Update version for 3.1.1.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
slrip: ip_reass: Fix use after free
2019-10-01 17:27:10 -05:00 · 2019-10-01 17:00:56 -05:00 · 2019-10-01 17:00:56 -05:00 · 2019-09-19 11:20:17 -05:00 · 2019-08-02 11:02:35 -05:00 · 2019-07-30 15:44:36 -05:00
2153 changed files with 52105 additions and 123179 deletions
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -1,16 +0,0 @@
-freebsd_12_task:
-  freebsd_instance:
-    image: freebsd-12-0-release-amd64
-    cpu: 8
-    memory: 8G
-  env:
-    CIRRUS_CLONE_DEPTH: 1
-  install_script: pkg install -y
-    bison curl cyrus-sasl git glib gmake gnutls
-    nettle perl5 pixman pkgconf png usbredir
-  script:
-    - mkdir build
-    - cd build
-    - ../configure || { cat config.log; exit 1; }
-    - gmake -j8
-    - gmake -j8 V=1 check
--- a/.gitignore
+++ b/.gitignore
@@ -30,15 +30,78 @@
 /qapi-gen-timestamp
 /qapi/qapi-builtin-types.[ch]
 /qapi/qapi-builtin-visit.[ch]
-/qapi/qapi-commands-*.[ch]
+/qapi/qapi-commands-block-core.[ch]
+/qapi/qapi-commands-block.[ch]
+/qapi/qapi-commands-char.[ch]
+/qapi/qapi-commands-common.[ch]
+/qapi/qapi-commands-crypto.[ch]
+/qapi/qapi-commands-introspect.[ch]
+/qapi/qapi-commands-job.[ch]
+/qapi/qapi-commands-migration.[ch]
+/qapi/qapi-commands-misc.[ch]
+/qapi/qapi-commands-net.[ch]
+/qapi/qapi-commands-rocker.[ch]
+/qapi/qapi-commands-run-state.[ch]
+/qapi/qapi-commands-sockets.[ch]
+/qapi/qapi-commands-tpm.[ch]
+/qapi/qapi-commands-trace.[ch]
+/qapi/qapi-commands-transaction.[ch]
+/qapi/qapi-commands-ui.[ch]
 /qapi/qapi-commands.[ch]
-/qapi/qapi-emit-events.[ch]
-/qapi/qapi-events-*.[ch]
+/qapi/qapi-events-block-core.[ch]
+/qapi/qapi-events-block.[ch]
+/qapi/qapi-events-char.[ch]
+/qapi/qapi-events-common.[ch]
+/qapi/qapi-events-crypto.[ch]
+/qapi/qapi-events-introspect.[ch]
+/qapi/qapi-events-job.[ch]
+/qapi/qapi-events-migration.[ch]
+/qapi/qapi-events-misc.[ch]
+/qapi/qapi-events-net.[ch]
+/qapi/qapi-events-rocker.[ch]
+/qapi/qapi-events-run-state.[ch]
+/qapi/qapi-events-sockets.[ch]
+/qapi/qapi-events-tpm.[ch]
+/qapi/qapi-events-trace.[ch]
+/qapi/qapi-events-transaction.[ch]
+/qapi/qapi-events-ui.[ch]
 /qapi/qapi-events.[ch]
 /qapi/qapi-introspect.[ch]
-/qapi/qapi-types-*.[ch]
+/qapi/qapi-types-block-core.[ch]
+/qapi/qapi-types-block.[ch]
+/qapi/qapi-types-char.[ch]
+/qapi/qapi-types-common.[ch]
+/qapi/qapi-types-crypto.[ch]
+/qapi/qapi-types-introspect.[ch]
+/qapi/qapi-types-job.[ch]
+/qapi/qapi-types-migration.[ch]
+/qapi/qapi-types-misc.[ch]
+/qapi/qapi-types-net.[ch]
+/qapi/qapi-types-rocker.[ch]
+/qapi/qapi-types-run-state.[ch]
+/qapi/qapi-types-sockets.[ch]
+/qapi/qapi-types-tpm.[ch]
+/qapi/qapi-types-trace.[ch]
+/qapi/qapi-types-transaction.[ch]
+/qapi/qapi-types-ui.[ch]
 /qapi/qapi-types.[ch]
-/qapi/qapi-visit-*.[ch]
+/qapi/qapi-visit-block-core.[ch]
+/qapi/qapi-visit-block.[ch]
+/qapi/qapi-visit-char.[ch]
+/qapi/qapi-visit-common.[ch]
+/qapi/qapi-visit-crypto.[ch]
+/qapi/qapi-visit-introspect.[ch]
+/qapi/qapi-visit-job.[ch]
+/qapi/qapi-visit-migration.[ch]
+/qapi/qapi-visit-misc.[ch]
+/qapi/qapi-visit-net.[ch]
+/qapi/qapi-visit-rocker.[ch]
+/qapi/qapi-visit-run-state.[ch]
+/qapi/qapi-visit-sockets.[ch]
+/qapi/qapi-visit-tpm.[ch]
+/qapi/qapi-visit-trace.[ch]
+/qapi/qapi-visit-transaction.[ch]
+/qapi/qapi-visit-ui.[ch]
 /qapi/qapi-visit.[ch]
 /qapi/qapi-doc.texi
 /qemu-doc.html
@@ -104,10 +167,6 @@
 /pc-bios/optionrom/linuxboot_dma.bin
 /pc-bios/optionrom/linuxboot_dma.raw
 /pc-bios/optionrom/linuxboot_dma.img
-/pc-bios/optionrom/pvh.asm
-/pc-bios/optionrom/pvh.bin
-/pc-bios/optionrom/pvh.raw
-/pc-bios/optionrom/pvh.img
 /pc-bios/optionrom/multiboot.asm
 /pc-bios/optionrom/multiboot.bin
 /pc-bios/optionrom/multiboot.raw
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,73 +0,0 @@
-before_script:
- - apt-get update -qq
- - apt-get install -y -qq flex bison libglib2.0-dev libpixman-1-dev genisoimage
-
-build-system1:
- script:
- - apt-get install -y -qq libgtk-3-dev libvte-dev nettle-dev libcacard-dev
-      libusb-dev libvde-dev libspice-protocol-dev libgl1-mesa-dev
- - ./configure --enable-werror --target-list="aarch64-softmmu alpha-softmmu
-      cris-softmmu hppa-softmmu lm32-softmmu moxie-softmmu microblazeel-softmmu
-      mips64el-softmmu m68k-softmmu ppc-softmmu riscv64-softmmu sparc-softmmu"
- - make -j2
- - make -j2 check
-
-build-system2:
- script:
- - apt-get install -y -qq libsdl2-dev libgcrypt-dev libbrlapi-dev libaio-dev
-      libfdt-dev liblzo2-dev librdmacm-dev libibverbs-dev libibumad-dev
- - ./configure --enable-werror --target-list="tricore-softmmu unicore32-softmmu
-      microblaze-softmmu mips-softmmu riscv32-softmmu s390x-softmmu sh4-softmmu
-      sparc64-softmmu x86_64-softmmu xtensa-softmmu nios2-softmmu or1k-softmmu"
- - make -j2
- - make -j2 check
-
-build-disabled:
- script:
- - ./configure --enable-werror --disable-rdma --disable-slirp --disable-curl
-      --disable-capstone --disable-live-block-migration --disable-glusterfs
-      --disable-replication --disable-coroutine-pool --disable-smartcard
-      --disable-guest-agent --disable-curses --disable-libxml2 --disable-tpm
-      --disable-qom-cast-debug --disable-spice --disable-vhost-vsock
-      --disable-vhost-net --disable-vhost-crypto --disable-vhost-user
-      --target-list="i386-softmmu ppc64-softmmu mips64-softmmu i386-linux-user"
- - make -j2
- - make -j2 check-qtest SPEED=slow
-
-build-tcg-disabled:
- script:
- - apt-get install -y -qq clang libgtk-3-dev libbluetooth-dev libusb-dev
- - ./configure --cc=clang --enable-werror --disable-tcg --audio-drv-list=""
- - make -j2
- - make check-unit
- - make check-qapi-schema
- - cd tests/qemu-iotests/
- - ./check -raw 001 002 003 004 005 008 009 010 011 012 021 025 032 033 048
-            052 063 077 086 101 104 106 113 147 148 150 151 152 157 159 160
-            163 170 171 183 184 192 194 197 205 208 215 221 222 226 227 236
- - ./check -qcow2 001 002 003 004 005 007 008 009 010 011 012 013 017 018 019
-            020 021 022 024 025 027 028 029 031 032 033 034 035 036 037 038
-            039 040 042 043 046 047 048 049 050 051 052 053 054 056 057 058
-            060 061 062 063 065 066 067 068 069 071 072 073 074 079 080 082
-            085 086 089 090 091 095 096 097 098 099 102 103 104 105 107 108
-            110 111 114 117 120 122 124 126 127 129 130 132 133 134 137 138
-            139 140 141 142 143 144 145 147 150 151 152 154 155 156 157 158
-            161 165 170 172 174 176 177 179 184 186 187 190 192 194 195 196
-            197 200 202 203 205 208 209 214 215 216 217 218 222 226 227 229 234
-
-build-user:
- script:
- - ./configure --enable-werror --disable-system --disable-guest-agent
-               --disable-capstone --disable-slirp --disable-fdt
- - make -j2
- - make run-tcg-tests-i386-linux-user run-tcg-tests-x86_64-linux-user
-
-build-clang:
- script:
- - apt-get install -y -qq clang libsdl2-dev
-      xfslibs-dev libiscsi-dev libnfs-dev libseccomp-dev gnutls-dev librbd-dev
- - ./configure --cc=clang --cxx=clang++ --enable-werror
-      --target-list="alpha-softmmu arm-softmmu m68k-softmmu mips64-softmmu
-                     ppc-softmmu s390x-softmmu x86_64-softmmu arm-linux-user"
- - make -j2
- - make -j2 check
--- a/.mailmap
+++ b/.mailmap
@@ -34,6 +34,6 @@ Justin Terry (VM) <juterry@microsoft.com> Justin Terry (VM) via Qemu-devel <qemu


 # Also list preferred name forms where people have changed their
-# git author config, or had utf8/latin1 encoding issues.
+# git author config, or having utf8/latin1 encoding issues.
 Daniel P. Berrangé <berrange@redhat.com>
 Reimar Döffinger <Reimar.Doeffinger@gmx.de>
--- a/.shippable.yml
+++ b/.shippable.yml
@@ -7,11 +7,10 @@ env:
  matrix:
    - IMAGE=debian-amd64
      TARGET_LIST=x86_64-softmmu,x86_64-linux-user
-    # currently disabled as the mxe.cc repos are down
-    # - IMAGE=debian-win32-cross
-    #   TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
-    # - IMAGE=debian-win64-cross
-    #   TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
+    - IMAGE=debian-win32-cross
+      TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
+    - IMAGE=debian-win64-cross
+      TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
    - IMAGE=debian-armel-cross
      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
    - IMAGE=debian-armhf-cross
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,13 +1,14 @@
-# The current Travis default is a VM based 16.04 Xenial on GCE
+# The current Travis default is a container based 14.04 Trust on EC2
 # Additional builds with specific requirements for a full VM need to
 # be added as additional matrix: entries later on
-dist: xenial
+sudo: false
+dist: trusty
 language: c
+python:
+  - "2.6"
 compiler:
  - gcc
 cache: ccache
-
-
 addons:
  apt:
    packages:
@@ -34,15 +35,10 @@ addons:
      - libssh2-1-dev
      - liburcu-dev
      - libusb-1.0-0-dev
-      - libvte-2.91-dev
+      - libvte-2.90-dev
      - sparse
      - uuid-dev
      - gcovr
-  homebrew:
-    packages:
-      - glib
-      - pixman
-

 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
 # to prevent IRC notifications from forks. This was created using:
@@ -53,156 +49,88 @@ notifications:
      - secure: "F7GDRgjuOo5IUyRLqSkmDL7kvdU4UcH3Lm/W2db2JnDHTGCqgEdaYEYKciyCLZ57vOTsTsOgesN8iUT7hNHBd1KWKjZe9KDTZWppWRYVwAwQMzVeSOsbbU4tRoJ6Pp+3qhH1Z0eGYR9ZgKYAoTumDFgSAYRp4IscKS8jkoedOqM="
    on_success: change
    on_failure: always
-
-
 env:
  global:
    - SRC_DIR="."
    - BUILD_DIR="."
-    - BASE_CONFIG="--disable-docs --disable-tools"
-    - TEST_CMD="make check -j3 V=1"
-
-
+    - TEST_CMD="make check"
+    - MAKEFLAGS="-j3"
+  matrix:
+    - CONFIG="--disable-system"
+    - CONFIG="--disable-user"
+    - CONFIG="--enable-debug --enable-debug-tcg"
+    - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-uuid --disable-libusb --disable-user"
+    - CONFIG="--enable-modules --disable-linux-user"
+    - CONFIG="--with-coroutine=ucontext --disable-linux-user"
+    - CONFIG="--with-coroutine=sigaltstack --disable-linux-user"
 git:
  # we want to do this ourselves
  submodules: false
-
-
+before_install:
+  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update ; fi
+  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew install libffi gettext glib pixman ; fi
+  - git submodule update --init --recursive capstone dtc ui/keycodemapdb
 before_script:
  - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
-  - ${SRC_DIR}/configure ${BASE_CONFIG} ${CONFIG} || { cat config.log && exit 1; }
+  - ${SRC_DIR}/configure ${CONFIG} || { cat config.log && exit 1; }
 script:
-  - make -j3 && ${TEST_CMD}
-
-
+  - make ${MAKEFLAGS} && ${TEST_CMD}
 matrix:
  include:
-    - env:
-        - CONFIG="--disable-system"
-
-
-    - env:
-        - CONFIG="--disable-user"
-
-
-    - env:
-        - CONFIG="--enable-debug --enable-debug-tcg --disable-user"
-
-
-    # TCG debug can be run just on it's own and is mostly agnostic to user/softmmu distinctions
-    - env:
-        - CONFIG="--enable-debug-tcg --disable-system"
-
-
-    - env:
-        - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-libusb --disable-user --disable-replication"
-
-
-    - env:
-        - CONFIG="--enable-modules --disable-linux-user"
-
-
-    # Alternate coroutines implementations are only really of interest to KVM users
-    # However we can't test against KVM on Travis so we can only run unit tests
-    - env:
-        - CONFIG="--with-coroutine=ucontext --disable-tcg"
-        - TEST_CMD="make check-unit -j3 V=1"
-
-
-    - env:
-        - CONFIG="--with-coroutine=sigaltstack --disable-tcg"
-        - TEST_CMD="make check-unit -j3 V=1"
-
-
-    # Check we can build docs and tools
-    - env:
-        - BASE_CONFIG="--enable-tools --enable-docs"
-        - CONFIG="--target-list=x86_64-softmmu,aarch64-linux-user"
-      addons:
-        apt:
-          packages:
-            - python-sphinx
-            - texinfo
-            - perl
-
    # Test out-of-tree builds
-    - env:
-        - CONFIG="--enable-debug --enable-debug-tcg"
-        - BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
-
-
+    - env: CONFIG="--enable-debug --enable-debug-tcg"
+           BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
    # Test with Clang for compile portability (Travis uses clang-5.0)
-    - env:
-        - CONFIG="--disable-system"
+    - env: CONFIG="--disable-system"
      compiler: clang
-
-
-    - env:
-        - CONFIG="--disable-user"
+    - env: CONFIG="--disable-user"
      compiler: clang
-
-
    # gprof/gcov are GCC features
-    - env:
-        - CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
+    - env: CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
      after_success:
        - ${SRC_DIR}/scripts/travis/coverage-summary.sh
-
-
+      compiler: gcc
    # We manually include builds which we disable "make check" for
-    - env:
-        - CONFIG="--enable-debug --enable-tcg-interpreter"
-        - TEST_CMD=""
-
-
+    - env: CONFIG="--enable-debug --enable-tcg-interpreter"
+           TEST_CMD=""
+      compiler: gcc
    # We don't need to exercise every backend with every front-end
-    - env:
-        - CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
-        - TEST_CMD=""
-
-
-    - env:
-        - CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
-        - TEST_CMD=""
-
-
-    - env:
-        - CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
-        - TEST_CMD=""
-
-
+    - env: CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--disable-tcg"
+           TEST_CMD=""
+      compiler: gcc
    # MacOSX builds
-    - env:
-        - CONFIG="--target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
+    - env: CONFIG="--target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
      os: osx
      osx_image: xcode9.4
      compiler: clang
-
-
+    - env: CONFIG="--target-list=i386-softmmu,ppc-softmmu,ppc64-softmmu,m68k-softmmu,x86_64-softmmu"
+      os: osx
+      osx_image: xcode10
+      compiler: clang
    # Python builds
-    - env:
-        - CONFIG="--target-list=x86_64-softmmu"
-      language: python
+    - env: CONFIG="--target-list=x86_64-softmmu"
      python:
-        - "3.4"
-
-
-    - env:
-        - CONFIG="--target-list=x86_64-softmmu"
-      language: python
+        - "3.0"
+    - env: CONFIG="--target-list=x86_64-softmmu"
      python:
        - "3.6"
-
-
    # Acceptance (Functional) tests
-    - env:
-        - CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
-        - TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
+    - env: CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
+           TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
      addons:
        apt:
          packages:
            - python3-pip
-            - python3.5-venv
+            - python3.4-venv
    # Using newer GCC with sanitizers
    - addons:
        apt:
@@ -236,7 +164,7 @@ matrix:
            - libssh2-1-dev
            - liburcu-dev
            - libusb-1.0-0-dev
-            - libvte-2.91-dev
+            - libvte-2.90-dev
            - sparse
            - uuid-dev
      language: generic
@@ -247,8 +175,11 @@ matrix:
        - TEST_CMD=""
      before_script:
        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || { cat config.log && exit 1; }
-
-
    - env:
-        - CONFIG="--disable-system"
-        - TEST_CMD="make -j3 check-tcg V=1"
+        - CONFIG="--disable-system --disable-docs"
+        - TEST_CMD="make check-tcg"
+      script:
+        - make ${MAKEFLAGS} && ${TEST_CMD} ${MAKEFLAGS}
+      sudo: required
+      dist: trusty
+      compiler: gcc
--- a/COPYING.LIB
+++ b/COPYING.LIB
@@ -1,8 +1,8 @@
-                  GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 2.1, February 1999
+		  GNU LESSER GENERAL PUBLIC LICENSE
+		       Version 2.1, February 1999

 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+	51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

@@ -10,7 +10,7 @@
 as the successor of the GNU Library Public License, version 2, hence
 the version number 2.1.]

-                            Preamble
+			    Preamble

  The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -112,7 +112,7 @@ modification follow.  Pay close attention to the difference between a
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.

-                  GNU LESSER GENERAL PUBLIC LICENSE
+		  GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License Agreement applies to any software library or other
@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-
+  
  1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -432,7 +432,7 @@ decision will be guided by the two goals of preserving the free status
 of all derivatives of our free software and of promoting the sharing
 and reuse of software generally.

-                            NO WARRANTY
+			    NO WARRANTY

  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
 WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
@@ -455,7 +455,7 @@ FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
 SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.

-                     END OF TERMS AND CONDITIONS
+		     END OF TERMS AND CONDITIONS

           How to Apply These Terms to Your New Libraries

@@ -476,7 +476,7 @@ convey the exclusion of warranty; and each file should have at least the
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
-    version 2.1 of the License, or (at your option) any later version.
+    version 2 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -485,7 +485,7 @@ convey the exclusion of warranty; and each file should have at least the

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

 Also add information on how to contact you by electronic and paper mail.

@@ -500,3 +500,5 @@ necessary.  Here is a sample; alter the names:
  Ty Coon, President of Vice

 That's all there is to it!
+
+
--- a/261
+++ b/261
@@ -110,6 +110,7 @@ Guest CPU cores (TCG):
 ----------------------
 Overall
 L: qemu-devel@nongnu.org
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Richard Henderson <rth@twiddle.net>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
@@ -126,11 +127,9 @@ F: include/sysemu/cpus.h
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
 M: Peter Maydell <peter.maydell@linaro.org>
-M: Alex Bennée <alex.bennee@linaro.org>
-S: Maintained
+S: Odd Fixes
 F: fpu/
 F: include/fpu/
-F: tests/fp/

 Alpha
 M: Richard Henderson <rth@twiddle.net>
@@ -184,7 +183,6 @@ F: disas/lm32.c
 F: hw/lm32/
 F: hw/*/lm32_*
 F: hw/*/milkymist-*
-F: include/hw/display/milkymist_tmu2.h
 F: include/hw/char/lm32_juart.h
 F: include/hw/lm32/
 F: tests/tcg/lm32/
@@ -205,23 +203,21 @@ F: disas/microblaze.c
 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: target/mips/
-F: default-configs/*mips*
-F: disas/mips.c
-F: disas/nanomips.cpp
-F: disas/nanomips.h
-F: hw/intc/mips_gic.c
 F: hw/mips/
 F: hw/misc/mips_*
+F: hw/intc/mips_gic.c
 F: hw/timer/mips_gictimer.c
-F: include/hw/intc/mips_gic.h
 F: include/hw/mips/
 F: include/hw/misc/mips_*
+F: include/hw/intc/mips_gic.h
 F: include/hw/timer/mips_gictimer.h
 F: tests/tcg/mips/
-K: ^Subject:.*(?i)mips
+F: disas/mips.c
+F: disas/nanomips.h
+F: disas/nanomips.cpp

 Moxie
 M: Anthony Green <green@moxielogic.com>
@@ -237,9 +233,7 @@ M: Marek Vasut <marex@denx.de>
 S: Maintained
 F: target/nios2/
 F: hw/nios2/
-F: hw/intc/nios2_iic.c
 F: disas/nios2.c
-F: default-configs/nios2-softmmu.mak

 OpenRISC
 M: Stafford Horne <shorne@gmail.com>
@@ -258,17 +252,17 @@ F: include/hw/ppc/
 F: disas/ppc.c

 RISC-V
+M: Michael Clark <mjc@sifive.com>
 M: Palmer Dabbelt <palmer@sifive.com>
 M: Alistair Francis <Alistair.Francis@wdc.com>
 M: Sagar Karandikar <sagark@eecs.berkeley.edu>
 M: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
 L: qemu-riscv@nongnu.org
-S: Supported
+S: Maintained
 F: target/riscv/
 F: hw/riscv/
 F: include/hw/riscv/
-F: linux-user/host/riscv32/
-F: linux-user/host/riscv64/
+F: disas/riscv.c

 S390
 M: Richard Henderson <rth@twiddle.net>
@@ -295,7 +289,6 @@ S: Maintained
 F: target/sparc/
 F: hw/sparc/
 F: hw/sparc64/
-F: include/hw/sparc/sparc64.h
 F: disas/sparc.c

 UniCore32
@@ -362,7 +355,7 @@ F: target/arm/kvm.c

 MIPS
 M: James Hogan <jhogan@kernel.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: target/mips/kvm.c

@@ -372,10 +365,9 @@ S: Maintained
 F: target/ppc/kvm.c

 S390
-M: Halil Pasic <pasic@linux.ibm.com>
-M: Cornelia Huck <cohuck@redhat.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
-S: Supported
+M: Cornelia Huck <cohuck@redhat.com>
+S: Maintained
 F: target/s390x/kvm.c
 F: target/s390x/kvm_s390x.h
 F: target/s390x/kvm-stub.c
@@ -404,7 +396,6 @@ Guest CPU Cores (Xen):
 X86
 M: Stefano Stabellini <sstabellini@kernel.org>
 M: Anthony Perard <anthony.perard@citrix.com>
-M: Paul Durrant <paul.durrant@citrix.com>
 L: xen-devel@lists.xenproject.org
 S: Supported
 F: */xen*
@@ -412,12 +403,10 @@ F: hw/9pfs/xen-9p-backend.c
 F: hw/char/xen_console.c
 F: hw/display/xenfb.c
 F: hw/net/xen_nic.c
-F: hw/block/xen*
-F: hw/block/dataplane/xen*
+F: hw/block/xen_*
 F: hw/xen/
 F: hw/xenpv/
 F: hw/i386/xen/
-F: include/hw/block/dataplane/xen*
 F: include/hw/xen/
 F: include/sysemu/xen-mapcache.h

@@ -491,7 +480,6 @@ F: hw/sd/pl181.c
 F: hw/ssi/pl022.c
 F: include/hw/ssi/pl022.h
 F: hw/timer/pl031.c
-F: include/hw/timer/pl031.h
 F: include/hw/arm/primecell.h
 F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
@@ -516,7 +504,6 @@ F: hw/intc/arm*
 F: hw/intc/gic_internal.h
 F: hw/misc/a9scu.c
 F: hw/misc/arm11scu.c
-F: hw/misc/arm_l2x0.c
 F: hw/timer/a9gtimer*
 F: hw/timer/arm*
 F: include/hw/arm/arm*.h
@@ -551,7 +538,6 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
-F: include/hw/*/digic*

 Gumstix
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -589,7 +575,6 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
-F: include/hw/misc/arm_integrator_debug.h

 MCIMX6UL EVK / i.MX6ul
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -609,9 +594,7 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/mcimx7d-sabre.c
 F: hw/arm/fsl-imx7.c
-F: hw/misc/imx7_*.c
 F: include/hw/arm/fsl-imx7.h
-F: include/hw/misc/imx7_*.h
 F: hw/pci-host/designware.c
 F: include/hw/pci-host/designware.h

@@ -623,22 +606,12 @@ F: hw/arm/mps2.c
 F: hw/arm/mps2-tz.c
 F: hw/misc/mps2-*.c
 F: include/hw/misc/mps2-*.h
-F: hw/arm/armsse.c
-F: include/hw/arm/armsse.h
-F: hw/misc/iotkit-secctl.c
-F: include/hw/misc/iotkit-secctl.h
+F: hw/arm/iotkit.c
+F: include/hw/arm/iotkit.h
 F: hw/misc/iotkit-sysctl.c
 F: include/hw/misc/iotkit-sysctl.h
 F: hw/misc/iotkit-sysinfo.c
 F: include/hw/misc/iotkit-sysinfo.h
-F: hw/misc/armsse-cpuid.c
-F: include/hw/misc/armsse-cpuid.h
-
-Musca
-M: Peter Maydell <peter.maydell@linaro.org>
-L: qemu-arm@nongnu.org
-S: Maintained
-F: hw/arm/musca.c

 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
@@ -653,10 +626,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/nseries.c
-F: hw/input/lm832x.c
-F: hw/input/tsc2005.c
-F: hw/misc/cbus.c
-F: hw/timer/twl92230.c

 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
@@ -664,7 +633,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/palm.c
-F: hw/input/tsc210x.c

 Raspberry Pi
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -701,7 +669,6 @@ F: hw/display/tc6393xb.c
 F: hw/gpio/max7310.c
 F: hw/gpio/zaurus.c
 F: hw/misc/mst_fpga.c
-F: hw/misc/max111x.c
 F: include/hw/arm/pxa.h
 F: include/hw/arm/sharpsl.h

@@ -712,10 +679,10 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/sabrelite.c
 F: hw/arm/fsl-imx6.c
-F: hw/misc/imx6_*.c
+F: hw/misc/imx6_src.c
 F: hw/ssi/imx_spi.c
 F: include/hw/arm/fsl-imx6.h
-F: include/hw/misc/imx6_*.h
+F: include/hw/misc/imx6_src.h
 F: include/hw/ssi/imx_spi.h

 Sharp SL-5500 (Collie) PDA
@@ -771,9 +738,6 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
 F: include/hw/*/xlnx*.h
-F: include/hw/ssi/xilinx_spips.h
-F: hw/display/dpcd.c
-F: include/hw/display/dpcd.h

 ARM ACPI Subsystem
 M: Shannon Zhao <shannon.zhaosl@gmail.com>
@@ -826,9 +790,7 @@ R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/*aspeed*
-F: hw/misc/pca9552.c
 F: include/hw/*/*aspeed*
-F: include/hw/misc/pca9552*.h
 F: hw/net/ftgmac100.c
 F: include/hw/net/ftgmac100.h

@@ -837,11 +799,9 @@ M: Joel Stanley <joel@jms.id.au>
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
-F: hw/*/nrf51*.c
-F: hw/*/microbit*.c
-F: include/hw/*/nrf51*.h
-F: include/hw/*/microbit*.h
-F: tests/microbit-test.c
+F: hw/arm/nrf51_soc.c
+F: hw/arm/microbit.c
+F: include/hw/arm/nrf51_soc.h

 CRIS Machines
 -------------
@@ -886,7 +846,6 @@ petalogix_s3adsp1800
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: hw/microblaze/petalogix_s3adsp1800_mmu.c
-F: include/hw/char/xilinx_uartlite.h

 petalogix_ml605
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -897,48 +856,45 @@ MIPS Machines
 -------------
 Jazz
 M: Hervé Poussineau <hpoussin@reactos.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_jazz.c
-F: hw/display/jazz_led.c
-F: hw/dma/rc4030.c

 Malta
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_malta.c

 Mipssim
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Odd Fixes
 F: hw/mips/mips_mipssim.c
 F: hw/net/mipsnet.c

 R4000
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_r4k.c

 Fulong 2E
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Odd Fixes
 F: hw/mips/mips_fulong2e.c
 F: hw/isa/vt82c686.c
-F: hw/pci-host/bonito.c
+
 F: include/hw/isa/vt82c686.h

 Boston
 M: Paul Burton <pburton@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/core/loader-fit.c
 F: hw/mips/boston.c
 F: hw/pci-host/xilinx-pcie.c
-F: include/hw/pci-host/xilinx-pcie.h

 OpenRISC Machines
 -----------------
@@ -965,10 +921,8 @@ e500
 M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
-F: hw/ppc/e500*
-F: hw/gpio/mpc8xxx.c
-F: hw/net/fsl_etsec/
-F: hw/pci-host/ppce500.c
+F: hw/ppc/e500.[hc]
+F: hw/ppc/e500plat.c
 F: include/hw/ppc/ppc_e500.h
 F: include/hw/pci-host/ppce500.h
 F: pc-bios/u-boot.e500
@@ -980,9 +934,8 @@ S: Odd Fixes
 F: hw/ppc/mpc8544ds.c
 F: hw/ppc/mpc8544_guts.c

-New World (mac99)
-M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-R: David Gibson <david@gibson.dropbear.id.au>
+New World
+M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/mac_newworld.c
@@ -991,27 +944,18 @@ F: hw/pci-bridge/dec.[hc]
 F: hw/misc/macio/
 F: hw/misc/mos6522.c
 F: hw/nvram/mac_nvram.c
-F: hw/input/adb*
 F: include/hw/misc/macio/
 F: include/hw/misc/mos6522.h
 F: include/hw/ppc/mac_dbdma.h
-F: include/hw/pci-host/uninorth.h
-F: include/hw/input/adb*
-F: pc-bios/qemu_vga.ndrv

-Old World (g3beige)
-M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-R: David Gibson <david@gibson.dropbear.id.au>
+Old World
+M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/mac_oldworld.c
 F: hw/pci-host/grackle.c
 F: hw/misc/macio/
 F: hw/intc/heathrow_pic.c
-F: hw/input/adb*
-F: include/hw/intc/heathrow_pic.h
-F: include/hw/input/adb*
-F: pc-bios/qemu_vga.ndrv

 PReP
 M: Hervé Poussineau <hpoussin@reactos.org>
@@ -1059,14 +1003,8 @@ sam460ex
 M: BALATON Zoltan <balaton@eik.bme.hu>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/sam460ex.c
-F: hw/ppc/ppc440_pcix.c
-F: hw/display/sm501*
 F: hw/ide/sii3112.c
 F: hw/timer/m41t80.c
-F: pc-bios/canyonlands.dt[sb]
-F: pc-bios/u-boot-sam460ex-20100605.bin
-F: roms/u-boot-sam460ex

 SH4 Machines
 ------------
@@ -1094,15 +1032,12 @@ F: hw/misc/eccmemctl.c
 F: hw/misc/slavio_misc.c
 F: include/hw/sparc/sparc32_dma.h
 F: pc-bios/openbios-sparc32
-F: include/hw/sparc/sun4m_iommu.h

 Sun4u
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 S: Maintained
 F: hw/sparc64/sun4u.c
 F: pc-bios/openbios-sparc64
-F: hw/pci-host/sabre.c
-F: include/hw/pci-host/sabre.h

 Sun4v
 M: Artyom Tarasenko <atar4qemu@gmail.com>
@@ -1122,7 +1057,6 @@ S390 Machines
 -------------
 S390 Virtio-ccw
 M: Cornelia Huck <cohuck@redhat.com>
-M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: hw/char/sclp*.[hc]
@@ -1202,13 +1136,11 @@ F: hw/timer/hpet*
 F: hw/timer/i8254*
 F: hw/timer/mc146818rtc*
 F: hw/watchdog/wdt_ib700.c
-F: hw/watchdog/wdt_i6300esb.c
 F: include/hw/display/vga.h
 F: include/hw/char/parallel.h
 F: include/hw/dma/i8257.h
 F: include/hw/i2c/pm_smbus.h
 F: include/hw/input/i8042.h
-F: include/hw/isa/i8259_internal.h
 F: include/hw/isa/superio.h
 F: include/hw/timer/hpet.h
 F: include/hw/timer/i8254*
@@ -1220,9 +1152,7 @@ M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
 S: Supported
 F: hw/core/machine.c
 F: hw/core/null-machine.c
-F: hw/cpu/cluster.c
 F: include/hw/boards.h
-F: include/hw/cpu/cluster.h
 T: git https://github.com/ehabkost/qemu.git machine-next

 Xtensa Machines
@@ -1308,7 +1238,7 @@ M: Michael S. Tsirkin <mst@redhat.com>
 M: Igor Mammedov <imammedo@redhat.com>
 S: Supported
 F: include/hw/acpi/*
-F: include/hw/firmware/smbios.h
+F: include/hw/smbios/*
 F: hw/mem/*
 F: hw/acpi/*
 F: hw/smbios/*
@@ -1316,7 +1246,8 @@ F: hw/i386/acpi-build.[hc]
 F: hw/arm/virt-acpi-build.c
 F: tests/bios-tables-test.c
 F: tests/acpi-utils.[hc]
-F: tests/data/acpi/
+F: tests/acpi-test-data/*
+F: tests/acpi-test-data/*/*

 ppc4xx
 M: David Gibson <david@gibson.dropbear.id.au>
@@ -1327,6 +1258,14 @@ F: hw/i2c/ppc4xx_i2c.c
 F: include/hw/ppc/ppc4xx.h
 F: include/hw/i2c/ppc4xx_i2c.h

+ppce500
+M: David Gibson <david@gibson.dropbear.id.au>
+L: qemu-ppc@nongnu.org
+S: Odd Fixes
+F: hw/ppc/e500*
+F: hw/pci-host/ppce500.c
+F: hw/net/fsl_etsec/
+
 Character devices
 M: Marc-André Lureau <marcandre.lureau@redhat.com>
 R: Paolo Bonzini <pbonzini@redhat.com>
@@ -1343,7 +1282,7 @@ T: git https://github.com/jasowang/qemu.git net

 SCSI
 M: Paolo Bonzini <pbonzini@redhat.com>
-R: Fam Zheng <fam@euphon.net>
+R: Fam Zheng <famz@redhat.com>
 S: Supported
 F: include/hw/scsi/*
 F: hw/scsi/*
@@ -1351,6 +1290,7 @@ F: tests/virtio-scsi-test.c
 T: git https://github.com/bonzini/qemu.git scsi-next

 SSI
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/ssi/*
@@ -1361,6 +1301,7 @@ F: tests/m25p80-test.c

 Xilinx SPI
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 S: Maintained
 F: hw/ssi/xilinx_*

