcm_info *info, SpiceRateCtl *rate)
    bytes = muldiv64 (ticks, info->bytes_per_second, get_ticks_per_sec ());
    samples = (bytes - rate->bytes_sent) >> info->shift;
    if (samples < 0 || samples > 65536) {
-        error_report("Resetting rate control (%" PRId64 " samples)", samples);
+        fprintf (stderr, "Resetting rate control (%" PRId64 " samples)\n", samples);
        rate_start (rate);
        samples = 0;
    }
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -63,7 +63,8 @@ static void wav_destroy (void *opaque)
        }
    doclose:
        if (fclose (wav->f)) {
-            error_report("wav_destroy: fclose failed: %s", strerror(errno));
+            fprintf (stderr, "wav_destroy: fclose failed: %s",
+                     strerror (errno));
        }
    }

--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -3,9 +3,6 @@ common-obj-$(CONFIG_POSIX) += rng-random.o

 common-obj-y += msmouse.o
 common-obj-$(CONFIG_BRLAPI) += baum.o
-baum.o-cflags := $(SDL_CFLAGS)
+$(obj)/baum.o: QEMU_CFLAGS += $(SDL_CFLAGS) 

 common-obj-$(CONFIG_TPM) += tpm.o
-
-common-obj-y += hostmem.o hostmem-ram.o
-common-obj-$(CONFIG_LINUX) += hostmem-file.o
--- a/backends/baum.c
+++ b/backends/baum.c
@@ -574,7 +574,7 @@ CharDriverState *chr_baum_init(void)
    int tty;

    baum = g_malloc0(sizeof(BaumDriverState));
-    baum->chr = chr = qemu_chr_alloc();
+    baum->chr = chr = g_malloc0(sizeof(CharDriverState));

    chr->opaque = baum;
    chr->chr_write = baum_write;
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -1,134 +0,0 @@
-/*
- * QEMU Host Memory Backend for hugetlbfs
- *
- * Copyright (C) 2013-2014 Red Hat Inc
- *
- * Authors:
- *   Paolo Bonzini <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-#include "qemu-common.h"
-#include "sysemu/hostmem.h"
-#include "sysemu/sysemu.h"
-#include "qom/object_interfaces.h"
-
-/* hostmem-file.c */
-/**
- * @TYPE_MEMORY_BACKEND_FILE:
- * name of backend that uses mmap on a file descriptor
- */
-#define TYPE_MEMORY_BACKEND_FILE "memory-backend-file"
-
-#define MEMORY_BACKEND_FILE(obj) \
-    OBJECT_CHECK(HostMemoryBackendFile, (obj), TYPE_MEMORY_BACKEND_FILE)
-
-typedef struct HostMemoryBackendFile HostMemoryBackendFile;
-
-struct HostMemoryBackendFile {
-    HostMemoryBackend parent_obj;
-
-    bool share;
-    char *mem_path;
-};
-
-static void
-file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
-{
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);
-
-    if (!backend->size) {
-        error_setg(errp, "can't create backend with size 0");
-        return;
-    }
-    if (!fb->mem_path) {
-        error_setg(errp, "mem_path property not set");
-        return;
-    }
-#ifndef CONFIG_LINUX
-    error_setg(errp, "-mem-path not supported on this host");
-#else
-    if (!memory_region_size(&backend->mr)) {
-        backend->force_prealloc = mem_prealloc;
-        memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
-                                 object_get_canonical_path(OBJECT(backend)),
-                                 backend->size, fb->share,
-                                 fb->mem_path, errp);
-    }
-#endif
-}
-
-static void
-file_backend_class_init(ObjectClass *oc, void *data)
-{
-    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
-
-    bc->alloc = file_backend_memory_alloc;
-}
-
-static char *get_mem_path(Object *o, Error **errp)
-{
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-
-    return g_strdup(fb->mem_path);
-}
-
-static void set_mem_path(Object *o, const char *str, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(o);
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-
-    if (memory_region_size(&backend->mr)) {
-        error_setg(errp, "cannot change property value");
-        return;
-    }
-    if (fb->mem_path) {
-        g_free(fb->mem_path);
-    }
-    fb->mem_path = g_strdup(str);
-}
-
-static bool file_memory_backend_get_share(Object *o, Error **errp)
-{
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-
-    return fb->share;
-}
-
-static void file_memory_backend_set_share(Object *o, bool value, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(o);
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-
-    if (memory_region_size(&backend->mr)) {
-        error_setg(errp, "cannot change property value");
-        return;
-    }
-    fb->share = value;
-}
-
-static void
-file_backend_instance_init(Object *o)
-{
-    object_property_add_bool(o, "share",
-                        file_memory_backend_get_share,
-                        file_memory_backend_set_share, NULL);
-    object_property_add_str(o, "mem-path", get_mem_path,
-                            set_mem_path, NULL);
-}
-
-static const TypeInfo file_backend_info = {
-    .name = TYPE_MEMORY_BACKEND_FILE,
-    .parent = TYPE_MEMORY_BACKEND,
-    .class_init = file_backend_class_init,
-    .instance_init = file_backend_instance_init,
-    .instance_size = sizeof(HostMemoryBackendFile),
-};
-
-static void register_types(void)
-{
-    type_register_static(&file_backend_info);
-}
-
-type_init(register_types);
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -1,53 +0,0 @@
-/*
- * QEMU Host Memory Backend
- *
- * Copyright (C) 2013-2014 Red Hat Inc
- *
- * Authors:
- *   Igor Mammedov <imammedo@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-#include "sysemu/hostmem.h"
-#include "qom/object_interfaces.h"
-
-#define TYPE_MEMORY_BACKEND_RAM "memory-backend-ram"
-
-
-static void
-ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
-{
-    char *path;
-
-    if (!backend->size) {
-        error_setg(errp, "can't create backend with size 0");
-        return;
-    }
-
-    path = object_get_canonical_path_component(OBJECT(backend));
-    memory_region_init_ram(&backend->mr, OBJECT(backend), path,
-                           backend->size);
-    g_free(path);
-}
-
-static void
-ram_backend_class_init(ObjectClass *oc, void *data)
-{
-    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
-
-    bc->alloc = ram_backend_memory_alloc;
-}
-
-static const TypeInfo ram_backend_info = {
-    .name = TYPE_MEMORY_BACKEND_RAM,
-    .parent = TYPE_MEMORY_BACKEND,
-    .class_init = ram_backend_class_init,
-};
-
-static void register_types(void)
-{
-    type_register_static(&ram_backend_info);
-}
-
-type_init(register_types);
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -1,375 +0,0 @@
-/*
- * QEMU Host Memory Backend
- *
- * Copyright (C) 2013-2014 Red Hat Inc
- *
- * Authors:
- *   Igor Mammedov <imammedo@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-#include "sysemu/hostmem.h"
-#include "qapi/visitor.h"
-#include "qapi-types.h"
-#include "qapi-visit.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/config-file.h"
-#include "qom/object_interfaces.h"
-
-#ifdef CONFIG_NUMA
-#include <numaif.h>
-QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_DEFAULT != MPOL_DEFAULT);
-QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_PREFERRED != MPOL_PREFERRED);
-QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_BIND != MPOL_BIND);
-QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_INTERLEAVE != MPOL_INTERLEAVE);
-#endif
-
-static void
-host_memory_backend_get_size(Object *obj, Visitor *v, void *opaque,
-                             const char *name, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    uint64_t value = backend->size;
-
-    visit_type_size(v, &value, name, errp);
-}
-
-static void
-host_memory_backend_set_size(Object *obj, Visitor *v, void *opaque,
-                             const char *name, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    Error *local_err = NULL;
-    uint64_t value;
-
-    if (memory_region_size(&backend->mr)) {
-        error_setg(&local_err, "cannot change property value");
-        goto out;
-    }
-
-    visit_type_size(v, &value, name, &local_err);
-    if (local_err) {
-        goto out;
-    }
-    if (!value) {
-        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
-                   PRIu64 "'", object_get_typename(obj), name, value);
-        goto out;
-    }
-    backend->size = value;
-out:
-    error_propagate(errp, local_err);
-}
-
-static void
-host_memory_backend_get_host_nodes(Object *obj, Visitor *v, void *opaque,
-                                   const char *name, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    uint16List *host_nodes = NULL;
-    uint16List **node = &host_nodes;
-    unsigned long value;
-
-    value = find_first_bit(backend->host_nodes, MAX_NODES);
-    if (value == MAX_NODES) {
-        return;
-    }
-
-    *node = g_malloc0(sizeof(**node));
-    (*node)->value = value;
-    node = &(*node)->next;
-
-    do {
-        value = find_next_bit(backend->host_nodes, MAX_NODES, value + 1);
-        if (value == MAX_NODES) {
-            break;
-        }
-
-        *node = g_malloc0(sizeof(**node));
-        (*node)->value = value;
-        node = &(*node)->next;
-    } while (true);
-
-    visit_type_uint16List(v, &host_nodes, name, errp);
-}
-
-static void
-host_memory_backend_set_host_nodes(Object *obj, Visitor *v, void *opaque,
-                                   const char *name, Error **errp)
-{
-#ifdef CONFIG_NUMA
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    uint16List *l = NULL;
-
-    visit_type_uint16List(v, &l, name, errp);
-
-    while (l) {
-        bitmap_set(backend->host_nodes, l->value, 1);
-        l = l->next;
-    }
-#else
-    error_setg(errp, "NUMA node binding are not supported by this QEMU");
-#endif
-}
-
-static void
-host_memory_backend_get_policy(Object *obj, Visitor *v, void *opaque,
-                               const char *name, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    int policy = backend->policy;
-
-    visit_type_enum(v, &policy, HostMemPolicy_lookup, NULL, name, errp);
-}
-
-static void
-host_memory_backend_set_policy(Object *obj, Visitor *v, void *opaque,
-                               const char *name, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    int policy;
-
-    visit_type_enum(v, &policy, HostMemPolicy_lookup, NULL, name, errp);
-    backend->policy = policy;
-
-#ifndef CONFIG_NUMA
-    if (policy != HOST_MEM_POLICY_DEFAULT) {
-        error_setg(errp, "NUMA policies are not supported by this QEMU");
-    }
-#endif
-}
-
-static bool host_memory_backend_get_merge(Object *obj, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    return backend->merge;
-}
-
-static void host_memory_backend_set_merge(Object *obj, bool value, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    if (!memory_region_size(&backend->mr)) {
-        backend->merge = value;
-        return;
-    }
-
-    if (value != backend->merge) {
-        void *ptr = memory_region_get_ram_ptr(&backend->mr);
-        uint64_t sz = memory_region_size(&backend->mr);
-
-        qemu_madvise(ptr, sz,
-                     value ? QEMU_MADV_MERGEABLE : QEMU_MADV_UNMERGEABLE);
-        backend->merge = value;
-    }
-}
-
-static bool host_memory_backend_get_dump(Object *obj, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    return backend->dump;
-}
-
-static void host_memory_backend_set_dump(Object *obj, bool value, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    if (!memory_region_size(&backend->mr)) {
-        backend->dump = value;
-        return;
-    }
-
-    if (value != backend->dump) {
-        void *ptr = memory_region_get_ram_ptr(&backend->mr);
-        uint64_t sz = memory_region_size(&backend->mr);
-
-        qemu_madvise(ptr, sz,
-                     value ? QEMU_MADV_DODUMP : QEMU_MADV_DONTDUMP);
-        backend->dump = value;
-    }
-}
-
-static bool host_memory_backend_get_prealloc(Object *obj, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    return backend->prealloc || backend->force_prealloc;
-}
-
-static void host_memory_backend_set_prealloc(Object *obj, bool value,
-                                             Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    if (backend->force_prealloc) {
-        if (value) {
-            error_setg(errp,
-                       "remove -mem-prealloc to use the prealloc property");
-            return;
-        }
-    }
-
-    if (!memory_region_size(&backend->mr)) {
-        backend->prealloc = value;
-        return;
-    }
-
-    if (value && !backend->prealloc) {
-        int fd = memory_region_get_fd(&backend->mr);
-        void *ptr = memory_region_get_ram_ptr(&backend->mr);
-        uint64_t sz = memory_region_size(&backend->mr);
-
-        os_mem_prealloc(fd, ptr, sz);
-        backend->prealloc = true;
-    }
-}
-
-static void host_memory_backend_init(Object *obj)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    backend->merge = qemu_opt_get_bool(qemu_get_machine_opts(),
-                                       "mem-merge", true);
-    backend->dump = qemu_opt_get_bool(qemu_get_machine_opts(),
-                                      "dump-guest-core", true);
-    backend->prealloc = mem_prealloc;
-
-    object_property_add_bool(obj, "merge",
-                        host_memory_backend_get_merge,
-                        host_memory_backend_set_merge, NULL);
-    object_property_add_bool(obj, "dump",
-                        host_memory_backend_get_dump,
-                        host_memory_backend_set_dump, NULL);
-    object_property_add_bool(obj, "prealloc",
-                        host_memory_backend_get_prealloc,
-                        host_memory_backend_set_prealloc, NULL);
-    object_property_add(obj, "size", "int",
-                        host_memory_backend_get_size,
-                        host_memory_backend_set_size, NULL, NULL, NULL);
-    object_property_add(obj, "host-nodes", "int",
-                        host_memory_backend_get_host_nodes,
-                        host_memory_backend_set_host_nodes, NULL, NULL, NULL);
-    object_property_add(obj, "policy", "str",
-                        host_memory_backend_get_policy,
-                        host_memory_backend_set_policy, NULL, NULL, NULL);
-}
-
-static void host_memory_backend_finalize(Object *obj)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    if (memory_region_size(&backend->mr)) {
-        memory_region_destroy(&backend->mr);
-    }
-}
-
-MemoryRegion *
-host_memory_backend_get_memory(HostMemoryBackend *backend, Error **errp)
-{
-    return memory_region_size(&backend->mr) ? &backend->mr : NULL;
-}
-
-static void
-host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(uc);
-    HostMemoryBackendClass *bc = MEMORY_BACKEND_GET_CLASS(uc);
-    Error *local_err = NULL;
-    void *ptr;
-    uint64_t sz;
-
-    if (bc->alloc) {
-        bc->alloc(backend, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return;
-        }
-
-        ptr = memory_region_get_ram_ptr(&backend->mr);
-        sz = memory_region_size(&backend->mr);
-
-        if (backend->merge) {
-            qemu_madvise(ptr, sz, QEMU_MADV_MERGEABLE);
-        }
-        if (!backend->dump) {
-            qemu_madvise(ptr, sz, QEMU_MADV_DONTDUMP);
-        }
-#ifdef CONFIG_NUMA
-        unsigned long lastbit = find_last_bit(backend->host_nodes, MAX_NODES);
-        /* lastbit == MAX_NODES means maxnode = 0 */
-        unsigned long maxnode = (lastbit + 1) % (MAX_NODES + 1);
-        /* ensure policy won't be ignored in case memory is preallocated
-         * before mbind(). note: MPOL_MF_STRICT is ignored on hugepages so
-         * this doesn't catch hugepage case. */
-        unsigned flags = MPOL_MF_STRICT;
-
-        /* check for invalid host-nodes and policies and give more verbose
-         * error messages than mbind(). */
-        if (maxnode && backend->policy == MPOL_DEFAULT) {
-            error_setg(errp, "host-nodes must be empty for policy default,"
-                       " or you should explicitly specify a policy other"
-                       " than default");
-            return;
-        } else if (maxnode == 0 && backend->policy != MPOL_DEFAULT) {
-            error_setg(errp, "host-nodes must be set for policy %s",
-                       HostMemPolicy_lookup[backend->policy]);
-            return;
-        }
-
-        /* We can have up to MAX_NODES nodes, but we need to pass maxnode+1
-         * as argument to mbind() due to an old Linux bug (feature?) which
-         * cuts off the last specified node. This means backend->host_nodes
-         * must have MAX_NODES+1 bits available.
-         */
-        assert(sizeof(backend->host_nodes) >=
-               BITS_TO_LONGS(MAX_NODES + 1) * sizeof(unsigned long));
-        assert(maxnode <= MAX_NODES);
-        if (mbind(ptr, sz, backend->policy,
-                  maxnode ? backend->host_nodes : NULL, maxnode + 1, flags)) {
-            error_setg_errno(errp, errno,
-                             "cannot bind memory to host NUMA nodes");
-            return;
-        }
-#endif
-        /* Preallocate memory after the NUMA policy has been instantiated.
-         * This is necessary to guarantee memory is allocated with
-         * specified NUMA policy in place.
-         */
-        if (backend->prealloc) {
-            os_mem_prealloc(memory_region_get_fd(&backend->mr), ptr, sz);
-        }
-    }
-}
-
-static void
-host_memory_backend_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-
-    ucc->complete = host_memory_backend_memory_complete;
-}
-
-static const TypeInfo host_memory_backend_info = {
-    .name = TYPE_MEMORY_BACKEND,
-    .parent = TYPE_OBJECT,
-    .abstract = true,
-    .class_size = sizeof(HostMemoryBackendClass),
-    .class_init = host_memory_backend_class_init,
-    .instance_size = sizeof(HostMemoryBackend),
-    .instance_init = host_memory_backend_init,
-    .instance_finalize = host_memory_backend_finalize,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-static void register_types(void)
-{
-    type_register_static(&host_memory_backend_info);
-}
-
-type_init(register_types);
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -67,7 +67,7 @@ CharDriverState *qemu_chr_open_msmouse(void)
 {
    CharDriverState *chr;

-    chr = qemu_chr_alloc();
+    chr = g_malloc0(sizeof(CharDriverState));
    chr->chr_write = msmouse_chr_write;
    chr->chr_close = msmouse_chr_close;
    chr->explicit_be_open = true;
--- a/backends/rng-random.c
+++ b/backends/rng-random.c
@@ -106,7 +106,10 @@ static void rng_random_set_filename(Object *obj, const char *filename,
        return;
    }

-    g_free(s->filename);
+    if (s->filename) {
+        g_free(s->filename);
+    }
+
    s->filename = g_strdup(filename);
 }

--- a/backends/rng.c
+++ b/backends/rng.c
@@ -50,7 +50,6 @@ static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    RngBackend *s = RNG_BACKEND(obj);
    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-    Error *local_err = NULL;

    if (value == s->opened) {
        return;
@@ -62,14 +61,12 @@ static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
    }

    if (k->opened) {
-        k->opened(s, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return;
-        }
+        k->opened(s, errp);
    }

-    s->opened = true;
+    if (!error_is_set(errp)) {
+        s->opened = value;
+    }
 }

 static void rng_backend_init(Object *obj)
--- a/backends/tpm.c
+++ b/backends/tpm.c
@@ -112,7 +112,6 @@ static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
 {
    TPMBackend *s = TPM_BACKEND(obj);
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-    Error *local_err = NULL;

    if (value == s->opened) {
        return;
@@ -124,14 +123,12 @@ static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
    }

    if (k->opened) {
-        k->opened(s, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return;
-        }
+        k->opened(s, errp);
    }

-    s->opened = true;
+    if (!error_is_set(errp)) {
+        s->opened = value;
+    }
 }

 static void tpm_backend_instance_init(Object *obj)
--- a/balloon.c
+++ b/balloon.c
@@ -81,6 +81,19 @@ static int qemu_balloon_status(BalloonInfo *info)
    return 1;
 }

+void qemu_balloon_changed(int64_t actual)
+{
+    QObject *data;
+
+    data = qobject_from_jsonf("{ 'actual': %" PRId64 " }",
+                              actual);
+
+    monitor_protocol_event(QEVENT_BALLOON_CHANGE, data);
+
+    qobject_decref(data);
+}
+
+
 BalloonInfo *qmp_query_balloon(Error **errp)
 {
    BalloonInfo *info;
--- a/block-migration.c
+++ b/block-migration.c
@@ -59,7 +59,6 @@ typedef struct BlkMigDevState {
    unsigned long *aio_bitmap;
    int64_t completed_sectors;
    BdrvDirtyBitmap *dirty_bitmap;
-    Error *blocker;
 } BlkMigDevState;

 typedef struct BlkMigBlock {
@@ -311,28 +310,13 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)

 /* Called with iothread lock taken.  */

-static int set_dirty_tracking(void)
+static void set_dirty_tracking(void)
 {
    BlkMigDevState *bmds;
-    int ret;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bmds->dirty_bitmap = bdrv_create_dirty_bitmap(bmds->bs, BLOCK_SIZE,
-                                                      NULL);
-        if (!bmds->dirty_bitmap) {
-            ret = -errno;
-            goto fail;
-        }
+        bmds->dirty_bitmap = bdrv_create_dirty_bitmap(bmds->bs, BLOCK_SIZE);
    }
-    return 0;
-
-fail:
-    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        if (bmds->dirty_bitmap) {
-            bdrv_release_dirty_bitmap(bmds->bs, bmds->dirty_bitmap);
-        }
-    }
-    return ret;
 }

 static void unset_dirty_tracking(void)
@@ -362,8 +346,7 @@ static void init_blk_migration_it(void *opaque, BlockDriverState *bs)
        bmds->completed_sectors = 0;
        bmds->shared_base = block_mig_state.shared_base;
        alloc_aio_bitmap(bmds);
-        error_setg(&bmds->blocker, "block device is in use by migration");
-        bdrv_op_block_all(bs, bmds->blocker);
+        bdrv_set_in_use(bs, 1);
        bdrv_ref(bs);

        block_mig_state.total_sector_sum += sectors;
@@ -601,8 +584,7 @@ static void blk_mig_cleanup(void)
    blk_mig_lock();
    while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
-        bdrv_op_unblock_all(bmds->bs, bmds->blocker);
-        error_free(bmds->blocker);
+        bdrv_set_in_use(bmds->bs, 0);
        bdrv_unref(bmds->bs);
        g_free(bmds->aio_bitmap);
        g_free(bmds);
@@ -632,13 +614,7 @@ static int block_save_setup(QEMUFile *f, void *opaque)
    init_blk_migration(f);

    /* start track dirty blocks */
-    ret = set_dirty_tracking();
-
-    if (ret) {
-        qemu_mutex_unlock_iothread();
-        return ret;
-    }
-
+    set_dirty_tracking();
    qemu_mutex_unlock_iothread();

    ret = flush_blks(f);
@@ -861,7 +837,7 @@ static bool block_is_active(void *opaque)
    return block_mig_state.blk_enable == 1;
 }

-static SaveVMHandlers savevm_block_handlers = {
+SaveVMHandlers savevm_block_handlers = {
    .set_params = block_set_params,
    .save_live_setup = block_save_setup,
    .save_live_iterate = block_save_iterate,
--- a/block.c
+++ b/block.c
--- a/block/backup.c
+++ b/block/backup.c
@@ -307,7 +307,7 @@ static void coroutine_fn backup_run(void *opaque)
                                BACKUP_SECTORS_PER_CLUSTER - i, &n);
                    i += n;

-                    if (alloced == 1 || n == 0) {
+                    if (alloced == 1) {
                        break;
                    }
                }
@@ -325,7 +325,7 @@ static void coroutine_fn backup_run(void *opaque)
                /* Depending on error action, fail now or retry cluster */
                BlockErrorAction action =
                    backup_error_action(job, error_is_read, -ret);
-                if (action == BLOCK_ERROR_ACTION_REPORT) {
+                if (action == BDRV_ACTION_REPORT) {
                    break;
                } else {
                    start--;
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -471,7 +471,7 @@ static BlockDriverAIOCB *inject_error(BlockDriverState *bs,
    acb = qemu_aio_get(&blkdebug_aiocb_info, bs, cb, opaque);
    acb->ret = -error;

-    bh = aio_bh_new(bdrv_get_aio_context(bs), error_callback_bh, acb);
+    bh = qemu_bh_new(error_callback_bh, acb);
    acb->bh = bh;
    qemu_bh_schedule(bh);

--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -39,13 +39,12 @@ struct BlkverifyAIOCB {
 static void blkverify_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    BlkverifyAIOCB *acb = (BlkverifyAIOCB *)blockacb;
-    AioContext *aio_context = bdrv_get_aio_context(blockacb->bs);
    bool finished = false;

    /* Wait until request completes, invokes its callback, and frees itself */
    acb->finished = &finished;
    while (!finished) {
-        aio_poll(aio_context, true);
+        qemu_aio_wait();
    }
 }

@@ -229,8 +228,7 @@ static void blkverify_aio_cb(void *opaque, int ret)
            acb->verify(acb);
        }

-        acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
-                             blkverify_aio_bh, acb);
+        acb->bh = qemu_bh_new(blkverify_aio_bh, acb);
        qemu_bh_schedule(acb->bh);
        break;
    }
@@ -304,40 +302,21 @@ static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
    return bdrv_recurse_is_first_non_filter(s->test_file, candidate);
 }

-/* Propagate AioContext changes to ->test_file */
-static void blkverify_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVBlkverifyState *s = bs->opaque;
-
-    bdrv_detach_aio_context(s->test_file);
-}
-
-static void blkverify_attach_aio_context(BlockDriverState *bs,
-                                         AioContext *new_context)
-{
-    BDRVBlkverifyState *s = bs->opaque;
-
-    bdrv_attach_aio_context(s->test_file, new_context);
-}
-
 static BlockDriver bdrv_blkverify = {
-    .format_name                      = "blkverify",
-    .protocol_name                    = "blkverify",
-    .instance_size                    = sizeof(BDRVBlkverifyState),
+    .format_name            = "blkverify",
+    .protocol_name          = "blkverify",
+    .instance_size          = sizeof(BDRVBlkverifyState),

-    .bdrv_parse_filename              = blkverify_parse_filename,
-    .bdrv_file_open                   = blkverify_open,
-    .bdrv_close                       = blkverify_close,
-    .bdrv_getlength                   = blkverify_getlength,
+    .bdrv_parse_filename    = blkverify_parse_filename,
+    .bdrv_file_open         = blkverify_open,
+    .bdrv_close             = blkverify_close,
+    .bdrv_getlength         = blkverify_getlength,

-    .bdrv_aio_readv                   = blkverify_aio_readv,
-    .bdrv_aio_writev                  = blkverify_aio_writev,
-    .bdrv_aio_flush                   = blkverify_aio_flush,
+    .bdrv_aio_readv         = blkverify_aio_readv,
+    .bdrv_aio_writev        = blkverify_aio_writev,
+    .bdrv_aio_flush         = blkverify_aio_flush,

-    .bdrv_attach_aio_context          = blkverify_attach_aio_context,
-    .bdrv_detach_aio_context          = blkverify_detach_aio_context,
-
-    .is_filter                        = true,
+    .is_filter              = true,
    .bdrv_recurse_is_first_non_filter = blkverify_recurse_is_first_non_filter,
 };

--- a/block/bochs.c
+++ b/block/bochs.c
@@ -187,14 +187,13 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    uint64_t offset = sector_num * 512;
    uint64_t extent_index, extent_offset, bitmap_offset;
    char bitmap_entry;
-    int ret;

    // seek to sector
    extent_index = offset / s->extent_size;
    extent_offset = (offset % s->extent_size) / 512;

    if (s->catalog_bitmap[extent_index] == 0xffffffff) {
-	return 0; /* not allocated */
+	return -1; /* not allocated */
    }

    bitmap_offset = s->data_offset +
@@ -202,14 +201,13 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
        (s->extent_blocks + s->bitmap_blocks));

    /* read in bitmap for current extent */
-    ret = bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
-                     &bitmap_entry, 1);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, bitmap_offset + (extent_offset / 8),
+                   &bitmap_entry, 1) != 1) {
+        return -1;
    }

    if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
-	return 0; /* not allocated */
+	return -1; /* not allocated */
    }

    return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
@@ -222,16 +220,13 @@ static int bochs_read(BlockDriverState *bs, int64_t sector_num,

    while (nb_sectors > 0) {
        int64_t block_offset = seek_to_sector(bs, sector_num);
-        if (block_offset < 0) {
-            return block_offset;
-        } else if (block_offset > 0) {
+        if (block_offset >= 0) {
            ret = bdrv_pread(bs->file, block_offset, buf, 512);
-            if (ret < 0) {
-                return ret;
+            if (ret != 512) {
+                return -1;
            }
-        } else {
+        } else
            memset(buf, 0, 512);
-        }
        nb_sectors--;
        sector_num++;
        buf += 512;
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -72,7 +72,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    }
    s->block_size = be32_to_cpu(s->block_size);
    if (s->block_size % 512) {
-        error_setg(errp, "block_size %" PRIu32 " must be a multiple of 512",
+        error_setg(errp, "block_size %u must be a multiple of 512",
                   s->block_size);
        return -EINVAL;
    }
@@ -86,7 +86,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
     * need a buffer this big.
     */
    if (s->block_size > MAX_BLOCK_SIZE) {
-        error_setg(errp, "block_size %" PRIu32 " must be %u MB or less",
+        error_setg(errp, "block_size %u must be %u MB or less",
                   s->block_size,
                   MAX_BLOCK_SIZE / (1024 * 1024));
        return -EINVAL;
@@ -101,7 +101,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    /* read offsets */
    if (s->n_blocks > (UINT32_MAX - 1) / sizeof(uint64_t)) {
        /* Prevent integer overflow */
-        error_setg(errp, "n_blocks %" PRIu32 " must be %zu or less",
+        error_setg(errp, "n_blocks %u must be %zu or less",
                   s->n_blocks,
                   (UINT32_MAX - 1) / sizeof(uint64_t));
        return -EINVAL;
@@ -133,7 +133,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,

        if (s->offsets[i] < s->offsets[i - 1]) {
            error_setg(errp, "offsets not monotonically increasing at "
-                       "index %" PRIu32 ", image file is corrupt", i);
+                       "index %u, image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
@@ -146,8 +146,8 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
         * ridiculous s->compressed_block allocation.
         */
        if (size > 2 * MAX_BLOCK_SIZE) {
-            error_setg(errp, "invalid compressed block size at index %" PRIu32
-                       ", image file is corrupt", i);
+            error_setg(errp, "invalid compressed block size at index %u, "
+                       "image file is corrupt", i);
            ret = -EINVAL;
            goto fail;
        }
--- a/block/commit.c
+++ b/block/commit.c
@@ -37,7 +37,6 @@ typedef struct CommitBlockJob {
    BlockdevOnError on_error;
    int base_flags;
    int orig_overlay_flags;
-    char *backing_file_str;
 } CommitBlockJob;

 static int coroutine_fn commit_populate(BlockDriverState *bs,
@@ -142,7 +141,7 @@ wait:

    if (!block_job_is_cancelled(&s->common) && sector_num == end) {
        /* success */
-        ret = bdrv_drop_intermediate(active, top, base, s->backing_file_str);
+        ret = bdrv_drop_intermediate(active, top, base);
    }

 exit_free_buf:
@@ -159,7 +158,7 @@ exit_restore_reopen:
    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
    }
-    g_free(s->backing_file_str);
+
    block_job_completed(&s->common, ret);
 }

@@ -183,7 +182,7 @@ static const BlockJobDriver commit_job_driver = {
 void commit_start(BlockDriverState *bs, BlockDriverState *base,
                  BlockDriverState *top, int64_t speed,
                  BlockdevOnError on_error, BlockDriverCompletionFunc *cb,
-                  void *opaque, const char *backing_file_str, Error **errp)
+                  void *opaque, Error **errp)
 {
    CommitBlockJob *s;
    BlockReopenQueue *reopen_queue = NULL;
@@ -195,7 +194,7 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,
    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
        !bdrv_iostatus_is_enabled(bs)) {
-        error_setg(errp, "Invalid parameter combination");
+        error_set(errp, QERR_INVALID_PARAMETER_COMBINATION);
        return;
    }

@@ -245,8 +244,6 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,
    s->base_flags          = orig_base_flags;
    s->orig_overlay_flags  = orig_overlay_flags;

-    s->backing_file_str = g_strdup(backing_file_str);
-
    s->on_error = on_error;
    s->common.co = qemu_coroutine_create(commit_run);

--- a/block/cow.c
+++ b/block/cow.c
@@ -82,7 +82,7 @@ static int cow_open(BlockDriverState *bs, QDict *options, int flags,
    if (be32_to_cpu(cow_header.version) != COW_VERSION) {
        char version[64];
        snprintf(version, sizeof(version),
-               "COW version %" PRIu32, cow_header.version);
+               "COW version %d", cow_header.version);
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
            bs->device_name, "cow", version);
        ret = -ENOTSUP;
@@ -324,31 +324,39 @@ static void cow_close(BlockDriverState *bs)
 {
 }

-static int cow_create(const char *filename, QemuOpts *opts, Error **errp)
+static int cow_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    struct cow_header_v2 cow_header;
    struct stat st;
    int64_t image_sectors = 0;
-    char *image_filename = NULL;
+    const char *image_filename = NULL;
    Error *local_err = NULL;
    int ret;
-    BlockDriverState *cow_bs = NULL;
+    BlockDriverState *cow_bs;

    /* Read out options */
-    image_sectors = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512;
-    image_filename = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-
-    ret = bdrv_create_file(filename, opts, &local_err);
-    if (ret < 0) {
-        error_propagate(errp, local_err);
-        goto exit;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            image_sectors = options->value.n / 512;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
+            image_filename = options->value.s;
+        }
+        options++;
    }

+    ret = bdrv_create_file(filename, options, &local_err);
+    if (ret < 0) {
+        error_propagate(errp, local_err);
+        return ret;
+    }
+
+    cow_bs = NULL;
    ret = bdrv_open(&cow_bs, filename, NULL, NULL,
                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
-        goto exit;
+        return ret;
    }

    memset(&cow_header, 0, sizeof(cow_header));
@@ -381,29 +389,22 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp)
    }

 exit:
-    g_free(image_filename);
-    if (cow_bs) {
-        bdrv_unref(cow_bs);
-    }
+    bdrv_unref(cow_bs);
    return ret;
 }

-static QemuOptsList cow_create_opts = {
-    .name = "cow-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(cow_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FILE,
-            .type = QEMU_OPT_STRING,
-            .help = "File name of a base image"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter cow_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_BACKING_FILE,
+        .type = OPT_STRING,
+        .help = "File name of a base image"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_cow = {
@@ -415,13 +416,12 @@ static BlockDriver bdrv_cow = {
    .bdrv_close     = cow_close,
    .bdrv_create    = cow_create,
    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
-    .supports_backing       = true,

    .bdrv_read              = cow_co_read,
    .bdrv_write             = cow_co_write,
    .bdrv_co_get_block_status   = cow_co_get_block_status,

-    .create_opts    = &cow_create_opts,
+    .create_options = cow_create_options,
 };

 static void bdrv_cow_init(void)
--- a/block/curl.c
+++ b/block/curl.c
@@ -23,7 +23,6 @@
 */
 #include "qemu-common.h"
 #include "block/block_int.h"
-#include "qapi/qmp/qbool.h"
 #include <curl/curl.h>

 // #define DEBUG
@@ -38,21 +37,6 @@
 #if LIBCURL_VERSION_NUM >= 0x071000
 /* The multi interface timer callback was introduced in 7.16.0 */
 #define NEED_CURL_TIMER_CALLBACK
-#define HAVE_SOCKET_ACTION
-#endif
-
-#ifndef HAVE_SOCKET_ACTION
-/* If curl_multi_socket_action isn't available, define it statically here in
- * terms of curl_multi_socket. Note that ev_bitmask will be ignored, which is
- * less efficient but still safe. */
-static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
-                                            curl_socket_t sockfd,
-                                            int ev_bitmask,
-                                            int *running_handles)
-{
-    return curl_multi_socket(multi_handle, sockfd, running_handles);
-}
-#define curl_multi_socket_action __curl_multi_socket_action
 #endif

 #define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
@@ -62,16 +46,12 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
 #define SECTOR_SIZE     512
-#define READ_AHEAD_DEFAULT (256 * 1024)
+#define READ_AHEAD_SIZE (256 * 1024)

 #define FIND_RET_NONE   0
 #define FIND_RET_OK     1
 #define FIND_RET_WAIT   2

-#define CURL_BLOCK_OPT_URL       "url"
-#define CURL_BLOCK_OPT_READAHEAD "readahead"
-#define CURL_BLOCK_OPT_SSLVERIFY "sslverify"
-
 struct BDRVCURLState;

 typedef struct CURLAIOCB {
@@ -91,7 +71,6 @@ typedef struct CURLState
    struct BDRVCURLState *s;
    CURLAIOCB *acb[CURL_NUM_ACB];
    CURL *curl;
-    curl_socket_t sock_fd;
    char *orig_buf;
    size_t buf_start;
    size_t buf_off;
@@ -108,14 +87,11 @@ typedef struct BDRVCURLState {
    CURLState states[CURL_NUM_STATES];
    char *url;
    size_t readahead_size;
-    bool sslverify;
    bool accept_range;
-    AioContext *aio_context;
 } BDRVCURLState;

 static void curl_clean_state(CURLState *s);
 static void curl_multi_do(void *arg);
-static void curl_multi_read(void *arg);

 #ifdef NEED_CURL_TIMER_CALLBACK
 static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
@@ -135,29 +111,21 @@ static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
 #endif

 static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
-                        void *userp, void *sp)
+                        void *s, void *sp)
 {
-    BDRVCURLState *s;
-    CURLState *state = NULL;
-    curl_easy_getinfo(curl, CURLINFO_PRIVATE, (char **)&state);
-    state->sock_fd = fd;
-    s = state->s;
-
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            aio_set_fd_handler(s->aio_context, fd, curl_multi_read,
-                               NULL, state);
+            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, s);
            break;
        case CURL_POLL_OUT:
-            aio_set_fd_handler(s->aio_context, fd, NULL, curl_multi_do, state);
+            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, s);
            break;
        case CURL_POLL_INOUT:
-            aio_set_fd_handler(s->aio_context, fd, curl_multi_read,
-                               curl_multi_do, state);
+            qemu_aio_set_fd_handler(fd, curl_multi_do, curl_multi_do, s);
            break;
        case CURL_POLL_REMOVE:
-            aio_set_fd_handler(s->aio_context, fd, NULL, NULL, NULL);
+            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL);
            break;
    }

@@ -187,7 +155,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
    DPRINTF("CURL: Just reading %zd bytes\n", realsize);

    if (!s || !s->orig_buf)
-        return 0;
+        goto read_end;

    if (s->buf_off >= s->buf_len) {
        /* buffer full, read nothing */
@@ -212,6 +180,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
        }
    }

+read_end:
    return realsize;
 }

@@ -246,8 +215,7 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
        }

        // Wait for unfinished chunks
-        if (state->in_use &&
-            (start >= state->buf_start) &&
+        if ((start >= state->buf_start) &&
            (start <= buf_fend) &&
            (end >= state->buf_start) &&
            (end <= buf_fend))
@@ -269,69 +237,68 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
    return FIND_RET_NONE;
 }

-static void curl_multi_check_completion(BDRVCURLState *s)
+static void curl_multi_read(BDRVCURLState *s)
 {
    int msgs_in_queue;

    /* Try to find done transfers, so we can free the easy
     * handle again. */
-    for (;;) {
+    do {
        CURLMsg *msg;
        msg = curl_multi_info_read(s->multi, &msgs_in_queue);

-        /* Quit when there are no more completions */
        if (!msg)
            break;
-
-        if (msg->msg == CURLMSG_DONE) {
-            CURLState *state = NULL;
-            curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE,
-                              (char **)&state);
-
-            /* ACBs for successful messages get completed in curl_read_cb */
-            if (msg->data.result != CURLE_OK) {
-                int i;
-                for (i = 0; i < CURL_NUM_ACB; i++) {
-                    CURLAIOCB *acb = state->acb[i];
-
-                    if (acb == NULL) {
-                        continue;
-                    }
-
-                    acb->common.cb(acb->common.opaque, -EIO);
-                    qemu_aio_release(acb);
-                    state->acb[i] = NULL;
-                }
-            }
-
-            curl_clean_state(state);
+        if (msg->msg == CURLMSG_NONE)
            break;
+
+        switch (msg->msg) {
+            case CURLMSG_DONE:
+            {
+                CURLState *state = NULL;
+                curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, (char**)&state);
+
+                /* ACBs for successful messages get completed in curl_read_cb */
+                if (msg->data.result != CURLE_OK) {
+                    int i;
+                    for (i = 0; i < CURL_NUM_ACB; i++) {
+                        CURLAIOCB *acb = state->acb[i];
+
+                        if (acb == NULL) {
+                            continue;
+                        }
+
+                        acb->common.cb(acb->common.opaque, -EIO);
+                        qemu_aio_release(acb);
+                        state->acb[i] = NULL;
+                    }
+                }
+
+                curl_clean_state(state);
+                break;
+            }
+            default:
+                msgs_in_queue = 0;
+                break;
        }
-    }
+    } while(msgs_in_queue);
 }

 static void curl_multi_do(void *arg)
 {
-    CURLState *s = (CURLState *)arg;
+    BDRVCURLState *s = (BDRVCURLState *)arg;
    int running;
    int r;

-    if (!s->s->multi) {
+    if (!s->multi) {
        return;
    }

    do {
-        r = curl_multi_socket_action(s->s->multi, s->sock_fd, 0, &running);
+        r = curl_multi_socket_all(s->multi, &running);
    } while(r == CURLM_CALL_MULTI_PERFORM);

-}
-
-static void curl_multi_read(void *arg)
-{
-    CURLState *s = (CURLState *)arg;
-
-    curl_multi_do(arg);
-    curl_multi_check_completion(s->s);
+    curl_multi_read(s);
 }

 static void curl_multi_timeout_do(void *arg)
@@ -346,7 +313,7 @@ static void curl_multi_timeout_do(void *arg)

    curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);

-    curl_multi_check_completion(s);
+    curl_multi_read(s);
 #else
    abort();
 #endif
@@ -370,44 +337,44 @@ static CURLState *curl_init_state(BDRVCURLState *s)
            break;
        }
        if (!state) {
-            aio_poll(state->s->aio_context, true);
+            g_usleep(100);
+            curl_multi_do(s);
        }
    } while(!state);

-    if (!state->curl) {
-        state->curl = curl_easy_init();
-        if (!state->curl) {
-            return NULL;
-        }
-        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
-                         (long) s->sslverify);
-        curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, 5);
-        curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION,
-                         (void *)curl_read_cb);
-        curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
-        curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
-        curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
-        curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
-        curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
-        curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
-        curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
+    if (state->curl)
+        goto has_curl;

-        /* Restrict supported protocols to avoid security issues in the more
-         * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
-         * CVE-2013-0249.
-         *
-         * Restricting protocols is only supported from 7.19.4 upwards.
-         */
+    state->curl = curl_easy_init();
+    if (!state->curl)
+        return NULL;
+    curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
+    curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, 5);
+    curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION, (void *)curl_read_cb);
+    curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state);
+    curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state);
+    curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1);
+    curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
+    curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
+    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
+    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
+
+    /* Restrict supported protocols to avoid security issues in the more
+     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
+     * CVE-2013-0249.
+     *
+     * Restricting protocols is only supported from 7.19.4 upwards.
+     */
 #if LIBCURL_VERSION_NUM >= 0x071304
-        curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-        curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
+    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
+    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
 #endif

 #ifdef DEBUG_VERBOSE
-        curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
+    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
-    }
+
+has_curl:

    state->s = s;

@@ -424,50 +391,43 @@ static void curl_clean_state(CURLState *s)
 static void curl_parse_filename(const char *filename, QDict *options,
                                Error **errp)
 {
-    qdict_put(options, CURL_BLOCK_OPT_URL, qstring_from_str(filename));
-}

-static void curl_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVCURLState *s = bs->opaque;
-    int i;
+    #define RA_OPTSTR ":readahead="
+    char *file;
+    char *ra;
+    const char *ra_val;
+    int parse_state = 0;

-    for (i = 0; i < CURL_NUM_STATES; i++) {
-        if (s->states[i].in_use) {
-            curl_clean_state(&s->states[i]);
+    file = g_strdup(filename);
+
+    /* Parse a trailing ":readahead=#:" param, if present. */
+    ra = file + strlen(file) - 1;
+    while (ra >= file) {
+        if (parse_state == 0) {
+            if (*ra == ':') {
+                parse_state++;
+            } else {
+                break;
+            }
+        } else if (parse_state == 1) {
+            if (*ra > '9' || *ra < '0') {
+                char *opt_start = ra - strlen(RA_OPTSTR) + 1;
+                if (opt_start > file &&
+                    strncmp(opt_start, RA_OPTSTR, strlen(RA_OPTSTR)) == 0) {
+                    ra_val = ra + 1;
+                    ra -= strlen(RA_OPTSTR) - 1;
+                    *ra = '\0';
+                    qdict_put(options, "readahead", qstring_from_str(ra_val));
+                }
+                break;
+            }
        }
-        if (s->states[i].curl) {
-            curl_easy_cleanup(s->states[i].curl);
-            s->states[i].curl = NULL;
-        }
-        g_free(s->states[i].orig_buf);
-        s->states[i].orig_buf = NULL;
-    }
-    if (s->multi) {
-        curl_multi_cleanup(s->multi);
-        s->multi = NULL;
+        ra--;
    }

-    timer_del(&s->timer);
-}
+    qdict_put(options, "url", qstring_from_str(file));

-static void curl_attach_aio_context(BlockDriverState *bs,
-                                    AioContext *new_context)
-{
-    BDRVCURLState *s = bs->opaque;
-
-    aio_timer_init(new_context, &s->timer,
-                   QEMU_CLOCK_REALTIME, SCALE_NS,
-                   curl_multi_timeout_do, s);
-
-    assert(!s->multi);
-    s->multi = curl_multi_init();
-    s->aio_context = new_context;
-    curl_multi_setopt(s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb);
-#ifdef NEED_CURL_TIMER_CALLBACK
-    curl_multi_setopt(s->multi, CURLMOPT_TIMERDATA, s);
-    curl_multi_setopt(s->multi, CURLMOPT_TIMERFUNCTION, curl_timer_cb);
-#endif
+    g_free(file);
 }

 static QemuOptsList runtime_opts = {
@@ -475,20 +435,15 @@ static QemuOptsList runtime_opts = {
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
    .desc = {
        {
-            .name = CURL_BLOCK_OPT_URL,
+            .name = "url",
            .type = QEMU_OPT_STRING,
            .help = "URL to open",
        },
        {
-            .name = CURL_BLOCK_OPT_READAHEAD,
+            .name = "readahead",
            .type = QEMU_OPT_SIZE,
            .help = "Readahead size",
        },
-        {
-            .name = CURL_BLOCK_OPT_SSLVERIFY,
-            .type = QEMU_OPT_BOOL,
-            .help = "Verify SSL certificate"
-        },
        { /* end of list */ }
    },
 };
@@ -517,17 +472,14 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
        goto out_noclean;
    }

-    s->readahead_size = qemu_opt_get_size(opts, CURL_BLOCK_OPT_READAHEAD,
-                                          READ_AHEAD_DEFAULT);
+    s->readahead_size = qemu_opt_get_size(opts, "readahead", READ_AHEAD_SIZE);
    if ((s->readahead_size & 0x1ff) != 0) {
        error_setg(errp, "HTTP_READAHEAD_SIZE %zd is not a multiple of 512",
                   s->readahead_size);
        goto out_noclean;
    }

-    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY, true);
-
-    file = qemu_opt_get(opts, CURL_BLOCK_OPT_URL);
+    file = qemu_opt_get(opts, "url");
    if (file == NULL) {
        error_setg(errp, "curl block driver requires an 'url' option");
        goto out_noclean;
@@ -539,7 +491,6 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    DPRINTF("CURL: Opening %s\n", file);
-    s->aio_context = bdrv_get_aio_context(bs);
    s->url = g_strdup(file);
    state = curl_init_state(s);
    if (!state)
@@ -572,13 +523,27 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    curl_easy_cleanup(state->curl);
    state->curl = NULL;

-    curl_attach_aio_context(bs, bdrv_get_aio_context(bs));
+    aio_timer_init(bdrv_get_aio_context(bs), &s->timer,
+                   QEMU_CLOCK_REALTIME, SCALE_NS,
+                   curl_multi_timeout_do, s);
+
+    // Now we know the file exists and its size, so let's
+    // initialize the multi interface!
+
+    s->multi = curl_multi_init();
+    curl_multi_setopt(s->multi, CURLMOPT_SOCKETDATA, s);
+    curl_multi_setopt(s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb);
+#ifdef NEED_CURL_TIMER_CALLBACK
+    curl_multi_setopt(s->multi, CURLMOPT_TIMERDATA, s);
+    curl_multi_setopt(s->multi, CURLMOPT_TIMERFUNCTION, curl_timer_cb);
+#endif
+    curl_multi_do(s);

    qemu_opts_del(opts);
    return 0;

 out:
-    error_setg(errp, "CURL: Error opening file: %s", state->errmsg);
+    fprintf(stderr, "CURL: Error opening file: %s\n", state->errmsg);
    curl_easy_cleanup(state->curl);
    state->curl = NULL;
 out_noclean:
@@ -601,7 +566,6 @@ static const AIOCBInfo curl_aiocb_info = {
 static void curl_readv_bh_cb(void *p)
 {
    CURLState *state;
-    int running;

    CURLAIOCB *acb = p;
    BDRVCURLState *s = acb->common.bs->opaque;
@@ -636,7 +600,8 @@ static void curl_readv_bh_cb(void *p)
    acb->end = (acb->nb_sectors * SECTOR_SIZE);

    state->buf_off = 0;
-    g_free(state->orig_buf);
+    if (state->orig_buf)
+        g_free(state->orig_buf);
    state->buf_start = start;
    state->buf_len = acb->end + s->readahead_size;
    end = MIN(start + state->buf_len, s->len) - 1;
@@ -649,9 +614,8 @@ static void curl_readv_bh_cb(void *p)
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
+    curl_multi_do(s);

-    /* Tell curl it needs to kick things off */
-    curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
 }

 static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
@@ -666,7 +630,7 @@ static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
    acb->sector_num = sector_num;
    acb->nb_sectors = nb_sectors;

-    acb->bh = aio_bh_new(bdrv_get_aio_context(bs), curl_readv_bh_cb, acb);
+    acb->bh = qemu_bh_new(curl_readv_bh_cb, acb);
    qemu_bh_schedule(acb->bh);
    return &acb->common;
 }
@@ -674,9 +638,25 @@ static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
 static void curl_close(BlockDriverState *bs)
 {
    BDRVCURLState *s = bs->opaque;
+    int i;

    DPRINTF("CURL: Close\n");
-    curl_detach_aio_context(bs);
+    for (i=0; i<CURL_NUM_STATES; i++) {
+        if (s->states[i].in_use)
+            curl_clean_state(&s->states[i]);
+        if (s->states[i].curl) {
+            curl_easy_cleanup(s->states[i].curl);
+            s->states[i].curl = NULL;
+        }
+        if (s->states[i].orig_buf) {
+            g_free(s->states[i].orig_buf);
+            s->states[i].orig_buf = NULL;
+        }
+    }
+    if (s->multi)
+        curl_multi_cleanup(s->multi);
+
+    timer_del(&s->timer);

    g_free(s->url);
 }
@@ -688,83 +668,68 @@ static int64_t curl_getlength(BlockDriverState *bs)
 }

 static BlockDriver bdrv_http = {
-    .format_name                = "http",
-    .protocol_name              = "http",
+    .format_name            = "http",
+    .protocol_name          = "http",

-    .instance_size              = sizeof(BDRVCURLState),
-    .bdrv_parse_filename        = curl_parse_filename,
-    .bdrv_file_open             = curl_open,
-    .bdrv_close                 = curl_close,
-    .bdrv_getlength             = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,

-    .bdrv_aio_readv             = curl_aio_readv,
-
-    .bdrv_detach_aio_context    = curl_detach_aio_context,
-    .bdrv_attach_aio_context    = curl_attach_aio_context,
+    .bdrv_aio_readv         = curl_aio_readv,
 };

 static BlockDriver bdrv_https = {
-    .format_name                = "https",
-    .protocol_name              = "https",
+    .format_name            = "https",
+    .protocol_name          = "https",

-    .instance_size              = sizeof(BDRVCURLState),
-    .bdrv_parse_filename        = curl_parse_filename,
-    .bdrv_file_open             = curl_open,
-    .bdrv_close                 = curl_close,
-    .bdrv_getlength             = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,

-    .bdrv_aio_readv             = curl_aio_readv,
-
-    .bdrv_detach_aio_context    = curl_detach_aio_context,
-    .bdrv_attach_aio_context    = curl_attach_aio_context,
+    .bdrv_aio_readv         = curl_aio_readv,
 };

 static BlockDriver bdrv_ftp = {
-    .format_name                = "ftp",
-    .protocol_name              = "ftp",
+    .format_name            = "ftp",
+    .protocol_name          = "ftp",

-    .instance_size              = sizeof(BDRVCURLState),
-    .bdrv_parse_filename        = curl_parse_filename,
-    .bdrv_file_open             = curl_open,
-    .bdrv_close                 = curl_close,
-    .bdrv_getlength             = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,

-    .bdrv_aio_readv             = curl_aio_readv,
-
-    .bdrv_detach_aio_context    = curl_detach_aio_context,
-    .bdrv_attach_aio_context    = curl_attach_aio_context,
+    .bdrv_aio_readv         = curl_aio_readv,
 };

 static BlockDriver bdrv_ftps = {
-    .format_name                = "ftps",
-    .protocol_name              = "ftps",
+    .format_name            = "ftps",
+    .protocol_name          = "ftps",

-    .instance_size              = sizeof(BDRVCURLState),
-    .bdrv_parse_filename        = curl_parse_filename,
-    .bdrv_file_open             = curl_open,
-    .bdrv_close                 = curl_close,
-    .bdrv_getlength             = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,

-    .bdrv_aio_readv             = curl_aio_readv,
-
-    .bdrv_detach_aio_context    = curl_detach_aio_context,
-    .bdrv_attach_aio_context    = curl_attach_aio_context,
+    .bdrv_aio_readv         = curl_aio_readv,
 };

 static BlockDriver bdrv_tftp = {
-    .format_name                = "tftp",
-    .protocol_name              = "tftp",
+    .format_name            = "tftp",
+    .protocol_name          = "tftp",

-    .instance_size              = sizeof(BDRVCURLState),
-    .bdrv_parse_filename        = curl_parse_filename,
-    .bdrv_file_open             = curl_open,
-    .bdrv_close                 = curl_close,
-    .bdrv_getlength             = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,