@@ -1425,7 +1366,6 @@ M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: hw/*/*vhost*
 F: docs/interop/vhost-user.txt
-F: contrib/vhost-user-*/

 virtio
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -1538,7 +1478,6 @@ S: Maintained
 F: hw/acpi/nvdimm.c
 F: hw/mem/nvdimm.c
 F: include/hw/mem/nvdimm.h
-F: docs/nvdimm.txt

 e1000x
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
@@ -1626,7 +1565,7 @@ F: include/hw/display/edid.h
 F: qemu-edid.c

 Firmware configuration (fw_cfg)
-M: Philippe Mathieu-Daudé <philmd@redhat.com>
+M: Philippe Mathieu-DaudÃ© <philmd@redhat.com>
 R: Laszlo Ersek <lersek@redhat.com>
 R: Gerd Hoffmann <kraxel@redhat.com>
 S: Supported
@@ -1638,14 +1577,6 @@ F: tests/libqos/fw_cfg.c
 F: tests/fw_cfg-test.c
 T: git https://github.com/philmd/qemu.git fw_cfg-next

-XIVE
-M: David Gibson <david@gibson.dropbear.id.au>
-M: Cédric Le Goater <clg@kaod.org>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/*/*xive*
-F: include/hw/*/*xive*
-
 Subsystems
 ----------
 Audio
@@ -1677,7 +1608,7 @@ T: git https://repo.or.cz/qemu/kevin.git block

 Block I/O path
 M: Stefan Hajnoczi <stefanha@redhat.com>
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: util/async.c
@@ -1691,14 +1622,14 @@ T: git https://github.com/stefanha/qemu.git block

 Block SCSI subsystem
 M: Paolo Bonzini <pbonzini@redhat.com>
-R: Fam Zheng <fam@euphon.net>
+R: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: include/scsi/*
 F: scsi/*

 Block Jobs
-M: John Snow <jsnow@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: blockjob.c
@@ -1711,7 +1642,7 @@ F: block/commit.c
 F: block/stream.c
 F: block/mirror.c
 F: qapi/job.json
-T: git https://github.com/jnsnow/qemu.git jobs
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Block QAPI, monitor, command line
 M: Markus Armbruster <armbru@redhat.com>
@@ -1723,7 +1654,7 @@ F: qapi/transaction.json
 T: git https://repo.or.cz/qemu/armbru.git block-next

 Dirty Bitmaps
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 M: John Snow <jsnow@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
@@ -1770,6 +1701,7 @@ F: qom/cpu.c
 F: include/qom/cpu.h

 Device Tree
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: device_tree.c
@@ -1820,7 +1752,6 @@ F: ui/spice-*.c
 F: audio/spiceaudio.c
 F: hw/display/qxl*
 F: qapi/ui.json
-F: docs/spice-port-fqdn.txt

 Graphics
 M: Gerd Hoffmann <kraxel@redhat.com>
@@ -1965,7 +1896,6 @@ S: Supported
 F: qmp.c
 F: monitor.c
 F: docs/devel/*qmp-*
-F: docs/interop/*qmp-*
 F: scripts/qmp/
 F: tests/qmp-test.c
 F: tests/qmp-cmd-test.c
@@ -2011,7 +1941,6 @@ F: trace-events
 F: qemu-option-trace.texi
 F: scripts/tracetool.py
 F: scripts/tracetool/
-F: scripts/qemu-trace-stap*
 F: docs/devel/tracing.txt
 T: git https://github.com/stefanha/qemu.git tracing

@@ -2079,14 +2008,6 @@ F: io/
 F: include/io/
 F: tests/test-io-*

-User authorization
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Maintained
-F: authz/
-F: qapi/authz.json
-F: include/authz/
-F: tests/test-authz-*
-
 Sockets
 M: Daniel P. Berrange <berrange@redhat.com>
 M: Gerd Hoffmann <kraxel@redhat.com>
@@ -2095,13 +2016,6 @@ F: include/qemu/sockets.h
 F: util/qemu-sockets.c
 F: qapi/sockets.json

-File monitor
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Odd fixes
-F: util/filemonitor*.c
-F: include/qemu/filemonitor.h
-F: tests/test-util-filemonitor.c
-
 Throttling infrastructure
 M: Alberto Garcia <berto@igalia.com>
 S: Supported
@@ -2114,7 +2028,7 @@ F: tests/test-throttle.c
 L: qemu-block@nongnu.org

 UUID
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 S: Supported
 F: util/uuid.c
 F: include/qemu/uuid.h
@@ -2212,7 +2126,7 @@ F: disas/i386.c

 MIPS target
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: tcg/mips/
 F: disas/mips.c
@@ -2223,15 +2137,6 @@ S: Odd Fixes
 F: tcg/ppc/
 F: disas/ppc.c

-RISC-V
-M: Michael Clark <mjc@sifive.com>
-M: Palmer Dabbelt <palmer@sifive.com>
-M: Alistair Francis <Alistair.Francis@wdc.com>
-L: qemu-riscv@nongnu.org
-S: Maintained
-F: tcg/riscv/
-F: disas/riscv.c
-
 S390 target
 M: Richard Henderson <rth@twiddle.net>
 S: Maintained
@@ -2254,29 +2159,33 @@ F: disas/tci.c
 Block drivers
 -------------
 VMDK
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/vmdk.c

 RBD
 M: Josh Durgin <jdurgin@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/rbd.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Sheepdog
 M: Liu Yuan <namei.unix@gmail.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
-L: sheepdog@lists.wpkg.org
-S: Odd Fixes
+S: Supported
 F: block/sheepdog.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 VHDX
-M: Jeff Cody <codyprime@gmail.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/vhdx*
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 VDI
 M: Stefan Weil <sw@weilnetz.de>
@@ -2306,35 +2215,43 @@ F: docs/interop/nbd.txt
 T: git https://repo.or.cz/qemu/ericb.git nbd

 NFS
+M: Jeff Cody <jcody@redhat.com>
 M: Peter Lieven <pl@kamp.de>
 L: qemu-block@nongnu.org
 S: Maintained
 F: block/nfs.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 SSH
 M: Richard W.M. Jones <rjones@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/ssh.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 CURL
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/curl.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 GLUSTER
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/gluster.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Null Block Driver
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/null.c

 NVMe Block Driver
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/nvme*
@@ -2460,15 +2377,13 @@ S: Maintained
 F: hw/rdma/*
 F: hw/rdma/vmw/*
 F: docs/pvrdma.txt
-F: contrib/rdmacm-mux/*
-F: qapi/rdma.json

 Build and test automation
 -------------------------
 Build and test automation
 M: Alex Bennée <alex.bennee@linaro.org>
-M: Fam Zheng <fam@euphon.net>
-R: Philippe Mathieu-Daudé <philmd@redhat.com>
+M: Fam Zheng <famz@redhat.com>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 S: Maintained
 F: .travis.yml
@@ -2476,24 +2391,10 @@ F: scripts/travis/
 F: .shippable.yml
 F: tests/docker/
 F: tests/vm/
-F: scripts/archive-source.sh
 W: https://travis-ci.org/qemu/qemu
 W: https://app.shippable.com/github/qemu/qemu
 W: http://patchew.org/QEMU/

-FreeBSD Hosted Continuous Integration
-M: Ed Maste <emaste@freebsd.org>
-M: Li-Wen Hsu <lwhsu@freebsd.org>
-L: qemu-devel@nongnu.org
-S: Maintained
-F: .cirrus.yml
-W: https://cirrus-ci.com/github/qemu/qemu
-
-GitLab Continuous Integration
-M: Thomas Huth <thuth@redhat.com>
-S: Maintained
-F: .gitlab-ci.yml
-
 Guest Test Compilation Support
 M: Alex Bennée <alex.bennee@linaro.org>
 R: Philippe Mathieu-Daudé <f4bug@amsat.org>
@@ -2508,12 +2409,6 @@ M: Daniel P. Berrange <berrange@redhat.com>
 S: Odd Fixes
 F: docs/devel/build-system.txt

-GIT Data Mining Config
-M: Alex Bennée <alex.bennee@linaro.org>
-S: Odd Fixes
-F: gitdm.config
-F: contrib/gitdm/*
-
 Incompatible changes
 R: libvir-list@redhat.com
 F: qemu-deprecated.texi
--- a/268
+++ b/268
@@ -67,7 +67,7 @@ CONFIG_ALL=y
 -include config-all-devices.mak
 -include config-all-disas.mak

-config-host.mak: $(SRC_PATH)/configure $(SRC_PATH)/pc-bios $(SRC_PATH)/VERSION
+config-host.mak: $(SRC_PATH)/configure $(SRC_PATH)/pc-bios
 	@echo $@ is out-of-date, running configure
 	@# TODO: The next lines include code which supports a smooth
 	@# transition from old configurations without config.status.
@@ -88,26 +88,82 @@ endif
 include $(SRC_PATH)/rules.mak

 GENERATED_FILES = qemu-version.h config-host.h qemu-options.def
-
-GENERATED_QAPI_FILES = qapi/qapi-builtin-types.h qapi/qapi-builtin-types.c
-GENERATED_QAPI_FILES += qapi/qapi-types.h qapi/qapi-types.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-types-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-types-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-builtin-visit.h qapi/qapi-builtin-visit.c
-GENERATED_QAPI_FILES += qapi/qapi-visit.h qapi/qapi-visit.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-visit-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-visit-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-commands.h qapi/qapi-commands.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-commands-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-commands-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-emit-events.h qapi/qapi-emit-events.c
-GENERATED_QAPI_FILES += qapi/qapi-events.h qapi/qapi-events.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-events-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-events-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-introspect.c qapi/qapi-introspect.h
-GENERATED_QAPI_FILES += qapi/qapi-doc.texi
-
-GENERATED_FILES += $(GENERATED_QAPI_FILES)
+GENERATED_FILES += qapi/qapi-builtin-types.h qapi/qapi-builtin-types.c
+GENERATED_FILES += qapi/qapi-types.h qapi/qapi-types.c
+GENERATED_FILES += qapi/qapi-types-block-core.h qapi/qapi-types-block-core.c
+GENERATED_FILES += qapi/qapi-types-block.h qapi/qapi-types-block.c
+GENERATED_FILES += qapi/qapi-types-char.h qapi/qapi-types-char.c
+GENERATED_FILES += qapi/qapi-types-common.h qapi/qapi-types-common.c
+GENERATED_FILES += qapi/qapi-types-crypto.h qapi/qapi-types-crypto.c
+GENERATED_FILES += qapi/qapi-types-introspect.h qapi/qapi-types-introspect.c
+GENERATED_FILES += qapi/qapi-types-job.h qapi/qapi-types-job.c
+GENERATED_FILES += qapi/qapi-types-migration.h qapi/qapi-types-migration.c
+GENERATED_FILES += qapi/qapi-types-misc.h qapi/qapi-types-misc.c
+GENERATED_FILES += qapi/qapi-types-net.h qapi/qapi-types-net.c
+GENERATED_FILES += qapi/qapi-types-rocker.h qapi/qapi-types-rocker.c
+GENERATED_FILES += qapi/qapi-types-run-state.h qapi/qapi-types-run-state.c
+GENERATED_FILES += qapi/qapi-types-sockets.h qapi/qapi-types-sockets.c
+GENERATED_FILES += qapi/qapi-types-tpm.h qapi/qapi-types-tpm.c
+GENERATED_FILES += qapi/qapi-types-trace.h qapi/qapi-types-trace.c
+GENERATED_FILES += qapi/qapi-types-transaction.h qapi/qapi-types-transaction.c
+GENERATED_FILES += qapi/qapi-types-ui.h qapi/qapi-types-ui.c
+GENERATED_FILES += qapi/qapi-builtin-visit.h qapi/qapi-builtin-visit.c
+GENERATED_FILES += qapi/qapi-visit.h qapi/qapi-visit.c
+GENERATED_FILES += qapi/qapi-visit-block-core.h qapi/qapi-visit-block-core.c
+GENERATED_FILES += qapi/qapi-visit-block.h qapi/qapi-visit-block.c
+GENERATED_FILES += qapi/qapi-visit-char.h qapi/qapi-visit-char.c
+GENERATED_FILES += qapi/qapi-visit-common.h qapi/qapi-visit-common.c
+GENERATED_FILES += qapi/qapi-visit-crypto.h qapi/qapi-visit-crypto.c
+GENERATED_FILES += qapi/qapi-visit-introspect.h qapi/qapi-visit-introspect.c
+GENERATED_FILES += qapi/qapi-visit-job.h qapi/qapi-visit-job.c
+GENERATED_FILES += qapi/qapi-visit-migration.h qapi/qapi-visit-migration.c
+GENERATED_FILES += qapi/qapi-visit-misc.h qapi/qapi-visit-misc.c
+GENERATED_FILES += qapi/qapi-visit-net.h qapi/qapi-visit-net.c
+GENERATED_FILES += qapi/qapi-visit-rocker.h qapi/qapi-visit-rocker.c
+GENERATED_FILES += qapi/qapi-visit-run-state.h qapi/qapi-visit-run-state.c
+GENERATED_FILES += qapi/qapi-visit-sockets.h qapi/qapi-visit-sockets.c
+GENERATED_FILES += qapi/qapi-visit-tpm.h qapi/qapi-visit-tpm.c
+GENERATED_FILES += qapi/qapi-visit-trace.h qapi/qapi-visit-trace.c
+GENERATED_FILES += qapi/qapi-visit-transaction.h qapi/qapi-visit-transaction.c
+GENERATED_FILES += qapi/qapi-visit-ui.h qapi/qapi-visit-ui.c
+GENERATED_FILES += qapi/qapi-commands.h qapi/qapi-commands.c
+GENERATED_FILES += qapi/qapi-commands-block-core.h qapi/qapi-commands-block-core.c
+GENERATED_FILES += qapi/qapi-commands-block.h qapi/qapi-commands-block.c
+GENERATED_FILES += qapi/qapi-commands-char.h qapi/qapi-commands-char.c
+GENERATED_FILES += qapi/qapi-commands-common.h qapi/qapi-commands-common.c
+GENERATED_FILES += qapi/qapi-commands-crypto.h qapi/qapi-commands-crypto.c
+GENERATED_FILES += qapi/qapi-commands-introspect.h qapi/qapi-commands-introspect.c
+GENERATED_FILES += qapi/qapi-commands-job.h qapi/qapi-commands-job.c
+GENERATED_FILES += qapi/qapi-commands-migration.h qapi/qapi-commands-migration.c
+GENERATED_FILES += qapi/qapi-commands-misc.h qapi/qapi-commands-misc.c
+GENERATED_FILES += qapi/qapi-commands-net.h qapi/qapi-commands-net.c
+GENERATED_FILES += qapi/qapi-commands-rocker.h qapi/qapi-commands-rocker.c
+GENERATED_FILES += qapi/qapi-commands-run-state.h qapi/qapi-commands-run-state.c
+GENERATED_FILES += qapi/qapi-commands-sockets.h qapi/qapi-commands-sockets.c
+GENERATED_FILES += qapi/qapi-commands-tpm.h qapi/qapi-commands-tpm.c
+GENERATED_FILES += qapi/qapi-commands-trace.h qapi/qapi-commands-trace.c
+GENERATED_FILES += qapi/qapi-commands-transaction.h qapi/qapi-commands-transaction.c
+GENERATED_FILES += qapi/qapi-commands-ui.h qapi/qapi-commands-ui.c
+GENERATED_FILES += qapi/qapi-events.h qapi/qapi-events.c
+GENERATED_FILES += qapi/qapi-events-block-core.h qapi/qapi-events-block-core.c
+GENERATED_FILES += qapi/qapi-events-block.h qapi/qapi-events-block.c
+GENERATED_FILES += qapi/qapi-events-char.h qapi/qapi-events-char.c
+GENERATED_FILES += qapi/qapi-events-common.h qapi/qapi-events-common.c
+GENERATED_FILES += qapi/qapi-events-crypto.h qapi/qapi-events-crypto.c
+GENERATED_FILES += qapi/qapi-events-introspect.h qapi/qapi-events-introspect.c
+GENERATED_FILES += qapi/qapi-events-job.h qapi/qapi-events-job.c
+GENERATED_FILES += qapi/qapi-events-migration.h qapi/qapi-events-migration.c
+GENERATED_FILES += qapi/qapi-events-misc.h qapi/qapi-events-misc.c
+GENERATED_FILES += qapi/qapi-events-net.h qapi/qapi-events-net.c
+GENERATED_FILES += qapi/qapi-events-rocker.h qapi/qapi-events-rocker.c
+GENERATED_FILES += qapi/qapi-events-run-state.h qapi/qapi-events-run-state.c
+GENERATED_FILES += qapi/qapi-events-sockets.h qapi/qapi-events-sockets.c
+GENERATED_FILES += qapi/qapi-events-tpm.h qapi/qapi-events-tpm.c
+GENERATED_FILES += qapi/qapi-events-trace.h qapi/qapi-events-trace.c
+GENERATED_FILES += qapi/qapi-events-transaction.h qapi/qapi-events-transaction.c
+GENERATED_FILES += qapi/qapi-events-ui.h qapi/qapi-events-ui.c
+GENERATED_FILES += qapi/qapi-introspect.c qapi/qapi-introspect.h
+GENERATED_FILES += qapi/qapi-doc.texi

 GENERATED_FILES += trace/generated-tcg-tracers.h

@@ -145,7 +201,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace.h: %/trace.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=h \
@@ -154,7 +210,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace.c: %/trace.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace.c-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace.c-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=c \
@@ -163,7 +219,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace-ust.h: %/trace-ust.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace-ust.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace-ust.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=ust-events-h \
@@ -187,7 +243,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 trace-root.h: trace-root.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=h \
@@ -196,7 +252,7 @@ trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/con

 trace-root.c: trace-root.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=c \
@@ -205,7 +261,7 @@ trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/con

 trace-ust-root.h: trace-ust-root.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=ust-events-h \
@@ -214,7 +270,7 @@ trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)

 trace-ust-all.h: trace-ust-all.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=ust-events-h \
@@ -223,7 +279,7 @@ trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/con

 trace-ust-all.c: trace-ust-all.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-all.c-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-all.c-timestamp: $(trace-events-files) $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=ust-events-c \
@@ -305,9 +361,6 @@ DOCS+=docs/qemu-cpu-models.7
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-DOCS+=scripts/qemu-trace-stap.1
-endif
 else
 DOCS=
 endif
@@ -359,14 +412,12 @@ endif

 dummy := $(call unnest-vars,, \
                stub-obj-y \
-                authz-obj-y \
                chardev-obj-y \
                util-obj-y \
                qga-obj-y \
                elf2dmp-obj-y \
                ivshmem-client-obj-y \
                ivshmem-server-obj-y \
-                rdmacm-mux-obj-y \
                libvhost-user-obj-y \
                vhost-user-scsi-obj-y \
                vhost-user-blk-obj-y \
@@ -383,8 +434,7 @@ dummy := $(call unnest-vars,, \
                ui-obj-m \
                audio-obj-y \
                audio-obj-m \
-                trace-obj-y \
-                slirp-obj-y)
+                trace-obj-y)

 include $(SRC_PATH)/tests/Makefile.include

@@ -424,7 +474,6 @@ qemu-options.def: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))

-$(SOFTMMU_SUBDIR_RULES): $(authz-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(block-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(crypto-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(io-obj-y)
@@ -458,7 +507,7 @@ CAP_CFLAGS += -DCAPSTONE_HAS_X86
 subdir-capstone: .git-submodule-status
 	$(call quiet-command,$(MAKE) -C $(SRC_PATH)/capstone CAPSTONE_SHARED=no BUILDDIR="$(BUILD_DIR)/capstone" CC="$(CC)" AR="$(AR)" LD="$(LD)" RANLIB="$(RANLIB)" CFLAGS="$(CAP_CFLAGS)" $(SUBDIR_MAKEFLAGS) $(BUILD_DIR)/capstone/$(LIBCAPSTONE))

-$(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) $(slirp-obj-y) \
+$(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) \
 	$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
@@ -487,9 +536,9 @@ COMMON_LDADDS = libqemuutil.a

 qemu-img.o: qemu-img-cmds.h

-qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
-qemu-nbd$(EXESUF): qemu-nbd.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
-qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-img$(EXESUF): qemu-img.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-io$(EXESUF): qemu-io.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o $(COMMON_LDADDS)

@@ -500,7 +549,7 @@ qemu-edid$(EXESUF): qemu-edid.o hw/display/edid-generate.o $(COMMON_LDADDS)
 fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal.o fsdev/9p-iov-marshal.o $(COMMON_LDADDS)
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

-scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(authz-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
 ifdef CONFIG_MPATH
 scsi/qemu-pr-helper$(EXESUF): LIBS += -ludev -lmultipath -lmpathpersist
 endif
@@ -534,10 +583,100 @@ qga/qapi-generated/qapi-gen-timestamp: $(SRC_PATH)/qga/qapi-schema.json $(qapi-p
 		"GEN","$(@:%-timestamp=%)")
 	@>$@

-qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json \
-               $(QAPI_MODULES:%=$(SRC_PATH)/qapi/%.json)
+qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json $(SRC_PATH)/qapi/common.json \
+               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
+               $(SRC_PATH)/qapi/char.json \
+               $(SRC_PATH)/qapi/crypto.json \
+               $(SRC_PATH)/qapi/introspect.json \
+               $(SRC_PATH)/qapi/job.json \
+               $(SRC_PATH)/qapi/migration.json \
+               $(SRC_PATH)/qapi/misc.json \
+               $(SRC_PATH)/qapi/net.json \
+               $(SRC_PATH)/qapi/rocker.json \
+               $(SRC_PATH)/qapi/run-state.json \
+               $(SRC_PATH)/qapi/sockets.json \
+               $(SRC_PATH)/qapi/tpm.json \
+               $(SRC_PATH)/qapi/trace.json \
+               $(SRC_PATH)/qapi/transaction.json \
+               $(SRC_PATH)/qapi/ui.json

-$(GENERATED_QAPI_FILES): qapi-gen-timestamp ;
+qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
+qapi/qapi-types.c qapi/qapi-types.h \
+qapi/qapi-types-block-core.c qapi/qapi-types-block-core.h \
+qapi/qapi-types-block.c qapi/qapi-types-block.h \
+qapi/qapi-types-char.c qapi/qapi-types-char.h \
+qapi/qapi-types-common.c qapi/qapi-types-common.h \
+qapi/qapi-types-crypto.c qapi/qapi-types-crypto.h \
+qapi/qapi-types-introspect.c qapi/qapi-types-introspect.h \
+qapi/qapi-types-job.c qapi/qapi-types-job.h \
+qapi/qapi-types-migration.c qapi/qapi-types-migration.h \
+qapi/qapi-types-misc.c qapi/qapi-types-misc.h \
+qapi/qapi-types-net.c qapi/qapi-types-net.h \
+qapi/qapi-types-rocker.c qapi/qapi-types-rocker.h \
+qapi/qapi-types-run-state.c qapi/qapi-types-run-state.h \
+qapi/qapi-types-sockets.c qapi/qapi-types-sockets.h \
+qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
+qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
+qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
+qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
+qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
+qapi/qapi-visit.c qapi/qapi-visit.h \
+qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
+qapi/qapi-visit-block.c qapi/qapi-visit-block.h \
+qapi/qapi-visit-char.c qapi/qapi-visit-char.h \
+qapi/qapi-visit-common.c qapi/qapi-visit-common.h \
+qapi/qapi-visit-crypto.c qapi/qapi-visit-crypto.h \
+qapi/qapi-visit-introspect.c qapi/qapi-visit-introspect.h \
+qapi/qapi-visit-job.c qapi/qapi-visit-job.h \
+qapi/qapi-visit-migration.c qapi/qapi-visit-migration.h \
+qapi/qapi-visit-misc.c qapi/qapi-visit-misc.h \
+qapi/qapi-visit-net.c qapi/qapi-visit-net.h \
+qapi/qapi-visit-rocker.c qapi/qapi-visit-rocker.h \
+qapi/qapi-visit-run-state.c qapi/qapi-visit-run-state.h \
+qapi/qapi-visit-sockets.c qapi/qapi-visit-sockets.h \
+qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
+qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
+qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
+qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
+qapi/qapi-commands.h qapi/qapi-commands.c \
+qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
+qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
+qapi/qapi-commands-char.c qapi/qapi-commands-char.h \
+qapi/qapi-commands-common.c qapi/qapi-commands-common.h \
+qapi/qapi-commands-crypto.c qapi/qapi-commands-crypto.h \
+qapi/qapi-commands-introspect.c qapi/qapi-commands-introspect.h \
+qapi/qapi-commands-job.c qapi/qapi-commands-job.h \
+qapi/qapi-commands-migration.c qapi/qapi-commands-migration.h \
+qapi/qapi-commands-misc.c qapi/qapi-commands-misc.h \
+qapi/qapi-commands-net.c qapi/qapi-commands-net.h \
+qapi/qapi-commands-rocker.c qapi/qapi-commands-rocker.h \
+qapi/qapi-commands-run-state.c qapi/qapi-commands-run-state.h \
+qapi/qapi-commands-sockets.c qapi/qapi-commands-sockets.h \
+qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
+qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
+qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
+qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
+qapi/qapi-events.c qapi/qapi-events.h \
+qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
+qapi/qapi-events-block.c qapi/qapi-events-block.h \
+qapi/qapi-events-char.c qapi/qapi-events-char.h \
+qapi/qapi-events-common.c qapi/qapi-events-common.h \
+qapi/qapi-events-crypto.c qapi/qapi-events-crypto.h \
+qapi/qapi-events-introspect.c qapi/qapi-events-introspect.h \
+qapi/qapi-events-job.c qapi/qapi-events-job.h \
+qapi/qapi-events-migration.c qapi/qapi-events-migration.h \
+qapi/qapi-events-misc.c qapi/qapi-events-misc.h \
+qapi/qapi-events-net.c qapi/qapi-events-net.h \
+qapi/qapi-events-rocker.c qapi/qapi-events-rocker.h \
+qapi/qapi-events-run-state.c qapi/qapi-events-run-state.h \
+qapi/qapi-events-sockets.c qapi/qapi-events-sockets.h \
+qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
+qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
+qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
+qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
+qapi/qapi-introspect.h qapi/qapi-introspect.c \
+qapi/qapi-doc.texi: \
+qapi-gen-timestamp ;
 qapi-gen-timestamp: $(qapi-modules) $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-gen.py \
 		-o "qapi" -b $<, \
@@ -572,8 +711,8 @@ ifneq ($(EXESUF),)
 qemu-ga: qemu-ga$(EXESUF) $(QGA_VSS_PROVIDER) $(QEMU_GA_MSI)
 endif

-elf2dmp$(EXESUF): LIBS += $(CURL_LIBS)
-elf2dmp$(EXESUF): $(elf2dmp-obj-y)
+elf2dmp: LIBS = $(CURL_LIBS)
+elf2dmp: $(elf2dmp-obj-y)
 	$(call LINK, $^)

 ifdef CONFIG_IVSHMEM
@@ -587,10 +726,6 @@ vhost-user-scsi$(EXESUF): $(vhost-user-scsi-obj-y) libvhost-user.a
 vhost-user-blk$(EXESUF): $(vhost-user-blk-obj-y) libvhost-user.a
 	$(call LINK, $^)

-rdmacm-mux$(EXESUF): LIBS += "-libumad"
-rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
-	$(call LINK, $^)
-
 module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
 	$(call quiet-command,$(PYTHON) $< $@ \
 	$(addprefix $(SRC_PATH)/,$(patsubst %.mo,%.c,$(block-obj-m))), \
@@ -659,9 +794,9 @@ distclean: clean
 	rm -Rf .sdk
 	if test -f dtc/version_gen.h; then $(MAKE) $(DTC_MAKE_ARGS) clean; fi

-KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  no  pt-br  sv \
+KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
-de-ch  es     fo  fr-ca  hu     ja  mk  pt  sl     tr \
+common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr \
 bepo    cz

 ifdef INSTALL_BLOBS
@@ -674,8 +809,9 @@ pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
 efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
 efi-pcnet.rom efi-rtl8139.rom efi-virtio.rom \
 efi-e1000e.rom efi-vmxnet3.rom \
+qemu-icon.bmp qemu_logo_no_text.svg \
 bamboo.dtb canyonlands.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
-multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin pvh.bin \
+multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin \
 s390-ccw.img s390-netboot.img \
 spapr-rtas.bin slof.bin skiboot.lid \
 palcode-clipper \
@@ -704,9 +840,6 @@ ifneq ($(TOOLS),)
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-	$(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
-endif
 ifneq (,$(findstring qemu-ga,$(TOOLS)))
 	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
@@ -729,7 +862,6 @@ ifneq (,$(findstring qemu-ga,$(TOOLS)))
 endif
 endif

-ICON_SIZES=16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512

 install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
 ifneq ($(TOOLS),)
@@ -746,28 +878,11 @@ endif
 ifneq ($(HELPERS-y),)
 	$(call install-prog,$(HELPERS-y),$(DESTDIR)$(libexecdir))
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-	$(INSTALL_PROG) "scripts/qemu-trace-stap" $(DESTDIR)$(bindir)
-endif
 ifneq ($(BLOBS),)
 	set -e; for x in $(BLOBS); do \
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(qemu_datadir)"; \
 	done
 endif
-	for s in $(ICON_SIZES); do \
-		mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/$${s}/apps"; \
-		$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu_$${s}.png \
-			"$(DESTDIR)/$(qemu_icondir)/hicolor/$${s}/apps/qemu.png"; \
-	done; \
-	mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/32x32/apps"; \
-	$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu_32x32.bmp \
-		"$(DESTDIR)/$(qemu_icondir)/hicolor/32x32/apps/qemu.bmp"; \
-	mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/scalable/apps"; \
-	$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu.svg \
-		"$(DESTDIR)/$(qemu_icondir)/hicolor/scalable/apps/qemu.svg"
-	mkdir -p "$(DESTDIR)/$(qemu_desktopdir)"
-	$(INSTALL_DATA) $(SRC_PATH)/ui/qemu.desktop \
-		"$(DESTDIR)/$(qemu_desktopdir)/qemu.desktop"
 ifdef CONFIG_GTK
 	$(MAKE) -C po $@
 endif
@@ -863,7 +978,6 @@ qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 qemu-ga.8: qemu-ga.texi
 docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
-scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi

 html: qemu-doc.html docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
 info: qemu-doc.info docs/interop/qemu-qmp-ref.info docs/interop/qemu-ga-ref.info
@@ -886,8 +1000,6 @@ docs/interop/qemu-qmp-ref.dvi docs/interop/qemu-qmp-ref.html \
    docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7: \
 	docs/interop/qemu-qmp-ref.texi docs/interop/qemu-qmp-qapi.texi

-$(filter %.1 %.7 %.8,$(DOCS)): scripts/texi2pod.pl
-
 # Reports/Analysis

 %/coverage-report.html:
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,15 +1,66 @@
 #######################################################################
 # Common libraries for tools and emulators
-stub-obj-y = stubs/ util/ crypto/
+stub-obj-y = stubs/ crypto/
 util-obj-y = util/ qobject/ qapi/
+util-obj-y += qapi/qapi-builtin-types.o
+util-obj-y += qapi/qapi-types.o
+util-obj-y += qapi/qapi-types-block-core.o
+util-obj-y += qapi/qapi-types-block.o
+util-obj-y += qapi/qapi-types-char.o
+util-obj-y += qapi/qapi-types-common.o
+util-obj-y += qapi/qapi-types-crypto.o
+util-obj-y += qapi/qapi-types-introspect.o
+util-obj-y += qapi/qapi-types-job.o
+util-obj-y += qapi/qapi-types-migration.o
+util-obj-y += qapi/qapi-types-misc.o
+util-obj-y += qapi/qapi-types-net.o
+util-obj-y += qapi/qapi-types-rocker.o
+util-obj-y += qapi/qapi-types-run-state.o
+util-obj-y += qapi/qapi-types-sockets.o
+util-obj-y += qapi/qapi-types-tpm.o
+util-obj-y += qapi/qapi-types-trace.o
+util-obj-y += qapi/qapi-types-transaction.o
+util-obj-y += qapi/qapi-types-ui.o
+util-obj-y += qapi/qapi-builtin-visit.o
+util-obj-y += qapi/qapi-visit.o
+util-obj-y += qapi/qapi-visit-block-core.o
+util-obj-y += qapi/qapi-visit-block.o
+util-obj-y += qapi/qapi-visit-char.o
+util-obj-y += qapi/qapi-visit-common.o
+util-obj-y += qapi/qapi-visit-crypto.o
+util-obj-y += qapi/qapi-visit-introspect.o
+util-obj-y += qapi/qapi-visit-job.o
+util-obj-y += qapi/qapi-visit-migration.o
+util-obj-y += qapi/qapi-visit-misc.o
+util-obj-y += qapi/qapi-visit-net.o
+util-obj-y += qapi/qapi-visit-rocker.o
+util-obj-y += qapi/qapi-visit-run-state.o
+util-obj-y += qapi/qapi-visit-sockets.o
+util-obj-y += qapi/qapi-visit-tpm.o
+util-obj-y += qapi/qapi-visit-trace.o
+util-obj-y += qapi/qapi-visit-transaction.o
+util-obj-y += qapi/qapi-visit-ui.o
+util-obj-y += qapi/qapi-events.o
+util-obj-y += qapi/qapi-events-block-core.o
+util-obj-y += qapi/qapi-events-block.o
+util-obj-y += qapi/qapi-events-char.o
+util-obj-y += qapi/qapi-events-common.o
+util-obj-y += qapi/qapi-events-crypto.o
+util-obj-y += qapi/qapi-events-introspect.o
+util-obj-y += qapi/qapi-events-job.o
+util-obj-y += qapi/qapi-events-migration.o
+util-obj-y += qapi/qapi-events-misc.o
+util-obj-y += qapi/qapi-events-net.o
+util-obj-y += qapi/qapi-events-rocker.o
+util-obj-y += qapi/qapi-events-run-state.o
+util-obj-y += qapi/qapi-events-sockets.o
+util-obj-y += qapi/qapi-events-tpm.o
+util-obj-y += qapi/qapi-events-trace.o
+util-obj-y += qapi/qapi-events-transaction.o
+util-obj-y += qapi/qapi-events-ui.o
+util-obj-y += qapi/qapi-introspect.o

 chardev-obj-y = chardev/
-slirp-obj-$(CONFIG_SLIRP) = slirp/
-
-#######################################################################
-# authz-obj-y is code used by both qemu system emulation and qemu-img
-
-authz-obj-y = authz/

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img
@@ -72,6 +123,8 @@ common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-$(CONFIG_TPM) += tpm.o

+common-obj-$(CONFIG_SLIRP) += slirp/
+
 common-obj-y += backends/
 common-obj-y += chardev/

@@ -84,8 +137,26 @@ common-obj-$(CONFIG_FDT) += device_tree.o
 ######################################################################
 # qapi

+common-obj-y += qapi/qapi-commands.o
+common-obj-y += qapi/qapi-commands-block-core.o
+common-obj-y += qapi/qapi-commands-block.o
+common-obj-y += qapi/qapi-commands-char.o
+common-obj-y += qapi/qapi-commands-common.o
+common-obj-y += qapi/qapi-commands-crypto.o
+common-obj-y += qapi/qapi-commands-introspect.o
+common-obj-y += qapi/qapi-commands-job.o
+common-obj-y += qapi/qapi-commands-migration.o
+common-obj-y += qapi/qapi-commands-misc.o
+common-obj-y += qapi/qapi-commands-net.o
+common-obj-y += qapi/qapi-commands-rocker.o
+common-obj-y += qapi/qapi-commands-run-state.o
+common-obj-y += qapi/qapi-commands-sockets.o
+common-obj-y += qapi/qapi-commands-tpm.o
+common-obj-y += qapi/qapi-commands-trace.o
+common-obj-y += qapi/qapi-commands-transaction.o
+common-obj-y += qapi/qapi-commands-ui.o
+common-obj-y += qapi/qapi-introspect.o
 common-obj-y += qmp.o hmp.o
-common-obj-y += qapi/
 endif

 #######################################################################
@@ -123,14 +194,12 @@ vhost-user-scsi.o-cflags := $(LIBISCSI_CFLAGS)
 vhost-user-scsi.o-libs := $(LIBISCSI_LIBS)
 vhost-user-scsi-obj-y = contrib/vhost-user-scsi/
 vhost-user-blk-obj-y = contrib/vhost-user-blk/
-rdmacm-mux-obj-y = contrib/rdmacm-mux/

 ######################################################################
 trace-events-subdirs =
 trace-events-subdirs += accel/kvm
 trace-events-subdirs += accel/tcg
 trace-events-subdirs += audio
-trace-events-subdirs += authz
 trace-events-subdirs += block
 trace-events-subdirs += chardev
 trace-events-subdirs += crypto
@@ -174,7 +243,6 @@ trace-events-subdirs += hw/vfio
 trace-events-subdirs += hw/virtio
 trace-events-subdirs += hw/watchdog
 trace-events-subdirs += hw/xen
-trace-events-subdirs += hw/gpio
 trace-events-subdirs += io
 trace-events-subdirs += linux-user
 trace-events-subdirs += migration
--- a/Makefile.target
+++ b/Makefile.target
@@ -45,7 +45,7 @@ config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

 ifdef CONFIG_TRACE_SYSTEMTAP
-stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp $(QEMU_PROG)-log.stp
+stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp

 ifdef CONFIG_USER_ONLY
 TARGET_TYPE=user
@@ -84,14 +84,6 @@ $(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")

-$(QEMU_PROG)-log.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
-	$(call quiet-command,$(TRACETOOL) \
-		--group=all \
-		--format=log-stap \
-		--backends=$(TRACE_BACKENDS) \
-		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
-		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-log.stp")
-
 else
 stap:
 endif
@@ -148,7 +140,6 @@ ifdef CONFIG_SOFTMMU
 obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
 obj-y += qtest.o
 obj-y += hw/
-obj-y += qapi/
 obj-y += memory.o
 obj-y += memory_mapping.o
 obj-y += dump.o
@@ -167,6 +158,9 @@ GENERATED_FILES += hmp-commands.h hmp-commands-info.h

 endif # CONFIG_SOFTMMU

+# Workaround for http://gcc.gnu.org/PR55489, see configure.
+%/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
+
 dummy := $(call unnest-vars,,obj-y)
 all-obj-y := $(obj-y)

@@ -174,12 +168,10 @@ target-obj-y :=
 block-obj-y :=
 common-obj-y :=
 chardev-obj-y :=
-slirp-obj-y :=
 include $(SRC_PATH)/Makefile.objs
 dummy := $(call unnest-vars,,target-obj-y)
 target-obj-y-save := $(target-obj-y)
 dummy := $(call unnest-vars,.., \
-               authz-obj-y \
               block-obj-y \
               block-obj-m \
               chardev-obj-y \
@@ -188,18 +180,15 @@ dummy := $(call unnest-vars,.., \
               qom-obj-y \
               io-obj-y \
               common-obj-y \
-               common-obj-m \
-               slirp-obj-y)
+               common-obj-m)
 target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
 all-obj-y += $(qom-obj-y)
-all-obj-$(CONFIG_SOFTMMU) += $(authz-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y) $(chardev-obj-y)
 all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)
-all-obj-$(CONFIG_SOFTMMU) += $(slirp-obj-y)

 $(QEMU_PROG_BUILD): config-devices.mak

@@ -238,7 +227,6 @@ ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp-installed "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG).stp"
 	$(INSTALL_DATA) $(QEMU_PROG)-simpletrace.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-simpletrace.stp"
-	$(INSTALL_DATA) $(QEMU_PROG)-log.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-log.stp"
 endif

 GENERATED_FILES += config-target.h
--- a/2
+++ b/2
@@ -1 +1 @@
-3.1.50
+3.1.1.1
--- a/accel/accel.c
+++ b/accel/accel.c
@@ -34,7 +34,6 @@
 #include "qom/object.h"
 #include "qemu/error-report.h"
 #include "qemu/option.h"
-#include "qapi/error.h"

 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
@@ -69,7 +68,7 @@ static int accel_init_machine(AccelClass *acc, MachineState *ms)
    return ret;
 }

-void configure_accelerator(MachineState *ms, const char *progname)
+void configure_accelerator(MachineState *ms)
 {
    const char *accel;
    char **accel_list, **tmp;
@@ -80,20 +79,8 @@ void configure_accelerator(MachineState *ms, const char *progname)

    accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
    if (accel == NULL) {
-        /* Select the default accelerator */
-        int pnlen = strlen(progname);
-        if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
-            /* If the program name ends with "kvm", we prefer KVM */
-            accel = "kvm:tcg";
-        } else {
-#if defined(CONFIG_TCG)
-            accel = "tcg";
-#elif defined(CONFIG_KVM)
-            accel = "kvm";
-#else
-#error "No default accelerator available"
-#endif
-        }
+        /* Use the default "accelerator", tcg */
+        accel = "tcg";
    }

    accel_list = g_strsplit(accel, ":", 0);
@@ -131,6 +118,12 @@ void configure_accelerator(MachineState *ms, const char *progname)
    }
 }

+void accel_register_compat_props(AccelState *accel)
+{
+    AccelClass *class = ACCEL_GET_CLASS(accel);
+    register_compat_props_array(class->global_props);
+}
+
 void accel_setup_post(MachineState *ms)
 {
    AccelState *accel = ms->accelerator;
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -86,7 +86,7 @@ struct KVMState
    int robust_singlestep;
    int debugregs;
 #ifdef KVM_CAP_SET_GUEST_DEBUG
-    QTAILQ_HEAD(, kvm_sw_breakpoint) kvm_sw_breakpoints;
+    struct kvm_sw_breakpoint_head kvm_sw_breakpoints;
 #endif
    int many_ioeventfds;
    int intx_set_mask;
@@ -102,7 +102,7 @@ struct KVMState
    int nr_allocated_irq_routes;
    unsigned long *used_gsi_bitmap;
    unsigned int gsi_count;
-    QTAILQ_HEAD(, KVMMSIRoute) msi_hashtab[KVM_MSI_HASHTAB_SIZE];
+    QTAILQ_HEAD(msi_hashtab, KVMMSIRoute) msi_hashtab[KVM_MSI_HASHTAB_SIZE];
 #endif
    KVMMemoryListener memory_listener;
    QLIST_HEAD(, KVMParkedVcpu) kvm_parked_vcpus;
@@ -657,8 +657,6 @@ static int kvm_set_ioeventfd_mmio(int fd, hwaddr addr, uint32_t val,
        .fd = fd,
    };

-    trace_kvm_set_ioeventfd_mmio(fd, (uint64_t)addr, val, assign, size,
-                                 datamatch);
    if (!kvm_enabled()) {
        return -ENOSYS;
    }
@@ -690,7 +688,6 @@ static int kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint16_t val,
        .fd = fd,
    };
    int r;
-    trace_kvm_set_ioeventfd_pio(fd, addr, val, assign, size, datamatch);
    if (!kvm_enabled()) {
        return -ENOSYS;
    }
@@ -2267,13 +2264,6 @@ bool kvm_arm_supports_user_irq(void)
    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
 }

-/* Whether the KVM_SET_GUEST_DEBUG ioctl supports single stepping */
-int kvm_has_guestdbg_singlestep(void)
-{
-    /* return kvm_check_extension(kvm_state, KVM_CAP_GUEST_DEBUG_SSTEP); */
-    return 0;
-}
-
 #ifdef KVM_CAP_SET_GUEST_DEBUG
 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                 target_ulong pc)
@@ -2323,15 +2313,6 @@ int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
    return data.err;
 }

-void kvm_set_singlestep(CPUState *cs, int enabled)
-{
-    if (kvm_has_guestdbg_singlestep()) {
-        kvm_update_guest_debug(cs, 0);
-    } else {
-        kvm_arch_set_singlestep(cs, enabled);
-    }
-}
-
 int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                          target_ulong len, int type)
 {
--- a/accel/kvm/trace-events
+++ b/accel/kvm/trace-events
@@ -12,7 +12,5 @@ kvm_irqchip_commit_routes(void) ""
 kvm_irqchip_add_msi_route(char *name, int vector, int virq) "dev %s vector %d virq %d"
 kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
 kvm_irqchip_release_virq(int virq) "virq %d"
-kvm_set_ioeventfd_mmio(int fd, uint64_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%" PRIx64 " val=0x%x assign: %d size: %d match: %d"
-kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%x val=0x%x assign: %d size: %d match: %d"
 kvm_set_user_memory(uint32_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"

--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -79,10 +79,6 @@ int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
    return -ENOSYS;
 }

-void kvm_set_singlestep(CPUState *cs, int enabled)
-{
-}
-
 int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                          target_ulong len, int type)
 {
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -7,7 +7,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -266,9 +266,6 @@ void cpu_exec_step_atomic(CPUState *cpu)
 #ifndef CONFIG_SOFTMMU
        tcg_debug_assert(!have_mmap_lock());
 #endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
        assert_no_pages_locked();
    }

@@ -702,7 +699,6 @@ int cpu_exec(CPUState *cpu)
        if (qemu_mutex_iothread_locked()) {
            qemu_mutex_unlock_iothread();
        }
-        assert_no_pages_locked();
    }

    /* if an exception is pending, we execute it here */
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -74,166 +74,6 @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)

-static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
-{
-    return env->tlb_mask[mmu_idx] + (1 << CPU_TLB_ENTRY_BITS);
-}
-
-static void tlb_window_reset(CPUTLBWindow *window, int64_t ns,
-                             size_t max_entries)
-{
-    window->begin_ns = ns;
-    window->max_entries = max_entries;
-}
-
-static void tlb_dyn_init(CPUArchState *env)
-{
-    int i;
-
-    for (i = 0; i < NB_MMU_MODES; i++) {
-        CPUTLBDesc *desc = &env->tlb_d[i];
-        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
-
-        tlb_window_reset(&desc->window, get_clock_realtime(), 0);
-        desc->n_used_entries = 0;
-        env->tlb_mask[i] = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
-        env->tlb_table[i] = g_new(CPUTLBEntry, n_entries);
-        env->iotlb[i] = g_new(CPUIOTLBEntry, n_entries);
-    }
-}
-
-/**
- * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
- * @env: CPU that owns the TLB
- * @mmu_idx: MMU index of the TLB
- *
- * Called with tlb_lock_held.
- *
- * We have two main constraints when resizing a TLB: (1) we only resize it
- * on a TLB flush (otherwise we'd have to take a perf hit by either rehashing
- * the array or unnecessarily flushing it), which means we do not control how
- * frequently the resizing can occur; (2) we don't have access to the guest's
- * future scheduling decisions, and therefore have to decide the magnitude of
- * the resize based on past observations.
- *
- * In general, a memory-hungry process can benefit greatly from an appropriately
- * sized TLB, since a guest TLB miss is very expensive. This doesn't mean that
- * we just have to make the TLB as large as possible; while an oversized TLB
- * results in minimal TLB miss rates, it also takes longer to be flushed
- * (flushes can be _very_ frequent), and the reduced locality can also hurt
- * performance.
- *
- * To achieve near-optimal performance for all kinds of workloads, we:
- *
- * 1. Aggressively increase the size of the TLB when the use rate of the
- * TLB being flushed is high, since it is likely that in the near future this
- * memory-hungry process will execute again, and its memory hungriness will
- * probably be similar.
- *
- * 2. Slowly reduce the size of the TLB as the use rate declines over a
- * reasonably large time window. The rationale is that if in such a time window
- * we have not observed a high TLB use rate, it is likely that we won't observe
- * it in the near future. In that case, once a time window expires we downsize
- * the TLB to match the maximum use rate observed in the window.
- *
- * 3. Try to keep the maximum use rate in a time window in the 30-70% range,
- * since in that range performance is likely near-optimal. Recall that the TLB
- * is direct mapped, so we want the use rate to be low (or at least not too
- * high), since otherwise we are likely to have a significant amount of
- * conflict misses.
- */
-static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-{
-    CPUTLBDesc *desc = &env->tlb_d[mmu_idx];
-    size_t old_size = tlb_n_entries(env, mmu_idx);
-    size_t rate;
-    size_t new_size = old_size;
-    int64_t now = get_clock_realtime();
-    int64_t window_len_ms = 100;
-    int64_t window_len_ns = window_len_ms * 1000 * 1000;
-    bool window_expired = now > desc->window.begin_ns + window_len_ns;
-
-    if (desc->n_used_entries > desc->window.max_entries) {
-        desc->window.max_entries = desc->n_used_entries;
-    }
-    rate = desc->window.max_entries * 100 / old_size;
-
-    if (rate > 70) {
-        new_size = MIN(old_size << 1, 1 << CPU_TLB_DYN_MAX_BITS);
-    } else if (rate < 30 && window_expired) {
-        size_t ceil = pow2ceil(desc->window.max_entries);
-        size_t expected_rate = desc->window.max_entries * 100 / ceil;
-
-        /*
-         * Avoid undersizing when the max number of entries seen is just below
-         * a pow2. For instance, if max_entries == 1025, the expected use rate
-         * would be 1025/2048==50%. However, if max_entries == 1023, we'd get
-         * 1023/1024==99.9% use rate, so we'd likely end up doubling the size
-         * later. Thus, make sure that the expected use rate remains below 70%.
-         * (and since we double the size, that means the lowest rate we'd
-         * expect to get is 35%, which is still in the 30-70% range where
-         * we consider that the size is appropriate.)
-         */
-        if (expected_rate > 70) {
-            ceil *= 2;
-        }
-        new_size = MAX(ceil, 1 << CPU_TLB_DYN_MIN_BITS);
-    }
-
-    if (new_size == old_size) {
-        if (window_expired) {
-            tlb_window_reset(&desc->window, now, desc->n_used_entries);
-        }
-        return;
-    }
-
-    g_free(env->tlb_table[mmu_idx]);
-    g_free(env->iotlb[mmu_idx]);
-
-    tlb_window_reset(&desc->window, now, 0);
-    /* desc->n_used_entries is cleared by the caller */
-    env->tlb_mask[mmu_idx] = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-    env->tlb_table[mmu_idx] = g_try_new(CPUTLBEntry, new_size);
-    env->iotlb[mmu_idx] = g_try_new(CPUIOTLBEntry, new_size);
-    /*
-     * If the allocations fail, try smaller sizes. We just freed some
-     * memory, so going back to half of new_size has a good chance of working.
-     * Increased memory pressure elsewhere in the system might cause the
-     * allocations to fail though, so we progressively reduce the allocation
-     * size, aborting if we cannot even allocate the smallest TLB we support.
-     */
-    while (env->tlb_table[mmu_idx] == NULL || env->iotlb[mmu_idx] == NULL) {
-        if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
-            error_report("%s: %s", __func__, strerror(errno));
-            abort();
-        }
-        new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
-        env->tlb_mask[mmu_idx] = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-
-        g_free(env->tlb_table[mmu_idx]);
-        g_free(env->iotlb[mmu_idx]);
-        env->tlb_table[mmu_idx] = g_try_new(CPUTLBEntry, new_size);
-        env->iotlb[mmu_idx] = g_try_new(CPUIOTLBEntry, new_size);
-    }
-}
-
-static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
-{
-    tlb_mmu_resize_locked(env, mmu_idx);
-    memset(env->tlb_table[mmu_idx], -1, sizeof_tlb(env, mmu_idx));
-    env->tlb_d[mmu_idx].n_used_entries = 0;
-}
-
-static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-{
-    env->tlb_d[mmu_idx].n_used_entries++;
-}
-
-static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
-{
-    env->tlb_d[mmu_idx].n_used_entries--;
-}
-
 void tlb_init(CPUState *cpu)
 {
    CPUArchState *env = cpu->env_ptr;
@@ -242,8 +82,6 @@ void tlb_init(CPUState *cpu)

    /* Ensure that cpu_reset performs a full flush.  */
    env->tlb_c.dirty = ALL_MMUIDX_BITS;
-
-    tlb_dyn_init(env);
 }

 /* flush_all_helper: run fn across all cpus
@@ -284,7 +122,7 @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)

 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_table_flush_by_mmuidx(env, mmu_idx);
+    memset(env->tlb_table[mmu_idx], -1, sizeof(env->tlb_table[0]));
    memset(env->tlb_v_table[mmu_idx], -1, sizeof(env->tlb_v_table[0]));
    env->tlb_d[mmu_idx].large_page_addr = -1;
    env->tlb_d[mmu_idx].large_page_mask = -1;
@@ -386,24 +224,13 @@ static inline bool tlb_hit_page_anyprot(CPUTLBEntry *tlb_entry,
           tlb_hit_page(tlb_entry->addr_code, page);
 }

-/**
- * tlb_entry_is_empty - return true if the entry is not in use
- * @te: pointer to CPUTLBEntry
- */
-static inline bool tlb_entry_is_empty(const CPUTLBEntry *te)
-{
-    return te->addr_read == -1 && te->addr_write == -1 && te->addr_code == -1;
-}
-
 /* Called with tlb_c.lock held */
-static inline bool tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
+static inline void tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
                                          target_ulong page)
 {
    if (tlb_hit_page_anyprot(tlb_entry, page)) {
        memset(tlb_entry, -1, sizeof(*tlb_entry));
-        return true;
    }
-    return false;
 }

 /* Called with tlb_c.lock held */
@@ -414,9 +241,7 @@ static inline void tlb_flush_vtlb_page_locked(CPUArchState *env, int mmu_idx,

    assert_cpu_is_self(ENV_GET_CPU(env));
    for (k = 0; k < CPU_VTLB_SIZE; k++) {
-        if (tlb_flush_entry_locked(&env->tlb_v_table[mmu_idx][k], page)) {
-            tlb_n_used_entries_dec(env, mmu_idx);
-        }
+        tlb_flush_entry_locked(&env->tlb_v_table[mmu_idx][k], page);
    }
 }

@@ -433,9 +258,7 @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
                  midx, lp_addr, lp_mask);
        tlb_flush_one_mmuidx_locked(env, midx);
    } else {
-        if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
-            tlb_n_used_entries_dec(env, midx);
-        }
+        tlb_flush_entry_locked(tlb_entry(env, midx, page), page);
        tlb_flush_vtlb_page_locked(env, midx, page);
    }
 }
@@ -612,9 +435,8 @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
    qemu_spin_lock(&env->tlb_c.lock);
    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
        unsigned int i;
-        unsigned int n = tlb_n_entries(env, mmu_idx);

-        for (i = 0; i < n; i++) {
+        for (i = 0; i < CPU_TLB_SIZE; i++) {
            tlb_reset_dirty_range_locked(&env->tlb_table[mmu_idx][i], start1,
                                         length);
        }
@@ -769,14 +591,13 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     * Only evict the old entry to the victim tlb if it's for a
     * different page; otherwise just overwrite the stale data.
     */
-    if (!tlb_hit_page_anyprot(te, vaddr_page) && !tlb_entry_is_empty(te)) {
+    if (!tlb_hit_page_anyprot(te, vaddr_page)) {
        unsigned vidx = env->tlb_d[mmu_idx].vindex++ % CPU_VTLB_SIZE;
        CPUTLBEntry *tv = &env->tlb_v_table[mmu_idx][vidx];

        /* Evict the old entry into the victim tlb.  */
        copy_tlb_helper_locked(tv, te);
        env->iotlb_v[mmu_idx][vidx] = env->iotlb[mmu_idx][index];
-        tlb_n_used_entries_dec(env, mmu_idx);
    }

    /* refill the tlb */
@@ -828,7 +649,6 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
    }

    copy_tlb_helper_locked(te, &tn);
-    tlb_n_used_entries_inc(env, mmu_idx);
    qemu_spin_unlock(&env->tlb_c.lock);
 }

@@ -1045,8 +865,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
        if (!VICTIM_TLB_HIT(addr_code, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        assert(tlb_hit(entry->addr_code, addr));
    }
@@ -1127,8 +945,6 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, 1 << s_bits, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            tlbe = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
    }
--- a/accel/tcg/softmmu_template.h
+++ b/accel/tcg/softmmu_template.h
@@ -11,7 +11,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -129,8 +129,6 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = entry->ADDR_READ;
    }
@@ -200,8 +198,6 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = entry->ADDR_READ;
    }
@@ -298,8 +294,6 @@ void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
    }
@@ -378,8 +372,6 @@ void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
    }
--- a/accel/tcg/tcg-runtime-gvec.c
+++ b/accel/tcg/tcg-runtime-gvec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -512,39 +512,6 @@ void HELPER(gvec_orc)(void *d, void *a, void *b, uint32_t desc)
    clear_high(d, oprsz, desc);
 }

-void HELPER(gvec_nand)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) & *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_nor)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) | *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_eqv)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) ^ *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
 void HELPER(gvec_ands)(void *d, void *a, uint64_t b, uint32_t desc)
 {
    intptr_t oprsz = simd_oprsz(desc);
@@ -1028,227 +995,3 @@ void HELPER(gvec_ussub64)(void *d, void *a, void *b, uint32_t desc)
    }
    clear_high(d, oprsz, desc);
 }
-
-void HELPER(gvec_smin8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int8_t)) {
-        int8_t aa = *(int8_t *)(a + i);
-        int8_t bb = *(int8_t *)(b + i);
-        int8_t dd = aa < bb ? aa : bb;
-        *(int8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int16_t aa = *(int16_t *)(a + i);
-        int16_t bb = *(int16_t *)(b + i);
-        int16_t dd = aa < bb ? aa : bb;
-        *(int16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t aa = *(int32_t *)(a + i);
-        int32_t bb = *(int32_t *)(b + i);
-        int32_t dd = aa < bb ? aa : bb;
-        *(int32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t aa = *(int64_t *)(a + i);
-        int64_t bb = *(int64_t *)(b + i);
-        int64_t dd = aa < bb ? aa : bb;
-        *(int64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int8_t)) {
-        int8_t aa = *(int8_t *)(a + i);
-        int8_t bb = *(int8_t *)(b + i);
-        int8_t dd = aa > bb ? aa : bb;
-        *(int8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int16_t aa = *(int16_t *)(a + i);
-        int16_t bb = *(int16_t *)(b + i);
-        int16_t dd = aa > bb ? aa : bb;
-        *(int16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t aa = *(int32_t *)(a + i);
-        int32_t bb = *(int32_t *)(b + i);
-        int32_t dd = aa > bb ? aa : bb;
-        *(int32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t aa = *(int64_t *)(a + i);
-        int64_t bb = *(int64_t *)(b + i);
-        int64_t dd = aa > bb ? aa : bb;
-        *(int64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        uint8_t aa = *(uint8_t *)(a + i);
-        uint8_t bb = *(uint8_t *)(b + i);
-        uint8_t dd = aa < bb ? aa : bb;
-        *(uint8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        uint16_t aa = *(uint16_t *)(a + i);
-        uint16_t bb = *(uint16_t *)(b + i);
-        uint16_t dd = aa < bb ? aa : bb;
-        *(uint16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t aa = *(uint32_t *)(a + i);
-        uint32_t bb = *(uint32_t *)(b + i);
-        uint32_t dd = aa < bb ? aa : bb;
-        *(uint32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t aa = *(uint64_t *)(a + i);
-        uint64_t bb = *(uint64_t *)(b + i);
-        uint64_t dd = aa < bb ? aa : bb;
-        *(uint64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        uint8_t aa = *(uint8_t *)(a + i);
-        uint8_t bb = *(uint8_t *)(b + i);
-        uint8_t dd = aa > bb ? aa : bb;
-        *(uint8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        uint16_t aa = *(uint16_t *)(a + i);
-        uint16_t bb = *(uint16_t *)(b + i);
-        uint16_t dd = aa > bb ? aa : bb;
-        *(uint16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t aa = *(uint32_t *)(a + i);
-        uint32_t bb = *(uint32_t *)(b + i);
-        uint32_t dd = aa > bb ? aa : bb;
-        *(uint32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t aa = *(uint64_t *)(a + i);
-        uint64_t bb = *(uint64_t *)(b + i);
-        uint64_t dd = aa > bb ? aa : bb;
-        *(uint64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -200,26 +200,6 @@ DEF_HELPER_FLAGS_4(gvec_ussub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)

-DEF_HELPER_FLAGS_4(gvec_smin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_smax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
 DEF_HELPER_FLAGS_3(gvec_neg8, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg16, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg32, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
@@ -231,9 +211,6 @@ DEF_HELPER_FLAGS_4(gvec_or, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_xor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_andc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_orc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_nand, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_nor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_eqv, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)

 DEF_HELPER_FLAGS_4(gvec_ands, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_xors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -16,8 +16,12 @@
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
+#ifdef _WIN32
+#include <windows.h>
+#endif
 #include "qemu/osdep.h"

+
 #include "qemu-common.h"
 #define NO_CPU_IO_DEFS
 #include "cpu.h"
@@ -1688,9 +1692,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
        cflags |= CF_NOCACHE | 1;
    }

-    cflags &= ~CF_CLUSTER_MASK;
-    cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
-
 buffer_overflow:
    tb = tb_alloc(pc);
    if (unlikely(!tb)) {
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -479,66 +479,28 @@ int cpu_signal_handler(int host_signum, void *pinfo,

 #elif defined(__aarch64__)

-#ifndef ESR_MAGIC
-/* Pre-3.16 kernel headers don't have these, so provide fallback definitions */
-#define ESR_MAGIC 0x45535201
-struct esr_context {
-    struct _aarch64_ctx head;
-    uint64_t esr;
-};
-#endif
-
-static inline struct _aarch64_ctx *first_ctx(ucontext_t *uc)
-{
-    return (struct _aarch64_ctx *)&uc->uc_mcontext.__reserved;
-}
-
-static inline struct _aarch64_ctx *next_ctx(struct _aarch64_ctx *hdr)
-{
-    return (struct _aarch64_ctx *)((char *)hdr + hdr->size);
-}
-
 int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
 {
    siginfo_t *info = pinfo;
    ucontext_t *uc = puc;
    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
    bool is_write;
-    struct _aarch64_ctx *hdr;
-    struct esr_context const *esrctx = NULL;

-    /* Find the esr_context, which has the WnR bit in it */
-    for (hdr = first_ctx(uc); hdr->magic; hdr = next_ctx(hdr)) {
-        if (hdr->magic == ESR_MAGIC) {
-            esrctx = (struct esr_context const *)hdr;
-            break;
-        }
-    }
+    /* XXX: need kernel patch to get write flag faster.  */
+    is_write = (   (insn & 0xbfff0000) == 0x0c000000   /* C3.3.1 */
+                || (insn & 0xbfe00000) == 0x0c800000   /* C3.3.2 */
+                || (insn & 0xbfdf0000) == 0x0d000000   /* C3.3.3 */
+                || (insn & 0xbfc00000) == 0x0d800000   /* C3.3.4 */
+                || (insn & 0x3f400000) == 0x08000000   /* C3.3.6 */
+                || (insn & 0x3bc00000) == 0x39000000   /* C3.3.13 */
+                || (insn & 0x3fc00000) == 0x3d800000   /* ... 128bit */
+                /* Ingore bits 10, 11 & 21, controlling indexing.  */
+                || (insn & 0x3bc00000) == 0x38000000   /* C3.3.8-12 */
+                || (insn & 0x3fe00000) == 0x3c800000   /* ... 128bit */
+                /* Ignore bits 23 & 24, controlling indexing.  */
+                || (insn & 0x3a400000) == 0x28000000); /* C3.3.7,14-16 */

-    if (esrctx) {
-        /* For data aborts ESR.EC is 0b10010x: then bit 6 is the WnR bit */
-        uint64_t esr = esrctx->esr;
-        is_write = extract32(esr, 27, 5) == 0x12 && extract32(esr, 6, 1) == 1;
-    } else {
-        /*
-         * Fall back to parsing instructions; will only be needed
-         * for really ancient (pre-3.16) kernels.
-         */
-        uint32_t insn = *(uint32_t *)pc;
-
-        is_write = ((insn & 0xbfff0000) == 0x0c000000   /* C3.3.1 */
-                    || (insn & 0xbfe00000) == 0x0c800000   /* C3.3.2 */
-                    || (insn & 0xbfdf0000) == 0x0d000000   /* C3.3.3 */
-                    || (insn & 0xbfc00000) == 0x0d800000   /* C3.3.4 */
-                    || (insn & 0x3f400000) == 0x08000000   /* C3.3.6 */
-                    || (insn & 0x3bc00000) == 0x39000000   /* C3.3.13 */
-                    || (insn & 0x3fc00000) == 0x3d800000   /* ... 128bit */
-                    /* Ignore bits 10, 11 & 21, controlling indexing.  */
-                    || (insn & 0x3bc00000) == 0x38000000   /* C3.3.8-12 */
-                    || (insn & 0x3fe00000) == 0x3c800000   /* ... 128bit */
-                    /* Ignore bits 23 & 24, controlling indexing.  */
-                    || (insn & 0x3a400000) == 0x28000000); /* C3.3.7,14-16 */
-    }
    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }

@@ -609,81 +571,6 @@ int cpu_signal_handler(int host_signum, void *pinfo,
    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }

-#elif defined(__riscv)
-
-int cpu_signal_handler(int host_signum, void *pinfo,
-                       void *puc)
-{
-    siginfo_t *info = pinfo;
-    ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.__gregs[REG_PC];
-    uint32_t insn = *(uint32_t *)pc;
-    int is_write = 0;
-
-    /* Detect store by reading the instruction at the program
-       counter. Note: we currently only generate 32-bit
-       instructions so we thus only detect 32-bit stores */
-    switch (((insn >> 0) & 0b11)) {
-    case 3:
-        switch (((insn >> 2) & 0b11111)) {
-        case 8:
-            switch (((insn >> 12) & 0b111)) {
-            case 0: /* sb */
-            case 1: /* sh */
-            case 2: /* sw */
-            case 3: /* sd */
-            case 4: /* sq */
-                is_write = 1;
-                break;
-            default:
-                break;
-            }
-            break;
-        case 9:
-            switch (((insn >> 12) & 0b111)) {
-            case 2: /* fsw */
-            case 3: /* fsd */
-            case 4: /* fsq */
-                is_write = 1;
-                break;
-            default:
-                break;
-            }
-            break;
-        default:
-            break;
-        }
-    }
-
-    /* Check for compressed instructions */
-    switch (((insn >> 13) & 0b111)) {
-    case 7:
-        switch (insn & 0b11) {
-        case 0: /*c.sd */
-        case 2: /* c.sdsp */
-            is_write = 1;
-            break;
-        default:
-            break;
-        }
-        break;
-    case 6:
-        switch (insn & 0b11) {
-        case 0: /* c.sw */
-        case 3: /* c.swsp */
-            is_write = 1;
-            break;
-        default:
-            break;
-        }
-        break;
-    default:
-        break;
-    }
-
-    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
-}
-
 #else

 #error host CPU specific signal handler needed
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -28,7 +28,9 @@
 #include "audio.h"
 #include "trace.h"

+#if QEMU_GNUC_PREREQ(4, 3)
 #pragma GCC diagnostic ignored "-Waddress"
+#endif

 #define AUDIO_CAP "alsa"
 #include "audio_int.h"
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1762,7 +1762,7 @@ void AUD_help (void)
        );
 }

-static int audio_driver_init(AudioState *s, struct audio_driver *drv, bool msg)
+static int audio_driver_init (AudioState *s, struct audio_driver *drv)
 {
    if (drv->options) {
        audio_process_options (drv->name, drv->options);
@@ -1776,9 +1776,7 @@ static int audio_driver_init(AudioState *s, struct audio_driver *drv, bool msg)
        return 0;
    }
    else {
-        if (msg) {
-            dolog("Could not init `%s' audio driver\n", drv->name);
-        }
+        dolog ("Could not init `%s' audio driver\n", drv->name);
        return -1;
    }
 }
@@ -1903,7 +1901,7 @@ static void audio_init (void)
    if (drvname) {
        driver = audio_driver_lookup(drvname);
        if (driver) {
-            done = !audio_driver_init(s, driver, true);
+            done = !audio_driver_init(s, driver);
        } else {
            dolog ("Unknown audio driver `%s'\n", drvname);
            dolog ("Run with -audio-help to list available drivers\n");
@@ -1914,14 +1912,14 @@ static void audio_init (void)
        for (i = 0; !done && i < ARRAY_SIZE(audio_prio_list); i++) {
            driver = audio_driver_lookup(audio_prio_list[i]);
            if (driver && driver->can_be_default) {
-                done = !audio_driver_init(s, driver, false);
+                done = !audio_driver_init(s, driver);
            }
        }
    }

    if (!done) {
        driver = audio_driver_lookup("none");
-        done = !audio_driver_init(s, driver, false);
+        done = !audio_driver_init(s, driver);
        assert(done);
        dolog("warning: Using timer based audio emulation\n");
    }
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -191,7 +191,7 @@ struct SWVoiceCap {
    QLIST_ENTRY (SWVoiceCap) entries;
 };

-typedef struct AudioState {
+struct AudioState {
    struct audio_driver *drv;
    void *drv_opaque;

@@ -203,7 +203,7 @@ typedef struct AudioState {
    int nb_hw_voices_out;
    int nb_hw_voices_in;
    int vm_running;
-} AudioState;
+};

 extern const struct mixeng_volume nominal_volume;

--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -814,21 +814,6 @@ static PAConf glob_conf = {

 static void *qpa_audio_init (void)
 {
-    if (glob_conf.server == NULL) {
-        char pidfile[64];
-        char *runtime;
-        struct stat st;
-
-        runtime = getenv("XDG_RUNTIME_DIR");
-        if (!runtime) {
-            return NULL;
-        }
-        snprintf(pidfile, sizeof(pidfile), "%s/pulse/pid", runtime);
-        if (stat(pidfile, &st) != 0) {
-            return NULL;
-        }
-    }
-
    paaudio *g = g_malloc(sizeof(paaudio));
    g->conf = glob_conf;
    g->mainloop = NULL;
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -38,29 +38,30 @@ static void wav_destroy (void *opaque)
    uint8_t dlen[4];
    uint32_t datalen = wav->bytes;
    uint32_t rifflen = datalen + 36;
+    Monitor *mon = cur_mon;

    if (wav->f) {
        le_store (rlen, rifflen, 4);
        le_store (dlen, datalen, 4);

        if (fseek (wav->f, 4, SEEK_SET)) {
-            error_report("wav_destroy: rlen fseek failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: rlen fseek failed\nReason: %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fwrite (rlen, 4, 1, wav->f) != 1) {
-            error_report("wav_destroy: rlen fwrite failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: rlen fwrite failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fseek (wav->f, 32, SEEK_CUR)) {
-            error_report("wav_destroy: dlen fseek failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: dlen fseek failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fwrite (dlen, 1, 4, wav->f) != 4) {
-            error_report("wav_destroy: dlen fwrite failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: dlen fwrite failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
    doclose:
@@ -77,7 +78,8 @@ static void wav_capture (void *opaque, void *buf, int size)
    WAVState *wav = opaque;

    if (fwrite (buf, size, 1, wav->f) != 1) {
-        error_report("wav_capture: fwrite error: %s", strerror(errno));
+        monitor_printf (cur_mon, "wav_capture: fwrite error\nReason: %s",
+                        strerror (errno));
    }
    wav->bytes += size;
 }
@@ -108,6 +110,7 @@ static struct capture_ops wav_capture_ops = {
 int wav_start_capture (CaptureState *s, const char *path, int freq,
                       int bits, int nchannels)
 {
+    Monitor *mon = cur_mon;
    WAVState *wav;
    uint8_t hdr[] = {
        0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00, 0x57, 0x41, 0x56,
@@ -121,13 +124,13 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    CaptureVoiceOut *cap;

    if (bits != 8 && bits != 16) {
-        error_report("incorrect bit count %d, must be 8 or 16", bits);
+        monitor_printf (mon, "incorrect bit count %d, must be 8 or 16\n", bits);
        return -1;
    }

    if (nchannels != 1 && nchannels != 2) {
-        error_report("incorrect channel count %d, must be 1 or 2",
-                     nchannels);
+        monitor_printf (mon, "incorrect channel count %d, must be 1 or 2\n",
+                        nchannels);
        return -1;
    }