-    .bdrv_aio_readv             = curl_aio_readv,
-
-    .bdrv_detach_aio_context    = curl_detach_aio_context,
-    .bdrv_attach_aio_context    = curl_attach_aio_context,
+    .bdrv_aio_readv         = curl_aio_readv,
 };

 static void curl_block_init(void)
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -248,8 +248,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
                offset += 8;

                if (s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
-                    error_report("sector count %" PRIu64 " for chunk %" PRIu32
-                                 " is larger than max (%u)",
+                    error_report("sector count %" PRIu64 " for chunk %u is "
+                                 "larger than max (%u)",
                                 s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
                    ret = -EINVAL;
                    goto fail;
@@ -269,8 +269,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
                offset += 8;

                if (s->lengths[i] > DMG_LENGTHS_MAX) {
-                    error_report("length %" PRIu64 " for chunk %" PRIu32
-                                 " is larger than max (%u)",
+                    error_report("length %" PRIu64 " for chunk %u is larger "
+                                 "than max (%u)",
                                 s->lengths[i], i, DMG_LENGTHS_MAX);
                    ret = -EINVAL;
                    goto fail;
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -16,7 +16,6 @@ typedef struct GlusterAIOCB {
    int ret;
    QEMUBH *bh;
    Coroutine *coroutine;
-    AioContext *aio_context;
 } GlusterAIOCB;

 typedef struct BDRVGlusterState {
@@ -208,11 +207,6 @@ static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename,
                         "volume=%s image=%s transport=%s", gconf->server,
                         gconf->port, gconf->volname, gconf->image,
                         gconf->transport);
-
-        /* glfs_init sometimes doesn't set errno although docs suggest that */
-        if (errno == 0)
-            errno = EINVAL;
-
        goto out;
    }
    return glfs;
@@ -250,7 +244,7 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
        acb->ret = -EIO; /* Partial read/write - fail it */
    }

-    acb->bh = aio_bh_new(acb->aio_context, qemu_gluster_complete_aio, acb);
+    acb->bh = qemu_bh_new(qemu_gluster_complete_aio, acb);
    qemu_bh_schedule(acb->bh);
 }

@@ -437,7 +431,6 @@ static coroutine_fn int qemu_gluster_co_write_zeroes(BlockDriverState *bs,
    acb->size = size;
    acb->ret = 0;
    acb->coroutine = qemu_coroutine_self();
-    acb->aio_context = bdrv_get_aio_context(bs);

    ret = glfs_zerofill_async(s->fd, offset, size, &gluster_finish_aiocb, acb);
    if (ret < 0) {
@@ -478,37 +471,39 @@ static inline int qemu_gluster_zerofill(struct glfs_fd *fd, int64_t offset,
 #endif

 static int qemu_gluster_create(const char *filename,
-                               QemuOpts *opts, Error **errp)
+        QEMUOptionParameter *options, Error **errp)
 {
    struct glfs *glfs;
    struct glfs_fd *fd;
    int ret = 0;
    int prealloc = 0;
    int64_t total_size = 0;
-    char *tmp = NULL;
    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));

    glfs = qemu_gluster_init(gconf, filename, errp);
    if (!glfs) {
-        ret = -errno;
+        ret = -EINVAL;
        goto out;
    }

-    total_size =
-        qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / BDRV_SECTOR_SIZE;
-
-    tmp = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
-    if (!tmp || !strcmp(tmp, "off")) {
-        prealloc = 0;
-    } else if (!strcmp(tmp, "full") &&
-               gluster_supports_zerofill()) {
-        prealloc = 1;
-    } else {
-        error_setg(errp, "Invalid preallocation mode: '%s'"
-            " or GlusterFS doesn't support zerofill API",
-            tmp);
-        ret = -EINVAL;
-        goto out;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n / BDRV_SECTOR_SIZE;
+        } else if (!strcmp(options->name, BLOCK_OPT_PREALLOC)) {
+            if (!options->value.s || !strcmp(options->value.s, "off")) {
+                prealloc = 0;
+            } else if (!strcmp(options->value.s, "full") &&
+                    gluster_supports_zerofill()) {
+                prealloc = 1;
+            } else {
+                error_setg(errp, "Invalid preallocation mode: '%s'"
+                    " or GlusterFS doesn't support zerofill API",
+                           options->value.s);
+                ret = -EINVAL;
+                goto out;
+            }
+        }
+        options++;
    }

    fd = glfs_creat(glfs, gconf->image,
@@ -530,7 +525,6 @@ static int qemu_gluster_create(const char *filename,
        }
    }
 out:
-    g_free(tmp);
    qemu_gluster_gconf_free(gconf);
    if (glfs) {
        glfs_fini(glfs);
@@ -550,7 +544,6 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
    acb->size = size;
    acb->ret = 0;
    acb->coroutine = qemu_coroutine_self();
-    acb->aio_context = bdrv_get_aio_context(bs);

    if (write) {
        ret = glfs_pwritev_async(s->fd, qiov->iov, qiov->niov, offset, 0,
@@ -607,7 +600,6 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
    acb->size = 0;
    acb->ret = 0;
    acb->coroutine = qemu_coroutine_self();
-    acb->aio_context = bdrv_get_aio_context(bs);

    ret = glfs_fsync_async(s->fd, &gluster_finish_aiocb, acb);
    if (ret < 0) {
@@ -636,7 +628,6 @@ static coroutine_fn int qemu_gluster_co_discard(BlockDriverState *bs,
    acb->size = 0;
    acb->ret = 0;
    acb->coroutine = qemu_coroutine_self();
-    acb->aio_context = bdrv_get_aio_context(bs);

    ret = glfs_discard_async(s->fd, offset, size, &gluster_finish_aiocb, acb);
    if (ret < 0) {
@@ -697,22 +688,18 @@ static int qemu_gluster_has_zero_init(BlockDriverState *bs)
    return 0;
 }

-static QemuOptsList qemu_gluster_create_opts = {
-    .name = "qemu-gluster-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(qemu_gluster_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_PREALLOC,
-            .type = QEMU_OPT_STRING,
-            .help = "Preallocation mode (allowed values: off, full)"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter qemu_gluster_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_PREALLOC,
+        .type = OPT_STRING,
+        .help = "Preallocation mode (allowed values: off, full)"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_gluster = {
@@ -739,7 +726,7 @@ static BlockDriver bdrv_gluster = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_write_zeroes         = qemu_gluster_co_write_zeroes,
 #endif
-    .create_opts                  = &qemu_gluster_create_opts,
+    .create_options               = qemu_gluster_create_options,
 };

 static BlockDriver bdrv_gluster_tcp = {
@@ -766,7 +753,7 @@ static BlockDriver bdrv_gluster_tcp = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_write_zeroes         = qemu_gluster_co_write_zeroes,
 #endif
-    .create_opts                  = &qemu_gluster_create_opts,
+    .create_options               = qemu_gluster_create_options,
 };

 static BlockDriver bdrv_gluster_unix = {
@@ -793,7 +780,7 @@ static BlockDriver bdrv_gluster_unix = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_write_zeroes         = qemu_gluster_co_write_zeroes,
 #endif
-    .create_opts                  = &qemu_gluster_create_opts,
+    .create_options               = qemu_gluster_create_options,
 };

 static BlockDriver bdrv_gluster_rdma = {
@@ -820,7 +807,7 @@ static BlockDriver bdrv_gluster_rdma = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_write_zeroes         = qemu_gluster_co_write_zeroes,
 #endif
-    .create_opts                  = &qemu_gluster_create_opts,
+    .create_options               = qemu_gluster_create_options,
 };

 static void bdrv_gluster_init(void)
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -2,7 +2,7 @@
 * QEMU Block driver for iSCSI images
 *
 * Copyright (c) 2010-2011 Ronnie Sahlberg <ronniesahlberg@gmail.com>
- * Copyright (c) 2012-2014 Peter Lieven <pl@kamp.de>
+ * Copyright (c) 2012-2013 Peter Lieven <pl@kamp.de>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -26,13 +26,10 @@
 #include "config-host.h"

 #include <poll.h>
-#include <math.h>
 #include <arpa/inet.h>
 #include "qemu-common.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
-#include "qemu/bitops.h"
-#include "qemu/bitmap.h"
 #include "block/block_int.h"
 #include "trace.h"
 #include "block/scsi.h"
@@ -50,7 +47,6 @@

 typedef struct IscsiLun {
    struct iscsi_context *iscsi;
-    AioContext *aio_context;
    int lun;
    enum scsi_inquiry_peripheral_device_type type;
    int block_size;
@@ -63,9 +59,6 @@ typedef struct IscsiLun {
    struct scsi_inquiry_logical_block_provisioning lbp;
    struct scsi_inquiry_block_limits bl;
    unsigned char *zeroblock;
-    unsigned long *allocationmap;
-    int cluster_sectors;
-    bool use_16_for_rw;
 } IscsiLun;

 typedef struct IscsiTask {
@@ -76,8 +69,6 @@ typedef struct IscsiTask {
    struct scsi_task *task;
    Coroutine *co;
    QEMUBH *bh;
-    IscsiLun *iscsilun;
-    QEMUTimer retry_timer;
 } IscsiTask;

 typedef struct IscsiAIOCB {
@@ -89,6 +80,7 @@ typedef struct IscsiAIOCB {
    uint8_t *buf;
    int status;
    int canceled;
+    int retries;
    int64_t sector_num;
    int nb_sectors;
 #ifdef __linux__
@@ -98,17 +90,7 @@ typedef struct IscsiAIOCB {

 #define NOP_INTERVAL 5000
 #define MAX_NOP_FAILURES 3
-#define ISCSI_CMD_RETRIES ARRAY_SIZE(iscsi_retry_times)
-static const unsigned iscsi_retry_times[] = {8, 32, 128, 512, 2048};
-
-/* this threshold is a trade-off knob to choose between
- * the potential additional overhead of an extra GET_LBA_STATUS request
- * vs. unnecessarily reading a lot of zero sectors over the wire.
- * If a read request is greater or equal than ISCSI_CHECKALLOC_THRES
- * sectors we check the allocation status of the area covered by the
- * request first if the allocationmap indicates that the area might be
- * unallocated. */
-#define ISCSI_CHECKALLOC_THRES 64
+#define ISCSI_CMD_RETRIES 5

 static void
 iscsi_bh_cb(void *p)
@@ -138,32 +120,17 @@ iscsi_schedule_bh(IscsiAIOCB *acb)
    if (acb->bh) {
        return;
    }
-    acb->bh = aio_bh_new(acb->iscsilun->aio_context, iscsi_bh_cb, acb);
+    acb->bh = qemu_bh_new(iscsi_bh_cb, acb);
    qemu_bh_schedule(acb->bh);
 }

 static void iscsi_co_generic_bh_cb(void *opaque)
 {
    struct IscsiTask *iTask = opaque;
-    iTask->complete = 1;
    qemu_bh_delete(iTask->bh);
    qemu_coroutine_enter(iTask->co, NULL);
 }

-static void iscsi_retry_timer_expired(void *opaque)
-{
-    struct IscsiTask *iTask = opaque;
-    iTask->complete = 1;
-    if (iTask->co) {
-        qemu_coroutine_enter(iTask->co, NULL);
-    }
-}
-
-static inline unsigned exp_random(double mean)
-{
-    return -mean * log((double)rand() / RAND_MAX);
-}
-
 static void
 iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
                        void *command_data, void *opaque)
@@ -171,44 +138,26 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
    struct IscsiTask *iTask = opaque;
    struct scsi_task *task = command_data;

+    iTask->complete = 1;
    iTask->status = status;
    iTask->do_retry = 0;
    iTask->task = task;

+    if (iTask->retries-- > 0 && status == SCSI_STATUS_CHECK_CONDITION
+        && task->sense.key == SCSI_SENSE_UNIT_ATTENTION) {
+        error_report("iSCSI CheckCondition: %s", iscsi_get_error(iscsi));
+        iTask->do_retry = 1;
+        goto out;
+    }
+
    if (status != SCSI_STATUS_GOOD) {
-        if (iTask->retries++ < ISCSI_CMD_RETRIES) {
-            if (status == SCSI_STATUS_CHECK_CONDITION
-                && task->sense.key == SCSI_SENSE_UNIT_ATTENTION) {
-                error_report("iSCSI CheckCondition: %s",
-                             iscsi_get_error(iscsi));
-                iTask->do_retry = 1;
-                goto out;
-            }
-            if (status == SCSI_STATUS_BUSY) {
-                unsigned retry_time =
-                    exp_random(iscsi_retry_times[iTask->retries - 1]);
-                error_report("iSCSI Busy (retry #%u in %u ms): %s",
-                             iTask->retries, retry_time,
-                             iscsi_get_error(iscsi));
-                aio_timer_init(iTask->iscsilun->aio_context,
-                               &iTask->retry_timer, QEMU_CLOCK_REALTIME,
-                               SCALE_MS, iscsi_retry_timer_expired, iTask);
-                timer_mod(&iTask->retry_timer,
-                          qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + retry_time);
-                iTask->do_retry = 1;
-                return;
-            }
-        }
        error_report("iSCSI Failure: %s", iscsi_get_error(iscsi));
    }

 out:
    if (iTask->co) {
-        iTask->bh = aio_bh_new(iTask->iscsilun->aio_context,
-                               iscsi_co_generic_bh_cb, iTask);
+        iTask->bh = qemu_bh_new(iscsi_co_generic_bh_cb, iTask);
        qemu_bh_schedule(iTask->bh);
-    } else {
-        iTask->complete = 1;
    }
 }

@@ -216,7 +165,7 @@ static void iscsi_co_init_iscsitask(IscsiLun *iscsilun, struct IscsiTask *iTask)
 {
    *iTask = (struct IscsiTask) {
        .co         = qemu_coroutine_self(),
-        .iscsilun   = iscsilun,
+        .retries    = ISCSI_CMD_RETRIES,
    };
 }

@@ -247,7 +196,7 @@ iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
                                     iscsi_abort_task_cb, acb);

    while (acb->status == -EINPROGRESS) {
-        aio_poll(iscsilun->aio_context, true);
+        qemu_aio_wait();
    }
 }

@@ -270,11 +219,10 @@ iscsi_set_events(IscsiLun *iscsilun)
    ev = POLLIN;
    ev |= iscsi_which_events(iscsi);
    if (ev != iscsilun->events) {
-        aio_set_fd_handler(iscsilun->aio_context,
-                           iscsi_get_fd(iscsi),
-                           iscsi_process_read,
-                           (ev & POLLOUT) ? iscsi_process_write : NULL,
-                           iscsilun);
+        qemu_aio_set_fd_handler(iscsi_get_fd(iscsi),
+                      iscsi_process_read,
+                      (ev & POLLOUT) ? iscsi_process_write : NULL,
+                      iscsilun);

    }

@@ -325,32 +273,6 @@ static bool is_request_lun_aligned(int64_t sector_num, int nb_sectors,
    return 1;
 }

-static void iscsi_allocationmap_set(IscsiLun *iscsilun, int64_t sector_num,
-                                    int nb_sectors)
-{
-    if (iscsilun->allocationmap == NULL) {
-        return;
-    }
-    bitmap_set(iscsilun->allocationmap,
-               sector_num / iscsilun->cluster_sectors,
-               DIV_ROUND_UP(nb_sectors, iscsilun->cluster_sectors));
-}
-
-static void iscsi_allocationmap_clear(IscsiLun *iscsilun, int64_t sector_num,
-                                      int nb_sectors)
-{
-    int64_t cluster_num, nb_clusters;
-    if (iscsilun->allocationmap == NULL) {
-        return;
-    }
-    cluster_num = DIV_ROUND_UP(sector_num, iscsilun->cluster_sectors);
-    nb_clusters = (sector_num + nb_sectors) / iscsilun->cluster_sectors
-                  - cluster_num;
-    if (nb_clusters > 0) {
-        bitmap_clear(iscsilun->allocationmap, cluster_num, nb_clusters);
-    }
-}
-
 static int coroutine_fn iscsi_co_writev(BlockDriverState *bs,
                                        int64_t sector_num, int nb_sectors,
                                        QEMUIOVector *iov)
@@ -359,6 +281,8 @@ static int coroutine_fn iscsi_co_writev(BlockDriverState *bs,
    struct IscsiTask iTask;
    uint64_t lba;
    uint32_t num_sectors;
+    uint8_t *data = NULL;
+    uint8_t *buf = NULL;

    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
        return -EINVAL;
@@ -366,24 +290,31 @@ static int coroutine_fn iscsi_co_writev(BlockDriverState *bs,

    lba = sector_qemu2lun(sector_num, iscsilun);
    num_sectors = sector_qemu2lun(nb_sectors, iscsilun);
+#if !defined(LIBISCSI_FEATURE_IOVECTOR)
+    /* if the iovec only contains one buffer we can pass it directly */
+    if (iov->niov == 1) {
+        data = iov->iov[0].iov_base;
+    } else {
+        size_t size = MIN(nb_sectors * BDRV_SECTOR_SIZE, iov->size);
+        buf = g_malloc(size);
+        qemu_iovec_to_buf(iov, 0, buf, size);
+        data = buf;
+    }
+#endif
    iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
-    if (iscsilun->use_16_for_rw) {
-        iTask.task = iscsi_write16_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                        NULL, num_sectors * iscsilun->block_size,
-                                        iscsilun->block_size, 0, 0, 0, 0, 0,
-                                        iscsi_co_generic_cb, &iTask);
-    } else {
-        iTask.task = iscsi_write10_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                        NULL, num_sectors * iscsilun->block_size,
-                                        iscsilun->block_size, 0, 0, 0, 0, 0,
-                                        iscsi_co_generic_cb, &iTask);
-    }
+    iTask.task = iscsi_write16_task(iscsilun->iscsi, iscsilun->lun, lba,
+                                    data, num_sectors * iscsilun->block_size,
+                                    iscsilun->block_size, 0, 0, 0, 0, 0,
+                                    iscsi_co_generic_cb, &iTask);
    if (iTask.task == NULL) {
+        g_free(buf);
        return -ENOMEM;
    }
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
    scsi_task_set_iov_out(iTask.task, (struct scsi_iovec *) iov->iov,
                          iov->niov);
+#endif
    while (!iTask.complete) {
        iscsi_set_events(iscsilun);
        qemu_coroutine_yield();
@@ -399,125 +330,15 @@ retry:
        goto retry;
    }

+    g_free(buf);
+
    if (iTask.status != SCSI_STATUS_GOOD) {
        return -EIO;
    }

-    iscsi_allocationmap_set(iscsilun, sector_num, nb_sectors);
-
    return 0;
 }

-
-static bool iscsi_allocationmap_is_allocated(IscsiLun *iscsilun,
-                                             int64_t sector_num, int nb_sectors)
-{
-    unsigned long size;
-    if (iscsilun->allocationmap == NULL) {
-        return true;
-    }
-    size = DIV_ROUND_UP(sector_num + nb_sectors, iscsilun->cluster_sectors);
-    return !(find_next_bit(iscsilun->allocationmap, size,
-                           sector_num / iscsilun->cluster_sectors) == size);
-}
-
-static int64_t coroutine_fn iscsi_co_get_block_status(BlockDriverState *bs,
-                                                  int64_t sector_num,
-                                                  int nb_sectors, int *pnum)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct scsi_get_lba_status *lbas = NULL;
-    struct scsi_lba_status_descriptor *lbasd = NULL;
-    struct IscsiTask iTask;
-    int64_t ret;
-
-    iscsi_co_init_iscsitask(iscsilun, &iTask);
-
-    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    /* default to all sectors allocated */
-    ret = BDRV_BLOCK_DATA;
-    ret |= (sector_num << BDRV_SECTOR_BITS) | BDRV_BLOCK_OFFSET_VALID;
-    *pnum = nb_sectors;
-
-    /* LUN does not support logical block provisioning */
-    if (iscsilun->lbpme == 0) {
-        goto out;
-    }
-
-retry:
-    if (iscsi_get_lba_status_task(iscsilun->iscsi, iscsilun->lun,
-                                  sector_qemu2lun(sector_num, iscsilun),
-                                  8 + 16, iscsi_co_generic_cb,
-                                  &iTask) == NULL) {
-        ret = -ENOMEM;
-        goto out;
-    }
-
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_coroutine_yield();
-    }
-
-    if (iTask.do_retry) {
-        if (iTask.task != NULL) {
-            scsi_free_scsi_task(iTask.task);
-            iTask.task = NULL;
-        }
-        iTask.complete = 0;
-        goto retry;
-    }
-
-    if (iTask.status != SCSI_STATUS_GOOD) {
-        /* in case the get_lba_status_callout fails (i.e.
-         * because the device is busy or the cmd is not
-         * supported) we pretend all blocks are allocated
-         * for backwards compatibility */
-        goto out;
-    }
-
-    lbas = scsi_datain_unmarshall(iTask.task);
-    if (lbas == NULL) {
-        ret = -EIO;
-        goto out;
-    }
-
-    lbasd = &lbas->descriptors[0];
-
-    if (sector_qemu2lun(sector_num, iscsilun) != lbasd->lba) {
-        ret = -EIO;
-        goto out;
-    }
-
-    *pnum = sector_lun2qemu(lbasd->num_blocks, iscsilun);
-
-    if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED ||
-        lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
-        ret &= ~BDRV_BLOCK_DATA;
-        if (iscsilun->lbprz) {
-            ret |= BDRV_BLOCK_ZERO;
-        }
-    }
-
-    if (ret & BDRV_BLOCK_ZERO) {
-        iscsi_allocationmap_clear(iscsilun, sector_num, *pnum);
-    } else {
-        iscsi_allocationmap_set(iscsilun, sector_num, *pnum);
-    }
-
-    if (*pnum > nb_sectors) {
-        *pnum = nb_sectors;
-    }
-out:
-    if (iTask.task != NULL) {
-        scsi_free_scsi_task(iTask.task);
-    }
-    return ret;
-}
-
 static int coroutine_fn iscsi_co_readv(BlockDriverState *bs,
                                       int64_t sector_num, int nb_sectors,
                                       QEMUIOVector *iov)
@@ -526,46 +347,48 @@ static int coroutine_fn iscsi_co_readv(BlockDriverState *bs,
    struct IscsiTask iTask;
    uint64_t lba;
    uint32_t num_sectors;
+#if !defined(LIBISCSI_FEATURE_IOVECTOR)
+    int i;
+#endif

    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
        return -EINVAL;
    }

-    if (iscsilun->lbprz && nb_sectors >= ISCSI_CHECKALLOC_THRES &&
-        !iscsi_allocationmap_is_allocated(iscsilun, sector_num, nb_sectors)) {
-        int64_t ret;
-        int pnum;
-        ret = iscsi_co_get_block_status(bs, sector_num, INT_MAX, &pnum);
-        if (ret < 0) {
-            return ret;
-        }
-        if (ret & BDRV_BLOCK_ZERO && pnum >= nb_sectors) {
-            qemu_iovec_memset(iov, 0, 0x00, iov->size);
-            return 0;
-        }
-    }
-
    lba = sector_qemu2lun(sector_num, iscsilun);
    num_sectors = sector_qemu2lun(nb_sectors, iscsilun);

    iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
-    if (iscsilun->use_16_for_rw) {
+    switch (iscsilun->type) {
+    case TYPE_DISK:
        iTask.task = iscsi_read16_task(iscsilun->iscsi, iscsilun->lun, lba,
                                       num_sectors * iscsilun->block_size,
                                       iscsilun->block_size, 0, 0, 0, 0, 0,
                                       iscsi_co_generic_cb, &iTask);
-    } else {
+        break;
+    default:
        iTask.task = iscsi_read10_task(iscsilun->iscsi, iscsilun->lun, lba,
                                       num_sectors * iscsilun->block_size,
                                       iscsilun->block_size,
+#if !defined(CONFIG_LIBISCSI_1_4) /* API change from 1.4.0 to 1.5.0 */
                                       0, 0, 0, 0, 0,
+#endif
                                       iscsi_co_generic_cb, &iTask);
+        break;
    }
    if (iTask.task == NULL) {
        return -ENOMEM;
    }
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
    scsi_task_set_iov_in(iTask.task, (struct scsi_iovec *) iov->iov, iov->niov);
+#else
+    for (i = 0; i < iov->niov; i++) {
+        scsi_task_add_data_in_buffer(iTask.task,
+                                     iov->iov[i].iov_len,
+                                     iov->iov[i].iov_base);
+    }
+#endif

    while (!iTask.complete) {
        iscsi_set_events(iscsilun);
@@ -720,9 +543,18 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
            data.data = acb->ioh->dxferp;
            data.size = acb->ioh->dxfer_len;
        } else {
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
            scsi_task_set_iov_out(acb->task,
                                 (struct scsi_iovec *) acb->ioh->dxferp,
                                 acb->ioh->iovec_count);
+#else
+            struct iovec *iov = (struct iovec *)acb->ioh->dxferp;
+
+            acb->buf = g_malloc(acb->ioh->dxfer_len);
+            data.data = acb->buf;
+            data.size = iov_to_buf(iov, acb->ioh->iovec_count, 0,
+                                   acb->buf, acb->ioh->dxfer_len);
+#endif
        }
    }

@@ -742,9 +574,20 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
                                         acb->ioh->dxfer_len,
                                         acb->ioh->dxferp);
        } else {
+#if defined(LIBISCSI_FEATURE_IOVECTOR)
            scsi_task_set_iov_in(acb->task,
                                 (struct scsi_iovec *) acb->ioh->dxferp,
                                 acb->ioh->iovec_count);
+#else
+            int i;
+            for (i = 0; i < acb->ioh->iovec_count; i++) {
+                struct iovec *iov = (struct iovec *)acb->ioh->dxferp;
+
+                scsi_task_add_data_in_buffer(acb->task,
+                    iov[i].iov_len,
+                    iov[i].iov_base);
+            }
+#endif
        }
    }

@@ -753,6 +596,7 @@ static BlockDriverAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
    return &acb->common;
 }

+
 static void ioctl_cb(void *opaque, int status)
 {
    int *p_status = opaque;
@@ -776,7 +620,7 @@ static int iscsi_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
        iscsi_aio_ioctl(bs, req, buf, ioctl_cb, &status);

        while (status == -EINPROGRESS) {
-            aio_poll(iscsilun->aio_context, true);
+            qemu_aio_wait();
        }

        return 0;
@@ -799,6 +643,101 @@ iscsi_getlength(BlockDriverState *bs)
    return len;
 }

+#if defined(LIBISCSI_FEATURE_IOVECTOR)
+
+static int64_t coroutine_fn iscsi_co_get_block_status(BlockDriverState *bs,
+                                                  int64_t sector_num,
+                                                  int nb_sectors, int *pnum)
+{
+    IscsiLun *iscsilun = bs->opaque;
+    struct scsi_get_lba_status *lbas = NULL;
+    struct scsi_lba_status_descriptor *lbasd = NULL;
+    struct IscsiTask iTask;
+    int64_t ret;
+
+    iscsi_co_init_iscsitask(iscsilun, &iTask);
+
+    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
+        ret = -EINVAL;
+        goto out;
+    }
+
+    /* default to all sectors allocated */
+    ret = BDRV_BLOCK_DATA;
+    ret |= (sector_num << BDRV_SECTOR_BITS) | BDRV_BLOCK_OFFSET_VALID;
+    *pnum = nb_sectors;
+
+    /* LUN does not support logical block provisioning */
+    if (iscsilun->lbpme == 0) {
+        goto out;
+    }
+
+retry:
+    if (iscsi_get_lba_status_task(iscsilun->iscsi, iscsilun->lun,
+                                  sector_qemu2lun(sector_num, iscsilun),
+                                  8 + 16, iscsi_co_generic_cb,
+                                  &iTask) == NULL) {
+        ret = -ENOMEM;
+        goto out;
+    }
+
+    while (!iTask.complete) {
+        iscsi_set_events(iscsilun);
+        qemu_coroutine_yield();
+    }
+
+    if (iTask.do_retry) {
+        if (iTask.task != NULL) {
+            scsi_free_scsi_task(iTask.task);
+            iTask.task = NULL;
+        }
+        iTask.complete = 0;
+        goto retry;
+    }
+
+    if (iTask.status != SCSI_STATUS_GOOD) {
+        /* in case the get_lba_status_callout fails (i.e.
+         * because the device is busy or the cmd is not
+         * supported) we pretend all blocks are allocated
+         * for backwards compatibility */
+        goto out;
+    }
+
+    lbas = scsi_datain_unmarshall(iTask.task);
+    if (lbas == NULL) {
+        ret = -EIO;
+        goto out;
+    }
+
+    lbasd = &lbas->descriptors[0];
+
+    if (sector_qemu2lun(sector_num, iscsilun) != lbasd->lba) {
+        ret = -EIO;
+        goto out;
+    }
+
+    *pnum = sector_lun2qemu(lbasd->num_blocks, iscsilun);
+    if (*pnum > nb_sectors) {
+        *pnum = nb_sectors;
+    }
+
+    if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED ||
+        lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
+        ret &= ~BDRV_BLOCK_DATA;
+        if (iscsilun->lbprz) {
+            ret |= BDRV_BLOCK_ZERO;
+        }
+    }
+
+out:
+    if (iTask.task != NULL) {
+        scsi_free_scsi_task(iTask.task);
+    }
+    return ret;
+}
+
+#endif /* LIBISCSI_FEATURE_IOVECTOR */
+
 static int
 coroutine_fn iscsi_co_discard(BlockDriverState *bs, int64_t sector_num,
                                   int nb_sectors)
@@ -852,11 +791,11 @@ retry:
        return -EIO;
    }

-    iscsi_allocationmap_clear(iscsilun, sector_num, nb_sectors);
-
    return 0;
 }

+#if defined(SCSI_SENSE_ASCQ_CAPACITY_DATA_HAS_CHANGED)
+
 static int
 coroutine_fn iscsi_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
                                   int nb_sectors, BdrvRequestFlags flags)
@@ -865,27 +804,18 @@ coroutine_fn iscsi_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
    struct IscsiTask iTask;
    uint64_t lba;
    uint32_t nb_blocks;
-    bool use_16_for_ws = iscsilun->use_16_for_rw;

    if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) {
        return -EINVAL;
    }

-    if (flags & BDRV_REQ_MAY_UNMAP) {
-        if (!use_16_for_ws && !iscsilun->lbp.lbpws10) {
-            /* WRITESAME10 with UNMAP is unsupported try WRITESAME16 */
-            use_16_for_ws = true;
-        }
-        if (use_16_for_ws && !iscsilun->lbp.lbpws) {
-            /* WRITESAME16 with UNMAP is not supported by the target,
-             * fall back and try WRITESAME10/16 without UNMAP */
-            flags &= ~BDRV_REQ_MAY_UNMAP;
-            use_16_for_ws = iscsilun->use_16_for_rw;
-        }
+    if (!(flags & BDRV_REQ_MAY_UNMAP) && !iscsilun->has_write_same) {
+        /* WRITE SAME without UNMAP is not supported by the target */
+        return -ENOTSUP;
    }

-    if (!(flags & BDRV_REQ_MAY_UNMAP) && !iscsilun->has_write_same) {
-        /* WRITESAME without UNMAP is not supported by the target */
+    if ((flags & BDRV_REQ_MAY_UNMAP) && !iscsilun->lbp.lbpws) {
+        /* WRITE SAME with UNMAP is not supported by the target */
        return -ENOTSUP;
    }

@@ -898,18 +828,10 @@ coroutine_fn iscsi_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,

    iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
-    if (use_16_for_ws) {
-        iTask.task = iscsi_writesame16_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                            iscsilun->zeroblock, iscsilun->block_size,
-                                            nb_blocks, 0, !!(flags & BDRV_REQ_MAY_UNMAP),
-                                            0, 0, iscsi_co_generic_cb, &iTask);
-    } else {
-        iTask.task = iscsi_writesame10_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                            iscsilun->zeroblock, iscsilun->block_size,
-                                            nb_blocks, 0, !!(flags & BDRV_REQ_MAY_UNMAP),
-                                            0, 0, iscsi_co_generic_cb, &iTask);
-    }
-    if (iTask.task == NULL) {
+    if (iscsi_writesame16_task(iscsilun->iscsi, iscsilun->lun, lba,
+                               iscsilun->zeroblock, iscsilun->block_size,
+                               nb_blocks, 0, !!(flags & BDRV_REQ_MAY_UNMAP),
+                               0, 0, iscsi_co_generic_cb, &iTask) == NULL) {
        return -ENOMEM;
    }

@@ -942,15 +864,11 @@ retry:
        return -EIO;
    }

-    if (flags & BDRV_REQ_MAY_UNMAP) {
-        iscsi_allocationmap_clear(iscsilun, sector_num, nb_sectors);
-    } else {
-        iscsi_allocationmap_set(iscsilun, sector_num, nb_sectors);
-    }
-
    return 0;
 }

+#endif /* SCSI_SENSE_ASCQ_CAPACITY_DATA_HAS_CHANGED */
+
 static void parse_chap(struct iscsi_context *iscsi, const char *target,
                       Error **errp)
 {
@@ -1060,6 +978,7 @@ static char *parse_initiator_name(const char *target)
    return iscsi_name;
 }

+#if defined(LIBISCSI_FEATURE_NOP_COUNTER)
 static void iscsi_nop_timed_event(void *opaque)
 {
    IscsiLun *iscsilun = opaque;
@@ -1077,6 +996,7 @@ static void iscsi_nop_timed_event(void *opaque)
    timer_mod(iscsilun->nop_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);
    iscsi_set_events(iscsilun);
 }
+#endif

 static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
 {
@@ -1103,7 +1023,6 @@ static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
                    iscsilun->num_blocks = rc16->returned_lba + 1;
                    iscsilun->lbpme = rc16->lbpme;
                    iscsilun->lbprz = rc16->lbprz;
-                    iscsilun->use_16_for_rw = (rc16->returned_lba > 0xffffffff);
                }
            }
            break;
@@ -1176,53 +1095,22 @@ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
    *inq = scsi_datain_unmarshall(task);
    if (*inq == NULL) {
        error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
-        goto fail_with_err;
+        goto fail;
    }

    return task;

 fail:
-    error_setg(errp, "iSCSI: Inquiry command failed : %s",
-               iscsi_get_error(iscsi));
-fail_with_err:
+    if (!error_is_set(errp)) {
+        error_setg(errp, "iSCSI: Inquiry command failed : %s",
+                   iscsi_get_error(iscsi));
+    }
    if (task != NULL) {
        scsi_free_scsi_task(task);
    }
    return NULL;
 }

-static void iscsi_detach_aio_context(BlockDriverState *bs)
-{
-    IscsiLun *iscsilun = bs->opaque;
-
-    aio_set_fd_handler(iscsilun->aio_context,
-                       iscsi_get_fd(iscsilun->iscsi),
-                       NULL, NULL, NULL);
-    iscsilun->events = 0;
-
-    if (iscsilun->nop_timer) {
-        timer_del(iscsilun->nop_timer);
-        timer_free(iscsilun->nop_timer);
-        iscsilun->nop_timer = NULL;
-    }
-}
-
-static void iscsi_attach_aio_context(BlockDriverState *bs,
-                                     AioContext *new_context)
-{
-    IscsiLun *iscsilun = bs->opaque;
-
-    iscsilun->aio_context = new_context;
-    iscsi_set_events(iscsilun);
-
-    /* Set up a timer for sending out iSCSI NOPs */
-    iscsilun->nop_timer = aio_timer_new(iscsilun->aio_context,
-                                        QEMU_CLOCK_REALTIME, SCALE_MS,
-                                        iscsi_nop_timed_event, iscsilun);
-    timer_mod(iscsilun->nop_timer,
-              qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);
-}
-
 /*
 * We support iscsi url's on the form
 * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
@@ -1329,7 +1217,6 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
    }

    iscsilun->iscsi = iscsi;
-    iscsilun->aio_context = bdrv_get_aio_context(bs);
    iscsilun->lun   = iscsi_url->lun;
    iscsilun->has_write_same = true;

@@ -1403,25 +1290,17 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
    scsi_free_scsi_task(task);
    task = NULL;

-    iscsi_attach_aio_context(bs, iscsilun->aio_context);
-
-    /* Guess the internal cluster (page) size of the iscsi target by the means
-     * of opt_unmap_gran. Transfer the unmap granularity only if it has a
-     * reasonable size */
-    if (iscsilun->bl.opt_unmap_gran * iscsilun->block_size >= 4 * 1024 &&
-        iscsilun->bl.opt_unmap_gran * iscsilun->block_size <= 16 * 1024 * 1024) {
-        iscsilun->cluster_sectors = (iscsilun->bl.opt_unmap_gran *
-                                     iscsilun->block_size) >> BDRV_SECTOR_BITS;
-        if (iscsilun->lbprz && !(bs->open_flags & BDRV_O_NOCACHE)) {
-            iscsilun->allocationmap =
-                bitmap_new(DIV_ROUND_UP(bs->total_sectors,
-                                        iscsilun->cluster_sectors));
-        }
-    }
+#if defined(LIBISCSI_FEATURE_NOP_COUNTER)
+    /* Set up a timer for sending out iSCSI NOPs */
+    iscsilun->nop_timer = timer_new_ms(QEMU_CLOCK_REALTIME, iscsi_nop_timed_event, iscsilun);
+    timer_mod(iscsilun->nop_timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + NOP_INTERVAL);
+#endif

 out:
    qemu_opts_del(opts);
-    g_free(initiator_name);
+    if (initiator_name != NULL) {
+        g_free(initiator_name);
+    }
    if (iscsi_url != NULL) {
        iscsi_destroy_url(iscsi_url);
    }
@@ -1443,14 +1322,17 @@ static void iscsi_close(BlockDriverState *bs)
    IscsiLun *iscsilun = bs->opaque;
    struct iscsi_context *iscsi = iscsilun->iscsi;

-    iscsi_detach_aio_context(bs);
+    if (iscsilun->nop_timer) {
+        timer_del(iscsilun->nop_timer);
+        timer_free(iscsilun->nop_timer);
+    }
+    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), NULL, NULL, NULL);
    iscsi_destroy_context(iscsi);
    g_free(iscsilun->zeroblock);
-    g_free(iscsilun->allocationmap);
    memset(iscsilun, 0, sizeof(IscsiLun));
 }

-static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
+static int iscsi_refresh_limits(BlockDriverState *bs)
 {
    IscsiLun *iscsilun = bs->opaque;

@@ -1475,6 +1357,7 @@ static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
    }
    bs->bl.opt_transfer_length = sector_lun2qemu(iscsilun->bl.opt_xfer_len,
                                                 iscsilun);
+    return 0;
 }

 /* Since iscsi_open() ignores bdrv_flags, there is nothing to do here in
@@ -1506,17 +1389,11 @@ static int iscsi_truncate(BlockDriverState *bs, int64_t offset)
        return -EINVAL;
    }

-    if (iscsilun->allocationmap != NULL) {
-        g_free(iscsilun->allocationmap);
-        iscsilun->allocationmap =
-            bitmap_new(DIV_ROUND_UP(bs->total_sectors,
-                                    iscsilun->cluster_sectors));
-    }
-
    return 0;
 }

-static int iscsi_create(const char *filename, QemuOpts *opts, Error **errp)
+static int iscsi_create(const char *filename, QEMUOptionParameter *options,
+                        Error **errp)
 {
    int ret = 0;
    int64_t total_size = 0;
@@ -1524,11 +1401,16 @@ static int iscsi_create(const char *filename, QemuOpts *opts, Error **errp)
    IscsiLun *iscsilun = NULL;
    QDict *bs_options;

-    bs = bdrv_new("", &error_abort);
+    bs = bdrv_new("");

    /* Read out options */
-    total_size =
-        qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / BDRV_SECTOR_SIZE;
+    while (options && options->name) {
+        if (!strcmp(options->name, "size")) {
+            total_size = options->value.n / BDRV_SECTOR_SIZE;
+        }
+        options++;
+    }
+
    bs->opaque = g_malloc0(sizeof(struct IscsiLun));
    iscsilun = bs->opaque;

@@ -1540,7 +1422,10 @@ static int iscsi_create(const char *filename, QemuOpts *opts, Error **errp)
    if (ret != 0) {
        goto out;
    }
-    iscsi_detach_aio_context(bs);
+    if (iscsilun->nop_timer) {
+        timer_del(iscsilun->nop_timer);
+        timer_free(iscsilun->nop_timer);
+    }
    if (iscsilun->type != TYPE_DISK) {
        ret = -ENODEV;
        goto out;
@@ -1566,21 +1451,23 @@ static int iscsi_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    IscsiLun *iscsilun = bs->opaque;
    bdi->unallocated_blocks_are_zero = !!iscsilun->lbprz;
    bdi->can_write_zeroes_with_unmap = iscsilun->lbprz && iscsilun->lbp.lbpws;
-    bdi->cluster_size = iscsilun->cluster_sectors * BDRV_SECTOR_SIZE;
+    /* Guess the internal cluster (page) size of the iscsi target by the means
+     * of opt_unmap_gran. Transfer the unmap granularity only if it has a
+     * reasonable size for bdi->cluster_size */
+    if (iscsilun->bl.opt_unmap_gran * iscsilun->block_size >= 64 * 1024 &&
+        iscsilun->bl.opt_unmap_gran * iscsilun->block_size <= 16 * 1024 * 1024) {
+        bdi->cluster_size = iscsilun->bl.opt_unmap_gran * iscsilun->block_size;
+    }
    return 0;
 }

-static QemuOptsList iscsi_create_opts = {
-    .name = "iscsi-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(iscsi_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter iscsi_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_iscsi = {
@@ -1592,7 +1479,7 @@ static BlockDriver bdrv_iscsi = {
    .bdrv_file_open  = iscsi_open,
    .bdrv_close      = iscsi_close,
    .bdrv_create     = iscsi_create,
-    .create_opts     = &iscsi_create_opts,
+    .create_options  = iscsi_create_options,
    .bdrv_reopen_prepare  = iscsi_reopen_prepare,

    .bdrv_getlength  = iscsi_getlength,
@@ -1600,9 +1487,13 @@ static BlockDriver bdrv_iscsi = {
    .bdrv_truncate   = iscsi_truncate,
    .bdrv_refresh_limits = iscsi_refresh_limits,

+#if defined(LIBISCSI_FEATURE_IOVECTOR)
    .bdrv_co_get_block_status = iscsi_co_get_block_status,
+#endif
    .bdrv_co_discard      = iscsi_co_discard,
+#if defined(SCSI_SENSE_ASCQ_CAPACITY_DATA_HAS_CHANGED)
    .bdrv_co_write_zeroes = iscsi_co_write_zeroes,
+#endif
    .bdrv_co_readv         = iscsi_co_readv,
    .bdrv_co_writev        = iscsi_co_writev,
    .bdrv_co_flush_to_disk = iscsi_co_flush,
@@ -1611,9 +1502,6 @@ static BlockDriver bdrv_iscsi = {
    .bdrv_ioctl       = iscsi_ioctl,
    .bdrv_aio_ioctl   = iscsi_aio_ioctl,
 #endif
-
-    .bdrv_detach_aio_context = iscsi_detach_aio_context,
-    .bdrv_attach_aio_context = iscsi_attach_aio_context,
 };

 static QemuOptsList qemu_iscsi_opts = {
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -25,8 +25,6 @@
 */
 #define MAX_EVENTS 128

-#define MAX_QUEUED_IO  128
-
 struct qemu_laiocb {
    BlockDriverAIOCB common;
    struct qemu_laio_state *ctx;
@@ -38,19 +36,9 @@ struct qemu_laiocb {
    QLIST_ENTRY(qemu_laiocb) node;
 };

-typedef struct {
-    struct iocb *iocbs[MAX_QUEUED_IO];
-    int plugged;
-    unsigned int size;
-    unsigned int idx;
-} LaioQueue;
-
 struct qemu_laio_state {
    io_context_t ctx;
    EventNotifier e;
-
-    /* io queue for submit at batch */
-    LaioQueue io_q;
 };

 static inline ssize_t io_event_ret(struct io_event *ev)
@@ -147,79 +135,6 @@ static const AIOCBInfo laio_aiocb_info = {
    .cancel             = laio_cancel,
 };

-static void ioq_init(LaioQueue *io_q)
-{
-    io_q->size = MAX_QUEUED_IO;
-    io_q->idx = 0;
-    io_q->plugged = 0;
-}
-
-static int ioq_submit(struct qemu_laio_state *s)
-{
-    int ret, i = 0;
-    int len = s->io_q.idx;
-
-    do {
-        ret = io_submit(s->ctx, len, s->io_q.iocbs);
-    } while (i++ < 3 && ret == -EAGAIN);
-
-    /* empty io queue */
-    s->io_q.idx = 0;
-
-    if (ret < 0) {
-        i = 0;
-    } else {
-        i = ret;
-    }
-
-    for (; i < len; i++) {
-        struct qemu_laiocb *laiocb =
-            container_of(s->io_q.iocbs[i], struct qemu_laiocb, iocb);
-
-        laiocb->ret = (ret < 0) ? ret : -EIO;
-        qemu_laio_process_completion(s, laiocb);
-    }
-    return ret;
-}
-
-static void ioq_enqueue(struct qemu_laio_state *s, struct iocb *iocb)
-{
-    unsigned int idx = s->io_q.idx;
-
-    s->io_q.iocbs[idx++] = iocb;
-    s->io_q.idx = idx;
-
-    /* submit immediately if queue is full */
-    if (idx == s->io_q.size) {
-        ioq_submit(s);
-    }
-}
-
-void laio_io_plug(BlockDriverState *bs, void *aio_ctx)
-{
-    struct qemu_laio_state *s = aio_ctx;
-
-    s->io_q.plugged++;
-}
-
-int laio_io_unplug(BlockDriverState *bs, void *aio_ctx, bool unplug)
-{
-    struct qemu_laio_state *s = aio_ctx;
-    int ret = 0;
-
-    assert(s->io_q.plugged > 0 || !unplug);
-
-    if (unplug && --s->io_q.plugged > 0) {
-        return 0;
-    }
-
-    if (s->io_q.idx > 0) {
-        ret = ioq_submit(s);
-    }
-
-    return ret;
-}
-
 BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type)
@@ -253,13 +168,8 @@ BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
    }
    io_set_eventfd(&laiocb->iocb, event_notifier_get_fd(&s->e));

-    if (!s->io_q.plugged) {
-        if (io_submit(s->ctx, 1, &iocbs) < 0) {
-            goto out_free_aiocb;
-        }
-    } else {
-        ioq_enqueue(s, iocbs);
-    }
+    if (io_submit(s->ctx, 1, &iocbs) < 0)
+        goto out_free_aiocb;
    return &laiocb->common;

 out_free_aiocb:
@@ -267,20 +177,6 @@ out_free_aiocb:
    return NULL;
 }

-void laio_detach_aio_context(void *s_, AioContext *old_context)
-{
-    struct qemu_laio_state *s = s_;
-
-    aio_set_event_notifier(old_context, &s->e, NULL);
-}
-
-void laio_attach_aio_context(void *s_, AioContext *new_context)
-{
-    struct qemu_laio_state *s = s_;
-
-    aio_set_event_notifier(new_context, &s->e, qemu_laio_completion_cb);
-}
-
 void *laio_init(void)
 {
    struct qemu_laio_state *s;
@@ -294,7 +190,7 @@ void *laio_init(void)
        goto out_close_efd;
    }

-    ioq_init(&s->io_q);
+    qemu_aio_set_event_notifier(&s->e, qemu_laio_completion_cb);

    return s;

@@ -304,16 +200,3 @@ out_free_state:
    g_free(s);
    return NULL;
 }
-
-void laio_cleanup(void *s_)
-{
-    struct qemu_laio_state *s = s_;
-
-    event_notifier_cleanup(&s->e);
-
-    if (io_destroy(s->ctx) != 0) {
-        fprintf(stderr, "%s: destroy AIO context %p failed\n",
-                        __func__, &s->ctx);
-    }
-    g_free(s);
-}
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -32,12 +32,6 @@ typedef struct MirrorBlockJob {
    RateLimit limit;
    BlockDriverState *target;
    BlockDriverState *base;
-    /* The name of the graph node to replace */
-    char *replaces;
-    /* The BDS to replace */
-    BlockDriverState *to_replace;
-    /* Used to block operations on the drive-mirror-replace target */
-    Error *replace_blocker;
    bool is_none_mode;
    BlockdevOnError on_source_error, on_target_error;
    bool synced;
@@ -124,7 +118,7 @@ static void mirror_write_complete(void *opaque, int ret)

        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
        action = mirror_error_action(s, false, -ret);
-        if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {
+        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
            s->ret = ret;
        }
    }
@@ -141,7 +135,7 @@ static void mirror_read_complete(void *opaque, int ret)

        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
        action = mirror_error_action(s, true, -ret);
-        if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {
+        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
            s->ret = ret;
        }

@@ -337,7 +331,7 @@ static void coroutine_fn mirror_run(void *opaque)
        goto immediate_exit;
    } else if (s->common.len == 0) {
        /* Report BLOCK_JOB_READY and wait for complete. */
-        block_job_event_ready(&s->common);
+        block_job_ready(&s->common);
        s->synced = true;
        while (!block_job_is_cancelled(&s->common) && !s->should_complete) {
            block_job_yield(&s->common);
@@ -346,7 +340,7 @@ static void coroutine_fn mirror_run(void *opaque)
        goto immediate_exit;
    }

-    length = DIV_ROUND_UP(s->common.len, s->granularity);
+    length = (bdrv_getlength(bs) + s->granularity - 1) / s->granularity;
    s->in_flight_bitmap = bitmap_new(length);

    /* If we have no backing file yet in the destination, we cannot let
@@ -356,10 +350,7 @@ static void coroutine_fn mirror_run(void *opaque)
    bdrv_get_backing_filename(s->target, backing_filename,
                              sizeof(backing_filename));
    if (backing_filename[0] && !s->target->backing_hd) {
-        ret = bdrv_get_info(s->target, &bdi);
-        if (ret < 0) {
-            goto immediate_exit;
-        }
+        bdrv_get_info(s->target, &bdi);
        if (s->granularity < bdi.cluster_size) {
            s->buf_size = MAX(s->buf_size, bdi.cluster_size);
            s->cow_bitmap = bitmap_new(length);
@@ -432,8 +423,7 @@ static void coroutine_fn mirror_run(void *opaque)
            trace_mirror_before_flush(s);
            ret = bdrv_flush(s->target);
            if (ret < 0) {
-                if (mirror_error_action(s, false, -ret) ==
-                    BLOCK_ERROR_ACTION_REPORT) {
+                if (mirror_error_action(s, false, -ret) == BDRV_ACTION_REPORT) {
                    goto immediate_exit;
                }
            } else {
@@ -444,7 +434,7 @@ static void coroutine_fn mirror_run(void *opaque)
                 */
                s->common.offset = end * BDRV_SECTOR_SIZE;
                if (!s->synced) {
-                    block_job_event_ready(&s->common);
+                    block_job_ready(&s->common);
                    s->synced = true;
                }

@@ -508,28 +498,18 @@ immediate_exit:
    bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);
    bdrv_iostatus_disable(s->target);
    if (s->should_complete && ret == 0) {
-        BlockDriverState *to_replace = s->common.bs;
-        if (s->to_replace) {
-            to_replace = s->to_replace;
+        if (bdrv_get_flags(s->target) != bdrv_get_flags(s->common.bs)) {
+            bdrv_reopen(s->target, bdrv_get_flags(s->common.bs), NULL);
        }
-        if (bdrv_get_flags(s->target) != bdrv_get_flags(to_replace)) {
-            bdrv_reopen(s->target, bdrv_get_flags(to_replace), NULL);
-        }
-        bdrv_swap(s->target, to_replace);
+        bdrv_swap(s->target, s->common.bs);
        if (s->common.driver->job_type == BLOCK_JOB_TYPE_COMMIT) {
            /* drop the bs loop chain formed by the swap: break the loop then
             * trigger the unref from the top one */
            BlockDriverState *p = s->base->backing_hd;
-            bdrv_set_backing_hd(s->base, NULL);
+            s->base->backing_hd = NULL;
            bdrv_unref(p);
        }
    }
-    if (s->to_replace) {
-        bdrv_op_unblock_all(s->to_replace, s->replace_blocker);
-        error_free(s->replace_blocker);
-        bdrv_unref(s->to_replace);
-    }
-    g_free(s->replaces);
    bdrv_unref(s->target);
    block_job_completed(&s->common, ret);
 }
@@ -568,20 +548,6 @@ static void mirror_complete(BlockJob *job, Error **errp)
        return;
    }

-    /* check the target bs is not blocked and block all operations on it */
-    if (s->replaces) {
-        s->to_replace = check_to_replace_node(s->replaces, &local_err);
-        if (!s->to_replace) {
-            error_propagate(errp, local_err);
-            return;
-        }
-
-        error_setg(&s->replace_blocker,
-                   "block device is in use by block-job-complete");
-        bdrv_op_block_all(s->to_replace, s->replace_blocker);
-        bdrv_ref(s->to_replace);
-    }
-
    s->should_complete = true;
    block_job_resume(job);
 }
@@ -604,15 +570,14 @@ static const BlockJobDriver commit_active_job_driver = {
 };

 static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
-                             const char *replaces,
-                             int64_t speed, int64_t granularity,
-                             int64_t buf_size,
-                             BlockdevOnError on_source_error,
-                             BlockdevOnError on_target_error,
-                             BlockDriverCompletionFunc *cb,
-                             void *opaque, Error **errp,
-                             const BlockJobDriver *driver,
-                             bool is_none_mode, BlockDriverState *base)
+                            int64_t speed, int64_t granularity,
+                            int64_t buf_size,
+                            BlockdevOnError on_source_error,
+                            BlockdevOnError on_target_error,
+                            BlockDriverCompletionFunc *cb,
+                            void *opaque, Error **errp,
+                            const BlockJobDriver *driver,
+                            bool is_none_mode, BlockDriverState *base)
 {
    MirrorBlockJob *s;

@@ -643,7 +608,6 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
        return;
    }

-    s->replaces = g_strdup(replaces);
    s->on_source_error = on_source_error;
    s->on_target_error = on_target_error;
    s->target = target;
@@ -652,10 +616,7 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
    s->granularity = granularity;
    s->buf_size = MAX(buf_size, granularity);

-    s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, errp);
-    if (!s->dirty_bitmap) {
-        return;
-    }
+    s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity);
    bdrv_set_enable_write_cache(s->target, true);
    bdrv_set_on_error(s->target, on_target_error, on_target_error);
    bdrv_iostatus_enable(s->target);
@@ -665,7 +626,6 @@ static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target,
 }

 void mirror_start(BlockDriverState *bs, BlockDriverState *target,
-                  const char *replaces,
                  int64_t speed, int64_t granularity, int64_t buf_size,
                  MirrorSyncMode mode, BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
@@ -677,8 +637,7 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,

    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
    base = mode == MIRROR_SYNC_MODE_TOP ? bs->backing_hd : NULL;
-    mirror_start_job(bs, target, replaces,
-                     speed, granularity, buf_size,
+    mirror_start_job(bs, target, speed, granularity, buf_size,
                     on_source_error, on_target_error, cb, opaque, errp,
                     &mirror_job_driver, is_none_mode, base);
 }
@@ -726,10 +685,10 @@ void commit_active_start(BlockDriverState *bs, BlockDriverState *base,
    }

    bdrv_ref(base);
-    mirror_start_job(bs, base, NULL, speed, 0, 0,
+    mirror_start_job(bs, base, speed, 0, 0,
                     on_error, on_error, cb, opaque, &local_err,
                     &commit_active_job_driver, false, base);
-    if (local_err) {
+    if (error_is_set(&local_err)) {
        error_propagate(errp, local_err);
        goto error_restore_flags;
    }
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -49,7 +49,7 @@ static void nbd_teardown_connection(NbdClientSession *client)
    shutdown(client->sock, 2);
    nbd_recv_coroutines_enter_all(client);

-    nbd_client_session_detach_aio_context(client);
+    qemu_aio_set_fd_handler(client->sock, NULL, NULL, NULL);
    closesocket(client->sock);
    client->sock = -1;
 }
@@ -103,14 +103,11 @@ static int nbd_co_send_request(NbdClientSession *s,
    struct nbd_request *request,
    QEMUIOVector *qiov, int offset)
 {
-    AioContext *aio_context;
    int rc, ret;

    qemu_co_mutex_lock(&s->send_mutex);
    s->send_coroutine = qemu_coroutine_self();
-    aio_context = bdrv_get_aio_context(s->bs);
-    aio_set_fd_handler(aio_context, s->sock,
-                       nbd_reply_ready, nbd_restart_write, s);
+    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write, s);
    if (qiov) {
        if (!s->is_unix) {
            socket_set_cork(s->sock, 1);
@@ -129,7 +126,7 @@ static int nbd_co_send_request(NbdClientSession *s,
    } else {
        rc = nbd_send_request(s->sock, request);
    }
-    aio_set_fd_handler(aio_context, s->sock, nbd_reply_ready, NULL, s);
+    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL, s);
    s->send_coroutine = NULL;
    qemu_co_mutex_unlock(&s->send_mutex);
    return rc;
@@ -338,19 +335,6 @@ int nbd_client_session_co_discard(NbdClientSession *client, int64_t sector_num,

 }

-void nbd_client_session_detach_aio_context(NbdClientSession *client)
-{
-    aio_set_fd_handler(bdrv_get_aio_context(client->bs), client->sock,
-                       NULL, NULL, NULL);
-}
-
-void nbd_client_session_attach_aio_context(NbdClientSession *client,
-                                           AioContext *new_context)
-{
-    aio_set_fd_handler(new_context, client->sock,
-                       nbd_reply_ready, NULL, client);
-}
-
 void nbd_client_session_close(NbdClientSession *client)
 {
    struct nbd_request request = {
@@ -397,7 +381,7 @@ int nbd_client_session_init(NbdClientSession *client, BlockDriverState *bs,
    /* Now that we're connected, set the socket to be non-blocking and
     * kick the reply mechanism.  */
    qemu_set_nonblock(sock);
-    nbd_client_session_attach_aio_context(client, bdrv_get_aio_context(bs));
+    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL, client);

    logout("Established connection with NBD server\n");
    return 0;
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -47,8 +47,4 @@ int nbd_client_session_co_writev(NbdClientSession *client, int64_t sector_num,
 int nbd_client_session_co_readv(NbdClientSession *client, int64_t sector_num,
                                int nb_sectors, QEMUIOVector *qiov);

-void nbd_client_session_detach_aio_context(NbdClientSession *client);
-void nbd_client_session_attach_aio_context(NbdClientSession *client,
-                                           AioContext *new_context);
-
 #endif /* NBD_CLIENT_H */
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -175,7 +175,7 @@ static void nbd_parse_filename(const char *filename, QDict *options,
        InetSocketAddress *addr = NULL;

        addr = inet_parse(host_spec, errp);
-        if (!addr) {
+        if (error_is_set(errp)) {
            goto out;
        }

@@ -323,67 +323,46 @@ static int64_t nbd_getlength(BlockDriverState *bs)
    return s->client.size;
 }

-static void nbd_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVNBDState *s = bs->opaque;
-
-    nbd_client_session_detach_aio_context(&s->client);
-}
-
-static void nbd_attach_aio_context(BlockDriverState *bs,
-                                   AioContext *new_context)
-{
-    BDRVNBDState *s = bs->opaque;
-
-    nbd_client_session_attach_aio_context(&s->client, new_context);
-}
-
 static BlockDriver bdrv_nbd = {
-    .format_name                = "nbd",
-    .protocol_name              = "nbd",
-    .instance_size              = sizeof(BDRVNBDState),
-    .bdrv_parse_filename        = nbd_parse_filename,
-    .bdrv_file_open             = nbd_open,
-    .bdrv_co_readv              = nbd_co_readv,
-    .bdrv_co_writev             = nbd_co_writev,
-    .bdrv_close                 = nbd_close,
-    .bdrv_co_flush_to_os        = nbd_co_flush,
-    .bdrv_co_discard            = nbd_co_discard,
-    .bdrv_getlength             = nbd_getlength,
-    .bdrv_detach_aio_context    = nbd_detach_aio_context,
-    .bdrv_attach_aio_context    = nbd_attach_aio_context,
+    .format_name         = "nbd",
+    .protocol_name       = "nbd",
+    .instance_size       = sizeof(BDRVNBDState),
+    .bdrv_parse_filename = nbd_parse_filename,
+    .bdrv_file_open      = nbd_open,
+    .bdrv_co_readv       = nbd_co_readv,
+    .bdrv_co_writev      = nbd_co_writev,
+    .bdrv_close          = nbd_close,
+    .bdrv_co_flush_to_os = nbd_co_flush,
+    .bdrv_co_discard     = nbd_co_discard,
+    .bdrv_getlength      = nbd_getlength,
 };

 static BlockDriver bdrv_nbd_tcp = {
-    .format_name                = "nbd",
-    .protocol_name              = "nbd+tcp",
-    .instance_size              = sizeof(BDRVNBDState),
-    .bdrv_parse_filename        = nbd_parse_filename,
-    .bdrv_file_open             = nbd_open,
-    .bdrv_co_readv              = nbd_co_readv,
-    .bdrv_co_writev             = nbd_co_writev,
-    .bdrv_close                 = nbd_close,
-    .bdrv_co_flush_to_os        = nbd_co_flush,
-    .bdrv_co_discard            = nbd_co_discard,
-    .bdrv_getlength             = nbd_getlength,
-    .bdrv_detach_aio_context    = nbd_detach_aio_context,
-    .bdrv_attach_aio_context    = nbd_attach_aio_context,
+    .format_name         = "nbd",
+    .protocol_name       = "nbd+tcp",
+    .instance_size       = sizeof(BDRVNBDState),
+    .bdrv_parse_filename = nbd_parse_filename,
+    .bdrv_file_open      = nbd_open,
+    .bdrv_co_readv       = nbd_co_readv,
+    .bdrv_co_writev      = nbd_co_writev,
+    .bdrv_close          = nbd_close,
+    .bdrv_co_flush_to_os = nbd_co_flush,
+    .bdrv_co_discard     = nbd_co_discard,
+    .bdrv_getlength      = nbd_getlength,
 };

 static BlockDriver bdrv_nbd_unix = {
-    .format_name                = "nbd",
-    .protocol_name              = "nbd+unix",
-    .instance_size              = sizeof(BDRVNBDState),
-    .bdrv_parse_filename        = nbd_parse_filename,
-    .bdrv_file_open             = nbd_open,
-    .bdrv_co_readv              = nbd_co_readv,
-    .bdrv_co_writev             = nbd_co_writev,
-    .bdrv_close                 = nbd_close,
-    .bdrv_co_flush_to_os        = nbd_co_flush,
-    .bdrv_co_discard            = nbd_co_discard,
-    .bdrv_getlength             = nbd_getlength,
-    .bdrv_detach_aio_context    = nbd_detach_aio_context,
-    .bdrv_attach_aio_context    = nbd_attach_aio_context,
+    .format_name         = "nbd",
+    .protocol_name       = "nbd+unix",
+    .instance_size       = sizeof(BDRVNBDState),
+    .bdrv_parse_filename = nbd_parse_filename,
+    .bdrv_file_open      = nbd_open,
+    .bdrv_co_readv       = nbd_co_readv,
+    .bdrv_co_writev      = nbd_co_writev,
+    .bdrv_close          = nbd_close,
+    .bdrv_co_flush_to_os = nbd_co_flush,
+    .bdrv_co_discard     = nbd_co_discard,
+    .bdrv_getlength      = nbd_getlength,
 };

 static void bdrv_nbd_init(void)
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -40,7 +40,6 @@ typedef struct NFSClient {
    struct nfsfh *fh;
    int events;
    bool has_zero_init;
-    AioContext *aio_context;
 } NFSClient;

 typedef struct NFSRPC {
@@ -50,7 +49,6 @@ typedef struct NFSRPC {
    struct stat *st;
    Coroutine *co;
    QEMUBH *bh;
-    NFSClient *client;
 } NFSRPC;

 static void nfs_process_read(void *arg);
@@ -60,11 +58,10 @@ static void nfs_set_events(NFSClient *client)
 {
    int ev = nfs_which_events(client->context);
    if (ev != client->events) {
-        aio_set_fd_handler(client->aio_context,
-                           nfs_get_fd(client->context),
-                           (ev & POLLIN) ? nfs_process_read : NULL,
-                           (ev & POLLOUT) ? nfs_process_write : NULL,
-                           client);
+        qemu_aio_set_fd_handler(nfs_get_fd(client->context),
+                      (ev & POLLIN) ? nfs_process_read : NULL,
+                      (ev & POLLOUT) ? nfs_process_write : NULL,
+                      client);

    }
    client->events = ev;
@@ -87,15 +84,13 @@ static void nfs_process_write(void *arg)
 static void nfs_co_init_task(NFSClient *client, NFSRPC *task)
 {
    *task = (NFSRPC) {
-        .co             = qemu_coroutine_self(),
-        .client         = client,
+        .co         = qemu_coroutine_self(),
    };
 }

 static void nfs_co_generic_bh_cb(void *opaque)
 {
    NFSRPC *task = opaque;
-    task->complete = 1;
    qemu_bh_delete(task->bh);
    qemu_coroutine_enter(task->co, NULL);
 }
@@ -105,6 +100,7 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
                  void *private_data)
 {
    NFSRPC *task = private_data;
+    task->complete = 1;
    task->ret = ret;
    if (task->ret > 0 && task->iov) {
        if (task->ret <= task->iov->size) {
@@ -120,11 +116,8 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
        error_report("NFS Error: %s", nfs_get_error(nfs));
    }
    if (task->co) {
-        task->bh = aio_bh_new(task->client->aio_context,
-                              nfs_co_generic_bh_cb, task);
+        task->bh = qemu_bh_new(nfs_co_generic_bh_cb, task);
        qemu_bh_schedule(task->bh);
-    } else {
-        task->complete = 1;
    }
 }

@@ -231,34 +224,13 @@ static QemuOptsList runtime_opts = {
    },
 };

-static void nfs_detach_aio_context(BlockDriverState *bs)
-{
-    NFSClient *client = bs->opaque;
-
-    aio_set_fd_handler(client->aio_context,
-                       nfs_get_fd(client->context),
-                       NULL, NULL, NULL);
-    client->events = 0;
-}
-
-static void nfs_attach_aio_context(BlockDriverState *bs,
-                                   AioContext *new_context)
-{
-    NFSClient *client = bs->opaque;
-
-    client->aio_context = new_context;
-    nfs_set_events(client);
-}
-
 static void nfs_client_close(NFSClient *client)
 {
    if (client->context) {
        if (client->fh) {
            nfs_close(client->context, client->fh);
        }
-        aio_set_fd_handler(client->aio_context,
-                           nfs_get_fd(client->context),
-                           NULL, NULL, NULL);
+        qemu_aio_set_fd_handler(nfs_get_fd(client->context), NULL, NULL, NULL);
        nfs_destroy_context(client->context);
    }
    memset(client, 0, sizeof(NFSClient));
@@ -284,10 +256,6 @@ static int64_t nfs_client_open(NFSClient *client, const char *filename,
        error_setg(errp, "Invalid URL specified");
        goto fail;
    }
-    if (!uri->server) {
-        error_setg(errp, "Invalid URL specified");
-        goto fail;
-    }
    strp = strrchr(uri->path, '/');
    if (strp == NULL) {
        error_setg(errp, "Invalid URL specified");
@@ -304,27 +272,17 @@ static int64_t nfs_client_open(NFSClient *client, const char *filename,

    qp = query_params_parse(uri->query);
    for (i = 0; i < qp->n; i++) {
-        unsigned long long val;
        if (!qp->p[i].value) {
            error_setg(errp, "Value for NFS parameter expected: %s",
                       qp->p[i].name);
            goto fail;
        }
-        if (parse_uint_full(qp->p[i].value, &val, 0)) {
-            error_setg(errp, "Illegal value for NFS parameter: %s",
-                       qp->p[i].name);
-            goto fail;
-        }
-        if (!strcmp(qp->p[i].name, "uid")) {
-            nfs_set_uid(client->context, val);
-        } else if (!strcmp(qp->p[i].name, "gid")) {
-            nfs_set_gid(client->context, val);
-        } else if (!strcmp(qp->p[i].name, "tcp-syncnt")) {
-            nfs_set_tcp_syncnt(client->context, val);
-#ifdef LIBNFS_FEATURE_READAHEAD
-        } else if (!strcmp(qp->p[i].name, "readahead")) {
-            nfs_set_readahead(client->context, val);
-#endif
+        if (!strncmp(qp->p[i].name, "uid", 3)) {
+            nfs_set_uid(client->context, atoi(qp->p[i].value));
+        } else if (!strncmp(qp->p[i].name, "gid", 3)) {
+            nfs_set_gid(client->context, atoi(qp->p[i].value));
+        } else if (!strncmp(qp->p[i].name, "tcp-syncnt", 10)) {
+            nfs_set_tcp_syncnt(client->context, atoi(qp->p[i].value));
        } else {
            error_setg(errp, "Unknown NFS parameter name: %s",
                       qp->p[i].name);
@@ -383,11 +341,9 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
    QemuOpts *opts;
    Error *local_err = NULL;

-    client->aio_context = bdrv_get_aio_context(bs);
-
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
+    if (error_is_set(&local_err)) {
        error_propagate(errp, local_err);
        return -EINVAL;
    }
@@ -401,16 +357,20 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
    return 0;
 }

-static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
+static int nfs_file_create(const char *url, QEMUOptionParameter *options,
+                           Error **errp)
 {
    int ret = 0;
    int64_t total_size = 0;
    NFSClient *client = g_malloc0(sizeof(NFSClient));

-    client->aio_context = qemu_get_aio_context();
-
    /* Read out options */
-    total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
+    while (options && options->name) {
+        if (!strcmp(options->name, "size")) {
+            total_size = options->value.n;
+        }
+        options++;
+    }

    ret = nfs_client_open(client, url, O_CREAT, errp);
    if (ret < 0) {
@@ -443,7 +403,7 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)

    while (!task.complete) {
        nfs_set_events(client);
-        aio_poll(client->aio_context, true);
+        qemu_aio_wait();
    }

    return (task.ret < 0 ? task.ret : st.st_blocks * st.st_blksize);
@@ -456,25 +416,22 @@ static int nfs_file_truncate(BlockDriverState *bs, int64_t offset)
 }

 static BlockDriver bdrv_nfs = {
-    .format_name                    = "nfs",
-    .protocol_name                  = "nfs",
+    .format_name     = "nfs",
+    .protocol_name   = "nfs",

-    .instance_size                  = sizeof(NFSClient),
-    .bdrv_needs_filename            = true,
-    .bdrv_has_zero_init             = nfs_has_zero_init,
-    .bdrv_get_allocated_file_size   = nfs_get_allocated_file_size,
-    .bdrv_truncate                  = nfs_file_truncate,
+    .instance_size   = sizeof(NFSClient),
+    .bdrv_needs_filename = true,
+    .bdrv_has_zero_init = nfs_has_zero_init,
+    .bdrv_get_allocated_file_size = nfs_get_allocated_file_size,
+    .bdrv_truncate = nfs_file_truncate,

-    .bdrv_file_open                 = nfs_file_open,
-    .bdrv_close                     = nfs_file_close,
-    .bdrv_create                    = nfs_file_create,
+    .bdrv_file_open  = nfs_file_open,
+    .bdrv_close      = nfs_file_close,
+    .bdrv_create     = nfs_file_create,

-    .bdrv_co_readv                  = nfs_co_readv,
-    .bdrv_co_writev                 = nfs_co_writev,
-    .bdrv_co_flush_to_disk          = nfs_co_flush,
-
-    .bdrv_detach_aio_context        = nfs_detach_aio_context,
-    .bdrv_attach_aio_context        = nfs_attach_aio_context,
+    .bdrv_co_readv         = nfs_co_readv,
+    .bdrv_co_writev        = nfs_co_writev,
+    .bdrv_co_flush_to_disk = nfs_co_flush,
 };

 static void nfs_block_init(void)
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -50,7 +50,6 @@ BlockDeviceInfo *bdrv_block_device_info(BlockDriverState *bs)
    }

    info->backing_file_depth = bdrv_get_backing_file_depth(bs);
-    info->detect_zeroes = bs->detect_zeroes;

    if (bs->io_limits_enabled) {
        ThrottleConfig cfg;
@@ -293,7 +292,7 @@ void bdrv_query_info(BlockDriverState *bs,
    qapi_free_BlockInfo(info);
 }

-static BlockStats *bdrv_query_stats(const BlockDriverState *bs)
+BlockStats *bdrv_query_stats(const BlockDriverState *bs)
 {
    BlockStats *s;

@@ -360,11 +359,7 @@ BlockStatsList *qmp_query_blockstats(Error **errp)

     while ((bs = bdrv_next(bs))) {
        BlockStatsList *info = g_malloc0(sizeof(*info));
-        AioContext *ctx = bdrv_get_aio_context(bs);
-
-        aio_context_acquire(ctx);
        info->value = bdrv_query_stats(bs);
-        aio_context_release(ctx);

        *p_next = info;
        p_next = &info->next;
@@ -538,11 +533,12 @@ static void dump_qdict(fprintf_function func_fprintf, void *f, int indentation,
 void bdrv_image_info_specific_dump(fprintf_function func_fprintf, void *f,
                                   ImageInfoSpecific *info_spec)
 {
+    Error *local_err = NULL;
    QmpOutputVisitor *ov = qmp_output_visitor_new();
    QObject *obj, *data;

    visit_type_ImageInfoSpecific(qmp_output_get_visitor(ov), &info_spec, NULL,
-                                 &error_abort);
+                                 &local_err);
    obj = qmp_output_get_qobject(ov);
    assert(qobject_type(obj) == QTYPE_QDICT);
    data = qdict_get(qobject_to_qdict(obj), "data");
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -121,8 +121,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
    }
    if (header.version != QCOW_VERSION) {
        char version[64];
-        snprintf(version, sizeof(version), "QCOW version %" PRIu32,
-                 header.version);
+        snprintf(version, sizeof(version), "QCOW version %d", header.version);
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
                  bs->device_name, "qcow", version);
        ret = -ENOTSUP;
@@ -693,29 +692,35 @@ static void qcow_close(BlockDriverState *bs)
    error_free(s->migration_blocker);
 }

-static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
+static int qcow_create(const char *filename, QEMUOptionParameter *options,
+                       Error **errp)
 {
    int header_size, backing_filename_len, l1_size, shift, i;
    QCowHeader header;
    uint8_t *tmp;
    int64_t total_size = 0;
-    char *backing_file = NULL;
+    const char *backing_file = NULL;
    int flags = 0;
    Error *local_err = NULL;
    int ret;
    BlockDriverState *qcow_bs;

    /* Read out options */
-    total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512;
-    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
-        flags |= BLOCK_FLAG_ENCRYPT;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n / 512;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
+            backing_file = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_ENCRYPT)) {
+            flags |= options->value.n ? BLOCK_FLAG_ENCRYPT : 0;
+        }
+        options++;
    }

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, options, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
-        goto cleanup;
+        return ret;
    }

    qcow_bs = NULL;
@@ -723,7 +728,7 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
-        goto cleanup;
+        return ret;
    }

    ret = bdrv_truncate(qcow_bs, 0);
@@ -794,8 +799,6 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
    ret = 0;
 exit:
    bdrv_unref(qcow_bs);
-cleanup:
-    g_free(backing_file);
    return ret;
 }

@@ -908,28 +911,24 @@ static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return 0;
 }

-static QemuOptsList qcow_create_opts = {
-    .name = "qcow-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(qcow_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FILE,
-            .type = QEMU_OPT_STRING,
-            .help = "File name of a base image"
-        },
-        {
-            .name = BLOCK_OPT_ENCRYPT,
-            .type = QEMU_OPT_BOOL,
-            .help = "Encrypt the image",
-            .def_value_str = "off"
-        },
-        { /* end of list */ }
-    }
+
+static QEMUOptionParameter qcow_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_BACKING_FILE,
+        .type = OPT_STRING,
+        .help = "File name of a base image"
+    },
+    {
+        .name = BLOCK_OPT_ENCRYPT,
+        .type = OPT_FLAG,
+        .help = "Encrypt the image"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_qcow = {
@@ -938,10 +937,9 @@ static BlockDriver bdrv_qcow = {
    .bdrv_probe		= qcow_probe,
    .bdrv_open		= qcow_open,
    .bdrv_close		= qcow_close,
-    .bdrv_reopen_prepare    = qcow_reopen_prepare,
-    .bdrv_create            = qcow_create,
+    .bdrv_reopen_prepare = qcow_reopen_prepare,
+    .bdrv_create	= qcow_create,
    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
-    .supports_backing       = true,

    .bdrv_co_readv          = qcow_co_readv,
    .bdrv_co_writev         = qcow_co_writev,
@@ -952,7 +950,7 @@ static BlockDriver bdrv_qcow = {
    .bdrv_write_compressed  = qcow_write_compressed,
    .bdrv_get_info          = qcow_get_info,

-    .create_opts            = &qcow_create_opts,
+    .create_options = qcow_create_options,
 };

 static void bdrv_qcow_init(void)
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -42,13 +42,6 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    if (min_size <= s->l1_size)
        return 0;

-    /* Do a sanity check on min_size before trying to calculate new_l1_size
-     * (this prevents overflows during the while loop for the calculation of
-     * new_l1_size) */
-    if (min_size > INT_MAX / sizeof(uint64_t)) {
-        return -EFBIG;
-    }
-
    if (exact_size) {
        new_l1_size = min_size;
    } else {
@@ -379,8 +372,7 @@ static int coroutine_fn copy_sectors(BlockDriverState *bs,
    BLKDBG_EVENT(bs->file, BLKDBG_COW_READ);

    if (!bs->drv) {
-        ret = -ENOMEDIUM;
-        goto out;
+        return -ENOMEDIUM;
    }

    /* Call .bdrv_co_readv() directly instead of using the public block-layer
@@ -1368,9 +1360,9 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);

    for (i = 0; i < nb_clusters; i++) {
-        uint64_t old_l2_entry;
+        uint64_t old_offset;

-        old_l2_entry = be64_to_cpu(l2_table[l2_index + i]);
+        old_offset = be64_to_cpu(l2_table[l2_index + i]);

        /*
         * Make sure that a discarded area reads back as zeroes for v3 images
@@ -1381,22 +1373,12 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
         * TODO We might want to use bdrv_get_block_status(bs) here, but we're
         * holding s->lock, so that doesn't work today.
         */
-        switch (qcow2_get_cluster_type(old_l2_entry)) {
-            case QCOW2_CLUSTER_UNALLOCATED:
-                if (!bs->backing_hd) {
-                    continue;
-                }
-                break;
+        if (old_offset & QCOW_OFLAG_ZERO) {
+            continue;
+        }

-            case QCOW2_CLUSTER_ZERO:
-                continue;
-
-            case QCOW2_CLUSTER_NORMAL:
-            case QCOW2_CLUSTER_COMPRESSED:
-                break;
-
-            default:
-                abort();
+        if ((old_offset & L2E_OFFSET_MASK) == 0 && !bs->backing_hd) {
+            continue;
        }

        /* First remove L2 entries */
@@ -1408,7 +1390,7 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
        }

        /* Then decrease the refcount */
-        qcow2_free_any_clusters(bs, old_l2_entry, 1, type);
+        qcow2_free_any_clusters(bs, old_offset, 1, type);
    }

    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -27,7 +27,6 @@
 #include "block/qcow2.h"
 #include "qemu/range.h"
 #include "qapi/qmp/types.h"
-#include "qapi-event.h"

 static int64_t alloc_clusters_noref(BlockDriverState *bs, uint64_t size);
 static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
@@ -654,15 +653,6 @@ retry:
            goto retry;
        }
    }
-
-    /* Make sure that all offsets in the "allocated" range are representable
-     * in an int64_t */
-    if (s->free_cluster_index > 0 &&
-        s->free_cluster_index - 1 > (INT64_MAX >> s->cluster_bits))
-    {
-        return -EFBIG;
-    }
-
 #ifdef DEBUG_ALLOC2
    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
            size,
@@ -1490,11 +1480,6 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    int ret;

    size = bdrv_getlength(bs->file);
-    if (size < 0) {
-        res->check_errors++;
-        return size;
-    }
-
    nb_clusters = size_to_clusters(s, size);
    if (nb_clusters > INT_MAX) {
        res->check_errors++;
@@ -1808,6 +1793,7 @@ int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
    } else if (ret > 0) {
        int metadata_ol_bitnr = ffs(ret) - 1;
        char *message;
+        QObject *data;

        assert(metadata_ol_bitnr < QCOW2_OL_MAX_BITNR);

@@ -1816,14 +1802,12 @@ int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
                metadata_ol_names[metadata_ol_bitnr]);
        message = g_strdup_printf("Prevented %s overwrite",
                metadata_ol_names[metadata_ol_bitnr]);
-        qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
-                                              message,
-                                              true,
-                                              offset,
-                                              true,
-                                              size,
-                                              &error_abort);
+        data = qobject_from_jsonf("{ 'device': %s, 'msg': %s, 'offset': %"
+                PRId64 ", 'size': %" PRId64 " }", bs->device_name, message,
+                offset, size);
+        monitor_protocol_event(QEVENT_BLOCK_IMAGE_CORRUPTED, data);
        g_free(message);
+        qobject_decref(data);

        qcow2_mark_corrupt(bs);
        bs->drv = NULL; /* make BDS unusable */
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -31,7 +31,6 @@
 #include "qapi/qmp/qerror.h"
 #include "qapi/qmp/qbool.h"
 #include "trace.h"
-#include "qemu/option_int.h"

 /*
  Differences with QCOW:
@@ -125,9 +124,8 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,

        case QCOW2_EXT_MAGIC_BACKING_FORMAT:
            if (ext.len >= sizeof(bs->backing_format)) {
-                error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
-                           " too large (>=%zu)", ext.len,
-                           sizeof(bs->backing_format));
+                error_setg(errp, "ERROR: ext_backing_format: len=%u too large"
+                           " (>=%zu)", ext.len, sizeof(bs->backing_format));
                return 2;
            }
            ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
@@ -210,31 +208,20 @@ static void GCC_FMT_ATTR(3, 4) report_unsupported(BlockDriverState *bs,
 static void report_unsupported_feature(BlockDriverState *bs,
    Error **errp, Qcow2Feature *table, uint64_t mask)
 {
-    char *features = g_strdup("");
-    char *old;
-
    while (table && table->name[0] != '\0') {
        if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
-            if (mask & (1ULL << table->bit)) {
-                old = features;
-                features = g_strdup_printf("%s%s%.46s", old, *old ? ", " : "",
-                                           table->name);
-                g_free(old);
-                mask &= ~(1ULL << table->bit);
+            if (mask & (1 << table->bit)) {
+                report_unsupported(bs, errp, "%.46s", table->name);
+                mask &= ~(1 << table->bit);
            }
        }
        table++;
    }

    if (mask) {
-        old = features;
-        features = g_strdup_printf("%s%sUnknown incompatible feature: %" PRIx64,
-                                   old, *old ? ", " : "", mask);
-        g_free(old);
+        report_unsupported(bs, errp, "Unknown incompatible feature: %" PRIx64,
+                           mask);
    }
-
-    report_unsupported(bs, errp, "%s", features);
-    g_free(features);
 }

 /*
@@ -496,7 +483,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }
    if (header.version < 2 || header.version > 3) {
-        report_unsupported(bs, errp, "QCOW version %" PRIu32, header.version);
+        report_unsupported(bs, errp, "QCOW version %d", header.version);
        ret = -ENOTSUP;
        goto fail;
    }
@@ -506,8 +493,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
    /* Initialise cluster size */
    if (header.cluster_bits < MIN_CLUSTER_BITS ||
        header.cluster_bits > MAX_CLUSTER_BITS) {
-        error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
-                   header.cluster_bits);
+        error_setg(errp, "Unsupported cluster size: 2^%i", header.cluster_bits);
        ret = -EINVAL;
        goto fail;
    }
@@ -605,7 +591,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
    s->refcount_order = header.refcount_order;

    if (header.crypt_method > QCOW_CRYPT_AES) {
-        error_setg(errp, "Unsupported encryption method: %" PRIu32,
+        error_setg(errp, "Unsupported encryption method: %i",
                   header.crypt_method);
        ret = -EINVAL;
        goto fail;
@@ -866,11 +852,13 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
    return ret;
 }

-static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
+static int qcow2_refresh_limits(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;

    bs->bl.write_zeroes_alignment = s->cluster_sectors;
+
+    return 0;
 }

 static int qcow2_set_key(BlockDriverState *bs, const char *key)
@@ -1029,20 +1017,11 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
                n1 = qcow2_backing_read1(bs->backing_hd, &hd_qiov,
                    sector_num, cur_nr_sectors);
                if (n1 > 0) {
-                    QEMUIOVector local_qiov;
-
-                    qemu_iovec_init(&local_qiov, hd_qiov.niov);
-                    qemu_iovec_concat(&local_qiov, &hd_qiov, 0,
-                                      n1 * BDRV_SECTOR_SIZE);
-
                    BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
                    qemu_co_mutex_unlock(&s->lock);
                    ret = bdrv_co_readv(bs->backing_hd, sector_num,
-                                        n1, &local_qiov);
+                                        n1, &hd_qiov);
                    qemu_co_mutex_lock(&s->lock);
-
-                    qemu_iovec_destroy(&local_qiov);
-
                    if (ret < 0) {
                        goto fail;
                    }
@@ -1613,7 +1592,7 @@ static int preallocate(BlockDriverState *bs)
 static int qcow2_create2(const char *filename, int64_t total_size,
                         const char *backing_file, const char *backing_format,
                         int flags, size_t cluster_size, int prealloc,
-                         QemuOpts *opts, int version,
+                         QEMUOptionParameter *options, int version,
                         Error **errp)
 {
    /* Calculate cluster_bits */
@@ -1645,7 +1624,7 @@ static int qcow2_create2(const char *filename, int64_t total_size,
    Error *local_err = NULL;
    int ret;

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, options, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        return ret;
@@ -1781,11 +1760,11 @@ out:
    return ret;
 }

-static int qcow2_create(const char *filename, QemuOpts *opts, Error **errp)
+static int qcow2_create(const char *filename, QEMUOptionParameter *options,
+                        Error **errp)
 {
-    char *backing_file = NULL;
-    char *backing_fmt = NULL;
-    char *buf = NULL;
+    const char *backing_file = NULL;
+    const char *backing_fmt = NULL;
    uint64_t sectors = 0;
    int flags = 0;
    size_t cluster_size = DEFAULT_CLUSTER_SIZE;
@@ -1795,66 +1774,64 @@ static int qcow2_create(const char *filename, QemuOpts *opts, Error **errp)
    int ret;

    /* Read out options */
-    sectors = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512;
-    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    backing_fmt = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FMT);
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
-        flags |= BLOCK_FLAG_ENCRYPT;
-    }
-    cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
-                                         DEFAULT_CLUSTER_SIZE);
-    buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
-    if (!buf || !strcmp(buf, "off")) {
-        prealloc = 0;
-    } else if (!strcmp(buf, "metadata")) {
-        prealloc = 1;
-    } else {
-        error_setg(errp, "Invalid preallocation mode: '%s'", buf);
-        ret = -EINVAL;
-        goto finish;
-    }
-    g_free(buf);
-    buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
-    if (!buf) {
-        /* keep the default */
-    } else if (!strcmp(buf, "0.10")) {
-        version = 2;
-    } else if (!strcmp(buf, "1.1")) {
-        version = 3;
-    } else {
-        error_setg(errp, "Invalid compatibility level: '%s'", buf);
-        ret = -EINVAL;
-        goto finish;
-    }
-
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_LAZY_REFCOUNTS, false)) {
-        flags |= BLOCK_FLAG_LAZY_REFCOUNTS;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            sectors = options->value.n / 512;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
+            backing_file = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FMT)) {
+            backing_fmt = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_ENCRYPT)) {
+            flags |= options->value.n ? BLOCK_FLAG_ENCRYPT : 0;
+        } else if (!strcmp(options->name, BLOCK_OPT_CLUSTER_SIZE)) {
+            if (options->value.n) {
+                cluster_size = options->value.n;
+            }
+        } else if (!strcmp(options->name, BLOCK_OPT_PREALLOC)) {
+            if (!options->value.s || !strcmp(options->value.s, "off")) {
+                prealloc = 0;
+            } else if (!strcmp(options->value.s, "metadata")) {
+                prealloc = 1;
+            } else {
+                error_setg(errp, "Invalid preallocation mode: '%s'",
+                           options->value.s);
+                return -EINVAL;
+            }
+        } else if (!strcmp(options->name, BLOCK_OPT_COMPAT_LEVEL)) {
+            if (!options->value.s) {
+                /* keep the default */
+            } else if (!strcmp(options->value.s, "0.10")) {
+                version = 2;
+            } else if (!strcmp(options->value.s, "1.1")) {
+                version = 3;
+            } else {
+                error_setg(errp, "Invalid compatibility level: '%s'",
+                           options->value.s);
+                return -EINVAL;
+            }
+        } else if (!strcmp(options->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
+            flags |= options->value.n ? BLOCK_FLAG_LAZY_REFCOUNTS : 0;
+        }
+        options++;
    }

    if (backing_file && prealloc) {
        error_setg(errp, "Backing file and preallocation cannot be used at "
                   "the same time");
-        ret = -EINVAL;
-        goto finish;
+        return -EINVAL;
    }

    if (version < 3 && (flags & BLOCK_FLAG_LAZY_REFCOUNTS)) {
        error_setg(errp, "Lazy refcounts only supported with compatibility "
                   "level 1.1 and above (use compat=1.1 or greater)");
-        ret = -EINVAL;
-        goto finish;
+        return -EINVAL;
    }

    ret = qcow2_create2(filename, sectors, backing_file, backing_fmt, flags,
-                        cluster_size, prealloc, opts, version, &local_err);
+                        cluster_size, prealloc, options, version, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
    }
-
-finish:
-    g_free(backing_file);
-    g_free(backing_fmt);
-    g_free(buf);
    return ret;
 }

@@ -2219,72 +2196,64 @@ static int qcow2_downgrade(BlockDriverState *bs, int target_version)
    return 0;
 }

-static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts)
+static int qcow2_amend_options(BlockDriverState *bs,
+                               QEMUOptionParameter *options)
 {
    BDRVQcowState *s = bs->opaque;
    int old_version = s->qcow_version, new_version = old_version;
    uint64_t new_size = 0;
    const char *backing_file = NULL, *backing_format = NULL;
    bool lazy_refcounts = s->use_lazy_refcounts;
-    const char *compat = NULL;
-    uint64_t cluster_size = s->cluster_size;
-    bool encrypt;
    int ret;
-    QemuOptDesc *desc = opts->list->desc;
+    int i;

-    while (desc && desc->name) {
-        if (!qemu_opt_find(opts, desc->name)) {
+    for (i = 0; options[i].name; i++)
+    {
+        if (!options[i].assigned) {
            /* only change explicitly defined options */
-            desc++;
            continue;
        }

-        if (!strcmp(desc->name, "compat")) {
-            compat = qemu_opt_get(opts, "compat");
-            if (!compat) {
+        if (!strcmp(options[i].name, "compat")) {
+            if (!options[i].value.s) {
                /* preserve default */
-            } else if (!strcmp(compat, "0.10")) {
+            } else if (!strcmp(options[i].value.s, "0.10")) {
                new_version = 2;
-            } else if (!strcmp(compat, "1.1")) {
+            } else if (!strcmp(options[i].value.s, "1.1")) {
                new_version = 3;
            } else {
-                fprintf(stderr, "Unknown compatibility level %s.\n", compat);
+                fprintf(stderr, "Unknown compatibility level %s.\n",
+                        options[i].value.s);
                return -EINVAL;
            }
-        } else if (!strcmp(desc->name, "preallocation")) {
+        } else if (!strcmp(options[i].name, "preallocation")) {
            fprintf(stderr, "Cannot change preallocation mode.\n");
            return -ENOTSUP;
-        } else if (!strcmp(desc->name, "size")) {
-            new_size = qemu_opt_get_size(opts, "size", 0);
-        } else if (!strcmp(desc->name, "backing_file")) {
-            backing_file = qemu_opt_get(opts, "backing_file");
-        } else if (!strcmp(desc->name, "backing_fmt")) {
-            backing_format = qemu_opt_get(opts, "backing_fmt");
-        } else if (!strcmp(desc->name, "encryption")) {
-            encrypt = qemu_opt_get_bool(opts, "encryption", s->crypt_method);
-            if (encrypt != !!s->crypt_method) {
+        } else if (!strcmp(options[i].name, "size")) {
+            new_size = options[i].value.n;
+        } else if (!strcmp(options[i].name, "backing_file")) {
+            backing_file = options[i].value.s;
+        } else if (!strcmp(options[i].name, "backing_fmt")) {
+            backing_format = options[i].value.s;
+        } else if (!strcmp(options[i].name, "encryption")) {
+            if ((options[i].value.n != !!s->crypt_method)) {
                fprintf(stderr, "Changing the encryption flag is not "
                        "supported.\n");
                return -ENOTSUP;
            }
-        } else if (!strcmp(desc->name, "cluster_size")) {
-            cluster_size = qemu_opt_get_size(opts, "cluster_size",
-                                             cluster_size);
-            if (cluster_size != s->cluster_size) {
+        } else if (!strcmp(options[i].name, "cluster_size")) {
+            if (options[i].value.n != s->cluster_size) {
                fprintf(stderr, "Changing the cluster size is not "
                        "supported.\n");
                return -ENOTSUP;
            }
-        } else if (!strcmp(desc->name, "lazy_refcounts")) {
-            lazy_refcounts = qemu_opt_get_bool(opts, "lazy_refcounts",
-                                               lazy_refcounts);
+        } else if (!strcmp(options[i].name, "lazy_refcounts")) {
+            lazy_refcounts = options[i].value.n;
        } else {
            /* if this assertion fails, this probably means a new option was
             * added without having it covered here */
            assert(false);
        }
-
-        desc++;
    }

    if (new_version != old_version) {
@@ -2353,55 +2322,49 @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts)
    return 0;
 }

-static QemuOptsList qcow2_create_opts = {
-    .name = "qcow2-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_COMPAT_LEVEL,
-            .type = QEMU_OPT_STRING,
-            .help = "Compatibility level (0.10 or 1.1)"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FILE,
-            .type = QEMU_OPT_STRING,
-            .help = "File name of a base image"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FMT,
-            .type = QEMU_OPT_STRING,
-            .help = "Image format of the base image"
-        },
-        {
-            .name = BLOCK_OPT_ENCRYPT,
-            .type = QEMU_OPT_BOOL,
-            .help = "Encrypt the image",
-            .def_value_str = "off"
-        },
-        {
-            .name = BLOCK_OPT_CLUSTER_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "qcow2 cluster size",
-            .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
-        },
-        {
-            .name = BLOCK_OPT_PREALLOC,
-            .type = QEMU_OPT_STRING,
-            .help = "Preallocation mode (allowed values: off, metadata)"
-        },
-        {
-            .name = BLOCK_OPT_LAZY_REFCOUNTS,
-            .type = QEMU_OPT_BOOL,
-            .help = "Postpone refcount updates",
-            .def_value_str = "off"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter qcow2_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_COMPAT_LEVEL,
+        .type = OPT_STRING,
+        .help = "Compatibility level (0.10 or 1.1)"
+    },
+    {
+        .name = BLOCK_OPT_BACKING_FILE,
+        .type = OPT_STRING,
+        .help = "File name of a base image"
+    },
+    {
+        .name = BLOCK_OPT_BACKING_FMT,
+        .type = OPT_STRING,
+        .help = "Image format of the base image"
+    },
+    {
+        .name = BLOCK_OPT_ENCRYPT,
+        .type = OPT_FLAG,
+        .help = "Encrypt the image"
+    },
+    {
+        .name = BLOCK_OPT_CLUSTER_SIZE,
+        .type = OPT_SIZE,
+        .help = "qcow2 cluster size",
+        .value = { .n = DEFAULT_CLUSTER_SIZE },
+    },
+    {
+        .name = BLOCK_OPT_PREALLOC,
+        .type = OPT_STRING,
+        .help = "Preallocation mode (allowed values: off, metadata)"
+    },
+    {
+        .name = BLOCK_OPT_LAZY_REFCOUNTS,
+        .type = OPT_FLAG,
+        .help = "Postpone refcount updates",
+    },
+    { NULL }
 };

 static BlockDriver bdrv_qcow2 = {
@@ -2429,22 +2392,21 @@ static BlockDriver bdrv_qcow2 = {
    .bdrv_snapshot_goto     = qcow2_snapshot_goto,
    .bdrv_snapshot_delete   = qcow2_snapshot_delete,
    .bdrv_snapshot_list     = qcow2_snapshot_list,
-    .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
-    .bdrv_get_info          = qcow2_get_info,
+    .bdrv_snapshot_load_tmp     = qcow2_snapshot_load_tmp,
+    .bdrv_get_info      = qcow2_get_info,
    .bdrv_get_specific_info = qcow2_get_specific_info,

    .bdrv_save_vmstate    = qcow2_save_vmstate,
    .bdrv_load_vmstate    = qcow2_load_vmstate,

-    .supports_backing           = true,
    .bdrv_change_backing_file   = qcow2_change_backing_file,

    .bdrv_refresh_limits        = qcow2_refresh_limits,
    .bdrv_invalidate_cache      = qcow2_invalidate_cache,

-    .create_opts         = &qcow2_create_opts,
-    .bdrv_check          = qcow2_check,
-    .bdrv_amend_options  = qcow2_amend_options,
+    .create_options = qcow2_create_options,
+    .bdrv_check = qcow2_check,
+    .bdrv_amend_options = qcow2_amend_options,
 };

 static void bdrv_qcow2_init(void)
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -173,7 +173,7 @@ int qed_read_l1_table_sync(BDRVQEDState *s)
    qed_read_table(s, s->header.l1_table_offset,
                   s->l1_table, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(s->bs), true);
+        qemu_aio_wait();
    }

    return ret;
@@ -194,7 +194,7 @@ int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,

    qed_write_l1_table(s, index, n, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(s->bs), true);
+        qemu_aio_wait();
    }

    return ret;
@@ -267,7 +267,7 @@ int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request, uint64_t offset

    qed_read_l2_table(s, request, offset, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(s->bs), true);
+        qemu_aio_wait();
    }

    return ret;
@@ -289,7 +289,7 @@ int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,

    qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(s->bs), true);
+        qemu_aio_wait();
    }

    return ret;
--- a/block/qed.c
+++ b/block/qed.c
@@ -21,13 +21,12 @@
 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    QEDAIOCB *acb = (QEDAIOCB *)blockacb;
-    AioContext *aio_context = bdrv_get_aio_context(blockacb->bs);
    bool finished = false;

    /* Wait for the request to finish */
    acb->finished = &finished;
    while (!finished) {
-        aio_poll(aio_context, true);
+        qemu_aio_wait();
    }
 }

@@ -374,27 +373,6 @@ static void bdrv_qed_rebind(BlockDriverState *bs)
    s->bs = bs;
 }

-static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVQEDState *s = bs->opaque;
-
-    qed_cancel_need_check_timer(s);
-    timer_free(s->need_check_timer);
-}
-
-static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
-                                        AioContext *new_context)
-{
-    BDRVQEDState *s = bs->opaque;
-
-    s->need_check_timer = aio_timer_new(new_context,
-                                        QEMU_CLOCK_VIRTUAL, SCALE_NS,
-                                        qed_need_check_timer_cb, s);
-    if (s->header.features & QED_F_NEED_CHECK) {
-        qed_start_need_check_timer(s);
-    }
-}
-
 static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp)
 {
@@ -518,7 +496,8 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
        }
    }

-    bdrv_qed_attach_aio_context(bs, bdrv_get_aio_context(bs));
+    s->need_check_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                            qed_need_check_timer_cb, s);

 out:
    if (ret) {
@@ -528,11 +507,13 @@ out:
    return ret;
 }

-static void bdrv_qed_refresh_limits(BlockDriverState *bs, Error **errp)
+static int bdrv_qed_refresh_limits(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;

    bs->bl.write_zeroes_alignment = s->header.cluster_size >> BDRV_SECTOR_BITS;
+
+    return 0;
 }

 /* We have nothing to do for QED reopen, stubs just return
@@ -547,7 +528,8 @@ static void bdrv_qed_close(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;

-    bdrv_qed_detach_aio_context(bs);
+    qed_cancel_need_check_timer(s);
+    timer_free(s->need_check_timer);

    /* Ensure writes reach stable storage */
    bdrv_flush(bs->file);
@@ -565,7 +547,7 @@ static void bdrv_qed_close(BlockDriverState *bs)
 static int qed_create(const char *filename, uint32_t cluster_size,
                      uint64_t image_size, uint32_t table_size,
                      const char *backing_file, const char *backing_fmt,
-                      QemuOpts *opts, Error **errp)
+                      Error **errp)
 {
    QEDHeader header = {
        .magic = QED_MAGIC,
@@ -584,7 +566,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,
    int ret = 0;
    BlockDriverState *bs;

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        return ret;
@@ -639,53 +621,53 @@ out:
    return ret;
 }

-static int bdrv_qed_create(const char *filename, QemuOpts *opts, Error **errp)
+static int bdrv_qed_create(const char *filename, QEMUOptionParameter *options,
+                           Error **errp)
 {
    uint64_t image_size = 0;
    uint32_t cluster_size = QED_DEFAULT_CLUSTER_SIZE;
    uint32_t table_size = QED_DEFAULT_TABLE_SIZE;
-    char *backing_file = NULL;
-    char *backing_fmt = NULL;
-    int ret;
+    const char *backing_file = NULL;
+    const char *backing_fmt = NULL;

-    image_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    backing_fmt = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FMT);
-    cluster_size = qemu_opt_get_size_del(opts,
-                                         BLOCK_OPT_CLUSTER_SIZE,
-                                         QED_DEFAULT_CLUSTER_SIZE);
-    table_size = qemu_opt_get_size_del(opts, BLOCK_OPT_TABLE_SIZE,
-                                       QED_DEFAULT_TABLE_SIZE);
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            image_size = options->value.n;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
+            backing_file = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FMT)) {
+            backing_fmt = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_CLUSTER_SIZE)) {
+            if (options->value.n) {
+                cluster_size = options->value.n;
+            }
+        } else if (!strcmp(options->name, BLOCK_OPT_TABLE_SIZE)) {
+            if (options->value.n) {
+                table_size = options->value.n;
+            }
+        }
+        options++;
+    }

    if (!qed_is_cluster_size_valid(cluster_size)) {
-        error_setg(errp, "QED cluster size must be within range [%u, %u] "
-                         "and power of 2",
-                   QED_MIN_CLUSTER_SIZE, QED_MAX_CLUSTER_SIZE);
-        ret = -EINVAL;
-        goto finish;
+        fprintf(stderr, "QED cluster size must be within range [%u, %u] and power of 2\n",
+                QED_MIN_CLUSTER_SIZE, QED_MAX_CLUSTER_SIZE);
+        return -EINVAL;
    }
    if (!qed_is_table_size_valid(table_size)) {
-        error_setg(errp, "QED table size must be within range [%u, %u] "
-                         "and power of 2",
-                   QED_MIN_TABLE_SIZE, QED_MAX_TABLE_SIZE);
-        ret = -EINVAL;
-        goto finish;
+        fprintf(stderr, "QED table size must be within range [%u, %u] and power of 2\n",
+                QED_MIN_TABLE_SIZE, QED_MAX_TABLE_SIZE);
+        return -EINVAL;
    }
    if (!qed_is_image_size_valid(image_size, cluster_size, table_size)) {
-        error_setg(errp, "QED image size must be a non-zero multiple of "
-                         "cluster size and less than %" PRIu64 " bytes",
-                   qed_max_image_size(cluster_size, table_size));
-        ret = -EINVAL;
-        goto finish;
+        fprintf(stderr, "QED image size must be a non-zero multiple of "
+                        "cluster size and less than %" PRIu64 " bytes\n",
+                qed_max_image_size(cluster_size, table_size));
+        return -EINVAL;
    }

-    ret = qed_create(filename, cluster_size, image_size, table_size,
-                     backing_file, backing_fmt, opts, errp);
-
-finish:
-    g_free(backing_file);
-    g_free(backing_fmt);
-    return ret;
+    return qed_create(filename, cluster_size, image_size, table_size,
+                      backing_file, backing_fmt, errp);
 }

 typedef struct {
@@ -759,19 +741,17 @@ static BDRVQEDState *acb_to_s(QEDAIOCB *acb)
 /**
 * Read from the backing file or zero-fill if no backing file
 *
- * @s:              QED state
- * @pos:            Byte position in device
- * @qiov:           Destination I/O vector
- * @backing_qiov:   Possibly shortened copy of qiov, to be allocated here
- * @cb:             Completion function
- * @opaque:         User data for completion function
+ * @s:          QED state
+ * @pos:        Byte position in device
+ * @qiov:       Destination I/O vector
+ * @cb:         Completion function
+ * @opaque:     User data for completion function
 *
 * This function reads qiov->size bytes starting at pos from the backing file.
 * If there is no backing file then zeroes are read.
 */
 static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
                                  QEMUIOVector *qiov,
-                                  QEMUIOVector **backing_qiov,
                                  BlockDriverCompletionFunc *cb, void *opaque)
 {
    uint64_t backing_length = 0;
@@ -804,21 +784,15 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* If the read straddles the end of the backing file, shorten it */
    size = MIN((uint64_t)backing_length - pos, qiov->size);

-    assert(*backing_qiov == NULL);
-    *backing_qiov = g_new(QEMUIOVector, 1);
-    qemu_iovec_init(*backing_qiov, qiov->niov);
-    qemu_iovec_concat(*backing_qiov, qiov, 0, size);
-
    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
    bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
-                   *backing_qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
+                   qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
 }

 typedef struct {
    GenericCB gencb;
    BDRVQEDState *s;
    QEMUIOVector qiov;
-    QEMUIOVector *backing_qiov;
    struct iovec iov;
    uint64_t offset;
 } CopyFromBackingFileCB;
@@ -835,12 +809,6 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
    CopyFromBackingFileCB *copy_cb = opaque;
    BDRVQEDState *s = copy_cb->s;

-    if (copy_cb->backing_qiov) {
-        qemu_iovec_destroy(copy_cb->backing_qiov);
-        g_free(copy_cb->backing_qiov);
-        copy_cb->backing_qiov = NULL;
-    }
-
    if (ret) {
        qed_copy_from_backing_file_cb(copy_cb, ret);
        return;
@@ -878,12 +846,11 @@ static void qed_copy_from_backing_file(BDRVQEDState *s, uint64_t pos,
    copy_cb = gencb_alloc(sizeof(*copy_cb), cb, opaque);
    copy_cb->s = s;
    copy_cb->offset = offset;
-    copy_cb->backing_qiov = NULL;
    copy_cb->iov.iov_base = qemu_blockalign(s->bs, len);
    copy_cb->iov.iov_len = len;
    qemu_iovec_init_external(&copy_cb->qiov, &copy_cb->iov, 1);

-    qed_read_backing_file(s, pos, &copy_cb->qiov, &copy_cb->backing_qiov,
+    qed_read_backing_file(s, pos, &copy_cb->qiov,
                          qed_copy_from_backing_file_write, copy_cb);
 }

@@ -950,8 +917,7 @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)

    /* Arrange for a bh to invoke the completion function */
    acb->bh_ret = ret;
-    acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
-                         qed_aio_complete_bh, acb);
+    acb->bh = qemu_bh_new(qed_aio_complete_bh, acb);
    qemu_bh_schedule(acb->bh);

    /* Start next allocating write request waiting behind this one.  Note that
@@ -1326,7 +1292,7 @@ static void qed_aio_read_data(void *opaque, int ret,
        return;
    } else if (ret != QED_CLUSTER_FOUND) {
        qed_read_backing_file(s, acb->cur_pos, &acb->cur_qiov,
-                              &acb->backing_qiov, qed_aio_next_io, acb);
+                              qed_aio_next_io, acb);
        return;
    }

@@ -1352,12 +1318,6 @@ static void qed_aio_next_io(void *opaque, int ret)

    trace_qed_aio_next_io(s, acb, ret, acb->cur_pos + acb->cur_qiov.size);

-    if (acb->backing_qiov) {
-        qemu_iovec_destroy(acb->backing_qiov);
-        g_free(acb->backing_qiov);
-        acb->backing_qiov = NULL;
-    }
-
    /* Handle I/O error */
    if (ret) {
        qed_aio_complete(acb, ret);
@@ -1397,7 +1357,6 @@ static BlockDriverAIOCB *qed_aio_setup(BlockDriverState *bs,
    acb->qiov_offset = 0;
    acb->cur_pos = (uint64_t)sector_num * BDRV_SECTOR_SIZE;
    acb->end_pos = acb->cur_pos + nb_sectors * BDRV_SECTOR_SIZE;
-    acb->backing_qiov = NULL;
    acb->request.l2_table = NULL;
    qemu_iovec_init(&acb->cur_qiov, qiov->niov);

@@ -1634,45 +1593,36 @@ static int bdrv_qed_check(BlockDriverState *bs, BdrvCheckResult *result,
    return qed_check(s, result, !!fix);
 }