@@ -155,8 +158,8 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,

    wav->f = fopen (path, "wb");
    if (!wav->f) {
-        error_report("Failed to open wave file `%s': %s",
-                     path, strerror(errno));
+        monitor_printf (mon, "Failed to open wave file `%s'\nReason: %s\n",
+                        path, strerror (errno));
        g_free (wav);
        return -1;
    }
@@ -167,13 +170,14 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    wav->freq = freq;

    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        error_report("Failed to write header: %s", strerror(errno));
+        monitor_printf (mon, "Failed to write header\nReason: %s\n",
+                        strerror (errno));
        goto error_free;
    }

    cap = AUD_add_capture (&as, &ops, wav);
    if (!cap) {
-        error_report("Failed to add audio capture");
+        monitor_printf (mon, "Failed to add audio capture\n");
        goto error_free;
    }

@@ -185,7 +189,8 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
 error_free:
    g_free (wav->path);
    if (fclose (wav->f)) {
-        error_report("Failed to close wave file: %s", strerror(errno));
+        monitor_printf (mon, "Failed to close wave file\nReason: %s\n",
+                        strerror (errno));
    }
    g_free (wav);
    return -1;
--- a/authz/Makefile.objs
+++ b/authz/Makefile.objs
@@ -1,7 +0,0 @@
-authz-obj-y += base.o
-authz-obj-y += simple.o
-authz-obj-y += list.o
-authz-obj-y += listfile.o
-authz-obj-$(CONFIG_AUTH_PAM) += pamacct.o
-
-pamacct.o-libs = -lpam
--- a/authz/base.c
+++ b/authz/base.c
@@ -1,82 +0,0 @@
-/*
- * QEMU authorization framework base class
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/base.h"
-#include "authz/trace.h"
-
-bool qauthz_is_allowed(QAuthZ *authz,
-                       const char *identity,
-                       Error **errp)
-{
-    QAuthZClass *cls = QAUTHZ_GET_CLASS(authz);
-    bool allowed;
-
-    allowed = cls->is_allowed(authz, identity, errp);
-    trace_qauthz_is_allowed(authz, identity, allowed);
-
-    return allowed;
-}
-
-
-bool qauthz_is_allowed_by_id(const char *authzid,
-                             const char *identity,
-                             Error **errp)
-{
-    QAuthZ *authz;
-    Object *obj;
-    Object *container;
-
-    container = object_get_objects_root();
-    obj = object_resolve_path_component(container,
-                                        authzid);
-    if (!obj) {
-        error_setg(errp, "Cannot find QAuthZ object ID %s",
-                   authzid);
-        return false;
-    }
-
-    if (!object_dynamic_cast(obj, TYPE_QAUTHZ)) {
-        error_setg(errp, "Object '%s' is not a QAuthZ subclass",
-                   authzid);
-        return false;
-    }
-
-    authz = QAUTHZ(obj);
-
-    return qauthz_is_allowed(authz, identity, errp);
-}
-
-
-static const TypeInfo authz_info = {
-    .parent = TYPE_OBJECT,
-    .name = TYPE_QAUTHZ,
-    .instance_size = sizeof(QAuthZ),
-    .class_size = sizeof(QAuthZClass),
-    .abstract = true,
-};
-
-static void qauthz_register_types(void)
-{
-    type_register_static(&authz_info);
-}
-
-type_init(qauthz_register_types)
-
--- a/authz/list.c
+++ b/authz/list.c
@@ -1,271 +0,0 @@
-/*
- * QEMU access control list authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/list.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-#include "qapi/qapi-visit-authz.h"
-
-static bool qauthz_list_is_allowed(QAuthZ *authz,
-                                   const char *identity,
-                                   Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(authz);
-    QAuthZListRuleList *rules = lauthz->rules;
-
-    while (rules) {
-        QAuthZListRule *rule = rules->value;
-        QAuthZListFormat format = rule->has_format ? rule->format :
-            QAUTHZ_LIST_FORMAT_EXACT;
-
-        trace_qauthz_list_check_rule(authz, rule->match, identity,
-                                     format, rule->policy);
-        switch (format) {
-        case QAUTHZ_LIST_FORMAT_EXACT:
-            if (g_str_equal(rule->match, identity)) {
-                return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
-            }
-            break;
-        case QAUTHZ_LIST_FORMAT_GLOB:
-            if (g_pattern_match_simple(rule->match, identity)) {
-                return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
-            }
-            break;
-        default:
-            g_warn_if_reached();
-            return false;
-        }
-        rules = rules->next;
-    }
-
-    trace_qauthz_list_default_policy(authz, identity, lauthz->policy);
-    return lauthz->policy == QAUTHZ_LIST_POLICY_ALLOW;
-}
-
-
-static void
-qauthz_list_prop_set_policy(Object *obj,
-                            int value,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    lauthz->policy = value;
-}
-
-
-static int
-qauthz_list_prop_get_policy(Object *obj,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    return lauthz->policy;
-}
-
-
-static void
-qauthz_list_prop_get_rules(Object *obj, Visitor *v, const char *name,
-                           void *opaque, Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    visit_type_QAuthZListRuleList(v, name, &lauthz->rules, errp);
-}
-
-static void
-qauthz_list_prop_set_rules(Object *obj, Visitor *v, const char *name,
-                           void *opaque, Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-    QAuthZListRuleList *oldrules;
-
-    oldrules = lauthz->rules;
-    visit_type_QAuthZListRuleList(v, name, &lauthz->rules, errp);
-
-    qapi_free_QAuthZListRuleList(oldrules);
-}
-
-
-static void
-qauthz_list_finalize(Object *obj)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    qapi_free_QAuthZListRuleList(lauthz->rules);
-}
-
-
-static void
-qauthz_list_class_init(ObjectClass *oc, void *data)
-{
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    object_class_property_add_enum(oc, "policy",
-                                   "QAuthZListPolicy",
-                                   &QAuthZListPolicy_lookup,
-                                   qauthz_list_prop_get_policy,
-                                   qauthz_list_prop_set_policy,
-                                   NULL);
-
-    object_class_property_add(oc, "rules", "QAuthZListRule",
-                              qauthz_list_prop_get_rules,
-                              qauthz_list_prop_set_rules,
-                              NULL, NULL, NULL);
-
-    authz->is_allowed = qauthz_list_is_allowed;
-}
-
-
-QAuthZList *qauthz_list_new(const char *id,
-                            QAuthZListPolicy policy,
-                            Error **errp)
-{
-    return QAUTHZ_LIST(
-        object_new_with_props(TYPE_QAUTHZ_LIST,
-                              object_get_objects_root(),
-                              id, errp,
-                              "policy", QAuthZListPolicy_str(policy),
-                              NULL));
-}
-
-ssize_t qauthz_list_append_rule(QAuthZList *auth,
-                                const char *match,
-                                QAuthZListPolicy policy,
-                                QAuthZListFormat format,
-                                Error **errp)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *tmp;
-    size_t i = 0;
-
-    rule = g_new0(QAuthZListRule, 1);
-    rule->policy = policy;
-    rule->match = g_strdup(match);
-    rule->format = format;
-    rule->has_format = true;
-
-    tmp = g_new0(QAuthZListRuleList, 1);
-    tmp->value = rule;
-
-    rules = auth->rules;
-    if (rules) {
-        while (rules->next) {
-            i++;
-            rules = rules->next;
-        }
-        rules->next = tmp;
-        return i + 1;
-    } else {
-        auth->rules = tmp;
-        return 0;
-    }
-}
-
-
-ssize_t qauthz_list_insert_rule(QAuthZList *auth,
-                                const char *match,
-                                QAuthZListPolicy policy,
-                                QAuthZListFormat format,
-                                size_t index,
-                                Error **errp)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *tmp;
-    size_t i = 0;
-
-    rule = g_new0(QAuthZListRule, 1);
-    rule->policy = policy;
-    rule->match = g_strdup(match);
-    rule->format = format;
-    rule->has_format = true;
-
-    tmp = g_new0(QAuthZListRuleList, 1);
-    tmp->value = rule;
-
-    rules = auth->rules;
-    if (rules && index > 0) {
-        while (rules->next && i < (index - 1)) {
-            i++;
-            rules = rules->next;
-        }
-        tmp->next = rules->next;
-        rules->next = tmp;
-        return i + 1;
-    } else {
-        tmp->next = auth->rules;
-        auth->rules = tmp;
-        return 0;
-    }
-}
-
-
-ssize_t qauthz_list_delete_rule(QAuthZList *auth, const char *match)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *prev;
-    size_t i = 0;
-
-    prev = NULL;
-    rules = auth->rules;
-    while (rules) {
-        rule = rules->value;
-        if (g_str_equal(rule->match, match)) {
-            if (prev) {
-                prev->next = rules->next;
-            } else {
-                auth->rules = rules->next;
-            }
-            rules->next = NULL;
-            qapi_free_QAuthZListRuleList(rules);
-            return i;
-        }
-        prev = rules;
-        rules = rules->next;
-        i++;
-    }
-
-    return -1;
-}
-
-
-static const TypeInfo qauthz_list_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_LIST,
-    .instance_size = sizeof(QAuthZList),
-    .instance_finalize = qauthz_list_finalize,
-    .class_size = sizeof(QAuthZListClass),
-    .class_init = qauthz_list_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_list_register_types(void)
-{
-    type_register_static(&qauthz_list_info);
-}
-
-
-type_init(qauthz_list_register_types);
--- a/authz/listfile.c
+++ b/authz/listfile.c
@@ -1,283 +0,0 @@
-/*
- * QEMU access control list file authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/listfile.h"
-#include "authz/trace.h"
-#include "qemu/error-report.h"
-#include "qemu/main-loop.h"
-#include "qemu/sockets.h"
-#include "qemu/filemonitor.h"
-#include "qom/object_interfaces.h"
-#include "qapi/qapi-visit-authz.h"
-#include "qapi/qmp/qjson.h"
-#include "qapi/qmp/qobject.h"
-#include "qapi/qmp/qerror.h"
-#include "qapi/qobject-input-visitor.h"
-
-
-static bool
-qauthz_list_file_is_allowed(QAuthZ *authz,
-                            const char *identity,
-                            Error **errp)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(authz);
-    if (fauthz->list) {
-        return qauthz_is_allowed(fauthz->list, identity, errp);
-    }
-
-    return false;
-}
-
-
-static QAuthZ *
-qauthz_list_file_load(QAuthZListFile *fauthz, Error **errp)
-{
-    GError *err = NULL;
-    gchar *content = NULL;
-    gsize len;
-    QObject *obj = NULL;
-    QDict *pdict;
-    Visitor *v = NULL;
-    QAuthZ *ret = NULL;
-
-    trace_qauthz_list_file_load(fauthz, fauthz->filename);
-    if (!g_file_get_contents(fauthz->filename, &content, &len, &err)) {
-        error_setg(errp, "Unable to read '%s': %s",
-                   fauthz->filename, err->message);
-        goto cleanup;
-    }
-
-    obj = qobject_from_json(content, errp);
-    if (!obj) {
-        goto cleanup;
-    }
-
-    pdict = qobject_to(QDict, obj);
-    if (!pdict) {
-        error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "obj", "dict");
-        goto cleanup;
-    }
-
-    v = qobject_input_visitor_new(obj);
-
-    ret = (QAuthZ *)user_creatable_add_type(TYPE_QAUTHZ_LIST,
-                                            NULL, pdict, v, errp);
-
- cleanup:
-    visit_free(v);
-    qobject_unref(obj);
-    if (err) {
-        g_error_free(err);
-    }
-    g_free(content);
-    return ret;
-}
-
-
-static void
-qauthz_list_file_event(int wd G_GNUC_UNUSED,
-                       QFileMonitorEvent ev G_GNUC_UNUSED,
-                       const char *name G_GNUC_UNUSED,
-                       void *opaque)
-{
-    QAuthZListFile *fauthz = opaque;
-    Error *err = NULL;
-
-    if (ev != QFILE_MONITOR_EVENT_MODIFIED &&
-        ev != QFILE_MONITOR_EVENT_CREATED) {
-        return;
-    }
-
-    object_unref(OBJECT(fauthz->list));
-    fauthz->list = qauthz_list_file_load(fauthz, &err);
-    trace_qauthz_list_file_refresh(fauthz,
-                                   fauthz->filename, fauthz->list ? 1 : 0);
-    if (!fauthz->list) {
-        error_report_err(err);
-    }
-}
-
-static void
-qauthz_list_file_complete(UserCreatable *uc, Error **errp)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(uc);
-    gchar *dir = NULL, *file = NULL;
-
-    fauthz->list = qauthz_list_file_load(fauthz, errp);
-
-    if (!fauthz->refresh) {
-        return;
-    }
-
-    fauthz->file_monitor = qemu_file_monitor_new(errp);
-    if (!fauthz->file_monitor) {
-        return;
-    }
-
-    dir = g_path_get_dirname(fauthz->filename);
-    if (g_str_equal(dir, ".")) {
-        error_setg(errp, "Filename must be an absolute path");
-        goto cleanup;
-    }
-    file = g_path_get_basename(fauthz->filename);
-    if (g_str_equal(file, ".")) {
-        error_setg(errp, "Path has no trailing filename component");
-        goto cleanup;
-    }
-
-    fauthz->file_watch = qemu_file_monitor_add_watch(
-        fauthz->file_monitor, dir, file,
-        qauthz_list_file_event, fauthz, errp);
-    if (fauthz->file_watch < 0) {
-        goto cleanup;
-    }
-
- cleanup:
-    g_free(file);
-    g_free(dir);
-}
-
-
-static void
-qauthz_list_file_prop_set_filename(Object *obj,
-                                   const char *value,
-                                   Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    g_free(fauthz->filename);
-    fauthz->filename = g_strdup(value);
-}
-
-
-static char *
-qauthz_list_file_prop_get_filename(Object *obj,
-                                   Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    return g_strdup(fauthz->filename);
-}
-
-
-static void
-qauthz_list_file_prop_set_refresh(Object *obj,
-                                  bool value,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    fauthz->refresh = value;
-}
-
-
-static bool
-qauthz_list_file_prop_get_refresh(Object *obj,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    return fauthz->refresh;
-}
-
-
-static void
-qauthz_list_file_finalize(Object *obj)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    object_unref(OBJECT(fauthz->list));
-    g_free(fauthz->filename);
-    qemu_file_monitor_free(fauthz->file_monitor);
-}
-
-
-static void
-qauthz_list_file_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    ucc->complete = qauthz_list_file_complete;
-
-    object_class_property_add_str(oc, "filename",
-                                  qauthz_list_file_prop_get_filename,
-                                  qauthz_list_file_prop_set_filename,
-                                  NULL);
-    object_class_property_add_bool(oc, "refresh",
-                                   qauthz_list_file_prop_get_refresh,
-                                   qauthz_list_file_prop_set_refresh,
-                                   NULL);
-
-    authz->is_allowed = qauthz_list_file_is_allowed;
-}
-
-
-static void
-qauthz_list_file_init(Object *obj)
-{
-    QAuthZListFile *authz = QAUTHZ_LIST_FILE(obj);
-
-    authz->file_watch = -1;
-#ifdef CONFIG_INOTIFY1
-    authz->refresh = TRUE;
-#endif
-}
-
-
-QAuthZListFile *qauthz_list_file_new(const char *id,
-                                     const char *filename,
-                                     bool refresh,
-                                     Error **errp)
-{
-    return QAUTHZ_LIST_FILE(
-        object_new_with_props(TYPE_QAUTHZ_LIST_FILE,
-                              object_get_objects_root(),
-                              id, errp,
-                              "filename", filename,
-                              "refresh", refresh ? "yes" : "no",
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_list_file_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_LIST_FILE,
-    .instance_init = qauthz_list_file_init,
-    .instance_size = sizeof(QAuthZListFile),
-    .instance_finalize = qauthz_list_file_finalize,
-    .class_size = sizeof(QAuthZListFileClass),
-    .class_init = qauthz_list_file_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_list_file_register_types(void)
-{
-    type_register_static(&qauthz_list_file_info);
-}
-
-
-type_init(qauthz_list_file_register_types);
--- a/authz/pamacct.c
+++ b/authz/pamacct.c
@@ -1,148 +0,0 @@
-/*
- * QEMU PAM authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/pamacct.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-
-#include <security/pam_appl.h>
-
-
-static bool qauthz_pam_is_allowed(QAuthZ *authz,
-                                  const char *identity,
-                                  Error **errp)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(authz);
-    const struct pam_conv pam_conversation = { 0 };
-    pam_handle_t *pamh = NULL;
-    int ret;
-
-    trace_qauthz_pam_check(authz, identity, pauthz->service);
-    ret = pam_start(pauthz->service,
-                    identity,
-                    &pam_conversation,
-                    &pamh);
-    if (ret != PAM_SUCCESS) {
-        error_setg(errp, "Unable to start PAM transaction: %s",
-                   pam_strerror(NULL, ret));
-        return false;
-    }
-
-    ret = pam_acct_mgmt(pamh, PAM_SILENT);
-    pam_end(pamh, ret);
-    if (ret != PAM_SUCCESS) {
-        error_setg(errp, "Unable to authorize user '%s': %s",
-                   identity, pam_strerror(pamh, ret));
-        return false;
-    }
-
-    return true;
-}
-
-
-static void
-qauthz_pam_prop_set_service(Object *obj,
-                            const char *service,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    g_free(pauthz->service);
-    pauthz->service = g_strdup(service);
-}
-
-
-static char *
-qauthz_pam_prop_get_service(Object *obj,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    return g_strdup(pauthz->service);
-}
-
-
-static void
-qauthz_pam_complete(UserCreatable *uc, Error **errp)
-{
-}
-
-
-static void
-qauthz_pam_finalize(Object *obj)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    g_free(pauthz->service);
-}
-
-
-static void
-qauthz_pam_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    ucc->complete = qauthz_pam_complete;
-    authz->is_allowed = qauthz_pam_is_allowed;
-
-    object_class_property_add_str(oc, "service",
-                                  qauthz_pam_prop_get_service,
-                                  qauthz_pam_prop_set_service,
-                                  NULL);
-}
-
-
-QAuthZPAM *qauthz_pam_new(const char *id,
-                          const char *service,
-                          Error **errp)
-{
-    return QAUTHZ_PAM(
-        object_new_with_props(TYPE_QAUTHZ_PAM,
-                              object_get_objects_root(),
-                              id, errp,
-                              "service", service,
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_pam_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_PAM,
-    .instance_size = sizeof(QAuthZPAM),
-    .instance_finalize = qauthz_pam_finalize,
-    .class_size = sizeof(QAuthZPAMClass),
-    .class_init = qauthz_pam_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_pam_register_types(void)
-{
-    type_register_static(&qauthz_pam_info);
-}
-
-
-type_init(qauthz_pam_register_types);
--- a/authz/simple.c
+++ b/authz/simple.c
@@ -1,115 +0,0 @@
-/*
- * QEMU simple authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/simple.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-
-static bool qauthz_simple_is_allowed(QAuthZ *authz,
-                                     const char *identity,
-                                     Error **errp)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(authz);
-
-    trace_qauthz_simple_is_allowed(authz, sauthz->identity, identity);
-    return g_str_equal(identity, sauthz->identity);
-}
-
-static void
-qauthz_simple_prop_set_identity(Object *obj,
-                                const char *value,
-                                Error **errp G_GNUC_UNUSED)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    g_free(sauthz->identity);
-    sauthz->identity = g_strdup(value);
-}
-
-
-static char *
-qauthz_simple_prop_get_identity(Object *obj,
-                                Error **errp G_GNUC_UNUSED)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    return g_strdup(sauthz->identity);
-}
-
-
-static void
-qauthz_simple_finalize(Object *obj)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    g_free(sauthz->identity);
-}
-
-
-static void
-qauthz_simple_class_init(ObjectClass *oc, void *data)
-{
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    authz->is_allowed = qauthz_simple_is_allowed;
-
-    object_class_property_add_str(oc, "identity",
-                                  qauthz_simple_prop_get_identity,
-                                  qauthz_simple_prop_set_identity,
-                                  NULL);
-}
-
-
-QAuthZSimple *qauthz_simple_new(const char *id,
-                                const char *identity,
-                                Error **errp)
-{
-    return QAUTHZ_SIMPLE(
-        object_new_with_props(TYPE_QAUTHZ_SIMPLE,
-                              object_get_objects_root(),
-                              id, errp,
-                              "identity", identity,
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_simple_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_SIMPLE,
-    .instance_size = sizeof(QAuthZSimple),
-    .instance_finalize = qauthz_simple_finalize,
-    .class_size = sizeof(QAuthZSimpleClass),
-    .class_init = qauthz_simple_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_simple_register_types(void)
-{
-    type_register_static(&qauthz_simple_info);
-}
-
-
-type_init(qauthz_simple_register_types);
--- a/authz/trace-events
+++ b/authz/trace-events
@@ -1,18 +0,0 @@
-# See docs/devel/tracing.txt for syntax documentation.
-
-# authz/base.c
-qauthz_is_allowed(void *authz, const char *identity, bool allowed) "AuthZ %p check identity=%s allowed=%d"
-
-# auth/simple.c
-qauthz_simple_is_allowed(void *authz, const char *wantidentity, const char *gotidentity) "AuthZ simple %p check want identity=%s got identity=%s"
-
-# auth/list.c
-qauthz_list_check_rule(void *authz, const char *identity, const char *rule, int format, int policy) "AuthZ list %p check rule=%s identity=%s format=%d policy=%d"
-qauthz_list_default_policy(void *authz, const char *identity, int policy) "AuthZ list %p default identity=%s policy=%d"
-
-# auth/listfile.c
-qauthz_list_file_load(void *authz, const char *filename) "AuthZ file %p load filename=%s"
-qauthz_list_file_refresh(void *authz, const char *filename, int success) "AuthZ file %p load filename=%s success=%d"
-
-# auth/pam.c
-qauthz_pam_check(void *authz, const char *identity, const char *service) "AuthZ PAM %p identity=%s service=%s"
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -43,7 +43,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);
 #ifdef CONFIG_POSIX
-    gchar *name;
+    gchar *path;
 #endif

    if (!backend->size) {
@@ -58,14 +58,14 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
    error_setg(errp, "-mem-path not supported on this host");
 #else
    backend->force_prealloc = mem_prealloc;
-    name = host_memory_backend_get_name(backend);
+    path = object_get_canonical_path(OBJECT(backend));
    memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
-                                     name,
+                                     path,
                                     backend->size, fb->align,
                                     (backend->share ? RAM_SHARED : 0) |
                                     (fb->is_pmem ? RAM_PMEM : 0),
                                     fb->mem_path, errp);
-    g_free(name);
+    g_free(path);
 #endif
 }

@@ -82,8 +82,7 @@ static void set_mem_path(Object *o, const char *str, Error **errp)
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(errp, "cannot change property 'mem-path' of %s",
-                   object_get_typename(o));
+        error_setg(errp, "cannot change property value");
        return;
    }
    g_free(fb->mem_path);
@@ -121,8 +120,7 @@ static void file_memory_backend_set_align(Object *o, Visitor *v,
    uint64_t val;

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(&local_err, "cannot change property '%s' of %s",
-                   name, object_get_typename(o));
+        error_setg(&local_err, "cannot change property value");
        goto out;
    }

@@ -147,20 +145,26 @@ static void file_memory_backend_set_pmem(Object *o, bool value, Error **errp)
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

    if (host_memory_backend_mr_inited(backend)) {
+        char *path = object_get_canonical_path_component(o);

-        error_setg(errp, "cannot change property 'pmem' of %s.",
-                   object_get_typename(o));
+        error_setg(errp, "cannot change property 'pmem' of %s '%s'",
+                   object_get_typename(o),
+                   path);
+        g_free(path);
        return;
    }

 #ifndef CONFIG_LIBPMEM
    if (value) {
        Error *local_err = NULL;
+        char *path = object_get_canonical_path_component(o);

        error_setg(&local_err,
                   "Lack of libpmem support while setting the 'pmem=on'"
-                   " of %s. We can't ensure data persistence.",
-                   object_get_typename(o));
+                   " of %s '%s'. We can't ensure data persistence.",
+                   object_get_typename(o),
+                   path);
+        g_free(path);
        error_propagate(errp, local_err);
        return;
    }
--- a/backends/hostmem-memfd.c
+++ b/backends/hostmem-memfd.c
@@ -53,7 +53,7 @@ memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
        return;
    }

-    name = host_memory_backend_get_name(backend);
+    name = object_get_canonical_path(OBJECT(backend));
    memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
                                   name, backend->size,
                                   backend->share, fd, errp);
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -16,20 +16,21 @@

 #define TYPE_MEMORY_BACKEND_RAM "memory-backend-ram"

+
 static void
 ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
-    char *name;
+    char *path;

    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
        return;
    }

-    name = host_memory_backend_get_name(backend);
-    memory_region_init_ram_shared_nomigrate(&backend->mr, OBJECT(backend), name,
+    path = object_get_canonical_path_component(OBJECT(backend));
+    memory_region_init_ram_shared_nomigrate(&backend->mr, OBJECT(backend), path,
                           backend->size, backend->share, errp);
-    g_free(name);
+    g_free(path);
 }

 static void
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -28,16 +28,6 @@ QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_BIND != MPOL_BIND);
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_INTERLEAVE != MPOL_INTERLEAVE);
 #endif

-char *
-host_memory_backend_get_name(HostMemoryBackend *backend)
-{
-    if (!backend->use_canonical_path) {
-        return object_get_canonical_path_component(OBJECT(backend));
-    }
-
-    return object_get_canonical_path(OBJECT(backend));
-}
-
 static void
 host_memory_backend_get_size(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
@@ -57,8 +47,7 @@ host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
    uint64_t value;

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(&local_err, "cannot change property %s of %s ",
-                   name, object_get_typename(obj));
+        error_setg(&local_err, "cannot change property value");
        goto out;
    }

@@ -67,9 +56,8 @@ host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
        goto out;
    }
    if (!value) {
-        error_setg(&local_err,
-                   "property '%s' of %s doesn't take value '%" PRIu64 "'",
-                   name, object_get_typename(obj), value);
+        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
+                   PRIu64 "'", object_get_typename(obj), name, value);
        goto out;
    }
    backend->size = value;
@@ -115,23 +103,14 @@ host_memory_backend_set_host_nodes(Object *obj, Visitor *v, const char *name,
 {
 #ifdef CONFIG_NUMA
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    uint16List *l, *host_nodes = NULL;
+    uint16List *l = NULL;

-    visit_type_uint16List(v, name, &host_nodes, errp);
+    visit_type_uint16List(v, name, &l, errp);

-    for (l = host_nodes; l; l = l->next) {
-        if (l->value >= MAX_NODES) {
-            error_setg(errp, "Invalid host-nodes value: %d", l->value);
-            goto out;
-        }
-    }
-
-    for (l = host_nodes; l; l = l->next) {
+    while (l) {
        bitmap_set(backend->host_nodes, l->value, 1);
+        l = l->next;
    }
-
-out:
-    qapi_free_uint16List(host_nodes);
 #else
    error_setg(errp, "NUMA node binding are not supported by this QEMU");
 #endif
@@ -259,11 +238,6 @@ static void host_memory_backend_init(Object *obj)
    backend->prealloc = mem_prealloc;
 }

-static void host_memory_backend_post_init(Object *obj)
-{
-    object_apply_compat_props(obj);
-}
-
 bool host_memory_backend_mr_inited(HostMemoryBackend *backend)
 {
    /*
@@ -412,23 +386,6 @@ static void host_memory_backend_set_share(Object *o, bool value, Error **errp)
    backend->share = value;
 }

-static bool
-host_memory_backend_get_use_canonical_path(Object *obj, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    return backend->use_canonical_path;
-}
-
-static void
-host_memory_backend_set_use_canonical_path(Object *obj, bool value,
-                                           Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    backend->use_canonical_path = value;
-}
-
 static void
 host_memory_backend_class_init(ObjectClass *oc, void *data)
 {
@@ -475,9 +432,6 @@ host_memory_backend_class_init(ObjectClass *oc, void *data)
        &error_abort);
    object_class_property_set_description(oc, "share",
        "Mark the memory as private to QEMU or shared", &error_abort);
-    object_class_property_add_bool(oc, "x-use-canonical-path-for-ramblock-id",
-        host_memory_backend_get_use_canonical_path,
-        host_memory_backend_set_use_canonical_path, &error_abort);
 }

 static const TypeInfo host_memory_backend_info = {
@@ -488,7 +442,6 @@ static const TypeInfo host_memory_backend_info = {
    .class_init = host_memory_backend_class_init,
    .instance_size = sizeof(HostMemoryBackend),
    .instance_init = host_memory_backend_init,
-    .instance_post_init = host_memory_backend_post_init,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
--- a/block.c
+++ b/block.c
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -57,8 +57,6 @@ ssh.o-libs         := $(LIBSSH2_LIBS)
 block-obj-dmg-bz2-$(CONFIG_BZIP2) += dmg-bz2.o
 block-obj-$(if $(CONFIG_DMG),m,n) += $(block-obj-dmg-bz2-y)
 dmg-bz2.o-libs     := $(BZIP2_LIBS)
-block-obj-$(if $(CONFIG_LZFSE),m,n) += dmg-lzfse.o
-dmg-lzfse.o-libs   := $(LZFSE_LIBS)
 qcow.o-libs        := -lz
 linux-aio.o-libs   := -laio
 parallels.o-cflags := $(LIBXML2_CFLAGS)
--- a/block/backup.c
+++ b/block/backup.c
@@ -28,13 +28,6 @@

 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)

-typedef struct CowRequest {
-    int64_t start_byte;
-    int64_t end_byte;
-    QLIST_ENTRY(CowRequest) list;
-    CoQueue wait_queue; /* coroutines blocked on this request */
-} CowRequest;
-
 typedef struct BackupBlockJob {
    BlockJob common;
    BlockBackend *target;
@@ -107,6 +100,7 @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
                                                      void **bounce_buffer)
 {
    int ret;
+    struct iovec iov;
    QEMUIOVector qiov;
    BlockBackend *blk = job->common.blk;
    int nbytes;
@@ -118,7 +112,9 @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
    if (!*bounce_buffer) {
        *bounce_buffer = blk_blockalign(blk, job->cluster_size);
    }
-    qemu_iovec_init_buf(&qiov, *bounce_buffer, nbytes);
+    iov.iov_base = *bounce_buffer;
+    iov.iov_len = nbytes;
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = blk_co_preadv(blk, start, qiov.size, &qiov, read_flags);
    if (ret < 0) {
@@ -326,6 +322,37 @@ void backup_do_checkpoint(BlockJob *job, Error **errp)
    hbitmap_set(backup_job->copy_bitmap, 0, len);
 }

+void backup_wait_for_overlapping_requests(BlockJob *job, int64_t offset,
+                                          uint64_t bytes)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t start, end;
+
+    assert(block_job_driver(job) == &backup_job_driver);
+
+    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
+    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    wait_for_overlapping_requests(backup_job, start, end);
+}
+
+void backup_cow_request_begin(CowRequest *req, BlockJob *job,
+                              int64_t offset, uint64_t bytes)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t start, end;
+
+    assert(block_job_driver(job) == &backup_job_driver);
+
+    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
+    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    cow_request_begin(req, backup_job, start, end);
+}
+
+void backup_cow_request_end(CowRequest *req)
+{
+    cow_request_end(req);
+}
+
 static void backup_drain(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
@@ -382,7 +409,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
    HBitmapIter hbi;

    hbitmap_iter_init(&hbi, job->copy_bitmap, 0);
-    while ((cluster = hbitmap_iter_next(&hbi)) != -1) {
+    while ((cluster = hbitmap_iter_next(&hbi, true)) != -1) {
        do {
            if (yield_and_check(job)) {
                return 0;
@@ -419,8 +446,7 @@ static void backup_incremental_init_copy_bitmap(BackupBlockJob *job)
            break;
        }

-        offset = bdrv_dirty_bitmap_next_zero(job->sync_bitmap, offset,
-                                             UINT64_MAX);
+        offset = bdrv_dirty_bitmap_next_zero(job->sync_bitmap, offset);
        if (offset == -1) {
            hbitmap_set(job->copy_bitmap, cluster, end - cluster);
            break;
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -811,37 +811,51 @@ static int64_t blkdebug_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

-static void blkdebug_refresh_filename(BlockDriverState *bs)
+static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkdebugState *s = bs->opaque;
+    QDict *opts;
    const QDictEntry *e;
-    int ret;
+    bool force_json = false;

-    if (!bs->file->bs->exact_filename[0]) {
-        return;
-    }
-
-    for (e = qdict_first(bs->full_open_options); e;
-         e = qdict_next(bs->full_open_options, e))
-    {
-        /* Real child options are under "image", but "x-image" may
-         * contain a filename */
+    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
        if (strcmp(qdict_entry_key(e), "config") &&
-            strcmp(qdict_entry_key(e), "image") &&
-            strcmp(qdict_entry_key(e), "x-image") &&
-            strcmp(qdict_entry_key(e), "driver"))
+            strcmp(qdict_entry_key(e), "x-image"))
        {
-            return;
+            force_json = true;
+            break;
        }
    }

-    ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                   "blkdebug:%s:%s",
-                   s->config_file ?: "", bs->file->bs->exact_filename);
-    if (ret >= sizeof(bs->exact_filename)) {
-        /* An overflow makes the filename unusable, so do not report any */
-        bs->exact_filename[0] = 0;
+    if (force_json && !bs->file->bs->full_open_options) {
+        /* The config file cannot be recreated, so creating a plain filename
+         * is impossible */
+        return;
    }
+
+    if (!force_json && bs->file->bs->exact_filename[0]) {
+        int ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                           "blkdebug:%s:%s", s->config_file ?: "",
+                           bs->file->bs->exact_filename);
+        if (ret >= sizeof(bs->exact_filename)) {
+            /* An overflow makes the filename unusable, so do not report any */
+            bs->exact_filename[0] = 0;
+        }
+    }
+
+    opts = qdict_new();
+    qdict_put_str(opts, "driver", "blkdebug");
+
+    qdict_put(opts, "image", qobject_ref(bs->file->bs->full_open_options));
+
+    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
+        if (strcmp(qdict_entry_key(e), "x-image")) {
+            qdict_put_obj(opts, qdict_entry_key(e),
+                          qobject_ref(qdict_entry_value(e)));
+        }
+    }
+
+    bs->full_open_options = opts;
 }

 static void blkdebug_refresh_limits(BlockDriverState *bs, Error **errp)
@@ -874,20 +888,6 @@ static int blkdebug_reopen_prepare(BDRVReopenState *reopen_state,
    return 0;
 }