-static QemuOptsList qed_create_opts = {
-    .name = "qed-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(qed_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FILE,
-            .type = QEMU_OPT_STRING,
-            .help = "File name of a base image"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FMT,
-            .type = QEMU_OPT_STRING,
-            .help = "Image format of the base image"
-        },
-        {
-            .name = BLOCK_OPT_CLUSTER_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Cluster size (in bytes)",
-            .def_value_str = stringify(QED_DEFAULT_CLUSTER_SIZE)
-        },
-        {
-            .name = BLOCK_OPT_TABLE_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "L1/L2 table size (in clusters)"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter qed_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size (in bytes)"
+    }, {
+        .name = BLOCK_OPT_BACKING_FILE,
+        .type = OPT_STRING,
+        .help = "File name of a base image"
+    }, {
+        .name = BLOCK_OPT_BACKING_FMT,
+        .type = OPT_STRING,
+        .help = "Image format of the base image"
+    }, {
+        .name = BLOCK_OPT_CLUSTER_SIZE,
+        .type = OPT_SIZE,
+        .help = "Cluster size (in bytes)",
+        .value = { .n = QED_DEFAULT_CLUSTER_SIZE },
+    }, {
+        .name = BLOCK_OPT_TABLE_SIZE,
+        .type = OPT_SIZE,
+        .help = "L1/L2 table size (in clusters)"
+    },
+    { /* end of list */ }
 };

 static BlockDriver bdrv_qed = {
    .format_name              = "qed",
    .instance_size            = sizeof(BDRVQEDState),
-    .create_opts              = &qed_create_opts,
-    .supports_backing         = true,
+    .create_options           = qed_create_options,

    .bdrv_probe               = bdrv_qed_probe,
    .bdrv_rebind              = bdrv_qed_rebind,
@@ -1692,8 +1642,6 @@ static BlockDriver bdrv_qed = {
    .bdrv_change_backing_file = bdrv_qed_change_backing_file,
    .bdrv_invalidate_cache    = bdrv_qed_invalidate_cache,
    .bdrv_check               = bdrv_qed_check,
-    .bdrv_detach_aio_context  = bdrv_qed_detach_aio_context,
-    .bdrv_attach_aio_context  = bdrv_qed_attach_aio_context,
 };

 static void bdrv_qed_init(void)
--- a/block/qed.h
+++ b/block/qed.h
@@ -43,7 +43,7 @@
 *
 * All fields are little-endian on disk.
 */
-#define  QED_DEFAULT_CLUSTER_SIZE  65536
+
 enum {
    QED_MAGIC = 'Q' | 'E' << 8 | 'D' << 16 | '\0' << 24,

@@ -69,6 +69,7 @@ enum {
     */
    QED_MIN_CLUSTER_SIZE = 4 * 1024, /* in bytes */
    QED_MAX_CLUSTER_SIZE = 64 * 1024 * 1024,
+    QED_DEFAULT_CLUSTER_SIZE = 64 * 1024,

    /* Allocated clusters are tracked using a 2-level pagetable.  Table size is
     * a multiple of clusters so large maximum image sizes can be supported
@@ -142,7 +143,6 @@ typedef struct QEDAIOCB {

    /* Current cluster scatter-gather list */
    QEMUIOVector cur_qiov;
-    QEMUIOVector *backing_qiov;
    uint64_t cur_pos;               /* position on block device, in bytes */
    uint64_t cur_cluster;           /* cluster offset in image file */
    unsigned int cur_nclusters;     /* number of clusters being accessed */
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -17,13 +17,11 @@
 #include <gnutls/crypto.h>
 #include "block/block_int.h"
 #include "qapi/qmp/qjson.h"
-#include "qapi-event.h"

 #define HASH_LENGTH 32

 #define QUORUM_OPT_VOTE_THRESHOLD "vote-threshold"
 #define QUORUM_OPT_BLKVERIFY      "blkverify"
-#define QUORUM_OPT_REWRITE        "rewrite-corrupted"

 /* This union holds a vote hash value */
 typedef union QuorumVoteValue {
@@ -71,9 +69,6 @@ typedef struct BDRVQuorumState {
                            * It is useful to debug other block drivers by
                            * comparing them with a reference one.
                            */
-    bool rewrite_corrupted;/* true if the driver must rewrite-on-read corrupted
-                            * block if Quorum is reached.
-                            */
 } BDRVQuorumState;

 typedef struct QuorumAIOCB QuorumAIOCB;
@@ -109,17 +104,13 @@ struct QuorumAIOCB {
    int count;                  /* number of completed AIOCB */
    int success_count;          /* number of successfully completed AIOCB */

-    int rewrite_count;          /* number of replica to rewrite: count down to
-                                 * zero once writes are fired
-                                 */
-
    QuorumVotes votes;

    bool is_read;
    int vote_ret;
 };

-static bool quorum_vote(QuorumAIOCB *acb);
+static void quorum_vote(QuorumAIOCB *acb);

 static void quorum_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -191,7 +182,6 @@ static QuorumAIOCB *quorum_aio_get(BDRVQuorumState *s,
    acb->qcrs = g_new0(QuorumChildRequest, s->num_children);
    acb->count = 0;
    acb->success_count = 0;
-    acb->rewrite_count = 0;
    acb->votes.compare = quorum_sha256_compare;
    QLIST_INIT(&acb->votes.vote_list);
    acb->is_read = false;
@@ -208,22 +198,32 @@ static QuorumAIOCB *quorum_aio_get(BDRVQuorumState *s,

 static void quorum_report_bad(QuorumAIOCB *acb, char *node_name, int ret)
 {
-    const char *msg = NULL;
+    QObject *data;
+    assert(node_name);
+    data = qobject_from_jsonf("{ 'node-name': %s"
+                              ", 'sector-num': %" PRId64
+                              ", 'sectors-count': %d }",
+                              node_name, acb->sector_num, acb->nb_sectors);
    if (ret < 0) {
-        msg = strerror(-ret);
+        QDict *dict = qobject_to_qdict(data);
+        qdict_put(dict, "error", qstring_from_str(strerror(-ret)));
    }
-    qapi_event_send_quorum_report_bad(!!msg, msg, node_name,
-                                      acb->sector_num, acb->nb_sectors, &error_abort);
+    monitor_protocol_event(QEVENT_QUORUM_REPORT_BAD, data);
+    qobject_decref(data);
 }

 static void quorum_report_failure(QuorumAIOCB *acb)
 {
+    QObject *data;
    const char *reference = acb->common.bs->device_name[0] ?
                            acb->common.bs->device_name :
                            acb->common.bs->node_name;
-
-    qapi_event_send_quorum_failure(reference, acb->sector_num,
-                                   acb->nb_sectors, &error_abort);
+    data = qobject_from_jsonf("{ 'reference': %s"
+                              ", 'sector-num': %" PRId64
+                              ", 'sectors-count': %d }",
+                              reference, acb->sector_num, acb->nb_sectors);
+    monitor_protocol_event(QEVENT_QUORUM_FAILURE, data);
+    qobject_decref(data);
 }

 static int quorum_vote_error(QuorumAIOCB *acb);
@@ -241,27 +241,11 @@ static bool quorum_has_too_much_io_failed(QuorumAIOCB *acb)
    return false;
 }

-static void quorum_rewrite_aio_cb(void *opaque, int ret)
-{
-    QuorumAIOCB *acb = opaque;
-
-    /* one less rewrite to do */
-    acb->rewrite_count--;
-
-    /* wait until all rewrite callbacks have completed */
-    if (acb->rewrite_count) {
-        return;
-    }
-
-    quorum_aio_finalize(acb);
-}
-
 static void quorum_aio_cb(void *opaque, int ret)
 {
    QuorumChildRequest *sacb = opaque;
    QuorumAIOCB *acb = sacb->parent;
    BDRVQuorumState *s = acb->common.bs->opaque;
-    bool rewrite = false;

    sacb->ret = ret;
    acb->count++;
@@ -278,15 +262,12 @@ static void quorum_aio_cb(void *opaque, int ret)

    /* Do the vote on read */
    if (acb->is_read) {
-        rewrite = quorum_vote(acb);
+        quorum_vote(acb);
    } else {
        quorum_has_too_much_io_failed(acb);
    }

-    /* if no rewrite is done the code will finish right away */
-    if (!rewrite) {
-        quorum_aio_finalize(acb);
-    }
+    quorum_aio_finalize(acb);
 }

 static void quorum_report_bad_versions(BDRVQuorumState *s,
@@ -306,43 +287,6 @@ static void quorum_report_bad_versions(BDRVQuorumState *s,
    }
 }

-static bool quorum_rewrite_bad_versions(BDRVQuorumState *s, QuorumAIOCB *acb,
-                                        QuorumVoteValue *value)
-{
-    QuorumVoteVersion *version;
-    QuorumVoteItem *item;
-    int count = 0;
-
-    /* first count the number of bad versions: done first to avoid concurrency
-     * issues.
-     */
-    QLIST_FOREACH(version, &acb->votes.vote_list, next) {
-        if (acb->votes.compare(&version->value, value)) {
-            continue;
-        }
-        QLIST_FOREACH(item, &version->items, next) {
-            count++;
-        }
-    }
-
-    /* quorum_rewrite_aio_cb will count down this to zero */
-    acb->rewrite_count = count;
-
-    /* now fire the correcting rewrites */
-    QLIST_FOREACH(version, &acb->votes.vote_list, next) {
-        if (acb->votes.compare(&version->value, value)) {
-            continue;
-        }
-        QLIST_FOREACH(item, &version->items, next) {
-            bdrv_aio_writev(s->bs[item->index], acb->sector_num, acb->qiov,
-                            acb->nb_sectors, quorum_rewrite_aio_cb, acb);
-        }
-    }
-
-    /* return true if any rewrite is done else false */
-    return count;
-}
-
 static void quorum_copy_qiov(QEMUIOVector *dest, QEMUIOVector *source)
 {
    int i;
@@ -533,17 +477,16 @@ static int quorum_vote_error(QuorumAIOCB *acb)
    return ret;
 }

-static bool quorum_vote(QuorumAIOCB *acb)
+static void quorum_vote(QuorumAIOCB *acb)
 {
    bool quorum = true;
-    bool rewrite = false;
    int i, j, ret;
    QuorumVoteValue hash;
    BDRVQuorumState *s = acb->common.bs->opaque;
    QuorumVoteVersion *winner;

    if (quorum_has_too_much_io_failed(acb)) {
-        return false;
+        return;
    }

    /* get the index of the first successful read */
@@ -571,7 +514,7 @@ static bool quorum_vote(QuorumAIOCB *acb)
    /* Every successful read agrees */
    if (quorum) {
        quorum_copy_qiov(acb->qiov, &acb->qcrs[i].qiov);
-        return false;
+        return;
    }

    /* compute hashes for each successful read, also store indexes */
@@ -604,15 +547,9 @@ static bool quorum_vote(QuorumAIOCB *acb)
    /* some versions are bad print them */
    quorum_report_bad_versions(s, acb, &winner->value);

-    /* corruption correction is enabled */
-    if (s->rewrite_corrupted) {
-        rewrite = quorum_rewrite_bad_versions(s, acb, &winner->value);
-    }
-
 free_exit:
    /* free lists */
    quorum_free_vote_list(&acb->votes);
-    return rewrite;
 }

 static BlockDriverAIOCB *quorum_aio_readv(BlockDriverState *bs,
@@ -777,11 +714,6 @@ static QemuOptsList quorum_runtime_opts = {
            .type = QEMU_OPT_BOOL,
            .help = "Trigger block verify mode if set",
        },
-        {
-            .name = QUORUM_OPT_REWRITE,
-            .type = QEMU_OPT_BOOL,
-            .help = "Rewrite corrupted block on read quorum",
-        },
        { /* end of list */ }
    },
 };
@@ -821,7 +753,7 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,

    opts = qemu_opts_create(&quorum_runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
+    if (error_is_set(&local_err)) {
        ret = -EINVAL;
        goto exit;
    }
@@ -843,14 +775,6 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
                "and using two files with vote_threshold=2\n");
    }

-    s->rewrite_corrupted = qemu_opt_get_bool(opts, QUORUM_OPT_REWRITE, false);
-    if (s->rewrite_corrupted && s->is_blkverify) {
-        error_setg(&local_err,
-                   "rewrite-corrupted=on cannot be used with blkverify=on");
-        ret = -EINVAL;
-        goto exit;
-    }
-
    /* allocate the children BlockDriverState array */
    s->bs = g_new0(BlockDriverState *, s->num_children);
    opened = g_new0(bool, s->num_children);
@@ -904,7 +828,7 @@ close_exit:
    g_free(opened);
 exit:
    /* propagate error */
-    if (local_err) {
+    if (error_is_set(&local_err)) {
        error_propagate(errp, local_err);
    }
    QDECREF(list);
@@ -924,49 +848,25 @@ static void quorum_close(BlockDriverState *bs)
    g_free(s->bs);
 }

-static void quorum_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVQuorumState *s = bs->opaque;
-    int i;
-
-    for (i = 0; i < s->num_children; i++) {
-        bdrv_detach_aio_context(s->bs[i]);
-    }
-}
-
-static void quorum_attach_aio_context(BlockDriverState *bs,
-                                      AioContext *new_context)
-{
-    BDRVQuorumState *s = bs->opaque;
-    int i;
-
-    for (i = 0; i < s->num_children; i++) {
-        bdrv_attach_aio_context(s->bs[i], new_context);
-    }
-}
-
 static BlockDriver bdrv_quorum = {
-    .format_name                        = "quorum",
-    .protocol_name                      = "quorum",
+    .format_name        = "quorum",
+    .protocol_name      = "quorum",

-    .instance_size                      = sizeof(BDRVQuorumState),
+    .instance_size      = sizeof(BDRVQuorumState),

-    .bdrv_file_open                     = quorum_open,
-    .bdrv_close                         = quorum_close,
+    .bdrv_file_open     = quorum_open,
+    .bdrv_close         = quorum_close,

-    .bdrv_co_flush_to_disk              = quorum_co_flush,
+    .bdrv_co_flush_to_disk = quorum_co_flush,

-    .bdrv_getlength                     = quorum_getlength,
+    .bdrv_getlength     = quorum_getlength,

-    .bdrv_aio_readv                     = quorum_aio_readv,
-    .bdrv_aio_writev                    = quorum_aio_writev,
-    .bdrv_invalidate_cache              = quorum_invalidate_cache,
+    .bdrv_aio_readv     = quorum_aio_readv,
+    .bdrv_aio_writev    = quorum_aio_writev,
+    .bdrv_invalidate_cache = quorum_invalidate_cache,

-    .bdrv_detach_aio_context            = quorum_detach_aio_context,
-    .bdrv_attach_aio_context            = quorum_attach_aio_context,
-
-    .is_filter                          = true,
-    .bdrv_recurse_is_first_non_filter   = quorum_recurse_is_first_non_filter,
+    .is_filter           = true,
+    .bdrv_recurse_is_first_non_filter = quorum_recurse_is_first_non_filter,
 };

 static void bdrv_quorum_init(void)
--- a/block/raw-aio.h
+++ b/block/raw-aio.h
@@ -34,29 +34,19 @@
 /* linux-aio.c - Linux native implementation */
 #ifdef CONFIG_LINUX_AIO
 void *laio_init(void);
-void laio_cleanup(void *s);
 BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type);
-void laio_detach_aio_context(void *s, AioContext *old_context);
-void laio_attach_aio_context(void *s, AioContext *new_context);
-void laio_io_plug(BlockDriverState *bs, void *aio_ctx);
-int laio_io_unplug(BlockDriverState *bs, void *aio_ctx, bool unplug);
 #endif

 #ifdef _WIN32
 typedef struct QEMUWin32AIOState QEMUWin32AIOState;
 QEMUWin32AIOState *win32_aio_init(void);
-void win32_aio_cleanup(QEMUWin32AIOState *aio);
 int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile);
 BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
        QEMUWin32AIOState *aio, HANDLE hfile,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type);
-void win32_aio_detach_aio_context(QEMUWin32AIOState *aio,
-                                  AioContext *old_context);
-void win32_aio_attach_aio_context(QEMUWin32AIOState *aio,
-                                  AioContext *new_context);
 #endif

 #endif /* QEMU_RAW_AIO_H */
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -55,9 +55,6 @@
 #include <linux/cdrom.h>
 #include <linux/fd.h>
 #include <linux/fs.h>
-#ifndef FS_NOCOW_FL
-#define FS_NOCOW_FL                     0x00800000 /* Do not cow file */
-#endif
 #endif
 #ifdef CONFIG_FIEMAP
 #include <linux/fiemap.h>
@@ -149,9 +146,6 @@ typedef struct BDRVRawState {
    bool has_discard:1;
    bool has_write_zeroes:1;
    bool discard_zeroes:1;
-#ifdef CONFIG_FIEMAP
-    bool skip_fiemap;
-#endif
 } BDRVRawState;

 typedef struct BDRVRawReopenState {
@@ -221,7 +215,7 @@ static int raw_normalize_devicepath(const char **filename)
 }
 #endif

-static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
+static void raw_probe_alignment(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
    char *buf;
@@ -240,24 +234,24 @@ static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
    s->buf_align = 0;

 #ifdef BLKSSZGET
-    if (ioctl(fd, BLKSSZGET, &sector_size) >= 0) {
+    if (ioctl(s->fd, BLKSSZGET, &sector_size) >= 0) {
        bs->request_alignment = sector_size;
    }
 #endif
 #ifdef DKIOCGETBLOCKSIZE
-    if (ioctl(fd, DKIOCGETBLOCKSIZE, &sector_size) >= 0) {
+    if (ioctl(s->fd, DKIOCGETBLOCKSIZE, &sector_size) >= 0) {
        bs->request_alignment = sector_size;
    }
 #endif
 #ifdef DIOCGSECTORSIZE
-    if (ioctl(fd, DIOCGSECTORSIZE, &sector_size) >= 0) {
+    if (ioctl(s->fd, DIOCGSECTORSIZE, &sector_size) >= 0) {
        bs->request_alignment = sector_size;
    }
 #endif
 #ifdef CONFIG_XFS
    if (s->is_xfs) {
        struct dioattr da;
-        if (xfsctl(NULL, fd, XFS_IOC_DIOINFO, &da) >= 0) {
+        if (xfsctl(NULL, s->fd, XFS_IOC_DIOINFO, &da) >= 0) {
            bs->request_alignment = da.d_miniosz;
            /* The kernel returns wrong information for d_mem */
            /* s->buf_align = da.d_mem; */
@@ -270,7 +264,7 @@ static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
        size_t align;
        buf = qemu_memalign(MAX_BLOCKSIZE, 2 * MAX_BLOCKSIZE);
        for (align = 512; align <= MAX_BLOCKSIZE; align <<= 1) {
-            if (pread(fd, buf + align, MAX_BLOCKSIZE, 0) >= 0) {
+            if (pread(s->fd, buf + align, MAX_BLOCKSIZE, 0) >= 0) {
                s->buf_align = align;
                break;
            }
@@ -282,18 +276,13 @@ static void raw_probe_alignment(BlockDriverState *bs, int fd, Error **errp)
        size_t align;
        buf = qemu_memalign(s->buf_align, MAX_BLOCKSIZE);
        for (align = 512; align <= MAX_BLOCKSIZE; align <<= 1) {
-            if (pread(fd, buf, align, 0) >= 0) {
+            if (pread(s->fd, buf, align, 0) >= 0) {
                bs->request_alignment = align;
                break;
            }
        }
        qemu_vfree(buf);
    }
-
-    if (!s->buf_align || !bs->request_alignment) {
-        error_setg(errp, "Could not find working O_DIRECT alignment. "
-                         "Try cache.direct=off.");
-    }
 }

 static void raw_parse_flags(int bdrv_flags, int *open_flags)
@@ -315,29 +304,6 @@ static void raw_parse_flags(int bdrv_flags, int *open_flags)
    }
 }

-static void raw_detach_aio_context(BlockDriverState *bs)
-{
-#ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-
-    if (s->use_aio) {
-        laio_detach_aio_context(s->aio_ctx, bdrv_get_aio_context(bs));
-    }
-#endif
-}
-
-static void raw_attach_aio_context(BlockDriverState *bs,
-                                   AioContext *new_context)
-{
-#ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-
-    if (s->use_aio) {
-        laio_attach_aio_context(s->aio_ctx, new_context);
-    }
-#endif
-}
-
 #ifdef CONFIG_LINUX_AIO
 static int raw_set_aio(void **aio_ctx, int *use_aio, int bdrv_flags)
 {
@@ -400,7 +366,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    BDRVRawState *s = bs->opaque;
    QemuOpts *opts;
    Error *local_err = NULL;
-    const char *filename = NULL;
+    const char *filename;
    int fd, ret;
    struct stat st;

@@ -478,13 +444,8 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    }
 #endif

-    raw_attach_aio_context(bs, bdrv_get_aio_context(bs));
-
    ret = 0;
 fail:
-    if (filename && (bdrv_flags & BDRV_O_TEMPORARY)) {
-        unlink(filename);
-    }
    qemu_opts_del(opts);
    return ret;
 }
@@ -510,7 +471,6 @@ static int raw_reopen_prepare(BDRVReopenState *state,
    BDRVRawState *s;
    BDRVRawReopenState *raw_s;
    int ret = 0;
-    Error *local_err = NULL;

    assert(state != NULL);
    assert(state->bs != NULL);
@@ -583,19 +543,6 @@ static int raw_reopen_prepare(BDRVReopenState *state,
            ret = -1;
        }
    }
-
-    /* Fail already reopen_prepare() if we can't get a working O_DIRECT
-     * alignment with the new fd. */
-    if (raw_s->fd != -1) {
-        raw_probe_alignment(state->bs, raw_s->fd, &local_err);
-        if (local_err) {
-            qemu_close(raw_s->fd);
-            raw_s->fd = -1;
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-        }
-    }
-
    return ret;
 }

@@ -634,12 +581,14 @@ static void raw_reopen_abort(BDRVReopenState *state)
    state->opaque = NULL;
 }

-static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
+static int raw_refresh_limits(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;

-    raw_probe_alignment(bs, s->fd, errp);
+    raw_probe_alignment(bs);
    bs->bl.opt_mem_alignment = s->buf_align;
+
+    return 0;
 }

 static ssize_t handle_aiocb_ioctl(RawPosixAIOData *aiocb)
@@ -807,7 +756,6 @@ static ssize_t handle_aiocb_rw(RawPosixAIOData *aiocb)
            memcpy(p, aiocb->aio_iov[i].iov_base, aiocb->aio_iov[i].iov_len);
            p += aiocb->aio_iov[i].iov_len;
        }
-        assert(p - buf == aiocb->aio_nbytes);
    }

    nbytes = handle_aiocb_rw_linear(aiocb, buf);
@@ -822,11 +770,9 @@ static ssize_t handle_aiocb_rw(RawPosixAIOData *aiocb)
                copy = aiocb->aio_iov[i].iov_len;
            }
            memcpy(aiocb->aio_iov[i].iov_base, p, copy);
-            assert(count >= copy);
            p     += copy;
            count -= copy;
        }
-        assert(count == 0);
    }
    qemu_vfree(buf);

@@ -1013,14 +959,12 @@ static int paio_submit_co(BlockDriverState *bs, int fd,
    acb->aio_type = type;
    acb->aio_fildes = fd;

-    acb->aio_nbytes = nb_sectors * BDRV_SECTOR_SIZE;
-    acb->aio_offset = sector_num * BDRV_SECTOR_SIZE;
-
    if (qiov) {
        acb->aio_iov = qiov->iov;
        acb->aio_niov = qiov->niov;
-        assert(qiov->size == acb->aio_nbytes);
    }
+    acb->aio_nbytes = nb_sectors * 512;
+    acb->aio_offset = sector_num * 512;

    trace_paio_submit_co(sector_num, nb_sectors, type);
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
@@ -1038,14 +982,12 @@ static BlockDriverAIOCB *paio_submit(BlockDriverState *bs, int fd,
    acb->aio_type = type;
    acb->aio_fildes = fd;

-    acb->aio_nbytes = nb_sectors * BDRV_SECTOR_SIZE;
-    acb->aio_offset = sector_num * BDRV_SECTOR_SIZE;
-
    if (qiov) {
        acb->aio_iov = qiov->iov;
        acb->aio_niov = qiov->niov;
-        assert(qiov->size == acb->aio_nbytes);
    }
+    acb->aio_nbytes = nb_sectors * 512;
+    acb->aio_offset = sector_num * 512;

    trace_paio_submit(acb, opaque, sector_num, nb_sectors, type);
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
@@ -1081,36 +1023,6 @@ static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,
                       cb, opaque, type);
 }

-static void raw_aio_plug(BlockDriverState *bs)
-{
-#ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-    if (s->use_aio) {
-        laio_io_plug(bs, s->aio_ctx);
-    }
-#endif
-}
-
-static void raw_aio_unplug(BlockDriverState *bs)
-{
-#ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-    if (s->use_aio) {
-        laio_io_unplug(bs, s->aio_ctx, true);
-    }
-#endif
-}
-
-static void raw_aio_flush_io_queue(BlockDriverState *bs)
-{
-#ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-    if (s->use_aio) {
-        laio_io_unplug(bs, s->aio_ctx, false);
-    }
-#endif
-}
-
 static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque)
@@ -1141,14 +1053,6 @@ static BlockDriverAIOCB *raw_aio_flush(BlockDriverState *bs,
 static void raw_close(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
-
-    raw_detach_aio_context(bs);
-
-#ifdef CONFIG_LINUX_AIO
-    if (s->use_aio) {
-        laio_cleanup(s->aio_ctx);
-    }
-#endif
    if (s->fd >= 0) {
        qemu_close(s->fd);
        s->fd = -1;
@@ -1187,12 +1091,12 @@ static int64_t raw_getlength(BlockDriverState *bs)
    struct stat st;

    if (fstat(fd, &st))
-        return -errno;
+        return -1;
    if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
        struct disklabel dl;

        if (ioctl(fd, DIOCGDINFO, &dl))
-            return -errno;
+            return -1;
        return (uint64_t)dl.d_secsize *
            dl.d_partitions[DISKPART(st.st_rdev)].p_size;
    } else
@@ -1206,7 +1110,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
    struct stat st;

    if (fstat(fd, &st))
-        return -errno;
+        return -1;
    if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
        struct dkwedge_info dkw;

@@ -1216,7 +1120,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
            struct disklabel dl;

            if (ioctl(fd, DIOCGDINFO, &dl))
-                return -errno;
+                return -1;
            return (uint64_t)dl.d_secsize *
                dl.d_partitions[DISKPART(st.st_rdev)].p_size;
        }
@@ -1229,7 +1133,6 @@ static int64_t raw_getlength(BlockDriverState *bs)
    BDRVRawState *s = bs->opaque;
    struct dk_minfo minfo;
    int ret;
-    int64_t size;

    ret = fd_open(bs);
    if (ret < 0) {
@@ -1248,11 +1151,7 @@ static int64_t raw_getlength(BlockDriverState *bs)
     * There are reports that lseek on some devices fails, but
     * irc discussion said that contingency on contingency was overkill.
     */
-    size = lseek(s->fd, 0, SEEK_END);
-    if (size < 0) {
-        return -errno;
-    }
-    return size;
+    return lseek(s->fd, 0, SEEK_END);
 }
 #elif defined(CONFIG_BSD)
 static int64_t raw_getlength(BlockDriverState *bs)
@@ -1287,12 +1186,9 @@ again:
        if (size == 0)
 #endif
 #if defined(__APPLE__) && defined(__MACH__)
-        size = LLONG_MAX;
+        size = LONG_LONG_MAX;
 #else
        size = lseek(fd, 0LL, SEEK_END);
-        if (size < 0) {
-            return -errno;
-        }
 #endif
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
        switch(s->type) {
@@ -1309,9 +1205,6 @@ again:
 #endif
    } else {
        size = lseek(fd, 0, SEEK_END);
-        if (size < 0) {
-            return -errno;
-        }
    }
    return size;
 }
@@ -1320,18 +1213,13 @@ static int64_t raw_getlength(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
    int ret;
-    int64_t size;

    ret = fd_open(bs);
    if (ret < 0) {
        return ret;
    }

-    size = lseek(s->fd, 0, SEEK_END);
-    if (size < 0) {
-        return -errno;
-    }
-    return size;
+    return lseek(s->fd, 0, SEEK_END);
 }
 #endif

@@ -1346,19 +1234,22 @@ static int64_t raw_get_allocated_file_size(BlockDriverState *bs)
    return (int64_t)st.st_blocks * 512;
 }

-static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
+static int raw_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    int fd;
    int result = 0;
    int64_t total_size = 0;
-    bool nocow = false;

    strstart(filename, "file:", &filename);

    /* Read out options */
-    total_size =
-        qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / BDRV_SECTOR_SIZE;
-    nocow = qemu_opt_get_bool(opts, BLOCK_OPT_NOCOW, false);
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n / BDRV_SECTOR_SIZE;
+        }
+        options++;
+    }

    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
                   0644);
@@ -1366,21 +1257,6 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
        result = -errno;
        error_setg_errno(errp, -result, "Could not create file");
    } else {
-        if (nocow) {
-#ifdef __linux__
-            /* Set NOCOW flag to solve performance issue on fs like btrfs.
-             * This is an optimisation. The FS_IOC_SETFLAGS ioctl return value
-             * will be ignored since any failure of this operation should not
-             * block the left work.
-             */
-            int attr;
-            if (ioctl(fd, FS_IOC_GETFLAGS, &attr) == 0) {
-                attr |= FS_NOCOW_FL;
-                ioctl(fd, FS_IOC_SETFLAGS, &attr);
-            }
-#endif
-        }
-
        if (ftruncate(fd, total_size * BDRV_SECTOR_SIZE) != 0) {
            result = -errno;
            error_setg_errno(errp, -result, "Could not resize file");
@@ -1393,83 +1269,6 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
    return result;
 }

-static int64_t try_fiemap(BlockDriverState *bs, off_t start, off_t *data,
-                          off_t *hole, int nb_sectors, int *pnum)
-{
-#ifdef CONFIG_FIEMAP
-    BDRVRawState *s = bs->opaque;
-    int64_t ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
-    struct {
-        struct fiemap fm;
-        struct fiemap_extent fe;
-    } f;
-
-    if (s->skip_fiemap) {
-        return -ENOTSUP;
-    }
-
-    f.fm.fm_start = start;
-    f.fm.fm_length = (int64_t)nb_sectors * BDRV_SECTOR_SIZE;
-    f.fm.fm_flags = 0;
-    f.fm.fm_extent_count = 1;
-    f.fm.fm_reserved = 0;
-    if (ioctl(s->fd, FS_IOC_FIEMAP, &f) == -1) {
-        s->skip_fiemap = true;
-        return -errno;
-    }
-
-    if (f.fm.fm_mapped_extents == 0) {
-        /* No extents found, data is beyond f.fm.fm_start + f.fm.fm_length.
-         * f.fm.fm_start + f.fm.fm_length must be clamped to the file size!
-         */
-        off_t length = lseek(s->fd, 0, SEEK_END);
-        *hole = f.fm.fm_start;
-        *data = MIN(f.fm.fm_start + f.fm.fm_length, length);
-    } else {
-        *data = f.fe.fe_logical;
-        *hole = f.fe.fe_logical + f.fe.fe_length;
-        if (f.fe.fe_flags & FIEMAP_EXTENT_UNWRITTEN) {
-            ret |= BDRV_BLOCK_ZERO;
-        }
-    }
-
-    return ret;
-#else
-    return -ENOTSUP;
-#endif
-}
-
-static int64_t try_seek_hole(BlockDriverState *bs, off_t start, off_t *data,
-                             off_t *hole, int *pnum)
-{
-#if defined SEEK_HOLE && defined SEEK_DATA
-    BDRVRawState *s = bs->opaque;
-
-    *hole = lseek(s->fd, start, SEEK_HOLE);
-    if (*hole == -1) {
-        /* -ENXIO indicates that sector_num was past the end of the file.
-         * There is a virtual hole there.  */
-        assert(errno != -ENXIO);
-
-        return -errno;
-    }
-
-    if (*hole > start) {
-        *data = start;
-    } else {
-        /* On a hole.  We need another syscall to find its end.  */
-        *data = lseek(s->fd, start, SEEK_DATA);
-        if (*data == -1) {
-            *data = lseek(s->fd, 0, SEEK_END);
-        }
-    }
-
-    return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
-#else
-    return -ENOTSUP;
-#endif
-}
-
 /*
 * Returns true iff the specified sector is present in the disk image. Drivers
 * not implementing the functionality are assumed to not support backing files,
@@ -1486,10 +1285,10 @@ static int64_t try_seek_hole(BlockDriverState *bs, off_t start, off_t *data,
 * beyond the end of the disk image it will be clamped.
 */
 static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
-                                                    int64_t sector_num,
-                                                    int nb_sectors, int *pnum)
+                                            int64_t sector_num,
+                                            int nb_sectors, int *pnum)
 {
-    off_t start, data = 0, hole = 0;
+    off_t start, data, hole;
    int64_t ret;

    ret = fd_open(bs);
@@ -1498,18 +1297,71 @@ static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
    }

    start = sector_num * BDRV_SECTOR_SIZE;
+    ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;

-    ret = try_fiemap(bs, start, &data, &hole, nb_sectors, pnum);
-    if (ret < 0) {
-        ret = try_seek_hole(bs, start, &data, &hole, pnum);
-        if (ret < 0) {
-            /* Assume everything is allocated. */
-            data = 0;
-            hole = start + nb_sectors * BDRV_SECTOR_SIZE;
-            ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
+#ifdef CONFIG_FIEMAP
+
+    BDRVRawState *s = bs->opaque;
+    struct {
+        struct fiemap fm;
+        struct fiemap_extent fe;
+    } f;
+
+    f.fm.fm_start = start;
+    f.fm.fm_length = (int64_t)nb_sectors * BDRV_SECTOR_SIZE;
+    f.fm.fm_flags = 0;
+    f.fm.fm_extent_count = 1;
+    f.fm.fm_reserved = 0;
+    if (ioctl(s->fd, FS_IOC_FIEMAP, &f) == -1) {
+        /* Assume everything is allocated.  */
+        *pnum = nb_sectors;
+        return ret;
+    }
+
+    if (f.fm.fm_mapped_extents == 0) {
+        /* No extents found, data is beyond f.fm.fm_start + f.fm.fm_length.
+         * f.fm.fm_start + f.fm.fm_length must be clamped to the file size!
+         */
+        off_t length = lseek(s->fd, 0, SEEK_END);
+        hole = f.fm.fm_start;
+        data = MIN(f.fm.fm_start + f.fm.fm_length, length);
+    } else {
+        data = f.fe.fe_logical;
+        hole = f.fe.fe_logical + f.fe.fe_length;
+        if (f.fe.fe_flags & FIEMAP_EXTENT_UNWRITTEN) {
+            ret |= BDRV_BLOCK_ZERO;
        }
    }

+#elif defined SEEK_HOLE && defined SEEK_DATA
+
+    BDRVRawState *s = bs->opaque;
+
+    hole = lseek(s->fd, start, SEEK_HOLE);
+    if (hole == -1) {
+        /* -ENXIO indicates that sector_num was past the end of the file.
+         * There is a virtual hole there.  */
+        assert(errno != -ENXIO);
+
+        /* Most likely EINVAL.  Assume everything is allocated.  */
+        *pnum = nb_sectors;
+        return ret;
+    }
+
+    if (hole > start) {
+        data = start;
+    } else {
+        /* On a hole.  We need another syscall to find its end.  */
+        data = lseek(s->fd, start, SEEK_DATA);
+        if (data == -1) {
+            data = lseek(s->fd, 0, SEEK_END);
+        }
+    }
+#else
+    data = 0;
+    hole = start + nb_sectors * BDRV_SECTOR_SIZE;
+#endif
+
    if (data <= start) {
        /* On a data extent, compute sectors to the end of the extent.  */
        *pnum = MIN(nb_sectors, (hole - start) / BDRV_SECTOR_SIZE);
@@ -1558,22 +1410,13 @@ static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return 0;
 }

-static QemuOptsList raw_create_opts = {
-    .name = "raw-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(raw_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_NOCOW,
-            .type = QEMU_OPT_BOOL,
-            .help = "Turn off copy-on-write (valid only on btrfs)"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter raw_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_file = {
@@ -1598,9 +1441,6 @@ static BlockDriver bdrv_file = {
    .bdrv_aio_flush = raw_aio_flush,
    .bdrv_aio_discard = raw_aio_discard,
    .bdrv_refresh_limits = raw_refresh_limits,
-    .bdrv_io_plug = raw_aio_plug,
-    .bdrv_io_unplug = raw_aio_unplug,
-    .bdrv_flush_io_queue = raw_aio_flush_io_queue,

    .bdrv_truncate = raw_truncate,
    .bdrv_getlength = raw_getlength,
@@ -1608,10 +1448,7 @@ static BlockDriver bdrv_file = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
-    .create_opts = &raw_create_opts,
+    .create_options = raw_create_options,
 };

 /***********************************************/
@@ -1932,7 +1769,7 @@ static coroutine_fn int hdev_co_write_zeroes(BlockDriverState *bs,
    return -ENOTSUP;
 }

-static int hdev_create(const char *filename, QemuOpts *opts,
+static int hdev_create(const char *filename, QEMUOptionParameter *options,
                       Error **errp)
 {
    int fd;
@@ -1953,8 +1790,12 @@ static int hdev_create(const char *filename, QemuOpts *opts,
    (void)has_prefix;

    /* Read out options */
-    total_size =
-        qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / BDRV_SECTOR_SIZE;
+    while (options && options->name) {
+        if (!strcmp(options->name, "size")) {
+            total_size = options->value.n / BDRV_SECTOR_SIZE;
+        }
+        options++;
+    }

    fd = qemu_open(filename, O_WRONLY | O_BINARY);
    if (fd < 0) {
@@ -1991,8 +1832,8 @@ static BlockDriver bdrv_host_device = {
    .bdrv_reopen_prepare = raw_reopen_prepare,
    .bdrv_reopen_commit  = raw_reopen_commit,
    .bdrv_reopen_abort   = raw_reopen_abort,
-    .bdrv_create         = hdev_create,
-    .create_opts         = &raw_create_opts,
+    .bdrv_create        = hdev_create,
+    .create_options     = raw_create_options,
    .bdrv_co_write_zeroes = hdev_co_write_zeroes,

    .bdrv_aio_readv	= raw_aio_readv,
@@ -2000,9 +1841,6 @@ static BlockDriver bdrv_host_device = {
    .bdrv_aio_flush	= raw_aio_flush,
    .bdrv_aio_discard   = hdev_aio_discard,
    .bdrv_refresh_limits = raw_refresh_limits,
-    .bdrv_io_plug = raw_aio_plug,
-    .bdrv_io_unplug = raw_aio_unplug,
-    .bdrv_flush_io_queue = raw_aio_flush_io_queue,

    .bdrv_truncate      = raw_truncate,
    .bdrv_getlength	= raw_getlength,
@@ -2010,9 +1848,6 @@ static BlockDriver bdrv_host_device = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
    /* generic scsi device */
 #ifdef __linux__
    .bdrv_ioctl         = hdev_ioctl,
@@ -2141,16 +1976,13 @@ static BlockDriver bdrv_host_floppy = {
    .bdrv_reopen_prepare = raw_reopen_prepare,
    .bdrv_reopen_commit  = raw_reopen_commit,
    .bdrv_reopen_abort   = raw_reopen_abort,
-    .bdrv_create         = hdev_create,
-    .create_opts         = &raw_create_opts,
+    .bdrv_create        = hdev_create,
+    .create_options     = raw_create_options,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,
    .bdrv_refresh_limits = raw_refresh_limits,
-    .bdrv_io_plug = raw_aio_plug,
-    .bdrv_io_unplug = raw_aio_unplug,
-    .bdrv_flush_io_queue = raw_aio_flush_io_queue,

    .bdrv_truncate      = raw_truncate,
    .bdrv_getlength      = raw_getlength,
@@ -2158,9 +1990,6 @@ static BlockDriver bdrv_host_floppy = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
    /* removable device support */
    .bdrv_is_inserted   = floppy_is_inserted,
    .bdrv_media_changed = floppy_media_changed,
@@ -2272,16 +2101,13 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_reopen_prepare = raw_reopen_prepare,
    .bdrv_reopen_commit  = raw_reopen_commit,
    .bdrv_reopen_abort   = raw_reopen_abort,
-    .bdrv_create         = hdev_create,
-    .create_opts         = &raw_create_opts,
+    .bdrv_create        = hdev_create,
+    .create_options     = raw_create_options,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,
    .bdrv_refresh_limits = raw_refresh_limits,
-    .bdrv_io_plug = raw_aio_plug,
-    .bdrv_io_unplug = raw_aio_unplug,
-    .bdrv_flush_io_queue = raw_aio_flush_io_queue,

    .bdrv_truncate      = raw_truncate,
    .bdrv_getlength      = raw_getlength,
@@ -2289,9 +2115,6 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
@@ -2410,15 +2233,12 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_reopen_commit  = raw_reopen_commit,
    .bdrv_reopen_abort   = raw_reopen_abort,
    .bdrv_create        = hdev_create,
-    .create_opts        = &raw_create_opts,
+    .create_options     = raw_create_options,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,
    .bdrv_refresh_limits = raw_refresh_limits,
-    .bdrv_io_plug = raw_aio_plug,
-    .bdrv_io_unplug = raw_aio_unplug,
-    .bdrv_flush_io_queue = raw_aio_flush_io_queue,

    .bdrv_truncate      = raw_truncate,
    .bdrv_getlength      = raw_getlength,
@@ -2426,9 +2246,6 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
@@ -2436,6 +2253,40 @@ static BlockDriver bdrv_host_cdrom = {
 };
 #endif /* __FreeBSD__ */

+#ifdef CONFIG_LINUX_AIO
+/**
+ * Return the file descriptor for Linux AIO
+ *
+ * This function is a layering violation and should be removed when it becomes
+ * possible to call the block layer outside the global mutex.  It allows the
+ * caller to hijack the file descriptor so I/O can be performed outside the
+ * block layer.
+ */
+int raw_get_aio_fd(BlockDriverState *bs)
+{
+    BDRVRawState *s;
+
+    if (!bs->drv) {
+        return -ENOMEDIUM;
+    }
+
+    if (bs->drv == bdrv_find_format("raw")) {
+        bs = bs->file;
+    }
+
+    /* raw-posix has several protocols so just check for raw_aio_readv */
+    if (bs->drv->bdrv_aio_readv != raw_aio_readv) {
+        return -ENOTSUP;
+    }
+
+    s = bs->opaque;
+    if (!s->use_aio) {
+        return -ENOTSUP;
+    }
+    return s->fd;
+}
+#endif /* CONFIG_LINUX_AIO */
+
 static void bdrv_file_init(void)
 {
    /*
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -36,6 +36,8 @@
 #define FTYPE_CD     1
 #define FTYPE_HARDDISK 2

+static QEMUWin32AIOState *aio;
+
 typedef struct RawWin32AIOData {
    BlockDriverState *bs;
    HANDLE hfile;
@@ -200,25 +202,6 @@ static int set_sparse(int fd)
 				 NULL, 0, NULL, 0, &returned, NULL);
 }

-static void raw_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-
-    if (s->aio) {
-        win32_aio_detach_aio_context(s->aio, bdrv_get_aio_context(bs));
-    }
-}
-
-static void raw_attach_aio_context(BlockDriverState *bs,
-                                   AioContext *new_context)
-{
-    BDRVRawState *s = bs->opaque;
-
-    if (s->aio) {
-        win32_aio_attach_aio_context(s->aio, new_context);
-    }
-}
-
 static void raw_probe_alignment(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
@@ -317,6 +300,15 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,

    raw_parse_flags(flags, &access_flags, &overlapped);

+    if ((flags & BDRV_O_NATIVE_AIO) && aio == NULL) {
+        aio = win32_aio_init();
+        if (aio == NULL) {
+            error_setg(errp, "Could not initialize AIO");
+            ret = -EINVAL;
+            goto fail;
+        }
+    }
+
    if (filename[0] && filename[1] == ':') {
        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", filename[0]);
    } else if (filename[0] == '\\' && filename[1] == '\\') {
@@ -343,23 +335,13 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
    }

    if (flags & BDRV_O_NATIVE_AIO) {
-        s->aio = win32_aio_init();
-        if (s->aio == NULL) {
-            CloseHandle(s->hfile);
-            error_setg(errp, "Could not initialize AIO");
-            ret = -EINVAL;
-            goto fail;
-        }
-
-        ret = win32_aio_attach(s->aio, s->hfile);
+        ret = win32_aio_attach(aio, s->hfile);
        if (ret < 0) {
-            win32_aio_cleanup(s->aio);
            CloseHandle(s->hfile);
            error_setg_errno(errp, -ret, "Could not enable AIO");
            goto fail;
        }
-
-        win32_aio_attach_aio_context(s->aio, bdrv_get_aio_context(bs));
+        s->aio = aio;
    }

    raw_probe_alignment(bs);
@@ -407,17 +389,7 @@ static BlockDriverAIOCB *raw_aio_flush(BlockDriverState *bs,
 static void raw_close(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
-
-    if (s->aio) {
-        win32_aio_detach_aio_context(s->aio, bdrv_get_aio_context(bs));
-        win32_aio_cleanup(s->aio);
-        s->aio = NULL;
-    }
-
    CloseHandle(s->hfile);
-    if (bs->open_flags & BDRV_O_TEMPORARY) {
-        unlink(bs->filename);
-    }
 }

 static int raw_truncate(BlockDriverState *bs, int64_t offset)
@@ -503,7 +475,8 @@ static int64_t raw_get_allocated_file_size(BlockDriverState *bs)
    return st.st_size;
 }

-static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
+static int raw_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    int fd;
    int64_t total_size = 0;
@@ -511,8 +484,12 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
    strstart(filename, "file:", &filename);

    /* Read out options */
-    total_size =
-        qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n / 512;
+        }
+        options++;
+    }

    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
                   0644);
@@ -526,18 +503,13 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
    return 0;
 }

-
-static QemuOptsList raw_create_opts = {
-    .name = "raw-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(raw_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter raw_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_file = {
@@ -546,9 +518,9 @@ static BlockDriver bdrv_file = {
    .instance_size	= sizeof(BDRVRawState),
    .bdrv_needs_filename = true,
    .bdrv_parse_filename = raw_parse_filename,
-    .bdrv_file_open     = raw_open,
-    .bdrv_close         = raw_close,
-    .bdrv_create        = raw_create,
+    .bdrv_file_open	= raw_open,
+    .bdrv_close		= raw_close,
+    .bdrv_create	= raw_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,

    .bdrv_aio_readv     = raw_aio_readv,
@@ -560,7 +532,7 @@ static BlockDriver bdrv_file = {
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,

-    .create_opts        = &raw_create_opts,
+    .create_options = raw_create_options,
 };

 /***********************************************/
@@ -709,9 +681,6 @@ static BlockDriver bdrv_host_device = {
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush     = raw_aio_flush,

-    .bdrv_detach_aio_context = raw_detach_aio_context,
-    .bdrv_attach_aio_context = raw_attach_aio_context,
-
    .bdrv_getlength      = raw_getlength,
    .has_variable_length = true,

--- a/block/raw_bsd.c
+++ b/block/raw_bsd.c
@@ -29,17 +29,13 @@
 #include "block/block_int.h"
 #include "qemu/option.h"

-static QemuOptsList raw_create_opts = {
-    .name = "raw-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(raw_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter raw_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    { 0 }
 };

 static int raw_reopen_prepare(BDRVReopenState *reopen_state,
@@ -94,9 +90,10 @@ static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return bdrv_get_info(bs->file, bdi);
 }

-static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
+static int raw_refresh_limits(BlockDriverState *bs)
 {
    bs->bl = bs->file->bl;
+    return 0;
 }

 static int raw_truncate(BlockDriverState *bs, int64_t offset)
@@ -142,12 +139,13 @@ static int raw_has_zero_init(BlockDriverState *bs)
    return bdrv_has_zero_init(bs->file);
 }

-static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
+static int raw_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    Error *local_err = NULL;
    int ret;

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, options, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
    }
@@ -196,7 +194,7 @@ static BlockDriver bdrv_raw = {
    .bdrv_lock_medium     = &raw_lock_medium,
    .bdrv_ioctl           = &raw_ioctl,
    .bdrv_aio_ioctl       = &raw_aio_ioctl,
-    .create_opts          = &raw_create_opts,
+    .create_options       = &raw_create_options[0],
    .bdrv_has_zero_init   = &raw_has_zero_init
 };

--- a/block/rbd.c
+++ b/block/rbd.c
@@ -105,7 +105,7 @@ typedef struct BDRVRBDState {
 static int qemu_rbd_next_tok(char *dst, int dst_len,
                             char *src, char delim,
                             const char *name,
-                             char **p, Error **errp)
+                             char **p)
 {
    int l;
    char *end;
@@ -128,10 +128,10 @@ static int qemu_rbd_next_tok(char *dst, int dst_len,
    }
    l = strlen(src);
    if (l >= dst_len) {
-        error_setg(errp, "%s too long", name);
+        error_report("%s too long", name);
        return -EINVAL;
    } else if (l == 0) {
-        error_setg(errp, "%s too short", name);
+        error_report("%s too short", name);
        return -EINVAL;
    }

@@ -157,15 +157,13 @@ static int qemu_rbd_parsename(const char *filename,
                              char *pool, int pool_len,
                              char *snap, int snap_len,
                              char *name, int name_len,
-                              char *conf, int conf_len,
-                              Error **errp)
+                              char *conf, int conf_len)
 {
    const char *start;
    char *p, *buf;
    int ret;

    if (!strstart(filename, "rbd:", &start)) {
-        error_setg(errp, "File name must start with 'rbd:'");
        return -EINVAL;
    }

@@ -174,8 +172,7 @@ static int qemu_rbd_parsename(const char *filename,
    *snap = '\0';
    *conf = '\0';

-    ret = qemu_rbd_next_tok(pool, pool_len, p,
-                            '/', "pool name", &p, errp);
+    ret = qemu_rbd_next_tok(pool, pool_len, p, '/', "pool name", &p);
    if (ret < 0 || !p) {
        ret = -EINVAL;
        goto done;
@@ -183,25 +180,21 @@ static int qemu_rbd_parsename(const char *filename,
    qemu_rbd_unescape(pool);

    if (strchr(p, '@')) {
-        ret = qemu_rbd_next_tok(name, name_len, p,
-                                '@', "object name", &p, errp);
+        ret = qemu_rbd_next_tok(name, name_len, p, '@', "object name", &p);
        if (ret < 0) {
            goto done;
        }
-        ret = qemu_rbd_next_tok(snap, snap_len, p,
-                                ':', "snap name", &p, errp);
+        ret = qemu_rbd_next_tok(snap, snap_len, p, ':', "snap name", &p);
        qemu_rbd_unescape(snap);
    } else {
-        ret = qemu_rbd_next_tok(name, name_len, p,
-                                ':', "object name", &p, errp);
+        ret = qemu_rbd_next_tok(name, name_len, p, ':', "object name", &p);
    }
    qemu_rbd_unescape(name);
    if (ret < 0 || !p) {
        goto done;
    }

-    ret = qemu_rbd_next_tok(conf, conf_len, p,
-                            '\0', "configuration", &p, errp);
+    ret = qemu_rbd_next_tok(conf, conf_len, p, '\0', "configuration", &p);

 done:
    g_free(buf);
@@ -236,7 +229,7 @@ static char *qemu_rbd_parse_clientname(const char *conf, char *clientname)
    return NULL;
 }

-static int qemu_rbd_set_conf(rados_t cluster, const char *conf, Error **errp)
+static int qemu_rbd_set_conf(rados_t cluster, const char *conf)
 {
    char *p, *buf;
    char name[RBD_MAX_CONF_NAME_SIZE];
@@ -248,20 +241,20 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf, Error **errp)

    while (p) {
        ret = qemu_rbd_next_tok(name, sizeof(name), p,
-                                '=', "conf option name", &p, errp);
+                                '=', "conf option name", &p);
        if (ret < 0) {
            break;
        }
        qemu_rbd_unescape(name);

        if (!p) {
-            error_setg(errp, "conf option %s has no value", name);
+            error_report("conf option %s has no value", name);
            ret = -EINVAL;
            break;
        }

        ret = qemu_rbd_next_tok(value, sizeof(value), p,
-                                ':', "conf option value", &p, errp);
+                                ':', "conf option value", &p);
        if (ret < 0) {
            break;
        }
@@ -270,7 +263,7 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf, Error **errp)
        if (strcmp(name, "conf") == 0) {
            ret = rados_conf_read_file(cluster, value);
            if (ret < 0) {
-                error_setg(errp, "error reading conf file %s", value);
+                error_report("error reading conf file %s", value);
                break;
            }
        } else if (strcmp(name, "id") == 0) {
@@ -278,7 +271,7 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf, Error **errp)
        } else {
            ret = rados_conf_set(cluster, name, value);
            if (ret < 0) {
-                error_setg(errp, "invalid conf option %s", name);
+                error_report("invalid conf option %s", name);
                ret = -EINVAL;
                break;
            }
@@ -289,9 +282,9 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf, Error **errp)
    return ret;
 }

-static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
+static int qemu_rbd_create(const char *filename, QEMUOptionParameter *options,
+                           Error **errp)
 {
-    Error *local_err = NULL;
    int64_t bytes = 0;
    int64_t objsize;
    int obj_order = 0;
@@ -308,29 +301,34 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
    if (qemu_rbd_parsename(filename, pool, sizeof(pool),
                           snap_buf, sizeof(snap_buf),
                           name, sizeof(name),
-                           conf, sizeof(conf), &local_err) < 0) {
-        error_propagate(errp, local_err);
+                           conf, sizeof(conf)) < 0) {
        return -EINVAL;
    }

    /* Read out options */
-    bytes = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-    objsize = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE, 0);
-    if (objsize) {
-        if ((objsize - 1) & objsize) {    /* not a power of 2? */
-            error_setg(errp, "obj size needs to be power of 2");
-            return -EINVAL;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            bytes = options->value.n;
+        } else if (!strcmp(options->name, BLOCK_OPT_CLUSTER_SIZE)) {
+            if (options->value.n) {
+                objsize = options->value.n;
+                if ((objsize - 1) & objsize) {    /* not a power of 2? */
+                    error_report("obj size needs to be power of 2");
+                    return -EINVAL;
+                }
+                if (objsize < 4096) {
+                    error_report("obj size too small");
+                    return -EINVAL;
+                }
+                obj_order = ffs(objsize) - 1;
+            }
        }
-        if (objsize < 4096) {
-            error_setg(errp, "obj size too small");
-            return -EINVAL;
-        }
-        obj_order = ffs(objsize) - 1;
+        options++;
    }

    clientname = qemu_rbd_parse_clientname(conf, clientname_buf);
    if (rados_create(&cluster, clientname) < 0) {
-        error_setg(errp, "error initializing");
+        error_report("error initializing");
        return -EIO;
    }

@@ -340,20 +338,20 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
    }

    if (conf[0] != '\0' &&
-        qemu_rbd_set_conf(cluster, conf, &local_err) < 0) {
+        qemu_rbd_set_conf(cluster, conf) < 0) {
+        error_report("error setting config options");
        rados_shutdown(cluster);
-        error_propagate(errp, local_err);
        return -EIO;
    }

    if (rados_connect(cluster) < 0) {
-        error_setg(errp, "error connecting");
+        error_report("error connecting");
        rados_shutdown(cluster);
        return -EIO;
    }

    if (rados_ioctx_create(cluster, pool, &io_ctx) < 0) {
-        error_setg(errp, "error opening pool %s", pool);
+        error_report("error opening pool %s", pool);
        rados_shutdown(cluster);
        return -EIO;
    }
@@ -443,7 +441,8 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
-        error_propagate(errp, local_err);
+        qerror_report_err(local_err);
+        error_free(local_err);
        qemu_opts_del(opts);
        return -EINVAL;
    }
@@ -453,7 +452,7 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
    if (qemu_rbd_parsename(filename, pool, sizeof(pool),
                           snap_buf, sizeof(snap_buf),
                           s->name, sizeof(s->name),
-                           conf, sizeof(conf), errp) < 0) {
+                           conf, sizeof(conf)) < 0) {
        r = -EINVAL;
        goto failed_opts;
    }
@@ -461,7 +460,7 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
    clientname = qemu_rbd_parse_clientname(conf, clientname_buf);
    r = rados_create(&s->cluster, clientname);
    if (r < 0) {
-        error_setg(&local_err, "error initializing");
+        error_report("error initializing");
        goto failed_opts;
    }

@@ -489,27 +488,28 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
    }

    if (conf[0] != '\0') {
-        r = qemu_rbd_set_conf(s->cluster, conf, errp);
+        r = qemu_rbd_set_conf(s->cluster, conf);
        if (r < 0) {
+            error_report("error setting config options");
            goto failed_shutdown;
        }
    }

    r = rados_connect(s->cluster);
    if (r < 0) {
-        error_setg(&local_err, "error connecting");
+        error_report("error connecting");
        goto failed_shutdown;
    }

    r = rados_ioctx_create(s->cluster, pool, &s->io_ctx);
    if (r < 0) {
-        error_setg(&local_err, "error opening pool %s", pool);
+        error_report("error opening pool %s", pool);
        goto failed_shutdown;
    }

    r = rbd_open(s->io_ctx, s->name, &s->image, s->snap);
    if (r < 0) {
-        error_setg(&local_err, "error reading header from %s", s->name);
+        error_report("error reading header from %s", s->name);
        goto failed_open;
    }

@@ -548,7 +548,7 @@ static void qemu_rbd_aio_cancel(BlockDriverAIOCB *blockacb)
    acb->cancelled = 1;

    while (acb->status == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(acb->common.bs), true);
+        qemu_aio_wait();
    }

    qemu_aio_release(acb);
@@ -581,8 +581,7 @@ static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
    rcb->ret = rbd_aio_get_return_value(c);
    rbd_aio_release(c);

-    acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
-                         rbd_finish_bh, rcb);
+    acb->bh = qemu_bh_new(rbd_finish_bh, rcb);
    qemu_bh_schedule(acb->bh);
 }

@@ -678,16 +677,13 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    }

    if (r < 0) {
-        goto failed_completion;
+        goto failed;
    }

    return &acb->common;

-failed_completion:
-    rbd_aio_release(c);
 failed:
    g_free(rcb);
-    qemu_vfree(acb->bounce);
    qemu_aio_release(acb);
    return NULL;
 }
@@ -904,22 +900,18 @@ static BlockDriverAIOCB* qemu_rbd_aio_discard(BlockDriverState *bs,
 }
 #endif

-static QemuOptsList qemu_rbd_create_opts = {
-    .name = "rbd-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(qemu_rbd_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_CLUSTER_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "RBD object size"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter qemu_rbd_create_options[] = {
+    {
+     .name = BLOCK_OPT_SIZE,
+     .type = OPT_SIZE,
+     .help = "Virtual disk size"
+    },
+    {
+     .name = BLOCK_OPT_CLUSTER_SIZE,
+     .type = OPT_SIZE,
+     .help = "RBD object size"
+    },
+    {NULL}
 };

 static BlockDriver bdrv_rbd = {
@@ -931,7 +923,7 @@ static BlockDriver bdrv_rbd = {
    .bdrv_create        = qemu_rbd_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,
    .bdrv_get_info      = qemu_rbd_getinfo,
-    .create_opts        = &qemu_rbd_create_opts,
+    .create_options     = qemu_rbd_create_options,
    .bdrv_getlength     = qemu_rbd_getlength,
    .bdrv_truncate      = qemu_rbd_truncate,
    .protocol_name      = "rbd",
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -106,59 +106,30 @@ static void ssh_state_free(BDRVSSHState *s)
    }
 }

-static void GCC_FMT_ATTR(3, 4)
-session_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
+/* Wrappers around error_report which make sure to dump as much
+ * information from libssh2 as possible.
+ */
+static void GCC_FMT_ATTR(2, 3)
+session_error_report(BDRVSSHState *s, const char *fs, ...)
 {
    va_list args;
-    char *msg;

    va_start(args, fs);
-    msg = g_strdup_vprintf(fs, args);
-    va_end(args);
+    error_vprintf(fs, args);

-    if (s->session) {
+    if ((s)->session) {
        char *ssh_err;
        int ssh_err_code;

+        libssh2_session_last_error((s)->session, &ssh_err, NULL, 0);
        /* This is not an errno.  See <libssh2.h>. */
-        ssh_err_code = libssh2_session_last_error(s->session,
-                                                  &ssh_err, NULL, 0);
-        error_setg(errp, "%s: %s (libssh2 error code: %d)",
-                   msg, ssh_err, ssh_err_code);
-    } else {
-        error_setg(errp, "%s", msg);
+        ssh_err_code = libssh2_session_last_errno((s)->session);
+
+        error_printf(": %s (libssh2 error code: %d)", ssh_err, ssh_err_code);
    }
-    g_free(msg);
-}

-static void GCC_FMT_ATTR(3, 4)
-sftp_error_setg(Error **errp, BDRVSSHState *s, const char *fs, ...)
-{
-    va_list args;
-    char *msg;
-
-    va_start(args, fs);
-    msg = g_strdup_vprintf(fs, args);
    va_end(args);
-
-    if (s->sftp) {
-        char *ssh_err;
-        int ssh_err_code;
-        unsigned long sftp_err_code;
-
-        /* This is not an errno.  See <libssh2.h>. */
-        ssh_err_code = libssh2_session_last_error(s->session,
-                                                  &ssh_err, NULL, 0);
-        /* See <libssh2_sftp.h>. */
-        sftp_err_code = libssh2_sftp_last_error((s)->sftp);
-
-        error_setg(errp,
-                   "%s: %s (libssh2 error code: %d, sftp error code: %lu)",
-                   msg, ssh_err, ssh_err_code, sftp_err_code);
-    } else {
-        error_setg(errp, "%s", msg);
-    }
-    g_free(msg);
+    error_printf("\n");
 }

 static void GCC_FMT_ATTR(2, 3)
@@ -174,9 +145,9 @@ sftp_error_report(BDRVSSHState *s, const char *fs, ...)
        int ssh_err_code;
        unsigned long sftp_err_code;

+        libssh2_session_last_error((s)->session, &ssh_err, NULL, 0);
        /* This is not an errno.  See <libssh2.h>. */
-        ssh_err_code = libssh2_session_last_error(s->session,
-                                                  &ssh_err, NULL, 0);
+        ssh_err_code = libssh2_session_last_errno((s)->session);
        /* See <libssh2_sftp.h>. */
        sftp_err_code = libssh2_sftp_last_error((s)->sftp);

@@ -272,7 +243,7 @@ static void ssh_parse_filename(const char *filename, QDict *options,
 }

 static int check_host_key_knownhosts(BDRVSSHState *s,
-                                     const char *host, int port, Error **errp)
+                                     const char *host, int port)
 {
    const char *home;
    char *knh_file = NULL;
@@ -286,15 +257,14 @@ static int check_host_key_knownhosts(BDRVSSHState *s,
    hostkey = libssh2_session_hostkey(s->session, &len, &type);
    if (!hostkey) {
        ret = -EINVAL;
-        session_error_setg(errp, s, "failed to read remote host key");
+        session_error_report(s, "failed to read remote host key");
        goto out;
    }

    knh = libssh2_knownhost_init(s->session);
    if (!knh) {
        ret = -EINVAL;
-        session_error_setg(errp, s,
-                           "failed to initialize known hosts support");
+        session_error_report(s, "failed to initialize known hosts support");
        goto out;
    }

@@ -319,23 +289,21 @@ static int check_host_key_knownhosts(BDRVSSHState *s,
        break;
    case LIBSSH2_KNOWNHOST_CHECK_MISMATCH:
        ret = -EINVAL;
-        session_error_setg(errp, s,
-                      "host key does not match the one in known_hosts"
-                      " (found key %s)", found->key);
+        session_error_report(s, "host key does not match the one in known_hosts (found key %s)",
+                             found->key);
        goto out;
    case LIBSSH2_KNOWNHOST_CHECK_NOTFOUND:
        ret = -EINVAL;
-        session_error_setg(errp, s, "no host key was found in known_hosts");
+        session_error_report(s, "no host key was found in known_hosts");
        goto out;
    case LIBSSH2_KNOWNHOST_CHECK_FAILURE:
        ret = -EINVAL;
-        session_error_setg(errp, s,
-                      "failure matching the host key with known_hosts");
+        session_error_report(s, "failure matching the host key with known_hosts");
        goto out;
    default:
        ret = -EINVAL;
-        session_error_setg(errp, s, "unknown error matching the host key"
-                      " with known_hosts (%d)", r);
+        session_error_report(s, "unknown error matching the host key with known_hosts (%d)",
+                             r);
        goto out;
    }

@@ -390,20 +358,20 @@ static int compare_fingerprint(const unsigned char *fingerprint, size_t len,

 static int
 check_host_key_hash(BDRVSSHState *s, const char *hash,
-                    int hash_type, size_t fingerprint_len, Error **errp)
+                    int hash_type, size_t fingerprint_len)
 {
    const char *fingerprint;

    fingerprint = libssh2_hostkey_hash(s->session, hash_type);
    if (!fingerprint) {
-        session_error_setg(errp, s, "failed to read remote host key");
+        session_error_report(s, "failed to read remote host key");
        return -EINVAL;
    }

    if(compare_fingerprint((unsigned char *) fingerprint, fingerprint_len,
                           hash) != 0) {
-        error_setg(errp, "remote host key does not match host_key_check '%s'",
-                   hash);
+        error_report("remote host key does not match host_key_check '%s'",
+                     hash);
        return -EPERM;
    }

@@ -411,7 +379,7 @@ check_host_key_hash(BDRVSSHState *s, const char *hash,
 }

 static int check_host_key(BDRVSSHState *s, const char *host, int port,
-                          const char *host_key_check, Error **errp)
+                          const char *host_key_check)
 {
    /* host_key_check=no */
    if (strcmp(host_key_check, "no") == 0) {
@@ -421,25 +389,25 @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
    /* host_key_check=md5:xx:yy:zz:... */
    if (strncmp(host_key_check, "md5:", 4) == 0) {
        return check_host_key_hash(s, &host_key_check[4],
-                                   LIBSSH2_HOSTKEY_HASH_MD5, 16, errp);
+                                   LIBSSH2_HOSTKEY_HASH_MD5, 16);
    }

    /* host_key_check=sha1:xx:yy:zz:... */
    if (strncmp(host_key_check, "sha1:", 5) == 0) {
        return check_host_key_hash(s, &host_key_check[5],
-                                   LIBSSH2_HOSTKEY_HASH_SHA1, 20, errp);
+                                   LIBSSH2_HOSTKEY_HASH_SHA1, 20);
    }

    /* host_key_check=yes */
    if (strcmp(host_key_check, "yes") == 0) {
-        return check_host_key_knownhosts(s, host, port, errp);
+        return check_host_key_knownhosts(s, host, port);
    }

-    error_setg(errp, "unknown host_key_check setting (%s)", host_key_check);
+    error_report("unknown host_key_check setting (%s)", host_key_check);
    return -EINVAL;
 }

-static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
+static int authenticate(BDRVSSHState *s, const char *user)
 {
    int r, ret;
    const char *userauthlist;
@@ -450,8 +418,7 @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
    userauthlist = libssh2_userauth_list(s->session, user, strlen(user));
    if (strstr(userauthlist, "publickey") == NULL) {
        ret = -EPERM;
-        error_setg(errp,
-                "remote server does not support \"publickey\" authentication");
+        error_report("remote server does not support \"publickey\" authentication");
        goto out;
    }

@@ -459,18 +426,17 @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
    agent = libssh2_agent_init(s->session);
    if (!agent) {
        ret = -EINVAL;
-        session_error_setg(errp, s, "failed to initialize ssh-agent support");
+        session_error_report(s, "failed to initialize ssh-agent support");
        goto out;
    }
    if (libssh2_agent_connect(agent)) {
        ret = -ECONNREFUSED;
-        session_error_setg(errp, s, "failed to connect to ssh-agent");
+        session_error_report(s, "failed to connect to ssh-agent");
        goto out;
    }
    if (libssh2_agent_list_identities(agent)) {
        ret = -EINVAL;
-        session_error_setg(errp, s,
-                           "failed requesting identities from ssh-agent");
+        session_error_report(s, "failed requesting identities from ssh-agent");
        goto out;
    }

@@ -481,8 +447,7 @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
        }
        if (r < 0) {
            ret = -EINVAL;
-            session_error_setg(errp, s,
-                               "failed to obtain identity from ssh-agent");
+            session_error_report(s, "failed to obtain identity from ssh-agent");
            goto out;
        }
        r = libssh2_agent_userauth(agent, user, identity);
@@ -496,8 +461,8 @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
    }

    ret = -EPERM;
-    error_setg(errp, "failed to authenticate using publickey authentication "
-               "and the identities held by your ssh-agent");
+    error_report("failed to authenticate using publickey authentication "
+                 "and the identities held by your ssh-agent");

 out:
    if (agent != NULL) {
@@ -511,9 +476,10 @@ static int authenticate(BDRVSSHState *s, const char *user, Error **errp)
 }

 static int connect_to_ssh(BDRVSSHState *s, QDict *options,
-                          int ssh_flags, int creat_mode, Error **errp)
+                          int ssh_flags, int creat_mode)
 {
    int r, ret;
+    Error *err = NULL;
    const char *host, *user, *path, *host_key_check;
    int port;

@@ -532,7 +498,6 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    } else {
        user = g_get_user_name();
        if (!user) {
-            error_setg_errno(errp, errno, "Can't get user name");
            ret = -errno;
            goto err;
        }
@@ -549,9 +514,11 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    s->hostport = g_strdup_printf("%s:%d", host, port);

    /* Open the socket and connect. */
-    s->sock = inet_connect(s->hostport, errp);
-    if (s->sock < 0) {
+    s->sock = inet_connect(s->hostport, &err);
+    if (err != NULL) {
        ret = -errno;
+        qerror_report_err(err);
+        error_free(err);
        goto err;
    }

@@ -559,7 +526,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    s->session = libssh2_session_init();
    if (!s->session) {
        ret = -EINVAL;
-        session_error_setg(errp, s, "failed to initialize libssh2 session");
+        session_error_report(s, "failed to initialize libssh2 session");
        goto err;
    }

@@ -570,18 +537,18 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    r = libssh2_session_handshake(s->session, s->sock);
    if (r != 0) {
        ret = -EINVAL;
-        session_error_setg(errp, s, "failed to establish SSH session");
+        session_error_report(s, "failed to establish SSH session");
        goto err;
    }

    /* Check the remote host's key against known_hosts. */
-    ret = check_host_key(s, host, port, host_key_check, errp);
+    ret = check_host_key(s, host, port, host_key_check);
    if (ret < 0) {
        goto err;
    }

    /* Authenticate. */
-    ret = authenticate(s, user, errp);
+    ret = authenticate(s, user);
    if (ret < 0) {
        goto err;
    }
@@ -589,7 +556,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    /* Start SFTP. */
    s->sftp = libssh2_sftp_init(s->session);
    if (!s->sftp) {
-        session_error_setg(errp, s, "failed to initialize sftp handle");
+        session_error_report(s, "failed to initialize sftp handle");
        ret = -EINVAL;
        goto err;
    }
@@ -599,14 +566,14 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
            path, ssh_flags, creat_mode);
    s->sftp_handle = libssh2_sftp_open(s->sftp, path, ssh_flags, creat_mode);
    if (!s->sftp_handle) {
-        session_error_setg(errp, s, "failed to open remote file '%s'", path);
+        session_error_report(s, "failed to open remote file '%s'", path);
        ret = -EINVAL;
        goto err;
    }

    r = libssh2_sftp_fstat(s->sftp_handle, &s->attrs);
    if (r < 0) {
-        sftp_error_setg(errp, s, "failed to read file attributes");
+        sftp_error_report(s, "failed to read file attributes");
        return -EINVAL;
    }

@@ -656,7 +623,7 @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
    }

    /* Start up SSH. */
-    ret = connect_to_ssh(s, options, ssh_flags, 0, errp);
+    ret = connect_to_ssh(s, options, ssh_flags, 0);
    if (ret < 0) {
        goto err;
    }
@@ -675,22 +642,20 @@ static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags,
    return ret;
 }

-static QemuOptsList ssh_create_opts = {
-    .name = "ssh-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(ssh_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter ssh_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    { NULL }
 };

-static int ssh_create(const char *filename, QemuOpts *opts, Error **errp)
+static int ssh_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    int r, ret;
+    Error *local_err = NULL;
    int64_t total_size = 0;
    QDict *uri_options = NULL;
    BDRVSSHState s;
@@ -700,20 +665,26 @@ static int ssh_create(const char *filename, QemuOpts *opts, Error **errp)
    ssh_state_init(&s);

    /* Get desired file size. */
-    total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n;
+        }
+        options++;
+    }
    DPRINTF("total_size=%" PRIi64, total_size);

    uri_options = qdict_new();
-    r = parse_uri(filename, uri_options, errp);
+    r = parse_uri(filename, uri_options, &local_err);
    if (r < 0) {
+        qerror_report_err(local_err);
+        error_free(local_err);
        ret = r;
        goto out;
    }

    r = connect_to_ssh(&s, uri_options,
                       LIBSSH2_FXF_READ|LIBSSH2_FXF_WRITE|
-                       LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC,
-                       0644, errp);
+                       LIBSSH2_FXF_CREAT|LIBSSH2_FXF_TRUNC, 0644);
    if (r < 0) {
        ret = r;
        goto out;
@@ -723,7 +694,7 @@ static int ssh_create(const char *filename, QemuOpts *opts, Error **errp)
        libssh2_sftp_seek64(s.sftp_handle, total_size-1);
        r2 = libssh2_sftp_write(s.sftp_handle, c, 1);
        if (r2 < 0) {
-            sftp_error_setg(errp, &s, "truncate failed");
+            sftp_error_report(&s, "truncate failed");
            ret = -EINVAL;
            goto out;
        }
@@ -771,7 +742,7 @@ static void restart_coroutine(void *opaque)
    qemu_coroutine_enter(co, NULL);
 }

-static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
+static coroutine_fn void set_fd_handler(BDRVSSHState *s)
 {
    int r;
    IOHandler *rd_handler = NULL, *wr_handler = NULL;
@@ -789,26 +760,24 @@ static coroutine_fn void set_fd_handler(BDRVSSHState *s, BlockDriverState *bs)
    DPRINTF("s->sock=%d rd_handler=%p wr_handler=%p", s->sock,
            rd_handler, wr_handler);

-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                       rd_handler, wr_handler, co);
+    qemu_aio_set_fd_handler(s->sock, rd_handler, wr_handler, co);
 }

-static coroutine_fn void clear_fd_handler(BDRVSSHState *s,
-                                          BlockDriverState *bs)
+static coroutine_fn void clear_fd_handler(BDRVSSHState *s)
 {
    DPRINTF("s->sock=%d", s->sock);
-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, NULL, NULL, NULL);
+    qemu_aio_set_fd_handler(s->sock, NULL, NULL, NULL);
 }

 /* A non-blocking call returned EAGAIN, so yield, ensuring the
 * handlers are set up so that we'll be rescheduled when there is an
 * interesting event on the socket.
 */
-static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
+static coroutine_fn void co_yield(BDRVSSHState *s)
 {
-    set_fd_handler(s, bs);
+    set_fd_handler(s);
    qemu_coroutine_yield();
-    clear_fd_handler(s, bs);
+    clear_fd_handler(s);
 }

 /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
@@ -838,7 +807,7 @@ static void ssh_seek(BDRVSSHState *s, int64_t offset, int flags)
    }
 }

-static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
+static coroutine_fn int ssh_read(BDRVSSHState *s,
                                 int64_t offset, size_t size,
                                 QEMUIOVector *qiov)
 {
@@ -871,7 +840,7 @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
        DPRINTF("sftp_read returned %zd", r);

        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
-            co_yield(s, bs);
+            co_yield(s);
            goto again;
        }
        if (r < 0) {
@@ -906,14 +875,14 @@ static coroutine_fn int ssh_co_readv(BlockDriverState *bs,
    int ret;

    qemu_co_mutex_lock(&s->lock);
-    ret = ssh_read(s, bs, sector_num * BDRV_SECTOR_SIZE,
+    ret = ssh_read(s, sector_num * BDRV_SECTOR_SIZE,
                   nb_sectors * BDRV_SECTOR_SIZE, qiov);
    qemu_co_mutex_unlock(&s->lock);

    return ret;
 }

-static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
+static int ssh_write(BDRVSSHState *s,
                     int64_t offset, size_t size,
                     QEMUIOVector *qiov)
 {
@@ -941,7 +910,7 @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
        DPRINTF("sftp_write returned %zd", r);

        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
-            co_yield(s, bs);
+            co_yield(s);
            goto again;
        }
        if (r < 0) {
@@ -960,7 +929,7 @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
         */
        if (r == 0) {
            ssh_seek(s, offset + written, SSH_SEEK_WRITE|SSH_SEEK_FORCE);
-            co_yield(s, bs);
+            co_yield(s);
            goto again;
        }

@@ -988,7 +957,7 @@ static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
    int ret;

    qemu_co_mutex_lock(&s->lock);
-    ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE,
+    ret = ssh_write(s, sector_num * BDRV_SECTOR_SIZE,
                    nb_sectors * BDRV_SECTOR_SIZE, qiov);
    qemu_co_mutex_unlock(&s->lock);

@@ -1009,7 +978,7 @@ static void unsafe_flush_warning(BDRVSSHState *s, const char *what)

 #ifdef HAS_LIBSSH2_SFTP_FSYNC

-static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
+static coroutine_fn int ssh_flush(BDRVSSHState *s)
 {
    int r;

@@ -1017,7 +986,7 @@ static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
 again:
    r = libssh2_sftp_fsync(s->sftp_handle);
    if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
-        co_yield(s, bs);
+        co_yield(s);
        goto again;
    }
    if (r == LIBSSH2_ERROR_SFTP_PROTOCOL &&
@@ -1039,7 +1008,7 @@ static coroutine_fn int ssh_co_flush(BlockDriverState *bs)
    int ret;

    qemu_co_mutex_lock(&s->lock);
-    ret = ssh_flush(s, bs);
+    ret = ssh_flush(s);
    qemu_co_mutex_unlock(&s->lock);

    return ret;
@@ -1082,7 +1051,7 @@ static BlockDriver bdrv_ssh = {
    .bdrv_co_writev               = ssh_co_writev,
    .bdrv_getlength               = ssh_getlength,
    .bdrv_co_flush_to_disk        = ssh_co_flush,
-    .create_opts                  = &ssh_create_opts,
+    .create_options               = ssh_create_options,
 };

 static void bdrv_ssh_init(void)
--- a/block/stream.c
+++ b/block/stream.c
@@ -32,7 +32,7 @@ typedef struct StreamBlockJob {
    RateLimit limit;
    BlockDriverState *base;
    BlockdevOnError on_error;
-    char *backing_file_str;
+    char backing_file_id[1024];
 } StreamBlockJob;

 static int coroutine_fn stream_populate(BlockDriverState *bs,
@@ -60,7 +60,7 @@ static void close_unused_images(BlockDriverState *top, BlockDriverState *base,
    /* Must assign before bdrv_delete() to prevent traversing dangling pointer
     * while we delete backing image instances.
     */
-    bdrv_set_backing_hd(top, base);
+    top->backing_hd = base;

    while (intermediate) {
        BlockDriverState *unused;
@@ -72,11 +72,11 @@ static void close_unused_images(BlockDriverState *top, BlockDriverState *base,

        unused = intermediate;
        intermediate = intermediate->backing_hd;
-        bdrv_set_backing_hd(unused, NULL);
+        unused->backing_hd = NULL;
        bdrv_unref(unused);
    }

-    bdrv_refresh_limits(top, NULL);
+    bdrv_refresh_limits(top);
 }

 static void coroutine_fn stream_run(void *opaque)
@@ -159,14 +159,14 @@ wait:
            BlockErrorAction action =
                block_job_error_action(&s->common, s->common.bs, s->on_error,
                                       true, -ret);
-            if (action == BLOCK_ERROR_ACTION_STOP) {
+            if (action == BDRV_ACTION_STOP) {
                n = 0;
                continue;
            }
            if (error == 0) {
                error = ret;
            }
-            if (action == BLOCK_ERROR_ACTION_REPORT) {
+            if (action == BDRV_ACTION_REPORT) {
                break;
            }
        }
@@ -186,7 +186,7 @@ wait:
    if (!block_job_is_cancelled(&s->common) && sector_num == end && ret == 0) {
        const char *base_id = NULL, *base_fmt = NULL;
        if (base) {
-            base_id = s->backing_file_str;
+            base_id = s->backing_file_id;
            if (base->drv) {
                base_fmt = base->drv->format_name;
            }
@@ -196,7 +196,6 @@ wait:
    }

    qemu_vfree(buf);
-    g_free(s->backing_file_str);
    block_job_completed(&s->common, ret);
 }

@@ -218,7 +217,7 @@ static const BlockJobDriver stream_job_driver = {
 };

 void stream_start(BlockDriverState *bs, BlockDriverState *base,
-                  const char *backing_file_str, int64_t speed,
+                  const char *base_id, int64_t speed,
                  BlockdevOnError on_error,
                  BlockDriverCompletionFunc *cb,
                  void *opaque, Error **errp)
@@ -238,7 +237,9 @@ void stream_start(BlockDriverState *bs, BlockDriverState *base,
    }

    s->base = base;
-    s->backing_file_str = g_strdup(backing_file_str);
+    if (base_id) {
+        pstrcpy(s->backing_file_id, sizeof(s->backing_file_id), base_id);
+    }

    s->on_error = on_error;
    s->common.co = qemu_coroutine_create(stream_run);
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -53,13 +53,6 @@
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "migration/migration.h"
-#ifdef __linux__
-#include <linux/fs.h>
-#include <sys/ioctl.h>
-#ifndef FS_NOCOW_FL
-#define FS_NOCOW_FL                     0x00800000 /* Do not cow file */
-#endif
-#endif

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
@@ -246,6 +239,7 @@ static void vdi_header_to_le(VdiHeader *header)
    cpu_to_le32s(&header->block_extra);
    cpu_to_le32s(&header->blocks_in_image);
    cpu_to_le32s(&header->blocks_allocated);
+    cpu_to_le32s(&header->blocks_allocated);
    uuid_convert(header->uuid_image);
    uuid_convert(header->uuid_last_snap);
    uuid_convert(header->uuid_link);
@@ -414,35 +408,34 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
    }

    if (header.signature != VDI_SIGNATURE) {
-        error_setg(errp, "Image not in VDI format (bad signature %08" PRIx32
-                   ")", header.signature);
+        error_setg(errp, "Image not in VDI format (bad signature %08x)", header.signature);
        ret = -EINVAL;
        goto fail;
    } else if (header.version != VDI_VERSION_1_1) {
-        error_setg(errp, "unsupported VDI image (version %" PRIu32 ".%" PRIu32
-                   ")", header.version >> 16, header.version & 0xffff);
+        error_setg(errp, "unsupported VDI image (version %u.%u)",
+                   header.version >> 16, header.version & 0xffff);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_bmap % SECTOR_SIZE != 0) {
        /* We only support block maps which start on a sector boundary. */
        error_setg(errp, "unsupported VDI image (unaligned block map offset "
-                   "0x%" PRIx32 ")", header.offset_bmap);
+                   "0x%x)", header.offset_bmap);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_data % SECTOR_SIZE != 0) {
        /* We only support data blocks which start on a sector boundary. */
-        error_setg(errp, "unsupported VDI image (unaligned data offset 0x%"
-                   PRIx32 ")", header.offset_data);
+        error_setg(errp, "unsupported VDI image (unaligned data offset 0x%x)",
+                   header.offset_data);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.sector_size != SECTOR_SIZE) {
-        error_setg(errp, "unsupported VDI image (sector size %" PRIu32
-                   " is not %u)", header.sector_size, SECTOR_SIZE);
+        error_setg(errp, "unsupported VDI image (sector size %u is not %u)",
+                   header.sector_size, SECTOR_SIZE);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.block_size != DEFAULT_CLUSTER_SIZE) {
-        error_setg(errp, "unsupported VDI image (block size %" PRIu32
-                   " is not %u)", header.block_size, DEFAULT_CLUSTER_SIZE);
+        error_setg(errp, "unsupported VDI image (block size %u is not %u)",
+                   header.block_size, DEFAULT_CLUSTER_SIZE);
        ret = -ENOTSUP;
        goto fail;
    } else if (header.disk_size >
@@ -679,7 +672,8 @@ static int vdi_co_write(BlockDriverState *bs,
    return ret;
 }

-static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
+static int vdi_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    int fd;
    int result = 0;
@@ -690,24 +684,29 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
    VdiHeader header;
    size_t i;
    size_t bmap_size;
-    bool nocow = false;

    logout("\n");

    /* Read out options. */
-    bytes = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            bytes = options->value.n;
 #if defined(CONFIG_VDI_BLOCK_SIZE)
-    /* TODO: Additional checks (SECTOR_SIZE * 2^n, ...). */
-    block_size = qemu_opt_get_size_del(opts,
-                                       BLOCK_OPT_CLUSTER_SIZE,
-                                       DEFAULT_CLUSTER_SIZE);
+        } else if (!strcmp(options->name, BLOCK_OPT_CLUSTER_SIZE)) {
+            if (options->value.n) {
+                /* TODO: Additional checks (SECTOR_SIZE * 2^n, ...). */
+                block_size = options->value.n;
+            }
 #endif
 #if defined(CONFIG_VDI_STATIC_IMAGE)
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_STATIC, false)) {
-        image_type = VDI_TYPE_STATIC;
-    }
+        } else if (!strcmp(options->name, BLOCK_OPT_STATIC)) {
+            if (options->value.n) {
+                image_type = VDI_TYPE_STATIC;
+            }
 #endif
-    nocow = qemu_opt_get_bool_del(opts, BLOCK_OPT_NOCOW, false);
+        }
+        options++;
+    }

    if (bytes > VDI_DISK_SIZE_MAX) {
        result = -ENOTSUP;
@@ -725,21 +724,6 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
        goto exit;
    }

-    if (nocow) {
-#ifdef __linux__
-        /* Set NOCOW flag to solve performance issue on fs like btrfs.
-         * This is an optimisation. The FS_IOC_SETFLAGS ioctl return value will
-         * be ignored since any failure of this operation should not block the
-         * left work.
-         */
-        int attr;
-        if (ioctl(fd, FS_IOC_GETFLAGS, &attr) == 0) {
-            attr |= FS_NOCOW_FL;
-            ioctl(fd, FS_IOC_SETFLAGS, &attr);
-        }
-#endif
-    }
-
    /* We need enough blocks to store the given disk size,
       so always round up. */
    blocks = (bytes + block_size - 1) / block_size;
@@ -771,7 +755,6 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
    vdi_header_to_le(&header);
    if (write(fd, &header, sizeof(header)) < 0) {
        result = -errno;
-        goto close_and_exit;
    }

    if (bmap_size > 0) {
@@ -785,8 +768,6 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
        }
        if (write(fd, bmap, bmap_size) < 0) {
            result = -errno;
-            g_free(bmap);
-            goto close_and_exit;
        }
        g_free(bmap);
    }
@@ -794,12 +775,10 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
    if (image_type == VDI_TYPE_STATIC) {
        if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
            result = -errno;
-            goto close_and_exit;
        }
    }

-close_and_exit:
-    if ((close(fd) < 0) && !result) {
+    if (close(fd) < 0) {
        result = -errno;
    }

@@ -817,39 +796,29 @@ static void vdi_close(BlockDriverState *bs)
    error_free(s->migration_blocker);
 }

-static QemuOptsList vdi_create_opts = {
-    .name = "vdi-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(vdi_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
+static QEMUOptionParameter vdi_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
 #if defined(CONFIG_VDI_BLOCK_SIZE)
-        {
-            .name = BLOCK_OPT_CLUSTER_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "VDI cluster (block) size",
-            .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)
-        },
+    {
+        .name = BLOCK_OPT_CLUSTER_SIZE,
+        .type = OPT_SIZE,
+        .help = "VDI cluster (block) size",
+        .value = { .n = DEFAULT_CLUSTER_SIZE },
+    },
 #endif
 #if defined(CONFIG_VDI_STATIC_IMAGE)
-        {
-            .name = BLOCK_OPT_STATIC,
-            .type = QEMU_OPT_BOOL,
-            .help = "VDI static (pre-allocated) image",
-            .def_value_str = "off"
-        },
+    {
+        .name = BLOCK_OPT_STATIC,
+        .type = OPT_FLAG,
+        .help = "VDI static (pre-allocated) image"
+    },
 #endif
-        {
-            .name = BLOCK_OPT_NOCOW,
-            .type = QEMU_OPT_BOOL,
-            .help = "Turn off copy-on-write (valid only on btrfs)"
-        },
-        /* TODO: An additional option to set UUID values might be useful. */
-        { /* end of list */ }
-    }
+    /* TODO: An additional option to set UUID values might be useful. */
+    { NULL }
 };

 static BlockDriver bdrv_vdi = {
@@ -871,7 +840,7 @@ static BlockDriver bdrv_vdi = {

    .bdrv_get_info = vdi_get_info,

-    .create_opts = &vdi_create_opts,
+    .create_options = vdi_create_options,
    .bdrv_check = vdi_check,
 };

--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -473,14 +473,7 @@ static void vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s,
        } else if (h2_seq > h1_seq) {
            s->curr_header = 1;
        } else {
-            /* The Microsoft Disk2VHD tool will create 2 identical
-             * headers, with identical sequence numbers.  If the headers are
-             * identical, don't consider the file corrupt */
-            if (!memcmp(header1, header2, sizeof(VHDXHeader))) {
-                s->curr_header = 0;
-            } else {
-                goto fail;
-            }
+            goto fail;
        }
    }

@@ -1723,7 +1716,8 @@ exit:
 *    .---- ~ ----------- ~ ------------ ~ ---------------- ~ -----------.
 *   1MB
 */
-static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
+static int vhdx_create(const char *filename, QEMUOptionParameter *options,
+                       Error **errp)
 {
    int ret = 0;
    uint64_t image_size = (uint64_t) 2 * GiB;
@@ -1736,15 +1730,24 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
    gunichar2 *creator = NULL;
    glong creator_items;
    BlockDriverState *bs;
-    char *type = NULL;
+    const char *type = NULL;
    VHDXImageType image_type;
    Error *local_err = NULL;

-    image_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-    log_size = qemu_opt_get_size_del(opts, VHDX_BLOCK_OPT_LOG_SIZE, 0);
-    block_size = qemu_opt_get_size_del(opts, VHDX_BLOCK_OPT_BLOCK_SIZE, 0);
-    type = qemu_opt_get_del(opts, BLOCK_OPT_SUBFMT);
-    use_zero_blocks = qemu_opt_get_bool_del(opts, VHDX_BLOCK_OPT_ZERO, false);
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            image_size = options->value.n;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_LOG_SIZE)) {
+            log_size = options->value.n;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_BLOCK_SIZE)) {
+            block_size = options->value.n;
+        } else if (!strcmp(options->name, BLOCK_OPT_SUBFMT)) {
+            type = options->value.s;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_ZERO)) {
+            use_zero_blocks = options->value.n != 0;
+        }
+        options++;
+    }

    if (image_size > VHDX_MAX_IMAGE_SIZE) {
        error_setg_errno(errp, EINVAL, "Image size too large; max of 64TB");
@@ -1753,7 +1756,7 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
    }

    if (type == NULL) {
-        type = g_strdup("dynamic");
+        type = "dynamic";
    }

    if (!strcmp(type, "dynamic")) {
@@ -1793,7 +1796,7 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
    block_size = block_size > VHDX_BLOCK_SIZE_MAX ? VHDX_BLOCK_SIZE_MAX :
                                                    block_size;

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, options, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
@@ -1853,7 +1856,6 @@ static int vhdx_create(const char *filename, QemuOpts *opts, Error **errp)
 delete_and_exit:
    bdrv_unref(bs);
 exit:
-    g_free(type);
    g_free(creator);
    return ret;
 }
@@ -1876,41 +1878,37 @@ static int vhdx_check(BlockDriverState *bs, BdrvCheckResult *result,
    return 0;
 }

-static QemuOptsList vhdx_create_opts = {
-    .name = "vhdx-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(vhdx_create_opts.head),
-    .desc = {
-        {
-           .name = BLOCK_OPT_SIZE,
-           .type = QEMU_OPT_SIZE,
-           .help = "Virtual disk size; max of 64TB."
-       },
-       {
-           .name = VHDX_BLOCK_OPT_LOG_SIZE,
-           .type = QEMU_OPT_SIZE,
-           .def_value_str = stringify(DEFAULT_LOG_SIZE),
-           .help = "Log size; min 1MB."
-       },
-       {
-           .name = VHDX_BLOCK_OPT_BLOCK_SIZE,
-           .type = QEMU_OPT_SIZE,
-           .def_value_str = stringify(0),
-           .help = "Block Size; min 1MB, max 256MB. " \
-                   "0 means auto-calculate based on image size."
-       },
-       {
-           .name = BLOCK_OPT_SUBFMT,
-           .type = QEMU_OPT_STRING,
-           .help = "VHDX format type, can be either 'dynamic' or 'fixed'. "\
-                   "Default is 'dynamic'."
-       },
-       {
-           .name = VHDX_BLOCK_OPT_ZERO,
-           .type = QEMU_OPT_BOOL,
-           .help = "Force use of payload blocks of type 'ZERO'.  Non-standard."
-       },
-       { NULL }
-    }
+static QEMUOptionParameter vhdx_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size; max of 64TB."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_LOG_SIZE,
+        .type = OPT_SIZE,
+        .value.n = 1 * MiB,
+        .help = "Log size; min 1MB."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_BLOCK_SIZE,
+        .type = OPT_SIZE,
+        .value.n = 0,
+        .help = "Block Size; min 1MB, max 256MB. " \
+                "0 means auto-calculate based on image size."
+    },
+    {
+        .name = BLOCK_OPT_SUBFMT,
+        .type = OPT_STRING,
+        .help = "VHDX format type, can be either 'dynamic' or 'fixed'. "\
+                "Default is 'dynamic'."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_ZERO,
+        .type = OPT_FLAG,
+        .help = "Force use of payload blocks of type 'ZERO'.  Non-standard."
+    },
+    { NULL }
 };

 static BlockDriver bdrv_vhdx = {
@@ -1926,7 +1924,7 @@ static BlockDriver bdrv_vhdx = {
    .bdrv_get_info          = vhdx_get_info,
    .bdrv_check             = vhdx_check,

-    .create_opts            = &vhdx_create_opts,
+    .create_options         = vhdx_create_options,
 };

 static void bdrv_vhdx_init(void)
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -23,7 +23,6 @@
 #define GiB            (MiB * 1024)
 #define TiB ((uint64_t) GiB * 1024)

-#define DEFAULT_LOG_SIZE 1048576 /* 1MiB */
 /* Structures and fields present in the VHDX file */

 /* The header section has the following blocks,
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -262,7 +262,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
    p_name = strstr(desc, cid_str);
    if (p_name != NULL) {
        p_name += cid_str_size;
-        sscanf(p_name, "%" SCNx32, &cid);
+        sscanf(p_name, "%x", &cid);
    }

    return cid;
@@ -290,7 +290,7 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
    p_name = strstr(desc, "CID");
    if (p_name != NULL) {
        p_name += sizeof("CID");
-        snprintf(p_name, sizeof(desc) - (p_name - desc), "%" PRIx32 "\n", cid);
+        snprintf(p_name, sizeof(desc) - (p_name - desc), "%x\n", cid);
        pstrcat(desc, sizeof(desc), tmp_desc);
    }

@@ -640,7 +640,7 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,

    if (le32_to_cpu(header.version) > 3) {
        char buf[64];
-        snprintf(buf, sizeof(buf), "VMDK version %" PRId32,
+        snprintf(buf, sizeof(buf), "VMDK version %d",
                 le32_to_cpu(header.version));
        error_set(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
                  bs->device_name, "vmdk", buf);
@@ -671,9 +671,8 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
    }
    if (bdrv_getlength(file) <
            le64_to_cpu(header.grain_offset) * BDRV_SECTOR_SIZE) {
-        error_setg(errp, "File truncated, expecting at least %" PRId64 " bytes",
-                   (int64_t)(le64_to_cpu(header.grain_offset)
-                             * BDRV_SECTOR_SIZE));
+        error_setg(errp, "File truncated, expecting at least %lld bytes",
+                   le64_to_cpu(header.grain_offset) * BDRV_SECTOR_SIZE);
        return -EINVAL;
    }

@@ -938,7 +937,7 @@ fail:
 }


-static void vmdk_refresh_limits(BlockDriverState *bs, Error **errp)
+static int vmdk_refresh_limits(BlockDriverState *bs)
 {
    BDRVVmdkState *s = bs->opaque;
    int i;
@@ -950,6 +949,8 @@ static void vmdk_refresh_limits(BlockDriverState *bs, Error **errp)
                    s->extents[i].cluster_sectors);
        }
    }
+
+    return 0;
 }

 static int get_whole_cluster(BlockDriverState *bs,
@@ -1494,19 +1495,6 @@ static coroutine_fn int vmdk_co_write(BlockDriverState *bs, int64_t sector_num,
    return ret;
 }

-static int vmdk_write_compressed(BlockDriverState *bs,
-                                 int64_t sector_num,
-                                 const uint8_t *buf,
-                                 int nb_sectors)
-{
-    BDRVVmdkState *s = bs->opaque;
-    if (s->num_extents == 1 && s->extents[0].compressed) {
-        return vmdk_write(bs, sector_num, buf, nb_sectors, false, false);
-    } else {
-        return -ENOTSUP;
-    }
-}
-
 static int coroutine_fn vmdk_co_write_zeroes(BlockDriverState *bs,
                                             int64_t sector_num,
                                             int nb_sectors,
@@ -1527,17 +1515,17 @@ static int coroutine_fn vmdk_co_write_zeroes(BlockDriverState *bs,

 static int vmdk_create_extent(const char *filename, int64_t filesize,
                              bool flat, bool compress, bool zeroed_grain,
-                              QemuOpts *opts, Error **errp)
+                              Error **errp)
 {
    int ret, i;
    BlockDriverState *bs = NULL;
    VMDK4Header header;
-    Error *local_err = NULL;
+    Error *local_err;
    uint32_t tmp, magic, grains, gd_sectors, gt_size, gt_count;
    uint32_t *gd_buf = NULL;
    int gd_buf_size;

-    ret = bdrv_create_file(filename, opts, &local_err);
+    ret = bdrv_create_file(filename, NULL, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        goto exit;
@@ -1693,16 +1681,17 @@ static int filename_decompose(const char *filename, char *path, char *prefix,
    return VMDK_OK;
 }

-static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
+static int vmdk_create(const char *filename, QEMUOptionParameter *options,
+                       Error **errp)
 {
    int idx = 0;
    BlockDriverState *new_bs = NULL;
-    Error *local_err = NULL;
+    Error *local_err;
    char *desc = NULL;
    int64_t total_size = 0, filesize;
-    char *adapter_type = NULL;
-    char *backing_file = NULL;
-    char *fmt = NULL;
+    const char *adapter_type = NULL;
+    const char *backing_file = NULL;
+    const char *fmt = NULL;
    int flags = 0;
    int ret = 0;
    bool flat, split, compress;
@@ -1718,8 +1707,8 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    const char desc_template[] =
        "# Disk DescriptorFile\n"
        "version=1\n"
-        "CID=%" PRIx32 "\n"
-        "parentCID=%" PRIx32 "\n"
+        "CID=%x\n"
+        "parentCID=%x\n"
        "createType=\"%s\"\n"
        "%s"
        "\n"
@@ -1731,7 +1720,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
        "\n"
        "ddb.virtualHWVersion = \"%d\"\n"
        "ddb.geometry.cylinders = \"%" PRId64 "\"\n"
-        "ddb.geometry.heads = \"%" PRIu32 "\"\n"
+        "ddb.geometry.heads = \"%d\"\n"
        "ddb.geometry.sectors = \"63\"\n"
        "ddb.adapterType = \"%s\"\n";

@@ -1742,19 +1731,24 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
        goto exit;
    }
    /* Read out options */
-    total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-    adapter_type = qemu_opt_get_del(opts, BLOCK_OPT_ADAPTER_TYPE);
-    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_COMPAT6, false)) {
-        flags |= BLOCK_FLAG_COMPAT6;
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            total_size = options->value.n;
+        } else if (!strcmp(options->name, BLOCK_OPT_ADAPTER_TYPE)) {
+            adapter_type = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
+            backing_file = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_COMPAT6)) {
+            flags |= options->value.n ? BLOCK_FLAG_COMPAT6 : 0;
+        } else if (!strcmp(options->name, BLOCK_OPT_SUBFMT)) {
+            fmt = options->value.s;
+        } else if (!strcmp(options->name, BLOCK_OPT_ZEROED_GRAIN)) {
+            zeroed_grain |= options->value.n;
+        }
+        options++;
    }
-    fmt = qemu_opt_get_del(opts, BLOCK_OPT_SUBFMT);
-    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ZEROED_GRAIN, false)) {
-        zeroed_grain = true;
-    }
-
    if (!adapter_type) {
-        adapter_type = g_strdup("ide");
+        adapter_type = "ide";
    } else if (strcmp(adapter_type, "ide") &&
               strcmp(adapter_type, "buslogic") &&
               strcmp(adapter_type, "lsilogic") &&
@@ -1770,7 +1764,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    }
    if (!fmt) {
        /* Default format to monolithicSparse */
-        fmt = g_strdup("monolithicSparse");
+        fmt = "monolithicSparse";
    } else if (strcmp(fmt, "monolithicFlat") &&
               strcmp(fmt, "monolithicSparse") &&
               strcmp(fmt, "twoGbMaxExtentSparse") &&
@@ -1786,9 +1780,9 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
             strcmp(fmt, "twoGbMaxExtentFlat"));
    compress = !strcmp(fmt, "streamOptimized");
    if (flat) {
-        desc_extent_line = "RW %" PRId64 " FLAT \"%s\" 0\n";
+        desc_extent_line = "RW %lld FLAT \"%s\" 0\n";
    } else {
-        desc_extent_line = "RW %" PRId64 " SPARSE \"%s\"\n";
+        desc_extent_line = "RW %lld SPARSE \"%s\"\n";
    }
    if (flat && backing_file) {
        error_setg(errp, "Flat image can't have backing file");
@@ -1843,7 +1837,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
                path, desc_filename);

        if (vmdk_create_extent(ext_filename, size,
-                               flat, compress, zeroed_grain, opts, errp)) {
+                               flat, compress, zeroed_grain, errp)) {
            ret = -EINVAL;
            goto exit;
        }
@@ -1856,7 +1850,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    }
    /* generate descriptor file */
    desc = g_strdup_printf(desc_template,
-                           (uint32_t)time(NULL),
+                           (unsigned int)time(NULL),
                           parent_cid,
                           fmt,
                           parent_desc_line,
@@ -1871,9 +1865,9 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    if (!split && !flat) {
        desc_offset = 0x200;
    } else {
-        ret = bdrv_create_file(filename, opts, &local_err);
+        ret = bdrv_create_file(filename, options, &local_err);
        if (ret < 0) {
-            error_propagate(errp, local_err);
+            error_setg_errno(errp, -ret, "Could not create image file");
            goto exit;
        }
    }
@@ -1881,7 +1875,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    ret = bdrv_open(&new_bs, filename, NULL, NULL,
                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);
    if (ret < 0) {
-        error_propagate(errp, local_err);
+        error_setg_errno(errp, -ret, "Could not write description");
        goto exit;
    }
    ret = bdrv_pwrite(new_bs, desc_offset, desc, desc_len);
@@ -1901,9 +1895,6 @@ exit:
    if (new_bs) {
        bdrv_unref(new_bs);
    }
-    g_free(adapter_type);
-    g_free(backing_file);
-    g_free(fmt);
    g_free(desc);
    g_string_free(ext_desc_lines, true);
    return ret;
@@ -2071,88 +2062,41 @@ static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)
    return spec_info;
 }

-static int vmdk_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
-{
-    int i;
-    BDRVVmdkState *s = bs->opaque;
-    assert(s->num_extents);
-    bdi->needs_compressed_writes = s->extents[0].compressed;
-    if (!s->extents[0].flat) {
-        bdi->cluster_size = s->extents[0].cluster_sectors << BDRV_SECTOR_BITS;
-    }
-    /* See if we have multiple extents but they have different cases */
-    for (i = 1; i < s->num_extents; i++) {
-        if (bdi->needs_compressed_writes != s->extents[i].compressed ||
-            (bdi->cluster_size && bdi->cluster_size !=
-                s->extents[i].cluster_sectors << BDRV_SECTOR_BITS)) {
-            return -ENOTSUP;
-        }
-    }
-    return 0;
-}
-
-static void vmdk_detach_aio_context(BlockDriverState *bs)
-{
-    BDRVVmdkState *s = bs->opaque;
-    int i;
-
-    for (i = 0; i < s->num_extents; i++) {
-        bdrv_detach_aio_context(s->extents[i].file);
-    }
-}
-
-static void vmdk_attach_aio_context(BlockDriverState *bs,
-                                    AioContext *new_context)
-{
-    BDRVVmdkState *s = bs->opaque;
-    int i;
-
-    for (i = 0; i < s->num_extents; i++) {
-        bdrv_attach_aio_context(s->extents[i].file, new_context);
-    }
-}
-
-static QemuOptsList vmdk_create_opts = {
-    .name = "vmdk-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(vmdk_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_ADAPTER_TYPE,
-            .type = QEMU_OPT_STRING,
-            .help = "Virtual adapter type, can be one of "
-                    "ide (default), lsilogic, buslogic or legacyESX"
-        },
-        {
-            .name = BLOCK_OPT_BACKING_FILE,
-            .type = QEMU_OPT_STRING,
-            .help = "File name of a base image"
-        },
-        {
-            .name = BLOCK_OPT_COMPAT6,
-            .type = QEMU_OPT_BOOL,
-            .help = "VMDK version 6 image",
-            .def_value_str = "off"
-        },
-        {
-            .name = BLOCK_OPT_SUBFMT,
-            .type = QEMU_OPT_STRING,
-            .help =
-                "VMDK flat extent format, can be one of "
-                "{monolithicSparse (default) | monolithicFlat | twoGbMaxExtentSparse | twoGbMaxExtentFlat | streamOptimized} "
-        },
-        {
-            .name = BLOCK_OPT_ZEROED_GRAIN,
-            .type = QEMU_OPT_BOOL,
-            .help = "Enable efficient zero writes "
-                    "using the zeroed-grain GTE feature"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter vmdk_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_ADAPTER_TYPE,
+        .type = OPT_STRING,
+        .help = "Virtual adapter type, can be one of "
+                "ide (default), lsilogic, buslogic or legacyESX"
+    },
+    {
+        .name = BLOCK_OPT_BACKING_FILE,
+        .type = OPT_STRING,
+        .help = "File name of a base image"
+    },
+    {
+        .name = BLOCK_OPT_COMPAT6,
+        .type = OPT_FLAG,
+        .help = "VMDK version 6 image"
+    },
+    {
+        .name = BLOCK_OPT_SUBFMT,
+        .type = OPT_STRING,
+        .help =
+            "VMDK flat extent format, can be one of "
+            "{monolithicSparse (default) | monolithicFlat | twoGbMaxExtentSparse | twoGbMaxExtentFlat | streamOptimized} "
+    },
+    {
+        .name = BLOCK_OPT_ZEROED_GRAIN,
+        .type = OPT_FLAG,
+        .help = "Enable efficient zero writes using the zeroed-grain GTE feature"
+    },
+    { NULL }
 };

 static BlockDriver bdrv_vmdk = {
@@ -2164,7 +2108,6 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_reopen_prepare          = vmdk_reopen_prepare,
    .bdrv_read                    = vmdk_co_read,
    .bdrv_write                   = vmdk_co_write,
-    .bdrv_write_compressed        = vmdk_write_compressed,
    .bdrv_co_write_zeroes         = vmdk_co_write_zeroes,
    .bdrv_close                   = vmdk_close,
    .bdrv_create                  = vmdk_create,
@@ -2174,12 +2117,8 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_has_zero_init           = vmdk_has_zero_init,
    .bdrv_get_specific_info       = vmdk_get_specific_info,
    .bdrv_refresh_limits          = vmdk_refresh_limits,
-    .bdrv_get_info                = vmdk_get_info,
-    .bdrv_detach_aio_context      = vmdk_detach_aio_context,
-    .bdrv_attach_aio_context      = vmdk_attach_aio_context,

-    .supports_backing             = true,
-    .create_opts                  = &vmdk_create_opts,
+    .create_options               = vmdk_create_options,
 };

 static void bdrv_vmdk_init(void)
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -29,13 +29,6 @@
 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
 #endif
-#ifdef __linux__
-#include <linux/fs.h>
-#include <sys/ioctl.h>
-#ifndef FS_NOCOW_FL
-#define FS_NOCOW_FL                     0x00800000 /* Do not cow file */
-#endif
-#endif

 /**************************************************************/

@@ -745,11 +738,12 @@ static int create_fixed_disk(int fd, uint8_t *buf, int64_t total_size)
    return ret;
 }