-static const char *const blkdebug_strong_runtime_opts[] = {
-    "config",
-    "inject-error.",
-    "set-state.",
-    "align",
-    "max-transfer",
-    "opt-write-zero",
-    "max-write-zero",
-    "opt-discard",
-    "max-discard",
-
-    NULL
-};
-
 static BlockDriver bdrv_blkdebug = {
    .format_name            = "blkdebug",
    .protocol_name          = "blkdebug",
@@ -917,8 +917,6 @@ static BlockDriver bdrv_blkdebug = {
                                = blkdebug_debug_remove_breakpoint,
    .bdrv_debug_resume          = blkdebug_debug_resume,
    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
-
-    .strong_runtime_opts        = blkdebug_strong_runtime_opts,
 };

 static void bdrv_blkdebug_init(void)
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -280,6 +280,31 @@ static int64_t blk_log_writes_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

+static void blk_log_writes_refresh_filename(BlockDriverState *bs,
+                                            QDict *options)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+
+    /* bs->file->bs has already been refreshed */
+    bdrv_refresh_filename(s->log_file->bs);
+
+    if (bs->file->bs->full_open_options
+        && s->log_file->bs->full_open_options)
+    {
+        QDict *opts = qdict_new();
+        qdict_put_str(opts, "driver", "blklogwrites");
+
+        qobject_ref(bs->file->bs->full_open_options);
+        qdict_put_obj(opts, "file", QOBJECT(bs->file->bs->full_open_options));
+        qobject_ref(s->log_file->bs->full_open_options);
+        qdict_put_obj(opts, "log",
+                      QOBJECT(s->log_file->bs->full_open_options));
+        qdict_put_int(opts, "log-sector-size", s->sectorsize);
+
+        bs->full_open_options = opts;
+    }
+}
+
 static void blk_log_writes_child_perm(BlockDriverState *bs, BdrvChild *c,
                                      const BdrvChildRole *role,
                                      BlockReopenQueue *ro_q,
@@ -496,13 +521,6 @@ blk_log_writes_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
                                 LOG_DISCARD_FLAG, false);
 }

-static const char *const blk_log_writes_strong_runtime_opts[] = {
-    "log-append",
-    "log-sector-size",
-
-    NULL
-};
-
 static BlockDriver bdrv_blk_log_writes = {
    .format_name            = "blklogwrites",
    .instance_size          = sizeof(BDRVBlkLogWritesState),
@@ -510,6 +528,7 @@ static BlockDriver bdrv_blk_log_writes = {
    .bdrv_open              = blk_log_writes_open,
    .bdrv_close             = blk_log_writes_close,
    .bdrv_getlength         = blk_log_writes_getlength,
+    .bdrv_refresh_filename  = blk_log_writes_refresh_filename,
    .bdrv_child_perm        = blk_log_writes_child_perm,
    .bdrv_refresh_limits    = blk_log_writes_refresh_limits,

@@ -521,7 +540,6 @@ static BlockDriver bdrv_blk_log_writes = {
    .bdrv_co_block_status   = bdrv_co_block_status_from_file,

    .is_filter              = true,
-    .strong_runtime_opts    = blk_log_writes_strong_runtime_opts,
 };

 static void bdrv_blk_log_writes_init(void)
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -281,10 +281,27 @@ static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
    return bdrv_recurse_is_first_non_filter(s->test_file->bs, candidate);
 }

-static void blkverify_refresh_filename(BlockDriverState *bs)
+static void blkverify_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkverifyState *s = bs->opaque;

+    /* bs->file->bs has already been refreshed */
+    bdrv_refresh_filename(s->test_file->bs);
+
+    if (bs->file->bs->full_open_options
+        && s->test_file->bs->full_open_options)
+    {
+        QDict *opts = qdict_new();
+        qdict_put_str(opts, "driver", "blkverify");
+
+        qdict_put(opts, "raw",
+                  qobject_ref(bs->file->bs->full_open_options));
+        qdict_put(opts, "test",
+                  qobject_ref(s->test_file->bs->full_open_options));
+
+        bs->full_open_options = opts;
+    }
+
    if (bs->file->bs->exact_filename[0]
        && s->test_file->bs->exact_filename[0])
    {
@@ -299,15 +316,6 @@ static void blkverify_refresh_filename(BlockDriverState *bs)
    }
 }

-static char *blkverify_dirname(BlockDriverState *bs, Error **errp)
-{
-    /* In general, there are two BDSs with different dirnames below this one;
-     * so there is no unique dirname we could return (unless both are equal by
-     * chance). Therefore, to be consistent, just always return NULL. */
-    error_setg(errp, "Cannot generate a base directory for blkverify nodes");
-    return NULL;
-}
-
 static BlockDriver bdrv_blkverify = {
    .format_name                      = "blkverify",
    .protocol_name                    = "blkverify",
@@ -319,7 +327,6 @@ static BlockDriver bdrv_blkverify = {
    .bdrv_child_perm                  = bdrv_filter_default_perms,
    .bdrv_getlength                   = blkverify_getlength,
    .bdrv_refresh_filename            = blkverify_refresh_filename,
-    .bdrv_dirname                     = blkverify_dirname,

    .bdrv_co_preadv                   = blkverify_co_preadv,
    .bdrv_co_pwritev                  = blkverify_co_pwritev,
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -47,7 +47,9 @@ struct BlockBackend {
    QTAILQ_ENTRY(BlockBackend) monitor_link; /* for monitor_block_backends */
    BlockBackendPublic public;

-    DeviceState *dev;           /* attached device model, if any */
+    void *dev;                  /* attached device model, if any */
+    bool legacy_dev;            /* true if dev is not a DeviceState */
+    /* TODO change to DeviceState when all users are qdevified */
    const BlockDevOps *dev_ops;
    void *dev_opaque;

@@ -834,11 +836,7 @@ void blk_get_perm(BlockBackend *blk, uint64_t *perm, uint64_t *shared_perm)
    *shared_perm = blk->shared_perm;
 }

-/*
- * Attach device model @dev to @blk.
- * Return 0 on success, -EBUSY when a device model is attached already.
- */
-int blk_attach_dev(BlockBackend *blk, DeviceState *dev)
+static int blk_do_attach_dev(BlockBackend *blk, void *dev)
 {
    if (blk->dev) {
        return -EBUSY;
@@ -853,16 +851,40 @@ int blk_attach_dev(BlockBackend *blk, DeviceState *dev)

    blk_ref(blk);
    blk->dev = dev;
+    blk->legacy_dev = false;
    blk_iostatus_reset(blk);

    return 0;
 }

+/*
+ * Attach device model @dev to @blk.
+ * Return 0 on success, -EBUSY when a device model is attached already.
+ */
+int blk_attach_dev(BlockBackend *blk, DeviceState *dev)
+{
+    return blk_do_attach_dev(blk, dev);
+}
+
+/*
+ * Attach device model @dev to @blk.
+ * @blk must not have a device model attached already.
+ * TODO qdevified devices don't use this, remove when devices are qdevified
+ */
+void blk_attach_dev_legacy(BlockBackend *blk, void *dev)
+{
+    if (blk_do_attach_dev(blk, dev) < 0) {
+        abort();
+    }
+    blk->legacy_dev = true;
+}
+
 /*
 * Detach device model @dev from @blk.
 * @dev must be currently attached to @blk.
 */
-void blk_detach_dev(BlockBackend *blk, DeviceState *dev)
+void blk_detach_dev(BlockBackend *blk, void *dev)
+/* TODO change to DeviceState *dev when all users are qdevified */
 {
    assert(blk->dev == dev);
    blk->dev = NULL;
@@ -876,7 +898,8 @@ void blk_detach_dev(BlockBackend *blk, DeviceState *dev)
 /*
 * Return the device model attached to @blk if any, else null.
 */
-DeviceState *blk_get_attached_dev(BlockBackend *blk)
+void *blk_get_attached_dev(BlockBackend *blk)
+/* TODO change to return DeviceState * when all users are qdevified */
 {
    return blk->dev;
 }
@@ -885,7 +908,10 @@ DeviceState *blk_get_attached_dev(BlockBackend *blk)
 * device attached to the BlockBackend. */
 char *blk_get_attached_dev_id(BlockBackend *blk)
 {
-    DeviceState *dev = blk->dev;
+    DeviceState *dev;
+
+    assert(!blk->legacy_dev);
+    dev = blk->dev;

    if (!dev) {
        return g_strdup("");
@@ -923,6 +949,11 @@ BlockBackend *blk_by_dev(void *dev)
 void blk_set_dev_ops(BlockBackend *blk, const BlockDevOps *ops,
                     void *opaque)
 {
+    /* All drivers that use blk_set_dev_ops() are qdevified and we want to keep
+     * it that way, so we can assume blk->dev, if present, is a DeviceState if
+     * blk->dev_ops is set. Non-device users may use dev_ops without device. */
+    assert(!blk->legacy_dev);
+
    blk->dev_ops = ops;
    blk->dev_opaque = opaque;

@@ -948,6 +979,8 @@ void blk_dev_change_media_cb(BlockBackend *blk, bool load, Error **errp)
        bool tray_was_open, tray_is_open;
        Error *local_err = NULL;

+        assert(!blk->legacy_dev);
+
        tray_was_open = blk_dev_is_tray_open(blk);
        blk->dev_ops->change_media_cb(blk->dev_opaque, load, &local_err);
        if (local_err) {
@@ -1204,8 +1237,17 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
                   int64_t bytes, CoroutineEntry co_entry,
                   BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-    BlkRwCo rwco = {
+    QEMUIOVector qiov;
+    struct iovec iov;
+    BlkRwCo rwco;
+
+    iov = (struct iovec) {
+        .iov_base = buf,
+        .iov_len = bytes,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
+    rwco = (BlkRwCo) {
        .blk    = blk,
        .offset = offset,
        .iobuf  = &qiov,
@@ -1253,12 +1295,12 @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
    return bdrv_make_zero(blk->root, flags);
 }

-void blk_inc_in_flight(BlockBackend *blk)
+static void blk_inc_in_flight(BlockBackend *blk)
 {
    atomic_inc(&blk->in_flight);
 }

-void blk_dec_in_flight(BlockBackend *blk)
+static void blk_dec_in_flight(BlockBackend *blk)
 {
    atomic_dec(&blk->in_flight);
    aio_wait_kick();
@@ -1741,6 +1783,9 @@ void blk_eject(BlockBackend *blk, bool eject_flag)
    BlockDriverState *bs = blk_bs(blk);
    char *id;

+    /* blk_eject is only called by qdevified devices */
+    assert(!blk->legacy_dev);
+
    if (bs) {
        bdrv_eject(bs, eject_flag);
    }
@@ -2209,8 +2254,3 @@ int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
                              blk_out->root, off_out,
                              bytes, read_flags, write_flags);
 }
-
-const BdrvChild *blk_root(BlockBackend *blk)
-{
-    return blk->root;
-}
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -85,14 +85,14 @@ static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
    const struct bochs_header *bochs = (const void *)buf;

    if (buf_size < HEADER_SIZE)
-        return 0;
+	return 0;

    if (!strcmp(bochs->magic, HEADER_MAGIC) &&
-        !strcmp(bochs->type, REDOLOG_TYPE) &&
-        !strcmp(bochs->subtype, GROWING_TYPE) &&
-        ((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
-        (le32_to_cpu(bochs->version) == HEADER_V1)))
-        return 100;
+	!strcmp(bochs->type, REDOLOG_TYPE) &&
+	!strcmp(bochs->subtype, GROWING_TYPE) &&
+	((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
+	(le32_to_cpu(bochs->version) == HEADER_V1)))
+	return 100;

    return 0;
 }
@@ -125,8 +125,8 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
    if (strcmp(bochs.magic, HEADER_MAGIC) ||
        strcmp(bochs.type, REDOLOG_TYPE) ||
        strcmp(bochs.subtype, GROWING_TYPE) ||
-        ((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
-        (le32_to_cpu(bochs.version) != HEADER_V1))) {
+	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
+	(le32_to_cpu(bochs.version) != HEADER_V1))) {
        error_setg(errp, "Image not in Bochs format");
        return -EINVAL;
    }
@@ -158,7 +158,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
    }

    for (i = 0; i < s->catalog_size; i++)
-        le32_to_cpus(&s->catalog_bitmap[i]);
+	le32_to_cpus(&s->catalog_bitmap[i]);

    s->data_offset = le32_to_cpu(bochs.header) + (s->catalog_size * 4);

@@ -217,7 +217,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    extent_offset = (offset % s->extent_size) / 512;

    if (s->catalog_bitmap[extent_index] == 0xffffffff) {
-        return 0; /* not allocated */
+	return 0; /* not allocated */
    }

    bitmap_offset = s->data_offset +
@@ -232,7 +232,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    }

    if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
-        return 0; /* not allocated */
+	return 0; /* not allocated */
    }

    return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
--- a/block/commit.c
+++ b/block/commit.c
@@ -38,7 +38,7 @@ typedef struct CommitBlockJob {
    BlockBackend *base;
    BlockDriverState *base_bs;
    BlockdevOnError on_error;
-    bool base_read_only;
+    int base_flags;
    char *backing_file_str;
 } CommitBlockJob;

@@ -47,9 +47,14 @@ static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
                                        void *buf)
 {
    int ret = 0;
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = buf,
+        .iov_len = bytes,
+    };

    assert(bytes < SIZE_MAX);
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = blk_co_preadv(bs, offset, qiov.size, &qiov, 0);
    if (ret < 0) {
@@ -119,8 +124,8 @@ static void commit_clean(Job *job)
    /* restore base open flags here if appropriate (e.g., change the base back
     * to r/o). These reopens do not need to be atomic, since we won't abort
     * even on failure here */
-    if (s->base_read_only) {
-        bdrv_reopen_set_read_only(s->base_bs, true, NULL);
+    if (s->base_flags != bdrv_get_flags(s->base_bs)) {
+        bdrv_reopen(s->base_bs, s->base_flags, NULL);
    }

    g_free(s->backing_file_str);
@@ -225,8 +230,9 @@ static int coroutine_fn bdrv_commit_top_preadv(BlockDriverState *bs,
    return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
 }

-static void bdrv_commit_top_refresh_filename(BlockDriverState *bs)
+static void bdrv_commit_top_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
+    bdrv_refresh_filename(bs->backing->bs);
    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
            bs->backing->bs->filename);
 }
@@ -258,6 +264,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
                  const char *filter_node_name, Error **errp)
 {
    CommitBlockJob *s;
+    int orig_base_flags;
    BlockDriverState *iter;
    BlockDriverState *commit_top_bs = NULL;
    Error *local_err = NULL;
@@ -276,9 +283,11 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    }

    /* convert base to r/w, if necessary */
-    s->base_read_only = bdrv_is_read_only(base);
-    if (s->base_read_only) {
-        if (bdrv_reopen_set_read_only(base, false, errp) != 0) {
+    orig_base_flags = bdrv_get_flags(base);
+    if (!(orig_base_flags & BDRV_O_RDWR)) {
+        bdrv_reopen(base, orig_base_flags | BDRV_O_RDWR, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
            goto fail;
        }
    }
@@ -354,6 +363,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

+    s->base_flags = orig_base_flags;
    s->backing_file_str = g_strdup(backing_file_str);
    s->on_error = on_error;

@@ -368,12 +378,10 @@ fail:
    if (s->top) {
        blk_unref(s->top);
    }
-    job_early_fail(&s->common.job);
-    /* commit_top_bs has to be replaced after deleting the block job,
-     * otherwise this would fail because of lack of permissions. */
    if (commit_top_bs) {
        bdrv_replace_node(commit_top_bs, top, &error_abort);
    }
+    job_early_fail(&s->common.job);
 }


@@ -387,7 +395,7 @@ int bdrv_commit(BlockDriverState *bs)
    BlockDriverState *commit_top_bs = NULL;
    BlockDriver *drv = bs->drv;
    int64_t offset, length, backing_length;
-    int ro;
+    int ro, open_flags;
    int64_t n;
    int ret = 0;
    uint8_t *buf = NULL;
@@ -406,9 +414,10 @@ int bdrv_commit(BlockDriverState *bs)
    }

    ro = bs->backing->bs->read_only;
+    open_flags =  bs->backing->bs->open_flags;

    if (ro) {
-        if (bdrv_reopen_set_read_only(bs->backing->bs, false, NULL)) {
+        if (bdrv_reopen(bs->backing->bs, open_flags | BDRV_O_RDWR, NULL)) {
            return -EACCES;
        }
    }
@@ -518,7 +527,7 @@ ro_cleanup:

    if (ro) {
        /* ignoring error return here */
-        bdrv_reopen_set_read_only(bs->backing->bs, true, NULL);
+        bdrv_reopen(bs->backing->bs, open_flags & ~BDRV_O_RDWR, NULL);
    }

    return ret;
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -229,7 +229,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
                                       block_crypto_read_func,
                                       bs,
                                       cflags,
-                                       1,
                                       errp);

    if (!crypto->block) {
@@ -594,17 +593,20 @@ static int block_crypto_get_info_luks(BlockDriverState *bs,
 }

 static ImageInfoSpecific *
-block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp)
+block_crypto_get_specific_info_luks(BlockDriverState *bs)
 {
    BlockCrypto *crypto = bs->opaque;
    ImageInfoSpecific *spec_info;
    QCryptoBlockInfo *info;

-    info = qcrypto_block_get_info(crypto->block, errp);
+    info = qcrypto_block_get_info(crypto->block, NULL);
    if (!info) {
        return NULL;
    }
-    assert(info->format == Q_CRYPTO_BLOCK_FORMAT_LUKS);
+    if (info->format != Q_CRYPTO_BLOCK_FORMAT_LUKS) {
+        qapi_free_QCryptoBlockInfo(info);
+        return NULL;
+    }

    spec_info = g_new(ImageInfoSpecific, 1);
    spec_info->type = IMAGE_INFO_SPECIFIC_KIND_LUKS;
@@ -619,12 +621,6 @@ block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp)
    return spec_info;
 }

-static const char *const block_crypto_strong_runtime_opts[] = {
-    BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
-
-    NULL
-};
-
 BlockDriver bdrv_crypto_luks = {
    .format_name        = "luks",
    .instance_size      = sizeof(BlockCrypto),
@@ -646,8 +642,6 @@ BlockDriver bdrv_crypto_luks = {
    .bdrv_getlength     = block_crypto_getlength,
    .bdrv_get_info      = block_crypto_get_info_luks,
    .bdrv_get_specific_info = block_crypto_get_specific_info_luks,
-
-    .strong_runtime_opts = block_crypto_strong_runtime_opts,
 };

 static void block_crypto_init(void)
--- a/block/curl.c
+++ b/block/curl.c
@@ -32,10 +32,22 @@
 #include "crypto/secret.h"
 #include <curl/curl.h>
 #include "qemu/cutils.h"
-#include "trace.h"

+// #define DEBUG_CURL
 // #define DEBUG_VERBOSE

+#ifdef DEBUG_CURL
+#define DEBUG_CURL_PRINT 1
+#else
+#define DEBUG_CURL_PRINT 0
+#endif
+#define DPRINTF(fmt, ...)                                            \
+    do {                                                             \
+        if (DEBUG_CURL_PRINT) {                                      \
+            fprintf(stderr, fmt, ## __VA_ARGS__);                    \
+        }                                                            \
+    } while (0)
+
 #if LIBCURL_VERSION_NUM >= 0x071000
 /* The multi interface timer callback was introduced in 7.16.0 */
 #define NEED_CURL_TIMER_CALLBACK
@@ -61,6 +73,8 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,

 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
+#define READ_AHEAD_DEFAULT (256 * 1024)
+#define CURL_TIMEOUT_DEFAULT 5
 #define CURL_TIMEOUT_MAX 10000

 #define CURL_BLOCK_OPT_URL       "url"
@@ -74,10 +88,6 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 #define CURL_BLOCK_OPT_PROXY_USERNAME "proxy-username"
 #define CURL_BLOCK_OPT_PROXY_PASSWORD_SECRET "proxy-password-secret"

-#define CURL_BLOCK_OPT_READAHEAD_DEFAULT (256 * 1024)
-#define CURL_BLOCK_OPT_SSLVERIFY_DEFAULT true
-#define CURL_BLOCK_OPT_TIMEOUT_DEFAULT 5
-
 struct BDRVCURLState;

 static bool libcurl_initialized;
@@ -144,7 +154,7 @@ static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
 {
    BDRVCURLState *s = opaque;

-    trace_curl_timer_cb(timeout_ms);
+    DPRINTF("CURL: timer callback timeout_ms %ld\n", timeout_ms);
    if (timeout_ms == -1) {
        timer_del(&s->timer);
    } else {
@@ -183,7 +193,7 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    }
    socket = NULL;

-    trace_curl_sock_cb(action, (int)fd);
+    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, (int)fd);
    switch (action) {
        case CURL_POLL_IN:
            aio_set_fd_handler(s->aio_context, fd, false,
@@ -228,7 +238,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
    size_t realsize = size * nmemb;
    int i;

-    trace_curl_read_cb(realsize);
+    DPRINTF("CURL: Just reading %zd bytes\n", realsize);

    if (!s || !s->orig_buf) {
        goto read_end;
@@ -698,7 +708,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    s->readahead_size = qemu_opt_get_size(opts, CURL_BLOCK_OPT_READAHEAD,
-                                          CURL_BLOCK_OPT_READAHEAD_DEFAULT);
+                                          READ_AHEAD_DEFAULT);
    if ((s->readahead_size & 0x1ff) != 0) {
        error_setg(errp, "HTTP_READAHEAD_SIZE %zd is not a multiple of 512",
                   s->readahead_size);
@@ -706,14 +716,13 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    s->timeout = qemu_opt_get_number(opts, CURL_BLOCK_OPT_TIMEOUT,
-                                     CURL_BLOCK_OPT_TIMEOUT_DEFAULT);
+                                     CURL_TIMEOUT_DEFAULT);
    if (s->timeout > CURL_TIMEOUT_MAX) {
        error_setg(errp, "timeout parameter is too large or negative");
        goto out_noclean;
    }

-    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY,
-                                     CURL_BLOCK_OPT_SSLVERIFY_DEFAULT);
+    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY, true);

    cookie = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE);
    cookie_secret = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE_SECRET);
@@ -768,7 +777,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
        }
    }

-    trace_curl_open(file);
+    DPRINTF("CURL: Opening %s\n", file);
    qemu_co_queue_init(&s->free_state_waitq);
    s->aio_context = bdrv_get_aio_context(bs);
    s->url = g_strdup(file);
@@ -821,7 +830,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
                "Server does not support 'range' (byte ranges).");
        goto out;
    }
-    trace_curl_open_size(s->len);
+    DPRINTF("CURL: Size = %" PRIu64 "\n", s->len);

    qemu_mutex_lock(&s->mutex);
    curl_clean_state(state);
@@ -899,7 +908,8 @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
    state->acb[0] = acb;

    snprintf(state->range, 127, "%" PRIu64 "-%" PRIu64, start, end);
-    trace_curl_setup_preadv(acb->bytes, start, state->range);
+    DPRINTF("CURL (AIO): Reading %" PRIu64 " at %" PRIu64 " (%s)\n",
+            acb->bytes, start, state->range);
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
@@ -933,7 +943,7 @@ static void curl_close(BlockDriverState *bs)
 {
    BDRVCURLState *s = bs->opaque;

-    trace_curl_close();
+    DPRINTF("CURL: Close\n");
    curl_detach_aio_context(bs);
    qemu_mutex_destroy(&s->mutex);

@@ -950,36 +960,6 @@ static int64_t curl_getlength(BlockDriverState *bs)
    return s->len;
 }

-static void curl_refresh_filename(BlockDriverState *bs)
-{
-    BDRVCURLState *s = bs->opaque;
-
-    /* "readahead" and "timeout" do not change the guest-visible data,
-     * so ignore them */
-    if (s->sslverify != CURL_BLOCK_OPT_SSLVERIFY_DEFAULT ||
-        s->cookie || s->username || s->password || s->proxyusername ||
-        s->proxypassword)
-    {
-        return;
-    }
-
-    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), s->url);
-}
-
-
-static const char *const curl_strong_runtime_opts[] = {
-    CURL_BLOCK_OPT_URL,
-    CURL_BLOCK_OPT_SSLVERIFY,
-    CURL_BLOCK_OPT_COOKIE,
-    CURL_BLOCK_OPT_COOKIE_SECRET,
-    CURL_BLOCK_OPT_USERNAME,
-    CURL_BLOCK_OPT_PASSWORD_SECRET,
-    CURL_BLOCK_OPT_PROXY_USERNAME,
-    CURL_BLOCK_OPT_PROXY_PASSWORD_SECRET,
-
-    NULL
-};
-
 static BlockDriver bdrv_http = {
    .format_name                = "http",
    .protocol_name              = "http",
@@ -994,9 +974,6 @@ static BlockDriver bdrv_http = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_https = {
@@ -1013,9 +990,6 @@ static BlockDriver bdrv_https = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_ftp = {
@@ -1032,9 +1006,6 @@ static BlockDriver bdrv_ftp = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_ftps = {
@@ -1051,9 +1022,6 @@ static BlockDriver bdrv_ftps = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static void curl_block_init(void)
--- a/block/dirty-bitmap.c
+++ b/block/dirty-bitmap.c
@@ -29,20 +29,12 @@
 #include "block/blockjob.h"

 /**
- * A BdrvDirtyBitmap can be in four possible user-visible states:
- * (1) Active:   successor is NULL, and disabled is false: full r/w mode
- * (2) Disabled: successor is NULL, and disabled is true: qualified r/w mode,
- *               guest writes are dropped, but monitor writes are possible,
- *               through commands like merge and clear.
- * (3) Frozen:   successor is not NULL.
- *               A frozen bitmap cannot be renamed, deleted, cleared, set,
- *               enabled, merged to, etc. A frozen bitmap can only abdicate()
- *               or reclaim().
- *               In this state, the anonymous successor bitmap may be either
- *               Active and recording writes from the guest (e.g. backup jobs),
- *               but it can be Disabled and not recording writes.
- * (4) Locked:   Whether Active or Disabled, the user cannot modify this bitmap
- *               in any way from the monitor.
+ * A BdrvDirtyBitmap can be in three possible states:
+ * (1) successor is NULL and disabled is false: full r/w mode
+ * (2) successor is NULL and disabled is true: read only mode ("disabled")
+ * (3) successor is set: frozen mode.
+ *     A frozen bitmap cannot be renamed, deleted, anonymized, cleared, set,
+ *     or enabled. A frozen bitmap can only abdicate() or reclaim().
 */
 struct BdrvDirtyBitmap {
    QemuMutex *mutex;
@@ -448,7 +440,6 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
        info->has_name = !!bm->name;
        info->name = g_strdup(bm->name);
        info->status = bdrv_dirty_bitmap_status(bm);
-        info->persistent = bm->persistent;
        entry->value = info;
        *plist = entry;
        plist = &entry->next;
@@ -524,7 +515,62 @@ void bdrv_dirty_iter_free(BdrvDirtyBitmapIter *iter)

 int64_t bdrv_dirty_iter_next(BdrvDirtyBitmapIter *iter)
 {
-    return hbitmap_iter_next(&iter->hbi);
+    return hbitmap_iter_next(&iter->hbi, true);
+}
+
+/**
+ * Return the next consecutively dirty area in the dirty bitmap
+ * belonging to the given iterator @iter.
+ *
+ * @max_offset: Maximum value that may be returned for
+ *              *offset + *bytes
+ * @offset:     Will contain the start offset of the next dirty area
+ * @bytes:      Will contain the length of the next dirty area
+ *
+ * Returns: True if a dirty area could be found before max_offset
+ *          (which means that *offset and *bytes then contain valid
+ *          values), false otherwise.
+ *
+ * Note that @iter is never advanced if false is returned.  If an area
+ * is found (which means that true is returned), it will be advanced
+ * past that area.
+ */
+bool bdrv_dirty_iter_next_area(BdrvDirtyBitmapIter *iter, uint64_t max_offset,
+                               uint64_t *offset, int *bytes)
+{
+    uint32_t granularity = bdrv_dirty_bitmap_granularity(iter->bitmap);
+    uint64_t gran_max_offset;
+    int64_t ret;
+    int size;
+
+    if (max_offset == iter->bitmap->size) {
+        /* If max_offset points to the image end, round it up by the
+         * bitmap granularity */
+        gran_max_offset = ROUND_UP(max_offset, granularity);
+    } else {
+        gran_max_offset = max_offset;
+    }
+
+    ret = hbitmap_iter_next(&iter->hbi, false);
+    if (ret < 0 || ret + granularity > gran_max_offset) {
+        return false;
+    }
+
+    *offset = ret;
+    size = 0;
+
+    assert(granularity <= INT_MAX);
+
+    do {
+        /* Advance iterator */
+        ret = hbitmap_iter_next(&iter->hbi, true);
+        size += granularity;
+    } while (ret + granularity <= gran_max_offset &&
+             hbitmap_iter_next(&iter->hbi, false) == ret + granularity &&
+             size <= INT_MAX - granularity);
+
+    *bytes = MIN(size, max_offset - *offset);
+    return true;
 }

 /* Called within bdrv_dirty_bitmap_lock..unlock */
@@ -579,6 +625,7 @@ void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
 void bdrv_restore_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *backup)
 {
    HBitmap *tmp = bitmap->bitmap;
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    bitmap->bitmap = backup;
    hbitmap_free(tmp);
@@ -735,16 +782,9 @@ char *bdrv_dirty_bitmap_sha256(const BdrvDirtyBitmap *bitmap, Error **errp)
    return hbitmap_sha256(bitmap->bitmap, errp);
 }

-int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, uint64_t offset,
-                                    uint64_t bytes)
+int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, uint64_t offset)
 {
-    return hbitmap_next_zero(bitmap->bitmap, offset, bytes);
-}
-
-bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
-                                       uint64_t *offset, uint64_t *bytes)
-{
-    return hbitmap_next_dirty_area(bitmap->bitmap, offset, bytes);
+    return hbitmap_next_zero(bitmap->bitmap, offset);
 }

 void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
--- a/block/dmg-lzfse.c
+++ b/block/dmg-lzfse.c
@@ -1,49 +0,0 @@
-/*
- * DMG lzfse uncompression
- *
- * Copyright (c) 2018 Julio Cesar Faracco
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "dmg.h"
-#include <lzfse.h>
-
-static int dmg_uncompress_lzfse_do(char *next_in, unsigned int avail_in,
-                                   char *next_out, unsigned int avail_out)
-{
-    size_t out_size = lzfse_decode_buffer((uint8_t *) next_out, avail_out,
-                                          (uint8_t *) next_in, avail_in,
-                                          NULL);
-
-    /* We need to decode the single chunk only. */
-    /* So, out_size == avail_out is not an error here. */
-    if (out_size > 0) {
-        return out_size;
-    }
-    return -1;
-}
-
-__attribute__((constructor))
-static void dmg_lzfse_init(void)
-{
-    assert(!dmg_uncompress_lzfse);
-    dmg_uncompress_lzfse = dmg_uncompress_lzfse_do;
-}
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -33,9 +33,6 @@
 int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
                          char *next_out, unsigned int avail_out);

-int (*dmg_uncompress_lzfse)(char *next_in, unsigned int avail_in,
-                            char *next_out, unsigned int avail_out);
-
 enum {
    /* Limit chunk sizes to prevent unreasonable amounts of memory being used
     * or truncating when converting to 32-bit types
@@ -44,19 +41,6 @@ enum {
    DMG_SECTORCOUNTS_MAX = DMG_LENGTHS_MAX / 512,
 };

-enum {
-    /* DMG Block Type */
-    UDZE = 0, /* Zeroes */
-    UDRW,     /* RAW type */
-    UDIG,     /* Ignore */
-    UDCO = 0x80000004,
-    UDZO,
-    UDBZ,
-    ULFO,
-    UDCM = 0x7ffffffe, /* Comments */
-    UDLE = 0xffffffff  /* Last Entry */
-};
-
 static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    int len;
@@ -121,17 +105,15 @@ static void update_max_chunk_size(BDRVDMGState *s, uint32_t chunk,
    uint32_t uncompressed_sectors = 0;

    switch (s->types[chunk]) {
-    case UDZO: /* zlib compressed */
-    case UDBZ: /* bzip2 compressed */
-    case ULFO: /* lzfse compressed */
+    case 0x80000005: /* zlib compressed */
+    case 0x80000006: /* bzip2 compressed */
        compressed_size = s->lengths[chunk];
        uncompressed_sectors = s->sectorcounts[chunk];
        break;
-    case UDRW: /* copy */
+    case 1: /* copy */
        uncompressed_sectors = DIV_ROUND_UP(s->lengths[chunk], 512);
        break;
-    case UDZE: /* zero */
-    case UDIG: /* ignore */
+    case 2: /* zero */
        /* as the all-zeroes block may be large, it is treated specially: the
         * sector is not copied from a large buffer, a simple memset is used
         * instead. Therefore uncompressed_sectors does not need to be set. */
@@ -200,15 +182,12 @@ typedef struct DmgHeaderState {
 static bool dmg_is_known_block_type(uint32_t entry_type)
 {
    switch (entry_type) {
-    case UDZE:    /* zeros */
-    case UDRW:    /* uncompressed */
-    case UDIG:    /* ignore */
-    case UDZO:    /* zlib */
+    case 0x00000001:    /* uncompressed */
+    case 0x00000002:    /* zeroes */
+    case 0x80000005:    /* zlib */
        return true;
-    case UDBZ:    /* bzip2 */
+    case 0x80000006:    /* bzip2 */
        return !!dmg_uncompress_bz2;
-    case ULFO:    /* lzfse */
-        return !!dmg_uncompress_lzfse;
    default:
        return false;
    }
@@ -267,10 +246,9 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
        /* sector count */
        s->sectorcounts[i] = buff_read_uint64(buffer, offset + 0x10);

-        /* all-zeroes sector (type UDZE and UDIG) does not need to be
-         * "uncompressed" and can therefore be unbounded. */
-        if (s->types[i] != UDZE && s->types[i] != UDIG
-            && s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
+        /* all-zeroes sector (type 2) does not need to be "uncompressed" and can
+         * therefore be unbounded. */
+        if (s->types[i] != 2 && s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
            error_report("sector count %" PRIu64 " for chunk %" PRIu32
                         " is larger than max (%u)",
                         s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
@@ -447,7 +425,6 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    }

    block_module_load_one("dmg-bz2");
-    block_module_load_one("dmg-lzfse");

    s->n_chunks = 0;
    s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL;
@@ -575,20 +552,16 @@ static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)
 {
    /* binary search */
    uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
-    while (chunk1 <= chunk2) {
+    while (chunk1 != chunk2) {
        chunk3 = (chunk1 + chunk2) / 2;
        if (s->sectors[chunk3] > sector_num) {
-            if (chunk3 == 0) {
-                goto err;
-            }
-            chunk2 = chunk3 - 1;
+            chunk2 = chunk3;
        } else if (s->sectors[chunk3] + s->sectorcounts[chunk3] > sector_num) {
            return chunk3;
        } else {
-            chunk1 = chunk3 + 1;
+            chunk1 = chunk3;
        }
    }
-err:
    return s->n_chunks; /* error */
 }