-static int vpc_create(const char *filename, QemuOpts *opts, Error **errp)
+static int vpc_create(const char *filename, QEMUOptionParameter *options,
+                      Error **errp)
 {
    uint8_t buf[1024];
    VHDFooter *footer = (VHDFooter *) buf;
-    char *disk_type_param;
+    QEMUOptionParameter *disk_type_param;
    int fd, i;
    uint16_t cyls = 0;
    uint8_t heads = 0;
@@ -758,45 +752,27 @@ static int vpc_create(const char *filename, QemuOpts *opts, Error **errp)
    int64_t total_size;
    int disk_type;
    int ret = -EIO;
-    bool nocow = false;

    /* Read out options */
-    total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-    disk_type_param = qemu_opt_get_del(opts, BLOCK_OPT_SUBFMT);
-    if (disk_type_param) {
-        if (!strcmp(disk_type_param, "dynamic")) {
+    total_size = get_option_parameter(options, BLOCK_OPT_SIZE)->value.n;
+
+    disk_type_param = get_option_parameter(options, BLOCK_OPT_SUBFMT);
+    if (disk_type_param && disk_type_param->value.s) {
+        if (!strcmp(disk_type_param->value.s, "dynamic")) {
            disk_type = VHD_DYNAMIC;
-        } else if (!strcmp(disk_type_param, "fixed")) {
+        } else if (!strcmp(disk_type_param->value.s, "fixed")) {
            disk_type = VHD_FIXED;
        } else {
-            ret = -EINVAL;
-            goto out;
+            return -EINVAL;
        }
    } else {
        disk_type = VHD_DYNAMIC;
    }
-    nocow = qemu_opt_get_bool_del(opts, BLOCK_OPT_NOCOW, false);

    /* Create the file */
    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
    if (fd < 0) {
-        ret = -EIO;
-        goto out;
-    }
-
-    if (nocow) {
-#ifdef __linux__
-        /* Set NOCOW flag to solve performance issue on fs like btrfs.
-         * This is an optimisation. The FS_IOC_SETFLAGS ioctl return value will
-         * be ignored since any failure of this operation should not block the
-         * left work.
-         */
-        int attr;
-        if (ioctl(fd, FS_IOC_GETFLAGS, &attr) == 0) {
-            attr |= FS_NOCOW_FL;
-            ioctl(fd, FS_IOC_SETFLAGS, &attr);
-        }
-#endif
+        return -EIO;
    }

    /*
@@ -861,10 +837,8 @@ static int vpc_create(const char *filename, QemuOpts *opts, Error **errp)
        ret = create_fixed_disk(fd, buf, total_size);
    }

-fail:
+ fail:
    qemu_close(fd);
-out:
-    g_free(disk_type_param);
    return ret;
 }

@@ -892,29 +866,20 @@ static void vpc_close(BlockDriverState *bs)
    error_free(s->migration_blocker);
 }

-static QemuOptsList vpc_create_opts = {
-    .name = "vpc-create-opts",
-    .head = QTAILQ_HEAD_INITIALIZER(vpc_create_opts.head),
-    .desc = {
-        {
-            .name = BLOCK_OPT_SIZE,
-            .type = QEMU_OPT_SIZE,
-            .help = "Virtual disk size"
-        },
-        {
-            .name = BLOCK_OPT_SUBFMT,
-            .type = QEMU_OPT_STRING,
-            .help =
-                "Type of virtual hard disk format. Supported formats are "
-                "{dynamic (default) | fixed} "
-        },
-        {
-            .name = BLOCK_OPT_NOCOW,
-            .type = QEMU_OPT_BOOL,
-            .help = "Turn off copy-on-write (valid only on btrfs)"
-        },
-        { /* end of list */ }
-    }
+static QEMUOptionParameter vpc_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size"
+    },
+    {
+        .name = BLOCK_OPT_SUBFMT,
+        .type = OPT_STRING,
+        .help =
+            "Type of virtual hard disk format. Supported formats are "
+            "{dynamic (default) | fixed} "
+    },
+    { NULL }
 };

 static BlockDriver bdrv_vpc = {
@@ -932,7 +897,7 @@ static BlockDriver bdrv_vpc = {

    .bdrv_get_info          = vpc_get_info,

-    .create_opts            = &vpc_create_opts,
+    .create_options         = vpc_create_options,
    .bdrv_has_zero_init     = vpc_has_zero_init,
 };

--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -833,8 +833,7 @@ static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
 }

 static int init_directories(BDRVVVFATState* s,
-                            const char *dirname, int heads, int secs,
-                            Error **errp)
+                            const char *dirname, int heads, int secs)
 {
    bootsector_t* bootsector;
    mapping_t* mapping;
@@ -895,8 +894,8 @@ static int init_directories(BDRVVVFATState* s,
        if (mapping->mode & MODE_DIRECTORY) {
 	    mapping->begin = cluster;
 	    if(read_directory(s, i)) {
-                error_setg(errp, "Could not read directory %s",
-                           mapping->path);
+		fprintf(stderr, "Could not read directory %s\n",
+			mapping->path);
 		return -1;
 	    }
 	    mapping = array_get(&(s->mapping), i);
@@ -922,10 +921,9 @@ static int init_directories(BDRVVVFATState* s,
 	cluster = mapping->end;

 	if(cluster > s->cluster_count) {
-            error_setg(errp,
-                       "Directory does not fit in FAT%d (capacity %.2f MB)",
-                       s->fat_type, s->sector_count / 2000.0);
-            return -1;
+	    fprintf(stderr,"Directory does not fit in FAT%d (capacity %.2f MB)\n",
+		    s->fat_type, s->sector_count / 2000.0);
+	    return -EINVAL;
 	}

 	/* fix fat for entry */
@@ -983,7 +981,7 @@ static int init_directories(BDRVVVFATState* s,
 static BDRVVVFATState *vvv = NULL;
 #endif

-static int enable_write_target(BDRVVVFATState *s, Error **errp);
+static int enable_write_target(BDRVVVFATState *s);
 static int is_consistent(BDRVVVFATState *s);

 static void vvfat_rebind(BlockDriverState *bs)
@@ -1164,7 +1162,7 @@ DLOG(if (stderr == NULL) {
    s->sector_count = cyls * heads * secs - (s->first_sectors_number - 1);

    if (qemu_opt_get_bool(opts, "rw", false)) {
-        ret = enable_write_target(s, errp);
+        ret = enable_write_target(s);
        if (ret < 0) {
            goto fail;
        }
@@ -1173,7 +1171,7 @@ DLOG(if (stderr == NULL) {

    bs->total_sectors = cyls * heads * secs;

-    if (init_directories(s, dirname, heads, secs, errp)) {
+    if (init_directories(s, dirname, heads, secs)) {
        ret = -EIO;
        goto fail;
    }
@@ -2908,10 +2906,11 @@ static BlockDriver vvfat_write_target = {
    .bdrv_close         = write_target_close,
 };

-static int enable_write_target(BDRVVVFATState *s, Error **errp)
+static int enable_write_target(BDRVVVFATState *s)
 {
-    BlockDriver *bdrv_qcow = NULL;
-    QemuOpts *opts = NULL;
+    BlockDriver *bdrv_qcow;
+    QEMUOptionParameter *options;
+    Error *local_err = NULL;
    int ret;
    int size = sector2cluster(s, s->sector_count);
    s->used_clusters = calloc(size, 1);
@@ -2921,26 +2920,28 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp)
    s->qcow_filename = g_malloc(1024);
    ret = get_tmp_filename(s->qcow_filename, 1024);
    if (ret < 0) {
-        error_setg_errno(errp, -ret, "can't create temporary file");
        goto err;
    }

    bdrv_qcow = bdrv_find_format("qcow");
-    opts = qemu_opts_create(bdrv_qcow->create_opts, NULL, 0, &error_abort);
-    qemu_opt_set_number(opts, BLOCK_OPT_SIZE, s->sector_count * 512);
-    qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, "fat:");
+    options = parse_option_parameters("", bdrv_qcow->create_options, NULL);
+    set_option_parameter_int(options, BLOCK_OPT_SIZE, s->sector_count * 512);
+    set_option_parameter(options, BLOCK_OPT_BACKING_FILE, "fat:");

-    ret = bdrv_create(bdrv_qcow, s->qcow_filename, opts, errp);
-    qemu_opts_del(opts);
+    ret = bdrv_create(bdrv_qcow, s->qcow_filename, options, &local_err);
    if (ret < 0) {
+        qerror_report_err(local_err);
+        error_free(local_err);
        goto err;
    }

    s->qcow = NULL;
    ret = bdrv_open(&s->qcow, s->qcow_filename, NULL, NULL,
-                    BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH,
-                    bdrv_qcow, errp);
+            BDRV_O_RDWR | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH, bdrv_qcow,
+            &local_err);
    if (ret < 0) {
+        qerror_report_err(local_err);
+        error_free(local_err);
        goto err;
    }

@@ -2948,7 +2949,7 @@ static int enable_write_target(BDRVVVFATState *s, Error **errp)
    unlink(s->qcow_filename);
 #endif

-    bdrv_set_backing_hd(s->bs, bdrv_new("", &error_abort));
+    s->bs->backing_hd = bdrv_new("");
    s->bs->backing_hd->drv = &vvfat_write_target;
    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
    *(void**)s->bs->backing_hd->opaque = s;
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -40,7 +40,6 @@ struct QEMUWin32AIOState {
    HANDLE hIOCP;
    EventNotifier e;
    int count;
-    bool is_aio_context_attached;
 };

 typedef struct QEMUWin32AIOCB {
@@ -115,7 +114,7 @@ static void win32_aio_cancel(BlockDriverAIOCB *blockacb)
     * wait for completion.
     */
    while (!HasOverlappedIoCompleted(&waiocb->ov)) {
-        aio_poll(bdrv_get_aio_context(blockacb->bs), true);
+        qemu_aio_wait();
    }
 }

@@ -181,20 +180,6 @@ int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile)
    }
 }

-void win32_aio_detach_aio_context(QEMUWin32AIOState *aio,
-                                  AioContext *old_context)
-{
-    aio_set_event_notifier(old_context, &aio->e, NULL);
-    aio->is_aio_context_attached = false;
-}
-
-void win32_aio_attach_aio_context(QEMUWin32AIOState *aio,
-                                  AioContext *new_context)
-{
-    aio->is_aio_context_attached = true;
-    aio_set_event_notifier(new_context, &aio->e, win32_aio_completion_cb);
-}
-
 QEMUWin32AIOState *win32_aio_init(void)
 {
    QEMUWin32AIOState *s;
@@ -209,6 +194,8 @@ QEMUWin32AIOState *win32_aio_init(void)
        goto out_close_efd;
    }

+    qemu_aio_set_event_notifier(&s->e, win32_aio_completion_cb);
+
    return s;

 out_close_efd:
@@ -217,11 +204,3 @@ out_free_state:
    g_free(s);
    return NULL;
 }
-
-void win32_aio_cleanup(QEMUWin32AIOState *aio)
-{
-    assert(!aio->is_aio_context_attached);
-    CloseHandle(aio->hIOCP);
-    event_notifier_cleanup(&aio->e);
-    g_free(aio);
-}
--- a/blockdev.c
+++ b/blockdev.c
@@ -34,6 +34,7 @@
 #include "hw/block/block.h"
 #include "block/blockjob.h"
 #include "monitor/monitor.h"
+#include "qapi/qmp/qerror.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "qapi/qmp/types.h"
@@ -106,7 +107,7 @@ void blockdev_auto_del(BlockDriverState *bs)
    DriveInfo *dinfo = drive_get_by_blockdev(bs);

    if (dinfo && dinfo->auto_del) {
-        drive_del(dinfo);
+        drive_put_ref(dinfo);
    }
 }

@@ -213,7 +214,7 @@ static void bdrv_format_print(void *opaque, const char *name)
    error_printf(" %s", name);
 }

-void drive_del(DriveInfo *dinfo)
+static void drive_uninit(DriveInfo *dinfo)
 {
    if (dinfo->opts) {
        qemu_opts_del(dinfo->opts);
@@ -226,6 +227,19 @@ void drive_del(DriveInfo *dinfo)
    g_free(dinfo);
 }

+void drive_put_ref(DriveInfo *dinfo)
+{
+    assert(dinfo->refcount);
+    if (--dinfo->refcount == 0) {
+        drive_uninit(dinfo);
+    }
+}
+
+void drive_get_ref(DriveInfo *dinfo)
+{
+    dinfo->refcount++;
+}
+
 typedef struct {
    QEMUBH *bh;
    BlockDriverState *bs;
@@ -274,25 +288,6 @@ static int parse_block_error_action(const char *buf, bool is_read, Error **errp)
    }
 }

-static inline int parse_enum_option(const char *lookup[], const char *buf,
-                                    int max, int def, Error **errp)
-{
-    int i;
-
-    if (!buf) {
-        return def;
-    }
-
-    for (i = 0; i < max; i++) {
-        if (!strcmp(buf, lookup[i])) {
-            return i;
-        }
-    }
-
-    error_setg(errp, "invalid parameter value: %s", buf);
-    return def;
-}
-
 static bool check_throttle_config(ThrottleConfig *cfg, Error **errp)
 {
    if (throttle_conflicting(cfg)) {
@@ -316,6 +311,7 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
                                Error **errp)
 {
    const char *buf;
+    const char *serial;
    int ro = 0;
    int bdrv_flags = 0;
    int on_read_error, on_write_error;
@@ -328,7 +324,6 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
    QemuOpts *opts;
    const char *id;
    bool has_driver_specific_opts;
-    BlockdevDetectZeroesOptions detect_zeroes;
    BlockDriver *drv = NULL;

    /* Check common options by copying from bs_opts to opts, all other options
@@ -357,6 +352,8 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
    ro = qemu_opt_get_bool(opts, "read-only", 0);
    copy_on_read = qemu_opt_get_bool(opts, "copy-on-read", false);

+    serial = qemu_opt_get(opts, "serial");
+
    if ((buf = qemu_opt_get(opts, "discard")) != NULL) {
        if (bdrv_parse_discard_flags(buf, &bdrv_flags) != 0) {
            error_setg(errp, "invalid discard option");
@@ -455,35 +452,22 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,
        }
    }

-    detect_zeroes =
-        parse_enum_option(BlockdevDetectZeroesOptions_lookup,
-                          qemu_opt_get(opts, "detect-zeroes"),
-                          BLOCKDEV_DETECT_ZEROES_OPTIONS_MAX,
-                          BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF,
-                          &error);
-    if (error) {
-        error_propagate(errp, error);
-        goto early_err;
-    }
-
-    if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-        !(bdrv_flags & BDRV_O_UNMAP)) {
-        error_setg(errp, "setting detect-zeroes to unmap is not allowed "
-                         "without setting discard operation to unmap");
+    if (bdrv_find_node(qemu_opts_id(opts))) {
+        error_setg(errp, "device id=%s is conflicting with a node-name",
+                   qemu_opts_id(opts));
        goto early_err;
    }

    /* init */
    dinfo = g_malloc0(sizeof(*dinfo));
    dinfo->id = g_strdup(qemu_opts_id(opts));
-    dinfo->bdrv = bdrv_new(dinfo->id, &error);
-    if (error) {
-        error_propagate(errp, error);
-        goto bdrv_new_err;
-    }
+    dinfo->bdrv = bdrv_new(dinfo->id);
    dinfo->bdrv->open_flags = snapshot ? BDRV_O_SNAPSHOT : 0;
    dinfo->bdrv->read_only = ro;
-    dinfo->bdrv->detect_zeroes = detect_zeroes;
+    dinfo->refcount = 1;
+    if (serial != NULL) {
+        dinfo->serial = g_strdup(serial);
+    }
    QTAILQ_INSERT_TAIL(&drives, dinfo, next);

    bdrv_set_on_error(dinfo->bdrv, on_read_error, on_write_error);
@@ -539,9 +523,8 @@ static DriveInfo *blockdev_init(const char *file, QDict *bs_opts,

 err:
    bdrv_unref(dinfo->bdrv);
-    QTAILQ_REMOVE(&drives, dinfo, next);
-bdrv_new_err:
    g_free(dinfo->id);
+    QTAILQ_REMOVE(&drives, dinfo, next);
    g_free(dinfo);
 early_err:
    qemu_opts_del(opts);
@@ -609,10 +592,6 @@ QemuOptsList qemu_legacy_drive_opts = {
            .name = "addr",
            .type = QEMU_OPT_STRING,
            .help = "pci address (virtio only)",
-        },{
-            .name = "serial",
-            .type = QEMU_OPT_STRING,
-            .help = "disk serial number",
        },{
            .name = "file",
            .type = QEMU_OPT_STRING,
@@ -642,7 +621,7 @@ QemuOptsList qemu_legacy_drive_opts = {
    },
 };

-DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
+DriveInfo *drive_init(QemuOpts *all_opts, BlockInterfaceType block_default_type)
 {
    const char *value;
    DriveInfo *dinfo = NULL;
@@ -656,7 +635,6 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
    const char *werror, *rerror;
    bool read_only = false;
    bool copy_on_read;
-    const char *serial;
    const char *filename;
    Error *local_err = NULL;

@@ -715,7 +693,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
                                   &error_abort);
    qemu_opts_absorb_qdict(legacy_opts, bs_opts, &local_err);
    if (local_err) {
-        error_report("%s", error_get_pretty(local_err));
+        qerror_report_err(local_err);
        error_free(local_err);
        goto fail;
    }
@@ -860,9 +838,6 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
        goto fail;
    }

-    /* Serial number */
-    serial = qemu_opt_get(legacy_opts, "serial");
-
    /* no id supplied -> create one */
    if (qemu_opts_id(all_opts) == NULL) {
        char *new_id;
@@ -931,7 +906,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
    bs_opts = NULL;
    if (dinfo == NULL) {
        if (local_err) {
-            error_report("%s", error_get_pretty(local_err));
+            qerror_report_err(local_err);
            error_free(local_err);
        }
        goto fail;
@@ -953,8 +928,6 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
    dinfo->unit = unit_id;
    dinfo->devaddr = devaddr;

-    dinfo->serial = g_strdup(serial);
-
    switch(type) {
    case IF_IDE:
    case IF_SCSI:
@@ -1146,7 +1119,6 @@ typedef struct InternalSnapshotState {
 static void internal_snapshot_prepare(BlkTransactionState *common,
                                      Error **errp)
 {
-    Error *local_err = NULL;
    const char *device;
    const char *name;
    BlockDriverState *bs;
@@ -1195,10 +1167,8 @@ static void internal_snapshot_prepare(BlkTransactionState *common,
    }

    /* check whether a snapshot with name exist */
-    ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn,
-                                            &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn, errp);
+    if (error_is_set(errp)) {
        return;
    } else if (ret) {
        error_setg(errp,
@@ -1326,8 +1296,8 @@ static void external_snapshot_prepare(BlkTransactionState *common,
        return;
    }

-    if (bdrv_op_is_blocked(state->old_bs,
-                           BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
+    if (bdrv_in_use(state->old_bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, device);
        return;
    }

@@ -1549,20 +1519,19 @@ exit:

 static void eject_device(BlockDriverState *bs, int force, Error **errp)
 {
-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_EJECT, errp)) {
+    if (bdrv_in_use(bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, bdrv_get_device_name(bs));
        return;
    }
    if (!bdrv_dev_has_removable_media(bs)) {
-        error_setg(errp, "Device '%s' is not removable",
-                   bdrv_get_device_name(bs));
+        error_set(errp, QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));
        return;
    }

    if (bdrv_dev_is_medium_locked(bs) && !bdrv_dev_is_tray_open(bs)) {
        bdrv_dev_eject_request(bs, force);
        if (!force) {
-            error_setg(errp, "Device '%s' is locked",
-                       bdrv_get_device_name(bs));
+            error_set(errp, QERR_DEVICE_LOCKED, bdrv_get_device_name(bs));
            return;
        }
    }
@@ -1693,7 +1662,6 @@ void qmp_block_set_io_throttle(const char *device, int64_t bps, int64_t bps_rd,
 {
    ThrottleConfig cfg;
    BlockDriverState *bs;
-    AioContext *aio_context;

    bs = bdrv_find(device);
    if (!bs) {
@@ -1737,9 +1705,6 @@ void qmp_block_set_io_throttle(const char *device, int64_t bps, int64_t bps_rd,
        return;
    }

-    aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(aio_context);
-
    if (!bs->io_limits_enabled && throttle_enabled(&cfg)) {
        bdrv_io_limits_enable(bs);
    } else if (bs->io_limits_enabled && !throttle_enabled(&cfg)) {
@@ -1749,24 +1714,20 @@ void qmp_block_set_io_throttle(const char *device, int64_t bps, int64_t bps_rd,
    if (bs->io_limits_enabled) {
        bdrv_set_io_limits(bs, &cfg);
    }
-
-    aio_context_release(aio_context);
 }

 int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data)
 {
    const char *id = qdict_get_str(qdict, "id");
    BlockDriverState *bs;
-    Error *local_err = NULL;

    bs = bdrv_find(id);
    if (!bs) {
-        error_report("Device '%s' not found", id);
+        qerror_report(QERR_DEVICE_NOT_FOUND, id);
        return -1;
    }
-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, &local_err)) {
-        error_report("%s", error_get_pretty(local_err));
-        error_free(local_err);
+    if (bdrv_in_use(bs)) {
+        qerror_report(QERR_DEVICE_IN_USE, id);
        return -1;
    }

@@ -1787,7 +1748,7 @@ int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data)
        bdrv_set_on_error(bs, BLOCKDEV_ON_ERROR_REPORT,
                          BLOCKDEV_ON_ERROR_REPORT);
    } else {
-        drive_del(drive_get_by_blockdev(bs));
+        drive_uninit(drive_get_by_blockdev(bs));
    }

    return 0;
@@ -1819,11 +1780,6 @@ void qmp_block_resize(bool has_device, const char *device,
        return;
    }

-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_RESIZE, NULL)) {
-        error_set(errp, QERR_DEVICE_IN_USE, device);
-        return;
-    }
-
    /* complete all in-flight operations before resizing the device */
    bdrv_drain_all();

@@ -1852,36 +1808,35 @@ void qmp_block_resize(bool has_device, const char *device,
 static void block_job_cb(void *opaque, int ret)
 {
    BlockDriverState *bs = opaque;
-    const char *msg = NULL;
+    QObject *obj;

    trace_block_job_cb(bs, bs->job, ret);

    assert(bs->job);
-
+    obj = qobject_from_block_job(bs->job);
    if (ret < 0) {
-        msg = strerror(-ret);
+        QDict *dict = qobject_to_qdict(obj);
+        qdict_put(dict, "error", qstring_from_str(strerror(-ret)));
    }

    if (block_job_is_cancelled(bs->job)) {
-        block_job_event_cancelled(bs->job);
+        monitor_protocol_event(QEVENT_BLOCK_JOB_CANCELLED, obj);
    } else {
-        block_job_event_completed(bs->job, msg);
+        monitor_protocol_event(QEVENT_BLOCK_JOB_COMPLETED, obj);
    }
+    qobject_decref(obj);

    bdrv_put_ref_bh_schedule(bs);
 }

-void qmp_block_stream(const char *device,
-                      bool has_base, const char *base,
-                      bool has_backing_file, const char *backing_file,
-                      bool has_speed, int64_t speed,
+void qmp_block_stream(const char *device, bool has_base,
+                      const char *base, bool has_speed, int64_t speed,
                      bool has_on_error, BlockdevOnError on_error,
                      Error **errp)
 {
    BlockDriverState *bs;
    BlockDriverState *base_bs = NULL;
    Error *local_err = NULL;
-    const char *base_name = NULL;

    if (!has_on_error) {
        on_error = BLOCKDEV_ON_ERROR_REPORT;
@@ -1893,31 +1848,15 @@ void qmp_block_stream(const char *device,
        return;
    }

-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_STREAM, errp)) {
-        return;
-    }
-
-    if (has_base) {
+    if (base) {
        base_bs = bdrv_find_backing_image(bs, base);
        if (base_bs == NULL) {
            error_set(errp, QERR_BASE_NOT_FOUND, base);
            return;
        }
-        base_name = base;
    }

-    /* if we are streaming the entire chain, the result will have no backing
-     * file, and specifying one is therefore an error */
-    if (base_bs == NULL && has_backing_file) {
-        error_setg(errp, "backing file specified, but streaming the "
-                         "entire chain");
-        return;
-    }
-
-    /* backing_file string overrides base bs filename */
-    base_name = has_backing_file ? backing_file : base_name;
-
-    stream_start(bs, base_bs, base_name, has_speed ? speed : 0,
+    stream_start(bs, base_bs, base, has_speed ? speed : 0,
                 on_error, block_job_cb, bs, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
@@ -1930,7 +1869,6 @@ void qmp_block_stream(const char *device,
 void qmp_block_commit(const char *device,
                      bool has_base, const char *base,
                      bool has_top, const char *top,
-                      bool has_backing_file, const char *backing_file,
                      bool has_speed, int64_t speed,
                      Error **errp)
 {
@@ -1960,10 +1898,6 @@ void qmp_block_commit(const char *device,
        return;
    }

-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_COMMIT, errp)) {
-        return;
-    }
-
    /* default top_bs is the active layer */
    top_bs = bs;

@@ -1996,16 +1930,11 @@ void qmp_block_commit(const char *device,
    }

    if (top_bs == bs) {
-        if (has_backing_file) {
-            error_setg(errp, "'backing-file' specified,"
-                             " but 'top' is the active layer");
-            return;
-        }
        commit_active_start(bs, base_bs, speed, on_error, block_job_cb,
                            bs, &local_err);
    } else {
        commit_start(bs, base_bs, top_bs, speed, on_error, block_job_cb, bs,
-                     has_backing_file ? backing_file : NULL, &local_err);
+                    &local_err);
    }
    if (local_err != NULL) {
        error_propagate(errp, local_err);
@@ -2066,7 +1995,8 @@ void qmp_drive_backup(const char *device, const char *target,
        }
    }

-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
+    if (bdrv_in_use(bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, device);
        return;
    }

@@ -2132,8 +2062,6 @@ BlockDeviceInfoList *qmp_query_named_block_nodes(Error **errp)

 void qmp_drive_mirror(const char *device, const char *target,
                      bool has_format, const char *format,
-                      bool has_node_name, const char *node_name,
-                      bool has_replaces, const char *replaces,
                      enum MirrorSyncMode sync,
                      bool has_mode, enum NewImageMode mode,
                      bool has_speed, int64_t speed,
@@ -2147,7 +2075,6 @@ void qmp_drive_mirror(const char *device, const char *target,
    BlockDriverState *source, *target_bs;
    BlockDriver *drv = NULL;
    Error *local_err = NULL;
-    QDict *options = NULL;
    int flags;
    int64_t size;
    int ret;
@@ -2202,7 +2129,8 @@ void qmp_drive_mirror(const char *device, const char *target,
        }
    }

-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_MIRROR, errp)) {
+    if (bdrv_in_use(bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, device);
        return;
    }

@@ -2221,29 +2149,6 @@ void qmp_drive_mirror(const char *device, const char *target,
        return;
    }

-    if (has_replaces) {
-        BlockDriverState *to_replace_bs;
-
-        if (!has_node_name) {
-            error_setg(errp, "a node-name must be provided when replacing a"
-                             " named node of the graph");
-            return;
-        }
-
-        to_replace_bs = check_to_replace_node(replaces, &local_err);
-
-        if (!to_replace_bs) {
-            error_propagate(errp, local_err);
-            return;
-        }
-
-        if (size != bdrv_getlength(to_replace_bs)) {
-            error_setg(errp, "cannot replace image with a mirror image of "
-                             "different size");
-            return;
-        }
-    }
-
    if ((sync == MIRROR_SYNC_MODE_FULL || !source)
        && mode != NEW_IMAGE_MODE_EXISTING)
    {
@@ -2272,28 +2177,18 @@ void qmp_drive_mirror(const char *device, const char *target,
        return;
    }

-    if (has_node_name) {
-        options = qdict_new();
-        qdict_put(options, "node-name", qstring_from_str(node_name));
-    }
-
    /* Mirroring takes care of copy-on-write using the source's backing
     * file.
     */
    target_bs = NULL;
-    ret = bdrv_open(&target_bs, target, NULL, options,
-                    flags | BDRV_O_NO_BACKING, drv, &local_err);
+    ret = bdrv_open(&target_bs, target, NULL, NULL, flags | BDRV_O_NO_BACKING,
+                    drv, &local_err);
    if (ret < 0) {
        error_propagate(errp, local_err);
        return;
    }

-    /* pass the node name to replace to mirror start since it's loose coupling
-     * and will allow to check whether the node still exist at mirror completion
-     */
-    mirror_start(bs, target_bs,
-                 has_replaces ? replaces : NULL,
-                 speed, granularity, buf_size, sync,
+    mirror_start(bs, target_bs, speed, granularity, buf_size, sync,
                 on_source_error, on_target_error,
                 block_job_cb, bs, &local_err);
    if (local_err != NULL) {
@@ -2340,8 +2235,7 @@ void qmp_block_job_cancel(const char *device,
        return;
    }
    if (job->paused && !force) {
-        error_setg(errp, "The block job for device '%s' is currently paused",
-                   device);
+        error_set(errp, QERR_BLOCK_JOB_PAUSED, device);
        return;
    }

@@ -2388,85 +2282,6 @@ void qmp_block_job_complete(const char *device, Error **errp)
    block_job_complete(job, errp);
 }

-void qmp_change_backing_file(const char *device,
-                             const char *image_node_name,
-                             const char *backing_file,
-                             Error **errp)
-{
-    BlockDriverState *bs = NULL;
-    BlockDriverState *image_bs = NULL;
-    Error *local_err = NULL;
-    bool ro;
-    int open_flags;
-    int ret;
-
-    /* find the top layer BDS of the chain */
-    bs = bdrv_find(device);
-    if (!bs) {
-        error_set(errp, QERR_DEVICE_NOT_FOUND, device);
-        return;
-    }
-
-    image_bs = bdrv_lookup_bs(NULL, image_node_name, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    if (!image_bs) {
-        error_setg(errp, "image file not found");
-        return;
-    }
-
-    if (bdrv_find_base(image_bs) == image_bs) {
-        error_setg(errp, "not allowing backing file change on an image "
-                         "without a backing file");
-        return;
-    }
-
-    /* even though we are not necessarily operating on bs, we need it to
-     * determine if block ops are currently prohibited on the chain */
-    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_CHANGE, errp)) {
-        return;
-    }
-
-    /* final sanity check */
-    if (!bdrv_chain_contains(bs, image_bs)) {
-        error_setg(errp, "'%s' and image file are not in the same chain",
-                   device);
-        return;
-    }
-
-    /* if not r/w, reopen to make r/w */
-    open_flags = image_bs->open_flags;
-    ro = bdrv_is_read_only(image_bs);
-
-    if (ro) {
-        bdrv_reopen(image_bs, open_flags | BDRV_O_RDWR, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return;
-        }
-    }
-
-    ret = bdrv_change_backing_file(image_bs, backing_file,
-                               image_bs->drv ? image_bs->drv->format_name : "");
-
-    if (ret < 0) {
-        error_setg_errno(errp, -ret, "Could not change backing file to '%s'",
-                         backing_file);
-        /* don't exit here, so we can try to restore open flags if
-         * appropriate */
-    }
-
-    if (ro) {
-        bdrv_reopen(image_bs, open_flags, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err); /* will preserve prior errp */
-        }
-    }
-}
-
 void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
 {
    QmpOutputVisitor *ov = qmp_output_visitor_new();
@@ -2481,9 +2296,9 @@ void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
        goto fail;
    }

-    /* TODO Sort it out in raw-posix and drive_new(): Reject aio=native with
+    /* TODO Sort it out in raw-posix and drive_init: Reject aio=native with
     * cache.direct=false instead of silently switching to aio=threads, except
-     * when called from drive_new().
+     * if called from drive_init.
     *
     * For now, simply forbidding the combination for all drivers will do. */
    if (options->has_aio && options->aio == BLOCKDEV_AIO_OPTIONS_NATIVE) {
@@ -2515,7 +2330,7 @@ void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
    }

    if (bdrv_key_required(dinfo->bdrv)) {
-        drive_del(dinfo);
+        drive_uninit(dinfo);
        error_setg(errp, "blockdev-add doesn't support encrypted devices");
        goto fail;
    }
@@ -2578,6 +2393,10 @@ QemuOptsList qemu_common_drive_opts = {
            .name = "format",
            .type = QEMU_OPT_STRING,
            .help = "disk format (raw, qcow2, ...)",
+        },{
+            .name = "serial",
+            .type = QEMU_OPT_STRING,
+            .help = "disk serial number",
        },{
            .name = "rerror",
            .type = QEMU_OPT_STRING,
@@ -2646,10 +2465,6 @@ QemuOptsList qemu_common_drive_opts = {
            .name = "copy-on-read",
            .type = QEMU_OPT_BOOL,
            .help = "copy read data from backing file into image file",
-        },{
-            .name = "detect-zeroes",
-            .type = QEMU_OPT_STRING,
-            .help = "try to optimize zero writes (off, on, unmap)",
        },
        { /* end of list */ }
    },
--- a/blockjob.c
+++ b/blockjob.c
@@ -26,6 +26,7 @@
 #include "config-host.h"
 #include "qemu-common.h"
 #include "trace.h"
+#include "monitor/monitor.h"
 #include "block/block.h"
 #include "block/blockjob.h"
 #include "block/block_int.h"
@@ -33,7 +34,6 @@
 #include "block/coroutine.h"
 #include "qmp-commands.h"
 #include "qemu/timer.h"
-#include "qapi-event.h"

 void *block_job_create(const BlockJobDriver *driver, BlockDriverState *bs,
                       int64_t speed, BlockDriverCompletionFunc *cb,
@@ -41,16 +41,14 @@ void *block_job_create(const BlockJobDriver *driver, BlockDriverState *bs,
 {
    BlockJob *job;

-    if (bs->job) {
+    if (bs->job || bdrv_in_use(bs)) {
        error_set(errp, QERR_DEVICE_IN_USE, bdrv_get_device_name(bs));
        return NULL;
    }
    bdrv_ref(bs);
-    job = g_malloc0(driver->instance_size);
-    error_setg(&job->blocker, "block device is in use by block job: %s",
-               BlockJobType_lookup[driver->job_type]);
-    bdrv_op_block_all(bs, job->blocker);
+    bdrv_set_in_use(bs, 1);

+    job = g_malloc0(driver->instance_size);
    job->driver        = driver;
    job->bs            = bs;
    job->cb            = cb;
@@ -65,9 +63,8 @@ void *block_job_create(const BlockJobDriver *driver, BlockDriverState *bs,
        block_job_set_speed(job, speed, &local_err);
        if (local_err) {
            bs->job = NULL;
-            bdrv_op_unblock_all(bs, job->blocker);
-            error_free(job->blocker);
            g_free(job);
+            bdrv_set_in_use(bs, 0);
            error_propagate(errp, local_err);
            return NULL;
        }
@@ -82,9 +79,8 @@ void block_job_completed(BlockJob *job, int ret)
    assert(bs->job == job);
    job->cb(job->opaque, ret);
    bs->job = NULL;
-    bdrv_op_unblock_all(bs, job->blocker);
-    error_free(job->blocker);
    g_free(job);
+    bdrv_set_in_use(bs, 0);
 }

 void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
@@ -92,7 +88,7 @@ void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
    Error *local_err = NULL;

    if (!job->driver->set_speed) {
-        error_set(errp, QERR_UNSUPPORTED);
+        error_set(errp, QERR_NOT_SUPPORTED);
        return;
    }
    job->driver->set_speed(job, speed, &local_err);
@@ -187,7 +183,7 @@ int block_job_cancel_sync(BlockJob *job)
    job->opaque = &data;
    block_job_cancel(job);
    while (data.ret == -EINPROGRESS) {
-        aio_poll(bdrv_get_aio_context(bs), true);
+        qemu_aio_wait();
    }
    return (data.cancelled && data.ret == 0) ? -ECANCELED : data.ret;
 }
@@ -246,35 +242,26 @@ static void block_job_iostatus_set_err(BlockJob *job, int error)
    }
 }

-void block_job_event_cancelled(BlockJob *job)
+
+QObject *qobject_from_block_job(BlockJob *job)
 {
-    qapi_event_send_block_job_cancelled(job->driver->job_type,
-                                        bdrv_get_device_name(job->bs),
-                                        job->len,
-                                        job->offset,
-                                        job->speed,
-                                        &error_abort);
+    return qobject_from_jsonf("{ 'type': %s,"
+                              "'device': %s,"
+                              "'len': %" PRId64 ","
+                              "'offset': %" PRId64 ","
+                              "'speed': %" PRId64 " }",
+                              BlockJobType_lookup[job->driver->job_type],
+                              bdrv_get_device_name(job->bs),
+                              job->len,
+                              job->offset,
+                              job->speed);
 }

-void block_job_event_completed(BlockJob *job, const char *msg)
+void block_job_ready(BlockJob *job)
 {
-    qapi_event_send_block_job_completed(job->driver->job_type,
-                                        bdrv_get_device_name(job->bs),
-                                        job->len,
-                                        job->offset,
-                                        job->speed,
-                                        !!msg,
-                                        msg,
-                                        &error_abort);
-}
-
-void block_job_event_ready(BlockJob *job)
-{
-    qapi_event_send_block_job_ready(job->driver->job_type,
-                                    bdrv_get_device_name(job->bs),
-                                    job->len,
-                                    job->offset,
-                                    job->speed, &error_abort);
+    QObject *data = qobject_from_block_job(job);
+    monitor_protocol_event(QEVENT_BLOCK_JOB_READY, data);
+    qobject_decref(data);
 }

 BlockErrorAction block_job_error_action(BlockJob *job, BlockDriverState *bs,
@@ -285,26 +272,22 @@ BlockErrorAction block_job_error_action(BlockJob *job, BlockDriverState *bs,

    switch (on_err) {
    case BLOCKDEV_ON_ERROR_ENOSPC:
-        action = (error == ENOSPC) ?
-                 BLOCK_ERROR_ACTION_STOP : BLOCK_ERROR_ACTION_REPORT;
+        action = (error == ENOSPC) ? BDRV_ACTION_STOP : BDRV_ACTION_REPORT;
        break;
    case BLOCKDEV_ON_ERROR_STOP:
-        action = BLOCK_ERROR_ACTION_STOP;
+        action = BDRV_ACTION_STOP;
        break;
    case BLOCKDEV_ON_ERROR_REPORT:
-        action = BLOCK_ERROR_ACTION_REPORT;
+        action = BDRV_ACTION_REPORT;
        break;
    case BLOCKDEV_ON_ERROR_IGNORE:
-        action = BLOCK_ERROR_ACTION_IGNORE;
+        action = BDRV_ACTION_IGNORE;
        break;
    default:
        abort();
    }
-    qapi_event_send_block_job_error(bdrv_get_device_name(job->bs),
-                                    is_read ? IO_OPERATION_TYPE_READ :
-                                    IO_OPERATION_TYPE_WRITE,
-                                    action, &error_abort);
-    if (action == BLOCK_ERROR_ACTION_STOP) {
+    bdrv_emit_qmp_error_event(job->bs, QEVENT_BLOCK_JOB_ERROR, action, is_read);
+    if (action == BDRV_ACTION_STOP) {
        block_job_pause(job);
        block_job_iostatus_set_err(job, error);
        if (bs != job->bs) {
--- a/bsd-user/freebsd/strace.list
+++ b/bsd-user/freebsd/strace.list
@@ -1,37 +1,7 @@
-/*
- *  FreeBSD strace list
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-{ TARGET_FREEBSD_NR___acl_aclcheck_fd, "__acl_aclcheck_fd", "%s(%d, %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_aclcheck_file, "__acl_aclcheck_file", "%s(\"%s\", %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_aclcheck_link, "__acl_aclcheck_link", "%s(\"%s\", %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_delete_fd, "__acl_delete_fd", "%s(%d, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_delete_file, "__acl_delete_file", "%s(\"%s\", %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_delete_link, "__acl_delete_link", "%s(\"%s\", %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_get_fd, "__acl_get_fd", "%s(%d, %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_get_file, "__acl_get_file", "%s(\"%s\", %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_get_link, "__acl_get_link", "%s(\"%s\", %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_set_fd, "__acl_set_fd", "%s(%d, %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_set_file, "__acl_set_file", "%s(\"%s\", %d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR___acl_set_link, "__acl_set_link", "%s(\"%s\", %d, %#x)", NULL, NULL },
+{ TARGET_FREEBSD_NR___getcwd, "__getcwd", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR___semctl, "__semctl", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR___syscall, "__syscall", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR___sysctl, "__sysctl", NULL, print_sysctl, NULL },
-{ TARGET_FREEBSD_NR__umtx_op, "_umtx_op", "%s(%#x, %d, %d, %#x, %#x)", NULL, NULL },
+{ TARGET_FREEBSD_NR___sysctl, "__sysctl", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_accept, "accept", "%s(%d,%#x,%#x)", NULL, NULL },
 { TARGET_FREEBSD_NR_access, "access", "%s(\"%s\",%#o)", NULL, NULL },
 { TARGET_FREEBSD_NR_acct, "acct", NULL, NULL, NULL },
@@ -50,41 +20,24 @@
 { TARGET_FREEBSD_NR_connect, "connect", "%s(%d,%#x,%d)", NULL, NULL },
 { TARGET_FREEBSD_NR_dup, "dup", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_dup2, "dup2", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_eaccess, "eaccess", "%s(\"%s\",%#x)", NULL, NULL },
 { TARGET_FREEBSD_NR_execve, "execve", NULL, print_execve, NULL },
 { TARGET_FREEBSD_NR_exit, "exit", "%s(%d)\n", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattrctl, "extattrctl", "%s(\"%s\", %d, \"%s\", %d, \"%s\"", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_delete_fd, "extattr_delete_fd", "%s(%d, %d, \"%s\")", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_delete_file, "extattr_delete_file", "%s(\"%s\", %d, \"%s\")", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_delete_link, "extattr_delete_link", "%s(\"%s\", %d, \"%s\")", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_get_fd, "extattr_get_fd", "%s(%d, %d, \"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_get_file, "extattr_get_file", "%s(\"%s\", %d, \"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_get_file, "extattr_get_link", "%s(\"%s\", %d, \"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_list_fd, "extattr_list_fd", "%s(%d, %d, %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_list_file, "extattr_list_file", "%s(\"%s\", %d, %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_list_link, "extattr_list_link", "%s(\"%s\", %d, %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_set_fd, "extattr_set_fd", "%s(%d, %d, \"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_set_file, "extattr_set_file", "%s(\"%s\", %d, \"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_extattr_set_link, "extattr_set_link", "%s(\"%s\", %d, \"%s\", %#x, %d)", NULL, NULL },
 { TARGET_FREEBSD_NR_fchdir, "fchdir", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_fchflags, "fchflags", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_fchmod, "fchmod", "%s(%d,%#o)", NULL, NULL },
-{ TARGET_FREEBSD_NR_fchown, "fchown", "%s(%d,%d,%d)", NULL, NULL },
+{ TARGET_FREEBSD_NR_fchown, "fchown", "%s(\"%s\",%d,%d)", NULL, NULL },
 { TARGET_FREEBSD_NR_fcntl, "fcntl", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_fexecve, "fexecve", NULL, print_execve, NULL },
 { TARGET_FREEBSD_NR_fhopen, "fhopen", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_fhstat, "fhstat", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_fhstatfs, "fhstatfs", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_flock, "flock", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_fork, "fork", "%s()", NULL, NULL },
 { TARGET_FREEBSD_NR_fpathconf, "fpathconf", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_fstat, "fstat", "%s(%d,%#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR_fstatat, "fstatat", "%s(%d,\"%s\", %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_fstatfs, "fstatfs", "%s(%d,%#x)", NULL, NULL },
+{ TARGET_FREEBSD_NR_fstat, "fstat", "%s(%d,%p)", NULL, NULL },
+{ TARGET_FREEBSD_NR_fstatfs, "fstatfs", "%s(%d,%p)", NULL, NULL },
 { TARGET_FREEBSD_NR_fsync, "fsync", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_ftruncate, "ftruncate", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_futimes, "futimes", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_getcontext, "getcontext", "%s(%#x)", NULL, NULL },
 { TARGET_FREEBSD_NR_getdirentries, "getdirentries", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_freebsd6_mmap, "freebsd6_mmap", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_getegid, "getegid", "%s()", NULL, NULL },
@@ -110,7 +63,7 @@
 { TARGET_FREEBSD_NR_getsockopt, "getsockopt", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_gettimeofday, "gettimeofday", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_getuid, "getuid", "%s()", NULL, NULL },
-{ TARGET_FREEBSD_NR_ioctl, "ioctl", NULL, print_ioctl, NULL },
+{ TARGET_FREEBSD_NR_ioctl, "ioctl", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_issetugid, "issetugid", "%s()", NULL, NULL },
 { TARGET_FREEBSD_NR_kevent, "kevent", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_kill, "kill", NULL, NULL, NULL },
@@ -119,7 +72,6 @@
 { TARGET_FREEBSD_NR_lchown, "lchown", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_link, "link", "%s(\"%s\",\"%s\")", NULL, NULL },
 { TARGET_FREEBSD_NR_listen, "listen", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_lpathconf, "lpathconf", "%s(\"%s\", %d)", NULL, NULL },
 { TARGET_FREEBSD_NR_lseek, "lseek", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_lstat, "lstat", "%s(\"%s\",%p)", NULL, NULL },
 { TARGET_FREEBSD_NR_madvise, "madvise", NULL, NULL, NULL },
@@ -144,8 +96,7 @@
 { TARGET_FREEBSD_NR_nanosleep, "nanosleep", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_nfssvc, "nfssvc", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_open, "open", "%s(\"%s\",%#x,%#o)", NULL, NULL },
-{ TARGET_FREEBSD_NR_openat, "openat", "%s(%d, \"%s\",%#x,%#o)", NULL, NULL },
-{ TARGET_FREEBSD_NR_pathconf, "pathconf", "%s(\"%s\", %d)", NULL, NULL },
+{ TARGET_FREEBSD_NR_pathconf, "pathconf", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_pipe, "pipe", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_poll, "poll", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_pread, "pread", NULL, NULL, NULL },
@@ -165,7 +116,6 @@
 { TARGET_FREEBSD_NR_revoke, "revoke", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_rfork, "rfork", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_rmdir, "rmdir", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_rtprio_thread, "rtprio_thread", "%s(%d, %d, %p)", NULL, NULL },
 { TARGET_FREEBSD_NR_sbrk, "sbrk", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sched_yield, "sched_yield", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_select, "select", NULL, NULL, NULL },
@@ -173,7 +123,6 @@
 { TARGET_FREEBSD_NR_semop, "semop", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sendmsg, "sendmsg", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sendto, "sendto", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_setcontext, "setcontext", "%s(%#x)", NULL, NULL },
 { TARGET_FREEBSD_NR_setegid, "setegid", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_seteuid, "seteuid", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_setgid, "setgid", NULL, NULL, NULL },
@@ -202,7 +151,7 @@
 { TARGET_FREEBSD_NR_sigprocmask, "sigprocmask", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sigreturn, "sigreturn", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sigsuspend, "sigsuspend", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_socket, "socket", "%s(%d,%d,%d)", NULL, NULL },
+{ TARGET_FREEBSD_NR_socket, "socket", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_socketpair, "socketpair", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sstk, "sstk", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_stat, "stat", "%s(\"%s\",%p)", NULL, NULL },
@@ -211,15 +160,6 @@
 { TARGET_FREEBSD_NR_sync, "sync", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_sysarch, "sysarch", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_syscall, "syscall", NULL, NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_create, "thr_create", "%s(%#x, %#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_exit, "thr_exit", "%s(%#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_kill, "thr_kill", "%s(%d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_kill2, "thr_kill2", "%s(%d, %d, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_new, "thr_new", "%s(%#x, %d)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_self, "thr_self", "%s(%#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_set_name, "thr_set_name", "%s(%d, \"%s\")", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_suspend, "thr_suspend", "%s(%d, %#x)", NULL, NULL },
-{ TARGET_FREEBSD_NR_thr_wake, "thr_wake", "%s(%d)", NULL, NULL },
 { TARGET_FREEBSD_NR_truncate, "truncate", NULL, NULL, NULL },
 { TARGET_FREEBSD_NR_umask, "umask", "%s(%#o)", NULL, NULL },
 { TARGET_FREEBSD_NR_unlink, "unlink", "%s(\"%s\")", NULL, NULL },
--- a/bsd-user/freebsd/syscall_nr.h
+++ b/bsd-user/freebsd/syscall_nr.h
@@ -1,450 +1,373 @@
 /*
 * System call numbers.
 *
- * created from FreeBSD: releng/9.1/sys/kern/syscalls.master 229723
- * 2012-01-06 19:29:16Z jhb
+ * $FreeBSD: src/sys/sys/syscall.h,v 1.224 2008/08/24 21:23:08 rwatson Exp $
+ * created from FreeBSD: head/sys/kern/syscalls.master 182123 2008-08-24 21:20:35Z rwatson
 */