@@ -606,7 +579,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)

        s->current_chunk = s->n_chunks;
        switch (s->types[chunk]) { /* block entry type */
-        case UDZO: { /* zlib compressed */
+        case 0x80000005: { /* zlib compressed */
            /* we need to buffer, because only the chunk as whole can be
             * inflated. */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
@@ -629,7 +602,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return -1;
            }
            break; }
-        case UDBZ: /* bzip2 compressed */
+        case 0x80000006: /* bzip2 compressed */
            if (!dmg_uncompress_bz2) {
                break;
            }
@@ -650,36 +623,14 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return ret;
            }
            break;
-        case ULFO:
-            if (!dmg_uncompress_lzfse) {
-                break;
-            }
-            /* we need to buffer, because only the chunk as whole can be
-             * inflated. */
-            ret = bdrv_pread(bs->file, s->offsets[chunk],
-                             s->compressed_chunk, s->lengths[chunk]);
-            if (ret != s->lengths[chunk]) {
-                return -1;
-            }
-
-            ret = dmg_uncompress_lzfse((char *)s->compressed_chunk,
-                                       (unsigned int) s->lengths[chunk],
-                                       (char *)s->uncompressed_chunk,
-                                       (unsigned int)
-                                           (512 * s->sectorcounts[chunk]));
-            if (ret < 0) {
-                return ret;
-            }
-            break;
-        case UDRW: /* copy */
+        case 1: /* copy */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->uncompressed_chunk, s->lengths[chunk]);
            if (ret != s->lengths[chunk]) {
                return -1;
            }
            break;
-        case UDZE: /* zeros */
-        case UDIG: /* ignore */
+        case 2: /* zero */
            /* see dmg_read, it is treated specially. No buffer needs to be
             * pre-filled, the zeroes can be set directly. */
            break;
@@ -714,8 +665,7 @@ dmg_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
        /* Special case: current chunk is all zeroes. Do not perform a memcpy as
         * s->uncompressed_chunk may be too small to cover the large all-zeroes
         * section. dmg_read_chunk is called to find s->current_chunk */
-        if (s->types[s->current_chunk] == UDZE
-            || s->types[s->current_chunk] == UDIG) { /* all zeroes block entry */
+        if (s->types[s->current_chunk] == 2) { /* all zeroes block entry */
            qemu_iovec_memset(qiov, i * 512, 0, 512);
            continue;
        }
--- a/block/dmg.h
+++ b/block/dmg.h
@@ -55,7 +55,4 @@ typedef struct BDRVDMGState {
 extern int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
                                 char *next_out, unsigned int avail_out);

-extern int (*dmg_uncompress_lzfse)(char *next_in, unsigned int avail_in,
-                                   char *next_out, unsigned int avail_out);
-
 #endif
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -102,7 +102,19 @@
 #include <xfs/xfs.h>
 #endif

-#include "trace.h"
+//#define DEBUG_BLOCK
+
+#ifdef DEBUG_BLOCK
+# define DEBUG_BLOCK_PRINT 1
+#else
+# define DEBUG_BLOCK_PRINT 0
+#endif
+#define DPRINTF(fmt, ...) \
+do { \
+    if (DEBUG_BLOCK_PRINT) { \
+        printf(fmt, ## __VA_ARGS__); \
+    } \
+} while (0)

 /* OS X does not have O_DSYNC */
 #ifndef O_DSYNC
@@ -170,29 +182,25 @@ static int64_t raw_getlength(BlockDriverState *bs);

 typedef struct RawPosixAIOData {
    BlockDriverState *bs;
-    int aio_type;
    int aio_fildes;
-
-    off_t aio_offset;
-    uint64_t aio_nbytes;
-
    union {
-        struct {
-            struct iovec *iov;
-            int niov;
-        } io;
-        struct {
-            uint64_t cmd;
-            void *buf;
-        } ioctl;
+        struct iovec *aio_iov;
+        void *aio_ioctl_buf;
+    };
+    int aio_niov;
+    uint64_t aio_nbytes;
+#define aio_ioctl_cmd   aio_nbytes /* for QEMU_AIO_IOCTL */
+    off_t aio_offset;
+    int aio_type;
+    union {
        struct {
            int aio_fd2;
            off_t aio_offset2;
-        } copy_range;
+        };
        struct {
            PreallocMode prealloc;
            Error **errp;
-        } truncate;
+        };
    };
 } RawPosixAIOData;

@@ -1140,24 +1148,20 @@ static int hdev_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
 }
 #endif

-#if defined(__linux__)
-static int handle_aiocb_ioctl(void *opaque)
+static ssize_t handle_aiocb_ioctl(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    int ret;

-    ret = ioctl(aiocb->aio_fildes, aiocb->ioctl.cmd, aiocb->ioctl.buf);
+    ret = ioctl(aiocb->aio_fildes, aiocb->aio_ioctl_cmd, aiocb->aio_ioctl_buf);
    if (ret == -1) {
        return -errno;
    }

    return 0;
 }
-#endif /* linux */

-static int handle_aiocb_flush(void *opaque)
+static ssize_t handle_aiocb_flush(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    BDRVRawState *s = aiocb->bs->opaque;
    int ret;

@@ -1229,13 +1233,13 @@ static ssize_t handle_aiocb_rw_vector(RawPosixAIOData *aiocb)
    do {
        if (aiocb->aio_type & QEMU_AIO_WRITE)
            len = qemu_pwritev(aiocb->aio_fildes,
-                               aiocb->io.iov,
-                               aiocb->io.niov,
+                               aiocb->aio_iov,
+                               aiocb->aio_niov,
                               aiocb->aio_offset);
         else
            len = qemu_preadv(aiocb->aio_fildes,
-                              aiocb->io.iov,
-                              aiocb->io.niov,
+                              aiocb->aio_iov,
+                              aiocb->aio_niov,
                              aiocb->aio_offset);
    } while (len == -1 && errno == EINTR);

@@ -1291,9 +1295,8 @@ static ssize_t handle_aiocb_rw_linear(RawPosixAIOData *aiocb, char *buf)
    return offset;
 }

-static int handle_aiocb_rw(void *opaque)
+static ssize_t handle_aiocb_rw(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    ssize_t nbytes;
    char *buf;

@@ -1302,9 +1305,8 @@ static int handle_aiocb_rw(void *opaque)
         * If there is just a single buffer, and it is properly aligned
         * we can just use plain pread/pwrite without any problems.
         */
-        if (aiocb->io.niov == 1) {
-            nbytes = handle_aiocb_rw_linear(aiocb, aiocb->io.iov->iov_base);
-            goto out;
+        if (aiocb->aio_niov == 1) {
+             return handle_aiocb_rw_linear(aiocb, aiocb->aio_iov->iov_base);
        }
        /*
         * We have more than one iovec, and all are properly aligned.
@@ -1316,7 +1318,7 @@ static int handle_aiocb_rw(void *opaque)
            nbytes = handle_aiocb_rw_vector(aiocb);
            if (nbytes == aiocb->aio_nbytes ||
                (nbytes < 0 && nbytes != -ENOSYS)) {
-                goto out;
+                return nbytes;
            }
            preadv_present = false;
        }
@@ -1334,17 +1336,16 @@ static int handle_aiocb_rw(void *opaque)
     */
    buf = qemu_try_blockalign(aiocb->bs, aiocb->aio_nbytes);
    if (buf == NULL) {
-        nbytes = -ENOMEM;
-        goto out;
+        return -ENOMEM;
    }

    if (aiocb->aio_type & QEMU_AIO_WRITE) {
        char *p = buf;
        int i;

-        for (i = 0; i < aiocb->io.niov; ++i) {
-            memcpy(p, aiocb->io.iov[i].iov_base, aiocb->io.iov[i].iov_len);
-            p += aiocb->io.iov[i].iov_len;
+        for (i = 0; i < aiocb->aio_niov; ++i) {
+            memcpy(p, aiocb->aio_iov[i].iov_base, aiocb->aio_iov[i].iov_len);
+            p += aiocb->aio_iov[i].iov_len;
        }
        assert(p - buf == aiocb->aio_nbytes);
    }
@@ -1355,12 +1356,12 @@ static int handle_aiocb_rw(void *opaque)
        size_t count = aiocb->aio_nbytes, copy;
        int i;

-        for (i = 0; i < aiocb->io.niov && count; ++i) {
+        for (i = 0; i < aiocb->aio_niov && count; ++i) {
            copy = count;
-            if (copy > aiocb->io.iov[i].iov_len) {
-                copy = aiocb->io.iov[i].iov_len;
+            if (copy > aiocb->aio_iov[i].iov_len) {
+                copy = aiocb->aio_iov[i].iov_len;
            }
-            memcpy(aiocb->io.iov[i].iov_base, p, copy);
+            memcpy(aiocb->aio_iov[i].iov_base, p, copy);
            assert(count >= copy);
            p     += copy;
            count -= copy;
@@ -1369,21 +1370,7 @@ static int handle_aiocb_rw(void *opaque)
    }
    qemu_vfree(buf);

-out:
-    if (nbytes == aiocb->aio_nbytes) {
-        return 0;
-    } else if (nbytes >= 0 && nbytes < aiocb->aio_nbytes) {
-        if (aiocb->aio_type & QEMU_AIO_WRITE) {
-            return -EINVAL;
-        } else {
-            iov_memset(aiocb->io.iov, aiocb->io.niov, nbytes,
-                      0, aiocb->aio_nbytes - nbytes);
-            return 0;
-        }
-    } else {
-        assert(nbytes < 0);
-        return nbytes;
-    }
+    return nbytes;
 }

 #ifdef CONFIG_XFS
@@ -1399,7 +1386,7 @@ static int xfs_write_zeroes(BDRVRawState *s, int64_t offset, uint64_t bytes)

    if (xfsctl(NULL, s->fd, XFS_IOC_ZERO_RANGE, &fl) < 0) {
        err = errno;
-        trace_file_xfs_write_zeroes(strerror(errno));
+        DPRINTF("cannot write zero range (%s)\n", strerror(errno));
        return -err;
    }

@@ -1418,7 +1405,7 @@ static int xfs_discard(BDRVRawState *s, int64_t offset, uint64_t bytes)

    if (xfsctl(NULL, s->fd, XFS_IOC_UNRESVSP64, &fl) < 0) {
        err = errno;
-        trace_file_xfs_discard(strerror(errno));
+        DPRINTF("cannot punch hole (%s)\n", strerror(errno));
        return -err;
    }

@@ -1473,9 +1460,8 @@ static ssize_t handle_aiocb_write_zeroes_block(RawPosixAIOData *aiocb)
    return ret;
 }

-static int handle_aiocb_write_zeroes(void *opaque)
+static ssize_t handle_aiocb_write_zeroes(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
 #if defined(CONFIG_FALLOCATE) || defined(CONFIG_XFS)
    BDRVRawState *s = aiocb->bs->opaque;
 #endif
@@ -1539,9 +1525,8 @@ static int handle_aiocb_write_zeroes(void *opaque)
    return -ENOTSUP;
 }

-static int handle_aiocb_write_zeroes_unmap(void *opaque)
+static ssize_t handle_aiocb_write_zeroes_unmap(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    BDRVRawState *s G_GNUC_UNUSED = aiocb->bs->opaque;
    int ret;

@@ -1583,20 +1568,18 @@ static off_t copy_file_range(int in_fd, off_t *in_off, int out_fd,
 }
 #endif

-static int handle_aiocb_copy_range(void *opaque)
+static ssize_t handle_aiocb_copy_range(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    uint64_t bytes = aiocb->aio_nbytes;
    off_t in_off = aiocb->aio_offset;
-    off_t out_off = aiocb->copy_range.aio_offset2;
+    off_t out_off = aiocb->aio_offset2;

    while (bytes) {
        ssize_t ret = copy_file_range(aiocb->aio_fildes, &in_off,
-                                      aiocb->copy_range.aio_fd2, &out_off,
+                                      aiocb->aio_fd2, &out_off,
                                      bytes, 0);
        trace_file_copy_file_range(aiocb->bs, aiocb->aio_fildes, in_off,
-                                   aiocb->copy_range.aio_fd2, out_off, bytes,
-                                   0, ret);
+                                   aiocb->aio_fd2, out_off, bytes, 0, ret);
        if (ret == 0) {
            /* No progress (e.g. when beyond EOF), let the caller fall back to
             * buffer I/O. */
@@ -1617,9 +1600,8 @@ static int handle_aiocb_copy_range(void *opaque)
    return 0;
 }

-static int handle_aiocb_discard(void *opaque)
+static ssize_t handle_aiocb_discard(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    int ret = -EOPNOTSUPP;
    BDRVRawState *s = aiocb->bs->opaque;

@@ -1658,17 +1640,15 @@ static int handle_aiocb_discard(void *opaque)
    return ret;
 }

-static int handle_aiocb_truncate(void *opaque)
+static int handle_aiocb_truncate(RawPosixAIOData *aiocb)
 {
-    RawPosixAIOData *aiocb = opaque;
    int result = 0;
    int64_t current_length = 0;
    char *buf = NULL;
    struct stat st;
    int fd = aiocb->aio_fildes;
    int64_t offset = aiocb->aio_offset;
-    PreallocMode prealloc = aiocb->truncate.prealloc;
-    Error **errp = aiocb->truncate.errp;
+    Error **errp = aiocb->errp;

    if (fstat(fd, &st) < 0) {
        result = -errno;
@@ -1677,12 +1657,12 @@ static int handle_aiocb_truncate(void *opaque)
    }

    current_length = st.st_size;
-    if (current_length > offset && prealloc != PREALLOC_MODE_OFF) {
+    if (current_length > offset && aiocb->prealloc != PREALLOC_MODE_OFF) {
        error_setg(errp, "Cannot use preallocation for shrinking files");
        return -ENOTSUP;
    }

-    switch (prealloc) {
+    switch (aiocb->prealloc) {
 #ifdef CONFIG_POSIX_FALLOCATE
    case PREALLOC_MODE_FALLOC:
        /*
@@ -1763,7 +1743,7 @@ static int handle_aiocb_truncate(void *opaque)
    default:
        result = -ENOTSUP;
        error_setg(errp, "Unsupported preallocation mode: %s",
-                   PreallocMode_str(prealloc));
+                   PreallocMode_str(aiocb->prealloc));
        return result;
    }

@@ -1779,19 +1759,104 @@ out:
    return result;
 }

-static int coroutine_fn raw_thread_pool_submit(BlockDriverState *bs,
-                                               ThreadPoolFunc func, void *arg)
+static int aio_worker(void *arg)
 {
-    /* @bs can be NULL, bdrv_get_aio_context() returns the main context then */
-    ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
-    return thread_pool_submit_co(pool, func, arg);
+    RawPosixAIOData *aiocb = arg;
+    ssize_t ret = 0;
+
+    switch (aiocb->aio_type & QEMU_AIO_TYPE_MASK) {
+    case QEMU_AIO_READ:
+        ret = handle_aiocb_rw(aiocb);
+        if (ret >= 0 && ret < aiocb->aio_nbytes) {
+            iov_memset(aiocb->aio_iov, aiocb->aio_niov, ret,
+                      0, aiocb->aio_nbytes - ret);
+
+            ret = aiocb->aio_nbytes;
+        }
+        if (ret == aiocb->aio_nbytes) {
+            ret = 0;
+        } else if (ret >= 0 && ret < aiocb->aio_nbytes) {
+            ret = -EINVAL;
+        }
+        break;
+    case QEMU_AIO_WRITE:
+        ret = handle_aiocb_rw(aiocb);
+        if (ret == aiocb->aio_nbytes) {
+            ret = 0;
+        } else if (ret >= 0 && ret < aiocb->aio_nbytes) {
+            ret = -EINVAL;
+        }
+        break;
+    case QEMU_AIO_FLUSH:
+        ret = handle_aiocb_flush(aiocb);
+        break;
+    case QEMU_AIO_IOCTL:
+        ret = handle_aiocb_ioctl(aiocb);
+        break;
+    case QEMU_AIO_DISCARD:
+        ret = handle_aiocb_discard(aiocb);
+        break;
+    case QEMU_AIO_WRITE_ZEROES:
+        ret = handle_aiocb_write_zeroes(aiocb);
+        break;
+    case QEMU_AIO_WRITE_ZEROES | QEMU_AIO_DISCARD:
+        ret = handle_aiocb_write_zeroes_unmap(aiocb);
+        break;
+    case QEMU_AIO_COPY_RANGE:
+        ret = handle_aiocb_copy_range(aiocb);
+        break;
+    case QEMU_AIO_TRUNCATE:
+        ret = handle_aiocb_truncate(aiocb);
+        break;
+    default:
+        error_report("invalid aio request (0x%x)", aiocb->aio_type);
+        ret = -EINVAL;
+        break;
+    }
+
+    g_free(aiocb);
+    return ret;
+}
+
+static int paio_submit_co_full(BlockDriverState *bs, int fd,
+                               int64_t offset, int fd2, int64_t offset2,
+                               QEMUIOVector *qiov,
+                               int bytes, int type)
+{
+    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
+    ThreadPool *pool;
+
+    acb->bs = bs;
+    acb->aio_type = type;
+    acb->aio_fildes = fd;
+    acb->aio_fd2 = fd2;
+    acb->aio_offset2 = offset2;
+
+    acb->aio_nbytes = bytes;
+    acb->aio_offset = offset;
+
+    if (qiov) {
+        acb->aio_iov = qiov->iov;
+        acb->aio_niov = qiov->niov;
+        assert(qiov->size == bytes);
+    }
+
+    trace_file_paio_submit_co(offset, bytes, type);
+    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
+    return thread_pool_submit_co(pool, aio_worker, acb);
+}
+
+static inline int paio_submit_co(BlockDriverState *bs, int fd,
+                                 int64_t offset, QEMUIOVector *qiov,
+                                 int bytes, int type)
+{
+    return paio_submit_co_full(bs, fd, offset, -1, 0, qiov, bytes, type);
 }

 static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
                                   uint64_t bytes, QEMUIOVector *qiov, int type)
 {
    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData acb;

    if (fd_open(bs) < 0)
        return -EIO;
@@ -1814,20 +1879,7 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
        }
    }

-    acb = (RawPosixAIOData) {
-        .bs             = bs,
-        .aio_fildes     = s->fd,
-        .aio_type       = type,
-        .aio_offset     = offset,
-        .aio_nbytes     = bytes,
-        .io             = {
-            .iov            = qiov->iov,
-            .niov           = qiov->niov,
-        },
-    };
-
-    assert(qiov->size == bytes);
-    return raw_thread_pool_submit(bs, handle_aiocb_rw, &acb);
+    return paio_submit_co(bs, s->fd, offset, qiov, bytes, type);
 }

 static int coroutine_fn raw_co_preadv(BlockDriverState *bs, uint64_t offset,
@@ -1870,7 +1922,6 @@ static void raw_aio_unplug(BlockDriverState *bs)
 static int raw_co_flush_to_disk(BlockDriverState *bs)
 {
    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData acb;
    int ret;

    ret = fd_open(bs);
@@ -1878,13 +1929,7 @@ static int raw_co_flush_to_disk(BlockDriverState *bs)
        return ret;
    }

-    acb = (RawPosixAIOData) {
-        .bs             = bs,
-        .aio_fildes     = s->fd,
-        .aio_type       = QEMU_AIO_FLUSH,
-    };
-
-    return raw_thread_pool_submit(bs, handle_aiocb_flush, &acb);
+    return paio_submit_co(bs, s->fd, 0, NULL, 0, QEMU_AIO_FLUSH);
 }

 static void raw_aio_attach_aio_context(BlockDriverState *bs,
@@ -1923,20 +1968,21 @@ static int coroutine_fn
 raw_regular_truncate(BlockDriverState *bs, int fd, int64_t offset,
                     PreallocMode prealloc, Error **errp)
 {
-    RawPosixAIOData acb;
+    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
+    ThreadPool *pool;

-    acb = (RawPosixAIOData) {
+    *acb = (RawPosixAIOData) {
        .bs             = bs,
        .aio_fildes     = fd,
        .aio_type       = QEMU_AIO_TRUNCATE,
        .aio_offset     = offset,
-        .truncate       = {
-            .prealloc       = prealloc,
-            .errp           = errp,
-        },
+        .prealloc       = prealloc,
+        .errp           = errp,
    };

-    return raw_thread_pool_submit(bs, handle_aiocb_truncate, &acb);
+    /* @bs can be NULL, bdrv_get_aio_context() returns the main context then */
+    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
+    return thread_pool_submit_co(pool, aio_worker, acb);
 }

 static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
@@ -2071,7 +2117,7 @@ again:
 #endif
    if (!fstat(fd, &sb) && (S_IFCHR & sb.st_mode)) {
 #ifdef DIOCGMEDIASIZE
-        if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
+	if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
 #elif defined(DIOCGPART)
        {
                struct partinfo pi;
@@ -2415,6 +2461,8 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
    off_t data = 0, hole = 0;
    int ret;

+    assert(QEMU_IS_ALIGNED(offset | bytes, bs->bl.request_alignment));
+
    ret = fd_open(bs);
    if (ret < 0) {
        return ret;
@@ -2440,6 +2488,20 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
        /* On a data extent, compute bytes to the end of the extent,
         * possibly including a partial sector at EOF. */
        *pnum = MIN(bytes, hole - offset);
+
+        /*
+         * We are not allowed to return partial sectors, though, so
+         * round up if necessary.
+         */
+        if (!QEMU_IS_ALIGNED(*pnum, bs->bl.request_alignment)) {
+            int64_t file_length = raw_getlength(bs);
+            if (file_length > 0) {
+                /* Ignore errors, this is just a safeguard */
+                assert(hole == file_length);
+            }
+            *pnum = ROUND_UP(*pnum, bs->bl.request_alignment);
+        }
+
        ret = BDRV_BLOCK_DATA;
    } else {
        /* On a hole, compute bytes to the beginning of the next extent.  */
@@ -2566,68 +2628,26 @@ static void coroutine_fn raw_co_invalidate_cache(BlockDriverState *bs,
 #endif /* !__linux__ */
 }

-static coroutine_fn int
-raw_do_pdiscard(BlockDriverState *bs, int64_t offset, int bytes, bool blkdev)
-{
-    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData acb;
-
-    acb = (RawPosixAIOData) {
-        .bs             = bs,
-        .aio_fildes     = s->fd,
-        .aio_type       = QEMU_AIO_DISCARD,
-        .aio_offset     = offset,
-        .aio_nbytes     = bytes,
-    };
-
-    if (blkdev) {
-        acb.aio_type |= QEMU_AIO_BLKDEV;
-    }
-
-    return raw_thread_pool_submit(bs, handle_aiocb_discard, &acb);
-}
-
 static coroutine_fn int
 raw_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
-{
-    return raw_do_pdiscard(bs, offset, bytes, false);
-}
-
-static int coroutine_fn
-raw_do_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int bytes,
-                     BdrvRequestFlags flags, bool blkdev)
 {
    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData acb;
-    ThreadPoolFunc *handler;

-    acb = (RawPosixAIOData) {
-        .bs             = bs,
-        .aio_fildes     = s->fd,
-        .aio_type       = QEMU_AIO_WRITE_ZEROES,
-        .aio_offset     = offset,
-        .aio_nbytes     = bytes,
-    };
-
-    if (blkdev) {
-        acb.aio_type |= QEMU_AIO_BLKDEV;
-    }
-
-    if (flags & BDRV_REQ_MAY_UNMAP) {
-        acb.aio_type |= QEMU_AIO_DISCARD;
-        handler = handle_aiocb_write_zeroes_unmap;
-    } else {
-        handler = handle_aiocb_write_zeroes;
-    }
-
-    return raw_thread_pool_submit(bs, handler, &acb);
+    return paio_submit_co(bs, s->fd, offset, NULL, bytes, QEMU_AIO_DISCARD);
 }

 static int coroutine_fn raw_co_pwrite_zeroes(
    BlockDriverState *bs, int64_t offset,
    int bytes, BdrvRequestFlags flags)
 {
-    return raw_do_pwrite_zeroes(bs, offset, bytes, flags, false);
+    BDRVRawState *s = bs->opaque;
+    int operation = QEMU_AIO_WRITE_ZEROES;
+
+    if (flags & BDRV_REQ_MAY_UNMAP) {
+        operation |= QEMU_AIO_DISCARD;
+    }
+
+    return paio_submit_co(bs, s->fd, offset, NULL, bytes, operation);
 }

 static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
@@ -2698,7 +2718,6 @@ static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
                                             BdrvRequestFlags read_flags,
                                             BdrvRequestFlags write_flags)
 {
-    RawPosixAIOData acb;
    BDRVRawState *s = bs->opaque;
    BDRVRawState *src_s;

@@ -2711,20 +2730,8 @@ static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
    if (fd_open(src->bs) < 0 || fd_open(dst->bs) < 0) {
        return -EIO;
    }
-
-    acb = (RawPosixAIOData) {
-        .bs             = bs,
-        .aio_type       = QEMU_AIO_COPY_RANGE,
-        .aio_fildes     = src_s->fd,
-        .aio_offset     = src_offset,
-        .aio_nbytes     = bytes,
-        .copy_range     = {
-            .aio_fd2        = s->fd,
-            .aio_offset2    = dst_offset,
-        },
-    };
-
-    return raw_thread_pool_submit(bs, handle_aiocb_copy_range, &acb);
+    return paio_submit_co_full(bs, src_s->fd, src_offset, s->fd, dst_offset,
+                               NULL, bytes, QEMU_AIO_COPY_RANGE);
 }

 BlockDriver bdrv_file = {
@@ -2807,7 +2814,7 @@ static char *FindEjectableOpticalMedia(io_iterator_t *mediaIterator)

        /* If a match was found, leave the loop */
        if (*mediaIterator != 0) {
-            trace_file_FindEjectableOpticalMedia(matching_array[index]);
+            DPRINTF("Matching using %s\n", matching_array[index]);
            mediaType = g_strdup(matching_array[index]);
            break;
        }
@@ -2867,7 +2874,7 @@ static bool setup_cdrom(char *bsd_path, Error **errp)
    if (partition_found == false) {
        error_setg(errp, "Failed to find a working partition on disc");
    } else {
-        trace_file_setup_cdrom(test_partition);
+        DPRINTF("Using %s as optical disc\n", test_partition);
        pstrcpy(bsd_path, MAXPATHLEN, test_partition);
    }
    return partition_found;
@@ -2962,7 +2969,8 @@ static bool hdev_is_sg(BlockDriverState *bs)

    ret = ioctl(s->fd, SG_GET_SCSI_ID, &scsiid);
    if (ret >= 0) {
-        trace_file_hdev_is_sg(scsiid.scsi_type, sg_version);
+        DPRINTF("SG device found: type=%d, version=%d\n",
+            scsiid.scsi_type, sg_version);
        return true;
    }

@@ -3071,39 +3079,36 @@ hdev_open_Mac_error:
 }

 #if defined(__linux__)
-static int coroutine_fn
-hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+
+static BlockAIOCB *hdev_aio_ioctl(BlockDriverState *bs,
+        unsigned long int req, void *buf,
+        BlockCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData acb;
-    int ret;
+    RawPosixAIOData *acb;
+    ThreadPool *pool;

-    ret = fd_open(bs);
-    if (ret < 0) {
-        return ret;
-    }
+    if (fd_open(bs) < 0)
+        return NULL;

    if (req == SG_IO && s->pr_mgr) {
        struct sg_io_hdr *io_hdr = buf;
        if (io_hdr->cmdp[0] == PERSISTENT_RESERVE_OUT ||
            io_hdr->cmdp[0] == PERSISTENT_RESERVE_IN) {
            return pr_manager_execute(s->pr_mgr, bdrv_get_aio_context(bs),
-                                      s->fd, io_hdr);
+                                      s->fd, io_hdr, cb, opaque);
        }
    }

-    acb = (RawPosixAIOData) {
-        .bs         = bs,
-        .aio_type   = QEMU_AIO_IOCTL,
-        .aio_fildes = s->fd,
-        .aio_offset = 0,
-        .ioctl      = {
-            .buf        = buf,
-            .cmd        = req,
-        },
-    };
-
-    return raw_thread_pool_submit(bs, handle_aiocb_ioctl, &acb);
+    acb = g_new(RawPosixAIOData, 1);
+    acb->bs = bs;
+    acb->aio_type = QEMU_AIO_IOCTL;
+    acb->aio_fildes = s->fd;
+    acb->aio_offset = 0;
+    acb->aio_ioctl_buf = buf;
+    acb->aio_ioctl_cmd = req;
+    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
+    return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);
 }
 #endif /* linux */

@@ -3120,18 +3125,22 @@ static int fd_open(BlockDriverState *bs)
 static coroutine_fn int
 hdev_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
 {
+    BDRVRawState *s = bs->opaque;
    int ret;

    ret = fd_open(bs);
    if (ret < 0) {
        return ret;
    }
-    return raw_do_pdiscard(bs, offset, bytes, true);
+    return paio_submit_co(bs, s->fd, offset, NULL, bytes,
+                          QEMU_AIO_DISCARD | QEMU_AIO_BLKDEV);
 }

 static coroutine_fn int hdev_co_pwrite_zeroes(BlockDriverState *bs,
    int64_t offset, int bytes, BdrvRequestFlags flags)
 {
+    BDRVRawState *s = bs->opaque;
+    int operation = QEMU_AIO_WRITE_ZEROES | QEMU_AIO_BLKDEV;
    int rc;

    rc = fd_open(bs);
@@ -3139,7 +3148,11 @@ static coroutine_fn int hdev_co_pwrite_zeroes(BlockDriverState *bs,
        return rc;
    }

-    return raw_do_pwrite_zeroes(bs, offset, bytes, flags, true);
+    if (flags & BDRV_REQ_MAY_UNMAP) {
+        operation |= QEMU_AIO_DISCARD;
+    }
+
+    return paio_submit_co(bs, s->fd, offset, NULL, bytes, operation);
 }

 static int coroutine_fn hdev_co_create_opts(const char *filename, QemuOpts *opts,
@@ -3244,7 +3257,7 @@ static BlockDriver bdrv_host_device = {

    /* generic scsi device */
 #ifdef __linux__
-    .bdrv_co_ioctl          = hdev_co_ioctl,
+    .bdrv_aio_ioctl     = hdev_aio_ioctl,
 #endif
 };

@@ -3366,7 +3379,7 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_lock_medium   = cdrom_lock_medium,

    /* generic scsi device */
-    .bdrv_co_ioctl      = hdev_co_ioctl,
+    .bdrv_aio_ioctl     = hdev_aio_ioctl,
 };
 #endif /* __linux__ */

--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -176,7 +176,7 @@ int qemu_ftruncate64(int fd, int64_t length)
    BOOL res;

    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
-        return -1;
+	return -1;

    h = (HANDLE)_get_osfhandle(fd);

@@ -184,13 +184,13 @@ int qemu_ftruncate64(int fd, int64_t length)
    li.HighPart = 0;
    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
    if (li.LowPart == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        return -1;
+	return -1;
    }

    high = length >> 32;
    dw = SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN);
    if (dw == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        return -1;
+	return -1;
    }
    res = SetEndOfFile(h);

@@ -203,7 +203,7 @@ static int set_sparse(int fd)
 {
    DWORD returned;
    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
-                                 NULL, 0, NULL, 0, &returned, NULL);
+				 NULL, 0, NULL, 0, &returned, NULL);
 }

 static void raw_detach_aio_context(BlockDriverState *bs)
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -20,6 +20,10 @@
 #include "qemu/option.h"
 #include "qemu/cutils.h"

+#ifdef CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT
+# define glfs_ftruncate(fd, offset) glfs_ftruncate(fd, offset, NULL, NULL)
+#endif
+
 #define GLUSTER_OPT_FILENAME        "filename"
 #define GLUSTER_OPT_VOLUME          "volume"
 #define GLUSTER_OPT_PATH            "path"
@@ -72,7 +76,7 @@ typedef struct ListElement {
    GlfsPreopened saved;
 } ListElement;

-static QLIST_HEAD(, ListElement) glfs_list;
+static QLIST_HEAD(glfs_list, ListElement) glfs_list;

 static QemuOptsList qemu_gluster_create_opts = {
    .name = "qemu-gluster-create-opts",
@@ -725,7 +729,11 @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
 /*
 * AIO callback routine called from GlusterFS thread.
 */
-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
+static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
+#ifdef CONFIG_GLUSTERFS_IOCB_HAS_STAT
+                                 struct glfs_stat *pre, struct glfs_stat *post,
+#endif
+                                 void *arg)
 {
    GlusterAIOCB *acb = (GlusterAIOCB *)arg;

@@ -1495,21 +1503,6 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
 }


-static const char *const gluster_strong_open_opts[] = {
-    GLUSTER_OPT_VOLUME,
-    GLUSTER_OPT_PATH,
-    GLUSTER_OPT_TYPE,
-    GLUSTER_OPT_SERVER_PATTERN,
-    GLUSTER_OPT_HOST,
-    GLUSTER_OPT_PORT,
-    GLUSTER_OPT_TO,
-    GLUSTER_OPT_IPV4,
-    GLUSTER_OPT_IPV6,
-    GLUSTER_OPT_SOCKET,
-
-    NULL
-};
-
 static BlockDriver bdrv_gluster = {
    .format_name                  = "gluster",
    .protocol_name                = "gluster",
@@ -1537,7 +1530,6 @@ static BlockDriver bdrv_gluster = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static BlockDriver bdrv_gluster_tcp = {
@@ -1567,7 +1559,6 @@ static BlockDriver bdrv_gluster_tcp = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static BlockDriver bdrv_gluster_unix = {
@@ -1597,7 +1588,6 @@ static BlockDriver bdrv_gluster_unix = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 /* rdma is deprecated (actually never supported for volfile fetch).
@@ -1633,7 +1623,6 @@ static BlockDriver bdrv_gluster_rdma = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static void bdrv_gluster_init(void)
--- a/block/io.c
+++ b/block/io.c
@@ -843,13 +843,17 @@ static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
 static int bdrv_rw_co(BdrvChild *child, int64_t sector_num, uint8_t *buf,
                      int nb_sectors, bool is_write, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf,
-                                            nb_sectors * BDRV_SECTOR_SIZE);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = (void *)buf,
+        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
+    };

    if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_prwv_co(child, sector_num << BDRV_SECTOR_BITS,
                        &qiov, is_write, flags);
 }
@@ -876,8 +880,13 @@ int bdrv_write(BdrvChild *child, int64_t sector_num,
 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
                       int bytes, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = NULL,
+        .iov_len = bytes,
+    };

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_prwv_co(child, offset, &qiov, true,
                        BDRV_REQ_ZERO_WRITE | flags);
 }
@@ -941,12 +950,17 @@ int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)

 int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = (void *)buf,
+        .iov_len = bytes,
+    };

    if (bytes < 0) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_preadv(child, offset, &qiov);
 }

@@ -964,12 +978,17 @@ int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)

 int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = (void *) buf,
+        .iov_len    = bytes,
+    };

    if (bytes < 0) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_pwritev(child, offset, &qiov);
 }

@@ -1146,6 +1165,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
    void *bounce_buffer;

    BlockDriver *drv = bs->drv;
+    struct iovec iov;
    QEMUIOVector local_qiov;
    int64_t cluster_offset;
    int64_t cluster_bytes;
@@ -1210,8 +1230,9 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,

        if (ret <= 0) {
            /* Must copy-on-read; use the bounce buffer */
-            pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
-            qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
+            iov.iov_base = bounce_buffer;
+            iov.iov_len = pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
+            qemu_iovec_init_external(&local_qiov, &iov, 1);

            ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
                                     &local_qiov, 0);
@@ -1456,7 +1477,7 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
 {
    BlockDriver *drv = bs->drv;
    QEMUIOVector qiov;
-    void *buf = NULL;
+    struct iovec iov = {0};
    int ret = 0;
    bool need_flush = false;
    int head = 0;
@@ -1526,14 +1547,16 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
                need_flush = true;
            }
            num = MIN(num, max_transfer);
-            if (buf == NULL) {
-                buf = qemu_try_blockalign0(bs, num);
-                if (buf == NULL) {
+            iov.iov_len = num;
+            if (iov.iov_base == NULL) {
+                iov.iov_base = qemu_try_blockalign(bs, num);
+                if (iov.iov_base == NULL) {
                    ret = -ENOMEM;
                    goto fail;
                }
+                memset(iov.iov_base, 0, num);
            }
-            qemu_iovec_init_buf(&qiov, buf, num);
+            qemu_iovec_init_external(&qiov, &iov, 1);

            ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);

@@ -1541,8 +1564,8 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
             * all future requests.
             */
            if (num < max_transfer) {
-                qemu_vfree(buf);
-                buf = NULL;
+                qemu_vfree(iov.iov_base);
+                iov.iov_base = NULL;
            }
        }

@@ -1554,7 +1577,7 @@ fail:
    if (ret == 0 && need_flush) {
        ret = bdrv_co_flush(bs);
    }
-    qemu_vfree(buf);
+    qemu_vfree(iov.iov_base);
    return ret;
 }

@@ -1740,6 +1763,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
    BlockDriverState *bs = child->bs;
    uint8_t *buf = NULL;
    QEMUIOVector local_qiov;
+    struct iovec iov;
    uint64_t align = bs->bl.request_alignment;
    unsigned int head_padding_bytes, tail_padding_bytes;
    int ret = 0;
@@ -1751,7 +1775,11 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
    assert(flags & BDRV_REQ_ZERO_WRITE);
    if (head_padding_bytes || tail_padding_bytes) {
        buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&local_qiov, buf, align);
+        iov = (struct iovec) {
+            .iov_base   = buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&local_qiov, &iov, 1);
    }
    if (head_padding_bytes) {
        uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
@@ -1857,12 +1885,17 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,

    if (offset & (align - 1)) {
        QEMUIOVector head_qiov;
+        struct iovec head_iov;

        mark_request_serialising(&req, align);
        wait_serialising_requests(&req);

        head_buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&head_qiov, head_buf, align);
+        head_iov = (struct iovec) {
+            .iov_base   = head_buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&head_qiov, &head_iov, 1);

        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
        ret = bdrv_aligned_preadv(child, &req, offset & ~(align - 1), align,
@@ -1891,6 +1924,7 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,

    if ((offset + bytes) & (align - 1)) {
        QEMUIOVector tail_qiov;
+        struct iovec tail_iov;
        size_t tail_bytes;
        bool waited;

@@ -1899,7 +1933,11 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
        assert(!waited || !use_local_qiov);

        tail_buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&tail_qiov, tail_buf, align);
+        tail_iov = (struct iovec) {
+            .iov_base   = tail_buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);

        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
        ret = bdrv_aligned_preadv(child, &req, (offset + bytes) & ~(align - 1),
@@ -2430,9 +2468,15 @@ bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
                      int64_t pos, int size)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = (void *) buf,
+        .iov_len    = size,
+    };
    int ret;

+    qemu_iovec_init_external(&qiov, &iov, 1);
+
    ret = bdrv_writev_vmstate(bs, &qiov, pos);
    if (ret < 0) {
        return ret;
@@ -2449,9 +2493,14 @@ int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = buf,
+        .iov_len    = size,
+    };
    int ret;

+    qemu_iovec_init_external(&qiov, &iov, 1);
    ret = bdrv_readv_vmstate(bs, &qiov, pos);
    if (ret < 0) {
        return ret;
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -49,9 +49,7 @@
 /* Conflict between scsi/utils.h and libiscsi! :( */
 #define SCSI_XFER_NONE ISCSI_XFER_NONE
 #include <iscsi/iscsi.h>
-#define inline __attribute__((gnu_inline))  /* required for libiscsi v1.9.0 */
 #include <iscsi/scsi-lowlevel.h>
-#undef inline
 #undef SCSI_XFER_NONE
 QEMU_BUILD_BUG_ON((int)SCSI_XFER_NONE != (int)ISCSI_XFER_NONE);

@@ -119,6 +117,7 @@ typedef struct IscsiAIOCB {
    QEMUBH *bh;
    IscsiLun *iscsilun;
    struct scsi_task *task;
+    uint8_t *buf;
    int status;
    int64_t sector_num;
    int nb_sectors;
@@ -126,7 +125,6 @@ typedef struct IscsiAIOCB {
 #ifdef __linux__
    sg_io_hdr_t *ioh;
 #endif
-    bool cancelled;
 } IscsiAIOCB;

 /* libiscsi uses time_t so its enough to process events every second */
@@ -152,6 +150,9 @@ iscsi_bh_cb(void *p)

    qemu_bh_delete(acb->bh);

+    g_free(acb->buf);
+    acb->buf = NULL;
+
    acb->common.cb(acb->common.opaque, acb->status);

    if (acb->task != NULL) {
@@ -290,20 +291,14 @@ static void iscsi_co_init_iscsitask(IscsiLun *iscsilun, struct IscsiTask *iTask)
    };
 }

-/* Called (via iscsi_service) with QemuMutex held. */
 static void
 iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
                    void *private_data)
 {
    IscsiAIOCB *acb = private_data;

-    /* If the command callback hasn't been called yet, drop the task */
-    if (!acb->bh) {
-        /* Call iscsi_aio_ioctl_cb() with SCSI_STATUS_CANCELLED */
-        iscsi_scsi_cancel_task(iscsi, acb->task);
-    }
-
-    qemu_aio_unref(acb); /* acquired in iscsi_aio_cancel() */
+    acb->status = -ECANCELED;
+    iscsi_schedule_bh(acb);
 }

 static void
@@ -312,25 +307,14 @@ iscsi_aio_cancel(BlockAIOCB *blockacb)
    IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
    IscsiLun *iscsilun = acb->iscsilun;

-    qemu_mutex_lock(&iscsilun->mutex);
-
-    /* If it was cancelled or completed already, our work is done here */
-    if (acb->cancelled || acb->status != -EINPROGRESS) {
-        qemu_mutex_unlock(&iscsilun->mutex);
+    if (acb->status != -EINPROGRESS) {
        return;
    }

-    acb->cancelled = true;
-
-    qemu_aio_ref(acb); /* released in iscsi_abort_task_cb() */
-
    /* send a task mgmt call to the target to cancel the task on the target */
-    if (iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
-                                         iscsi_abort_task_cb, acb) < 0) {
-        qemu_aio_unref(acb); /* since iscsi_abort_task_cb() won't be called */
-    }
+    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
+                                     iscsi_abort_task_cb, acb);

-    qemu_mutex_unlock(&iscsilun->mutex);
 }

 static const AIOCBInfo iscsi_aiocb_info = {
@@ -364,8 +348,6 @@ static void iscsi_timed_check_events(void *opaque)
 {
    IscsiLun *iscsilun = opaque;

-    qemu_mutex_lock(&iscsilun->mutex);
-
    /* check for timed out requests */
    iscsi_service(iscsilun->iscsi, 0);

@@ -378,8 +360,6 @@ static void iscsi_timed_check_events(void *opaque)
     * to return to service once this situation changes. */
    iscsi_set_events(iscsilun);

-    qemu_mutex_unlock(&iscsilun->mutex);
-
    timer_mod(iscsilun->event_timer,
              qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + EVENT_INTERVAL);
 }
@@ -953,13 +933,8 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
 {
    IscsiAIOCB *acb = opaque;

-    if (status == SCSI_STATUS_CANCELLED) {
-        if (!acb->bh) {
-            acb->status = -ECANCELED;
-            iscsi_schedule_bh(acb);
-        }
-        return;
-    }
+    g_free(acb->buf);
+    acb->buf = NULL;

    acb->status = 0;
    if (status < 0) {
@@ -1035,8 +1010,8 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
    acb->iscsilun = iscsilun;
    acb->bh          = NULL;
    acb->status      = -EINPROGRESS;
+    acb->buf         = NULL;
    acb->ioh         = buf;
-    acb->cancelled   = false;

    if (req != SG_IO) {
        iscsi_ioctl_handle_emulated(acb, req, buf);
@@ -2448,20 +2423,6 @@ static QemuOptsList iscsi_create_opts = {
    }
 };

-static const char *const iscsi_strong_runtime_opts[] = {
-    "transport",
-    "portal",
-    "target",
-    "user",
-    "password",
-    "password-secret",
-    "lun",
-    "initiator-name",
-    "header-digest",
-
-    NULL
-};
-
 static BlockDriver bdrv_iscsi = {
    .format_name     = "iscsi",
    .protocol_name   = "iscsi",
@@ -2496,8 +2457,6 @@ static BlockDriver bdrv_iscsi = {

    .bdrv_detach_aio_context = iscsi_detach_aio_context,
    .bdrv_attach_aio_context = iscsi_attach_aio_context,
-
-    .strong_runtime_opts = iscsi_strong_runtime_opts,
 };

 #if LIBISCSI_API_VERSION >= (20160603)
@@ -2535,8 +2494,6 @@ static BlockDriver bdrv_iser = {

    .bdrv_detach_aio_context = iscsi_detach_aio_context,
    .bdrv_attach_aio_context = iscsi_attach_aio_context,
-
-    .strong_runtime_opts = iscsi_strong_runtime_opts,
 };
 #endif

--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -384,10 +384,10 @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
    switch (type) {
    case QEMU_AIO_WRITE:
        io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
-        break;
+	break;
    case QEMU_AIO_READ:
        io_prep_preadv(iocbs, fd, qiov->iov, qiov->niov, offset);
-        break;
+	break;
    /* Currently Linux kernel does not support other operations */
    default:
        fprintf(stderr, "%s: invalid AIO request type 0x%x.\n",
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -72,7 +72,7 @@ typedef struct MirrorBlockJob {
    unsigned long *in_flight_bitmap;
    int in_flight;
    int64_t bytes_in_flight;
-    QTAILQ_HEAD(, MirrorOp) ops_in_flight;
+    QTAILQ_HEAD(MirrorOpList, MirrorOp) ops_in_flight;
    int ret;
    bool unmap;
    int target_cluster_size;
@@ -277,8 +277,7 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
    return ret;
 }

-static inline void coroutine_fn
-mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
+static inline void mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
 {
    MirrorOp *op;

@@ -296,8 +295,7 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
    abort();
 }

-static inline void coroutine_fn
-mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
+static inline void mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 {
    /* Only non-active operations use up in-flight slots */
    mirror_wait_for_any_operation(s, false);
@@ -600,7 +598,7 @@ static void mirror_free_init(MirrorBlockJob *s)
 * mirror_resume() because mirror_run() will begin iterating again
 * when the job is resumed.
 */
-static void coroutine_fn mirror_wait_for_all_io(MirrorBlockJob *s)
+static void mirror_wait_for_all_io(MirrorBlockJob *s)
 {
    while (s->in_flight > 0) {
        mirror_wait_for_free_in_flight_slot(s);
@@ -671,10 +669,9 @@ static int mirror_exit_common(Job *job)

    if (s->should_complete && !abort) {
        BlockDriverState *to_replace = s->to_replace ?: src;
-        bool ro = bdrv_is_read_only(to_replace);

-        if (ro != bdrv_is_read_only(target_bs)) {
-            bdrv_reopen_set_read_only(target_bs, ro, NULL);
+        if (bdrv_get_flags(target_bs) != bdrv_get_flags(to_replace)) {
+            bdrv_reopen(target_bs, bdrv_get_flags(to_replace), NULL);
        }

        /* The mirror job has no requests in flight any more, but we need to
@@ -734,7 +731,7 @@ static void mirror_abort(Job *job)
    assert(ret == 0);
 }

-static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
+static void mirror_throttle(MirrorBlockJob *s)
 {
    int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);

@@ -1109,7 +1106,7 @@ static void mirror_complete(Job *job, Error **errp)
    job_enter(job);
 }

-static void coroutine_fn mirror_pause(Job *job)
+static void mirror_pause(Job *job)
 {
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common.job);

@@ -1180,28 +1177,29 @@ static const BlockJobDriver commit_active_job_driver = {
    .drain                  = mirror_drain,
 };

-static void coroutine_fn
-do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-                     uint64_t offset, uint64_t bytes,
-                     QEMUIOVector *qiov, int flags)
+static void do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
+                                 uint64_t offset, uint64_t bytes,
+                                 QEMUIOVector *qiov, int flags)
 {
+    BdrvDirtyBitmapIter *iter;
    QEMUIOVector target_qiov;
-    uint64_t dirty_offset = offset;
-    uint64_t dirty_bytes;
+    uint64_t dirty_offset;
+    int dirty_bytes;

    if (qiov) {
        qemu_iovec_init(&target_qiov, qiov->niov);
    }

+    iter = bdrv_dirty_iter_new(job->dirty_bitmap);
+    bdrv_set_dirty_iter(iter, offset);
+
    while (true) {
        bool valid_area;
        int ret;

        bdrv_dirty_bitmap_lock(job->dirty_bitmap);
-        dirty_bytes = MIN(offset + bytes - dirty_offset, INT_MAX);
-        valid_area = bdrv_dirty_bitmap_next_dirty_area(job->dirty_bitmap,
-                                                       &dirty_offset,
-                                                       &dirty_bytes);
+        valid_area = bdrv_dirty_iter_next_area(iter, offset + bytes,
+                                               &dirty_offset, &dirty_bytes);
        if (!valid_area) {
            bdrv_dirty_bitmap_unlock(job->dirty_bitmap);
            break;
@@ -1257,10 +1255,9 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
                break;
            }
        }
-
-        dirty_offset += dirty_bytes;
    }

+    bdrv_dirty_iter_free(iter);
    if (qiov) {
        qemu_iovec_destroy(&target_qiov);
    }
@@ -1431,13 +1428,14 @@ static int coroutine_fn bdrv_mirror_top_pdiscard(BlockDriverState *bs,
                                    NULL, 0);
 }

-static void bdrv_mirror_top_refresh_filename(BlockDriverState *bs)
+static void bdrv_mirror_top_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
    if (bs->backing == NULL) {
        /* we can be here after failed bdrv_attach_child in
         * bdrv_set_backing_hd */
        return;
    }
+    bdrv_refresh_filename(bs->backing->bs);
    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
            bs->backing->bs->filename);
 }
@@ -1611,14 +1609,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

-    ret = block_job_add_bdrv(&s->common, "source", bs, 0,
-                             BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
-                             BLK_PERM_CONSISTENT_READ,
-                             errp);
-    if (ret < 0) {
-        goto fail;
-    }
-
    /* Required permissions are already taken with blk_new() */
    block_job_add_bdrv(&s->common, "target", target, 0, BLK_PERM_ALL,
                       &error_abort);
@@ -1656,9 +1646,6 @@ fail:
        g_free(s->replaces);
        blk_unref(s->target);
        bs_opaque->job = NULL;
-        if (s->dirty_bitmap) {
-            bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);
-        }
        job_early_fail(&s->common.job);
    }

@@ -1702,15 +1689,13 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
                         BlockCompletionFunc *cb, void *opaque,
                         bool auto_complete, Error **errp)
 {
-    bool base_read_only;
+    int orig_base_flags;
    Error *local_err = NULL;

-    base_read_only = bdrv_is_read_only(base);
+    orig_base_flags = bdrv_get_flags(base);

-    if (base_read_only) {
-        if (bdrv_reopen_set_read_only(base, false, errp) < 0) {
-            return;
-        }
+    if (bdrv_reopen(base, bs->open_flags, errp)) {
+        return;
    }

    mirror_start_job(job_id, bs, creation_flags, base, NULL, speed, 0, 0,
@@ -1729,8 +1714,6 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
 error_restore_flags:
    /* ignore error and errp for bdrv_reopen, because we want to propagate
     * the original error */
-    if (base_read_only) {
-        bdrv_reopen_set_read_only(base, true, NULL);
-    }
+    bdrv_reopen(base, orig_base_flags, NULL);
    return;
 }
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -28,8 +28,6 @@
 */

 #include "qemu/osdep.h"
-
-#include "trace.h"
 #include "qapi/error.h"
 #include "nbd-client.h"

@@ -53,13 +51,15 @@ static void nbd_teardown_connection(BlockDriverState *bs)
 {
    NBDClientSession *client = nbd_get_client_session(bs);

-    assert(client->ioc);
+    if (!client->ioc) { /* Already closed */
+        return;
+    }

    /* finish any pending coroutines */
    qio_channel_shutdown(client->ioc,
                         QIO_CHANNEL_SHUTDOWN_BOTH,
                         NULL);
-    BDRV_POLL_WHILE(bs, client->connection_co);
+    BDRV_POLL_WHILE(bs, client->read_reply_co);

    nbd_client_detach_aio_context(bs);
    object_unref(OBJECT(client->sioc));
@@ -68,7 +68,7 @@ static void nbd_teardown_connection(BlockDriverState *bs)
    client->ioc = NULL;
 }

-static coroutine_fn void nbd_connection_entry(void *opaque)
+static coroutine_fn void nbd_read_reply_entry(void *opaque)
 {
    NBDClientSession *s = opaque;
    uint64_t i;
@@ -76,21 +76,10 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
    Error *local_err = NULL;

    while (!s->quit) {
-        /*
-         * The NBD client can only really be considered idle when it has
-         * yielded from qio_channel_readv_all_eof(), waiting for data. This is
-         * the point where the additional scheduled coroutine entry happens
-         * after nbd_client_attach_aio_context().
-         *
-         * Therefore we keep an additional in_flight reference all the time and
-         * only drop it temporarily here.
-         */
        assert(s->reply.handle == 0);
-        ret = nbd_receive_reply(s->bs, s->ioc, &s->reply, &local_err);
-
+        ret = nbd_receive_reply(s->ioc, &s->reply, &local_err);
        if (local_err) {
-            trace_nbd_read_reply_entry_fail(ret, error_get_pretty(local_err));
-            error_free(local_err);
+            error_report_err(local_err);
        }
        if (ret <= 0) {
            break;
@@ -110,14 +99,14 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
        }

        /* We're woken up again by the request itself.  Note that there
-         * is no race between yielding and reentering connection_co.  This
+         * is no race between yielding and reentering read_reply_co.  This
         * is because:
         *
         * - if the request runs on the same AioContext, it is only
         *   entered after we yield
         *
         * - if the request runs on a different AioContext, reentering
-         *   connection_co happens through a bottom half, which can only
+         *   read_reply_co happens through a bottom half, which can only
         *   run after we yield.
         */
        aio_co_wake(s->requests[i].coroutine);
@@ -126,9 +115,7 @@ static coroutine_fn void nbd_connection_entry(void *opaque)

    s->quit = true;
    nbd_recv_coroutines_wake_all(s);
-    bdrv_dec_in_flight(s->bs);
-
-    s->connection_co = NULL;
+    s->read_reply_co = NULL;
    aio_wait_kick();
 }

@@ -164,7 +151,10 @@ static int nbd_co_send_request(BlockDriverState *bs,
        rc = -EIO;
        goto err;
    }
-    assert(s->ioc);
+    if (!s->ioc) {
+        rc = -EPIPE;
+        goto err;
+    }

    if (qiov) {
        qio_channel_set_cork(s->ioc, true);
@@ -257,11 +247,11 @@ static int nbd_parse_blockstatus_payload(NBDClientSession *client,
    }

    context_id = payload_advance32(&payload);
-    if (client->info.context_id != context_id) {
+    if (client->info.meta_base_allocation_id != context_id) {
        error_setg(errp, "Protocol error: unexpected context id %d for "
                         "NBD_REPLY_TYPE_BLOCK_STATUS, when negotiated context "
                         "id is %d", context_id,
-                         client->info.context_id);
+                         client->info.meta_base_allocation_id);
        return -EINVAL;
    }

@@ -345,9 +335,10 @@ static int nbd_co_receive_offset_data_payload(NBDClientSession *s,
        return -EINVAL;
    }

-    if (nbd_read64(s->ioc, &offset, "OFFSET_DATA offset", errp) < 0) {
+    if (nbd_read(s->ioc, &offset, sizeof(offset), errp) < 0) {
        return -EIO;
    }
+    be64_to_cpus(&offset);

    data_size = chunk->length - sizeof(offset);
    assert(data_size);
@@ -394,7 +385,7 @@ static coroutine_fn int nbd_co_receive_structured_payload(
    }

    *payload = g_new(char, len);
-    ret = nbd_read(s->ioc, *payload, len, "structured payload", errp);
+    ret = nbd_read(s->ioc, *payload, len, errp);
    if (ret < 0) {
        g_free(*payload);
        *payload = NULL;
@@ -432,15 +423,14 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
    }
    *request_ret = 0;

-    /* Wait until we're woken up by nbd_connection_entry.  */
+    /* Wait until we're woken up by nbd_read_reply_entry.  */
    s->requests[i].receiving = true;
    qemu_coroutine_yield();
    s->requests[i].receiving = false;
-    if (s->quit) {
+    if (!s->ioc || s->quit) {
        error_setg(errp, "Connection closed");
        return -EIO;
    }
-    assert(s->ioc);

    assert(s->reply.handle == handle);

@@ -507,29 +497,30 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
 }

 /* nbd_co_receive_one_chunk
- * Read reply, wake up connection_co and set s->quit if needed.
+ * Read reply, wake up read_reply_co and set s->quit if needed.
 * Return value is a fatal error code or normal nbd reply error code
 */
 static coroutine_fn int nbd_co_receive_one_chunk(
        NBDClientSession *s, uint64_t handle, bool only_structured,
-        int *request_ret, QEMUIOVector *qiov, NBDReply *reply, void **payload,
-        Error **errp)
+        QEMUIOVector *qiov, NBDReply *reply, void **payload, Error **errp)
 {
+    int request_ret;
    int ret = nbd_co_do_receive_one_chunk(s, handle, only_structured,
-                                          request_ret, qiov, payload, errp);
+                                          &request_ret, qiov, payload, errp);

    if (ret < 0) {
        s->quit = true;
    } else {
-        /* For assert at loop start in nbd_connection_entry */
+        /* For assert at loop start in nbd_read_reply_entry */
        if (reply) {
            *reply = s->reply;
        }
        s->reply.handle = 0;
+        ret = request_ret;
    }

-    if (s->connection_co) {
-        aio_co_wake(s->connection_co);
+    if (s->read_reply_co) {
+        aio_co_wake(s->read_reply_co);
    }

    return ret;
@@ -537,17 +528,22 @@ static coroutine_fn int nbd_co_receive_one_chunk(

 typedef struct NBDReplyChunkIter {
    int ret;
-    int request_ret;
+    bool fatal;
    Error *err;
    bool done, only_structured;
 } NBDReplyChunkIter;

-static void nbd_iter_channel_error(NBDReplyChunkIter *iter,
-                                   int ret, Error **local_err)
+static void nbd_iter_error(NBDReplyChunkIter *iter, bool fatal,
+                           int ret, Error **local_err)
 {
    assert(ret < 0);

-    if (!iter->ret) {
+    if ((fatal && !iter->fatal) || iter->ret == 0) {
+        if (iter->ret != 0) {
+            error_free(iter->err);
+            iter->err = NULL;
+        }
+        iter->fatal = fatal;
        iter->ret = ret;
        error_propagate(&iter->err, *local_err);
    } else {
@@ -557,15 +553,6 @@ static void nbd_iter_channel_error(NBDReplyChunkIter *iter,
    *local_err = NULL;
 }

-static void nbd_iter_request_error(NBDReplyChunkIter *iter, int ret)
-{
-    assert(ret < 0);
-
-    if (!iter->request_ret) {
-        iter->request_ret = ret;
-    }
-}
-
 /* NBD_FOREACH_REPLY_CHUNK
 */
 #define NBD_FOREACH_REPLY_CHUNK(s, iter, handle, structured, \
@@ -581,13 +568,13 @@ static bool nbd_reply_chunk_iter_receive(NBDClientSession *s,
                                         QEMUIOVector *qiov, NBDReply *reply,
                                         void **payload)
 {
-    int ret, request_ret;
+    int ret;
    NBDReply local_reply;
    NBDStructuredReplyChunk *chunk;
    Error *local_err = NULL;
    if (s->quit) {
        error_setg(&local_err, "Connection closed");
-        nbd_iter_channel_error(iter, -EIO, &local_err);
+        nbd_iter_error(iter, true, -EIO, &local_err);
        goto break_loop;
    }

@@ -601,16 +588,14 @@ static bool nbd_reply_chunk_iter_receive(NBDClientSession *s,
    }

    ret = nbd_co_receive_one_chunk(s, handle, iter->only_structured,
-                                   &request_ret, qiov, reply, payload,
-                                   &local_err);
+                                   qiov, reply, payload, &local_err);
    if (ret < 0) {
-        nbd_iter_channel_error(iter, ret, &local_err);
-    } else if (request_ret < 0) {
-        nbd_iter_request_error(iter, request_ret);
+        /* If it is a fatal error s->quit is set by nbd_co_receive_one_chunk */
+        nbd_iter_error(iter, s->quit, ret, &local_err);
    }

    /* Do not execute the body of NBD_FOREACH_REPLY_CHUNK for simple reply. */
-    if (nbd_reply_is_simple(reply) || s->quit) {
+    if (nbd_reply_is_simple(&s->reply) || s->quit) {
        goto break_loop;
    }

@@ -643,7 +628,7 @@ break_loop:
 }

 static int nbd_co_receive_return_code(NBDClientSession *s, uint64_t handle,
-                                      int *request_ret, Error **errp)
+                                      Error **errp)
 {
    NBDReplyChunkIter iter;

@@ -652,13 +637,12 @@ static int nbd_co_receive_return_code(NBDClientSession *s, uint64_t handle,
    }

    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                                        uint64_t offset, QEMUIOVector *qiov,
-                                        int *request_ret, Error **errp)
+                                        Error **errp)
 {
    NBDReplyChunkIter iter;
    NBDReply reply;
@@ -683,7 +667,7 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                                                offset, qiov, &local_err);
            if (ret < 0) {
                s->quit = true;
-                nbd_iter_channel_error(&iter, ret, &local_err);
+                nbd_iter_error(&iter, true, ret, &local_err);
            }
            break;
        default:
@@ -693,7 +677,7 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                error_setg(&local_err,
                           "Unexpected reply type: %d (%s) for CMD_READ",
                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
        }

@@ -702,14 +686,12 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
    }

    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                                            uint64_t handle, uint64_t length,
-                                            NBDExtent *extent,
-                                            int *request_ret, Error **errp)
+                                            NBDExtent *extent, Error **errp)
 {
    NBDReplyChunkIter iter;
    NBDReply reply;
@@ -731,7 +713,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
            if (received) {
                s->quit = true;
                error_setg(&local_err, "Several BLOCK_STATUS chunks in reply");
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
            received = true;

@@ -740,7 +722,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                                                &local_err);
            if (ret < 0) {
                s->quit = true;
-                nbd_iter_channel_error(&iter, ret, &local_err);
+                nbd_iter_error(&iter, true, ret, &local_err);
            }
            break;
        default:
@@ -750,7 +732,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                           "Unexpected reply type: %d (%s) "
                           "for CMD_BLOCK_STATUS",
                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
        }

@@ -765,16 +747,14 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
            iter.ret = -EIO;
        }
    }
-
    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
                          QEMUIOVector *write_qiov)
 {
-    int ret, request_ret;
+    int ret;
    Error *local_err = NULL;
    NBDClientSession *client = nbd_get_client_session(bs);

@@ -790,22 +770,17 @@ static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
        return ret;
    }

-    ret = nbd_co_receive_return_code(client, request->handle,
-                                     &request_ret, &local_err);
+    ret = nbd_co_receive_return_code(client, request->handle, &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request->from, request->len, request->handle,
-                                  request->flags, request->type,
-                                  nbd_cmd_lookup(request->type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    return ret ? ret : request_ret;
+    return ret;
 }

 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    int ret, request_ret;
+    int ret;
    Error *local_err = NULL;
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
@@ -826,15 +801,11 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
    }

    ret = nbd_co_receive_cmdread_reply(client, request.handle, offset, qiov,
-                                       &request_ret, &local_err);
+                                       &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    return ret ? ret : request_ret;
+    return ret;
 }

 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
@@ -928,7 +899,7 @@ int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
                                            int64_t *pnum, int64_t *map,
                                            BlockDriverState **file)
 {
-    int ret, request_ret;
+    int64_t ret;
    NBDExtent extent = { 0 };
    NBDClientSession *client = nbd_get_client_session(bs);
    Error *local_err = NULL;
@@ -953,16 +924,12 @@ int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
    }

    ret = nbd_co_receive_blockstatus_reply(client, request.handle, bytes,
-                                           &extent, &request_ret, &local_err);
+                                           &extent, &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    if (ret < 0 || request_ret < 0) {
-        return ret ? ret : request_ret;
+    if (ret < 0) {
+        return ret;
    }

    assert(extent.length);
@@ -977,30 +944,12 @@ void nbd_client_detach_aio_context(BlockDriverState *bs)
    qio_channel_detach_aio_context(QIO_CHANNEL(client->ioc));
 }

-static void nbd_client_attach_aio_context_bh(void *opaque)
-{
-    BlockDriverState *bs = opaque;
-    NBDClientSession *client = nbd_get_client_session(bs);
-
-    /* The node is still drained, so we know the coroutine has yielded in
-     * nbd_read_eof(), the only place where bs->in_flight can reach 0, or it is
-     * entered for the first time. Both places are safe for entering the
-     * coroutine.*/
-    qemu_aio_coroutine_enter(bs->aio_context, client->connection_co);
-    bdrv_dec_in_flight(bs);
-}
-
 void nbd_client_attach_aio_context(BlockDriverState *bs,
                                   AioContext *new_context)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    qio_channel_attach_aio_context(QIO_CHANNEL(client->ioc), new_context);
-
-    bdrv_inc_in_flight(bs);
-
-    /* Need to wait here for the BH to run because the BH must run while the
-     * node is still drained. */
-    aio_wait_bh_oneshot(new_context, nbd_client_attach_aio_context_bh, bs);
+    aio_co_schedule(new_context, client->read_reply_co);
 }

 void nbd_client_close(BlockDriverState *bs)
@@ -1008,55 +957,26 @@ void nbd_client_close(BlockDriverState *bs)
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = { .type = NBD_CMD_DISC };

-    assert(client->ioc);
+    if (client->ioc == NULL) {
+        return;
+    }

    nbd_send_request(client->ioc, &request);

    nbd_teardown_connection(bs);
 }

-static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
-                                                  Error **errp)
-{
-    QIOChannelSocket *sioc;
-    Error *local_err = NULL;
-
-    sioc = qio_channel_socket_new();
-    qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");
-
-    qio_channel_socket_connect_sync(sioc, saddr, &local_err);
-    if (local_err) {
-        object_unref(OBJECT(sioc));
-        error_propagate(errp, local_err);
-        return NULL;
-    }
-
-    qio_channel_set_delay(QIO_CHANNEL(sioc), false);
-
-    return sioc;
-}
-
-static int nbd_client_connect(BlockDriverState *bs,
-                              SocketAddress *saddr,
-                              const char *export,
-                              QCryptoTLSCreds *tlscreds,
-                              const char *hostname,
-                              const char *x_dirty_bitmap,
-                              Error **errp)
+int nbd_client_init(BlockDriverState *bs,
+                    QIOChannelSocket *sioc,
+                    const char *export,
+                    QCryptoTLSCreds *tlscreds,
+                    const char *hostname,
+                    const char *x_dirty_bitmap,
+                    Error **errp)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    int ret;

-    /*
-     * establish TCP connection, return error if it fails
-     * TODO: Configurable retry-until-timeout behaviour.
-     */
-    QIOChannelSocket *sioc = nbd_establish_connection(saddr, errp);
-
-    if (!sioc) {
-        return -ECONNREFUSED;
-    }
-
    /* NBD handshake */
    logout("session init %s\n", export);
    qio_channel_set_blocking(QIO_CHANNEL(sioc), true, NULL);
@@ -1065,14 +985,12 @@ static int nbd_client_connect(BlockDriverState *bs,
    client->info.structured_reply = true;
    client->info.base_allocation = true;
    client->info.x_dirty_bitmap = g_strdup(x_dirty_bitmap);
-    client->info.name = g_strdup(export ?: "");
-    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), tlscreds, hostname,
+    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), export,
+                                tlscreds, hostname,
                                &client->ioc, &client->info, errp);
    g_free(client->info.x_dirty_bitmap);
-    g_free(client->info.name);
    if (ret < 0) {
        logout("Failed to negotiate with the NBD server\n");
-        object_unref(OBJECT(sioc));
        return ret;
    }
    if (x_dirty_bitmap && !client->info.base_allocation) {
@@ -1095,7 +1013,10 @@ static int nbd_client_connect(BlockDriverState *bs,
        bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
    }

+    qemu_co_mutex_init(&client->send_mutex);
+    qemu_co_queue_init(&client->free_sema);
    client->sioc = sioc;
+    object_ref(OBJECT(client->sioc));

    if (!client->ioc) {
        client->ioc = QIO_CHANNEL(sioc);
@@ -1105,8 +1026,7 @@ static int nbd_client_connect(BlockDriverState *bs,
    /* Now that we're connected, set the socket to be non-blocking and
     * kick the reply mechanism.  */
    qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);
-    client->connection_co = qemu_coroutine_create(nbd_connection_entry, client);
-    bdrv_inc_in_flight(bs);
+    client->read_reply_co = qemu_coroutine_create(nbd_read_reply_entry, client);
    nbd_client_attach_aio_context(bs, bdrv_get_aio_context(bs));

    logout("Established connection with NBD server\n");
@@ -1122,27 +1042,6 @@ static int nbd_client_connect(BlockDriverState *bs,
        NBDRequest request = { .type = NBD_CMD_DISC };

        nbd_send_request(client->ioc ?: QIO_CHANNEL(sioc), &request);
-
-        object_unref(OBJECT(sioc));
-
        return ret;
    }
 }
-
-int nbd_client_init(BlockDriverState *bs,
-                    SocketAddress *saddr,
-                    const char *export,
-                    QCryptoTLSCreds *tlscreds,
-                    const char *hostname,
-                    const char *x_dirty_bitmap,
-                    Error **errp)
-{
-    NBDClientSession *client = nbd_get_client_session(bs);
-
-    client->bs = bs;
-    qemu_co_mutex_init(&client->send_mutex);
-    qemu_co_queue_init(&client->free_sema);
-
-    return nbd_client_connect(bs, saddr, export, tlscreds, hostname,
-                              x_dirty_bitmap, errp);
-}
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -20,7 +20,7 @@
 typedef struct {
    Coroutine *coroutine;
    uint64_t offset;        /* original offset of the request */
-    bool receiving;         /* waiting for connection_co? */
+    bool receiving;         /* waiting for read_reply_co? */
 } NBDClientRequest;

 typedef struct NBDClientSession {
@@ -30,19 +30,18 @@ typedef struct NBDClientSession {

    CoMutex send_mutex;
    CoQueue free_sema;
-    Coroutine *connection_co;
+    Coroutine *read_reply_co;
    int in_flight;

    NBDClientRequest requests[MAX_NBD_REQUESTS];
    NBDReply reply;
-    BlockDriverState *bs;
    bool quit;
 } NBDClientSession;

 NBDClientSession *nbd_get_client_session(BlockDriverState *bs);

 int nbd_client_init(BlockDriverState *bs,
-                    SocketAddress *saddr,
+                    QIOChannelSocket *sock,
                    const char *export_name,
                    QCryptoTLSCreds *tlscreds,
                    const char *hostname,
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -295,6 +295,30 @@ NBDClientSession *nbd_get_client_session(BlockDriverState *bs)
    return &s->client;
 }

+static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
+                                                  Error **errp)
+{
+    QIOChannelSocket *sioc;
+    Error *local_err = NULL;
+
+    sioc = qio_channel_socket_new();
+    qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");
+
+    qio_channel_socket_connect_sync(sioc,
+                                    saddr,
+                                    &local_err);
+    if (local_err) {
+        object_unref(OBJECT(sioc));
+        error_propagate(errp, local_err);
+        return NULL;
+    }
+
+    qio_channel_set_delay(QIO_CHANNEL(sioc), false);
+
+    return sioc;
+}
+
+
 static QCryptoTLSCreds *nbd_get_tls_creds(const char *id, Error **errp)
 {
    Object *obj;
@@ -370,6 +394,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
    BDRVNBDState *s = bs->opaque;
    QemuOpts *opts = NULL;
    Error *local_err = NULL;
+    QIOChannelSocket *sioc = NULL;
    QCryptoTLSCreds *tlscreds = NULL;
    const char *hostname = NULL;
    int ret = -EINVAL;
@@ -409,11 +434,22 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        hostname = s->saddr->u.inet.host;
    }