-#define TARGET_FREEBSD_NR_syscall   0
-#define TARGET_FREEBSD_NR_exit  1
-#define TARGET_FREEBSD_NR_fork  2
-#define TARGET_FREEBSD_NR_read  3
-#define TARGET_FREEBSD_NR_write 4
-#define TARGET_FREEBSD_NR_open  5
-#define TARGET_FREEBSD_NR_close 6
-#define TARGET_FREEBSD_NR_wait4 7
-                /* 8 is old creat */
-#define TARGET_FREEBSD_NR_link  9
-#define TARGET_FREEBSD_NR_unlink    10
-                /* 11 is obsolete execv */
-#define TARGET_FREEBSD_NR_chdir 12
-#define TARGET_FREEBSD_NR_fchdir    13
-#define TARGET_FREEBSD_NR_mknod 14
-#define TARGET_FREEBSD_NR_chmod 15
-#define TARGET_FREEBSD_NR_chown 16
-#define TARGET_FREEBSD_NR_break 17
-#define TARGET_FREEBSD_NR_freebsd4_getfsstat    18
-                /* 19 is old lseek */
-#define TARGET_FREEBSD_NR_getpid    20
-#define TARGET_FREEBSD_NR_mount 21
-#define TARGET_FREEBSD_NR_unmount   22
-#define TARGET_FREEBSD_NR_setuid    23
-#define TARGET_FREEBSD_NR_getuid    24
-#define TARGET_FREEBSD_NR_geteuid   25
-#define TARGET_FREEBSD_NR_ptrace    26
-#define TARGET_FREEBSD_NR_recvmsg   27
-#define TARGET_FREEBSD_NR_sendmsg   28
-#define TARGET_FREEBSD_NR_recvfrom  29
-#define TARGET_FREEBSD_NR_accept    30
-#define TARGET_FREEBSD_NR_getpeername   31
-#define TARGET_FREEBSD_NR_getsockname   32
-#define TARGET_FREEBSD_NR_access    33
-#define TARGET_FREEBSD_NR_chflags   34
-#define TARGET_FREEBSD_NR_fchflags  35
-#define TARGET_FREEBSD_NR_sync  36
-#define TARGET_FREEBSD_NR_kill  37
-                /* 38 is old stat */
-#define TARGET_FREEBSD_NR_getppid   39
-                /* 40 is old lstat */
-#define TARGET_FREEBSD_NR_dup   41
-#define TARGET_FREEBSD_NR_pipe  42
-#define TARGET_FREEBSD_NR_getegid   43
-#define TARGET_FREEBSD_NR_profil    44
-#define TARGET_FREEBSD_NR_ktrace    45
-                /* 46 is old sigaction */
-#define TARGET_FREEBSD_NR_getgid    47
-                /* 48 is old sigprocmask */
-#define TARGET_FREEBSD_NR_getlogin  49
-#define TARGET_FREEBSD_NR_setlogin  50
-#define TARGET_FREEBSD_NR_acct  51
-                /* 52 is old sigpending */
-#define TARGET_FREEBSD_NR_sigaltstack   53
-#define TARGET_FREEBSD_NR_ioctl 54
-#define TARGET_FREEBSD_NR_reboot    55
-#define TARGET_FREEBSD_NR_revoke    56
-#define TARGET_FREEBSD_NR_symlink   57
-#define TARGET_FREEBSD_NR_readlink  58
-#define TARGET_FREEBSD_NR_execve    59
-#define TARGET_FREEBSD_NR_umask 60
-#define TARGET_FREEBSD_NR_chroot    61
-                /* 62 is old fstat */
-                /* 63 is old getkerninfo */
-                /* 64 is old getpagesize */
-#define TARGET_FREEBSD_NR_msync 65
-#define TARGET_FREEBSD_NR_vfork 66
-                /* 67 is obsolete vread */
-                /* 68 is obsolete vwrite */
-#define TARGET_FREEBSD_NR_sbrk  69
-#define TARGET_FREEBSD_NR_sstk  70
-                /* 71 is old mmap */
-#define TARGET_FREEBSD_NR_vadvise   72
-#define TARGET_FREEBSD_NR_munmap    73
-#define TARGET_FREEBSD_NR_mprotect  74
-#define TARGET_FREEBSD_NR_madvise   75
-                /* 76 is obsolete vhangup */
-                /* 77 is obsolete vlimit */
-#define TARGET_FREEBSD_NR_mincore   78
-#define TARGET_FREEBSD_NR_getgroups 79
-#define TARGET_FREEBSD_NR_setgroups 80
-#define TARGET_FREEBSD_NR_getpgrp   81
-#define TARGET_FREEBSD_NR_setpgid   82
-#define TARGET_FREEBSD_NR_setitimer 83
-                /* 84 is old wait */
-#define TARGET_FREEBSD_NR_swapon    85
-#define TARGET_FREEBSD_NR_getitimer 86
-                /* 87 is old gethostname */
-                /* 88 is old sethostname */
-#define TARGET_FREEBSD_NR_getdtablesize 89
-#define TARGET_FREEBSD_NR_dup2  90
-#define TARGET_FREEBSD_NR_fcntl 92
-#define TARGET_FREEBSD_NR_select    93
-#define TARGET_FREEBSD_NR_fsync 95
-#define TARGET_FREEBSD_NR_setpriority   96
-#define TARGET_FREEBSD_NR_socket    97
-#define TARGET_FREEBSD_NR_connect   98
-                /* 99 is old accept */
-#define TARGET_FREEBSD_NR_getpriority   100
-                /* 101 is old send */
-                /* 102 is old recv */
-                /* 103 is old sigreturn */
-#define TARGET_FREEBSD_NR_bind  104
-#define TARGET_FREEBSD_NR_setsockopt    105
-#define TARGET_FREEBSD_NR_listen    106
-                /* 107 is obsolete vtimes */
-                /* 108 is old sigvec */
-                /* 109 is old sigblock */
-                /* 110 is old sigsetmask */
-                /* 111 is old sigsuspend */
-                /* 112 is old sigstack */
-                /* 113 is old recvmsg */
-                /* 114 is old sendmsg */
-                /* 115 is obsolete vtrace */
-#define TARGET_FREEBSD_NR_gettimeofday  116
-#define TARGET_FREEBSD_NR_getrusage 117
-#define TARGET_FREEBSD_NR_getsockopt    118
-#define TARGET_FREEBSD_NR_readv 120
-#define TARGET_FREEBSD_NR_writev    121
-#define TARGET_FREEBSD_NR_settimeofday  122
-#define TARGET_FREEBSD_NR_fchown    123
-#define TARGET_FREEBSD_NR_fchmod    124
-                /* 125 is old recvfrom */
-#define TARGET_FREEBSD_NR_setreuid  126
-#define TARGET_FREEBSD_NR_setregid  127
-#define TARGET_FREEBSD_NR_rename    128
-                /* 129 is old truncate */
-                /* 130 is old ftruncate */
-#define TARGET_FREEBSD_NR_flock 131
-#define TARGET_FREEBSD_NR_mkfifo    132
-#define TARGET_FREEBSD_NR_sendto    133
-#define TARGET_FREEBSD_NR_shutdown  134
-#define TARGET_FREEBSD_NR_socketpair    135
-#define TARGET_FREEBSD_NR_mkdir 136
-#define TARGET_FREEBSD_NR_rmdir 137
-#define TARGET_FREEBSD_NR_utimes    138
-                /* 139 is obsolete 4.2 sigreturn */
-#define TARGET_FREEBSD_NR_adjtime   140
-                /* 141 is old getpeername */
-                /* 142 is old gethostid */
-                /* 143 is old sethostid */
-                /* 144 is old getrlimit */
-                /* 145 is old setrlimit */
-                /* 146 is old killpg */
-#define TARGET_FREEBSD_NR_killpg    146 /* COMPAT */
-#define TARGET_FREEBSD_NR_setsid    147
-#define TARGET_FREEBSD_NR_quotactl  148
-                /* 149 is old quota */
-                /* 150 is old getsockname */
-#define TARGET_FREEBSD_NR_nlm_syscall   154
-#define TARGET_FREEBSD_NR_nfssvc    155
-                /* 156 is old getdirentries */
-#define TARGET_FREEBSD_NR_freebsd4_statfs   157
-#define TARGET_FREEBSD_NR_freebsd4_fstatfs  158
-#define TARGET_FREEBSD_NR_lgetfh    160
-#define TARGET_FREEBSD_NR_getfh 161
-#define TARGET_FREEBSD_NR_freebsd4_getdomainname    162
-#define TARGET_FREEBSD_NR_freebsd4_setdomainname    163
-#define TARGET_FREEBSD_NR_freebsd4_uname    164
-#define TARGET_FREEBSD_NR_sysarch   165
-#define TARGET_FREEBSD_NR_rtprio    166
-#define TARGET_FREEBSD_NR_semsys    169
-#define TARGET_FREEBSD_NR_msgsys    170
-#define TARGET_FREEBSD_NR_shmsys    171
-#define TARGET_FREEBSD_NR_freebsd6_pread    173
-#define TARGET_FREEBSD_NR_freebsd6_pwrite   174
-#define TARGET_FREEBSD_NR_setfib    175
-#define TARGET_FREEBSD_NR_ntp_adjtime   176
-#define TARGET_FREEBSD_NR_setgid    181
-#define TARGET_FREEBSD_NR_setegid   182
-#define TARGET_FREEBSD_NR_seteuid   183
-#define TARGET_FREEBSD_NR_stat  188
-#define TARGET_FREEBSD_NR_fstat 189
-#define TARGET_FREEBSD_NR_lstat 190
-#define TARGET_FREEBSD_NR_pathconf  191
-#define TARGET_FREEBSD_NR_fpathconf 192
-#define TARGET_FREEBSD_NR_getrlimit 194
-#define TARGET_FREEBSD_NR_setrlimit 195
-#define TARGET_FREEBSD_NR_getdirentries 196
-#define TARGET_FREEBSD_NR_freebsd6_mmap 197
-#define TARGET_FREEBSD_NR___syscall 198
-#define TARGET_FREEBSD_NR_freebsd6_lseek    199
-#define TARGET_FREEBSD_NR_freebsd6_truncate 200
-#define TARGET_FREEBSD_NR_freebsd6_ftruncate    201
-#define TARGET_FREEBSD_NR___sysctl  202
-#define TARGET_FREEBSD_NR_mlock 203
-#define TARGET_FREEBSD_NR_munlock   204
-#define TARGET_FREEBSD_NR_undelete  205
-#define TARGET_FREEBSD_NR_futimes   206
-#define TARGET_FREEBSD_NR_getpgid   207
-#define TARGET_FREEBSD_NR_poll  209
-#define TARGET_FREEBSD_NR_freebsd7___semctl 220
-#define TARGET_FREEBSD_NR_semget    221
-#define TARGET_FREEBSD_NR_semop 222
-#define TARGET_FREEBSD_NR_freebsd7_msgctl   224
-#define TARGET_FREEBSD_NR_msgget    225
-#define TARGET_FREEBSD_NR_msgsnd    226
-#define TARGET_FREEBSD_NR_msgrcv    227
-#define TARGET_FREEBSD_NR_shmat 228
-#define TARGET_FREEBSD_NR_freebsd7_shmctl   229
-#define TARGET_FREEBSD_NR_shmdt 230
-#define TARGET_FREEBSD_NR_shmget    231
-#define TARGET_FREEBSD_NR_clock_gettime 232
-#define TARGET_FREEBSD_NR_clock_settime 233
-#define TARGET_FREEBSD_NR_clock_getres  234
-#define TARGET_FREEBSD_NR_ktimer_create 235
-#define TARGET_FREEBSD_NR_ktimer_delete 236
-#define TARGET_FREEBSD_NR_ktimer_settime    237
-#define TARGET_FREEBSD_NR_ktimer_gettime    238
-#define TARGET_FREEBSD_NR_ktimer_getoverrun 239
-#define TARGET_FREEBSD_NR_nanosleep 240
-#define TARGET_FREEBSD_NR_ntp_gettime   248
-#define TARGET_FREEBSD_NR_minherit  250
-#define TARGET_FREEBSD_NR_rfork 251
-#define TARGET_FREEBSD_NR_openbsd_poll  252
-#define TARGET_FREEBSD_NR_issetugid 253
-#define TARGET_FREEBSD_NR_lchown    254
-#define TARGET_FREEBSD_NR_aio_read  255
-#define TARGET_FREEBSD_NR_aio_write 256
-#define TARGET_FREEBSD_NR_lio_listio    257
-#define TARGET_FREEBSD_NR_getdents  272
-#define TARGET_FREEBSD_NR_lchmod    274
-#define TARGET_FREEBSD_NR_netbsd_lchown 275
-#define TARGET_FREEBSD_NR_lutimes   276
-#define TARGET_FREEBSD_NR_netbsd_msync  277
-#define TARGET_FREEBSD_NR_nstat 278
-#define TARGET_FREEBSD_NR_nfstat    279
-#define TARGET_FREEBSD_NR_nlstat    280
-#define TARGET_FREEBSD_NR_preadv    289
-#define TARGET_FREEBSD_NR_pwritev   290
-#define TARGET_FREEBSD_NR_freebsd4_fhstatfs 297
-#define TARGET_FREEBSD_NR_fhopen    298
-#define TARGET_FREEBSD_NR_fhstat    299
-#define TARGET_FREEBSD_NR_modnext   300
-#define TARGET_FREEBSD_NR_modstat   301
-#define TARGET_FREEBSD_NR_modfnext  302
-#define TARGET_FREEBSD_NR_modfind   303
-#define TARGET_FREEBSD_NR_kldload   304
-#define TARGET_FREEBSD_NR_kldunload 305
-#define TARGET_FREEBSD_NR_kldfind   306
-#define TARGET_FREEBSD_NR_kldnext   307
-#define TARGET_FREEBSD_NR_kldstat   308
-#define TARGET_FREEBSD_NR_kldfirstmod   309
-#define TARGET_FREEBSD_NR_getsid    310
-#define TARGET_FREEBSD_NR_setresuid 311
-#define TARGET_FREEBSD_NR_setresgid 312
-                /* 313 is obsolete signanosleep */
-#define TARGET_FREEBSD_NR_aio_return    314
-#define TARGET_FREEBSD_NR_aio_suspend   315
-#define TARGET_FREEBSD_NR_aio_cancel    316
-#define TARGET_FREEBSD_NR_aio_error 317
-#define TARGET_FREEBSD_NR_oaio_read 318
-#define TARGET_FREEBSD_NR_oaio_write    319
-#define TARGET_FREEBSD_NR_olio_listio   320
-#define TARGET_FREEBSD_NR_yield 321
-                /* 322 is obsolete thr_sleep */
-                /* 323 is obsolete thr_wakeup */
-#define TARGET_FREEBSD_NR_mlockall  324
-#define TARGET_FREEBSD_NR_munlockall    325
-#define TARGET_FREEBSD_NR___getcwd  326
-#define TARGET_FREEBSD_NR_sched_setparam    327
-#define TARGET_FREEBSD_NR_sched_getparam    328
-#define TARGET_FREEBSD_NR_sched_setscheduler    329
-#define TARGET_FREEBSD_NR_sched_getscheduler    330
-#define TARGET_FREEBSD_NR_sched_yield   331
-#define TARGET_FREEBSD_NR_sched_get_priority_max    332
-#define TARGET_FREEBSD_NR_sched_get_priority_min    333
-#define TARGET_FREEBSD_NR_sched_rr_get_interval 334
-#define TARGET_FREEBSD_NR_utrace    335
-#define TARGET_FREEBSD_NR_freebsd4_sendfile 336
-#define TARGET_FREEBSD_NR_kldsym    337
-#define TARGET_FREEBSD_NR_jail  338
-#define TARGET_FREEBSD_NR_nnpfs_syscall 339
-#define TARGET_FREEBSD_NR_sigprocmask   340
-#define TARGET_FREEBSD_NR_sigsuspend    341
-#define TARGET_FREEBSD_NR_freebsd4_sigaction    342
-#define TARGET_FREEBSD_NR_sigpending    343
-#define TARGET_FREEBSD_NR_freebsd4_sigreturn    344
-#define TARGET_FREEBSD_NR_sigtimedwait  345
-#define TARGET_FREEBSD_NR_sigwaitinfo   346
-#define TARGET_FREEBSD_NR___acl_get_file    347
-#define TARGET_FREEBSD_NR___acl_set_file    348
-#define TARGET_FREEBSD_NR___acl_get_fd  349
-#define TARGET_FREEBSD_NR___acl_set_fd  350
-#define TARGET_FREEBSD_NR___acl_delete_file 351
-#define TARGET_FREEBSD_NR___acl_delete_fd   352
-#define TARGET_FREEBSD_NR___acl_aclcheck_file   353
-#define TARGET_FREEBSD_NR___acl_aclcheck_fd 354
-#define TARGET_FREEBSD_NR_extattrctl    355
-#define TARGET_FREEBSD_NR_extattr_set_file  356
-#define TARGET_FREEBSD_NR_extattr_get_file  357
-#define TARGET_FREEBSD_NR_extattr_delete_file   358
-#define TARGET_FREEBSD_NR_aio_waitcomplete  359
-#define TARGET_FREEBSD_NR_getresuid 360
-#define TARGET_FREEBSD_NR_getresgid 361
-#define TARGET_FREEBSD_NR_kqueue    362
-#define TARGET_FREEBSD_NR_kevent    363
-#define TARGET_FREEBSD_NR_extattr_set_fd    371
-#define TARGET_FREEBSD_NR_extattr_get_fd    372
-#define TARGET_FREEBSD_NR_extattr_delete_fd 373
-#define TARGET_FREEBSD_NR___setugid 374
-#define TARGET_FREEBSD_NR_eaccess   376
-#define TARGET_FREEBSD_NR_afs3_syscall  377
-#define TARGET_FREEBSD_NR_nmount    378
-#define TARGET_FREEBSD_NR___mac_get_proc    384
-#define TARGET_FREEBSD_NR___mac_set_proc    385
-#define TARGET_FREEBSD_NR___mac_get_fd  386
-#define TARGET_FREEBSD_NR___mac_get_file    387
-#define TARGET_FREEBSD_NR___mac_set_fd  388
-#define TARGET_FREEBSD_NR___mac_set_file    389
-#define TARGET_FREEBSD_NR_kenv  390
-#define TARGET_FREEBSD_NR_lchflags  391
-#define TARGET_FREEBSD_NR_uuidgen   392
-#define TARGET_FREEBSD_NR_sendfile  393
-#define TARGET_FREEBSD_NR_mac_syscall   394
-#define TARGET_FREEBSD_NR_getfsstat 395
-#define TARGET_FREEBSD_NR_statfs    396
-#define TARGET_FREEBSD_NR_fstatfs   397
-#define TARGET_FREEBSD_NR_fhstatfs  398
-#define TARGET_FREEBSD_NR_ksem_close    400
-#define TARGET_FREEBSD_NR_ksem_post 401
-#define TARGET_FREEBSD_NR_ksem_wait 402
-#define TARGET_FREEBSD_NR_ksem_trywait  403
-#define TARGET_FREEBSD_NR_ksem_init 404
-#define TARGET_FREEBSD_NR_ksem_open 405
-#define TARGET_FREEBSD_NR_ksem_unlink   406
-#define TARGET_FREEBSD_NR_ksem_getvalue 407
-#define TARGET_FREEBSD_NR_ksem_destroy  408
-#define TARGET_FREEBSD_NR___mac_get_pid 409
-#define TARGET_FREEBSD_NR___mac_get_link    410
-#define TARGET_FREEBSD_NR___mac_set_link    411
-#define TARGET_FREEBSD_NR_extattr_set_link  412
-#define TARGET_FREEBSD_NR_extattr_get_link  413
-#define TARGET_FREEBSD_NR_extattr_delete_link   414
-#define TARGET_FREEBSD_NR___mac_execve  415
-#define TARGET_FREEBSD_NR_sigaction 416
-#define TARGET_FREEBSD_NR_sigreturn 417
-#define TARGET_FREEBSD_NR_getcontext    421
-#define TARGET_FREEBSD_NR_setcontext    422
-#define TARGET_FREEBSD_NR_swapcontext   423
-#define TARGET_FREEBSD_NR_swapoff   424
-#define TARGET_FREEBSD_NR___acl_get_link    425
-#define TARGET_FREEBSD_NR___acl_set_link    426
-#define TARGET_FREEBSD_NR___acl_delete_link 427
-#define TARGET_FREEBSD_NR___acl_aclcheck_link   428
-#define TARGET_FREEBSD_NR_sigwait   429
-#define TARGET_FREEBSD_NR_thr_create    430
-#define TARGET_FREEBSD_NR_thr_exit  431
-#define TARGET_FREEBSD_NR_thr_self  432
-#define TARGET_FREEBSD_NR_thr_kill  433
-#define TARGET_FREEBSD_NR__umtx_lock    434
-#define TARGET_FREEBSD_NR__umtx_unlock  435
-#define TARGET_FREEBSD_NR_jail_attach   436
-#define TARGET_FREEBSD_NR_extattr_list_fd   437
-#define TARGET_FREEBSD_NR_extattr_list_file 438
-#define TARGET_FREEBSD_NR_extattr_list_link 439
-#define TARGET_FREEBSD_NR_ksem_timedwait    441
-#define TARGET_FREEBSD_NR_thr_suspend   442
-#define TARGET_FREEBSD_NR_thr_wake  443
-#define TARGET_FREEBSD_NR_kldunloadf    444
-#define TARGET_FREEBSD_NR_audit 445
-#define TARGET_FREEBSD_NR_auditon   446
-#define TARGET_FREEBSD_NR_getauid   447
-#define TARGET_FREEBSD_NR_setauid   448
-#define TARGET_FREEBSD_NR_getaudit  449
-#define TARGET_FREEBSD_NR_setaudit  450
-#define TARGET_FREEBSD_NR_getaudit_addr 451
-#define TARGET_FREEBSD_NR_setaudit_addr 452
-#define TARGET_FREEBSD_NR_auditctl  453
-#define TARGET_FREEBSD_NR__umtx_op  454
-#define TARGET_FREEBSD_NR_thr_new   455
-#define TARGET_FREEBSD_NR_sigqueue  456
-#define TARGET_FREEBSD_NR_kmq_open  457
-#define TARGET_FREEBSD_NR_kmq_setattr   458
-#define TARGET_FREEBSD_NR_kmq_timedreceive  459
-#define TARGET_FREEBSD_NR_kmq_timedsend 460
-#define TARGET_FREEBSD_NR_kmq_notify    461
-#define TARGET_FREEBSD_NR_kmq_unlink    462
-#define TARGET_FREEBSD_NR_abort2    463
-#define TARGET_FREEBSD_NR_thr_set_name  464
-#define TARGET_FREEBSD_NR_aio_fsync 465
-#define TARGET_FREEBSD_NR_rtprio_thread 466
-#define TARGET_FREEBSD_NR_sctp_peeloff  471
-#define TARGET_FREEBSD_NR_sctp_generic_sendmsg  472
-#define TARGET_FREEBSD_NR_sctp_generic_sendmsg_iov  473
-#define TARGET_FREEBSD_NR_sctp_generic_recvmsg  474
-#define TARGET_FREEBSD_NR_pread 475
-#define TARGET_FREEBSD_NR_pwrite    476
-#define TARGET_FREEBSD_NR_mmap  477
-#define TARGET_FREEBSD_NR_lseek 478
-#define TARGET_FREEBSD_NR_truncate  479
-#define TARGET_FREEBSD_NR_ftruncate 480
-#define TARGET_FREEBSD_NR_thr_kill2 481
-#define TARGET_FREEBSD_NR_shm_open  482
-#define TARGET_FREEBSD_NR_shm_unlink    483
-#define TARGET_FREEBSD_NR_cpuset    484
-#define TARGET_FREEBSD_NR_cpuset_setid  485
-#define TARGET_FREEBSD_NR_cpuset_getid  486
-#define TARGET_FREEBSD_NR_cpuset_getaffinity    487
-#define TARGET_FREEBSD_NR_cpuset_setaffinity    488
-#define TARGET_FREEBSD_NR_faccessat 489
-#define TARGET_FREEBSD_NR_fchmodat  490
-#define TARGET_FREEBSD_NR_fchownat  491
-#define TARGET_FREEBSD_NR_fexecve   492
-#define TARGET_FREEBSD_NR_fstatat   493
-#define TARGET_FREEBSD_NR_futimesat 494
-#define TARGET_FREEBSD_NR_linkat    495
-#define TARGET_FREEBSD_NR_mkdirat   496
-#define TARGET_FREEBSD_NR_mkfifoat  497
-#define TARGET_FREEBSD_NR_mknodat   498
-#define TARGET_FREEBSD_NR_openat    499
-#define TARGET_FREEBSD_NR_readlinkat    500
-#define TARGET_FREEBSD_NR_renameat  501
-#define TARGET_FREEBSD_NR_symlinkat 502
-#define TARGET_FREEBSD_NR_unlinkat  503
-#define TARGET_FREEBSD_NR_posix_openpt  504
-#define TARGET_FREEBSD_NR_gssd_syscall  505
-#define TARGET_FREEBSD_NR_jail_get  506
-#define TARGET_FREEBSD_NR_jail_set  507
-#define TARGET_FREEBSD_NR_jail_remove   508
-#define TARGET_FREEBSD_NR_closefrom 509
-#define TARGET_FREEBSD_NR___semctl  510
-#define TARGET_FREEBSD_NR_msgctl    511
-#define TARGET_FREEBSD_NR_shmctl    512
-#define TARGET_FREEBSD_NR_lpathconf 513
-#define TARGET_FREEBSD_NR_cap_new   514
-#define TARGET_FREEBSD_NR_cap_getrights 515
-#define TARGET_FREEBSD_NR_cap_enter 516
-#define TARGET_FREEBSD_NR_cap_getmode   517
-#define TARGET_FREEBSD_NR_pdfork    518
-#define TARGET_FREEBSD_NR_pdkill    519
-#define TARGET_FREEBSD_NR_pdgetpid  520
-#define TARGET_FREEBSD_NR_pselect   522
-#define TARGET_FREEBSD_NR_getloginclass 523
-#define TARGET_FREEBSD_NR_setloginclass 524
-#define TARGET_FREEBSD_NR_rctl_get_racct    525
-#define TARGET_FREEBSD_NR_rctl_get_rules    526
-#define TARGET_FREEBSD_NR_rctl_get_limits   527
-#define TARGET_FREEBSD_NR_rctl_add_rule 528
-#define TARGET_FREEBSD_NR_rctl_remove_rule  529
-#define TARGET_FREEBSD_NR_posix_fallocate   530
-#define TARGET_FREEBSD_NR_posix_fadvise 531
-#define TARGET_FREEBSD_NR_MAXSYSCALL    532
+#define TARGET_FREEBSD_NR_syscall     0
+#define TARGET_FREEBSD_NR_exit        1
+#define TARGET_FREEBSD_NR_fork        2
+#define TARGET_FREEBSD_NR_read        3
+#define TARGET_FREEBSD_NR_write       4
+#define TARGET_FREEBSD_NR_open        5
+#define TARGET_FREEBSD_NR_close       6
+#define TARGET_FREEBSD_NR_wait4       7
+#define TARGET_FREEBSD_NR_link        9
+#define TARGET_FREEBSD_NR_unlink      10
+#define TARGET_FREEBSD_NR_chdir       12
+#define TARGET_FREEBSD_NR_fchdir      13
+#define TARGET_FREEBSD_NR_mknod       14
+#define TARGET_FREEBSD_NR_chmod       15
+#define TARGET_FREEBSD_NR_chown       16
+#define TARGET_FREEBSD_NR_break       17
+#define TARGET_FREEBSD_NR_freebsd4_getfsstat  18
+#define TARGET_FREEBSD_NR_getpid      20
+#define TARGET_FREEBSD_NR_mount       21
+#define TARGET_FREEBSD_NR_unmount     22
+#define TARGET_FREEBSD_NR_setuid      23
+#define TARGET_FREEBSD_NR_getuid      24
+#define TARGET_FREEBSD_NR_geteuid     25
+#define TARGET_FREEBSD_NR_ptrace      26
+#define TARGET_FREEBSD_NR_recvmsg     27
+#define TARGET_FREEBSD_NR_sendmsg     28
+#define TARGET_FREEBSD_NR_recvfrom    29
+#define TARGET_FREEBSD_NR_accept      30
+#define TARGET_FREEBSD_NR_getpeername 31
+#define TARGET_FREEBSD_NR_getsockname 32
+#define TARGET_FREEBSD_NR_access      33
+#define TARGET_FREEBSD_NR_chflags     34
+#define TARGET_FREEBSD_NR_fchflags    35
+#define TARGET_FREEBSD_NR_sync        36
+#define TARGET_FREEBSD_NR_kill        37
+#define TARGET_FREEBSD_NR_getppid     39
+#define TARGET_FREEBSD_NR_dup 41
+#define TARGET_FREEBSD_NR_pipe        42
+#define TARGET_FREEBSD_NR_getegid     43
+#define TARGET_FREEBSD_NR_profil      44
+#define TARGET_FREEBSD_NR_ktrace      45
+#define TARGET_FREEBSD_NR_getgid      47
+#define TARGET_FREEBSD_NR_getlogin    49
+#define TARGET_FREEBSD_NR_setlogin    50
+#define TARGET_FREEBSD_NR_acct        51
+#define TARGET_FREEBSD_NR_sigaltstack 53
+#define TARGET_FREEBSD_NR_ioctl       54
+#define TARGET_FREEBSD_NR_reboot      55
+#define TARGET_FREEBSD_NR_revoke      56
+#define TARGET_FREEBSD_NR_symlink     57
+#define TARGET_FREEBSD_NR_readlink    58
+#define TARGET_FREEBSD_NR_execve      59
+#define TARGET_FREEBSD_NR_umask       60
+#define TARGET_FREEBSD_NR_chroot      61
+#define TARGET_FREEBSD_NR_msync       65
+#define TARGET_FREEBSD_NR_vfork       66
+#define TARGET_FREEBSD_NR_sbrk        69
+#define TARGET_FREEBSD_NR_sstk        70
+#define TARGET_FREEBSD_NR_vadvise     72
+#define TARGET_FREEBSD_NR_munmap      73
+#define TARGET_FREEBSD_NR_mprotect    74
+#define TARGET_FREEBSD_NR_madvise     75
+#define TARGET_FREEBSD_NR_mincore     78
+#define TARGET_FREEBSD_NR_getgroups   79
+#define TARGET_FREEBSD_NR_setgroups   80
+#define TARGET_FREEBSD_NR_getpgrp     81
+#define TARGET_FREEBSD_NR_setpgid     82
+#define TARGET_FREEBSD_NR_setitimer   83
+#define TARGET_FREEBSD_NR_swapon      85
+#define TARGET_FREEBSD_NR_getitimer   86
+#define TARGET_FREEBSD_NR_getdtablesize       89
+#define TARGET_FREEBSD_NR_dup2        90
+#define TARGET_FREEBSD_NR_fcntl       92
+#define TARGET_FREEBSD_NR_select      93
+#define TARGET_FREEBSD_NR_fsync       95
+#define TARGET_FREEBSD_NR_setpriority 96
+#define TARGET_FREEBSD_NR_socket      97
+#define TARGET_FREEBSD_NR_connect     98
+#define TARGET_FREEBSD_NR_getpriority 100
+#define TARGET_FREEBSD_NR_bind        104
+#define TARGET_FREEBSD_NR_setsockopt  105
+#define TARGET_FREEBSD_NR_listen      106
+#define TARGET_FREEBSD_NR_gettimeofday        116
+#define TARGET_FREEBSD_NR_getrusage   117
+#define TARGET_FREEBSD_NR_getsockopt  118
+#define TARGET_FREEBSD_NR_readv       120
+#define TARGET_FREEBSD_NR_writev      121
+#define TARGET_FREEBSD_NR_settimeofday        122
+#define TARGET_FREEBSD_NR_fchown      123
+#define TARGET_FREEBSD_NR_fchmod      124
+#define TARGET_FREEBSD_NR_setreuid    126
+#define TARGET_FREEBSD_NR_setregid    127
+#define TARGET_FREEBSD_NR_rename      128
+#define TARGET_FREEBSD_NR_flock       131
+#define TARGET_FREEBSD_NR_mkfifo      132
+#define TARGET_FREEBSD_NR_sendto      133
+#define TARGET_FREEBSD_NR_shutdown    134
+#define TARGET_FREEBSD_NR_socketpair  135
+#define TARGET_FREEBSD_NR_mkdir       136
+#define TARGET_FREEBSD_NR_rmdir       137
+#define TARGET_FREEBSD_NR_utimes      138
+#define TARGET_FREEBSD_NR_adjtime     140
+#define TARGET_FREEBSD_NR_setsid      147
+#define TARGET_FREEBSD_NR_quotactl    148
+#define TARGET_FREEBSD_NR_nlm_syscall 154
+#define TARGET_FREEBSD_NR_nfssvc      155
+#define TARGET_FREEBSD_NR_freebsd4_statfs     157
+#define TARGET_FREEBSD_NR_freebsd4_fstatfs    158
+#define TARGET_FREEBSD_NR_lgetfh      160
+#define TARGET_FREEBSD_NR_getfh       161
+#define TARGET_FREEBSD_NR_getdomainname       162
+#define TARGET_FREEBSD_NR_setdomainname       163
+#define TARGET_FREEBSD_NR_uname       164
+#define TARGET_FREEBSD_NR_sysarch     165
+#define TARGET_FREEBSD_NR_rtprio      166
+#define TARGET_FREEBSD_NR_semsys      169
+#define TARGET_FREEBSD_NR_msgsys      170
+#define TARGET_FREEBSD_NR_shmsys      171
+#define TARGET_FREEBSD_NR_freebsd6_pread      173
+#define TARGET_FREEBSD_NR_freebsd6_pwrite     174
+#define TARGET_FREEBSD_NR_setfib      175
+#define TARGET_FREEBSD_NR_ntp_adjtime 176
+#define TARGET_FREEBSD_NR_setgid      181
+#define TARGET_FREEBSD_NR_setegid     182
+#define TARGET_FREEBSD_NR_seteuid     183
+#define TARGET_FREEBSD_NR_stat        188
+#define TARGET_FREEBSD_NR_fstat       189
+#define TARGET_FREEBSD_NR_lstat       190
+#define TARGET_FREEBSD_NR_pathconf    191
+#define TARGET_FREEBSD_NR_fpathconf   192
+#define TARGET_FREEBSD_NR_getrlimit   194
+#define TARGET_FREEBSD_NR_setrlimit   195
+#define TARGET_FREEBSD_NR_getdirentries       196
+#define TARGET_FREEBSD_NR_freebsd6_mmap       197
+#define TARGET_FREEBSD_NR___syscall   198
+#define TARGET_FREEBSD_NR_freebsd6_lseek      199
+#define TARGET_FREEBSD_NR_freebsd6_truncate   200
+#define TARGET_FREEBSD_NR_freebsd6_ftruncate  201
+#define TARGET_FREEBSD_NR___sysctl    202
+#define TARGET_FREEBSD_NR_mlock       203
+#define TARGET_FREEBSD_NR_munlock     204
+#define TARGET_FREEBSD_NR_undelete    205
+#define TARGET_FREEBSD_NR_futimes     206
+#define TARGET_FREEBSD_NR_getpgid     207
+#define TARGET_FREEBSD_NR_poll        209
+#define TARGET_FREEBSD_NR___semctl    220
+#define TARGET_FREEBSD_NR_semget      221
+#define TARGET_FREEBSD_NR_semop       222
+#define TARGET_FREEBSD_NR_msgctl      224
+#define TARGET_FREEBSD_NR_msgget      225
+#define TARGET_FREEBSD_NR_msgsnd      226
+#define TARGET_FREEBSD_NR_msgrcv      227
+#define TARGET_FREEBSD_NR_shmat       228
+#define TARGET_FREEBSD_NR_shmctl      229
+#define TARGET_FREEBSD_NR_shmdt       230
+#define TARGET_FREEBSD_NR_shmget      231
+#define TARGET_FREEBSD_NR_clock_gettime       232
+#define TARGET_FREEBSD_NR_clock_settime       233
+#define TARGET_FREEBSD_NR_clock_getres        234
+#define TARGET_FREEBSD_NR_ktimer_create       235
+#define TARGET_FREEBSD_NR_ktimer_delete       236
+#define TARGET_FREEBSD_NR_ktimer_settime      237
+#define TARGET_FREEBSD_NR_ktimer_gettime      238
+#define TARGET_FREEBSD_NR_ktimer_getoverrun   239
+#define TARGET_FREEBSD_NR_nanosleep   240
+#define TARGET_FREEBSD_NR_ntp_gettime 248
+#define TARGET_FREEBSD_NR_minherit    250
+#define TARGET_FREEBSD_NR_rfork       251
+#define TARGET_FREEBSD_NR_openbsd_poll        252
+#define TARGET_FREEBSD_NR_issetugid   253
+#define TARGET_FREEBSD_NR_lchown      254
+#define TARGET_FREEBSD_NR_aio_read    255
+#define TARGET_FREEBSD_NR_aio_write   256
+#define TARGET_FREEBSD_NR_lio_listio  257
+#define TARGET_FREEBSD_NR_getdents    272
+#define TARGET_FREEBSD_NR_lchmod      274
+#define TARGET_FREEBSD_NR_netbsd_lchown       275
+#define TARGET_FREEBSD_NR_lutimes     276
+#define TARGET_FREEBSD_NR_netbsd_msync        277
+#define TARGET_FREEBSD_NR_nstat       278
+#define TARGET_FREEBSD_NR_nfstat      279
+#define TARGET_FREEBSD_NR_nlstat      280
+#define TARGET_FREEBSD_NR_preadv      289
+#define TARGET_FREEBSD_NR_pwritev     290
+#define TARGET_FREEBSD_NR_freebsd4_fhstatfs   297
+#define TARGET_FREEBSD_NR_fhopen      298
+#define TARGET_FREEBSD_NR_fhstat      299
+#define TARGET_FREEBSD_NR_modnext     300
+#define TARGET_FREEBSD_NR_modstat     301
+#define TARGET_FREEBSD_NR_modfnext    302
+#define TARGET_FREEBSD_NR_modfind     303
+#define TARGET_FREEBSD_NR_kldload     304
+#define TARGET_FREEBSD_NR_kldunload   305
+#define TARGET_FREEBSD_NR_kldfind     306
+#define TARGET_FREEBSD_NR_kldnext     307
+#define TARGET_FREEBSD_NR_kldstat     308
+#define TARGET_FREEBSD_NR_kldfirstmod 309
+#define TARGET_FREEBSD_NR_getsid      310
+#define TARGET_FREEBSD_NR_setresuid   311
+#define TARGET_FREEBSD_NR_setresgid   312
+#define TARGET_FREEBSD_NR_aio_return  314
+#define TARGET_FREEBSD_NR_aio_suspend 315
+#define TARGET_FREEBSD_NR_aio_cancel  316
+#define TARGET_FREEBSD_NR_aio_error   317
+#define TARGET_FREEBSD_NR_oaio_read   318
+#define TARGET_FREEBSD_NR_oaio_write  319
+#define TARGET_FREEBSD_NR_olio_listio 320
+#define TARGET_FREEBSD_NR_yield       321
+#define TARGET_FREEBSD_NR_mlockall    324
+#define TARGET_FREEBSD_NR_munlockall  325
+#define TARGET_FREEBSD_NR___getcwd    326
+#define TARGET_FREEBSD_NR_sched_setparam      327
+#define TARGET_FREEBSD_NR_sched_getparam      328
+#define TARGET_FREEBSD_NR_sched_setscheduler  329
+#define TARGET_FREEBSD_NR_sched_getscheduler  330
+#define TARGET_FREEBSD_NR_sched_yield 331
+#define TARGET_FREEBSD_NR_sched_get_priority_max      332
+#define TARGET_FREEBSD_NR_sched_get_priority_min      333
+#define TARGET_FREEBSD_NR_sched_rr_get_interval       334
+#define TARGET_FREEBSD_NR_utrace      335
+#define TARGET_FREEBSD_NR_freebsd4_sendfile   336
+#define TARGET_FREEBSD_NR_kldsym      337
+#define TARGET_FREEBSD_NR_jail        338
+#define TARGET_FREEBSD_NR_sigprocmask 340
+#define TARGET_FREEBSD_NR_sigsuspend  341
+#define TARGET_FREEBSD_NR_freebsd4_sigaction  342
+#define TARGET_FREEBSD_NR_sigpending  343
+#define TARGET_FREEBSD_NR_freebsd4_sigreturn  344
+#define TARGET_FREEBSD_NR_sigtimedwait        345
+#define TARGET_FREEBSD_NR_sigwaitinfo 346
+#define TARGET_FREEBSD_NR___acl_get_file      347
+#define TARGET_FREEBSD_NR___acl_set_file      348
+#define TARGET_FREEBSD_NR___acl_get_fd        349
+#define TARGET_FREEBSD_NR___acl_set_fd        350
+#define TARGET_FREEBSD_NR___acl_delete_file   351
+#define TARGET_FREEBSD_NR___acl_delete_fd     352
+#define TARGET_FREEBSD_NR___acl_aclcheck_file 353
+#define TARGET_FREEBSD_NR___acl_aclcheck_fd   354
+#define TARGET_FREEBSD_NR_extattrctl  355
+#define TARGET_FREEBSD_NR_extattr_set_file    356
+#define TARGET_FREEBSD_NR_extattr_get_file    357
+#define TARGET_FREEBSD_NR_extattr_delete_file 358
+#define TARGET_FREEBSD_NR_aio_waitcomplete    359
+#define TARGET_FREEBSD_NR_getresuid   360
+#define TARGET_FREEBSD_NR_getresgid   361
+#define TARGET_FREEBSD_NR_kqueue      362
+#define TARGET_FREEBSD_NR_kevent      363
+#define TARGET_FREEBSD_NR_extattr_set_fd      371
+#define TARGET_FREEBSD_NR_extattr_get_fd      372
+#define TARGET_FREEBSD_NR_extattr_delete_fd   373
+#define TARGET_FREEBSD_NR___setugid   374
+#define TARGET_FREEBSD_NR_nfsclnt     375
+#define TARGET_FREEBSD_NR_eaccess     376
+#define TARGET_FREEBSD_NR_nmount      378
+#define TARGET_FREEBSD_NR___mac_get_proc      384
+#define TARGET_FREEBSD_NR___mac_set_proc      385
+#define TARGET_FREEBSD_NR___mac_get_fd        386
+#define TARGET_FREEBSD_NR___mac_get_file      387
+#define TARGET_FREEBSD_NR___mac_set_fd        388
+#define TARGET_FREEBSD_NR___mac_set_file      389
+#define TARGET_FREEBSD_NR_kenv        390
+#define TARGET_FREEBSD_NR_lchflags    391
+#define TARGET_FREEBSD_NR_uuidgen     392
+#define TARGET_FREEBSD_NR_sendfile    393
+#define TARGET_FREEBSD_NR_mac_syscall 394
+#define TARGET_FREEBSD_NR_getfsstat   395
+#define TARGET_FREEBSD_NR_statfs      396
+#define TARGET_FREEBSD_NR_fstatfs     397
+#define TARGET_FREEBSD_NR_fhstatfs    398
+#define TARGET_FREEBSD_NR_ksem_close  400
+#define TARGET_FREEBSD_NR_ksem_post   401
+#define TARGET_FREEBSD_NR_ksem_wait   402
+#define TARGET_FREEBSD_NR_ksem_trywait        403
+#define TARGET_FREEBSD_NR_ksem_init   404
+#define TARGET_FREEBSD_NR_ksem_open   405
+#define TARGET_FREEBSD_NR_ksem_unlink 406
+#define TARGET_FREEBSD_NR_ksem_getvalue       407
+#define TARGET_FREEBSD_NR_ksem_destroy        408
+#define TARGET_FREEBSD_NR___mac_get_pid       409
+#define TARGET_FREEBSD_NR___mac_get_link      410
+#define TARGET_FREEBSD_NR___mac_set_link      411
+#define TARGET_FREEBSD_NR_extattr_set_link    412
+#define TARGET_FREEBSD_NR_extattr_get_link    413
+#define TARGET_FREEBSD_NR_extattr_delete_link 414
+#define TARGET_FREEBSD_NR___mac_execve        415
+#define TARGET_FREEBSD_NR_sigaction   416
+#define TARGET_FREEBSD_NR_sigreturn   417
+#define TARGET_FREEBSD_NR_getcontext  421
+#define TARGET_FREEBSD_NR_setcontext  422
+#define TARGET_FREEBSD_NR_swapcontext 423
+#define TARGET_FREEBSD_NR_swapoff     424
+#define TARGET_FREEBSD_NR___acl_get_link      425
+#define TARGET_FREEBSD_NR___acl_set_link      426
+#define TARGET_FREEBSD_NR___acl_delete_link   427
+#define TARGET_FREEBSD_NR___acl_aclcheck_link 428
+#define TARGET_FREEBSD_NR_sigwait     429
+#define TARGET_FREEBSD_NR_thr_create  430
+#define TARGET_FREEBSD_NR_thr_exit    431
+#define TARGET_FREEBSD_NR_thr_self    432
+#define TARGET_FREEBSD_NR_thr_kill    433
+#define TARGET_FREEBSD_NR__umtx_lock  434
+#define TARGET_FREEBSD_NR__umtx_unlock        435
+#define TARGET_FREEBSD_NR_jail_attach 436
+#define TARGET_FREEBSD_NR_extattr_list_fd     437
+#define TARGET_FREEBSD_NR_extattr_list_file   438
+#define TARGET_FREEBSD_NR_extattr_list_link   439
+#define TARGET_FREEBSD_NR_ksem_timedwait      441
+#define TARGET_FREEBSD_NR_thr_suspend 442
+#define TARGET_FREEBSD_NR_thr_wake    443
+#define TARGET_FREEBSD_NR_kldunloadf  444
+#define TARGET_FREEBSD_NR_audit       445
+#define TARGET_FREEBSD_NR_auditon     446
+#define TARGET_FREEBSD_NR_getauid     447
+#define TARGET_FREEBSD_NR_setauid     448
+#define TARGET_FREEBSD_NR_getaudit    449
+#define TARGET_FREEBSD_NR_setaudit    450
+#define TARGET_FREEBSD_NR_getaudit_addr       451
+#define TARGET_FREEBSD_NR_setaudit_addr       452
+#define TARGET_FREEBSD_NR_auditctl    453
+#define TARGET_FREEBSD_NR__umtx_op    454
+#define TARGET_FREEBSD_NR_thr_new     455
+#define TARGET_FREEBSD_NR_sigqueue    456
+#define TARGET_FREEBSD_NR_kmq_open    457
+#define TARGET_FREEBSD_NR_kmq_setattr 458
+#define TARGET_FREEBSD_NR_kmq_timedreceive    459
+#define TARGET_FREEBSD_NR_kmq_timedsend       460
+#define TARGET_FREEBSD_NR_kmq_notify  461
+#define TARGET_FREEBSD_NR_kmq_unlink  462
+#define TARGET_FREEBSD_NR_abort2      463
+#define TARGET_FREEBSD_NR_thr_set_name        464
+#define TARGET_FREEBSD_NR_aio_fsync   465
+#define TARGET_FREEBSD_NR_rtprio_thread       466
+#define TARGET_FREEBSD_NR_sctp_peeloff        471
+#define TARGET_FREEBSD_NR_sctp_generic_sendmsg        472
+#define TARGET_FREEBSD_NR_sctp_generic_sendmsg_iov    473
+#define TARGET_FREEBSD_NR_sctp_generic_recvmsg        474
+#define TARGET_FREEBSD_NR_pread       475
+#define TARGET_FREEBSD_NR_pwrite      476
+#define TARGET_FREEBSD_NR_mmap        477
+#define TARGET_FREEBSD_NR_lseek       478
+#define TARGET_FREEBSD_NR_truncate    479
+#define TARGET_FREEBSD_NR_ftruncate   480
+#define TARGET_FREEBSD_NR_thr_kill2   481
+#define TARGET_FREEBSD_NR_shm_open    482
+#define TARGET_FREEBSD_NR_shm_unlink  483
+#define TARGET_FREEBSD_NR_cpuset      484
+#define TARGET_FREEBSD_NR_cpuset_setid        485
+#define TARGET_FREEBSD_NR_cpuset_getid        486
+#define TARGET_FREEBSD_NR_cpuset_getaffinity  487
+#define TARGET_FREEBSD_NR_cpuset_setaffinity  488
+#define TARGET_FREEBSD_NR_faccessat   489
+#define TARGET_FREEBSD_NR_fchmodat    490
+#define TARGET_FREEBSD_NR_fchownat    491
+#define TARGET_FREEBSD_NR_fexecve     492
+#define TARGET_FREEBSD_NR_fstatat     493
+#define TARGET_FREEBSD_NR_futimesat   494
+#define TARGET_FREEBSD_NR_linkat      495
+#define TARGET_FREEBSD_NR_mkdirat     496
+#define TARGET_FREEBSD_NR_mkfifoat    497
+#define TARGET_FREEBSD_NR_mknodat     498
+#define TARGET_FREEBSD_NR_openat      499
+#define TARGET_FREEBSD_NR_readlinkat  500
+#define TARGET_FREEBSD_NR_renameat    501
+#define TARGET_FREEBSD_NR_symlinkat   502
+#define TARGET_FREEBSD_NR_unlinkat    503
+#define TARGET_FREEBSD_NR_posix_openpt        504
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -43,7 +43,7 @@ unsigned long reserved_va;
 #endif

 static const char *interp_prefix = CONFIG_QEMU_INTERP_PREFIX;
-const char *qemu_uname_release;
+const char *qemu_uname_release = CONFIG_UNAME_RELEASE;
 extern char **environ;
 enum BSDType bsd_type;

@@ -1003,8 +1003,10 @@ int main(int argc, char **argv)
    cpu->opaque = ts;

 #if defined(TARGET_I386)
+    cpu_x86_set_cpl(env, 3);
+
    env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
-    env->hflags |= HF_PE_MASK | HF_CPL_MASK;
+    env->hflags |= HF_PE_MASK;
    if (env->features[FEAT_1_EDX] & CPUID_SSE) {
        env->cr[4] |= CR4_OSFXSR_MASK;
        env->hflags |= HF_OSFXSR_MASK;
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -74,6 +74,66 @@ void mmap_unlock(void)
 }
 #endif

+static void *bsd_vmalloc(size_t size)
+{
+    void *p;
+    mmap_lock();
+    /* Use map and mark the pages as used.  */
+    p = mmap(NULL, size, PROT_READ | PROT_WRITE,
+             MAP_PRIVATE | MAP_ANON, -1, 0);
+
+    if (h2g_valid(p)) {
+        /* Allocated region overlaps guest address space.
+           This may recurse.  */
+        abi_ulong addr = h2g(p);
+        page_set_flags(addr & TARGET_PAGE_MASK, TARGET_PAGE_ALIGN(addr + size),
+                       PAGE_RESERVED);
+    }
+
+    mmap_unlock();
+    return p;
+}
+
+void *g_malloc(size_t size)
+{
+    char * p;
+    size += 16;
+    p = bsd_vmalloc(size);
+    *(size_t *)p = size;
+    return p + 16;
+}
+
+/* We use map, which is always zero initialized.  */
+void * g_malloc0(size_t size)
+{
+    return g_malloc(size);
+}
+
+void g_free(void *ptr)
+{
+    /* FIXME: We should unmark the reserved pages here.  However this gets
+       complicated when one target page spans multiple host pages, so we
+       don't bother.  */
+    size_t *p;
+    p = (size_t *)((char *)ptr - 16);
+    munmap(p, *p);
+}
+
+void *g_realloc(void *ptr, size_t size)
+{
+    size_t old_size, copy;
+    void *new_ptr;
+
+    if (!ptr)
+        return g_malloc(size);
+    old_size = *(size_t *)((char *)ptr - 16);
+    copy = old_size < size ? old_size : size;
+    new_ptr = g_malloc(size);
+    memcpy(new_ptr, ptr, copy);
+    g_free(ptr);
+    return new_ptr;
+}
+
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(abi_ulong start, abi_ulong len, int prot)
 {
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -1,19 +1,3 @@
-/*
- *  qemu bsd user mode definition
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
 #ifndef QEMU_H
 #define QEMU_H

@@ -21,7 +5,6 @@
 #include <string.h>

 #include "cpu.h"
-#include "exec/cpu_ldst.h"

 #undef DEBUG_REMAP
 #ifdef DEBUG_REMAP
@@ -166,16 +149,6 @@ void fork_end(int child);
 #include "qemu/log.h"

 /* strace.c */
-struct syscallname {
-    int nr;
-    const char *name;
-    const char *format;
-    void (*call)(const struct syscallname *,
-                 abi_long, abi_long, abi_long,
-                 abi_long, abi_long, abi_long);
-    void (*result)(const struct syscallname *, abi_long);
-};
-
 void
 print_freebsd_syscall(int num,
                      abi_long arg1, abi_long arg2, abi_long arg3,
--- a/bsd-user/strace.c
+++ b/bsd-user/strace.c
@@ -1,71 +1,37 @@
-/*
- *  System call tracing and debugging
- *
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
 #include <stdio.h>
 #include <errno.h>
 #include <sys/select.h>
 #include <sys/types.h>
 #include <unistd.h>
 #include <sys/syscall.h>
-#include <sys/ioccom.h>
-#include <ctype.h>
-
 #include "qemu.h"

-int do_strace;
+int do_strace=0;
+
+struct syscallname {
+    int nr;
+    const char *name;
+    const char *format;
+    void (*call)(const struct syscallname *,
+                 abi_long, abi_long, abi_long,
+                 abi_long, abi_long, abi_long);
+    void (*result)(const struct syscallname *, abi_long);
+};

 /*
 * Utility functions
 */

-static void print_sysctl(const struct syscallname *name, abi_long arg1,
-        abi_long arg2, abi_long arg3, abi_long arg4, abi_long arg5,
-        abi_long arg6)
-{
-    uint32_t i;
-    int32_t *namep;
-
-    gemu_log("%s({ ", name->name);
-    namep = lock_user(VERIFY_READ, arg1, sizeof(int32_t) * arg2, 1);
-    if (namep) {
-        int32_t *p = namep;
-
-        for (i = 0; i < (uint32_t)arg2; i++) {
-            gemu_log("%d ", tswap32(*p++));
-        }
-        unlock_user(namep, arg1, 0);
-    }
-    gemu_log("}, %u, 0x" TARGET_ABI_FMT_lx ", 0x" TARGET_ABI_FMT_lx ", 0x"
-        TARGET_ABI_FMT_lx ", 0x" TARGET_ABI_FMT_lx ")",
-        (uint32_t)arg2, arg3, arg4, arg5, arg6);
-}
-
-static void print_execve(const struct syscallname *name, abi_long arg1,
-        abi_long arg2, abi_long arg3, abi_long arg4, abi_long arg5,
-        abi_long arg6)
+static void
+print_execve(const struct syscallname *name,
+             abi_long arg1, abi_long arg2, abi_long arg3,
+             abi_long arg4, abi_long arg5, abi_long arg6)
 {
    abi_ulong arg_ptr_addr;
    char *s;

-    s = lock_user_string(arg1);
-    if (s == NULL) {
+    if (!(s = lock_user_string(arg1)))
        return;
-    }
    gemu_log("%s(\"%s\",{", name->name, s);
    unlock_user(s, arg1, 0);

@@ -73,48 +39,29 @@ static void print_execve(const struct syscallname *name, abi_long arg1,
        abi_ulong *arg_ptr, arg_addr;

        arg_ptr = lock_user(VERIFY_READ, arg_ptr_addr, sizeof(abi_ulong), 1);
-        if (!arg_ptr) {
+        if (!arg_ptr)
            return;
-        }
        arg_addr = tswapl(*arg_ptr);
        unlock_user(arg_ptr, arg_ptr_addr, 0);
-        if (!arg_addr) {
+        if (!arg_addr)
            break;
-        }
        if ((s = lock_user_string(arg_addr))) {
            gemu_log("\"%s\",", s);
            unlock_user(s, arg_addr, 0);
        }
    }
-    gemu_log("NULL})");
-}

-static void print_ioctl(const struct syscallname *name,
-        abi_long arg1, abi_long arg2, abi_long arg3, abi_long arg4,
-        abi_long arg5, abi_long arg6)
-{
-    /* Decode the ioctl request */
-    gemu_log("%s(%d, 0x%0lx { IO%s%s GRP:0x%x('%c') CMD:%d LEN:%d }, 0x"
-            TARGET_ABI_FMT_lx ", ...)",
-            name->name,
-            (int)arg1,
-            (unsigned long)arg2,
-            arg2 & IOC_OUT ? "R" : "",
-            arg2 & IOC_IN ? "W" : "",
-            (unsigned)IOCGROUP(arg2),
-            isprint(IOCGROUP(arg2)) ? (char)IOCGROUP(arg2) : '?',
-            (int)arg2 & 0xFF,
-            (int)IOCPARM_LEN(arg2),
-            arg3);
+    gemu_log("NULL})");
 }

 /*
 * Variants for the return value output function
 */

-static void print_syscall_ret_addr(const struct syscallname *name, abi_long ret)
+static void
+print_syscall_ret_addr(const struct syscallname *name, abi_long ret)
 {
-    if (ret == -1) {
+if( ret == -1 ) {
        gemu_log(" = -1 errno=%d (%s)\n", errno, strerror(errno));
    } else {
        gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
@@ -143,9 +90,10 @@ static const struct syscallname openbsd_scnames[] = {
 #include "openbsd/strace.list"
 };

-static void print_syscall(int num, const struct syscallname *scnames,
-        unsigned int nscnames, abi_long arg1, abi_long arg2, abi_long arg3,
-        abi_long arg4, abi_long arg5, abi_long arg6)
+static void
+print_syscall(int num, const struct syscallname *scnames, unsigned int nscnames,
+              abi_long arg1, abi_long arg2, abi_long arg3,
+              abi_long arg4, abi_long arg5, abi_long arg6)
 {
    unsigned int i;
    const char *format="%s(" TARGET_ABI_FMT_ld "," TARGET_ABI_FMT_ld ","
@@ -154,37 +102,36 @@ static void print_syscall(int num, const struct syscallname *scnames,

    gemu_log("%d ", getpid() );

-    for (i = 0; i < nscnames; i++) {
+    for (i = 0; i < nscnames; i++)
        if (scnames[i].nr == num) {
            if (scnames[i].call != NULL) {
                scnames[i].call(&scnames[i], arg1, arg2, arg3, arg4, arg5,
-                        arg6);
+                                arg6);
            } else {
                /* XXX: this format system is broken because it uses
                   host types and host pointers for strings */
-                if (scnames[i].format != NULL) {
+                if (scnames[i].format != NULL)
                    format = scnames[i].format;
-                }
-                gemu_log(format, scnames[i].name, arg1, arg2, arg3, arg4, arg5,
-                        arg6);
+                gemu_log(format, scnames[i].name, arg1, arg2, arg3, arg4,
+                         arg5, arg6);
            }
            return;
        }
-    }
    gemu_log("Unknown syscall %d\n", num);
 }

-static void print_syscall_ret(int num, abi_long ret,
-        const struct syscallname *scnames, unsigned int nscnames)
+static void
+print_syscall_ret(int num, abi_long ret, const struct syscallname *scnames,
+                  unsigned int nscnames)
 {
    unsigned int i;

-    for (i = 0; i < nscnames; i++) {
+    for (i = 0; i < nscnames; i++)
        if (scnames[i].nr == num) {
            if (scnames[i].result != NULL) {
                scnames[i].result(&scnames[i], ret);
            } else {
-                if (ret < 0) {
+                if( ret < 0 ) {
                    gemu_log(" = -1 errno=" TARGET_ABI_FMT_ld " (%s)\n", -ret,
                             strerror(-ret));
                } else {
@@ -193,50 +140,52 @@ static void print_syscall_ret(int num, abi_long ret,
            }
            break;
        }
-    }
 }

 /*
 * The public interface to this module.
 */
-void print_freebsd_syscall(int num, abi_long arg1, abi_long arg2, abi_long arg3,
-        abi_long arg4, abi_long arg5, abi_long arg6)
+void
+print_freebsd_syscall(int num,
+                      abi_long arg1, abi_long arg2, abi_long arg3,
+                      abi_long arg4, abi_long arg5, abi_long arg6)
 {
-
-    print_syscall(num, freebsd_scnames, ARRAY_SIZE(freebsd_scnames), arg1, arg2,
-            arg3, arg4, arg5, arg6);
+    print_syscall(num, freebsd_scnames, ARRAY_SIZE(freebsd_scnames),
+                  arg1, arg2, arg3, arg4, arg5, arg6);
 }

-void print_freebsd_syscall_ret(int num, abi_long ret)
+void
+print_freebsd_syscall_ret(int num, abi_long ret)
 {
-
    print_syscall_ret(num, ret, freebsd_scnames, ARRAY_SIZE(freebsd_scnames));
 }

-void print_netbsd_syscall(int num, abi_long arg1, abi_long arg2, abi_long arg3,
-        abi_long arg4, abi_long arg5, abi_long arg6)
+void
+print_netbsd_syscall(int num,
+                      abi_long arg1, abi_long arg2, abi_long arg3,
+                      abi_long arg4, abi_long arg5, abi_long arg6)
 {
-
    print_syscall(num, netbsd_scnames, ARRAY_SIZE(netbsd_scnames),
                  arg1, arg2, arg3, arg4, arg5, arg6);
 }

-void print_netbsd_syscall_ret(int num, abi_long ret)
+void
+print_netbsd_syscall_ret(int num, abi_long ret)
 {
-
    print_syscall_ret(num, ret, netbsd_scnames, ARRAY_SIZE(netbsd_scnames));
 }

-void print_openbsd_syscall(int num, abi_long arg1, abi_long arg2, abi_long arg3,
-        abi_long arg4, abi_long arg5, abi_long arg6)
+void
+print_openbsd_syscall(int num,
+                      abi_long arg1, abi_long arg2, abi_long arg3,
+                      abi_long arg4, abi_long arg5, abi_long arg6)
 {
-
-    print_syscall(num, openbsd_scnames, ARRAY_SIZE(openbsd_scnames), arg1, arg2,
-            arg3, arg4, arg5, arg6);
+    print_syscall(num, openbsd_scnames, ARRAY_SIZE(openbsd_scnames),
+                  arg1, arg2, arg3, arg4, arg5, arg6);
 }

-void print_openbsd_syscall_ret(int num, abi_long ret)
+void
+print_openbsd_syscall_ret(int num, abi_long ret)
 {
-
    print_syscall_ret(num, ret, openbsd_scnames, ARRAY_SIZE(openbsd_scnames));
 }
--- a/361
+++ b/361
@@ -2,33 +2,26 @@
 #
 # qemu configure script (c) 2003 Fabrice Bellard
 #
-
-# Unset some variables known to interfere with behavior of common tools,
-# just as autoconf does.
-CLICOLOR_FORCE= GREP_OPTIONS=
-unset CLICOLOR_FORCE GREP_OPTIONS
-
-# Temporary directory used for files created while
-# configure runs. Since it is in the build directory
-# we can safely blow away any previous version of it
-# (and we need not jump through hoops to try to delete
-# it when configure exits.)
-TMPDIR1="config-temp"
-rm -rf "${TMPDIR1}"
-mkdir -p "${TMPDIR1}"
-if [ $? -ne 0 ]; then
-    echo "ERROR: failed to create temporary directory"
-    exit 1
+# set temporary file name
+if test ! -z "$TMPDIR" ; then
+    TMPDIR1="${TMPDIR}"
+elif test ! -z "$TEMPDIR" ; then
+    TMPDIR1="${TEMPDIR}"
+else
+    TMPDIR1="/tmp"
 fi

-TMPB="qemu-conf"
-TMPC="${TMPDIR1}/${TMPB}.c"
+TMPC="${TMPDIR1}/qemu-conf-${RANDOM}-$$-${RANDOM}.c"
+TMPB="qemu-conf-${RANDOM}-$$-${RANDOM}"
 TMPO="${TMPDIR1}/${TMPB}.o"
 TMPCXX="${TMPDIR1}/${TMPB}.cxx"
 TMPL="${TMPDIR1}/${TMPB}.lo"
 TMPA="${TMPDIR1}/lib${TMPB}.la"
-TMPE="${TMPDIR1}/${TMPB}.exe"
+TMPE="${TMPDIR1}/qemu-conf-${RANDOM}-$$-${RANDOM}.exe"

+# NB: do not call "exit" in the trap handler; this is buggy with some shells;
+# see <1285349658-3122-1-git-send-email-loic.minier@linaro.org>
+trap "rm -f $TMPC $TMPO $TMPCXX $TMPE" EXIT INT QUIT TERM
 rm -f config.log

 # Print a helpful header at the top of config.log
@@ -187,10 +180,6 @@ path_of() {
    return 1
 }

-have_backend () {
-    echo "$trace_backends" | grep "$1" >/dev/null
-}
-
 # default parameters
 source_path=`dirname "$0"`
 cpu=""
@@ -296,13 +285,14 @@ softmmu="yes"
 linux_user="no"
 bsd_user="no"
 guest_base="yes"
+uname_release=""
 aix="no"
 blobs="yes"
 pkgversion=""
 pie=""
 zero_malloc=""
 qom_cast_debug="yes"
-trace_backends="nop"
+trace_backend="nop"
 trace_file="trace"
 spice=""
 rbd=""
@@ -311,8 +301,8 @@ libusb=""
 usb_redir=""
 glx=""
 zlib="yes"
-lzo=""
-snappy=""
+lzo="no"
+snappy="no"
 guest_agent=""
 guest_agent_with_vss="no"
 vss_win32_sdk=""
@@ -328,13 +318,12 @@ glusterfs_discard="no"
 glusterfs_zerofill="no"
 virtio_blk_data_plane=""
 gtk=""
-gtkabi=""
+gtkabi="2.0"
 vte=""
-tpm="yes"
+tpm="no"
 libssh2=""
 vhdx=""
-quorum=""
-numa=""
+quorum="no"

 # parse CC options first
 for opt do
@@ -415,14 +404,6 @@ fi
 # make source path absolute
 source_path=`cd "$source_path"; pwd`

-# running configure in the source tree?
-# we know that's the case if configure is there.
-if test -f "./configure"; then
-    pwd_is_source_path="y"
-else
-    pwd_is_source_path="n"
-fi
-
 check_define() {
 cat > $TMPC <<EOF
 #if !defined($1)
@@ -547,9 +528,6 @@ fi

 # OS specific

-# host *BSD for user mode
-HOST_VARIANT_DIR=""
-
 case $targetos in
 CYGWIN*)
  mingw32="yes"
@@ -575,14 +553,12 @@ FreeBSD)
  # needed for kinfo_getvmmap(3) in libutil.h
  LIBS="-lutil $LIBS"
  netmap=""  # enable netmap autodetect
-  HOST_VARIANT_DIR="freebsd"
 ;;
 DragonFly)
  bsd="yes"
  make="${MAKE-gmake}"
  audio_drv_list="oss"
  audio_possible_drivers="oss sdl esd pa"
-  HOST_VARIANT_DIR="dragonfly"
 ;;
 NetBSD)
  bsd="yes"
@@ -590,14 +566,12 @@ NetBSD)
  audio_drv_list="oss"
  audio_possible_drivers="oss sdl esd"
  oss_lib="-lossaudio"
-  HOST_VARIANT_DIR="netbsd"
 ;;
 OpenBSD)
  bsd="yes"
  make="${MAKE-gmake}"
  audio_drv_list="sdl"
  audio_possible_drivers="sdl esd"
-  HOST_VARIANT_DIR="openbsd"
 ;;
 Darwin)
  bsd="yes"
@@ -615,7 +589,6 @@ Darwin)
  # Disable attempts to use ObjectiveC features in os/object.h since they
  # won't work when we're compiling with gcc as a C compiler.
  QEMU_CFLAGS="-DOS_OBJECT_USE_OBJC=0 $QEMU_CFLAGS"
-  HOST_VARIANT_DIR="darwin"
 ;;
 SunOS)
  solaris="yes"
@@ -771,10 +744,7 @@ for opt do
  ;;
  --target-list=*) target_list="$optarg"
  ;;
-  --enable-trace-backends=*) trace_backends="$optarg"
-  ;;
-  # XXX: backwards compatibility
-  --enable-trace-backend=*) trace_backends="$optarg"
+  --enable-trace-backend=*) trace_backend="$optarg"
  ;;
  --with-trace-file=*) trace_file="$optarg"
  ;;
@@ -975,6 +945,8 @@ for opt do
  ;;
  --disable-pie) pie="no"
  ;;
+  --enable-uname-release=*) uname_release="$optarg"
+  ;;
  --enable-werror) werror="yes"
  ;;
  --disable-werror) werror="no"
@@ -1051,12 +1023,8 @@ for opt do
  ;;
  --disable-zlib-test) zlib="no"
  ;;
-  --disable-lzo) lzo="no"
-  ;;
  --enable-lzo) lzo="yes"
  ;;
-  --disable-snappy) snappy="no"
-  ;;
  --enable-snappy) snappy="yes"
  ;;
  --enable-guest-agent) guest_agent="yes"
@@ -1105,8 +1073,6 @@ for opt do
  ;;
  --enable-vte) vte="yes"
  ;;
-  --disable-tpm) tpm="no"
-  ;;
  --enable-tpm) tpm="yes"
  ;;
  --disable-libssh2) libssh2="no"
@@ -1121,14 +1087,7 @@ for opt do
  ;;
  --enable-quorum) quorum="yes"
  ;;
-  --disable-numa) numa="no"
-  ;;
-  --enable-numa) numa="yes"
-  ;;
-  *)
-      echo "ERROR: unknown option $opt"
-      echo "Try '$0 --help' for more information"
-      exit 1
+  *) echo "ERROR: unknown option $opt"; show_help="yes"
  ;;
  esac
 done
@@ -1170,11 +1129,11 @@ case "$cpu" in
           CPU_CFLAGS="-m64 -mcpu=ultrasparc"
           ;;
    s390)
-           CPU_CFLAGS="-m31"
+           CPU_CFLAGS="-m31 -march=z990"
           LDFLAGS="-m31 $LDFLAGS"
           ;;
    s390x)
-           CPU_CFLAGS="-m64"
+           CPU_CFLAGS="-m64 -march=z990"
           LDFLAGS="-m64 $LDFLAGS"
           ;;
    i386)
@@ -1258,8 +1217,8 @@ Advanced options (experts only):
  --enable-modules         enable modules support
  --enable-debug-tcg       enable TCG debugging
  --disable-debug-tcg      disable TCG debugging (default)
-  --enable-debug-info      enable debugging information (default)
-  --disable-debug-info     disable debugging information
+  --enable-debug-info       enable debugging information (default)
+  --disable-debug-info      disable debugging information
  --enable-debug           enable common debug build options
  --enable-sparse          enable sparse checker
  --disable-sparse         disable sparse checker (default)
@@ -1271,7 +1230,6 @@ Advanced options (experts only):
  --with-sdlabi            select preferred SDL ABI 1.2 or 2.0
  --disable-gtk            disable gtk UI
  --enable-gtk             enable gtk UI
-  --with-gtkabi            select preferred GTK ABI 2.0 or 3.0
  --disable-virtfs         disable VirtFS
  --enable-virtfs          enable VirtFS
  --disable-vnc            disable VNC
@@ -1333,6 +1291,7 @@ Advanced options (experts only):
  --fmod-lib               path to FMOD library
  --fmod-inc               path to FMOD includes
  --oss-lib                path to OSS library
+  --enable-uname-release=R Return R for uname -r in usermode emulation
  --cpu=CPU                Build for host CPU [$cpu]
  --disable-uuid           disable uuid support
  --enable-uuid            enable uuid support
@@ -1351,7 +1310,7 @@ Advanced options (experts only):
  --disable-docs           disable documentation build
  --disable-vhost-net      disable vhost-net acceleration support
  --enable-vhost-net       enable vhost-net acceleration support
-  --enable-trace-backends=B Set trace backend
+  --enable-trace-backend=B Set trace backend
                           Available backends: $($python $source_path/scripts/tracetool.py --list-backends)
  --with-trace-file=NAME   Full PATH,NAME of file to store traces
                           Default:trace-<pid>
@@ -1384,7 +1343,6 @@ Advanced options (experts only):
  --disable-glusterfs      disable GlusterFS backend
  --enable-gcov            enable test coverage analysis with gcov
  --gcov=GCOV              use specified gcov [$gcov_tool]
-  --disable-tpm            disable TPM support
  --enable-tpm             enable TPM support
  --disable-libssh2        disable ssh block device support
  --enable-libssh2         enable ssh block device support
@@ -1392,12 +1350,10 @@ Advanced options (experts only):
  --enable-vhdx            enable support for the Microsoft VHDX image format
  --disable-quorum         disable quorum block filter support
  --enable-quorum          enable quorum block filter support
-  --disable-numa           disable libnuma support
-  --enable-numa            enable libnuma support

 NOTE: The object files are built at the place where configure is launched
 EOF
-exit 0
+exit 1
 fi

 # Now we have handled --enable-tcg-interpreter and know we're not just
@@ -1489,9 +1445,8 @@ for flag in $gcc_flags; do
    fi
 done

-if test "$stack_protector" != "no"; then
+if test "$stack_protector" != "no" ; then
  gcc_flags="-fstack-protector-strong -fstack-protector-all"
-  sp_on=0
  for flag in $gcc_flags; do
    # We need to check both a compile and a link, since some compiler
    # setups fail only on a .c->.o compile and some only at link time
@@ -1499,15 +1454,9 @@ if test "$stack_protector" != "no"; then
       compile_prog "-Werror $flag" ""; then
      QEMU_CFLAGS="$QEMU_CFLAGS $flag"
      LIBTOOLFLAGS="$LIBTOOLFLAGS -Wc,$flag"
-      sp_on=1
      break
    fi
  done
-  if test "$stack_protector" = yes; then
-    if test $sp_on = 0; then
-      error_exit "Stack protector not supported"
-    fi
-  fi
 fi

 # Workaround for http://gcc.gnu.org/PR55489.  Happens with -fPIE/-fPIC and
@@ -1718,19 +1667,6 @@ else
    echo big/little test failed
 fi

-##########################################
-# L2TPV3 probe
-
-cat > $TMPC <<EOF
-#include <sys/socket.h>
-int main(void) { return sizeof(struct mmsghdr); }
-EOF
-if compile_prog "" "" ; then
-  l2tpv3=yes
-else
-  l2tpv3=no
-fi
-
 ##########################################
 # pkg-config probe

@@ -1783,14 +1719,13 @@ if test "$lzo" != "no" ; then
 int main(void) { lzo_version(); return 0; }
 EOF
    if compile_prog "" "-llzo2" ; then
-        libs_softmmu="$libs_softmmu -llzo2"
-        lzo="yes"
+        :
    else
-        if test "$lzo" = "yes"; then
-            feature_not_found "liblzo2" "Install liblzo2 devel"
-        fi
-        lzo="no"
+        error_exit "lzo check failed" \
+            "Make sure to have the lzo libs and headers installed."
    fi
+
+    libs_softmmu="$libs_softmmu -llzo2"
 fi

 ##########################################
@@ -1802,14 +1737,13 @@ if test "$snappy" != "no" ; then
 int main(void) { snappy_max_compressed_length(4096); return 0; }
 EOF
    if compile_prog "" "-lsnappy" ; then
-        libs_softmmu="$libs_softmmu -lsnappy"
-        snappy="yes"
+        :
    else
-        if test "$snappy" = "yes"; then
-            feature_not_found "libsnappy" "Install libsnappy devel"
-        fi
-        snappy="no"
+        error_exit "snappy check failed" \
+            "Make sure to have the snappy libs and headers installed."
    fi
+
+    libs_softmmu="$libs_softmmu -lsnappy"
 fi

 ##########################################
@@ -2028,21 +1962,8 @@ fi
 ##########################################
 # GTK probe

-if test "$gtkabi" = ""; then
-    # The GTK ABI was not specified explicitly, so try whether 2.0 is available.
-    # Use 3.0 as a fallback if that is available.
-    if $pkg_config --exists "gtk+-2.0 >= 2.18.0"; then
-        gtkabi=2.0
-    elif $pkg_config --exists "gtk+-3.0 >= 3.0.0"; then
-        gtkabi=3.0
-    else
-        gtkabi=2.0
-    fi
-fi
-
 if test "$gtk" != "no"; then
    gtkpackage="gtk+-$gtkabi"
-    gtkx11package="gtk+-x11-$gtkabi"
    if test "$gtkabi" = "3.0" ; then
      gtkversion="3.0.0"
    else
@@ -2051,13 +1972,10 @@ if test "$gtk" != "no"; then
    if $pkg_config --exists "$gtkpackage >= $gtkversion"; then
        gtk_cflags=`$pkg_config --cflags $gtkpackage`
        gtk_libs=`$pkg_config --libs $gtkpackage`
-        if $pkg_config --exists "$gtkx11package >= $gtkversion"; then
-            gtk_libs="$gtk_libs -lX11"
-        fi
        libs_softmmu="$gtk_libs $libs_softmmu"
        gtk="yes"
    elif test "$gtk" = "yes"; then
-        feature_not_found "gtk" "Install gtk2 or gtk3 devel"
+        feature_not_found "gtk" "Install gtk2 or gtk3 (requires --with-gtkabi=3.0 option to configure) devel"
    else
        gtk="no"
    fi
@@ -2080,11 +1998,7 @@ if test "$vte" != "no"; then
        libs_softmmu="$vte_libs $libs_softmmu"
        vte="yes"
    elif test "$vte" = "yes"; then
-        if test "$gtkabi" = "3.0"; then
-            feature_not_found "vte" "Install libvte-2.90 devel"
-        else
-            feature_not_found "vte" "Install libvte devel"
-        fi
+        feature_not_found "vte" "Install libvte or libvte-2.90 (requires --with-gtkabi=3.0 option to configure) devel"
    else
        vte="no"
    fi
@@ -2255,12 +2169,9 @@ if compile_prog "$quorum_tls_cflags" "$quorum_tls_libs" ; then
  libs_softmmu="$quorum_tls_libs $libs_softmmu"
  libs_tools="$quorum_tls_libs $libs_softmmu"
  QEMU_CFLAGS="$QEMU_CFLAGS $quorum_tls_cflags"
-  quorum="yes"
 else
-  if test "$quorum" = "yes"; then
-    feature_not_found "gnutls" "gnutls > 2.10.0 required to compile Quorum"
-  fi
-  quorum="no"
+  echo "gnutls > 2.10.0 required to compile Quorum"
+  exit 1
 fi
 fi

@@ -3029,7 +2940,7 @@ EOF
    fdt=yes
    dtc_internal="yes"
    mkdir -p dtc
-    if [ "$pwd_is_source_path" != "y" ] ; then
+    if [ "$source_path" != `pwd` ] ; then
       symlink "$source_path/dtc/Makefile" "dtc/Makefile"
       symlink "$source_path/dtc/scripts" "dtc/scripts"
    fi
@@ -3197,26 +3108,6 @@ if compile_prog "" "" ; then
  splice=yes
 fi

-##########################################
-# libnuma probe
-
-if test "$numa" != "no" ; then
-  cat > $TMPC << EOF
-#include <numa.h>
-int main(void) { return numa_available(); }
-EOF
-
-  if compile_prog "" "-lnuma" ; then
-    numa=yes
-    libs_softmmu="-lnuma $libs_softmmu"
-  else
-    if test "$numa" = "yes" ; then
-      feature_not_found "numa" "install numactl devel"
-    fi
-    numa=no
-  fi
-fi
-
 ##########################################
 # signalfd probe
 signalfd="no"
@@ -3455,25 +3346,51 @@ if compile_prog "" "" ; then
 fi

 ##########################################
-# Do we have libiscsi >= 1.9.0
+# Do we have libiscsi
+# We check for iscsi_write16_sync() to make sure we have a
+# at least version 1.4.0 of libiscsi.
 if test "$libiscsi" != "no" ; then
-  if $pkg_config --atleast-version=1.9.0 libiscsi; then
+  cat > $TMPC << EOF
+#include <stdio.h>
+#include <iscsi/iscsi.h>
+int main(void) { iscsi_write16_sync(NULL,0,0,NULL,0,0,0,0,0,0,0); return 0; }
+EOF
+  if $pkg_config --atleast-version=1.7.0 libiscsi; then
    libiscsi="yes"
    libiscsi_cflags=$($pkg_config --cflags libiscsi)
    libiscsi_libs=$($pkg_config --libs libiscsi)
+  elif compile_prog "" "-liscsi" ; then
+    libiscsi="yes"
+    libiscsi_libs="-liscsi"
  else
    if test "$libiscsi" = "yes" ; then
-      feature_not_found "libiscsi" "Install libiscsi >= 1.9.0"
+      feature_not_found "libiscsi" "Install libiscsi devel"
    fi
    libiscsi="no"
  fi
 fi

+# We also need to know the API version because there was an
+# API change from 1.4.0 to 1.5.0.
+if test "$libiscsi" = "yes"; then
+  cat >$TMPC <<EOF
+#include <iscsi/iscsi.h>
+int main(void)
+{
+  iscsi_read10_task(0, 0, 0, 0, 0, 0, 0);
+  return 0;
+}
+EOF
+  if compile_prog "" "-liscsi"; then
+    libiscsi_version="1.4.0"
+  fi
+fi
+
 ##########################################
 # Do we need libm
 cat > $TMPC << EOF
 #include <math.h>
-int main(int argc, char **argv) { return isnan(sin((double)argc)); }
+int main(void) { return isnan(sin(0.0)); }
 EOF
 if compile_prog "" "" ; then
  :
@@ -3502,9 +3419,9 @@ EOF
 if compile_prog "" "" ; then
  :
 # we need pthread for static linking. use previous pthread test result
-elif compile_prog "" "$pthread_lib -lrt" ; then
-  LIBS="$LIBS -lrt"
-  libs_qga="$libs_qga -lrt"
+elif compile_prog "" "-lrt $pthread_lib" ; then
+  LIBS="-lrt $LIBS"
+  libs_qga="-lrt $libs_qga"
 fi

 if test "$darwin" != "yes" -a "$mingw32" != "yes" -a "$solaris" != yes -a \
@@ -3545,10 +3462,10 @@ if test "$smartcard_nss" != "no"; then
 #include <pk11pub.h>
 int main(void) { PK11_FreeSlot(0); return 0; }
 EOF
-    # FIXME: do not include $glib_* in here
-    nss_libs="$($pkg_config --libs nss 2>/dev/null) $glib_libs"
-    nss_cflags="$($pkg_config --cflags nss 2>/dev/null) $glib_cflags"
-    test_cflags="$nss_cflags"
+    smartcard_includes="-I\$(SRC_PATH)/libcacard"
+    libcacard_libs="$($pkg_config --libs nss 2>/dev/null) $glib_libs"
+    libcacard_cflags="$($pkg_config --cflags nss 2>/dev/null) $glib_cflags"
+    test_cflags="$libcacard_cflags"
    # The header files in nss < 3.13.3 have a bug which causes them to
    # emit a warning. If we're going to compile QEMU with -Werror, then
    # test that the headers don't have this bug. Otherwise we would pass
@@ -3558,8 +3475,11 @@ EOF
    fi
    if test -n "$libtool" &&
       $pkg_config --atleast-version=3.12.8 nss && \
-      compile_prog "$test_cflags" "$nss_libs"; then
+      compile_prog "$test_cflags" "$libcacard_libs"; then
        smartcard_nss="yes"
+        QEMU_CFLAGS="$QEMU_CFLAGS $libcacard_cflags"
+        QEMU_INCLUDES="$QEMU_INCLUDES $smartcard_includes"
+        libs_softmmu="$libcacard_libs $libs_softmmu"
    else
        if test "$smartcard_nss" = "yes"; then
            feature_not_found "nss"
@@ -3723,15 +3643,15 @@ fi
 ##########################################
 # check if trace backend exists

-$python "$source_path/scripts/tracetool.py" "--backends=$trace_backends" --check-backends  > /dev/null 2> /dev/null
+$python "$source_path/scripts/tracetool.py" "--backend=$trace_backend" --check-backend  > /dev/null 2> /dev/null
 if test "$?" -ne 0 ; then
-  error_exit "invalid trace backends" \
-      "Please choose supported trace backends."
+  error_exit "invalid trace backend" \
+      "Please choose a supported trace backend."
 fi

 ##########################################
 # For 'ust' backend, test if ust headers are present
-if have_backend "ust"; then
+if test "$trace_backend" = "ust"; then
  cat > $TMPC << EOF
 #include <lttng/tracepoint.h>
 int main(void) { return 0; }
@@ -3757,7 +3677,7 @@ fi

 ##########################################
 # For 'dtrace' backend, test if 'dtrace' command is present
-if have_backend "dtrace"; then
+if test "$trace_backend" = "dtrace"; then
  if ! has 'dtrace' ; then
    error_exit "dtrace command is not found in PATH $PATH"
  fi
@@ -4104,14 +4024,11 @@ fi
 if test "$pie" = "no" ; then
  textseg_addr=
  case "$cpu" in
-    arm | i386 | ppc* | s390* | sparc* | x86_64 | x32)
-      # ??? Rationale for choosing this address
+    arm | hppa | i386 | m68k | ppc | ppc64 | s390* | sparc | sparc64 | x86_64 | x32)
      textseg_addr=0x60000000
      ;;
    mips)
-      # A 256M aligned address, high in the address space, with enough
-      # room for the code_gen_buffer above it before the stack.
-      textseg_addr=0x60000000
+      textseg_addr=0x400000
      ;;
  esac
  if [ -n "$textseg_addr" ]; then
@@ -4178,6 +4095,7 @@ echo "sparse enabled    $sparse"
 echo "strip binaries    $strip_opt"
 echo "profiler          $profiler"
 echo "static build      $static"
+echo "-Werror enabled   $werror"
 if test "$darwin" = "yes" ; then
    echo "Cocoa support     $cocoa"
 fi
@@ -4207,6 +4125,8 @@ echo "xen support       $xen"
 echo "brlapi support    $brlapi"
 echo "bluez  support    $bluez"
 echo "Documentation     $docs"
+[ ! -z "$uname_release" ] && \
+echo "uname -r          $uname_release"
 echo "GUEST_BASE        $guest_base"
 echo "PIE               $pie"
 echo "vde support       $vde"
@@ -4227,10 +4147,8 @@ echo "uuid support      $uuid"
 echo "libcap-ng support $cap_ng"
 echo "vhost-net support $vhost_net"
 echo "vhost-scsi support $vhost_scsi"
-echo "Trace backends    $trace_backends"
-if test "$trace_backend" = "simple"; then
+echo "Trace backend     $trace_backend"
 echo "Trace output file $trace_file-<pid>"
-fi
 if test "$spice" = "yes"; then
 echo "spice support     $spice ($spice_protocol_version/$spice_server_version)"
 else
@@ -4242,7 +4160,11 @@ echo "nss used          $smartcard_nss"
 echo "libusb            $libusb"
 echo "usb net redir     $usb_redir"
 echo "GLX support       $glx"
+if test "$libiscsi_version" = "1.4.0"; then
+echo "libiscsi support  $libiscsi (1.4.0)"
+else
 echo "libiscsi support  $libiscsi"
+fi
 echo "libnfs support    $libnfs"
 echo "build guest agent $guest_agent"
 echo "QGA VSS support   $guest_agent_with_vss"
@@ -4261,7 +4183,6 @@ echo "vhdx              $vhdx"
 echo "Quorum            $quorum"
 echo "lzo support       $lzo"
 echo "snappy support    $snappy"
-echo "NUMA host support $numa"

 if test "$sdl_too_old" = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
@@ -4363,9 +4284,6 @@ fi
 if test "$netmap" = "yes" ; then
  echo "CONFIG_NETMAP=y" >> $config_host_mak
 fi
-if test "$l2tpv3" = "yes" ; then
-  echo "CONFIG_L2TPV3=y" >> $config_host_mak
-fi
 if test "$cap_ng" = "yes" ; then
  echo "CONFIG_LIBCAP=y" >> $config_host_mak
 fi
@@ -4429,7 +4347,6 @@ if test "$modules" = "yes"; then
 fi
 if test "$sdl" = "yes" ; then
  echo "CONFIG_SDL=y" >> $config_host_mak
-  echo "CONFIG_SDLABI=$sdlabi" >> $config_host_mak
  echo "SDL_CFLAGS=$sdl_cflags" >> $config_host_mak
 fi
 if test "$cocoa" = "yes" ; then
@@ -4513,7 +4430,6 @@ fi
 echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
 if test "$gtk" = "yes" ; then
  echo "CONFIG_GTK=y" >> $config_host_mak
-  echo "CONFIG_GTKABI=$gtkabi" >> $config_host_mak
  echo "GTK_CFLAGS=$gtk_cflags" >> $config_host_mak
 fi
 if test "$vte" = "yes" ; then
@@ -4539,9 +4455,6 @@ fi
 if test "$vhost_scsi" = "yes" ; then
  echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
 fi
-if test "$vhost_net" = "yes" ; then
-  echo "CONFIG_VHOST_NET_USED=y" >> $config_host_mak
-fi
 if test "$blobs" = "yes" ; then
  echo "INSTALL_BLOBS=yes" >> $config_host_mak
 fi
@@ -4579,8 +4492,8 @@ fi

 if test "$smartcard_nss" = "yes" ; then
  echo "CONFIG_SMARTCARD_NSS=y" >> $config_host_mak
-  echo "NSS_LIBS=$nss_libs" >> $config_host_mak
-  echo "NSS_CFLAGS=$nss_cflags" >> $config_host_mak
+  echo "libcacard_libs=$libcacard_libs" >> $config_host_mak
+  echo "libcacard_cflags=$libcacard_cflags" >> $config_host_mak
 fi

 if test "$libusb" = "yes" ; then
@@ -4606,6 +4519,9 @@ fi

 if test "$libiscsi" = "yes" ; then
  echo "CONFIG_LIBISCSI=m" >> $config_host_mak
+  if test "$libiscsi_version" = "1.4.0"; then
+    echo "CONFIG_LIBISCSI_1_4=y" >> $config_host_mak
+  fi
  echo "LIBISCSI_CFLAGS=$libiscsi_cflags" >> $config_host_mak
  echo "LIBISCSI_LIBS=$libiscsi_libs" >> $config_host_mak
 fi
@@ -4623,6 +4539,8 @@ if [ "$bsd" = "yes" ] ; then
  echo "CONFIG_BSD=y" >> $config_host_mak
 fi

+echo "CONFIG_UNAME_RELEASE=\"$uname_release\"" >> $config_host_mak
+
 if test "$zero_malloc" = "yes" ; then
  echo "CONFIG_ZERO_MALLOC=y" >> $config_host_mak
 fi
@@ -4721,35 +4639,43 @@ if test "$tpm" = "yes"; then
  fi
 fi

-echo "TRACE_BACKENDS=$trace_backends" >> $config_host_mak
-if have_backend "nop"; then
+# use default implementation for tracing backend-specific routines
+trace_default=yes
+echo "TRACE_BACKEND=$trace_backend" >> $config_host_mak
+if test "$trace_backend" = "nop"; then
  echo "CONFIG_TRACE_NOP=y" >> $config_host_mak
 fi
-if have_backend "simple"; then
+if test "$trace_backend" = "simple"; then
  echo "CONFIG_TRACE_SIMPLE=y" >> $config_host_mak
+  trace_default=no
  # Set the appropriate trace file.
  trace_file="\"$trace_file-\" FMT_pid"
 fi
-if have_backend "stderr"; then
+if test "$trace_backend" = "stderr"; then
  echo "CONFIG_TRACE_STDERR=y" >> $config_host_mak
+  trace_default=no
 fi
-if have_backend "ust"; then
+if test "$trace_backend" = "ust"; then
  echo "CONFIG_TRACE_UST=y" >> $config_host_mak
 fi
-if have_backend "dtrace"; then
+if test "$trace_backend" = "dtrace"; then
  echo "CONFIG_TRACE_DTRACE=y" >> $config_host_mak
  if test "$trace_backend_stap" = "yes" ; then
    echo "CONFIG_TRACE_SYSTEMTAP=y" >> $config_host_mak
  fi
 fi
-if have_backend "ftrace"; then
+if test "$trace_backend" = "ftrace"; then
  if test "$linux" = "yes" ; then
    echo "CONFIG_TRACE_FTRACE=y" >> $config_host_mak
+    trace_default=no
  else
    feature_not_found "ftrace(trace backend)" "ftrace requires Linux"
  fi
 fi
 echo "CONFIG_TRACE_FILE=$trace_file" >> $config_host_mak
+if test "$trace_default" = "yes"; then
+  echo "CONFIG_TRACE_DEFAULT=y" >> $config_host_mak
+fi

 if test "$rdma" = "yes" ; then
  echo "CONFIG_RDMA=y" >> $config_host_mak
@@ -4773,8 +4699,6 @@ elif test "$ARCH" = "s390x" ; then
  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/s390 $QEMU_INCLUDES"
 elif test "$ARCH" = "x86_64" -o "$ARCH" = "x32" ; then
  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/i386 $QEMU_INCLUDES"
-elif test "$ARCH" = "ppc64" ; then
-  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/ppc $QEMU_INCLUDES"
 else
  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/\$(ARCH) $QEMU_INCLUDES"
 fi
@@ -4856,9 +4780,6 @@ if test "$linux" = "yes" ; then
  aarch64)
    linux_arch=arm64
    ;;
-  mips64)
-    linux_arch=mips
-    ;;
  *)
    # For most CPUs the kernel architecture name and QEMU CPU name match.
    linux_arch="$cpu"
@@ -4984,12 +4905,6 @@ case "$target_name" in
    TARGET_ABI_DIR=ppc
    gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
  ;;
-  ppc64le)
-    TARGET_ARCH=ppc64
-    TARGET_BASE_ARCH=ppc
-    TARGET_ABI_DIR=ppc
-    gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-  ;;
  ppc64abi32)
    TARGET_ARCH=ppc64
    TARGET_BASE_ARCH=ppc
@@ -5042,9 +4957,6 @@ if [ "$TARGET_ABI_DIR" = "" ]; then
  TARGET_ABI_DIR=$TARGET_ARCH
 fi
 echo "TARGET_ABI_DIR=$TARGET_ABI_DIR" >> $config_target_mak
-if [ "$HOST_VARIANT_DIR" != "" ]; then
-    echo "HOST_VARIANT_DIR=$HOST_VARIANT_DIR" >> $config_target_mak
-fi
 case "$target_name" in
  i386|x86_64)
    if test "$xen" = "yes" -a "$target_softmmu" = "yes" ; then
@@ -5057,7 +4969,7 @@ case "$target_name" in
  *)
 esac
 case "$target_name" in
-  aarch64|arm|i386|x86_64|ppcemb|ppc|ppc64|s390x|mipsel|mips)
+  aarch64|arm|i386|x86_64|ppcemb|ppc|ppc64|s390x)
    # Make sure the target and host cpus are compatible
    if test "$kvm" = "yes" -a "$target_softmmu" = "yes" -a \
      \( "$target_name" = "$cpu" -o \
@@ -5065,7 +4977,6 @@ case "$target_name" in
      \( "$target_name" = "ppc64"  -a "$cpu" = "ppc" \) -o \
      \( "$target_name" = "ppc"    -a "$cpu" = "ppc64" \) -o \
      \( "$target_name" = "ppcemb" -a "$cpu" = "ppc64" \) -o \
-      \( "$target_name" = "mipsel" -a "$cpu" = "mips" \) -o \
      \( "$target_name" = "x86_64" -a "$cpu" = "i386"   \) -o \
      \( "$target_name" = "i386"   -a "$cpu" = "x86_64" \) \) ; then
      echo "CONFIG_KVM=y" >> $config_target_mak
@@ -5237,10 +5148,6 @@ if [ "$dtc_internal" = "yes" ]; then
  echo "config-host.h: subdir-dtc" >> $config_host_mak
 fi

-if test "$numa" = "yes"; then
-  echo "CONFIG_NUMA=y" >> $config_host_mak
-fi
-
 # build tree in object directory in case the source is not in the current directory
 DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos tests/qapi-schema tests/tcg/xtensa tests/qemu-iotests"
 DIRS="$DIRS fsdev"
@@ -5262,7 +5169,6 @@ for bios_file in \
    $source_path/pc-bios/*.dtb \
    $source_path/pc-bios/*.img \
    $source_path/pc-bios/openbios-* \
-    $source_path/pc-bios/u-boot.* \
    $source_path/pc-bios/palcode-*
 do
    FILES="$FILES pc-bios/`basename $bios_file`"
@@ -5273,7 +5179,7 @@ do
 done
 mkdir -p $DIRS
 for f in $FILES ; do
-    if [ -e "$source_path/$f" ] && [ "$pwd_is_source_path" != "y" ]; then
+    if [ -e "$source_path/$f" ] && [ "$source_path" != `pwd` ]; then
        symlink "$source_path/$f" "$f"
    fi
 done
@@ -5296,18 +5202,6 @@ if test "$docs" = "yes" ; then
  mkdir -p QMP
 fi

-# set up qemu-iotests in this build directory
-iotests_common_env="tests/qemu-iotests/common.env"
-iotests_check="tests/qemu-iotests/check"
-
-echo "# Automatically generated by configure - do not modify" > "$iotests_common_env"
-echo >> "$iotests_common_env"
-echo "export PYTHON='$python'" >> "$iotests_common_env"
-
-if [ ! -e "$iotests_check" ]; then
-    symlink "$source_path/$iotests_check" "$iotests_check"
-fi
-
 # Save the configure command line for later reuse.
 cat <<EOD >config.status
 #!/bin/sh
@@ -5321,4 +5215,3 @@ printf " '%s'" "$0" "$@" >>config.status
 echo >>config.status
 chmod +x config.status

-rm -r "$TMPDIR1"
--- a/coroutine-gthread.c
+++ b/coroutine-gthread.c
@@ -30,14 +30,20 @@ typedef struct {
    CoroutineAction action;
 } CoroutineGThread;

-static CompatGMutex coroutine_lock;
-static CompatGCond coroutine_cond;
+static GStaticMutex coroutine_lock = G_STATIC_MUTEX_INIT;

 /* GLib 2.31 and beyond deprecated various parts of the thread API,
 * but the new interfaces are not available in older GLib versions
 * so we have to cope with both.
 */
 #if GLIB_CHECK_VERSION(2, 31, 0)
+/* Default zero-initialisation is sufficient for 2.31+ GCond */
+static GCond the_coroutine_cond;
+static GCond *coroutine_cond = &the_coroutine_cond;
+static inline void init_coroutine_cond(void)
+{
+}
+
 /* Awkwardly, the GPrivate API doesn't provide a way to update the
 * GDestroyNotify handler for the coroutine key dynamically. So instead
 * we track whether or not the CoroutineGThread should be freed on
@@ -78,6 +84,11 @@ static inline GThread *create_thread(GThreadFunc func, gpointer data)
 #else

 /* Handle older GLib versions */
+static GCond *coroutine_cond;
+static inline void init_coroutine_cond(void)
+{
+    coroutine_cond = g_cond_new();
+}

 static GStaticPrivate coroutine_key = G_STATIC_PRIVATE_INIT;

@@ -104,25 +115,30 @@ static inline GThread *create_thread(GThreadFunc func, gpointer data)

 static void __attribute__((constructor)) coroutine_init(void)
 {
-#if !GLIB_CHECK_VERSION(2, 31, 0)
    if (!g_thread_supported()) {
+#if !GLIB_CHECK_VERSION(2, 31, 0)
        g_thread_init(NULL);
-    }
+#else
+        fprintf(stderr, "glib threading failed to initialize.\n");
+        exit(1);
 #endif
+    }
+
+    init_coroutine_cond();
 }

 static void coroutine_wait_runnable_locked(CoroutineGThread *co)
 {
    while (!co->runnable) {
-        g_cond_wait(&coroutine_cond, &coroutine_lock);
+        g_cond_wait(coroutine_cond, g_static_mutex_get_mutex(&coroutine_lock));
    }
 }

 static void coroutine_wait_runnable(CoroutineGThread *co)
 {
-    g_mutex_lock(&coroutine_lock);
+    g_static_mutex_lock(&coroutine_lock);
    coroutine_wait_runnable_locked(co);
-    g_mutex_unlock(&coroutine_lock);
+    g_static_mutex_unlock(&coroutine_lock);
 }

 static gpointer coroutine_thread(gpointer opaque)
@@ -164,17 +180,17 @@ CoroutineAction qemu_coroutine_switch(Coroutine *from_,
    CoroutineGThread *from = DO_UPCAST(CoroutineGThread, base, from_);
    CoroutineGThread *to = DO_UPCAST(CoroutineGThread, base, to_);

-    g_mutex_lock(&coroutine_lock);
+    g_static_mutex_lock(&coroutine_lock);
    from->runnable = false;
    from->action = action;
    to->runnable = true;
    to->action = action;
-    g_cond_broadcast(&coroutine_cond);
+    g_cond_broadcast(coroutine_cond);

    if (action != COROUTINE_TERMINATE) {
        coroutine_wait_runnable_locked(from);
    }
-    g_mutex_unlock(&coroutine_lock);
+    g_static_mutex_unlock(&coroutine_lock);
    return from->action;
 }

--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -335,18 +335,6 @@ int cpu_exec(CPUArchState *env)
                        cpu_loop_exit(cpu);
                    }
 #endif
-#if defined(TARGET_I386)
-                    if (interrupt_request & CPU_INTERRUPT_INIT) {
-                        cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0);
-                        do_cpu_init(x86_cpu);
-                        cpu->exception_index = EXCP_HALTED;
-                        cpu_loop_exit(cpu);
-                    }
-#else
-                    if (interrupt_request & CPU_INTERRUPT_RESET) {
-                        cpu_reset(cpu);
-                    }
-#endif
 #if defined(TARGET_I386)
 #if !defined(CONFIG_USER_ONLY)
                    if (interrupt_request & CPU_INTERRUPT_POLL) {
@@ -354,7 +342,13 @@ int cpu_exec(CPUArchState *env)
                        apic_poll_irq(x86_cpu->apic_state);
                    }
 #endif
-                    if (interrupt_request & CPU_INTERRUPT_SIPI) {
+                    if (interrupt_request & CPU_INTERRUPT_INIT) {
+                            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT,
+                                                          0);
+                            do_cpu_init(x86_cpu);
+                            cpu->exception_index = EXCP_HALTED;
+                            cpu_loop_exit(cpu);
+                    } else if (interrupt_request & CPU_INTERRUPT_SIPI) {
                            do_cpu_sipi(x86_cpu);
                    } else if (env->hflags2 & HF2_GIF_MASK) {
                        if ((interrupt_request & CPU_INTERRUPT_SMI) &&
@@ -411,6 +405,9 @@ int cpu_exec(CPUArchState *env)
                        }
                    }
 #elif defined(TARGET_PPC)
+                    if ((interrupt_request & CPU_INTERRUPT_RESET)) {
+                        cpu_reset(cpu);
+                    }
                    if (interrupt_request & CPU_INTERRUPT_HARD) {
                        ppc_hw_interrupt(env);
                        if (env->pending_interrupts == 0) {
--- a/cpus.c
+++ b/cpus.c
@@ -26,7 +26,6 @@
 #include "config-host.h"

 #include "monitor/monitor.h"
-#include "qapi/qmp/qerror.h"
 #include "sysemu/sysemu.h"
 #include "exec/gdbstub.h"
 #include "sysemu/dma.h"
@@ -39,7 +38,6 @@
 #include "qemu/main-loop.h"
 #include "qemu/bitmap.h"
 #include "qemu/seqlock.h"
-#include "qapi-event.h"

 #ifndef _WIN32
 #include "qemu/compatfd.h"
@@ -349,7 +347,7 @@ void qtest_clock_warp(int64_t dest)
    assert(qtest_enabled());
    while (clock < dest) {
        int64_t deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
-        int64_t warp = qemu_soonest_timeout(dest - clock, deadline);
+        int64_t warp = MIN(dest - clock, deadline);
        seqlock_write_lock(&timers_state.vm_clock_seqlock);
        qemu_icount_bias += warp;
        seqlock_write_unlock(&timers_state.vm_clock_seqlock);
@@ -432,7 +430,8 @@ static const VMStateDescription vmstate_timers = {
    .name = "timer",
    .version_id = 2,
    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField[]) {
        VMSTATE_INT64(cpu_ticks_offset, TimersState),
        VMSTATE_INT64(dummy, TimersState),
        VMSTATE_INT64_V(cpu_clock_offset, TimersState, 2),
@@ -532,7 +531,7 @@ static int do_vm_stop(RunState state)
        pause_all_vcpus();
        runstate_set(state);
        vm_state_notify(0, state);
-        qapi_event_send_stop(&error_abort);
+        monitor_protocol_event(QEVENT_STOP, NULL);
    }

    bdrv_drain_all();
@@ -1208,7 +1207,6 @@ void cpu_stop_current(void)
 int vm_stop(RunState state)
 {
    if (qemu_in_vcpu_thread()) {
-        qemu_system_vmstop_request_prepare();
        qemu_system_vmstop_request(state);
        /*
         * FIXME: should not return to device code in case
@@ -1315,6 +1313,20 @@ static void tcg_exec_all(void)
    exit_request = 0;
 }

+void set_numa_modes(void)
+{
+    CPUState *cpu;
+    int i;
+
+    CPU_FOREACH(cpu) {
+        for (i = 0; i < nb_numa_nodes; i++) {
+            if (test_bit(cpu->cpu_index, node_cpumask[i])) {
+                cpu->numa_node = i;
+            }
+        }
+    }
+}
+
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
 {
    /* XXX: implement xxx_cpu_list for targets that still miss it */
@@ -1442,7 +1454,7 @@ void qmp_pmemsave(int64_t addr, int64_t size, const char *filename,
        l = sizeof(buf);
        if (l > size)
            l = size;
-        cpu_physical_memory_read(addr, buf, l);
+        cpu_physical_memory_rw(addr, buf, l, 0);
        if (fwrite(buf, 1, l, f) != l) {
            error_set(errp, QERR_IO_ERROR);
            goto exit;
--- a/cputlb.c
+++ b/cputlb.c
@@ -22,13 +22,11 @@
 #include "exec/exec-all.h"
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
-#include "exec/cpu_ldst.h"

 #include "exec/cputlb.h"

 #include "exec/memory-internal.h"
 #include "exec/ram_addr.h"
-#include "tcg/tcg.h"

 //#define DEBUG_TLB
 //#define DEBUG_TLB_CHECK
@@ -332,21 +330,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
    return qemu_ram_addr_from_host_nofail(p);
 }

-#define MMUSUFFIX _mmu
-
-#define SHIFT 0
-#include "softmmu_template.h"
-
-#define SHIFT 1
-#include "softmmu_template.h"
-
-#define SHIFT 2
-#include "softmmu_template.h"
-
-#define SHIFT 3
-#include "softmmu_template.h"
-#undef MMUSUFFIX
-
 #define MMUSUFFIX _cmmu
 #undef GETPC_ADJ
 #define GETPC_ADJ 0
@@ -355,13 +338,15 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
 #define SOFTMMU_CODE_ACCESS

 #define SHIFT 0
-#include "softmmu_template.h"
+#include "exec/softmmu_template.h"

 #define SHIFT 1
-#include "softmmu_template.h"
+#include "exec/softmmu_template.h"

 #define SHIFT 2
-#include "softmmu_template.h"
+#include "exec/softmmu_template.h"

 #define SHIFT 3
-#include "softmmu_template.h"
+#include "exec/softmmu_template.h"
+
+#undef env
--- a/default-configs/i386-softmmu.mak
+++ b/default-configs/i386-softmmu.mak
@@ -44,4 +44,3 @@ CONFIG_APIC=y
 CONFIG_IOAPIC=y
 CONFIG_ICC_BUS=y
 CONFIG_PVPANIC=y
-CONFIG_MEM_HOTPLUG=y
--- a/default-configs/ppc-linux-user.mak
+++ b/default-configs/ppc-linux-user.mak
@@ -1,2 +1 @@
 # Default configuration for ppc-linux-user
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppc-softmmu.mak
+++ b/default-configs/ppc-softmmu.mak
@@ -49,4 +49,3 @@ CONFIG_OPENPIC_KVM=$(and $(CONFIG_E500),$(CONFIG_KVM))
 CONFIG_MC146818RTC=y
 CONFIG_ETSEC=y
 CONFIG_ISA_TESTDEV=y
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppc64-linux-user.mak
+++ b/default-configs/ppc64-linux-user.mak
@@ -1,2 +1 @@
 # Default configuration for ppc64-linux-user
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppc64-softmmu.mak
+++ b/default-configs/ppc64-softmmu.mak
@@ -58,4 +58,3 @@ CONFIG_I82374=y
 CONFIG_I8257=y
 CONFIG_MC146818RTC=y
 CONFIG_ISA_TESTDEV=y
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppc64abi32-linux-user.mak
+++ b/default-configs/ppc64abi32-linux-user.mak
@@ -1,2 +1 @@
 # Default configuration for ppc64abi32-linux-user
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppc64le-linux-user.mak
+++ b/default-configs/ppc64le-linux-user.mak
@@ -1,2 +0,0 @@
-# Default configuration for ppc64le-linux-user
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/ppcemb-softmmu.mak
+++ b/default-configs/ppcemb-softmmu.mak
@@ -16,4 +16,3 @@ CONFIG_I8259=y
 CONFIG_XILINX=y
 CONFIG_XILINX_ETHLITE=y
 CONFIG_OPENPIC=y
-CONFIG_LIBDECNUMBER=y
--- a/default-configs/s390x-softmmu.mak
+++ b/default-configs/s390x-softmmu.mak
@@ -1,4 +1,3 @@
 CONFIG_VIRTIO=y
 CONFIG_SCLPCONSOLE=y
-CONFIG_S390_FLIC=y
-CONFIG_S390_FLIC_KVM=$(CONFIG_KVM)
+CONFIG_S390_FLIC=$(CONFIG_KVM)
--- a/default-configs/usb.mak
+++ b/default-configs/usb.mak
@@ -1,7 +1,6 @@
 CONFIG_USB_TABLET_WACOM=y
 CONFIG_USB_STORAGE_BOT=y
 CONFIG_USB_STORAGE_UAS=y
-CONFIG_USB_STORAGE_MTP=y
 CONFIG_USB_SMARTCARD=y
 CONFIG_USB_AUDIO=y
 CONFIG_USB_SERIAL=y
--- a/default-configs/x86_64-softmmu.mak
+++ b/default-configs/x86_64-softmmu.mak
@@ -44,4 +44,3 @@ CONFIG_APIC=y
 CONFIG_IOAPIC=y
 CONFIG_ICC_BUS=y
 CONFIG_PVPANIC=y
-CONFIG_MEM_HOTPLUG=y
--- a/device-hotplug.c
+++ b/device-hotplug.c
@@ -40,7 +40,7 @@ DriveInfo *add_init_drive(const char *optstr)
        return NULL;

    mc = MACHINE_GET_CLASS(current_machine);
-    dinfo = drive_new(opts, mc->block_default_type);
+    dinfo = drive_init(opts, mc->qemu_machine->block_default_type);
    if (!dinfo) {
        qemu_opts_del(opts);
        return NULL;
@@ -76,6 +76,6 @@ void drive_hot_add(Monitor *mon, const QDict *qdict)

 err:
    if (dinfo) {
-        drive_del(dinfo);
+        drive_put_ref(dinfo);
    }
 }
--- a/disas.c
+++ b/disas.c
@@ -191,8 +191,7 @@ static int print_insn_od_target(bfd_vma pc, disassemble_info *info)
   values:
    i386 - 1 means 16 bit code, 2 means 64 bit code
    arm  - bit 0 = thumb, bit 1 = reverse endian, bit 2 = A64
-    ppc  - bits 0:15 specify (optionally) the machine instruction set;
-           bit 16 indicates little endian.
+    ppc  - nonzero means little endian
    other targets - unused
 */
 void target_disas(FILE *out, CPUArchState *env, target_ulong code,
@@ -252,11 +251,11 @@ void target_disas(FILE *out, CPUArchState *env, target_ulong code,
    s.info.mach = bfd_mach_sparc_v9b;
 #endif
 #elif defined(TARGET_PPC)
-    if ((flags >> 16) & 1) {
+    if (flags >> 16) {
        s.info.endian = BFD_ENDIAN_LITTLE;
    }
    if (flags & 0xFFFF) {
-        /* If we have a precise definition of the instruction set, use it. */
+        /* If we have a precise definitions of the instructions set, use it */
        s.info.mach = flags & 0xFFFF;
    } else {
 #ifdef TARGET_PPC64
@@ -445,8 +444,6 @@ monitor_fprintf(FILE *stream, const char *fmt, ...)
    return 0;
 }

-/* Disassembler for the monitor.
-   See target_disas for a description of flags. */
 void monitor_disas(Monitor *mon, CPUArchState *env,
                   target_ulong pc, int nb_insn, int is_physical, int flags)
 {
@@ -487,19 +484,11 @@ void monitor_disas(Monitor *mon, CPUArchState *env,
    s.info.mach = bfd_mach_sparc_v9b;
 #endif
 #elif defined(TARGET_PPC)
-    if (flags & 0xFFFF) {
-        /* If we have a precise definition of the instruction set, use it. */
-        s.info.mach = flags & 0xFFFF;
-    } else {
 #ifdef TARGET_PPC64
-        s.info.mach = bfd_mach_ppc64;
+    s.info.mach = bfd_mach_ppc64;
 #else
-        s.info.mach = bfd_mach_ppc;
+    s.info.mach = bfd_mach_ppc;
 #endif
-    }
-    if ((flags >> 16) & 1) {
-        s.info.endian = BFD_ENDIAN_LITTLE;
-    }
    print_insn = print_insn_ppc;
 #elif defined(TARGET_M68K)
    print_insn = print_insn_m68k;
--- a/disas/Makefile.objs
+++ b/disas/Makefile.objs
@@ -4,7 +4,7 @@ common-obj-$(CONFIG_ARM_DIS) += arm.o
 common-obj-$(CONFIG_ARM_A64_DIS) += arm-a64.o
 common-obj-$(CONFIG_ARM_A64_DIS) += libvixl/
 libvixldir = $(SRC_PATH)/disas/libvixl
-arm-a64.o-cflags := -I$(libvixldir)
+$(obj)/arm-a64.o: QEMU_CFLAGS := -I$(libvixldir) $(QEMU_CFLAGS)
 common-obj-$(CONFIG_CRIS_DIS) += cris.o
 common-obj-$(CONFIG_HPPA_DIS) += hppa.o
 common-obj-$(CONFIG_I386_DIS) += i386.o
--- a/disas/libvixl/README
+++ b/disas/libvixl/README
@@ -2,7 +2,7 @@
 The code in this directory is a subset of libvixl:
 https://github.com/armvixl/vixl
 (specifically, it is the set of files needed for disassembly only,
-taken from libvixl 1.4).
+taken from libvixl 1.1).
 Bugfixes should preferably be sent upstream initially.

 The disassembler does not currently support the entire A64 instruction
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.0
 .0.2