-    /* NBD handshake */
-    ret = nbd_client_init(bs, s->saddr, s->export, tlscreds, hostname,
-                          qemu_opt_get(opts, "x-dirty-bitmap"), errp);
+    /* establish TCP connection, return error if it fails
+     * TODO: Configurable retry-until-timeout behaviour.
+     */
+    sioc = nbd_establish_connection(s->saddr, errp);
+    if (!sioc) {
+        ret = -ECONNREFUSED;
+        goto error;
+    }

+    /* NBD handshake */
+    ret = nbd_client_init(bs, sioc, s->export, tlscreds, hostname,
+                          qemu_opt_get(opts, "x-dirty-bitmap"), errp);
 error:
+    if (sioc) {
+        object_unref(OBJECT(sioc));
+    }
    if (tlscreds) {
        object_unref(OBJECT(tlscreds));
    }
@@ -477,9 +513,12 @@ static void nbd_attach_aio_context(BlockDriverState *bs,
    nbd_client_attach_aio_context(bs, new_context);
 }

-static void nbd_refresh_filename(BlockDriverState *bs)
+static void nbd_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVNBDState *s = bs->opaque;
+    QDict *opts = qdict_new();
+    QObject *saddr_qdict;
+    Visitor *ov;
    const char *host = NULL, *port = NULL, *path = NULL;

    if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
@@ -492,6 +531,8 @@ static void nbd_refresh_filename(BlockDriverState *bs)
        path = s->saddr->u.q_unix.path;
    } /* else can't represent as pseudo-filename */

+    qdict_put_str(opts, "driver", "nbd");
+
    if (path && s->export) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nbd+unix:///%s?socket=%s", s->export, path);
@@ -505,29 +546,24 @@ static void nbd_refresh_filename(BlockDriverState *bs)
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nbd://%s:%s", host, port);
    }
+
+    ov = qobject_output_visitor_new(&saddr_qdict);
+    visit_type_SocketAddress(ov, NULL, &s->saddr, &error_abort);
+    visit_complete(ov, &saddr_qdict);
+    visit_free(ov);
+    qdict_put_obj(opts, "server", saddr_qdict);
+
+    if (s->export) {
+        qdict_put_str(opts, "export", s->export);
+    }
+    if (s->tlscredsid) {
+        qdict_put_str(opts, "tls-creds", s->tlscredsid);
+    }
+
+    qdict_flatten(opts);
+    bs->full_open_options = opts;
 }

-static char *nbd_dirname(BlockDriverState *bs, Error **errp)
-{
-    /* The generic bdrv_dirname() implementation is able to work out some
-     * directory name for NBD nodes, but that would be wrong. So far there is no
-     * specification for how "export paths" would work, so NBD does not have
-     * directory names. */
-    error_setg(errp, "Cannot generate a base directory for NBD nodes");
-    return NULL;
-}
-
-static const char *const nbd_strong_runtime_opts[] = {
-    "path",
-    "host",
-    "port",
-    "export",
-    "tls-creds",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_nbd = {
    .format_name                = "nbd",
    .protocol_name              = "nbd",
@@ -546,8 +582,6 @@ static BlockDriver bdrv_nbd = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static BlockDriver bdrv_nbd_tcp = {
@@ -568,8 +602,6 @@ static BlockDriver bdrv_nbd_tcp = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static BlockDriver bdrv_nbd_unix = {
@@ -590,8 +622,6 @@ static BlockDriver bdrv_nbd_unix = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static void bdrv_nbd_init(void)
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -799,9 +799,14 @@ static int nfs_reopen_prepare(BDRVReopenState *state,
    return 0;
 }

-static void nfs_refresh_filename(BlockDriverState *bs)
+static void nfs_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    NFSClient *client = bs->opaque;
+    QDict *opts = qdict_new();
+    QObject *server_qdict;
+    Visitor *ov;
+
+    qdict_put_str(opts, "driver", "nfs");

    if (client->uid && !client->gid) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
@@ -819,20 +824,35 @@ static void nfs_refresh_filename(BlockDriverState *bs)
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nfs://%s%s", client->server->host, client->path);
    }
-}

-static char *nfs_dirname(BlockDriverState *bs, Error **errp)
-{
-    NFSClient *client = bs->opaque;
+    ov = qobject_output_visitor_new(&server_qdict);
+    visit_type_NFSServer(ov, NULL, &client->server, &error_abort);
+    visit_complete(ov, &server_qdict);
+    qdict_put_obj(opts, "server", server_qdict);
+    qdict_put_str(opts, "path", client->path);

-    if (client->uid || client->gid) {
-        bdrv_refresh_filename(bs);
-        error_setg(errp, "Cannot generate a base directory for NFS node '%s'",
-                   bs->filename);
-        return NULL;
+    if (client->uid) {
+        qdict_put_int(opts, "user", client->uid);
+    }
+    if (client->gid) {
+        qdict_put_int(opts, "group", client->gid);
+    }
+    if (client->tcp_syncnt) {
+        qdict_put_int(opts, "tcp-syn-cnt", client->tcp_syncnt);
+    }
+    if (client->readahead) {
+        qdict_put_int(opts, "readahead-size", client->readahead);
+    }
+    if (client->pagecache) {
+        qdict_put_int(opts, "page-cache-size", client->pagecache);
+    }
+    if (client->debug) {
+        qdict_put_int(opts, "debug", client->debug);
    }

-    return g_strdup_printf("nfs://%s%s/", client->server->host, client->path);
+    visit_free(ov);
+    qdict_flatten(opts);
+    bs->full_open_options = opts;
 }

 #ifdef LIBNFS_FEATURE_PAGECACHE
@@ -844,15 +864,6 @@ static void coroutine_fn nfs_co_invalidate_cache(BlockDriverState *bs,
 }
 #endif

-static const char *nfs_strong_runtime_opts[] = {
-    "path",
-    "user",
-    "group",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_nfs = {
    .format_name                    = "nfs",
    .protocol_name                  = "nfs",
@@ -878,9 +889,6 @@ static BlockDriver bdrv_nfs = {
    .bdrv_detach_aio_context        = nfs_detach_aio_context,
    .bdrv_attach_aio_context        = nfs_attach_aio_context,
    .bdrv_refresh_filename          = nfs_refresh_filename,
-    .bdrv_dirname                   = nfs_dirname,
-
-    .strong_runtime_opts            = nfs_strong_runtime_opts,

 #ifdef LIBNFS_FEATURE_PAGECACHE
    .bdrv_co_invalidate_cache       = nfs_co_invalidate_cache,
--- a/block/null.c
+++ b/block/null.c
@@ -239,33 +239,19 @@ static int coroutine_fn null_co_block_status(BlockDriverState *bs,
    return ret;
 }

-static void null_refresh_filename(BlockDriverState *bs)
+static void null_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
-    const QDictEntry *e;
+    qdict_del(opts, "filename");

-    for (e = qdict_first(bs->full_open_options); e;
-         e = qdict_next(bs->full_open_options, e))
-    {
-        /* These options can be ignored */
-        if (strcmp(qdict_entry_key(e), "filename") &&
-            strcmp(qdict_entry_key(e), "driver") &&
-            strcmp(qdict_entry_key(e), NULL_OPT_LATENCY))
-        {
-            return;
-        }
+    if (!qdict_size(opts)) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
+                 bs->drv->format_name);
    }

-    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
-             bs->drv->format_name);
+    qdict_put_str(opts, "driver", bs->drv->format_name);
+    bs->full_open_options = qobject_ref(opts);
 }

-static const char *const null_strong_runtime_opts[] = {
-    BLOCK_OPT_SIZE,
-    NULL_OPT_ZEROES,
-
-    NULL
-};
-
 static BlockDriver bdrv_null_co = {
    .format_name            = "null-co",
    .protocol_name          = "null-co",
@@ -283,7 +269,6 @@ static BlockDriver bdrv_null_co = {
    .bdrv_co_block_status   = null_co_block_status,

    .bdrv_refresh_filename  = null_refresh_filename,
-    .strong_runtime_opts    = null_strong_runtime_opts,
 };

 static BlockDriver bdrv_null_aio = {
@@ -303,7 +288,6 @@ static BlockDriver bdrv_null_aio = {
    .bdrv_co_block_status   = null_co_block_status,

    .bdrv_refresh_filename  = null_refresh_filename,
-    .strong_runtime_opts    = null_strong_runtime_opts,
 };

 static void bdrv_null_init(void)
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -82,7 +82,7 @@ typedef volatile struct {
    uint8_t  reserved1[0xec0];
    uint8_t  cmd_set_specfic[0x100];
    uint32_t doorbells[];
-} NVMeRegs;
+} QEMU_PACKED NVMeRegs;

 QEMU_BUILD_BUG_ON(offsetof(NVMeRegs, doorbells) != 0x1000);

@@ -111,9 +111,6 @@ typedef struct {

    /* Total size of mapped qiov, accessed under dma_map_lock */
    int dma_map_count;
-
-    /* PCI address (required for nvme_refresh_filename()) */
-    char *device;
 } BDRVNVMeState;

 #define NVME_BLOCK_OPT_DEVICE "device"
@@ -560,7 +557,6 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,

    qemu_co_mutex_init(&s->dma_map_lock);
    qemu_co_queue_init(&s->dma_flush_queue);
-    s->device = g_strdup(device);
    s->nsid = namespace;
    s->aio_context = bdrv_get_aio_context(bs);
    ret = event_notifier_init(&s->irq_notifier, 0);
@@ -733,8 +729,6 @@ static void nvme_close(BlockDriverState *bs)
    event_notifier_cleanup(&s->irq_notifier);
    qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
    qemu_vfio_close(s->vfio);
-
-    g_free(s->device);
 }

 static int nvme_file_open(BlockDriverState *bs, QDict *options, int flags,
@@ -844,7 +838,7 @@ try_map:
        }

        for (j = 0; j < qiov->iov[i].iov_len / s->page_size; j++) {
-            pagelist[entries++] = cpu_to_le64(iova + j * s->page_size);
+            pagelist[entries++] = iova + j * s->page_size;
        }
        trace_nvme_cmd_map_qiov_iov(s, i, qiov->iov[i].iov_base,
                                    qiov->iov[i].iov_len / s->page_size);
@@ -857,16 +851,20 @@ try_map:
    case 0:
        abort();
    case 1:
-        cmd->prp1 = pagelist[0];
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
        cmd->prp2 = 0;
        break;
    case 2:
-        cmd->prp1 = pagelist[0];
-        cmd->prp2 = pagelist[1];
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
+        cmd->prp2 = cpu_to_le64(pagelist[1]);;
        break;
    default:
-        cmd->prp1 = pagelist[0];
-        cmd->prp2 = cpu_to_le64(req->prp_list_iova + sizeof(uint64_t));
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
+        cmd->prp2 = cpu_to_le64(req->prp_list_iova);
+        for (i = 0; i < entries - 1; ++i) {
+            pagelist[i] = cpu_to_le64(pagelist[i + 1]);
+        }
+        pagelist[entries - 1] = 0;
        break;
    }
    trace_nvme_cmd_map_qiov(s, cmd, req, qiov, entries);
@@ -1059,12 +1057,17 @@ static int nvme_reopen_prepare(BDRVReopenState *reopen_state,
    return 0;
 }

-static void nvme_refresh_filename(BlockDriverState *bs)
+static void nvme_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
-    BDRVNVMeState *s = bs->opaque;
+    qdict_del(opts, "filename");

-    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "nvme://%s/%i",
-             s->device, s->nsid);
+    if (!qdict_size(opts)) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
+                 bs->drv->format_name);
+    }
+
+    qdict_put_str(opts, "driver", bs->drv->format_name);
+    bs->full_open_options = qobject_ref(opts);
 }

 static void nvme_refresh_limits(BlockDriverState *bs, Error **errp)
@@ -1137,13 +1140,6 @@ static void nvme_unregister_buf(BlockDriverState *bs, void *host)
    qemu_vfio_dma_unmap(s->vfio, host);
 }

-static const char *const nvme_strong_runtime_opts[] = {
-    NVME_BLOCK_OPT_DEVICE,
-    NVME_BLOCK_OPT_NAMESPACE,
-
-    NULL
-};
-
 static BlockDriver bdrv_nvme = {
    .format_name              = "nvme",
    .protocol_name            = "nvme",
@@ -1161,7 +1157,6 @@ static BlockDriver bdrv_nvme = {

    .bdrv_refresh_filename    = nvme_refresh_filename,
    .bdrv_refresh_limits      = nvme_refresh_limits,
-    .strong_runtime_opts      = nvme_strong_runtime_opts,

    .bdrv_detach_aio_context  = nvme_detach_aio_context,
    .bdrv_attach_aio_context  = nvme_attach_aio_context,
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -220,20 +220,23 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
    if (bs->backing) {
        int64_t nb_cow_sectors = to_allocate * s->tracks;
        int64_t nb_cow_bytes = nb_cow_sectors << BDRV_SECTOR_BITS;
-        QEMUIOVector qiov =
-            QEMU_IOVEC_INIT_BUF(qiov, qemu_blockalign(bs, nb_cow_bytes),
-                                nb_cow_bytes);
+        QEMUIOVector qiov;
+        struct iovec iov = {
+            .iov_len = nb_cow_bytes,
+            .iov_base = qemu_blockalign(bs, nb_cow_bytes)
+        };
+        qemu_iovec_init_external(&qiov, &iov, 1);

        ret = bdrv_co_preadv(bs->backing, idx * s->tracks * BDRV_SECTOR_SIZE,
                             nb_cow_bytes, &qiov, 0);
        if (ret < 0) {
-            qemu_vfree(qemu_iovec_buf(&qiov));
+            qemu_vfree(iov.iov_base);
            return ret;
        }

        ret = bdrv_co_pwritev(bs->file, s->data_end * BDRV_SECTOR_SIZE,
                              nb_cow_bytes, &qiov, 0);
-        qemu_vfree(qemu_iovec_buf(&qiov));
+        qemu_vfree(iov.iov_base);
        if (ret < 0) {
            return ret;
        }
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -51,8 +51,6 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
        return NULL;
    }

-    bdrv_refresh_filename(bs);
-
    info = g_malloc0(sizeof(*info));
    info->file                   = g_strdup(bs->filename);
    info->ro                     = bs->read_only;
@@ -266,8 +264,6 @@ void bdrv_query_image_info(BlockDriverState *bs,
        goto out;
    }

-    bdrv_refresh_filename(bs);
-
    info = g_new0(ImageInfo, 1);
    info->filename        = g_strdup(bs->filename);
    info->format          = g_strdup(bdrv_get_format_name(bs));
@@ -286,20 +282,23 @@ void bdrv_query_image_info(BlockDriverState *bs,
        info->dirty_flag = bdi.is_dirty;
        info->has_dirty_flag = true;
    }
-    info->format_specific = bdrv_get_specific_info(bs, &err);
-    if (err) {
-        error_propagate(errp, err);
-        qapi_free_ImageInfo(info);
-        goto out;
-    }
+    info->format_specific     = bdrv_get_specific_info(bs);
    info->has_format_specific = info->format_specific != NULL;

    backing_filename = bs->backing_file;
    if (backing_filename[0] != '\0') {
-        char *backing_filename2;
+        char *backing_filename2 = g_malloc0(PATH_MAX);
        info->backing_filename = g_strdup(backing_filename);
        info->has_backing_filename = true;
-        backing_filename2 = bdrv_get_full_backing_filename(bs, NULL);
+        bdrv_get_full_backing_filename(bs, backing_filename2, PATH_MAX, &err);
+        if (err) {
+            /* Can't reconstruct the full backing filename, so we must omit
+             * this field and apply a Best Effort to this query. */
+            g_free(backing_filename2);
+            backing_filename2 = NULL;
+            error_free(err);
+            err = NULL;
+        }

        /* Always report the full_backing_filename if present, even if it's the
         * same as backing_filename. That they are same is useful info. */
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -31,7 +31,6 @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/bswap.h"
-#include "qemu/cutils.h"
 #include <zlib.h>
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
@@ -214,7 +213,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
            }
            s->crypto = qcrypto_block_open(crypto_opts, "encrypt.",
-                                           NULL, NULL, cflags, 1, errp);
+                                           NULL, NULL, cflags, errp);
            if (!s->crypto) {
                ret = -EINVAL;
                goto fail;
@@ -296,13 +295,11 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
            goto fail;
        }
        ret = bdrv_pread(bs->file, header.backing_file_offset,
-                   bs->auto_backing_file, len);
+                   bs->backing_file, len);
        if (ret < 0) {
            goto fail;
        }
-        bs->auto_backing_file[len] = '\0';
-        pstrcpy(bs->backing_file, sizeof(bs->backing_file),
-                bs->auto_backing_file);
+        bs->backing_file[len] = '\0';
    }

    /* Disable migration when qcow images are used */
@@ -631,6 +628,7 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
    int offset_in_cluster;
    int ret = 0, n;
    uint64_t cluster_offset;
+    struct iovec hd_iov;
    QEMUIOVector hd_qiov;
    uint8_t *buf;
    void *orig_buf;
@@ -663,7 +661,9 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
        if (!cluster_offset) {
            if (bs->backing) {
                /* read from the base image */
-                qemu_iovec_init_buf(&hd_qiov, buf, n);
+                hd_iov.iov_base = (void *)buf;
+                hd_iov.iov_len = n;
+                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
                qemu_co_mutex_unlock(&s->lock);
                /* qcow2 emits this on bs->file instead of bs->backing */
                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
@@ -688,7 +688,9 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
                ret = -EIO;
                break;
            }
-            qemu_iovec_init_buf(&hd_qiov, buf, n);
+            hd_iov.iov_base = (void *)buf;
+            hd_iov.iov_len = n;
+            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
            qemu_co_mutex_unlock(&s->lock);
            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
            ret = bdrv_co_preadv(bs->file, cluster_offset + offset_in_cluster,
@@ -731,6 +733,7 @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
    int offset_in_cluster;
    uint64_t cluster_offset;
    int ret = 0, n;
+    struct iovec hd_iov;
    QEMUIOVector hd_qiov;
    uint8_t *buf;
    void *orig_buf;
@@ -776,7 +779,9 @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
            }
        }

-        qemu_iovec_init_buf(&hd_qiov, buf, n);
+        hd_iov.iov_base = (void *)buf;
+        hd_iov.iov_len = n;
+        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
        qemu_co_mutex_unlock(&s->lock);
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
        ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
@@ -1057,6 +1062,7 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 {
    BDRVQcowState *s = bs->opaque;
    QEMUIOVector hd_qiov;
+    struct iovec iov;
    z_stream strm;
    int ret, out_len;
    uint8_t *buf, *out_buf;
@@ -1122,7 +1128,11 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
    }
    cluster_offset &= s->cluster_offset_mask;

-    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
+    iov = (struct iovec) {
+        .iov_base   = out_buf,
+        .iov_len    = out_len,
+    };
+    qemu_iovec_init_external(&hd_qiov, &iov, 1);
    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
    ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
    if (ret < 0) {
@@ -1173,12 +1183,6 @@ static QemuOptsList qcow_create_opts = {
    }
 };

-static const char *const qcow_strong_runtime_opts[] = {
-    "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
-
-    NULL
-};
-
 static BlockDriver bdrv_qcow = {
    .format_name	= "qcow",
    .instance_size	= sizeof(BDRVQcowState),
@@ -1202,7 +1206,6 @@ static BlockDriver bdrv_qcow = {
    .bdrv_get_info          = qcow_get_info,

    .create_opts            = &qcow_create_opts,
-    .strong_runtime_opts    = qcow_strong_runtime_opts,
 };

 static void bdrv_qcow_init(void)
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -77,6 +77,8 @@ typedef struct Qcow2BitmapTable {
    uint32_t size; /* number of 64bit entries */
    QSIMPLEQ_ENTRY(Qcow2BitmapTable) entry;
 } Qcow2BitmapTable;
+typedef QSIMPLEQ_HEAD(Qcow2BitmapTableList, Qcow2BitmapTable)
+    Qcow2BitmapTableList;

 typedef struct Qcow2Bitmap {
    Qcow2BitmapTable table;
@@ -1006,82 +1008,6 @@ fail:
    return false;
 }

-
-static Qcow2BitmapInfoFlagsList *get_bitmap_info_flags(uint32_t flags)
-{
-    Qcow2BitmapInfoFlagsList *list = NULL;
-    Qcow2BitmapInfoFlagsList **plist = &list;
-    int i;
-
-    static const struct {
-        int bme;  /* Bitmap directory entry flags */
-        int info; /* The flags to report to the user */
-    } map[] = {
-        { BME_FLAG_IN_USE, QCOW2_BITMAP_INFO_FLAGS_IN_USE },
-        { BME_FLAG_AUTO,   QCOW2_BITMAP_INFO_FLAGS_AUTO },
-    };
-
-    int map_size = ARRAY_SIZE(map);
-
-    for (i = 0; i < map_size; ++i) {
-        if (flags & map[i].bme) {
-            Qcow2BitmapInfoFlagsList *entry =
-                g_new0(Qcow2BitmapInfoFlagsList, 1);
-            entry->value = map[i].info;
-            *plist = entry;
-            plist = &entry->next;
-            flags &= ~map[i].bme;
-        }
-    }
-    /* Check if the BME_* mapping above is complete */
-    assert(!flags);
-
-    return list;
-}
-
-/*
- * qcow2_get_bitmap_info_list()
- * Returns a list of QCOW2 bitmap details.
- * In case of no bitmaps, the function returns NULL and
- * the @errp parameter is not set.
- * When bitmap information can not be obtained, the function returns
- * NULL and the @errp parameter is set.
- */
-Qcow2BitmapInfoList *qcow2_get_bitmap_info_list(BlockDriverState *bs,
-                                                Error **errp)
-{
-    BDRVQcow2State *s = bs->opaque;
-    Qcow2BitmapList *bm_list;
-    Qcow2Bitmap *bm;
-    Qcow2BitmapInfoList *list = NULL;
-    Qcow2BitmapInfoList **plist = &list;
-
-    if (s->nb_bitmaps == 0) {
-        return NULL;
-    }
-
-    bm_list = bitmap_list_load(bs, s->bitmap_directory_offset,
-                               s->bitmap_directory_size, errp);
-    if (bm_list == NULL) {
-        return NULL;
-    }
-
-    QSIMPLEQ_FOREACH(bm, bm_list, entry) {
-        Qcow2BitmapInfo *info = g_new0(Qcow2BitmapInfo, 1);
-        Qcow2BitmapInfoList *obj = g_new0(Qcow2BitmapInfoList, 1);
-        info->granularity = 1U << bm->granularity_bits;
-        info->name = g_strdup(bm->name);
-        info->flags = get_bitmap_info_flags(bm->flags & ~BME_RESERVED_FLAGS);
-        obj->value = info;
-        *plist = obj;
-        plist = &obj->next;
-    }
-
-    bitmap_list_free(bm_list);
-
-    return list;
-}
-
 int qcow2_reopen_bitmaps_rw_hint(BlockDriverState *bs, bool *header_updated,
                                 Error **errp)
 {
@@ -1390,7 +1316,7 @@ void qcow2_store_persistent_dirty_bitmaps(BlockDriverState *bs, Error **errp)
    int ret;
    Qcow2BitmapList *bm_list;
    Qcow2Bitmap *bm;
-    QSIMPLEQ_HEAD(, Qcow2BitmapTable) drop_tables;
+    Qcow2BitmapTableList drop_tables;
    Qcow2BitmapTable *tb, *tb_next;

    if (!bdrv_has_changed_persistent_bitmaps(bs)) {
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -285,9 +285,6 @@ static int l2_allocate(BlockDriverState *bs, int l1_index)
        goto fail;
    }

-    /* The offset must fit in the offset field of the L1 table entry */
-    assert((l2_offset & L1E_OFFSET_MASK) == l2_offset);
-
    /* If we're allocating the table at offset 0 then something is wrong */
    if (l2_offset == 0) {
        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
@@ -405,7 +402,7 @@ static int count_contiguous_clusters(int nb_clusters, int cluster_size,
        }
    }

-        return i;
+	return i;
 }

 /*
@@ -1574,6 +1571,76 @@ again:
    return 0;
 }

+static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
+                             const uint8_t *buf, int buf_size)
+{
+    z_stream strm1, *strm = &strm1;
+    int ret, out_len;
+
+    memset(strm, 0, sizeof(*strm));
+
+    strm->next_in = (uint8_t *)buf;
+    strm->avail_in = buf_size;
+    strm->next_out = out_buf;
+    strm->avail_out = out_buf_size;
+
+    ret = inflateInit2(strm, -12);
+    if (ret != Z_OK)
+        return -1;
+    ret = inflate(strm, Z_FINISH);
+    out_len = strm->next_out - out_buf;
+    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
+        out_len != out_buf_size) {
+        inflateEnd(strm);
+        return -1;
+    }
+    inflateEnd(strm);
+    return 0;
+}
+
+int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
+{
+    BDRVQcow2State *s = bs->opaque;
+    int ret, csize, nb_csectors, sector_offset;
+    uint64_t coffset;
+
+    coffset = cluster_offset & s->cluster_offset_mask;
+    if (s->cluster_cache_offset != coffset) {
+        nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
+        sector_offset = coffset & 511;
+        csize = nb_csectors * 512 - sector_offset;
+
+        /* Allocate buffers on first decompress operation, most images are
+         * uncompressed and the memory overhead can be avoided.  The buffers
+         * are freed in .bdrv_close().
+         */
+        if (!s->cluster_data) {
+            /* one more sector for decompressed data alignment */
+            s->cluster_data = qemu_try_blockalign(bs->file->bs,
+                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size + 512);
+            if (!s->cluster_data) {
+                return -ENOMEM;
+            }
+        }
+        if (!s->cluster_cache) {
+            s->cluster_cache = g_malloc(s->cluster_size);
+        }
+
+        BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
+        ret = bdrv_read(bs->file, coffset >> 9, s->cluster_data,
+                        nb_csectors);
+        if (ret < 0) {
+            return ret;
+        }
+        if (decompress_buffer(s->cluster_cache, s->cluster_size,
+                              s->cluster_data + sector_offset, csize) < 0) {
+            return -EIO;
+        }
+        s->cluster_cache_offset = coffset;
+    }
+    return 0;
+}
+
 /*
 * This discards as many clusters of nb_clusters as possible at once (i.e.
 * all clusters in the same L2 slice) and returns the number of discarded
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -368,9 +368,6 @@ static int alloc_refcount_block(BlockDriverState *bs,
        return new_block;
    }

-    /* The offset must fit in the offset field of the refcount table entry */
-    assert((new_block & REFT_OFFSET_MASK) == new_block);
-
    /* If we're allocating the block at offset 0 then something is wrong */
    if (new_block == 0) {
        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -358,6 +358,11 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    /* Generate an ID */
    find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));

+    /* Check that the ID is unique */
+    if (find_snapshot_by_id_and_name(bs, sn_info->id_str, NULL) >= 0) {
+        return -EEXIST;
+    }
+
    /* Populate sn with passed data */
    sn->id_str = g_strdup(sn_info->id_str);
    sn->name = g_strdup(sn_info->name);
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -74,13 +74,6 @@ typedef struct {
 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875

-static int coroutine_fn
-qcow2_co_preadv_compressed(BlockDriverState *bs,
-                           uint64_t file_cluster_offset,
-                           uint64_t offset,
-                           uint64_t bytes,
-                           QEMUIOVector *qiov);
-
 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    const QCowHeader *cow_header = (const void *)buf;
@@ -301,7 +294,7 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
            }
            s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
                                           qcow2_crypto_hdr_read_func,
-                                           bs, cflags, 1, errp);
+                                           bs, cflags, errp);
            if (!s->crypto) {
                return -EINVAL;
            }
@@ -1421,6 +1414,7 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
        goto fail;
    }

+    s->cluster_cache_offset = -1;
    s->flags = flags;

    ret = qcow2_refcount_init(bs);
@@ -1451,7 +1445,7 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
            }
            s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
-                                           NULL, NULL, cflags, 1, errp);
+                                           NULL, NULL, cflags, errp);
            if (!s->crypto) {
                ret = -EINVAL;
                goto fail;
@@ -1474,15 +1468,13 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
            goto fail;
        }
        ret = bdrv_pread(bs->file, header.backing_file_offset,
-                         bs->auto_backing_file, len);
+                         bs->backing_file, len);
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Could not read backing file name");
            goto fail;
        }
-        bs->auto_backing_file[len] = '\0';
-        pstrcpy(bs->backing_file, sizeof(bs->backing_file),
-                bs->auto_backing_file);
-        s->image_backing_file = g_strdup(bs->auto_backing_file);
+        bs->backing_file[len] = '\0';
+        s->image_backing_file = g_strdup(bs->backing_file);
    }

    /* Internal snapshots */
@@ -1923,15 +1915,15 @@ static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
            break;

        case QCOW2_CLUSTER_COMPRESSED:
-            qemu_co_mutex_unlock(&s->lock);
-            ret = qcow2_co_preadv_compressed(bs, cluster_offset,
-                                             offset, cur_bytes,
-                                             &hd_qiov);
-            qemu_co_mutex_lock(&s->lock);
+            /* add AIO support for compressed blocks ? */
+            ret = qcow2_decompress_cluster(bs, cluster_offset);
            if (ret < 0) {
                goto fail;
            }

+            qemu_iovec_from_buf(&hd_qiov, 0,
+                                s->cluster_cache + offset_in_cluster,
+                                cur_bytes);
            break;

        case QCOW2_CLUSTER_NORMAL:
@@ -2067,6 +2059,8 @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,

    qemu_iovec_init(&hd_qiov, qiov->niov);

+    s->cluster_cache_offset = -1; /* disable compressed cache */
+
    qemu_co_mutex_lock(&s->lock);

    while (bytes != 0) {
@@ -2230,6 +2224,8 @@ static void qcow2_close(BlockDriverState *bs)
    g_free(s->image_backing_file);
    g_free(s->image_backing_format);

+    g_free(s->cluster_cache);
+    qemu_vfree(s->cluster_data);
    qcow2_refcount_close(bs);
    qcow2_free_snapshots(bs);
 }
@@ -2520,8 +2516,6 @@ static int qcow2_change_backing_file(BlockDriverState *bs,
        return -EINVAL;
    }

-    pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
-            backing_file ?: "");
    pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
    pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");

@@ -2597,6 +2591,7 @@ static int qcow2_set_up_encryption(BlockDriverState *bs,
 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
                                       uint64_t new_length)
 {
+    BDRVQcow2State *s = bs->opaque;
    uint64_t bytes;
    uint64_t host_offset = 0;
    unsigned int cur_bytes;
@@ -2607,7 +2602,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
    bytes = new_length - offset;

    while (bytes) {
-        cur_bytes = MIN(bytes, INT_MAX);
+        cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
        ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
                                         &host_offset, &meta);
        if (ret < 0) {
@@ -3408,6 +3403,7 @@ qcow2_co_copy_range_to(BlockDriverState *bs,
    QCowL2Meta *l2meta = NULL;

    assert(!bs->encrypted);
+    s->cluster_cache_offset = -1; /* disable compressed cache */

    qemu_co_mutex_lock(&s->lock);

@@ -3728,15 +3724,14 @@ fail:
 /*
 * qcow2_compress()
 *
- * @dest - destination buffer, @dest_size bytes
- * @src - source buffer, @src_size bytes
+ * @dest - destination buffer, at least of @size-1 bytes
+ * @src - source buffer, @size bytes
 *
 * Returns: compressed size on success
- *          -1 destination buffer is not enough to store compressed data
+ *          -1 if compression is inefficient
 *          -2 on any other error
 */
-static ssize_t qcow2_compress(void *dest, size_t dest_size,
-                              const void *src, size_t src_size)
+static ssize_t qcow2_compress(void *dest, const void *src, size_t size)
 {
    ssize_t ret;
    z_stream strm;
@@ -3745,20 +3740,20 @@ static ssize_t qcow2_compress(void *dest, size_t dest_size,
    memset(&strm, 0, sizeof(strm));
    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
                       -12, 9, Z_DEFAULT_STRATEGY);
-    if (ret != Z_OK) {
+    if (ret != 0) {
        return -2;
    }

    /* strm.next_in is not const in old zlib versions, such as those used on
     * OpenBSD/NetBSD, so cast the const away */
-    strm.avail_in = src_size;
+    strm.avail_in = size;
    strm.next_in = (void *) src;
-    strm.avail_out = dest_size;
+    strm.avail_out = size - 1;
    strm.next_out = dest;

    ret = deflate(&strm, Z_FINISH);
    if (ret == Z_STREAM_END) {
-        ret = dest_size - strm.avail_out;
+        ret = size - 1 - strm.avail_out;
    } else {
        ret = (ret == Z_OK ? -1 : -2);
    }
@@ -3768,68 +3763,20 @@ static ssize_t qcow2_compress(void *dest, size_t dest_size,
    return ret;
 }

-/*
- * qcow2_decompress()
- *
- * Decompress some data (not more than @src_size bytes) to produce exactly
- * @dest_size bytes.
- *
- * @dest - destination buffer, @dest_size bytes
- * @src - source buffer, @src_size bytes
- *
- * Returns: 0 on success
- *          -1 on fail
- */
-static ssize_t qcow2_decompress(void *dest, size_t dest_size,
-                                const void *src, size_t src_size)
-{
-    int ret = 0;
-    z_stream strm;
-
-    memset(&strm, 0, sizeof(strm));
-    strm.avail_in = src_size;
-    strm.next_in = (void *) src;
-    strm.avail_out = dest_size;
-    strm.next_out = dest;
-
-    ret = inflateInit2(&strm, -12);
-    if (ret != Z_OK) {
-        return -1;
-    }
-
-    ret = inflate(&strm, Z_FINISH);
-    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
-        /* We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
-         * @src buffer may be processed partly (because in qcow2 we know size of
-         * compressed data with precision of one sector) */
-        ret = -1;
-    }
-
-    inflateEnd(&strm);
-
-    return ret;
-}
-
 #define MAX_COMPRESS_THREADS 4

-typedef ssize_t (*Qcow2CompressFunc)(void *dest, size_t dest_size,
-                                     const void *src, size_t src_size);
 typedef struct Qcow2CompressData {
    void *dest;
-    size_t dest_size;
    const void *src;
-    size_t src_size;
+    size_t size;
    ssize_t ret;
-
-    Qcow2CompressFunc func;
 } Qcow2CompressData;

 static int qcow2_compress_pool_func(void *opaque)
 {
    Qcow2CompressData *data = opaque;

-    data->ret = data->func(data->dest, data->dest_size,
-                           data->src, data->src_size);
+    data->ret = qcow2_compress(data->dest, data->src, data->size);

    return 0;
 }
@@ -3839,19 +3786,17 @@ static void qcow2_compress_complete(void *opaque, int ret)
    qemu_coroutine_enter(opaque);
 }

-static ssize_t coroutine_fn
-qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
-                     const void *src, size_t src_size, Qcow2CompressFunc func)
+/* See qcow2_compress definition for parameters description */
+static ssize_t qcow2_co_compress(BlockDriverState *bs,
+                                 void *dest, const void *src, size_t size)
 {
    BDRVQcow2State *s = bs->opaque;
    BlockAIOCB *acb;
    ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
    Qcow2CompressData arg = {
        .dest = dest,
-        .dest_size = dest_size,
        .src = src,
-        .src_size = src_size,
-        .func = func,
+        .size = size,
    };

    while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
@@ -3874,22 +3819,6 @@ qcow2_co_do_compress(BlockDriverState *bs, void *dest, size_t dest_size,
    return arg.ret;
 }

-static ssize_t coroutine_fn
-qcow2_co_compress(BlockDriverState *bs, void *dest, size_t dest_size,
-                  const void *src, size_t src_size)
-{
-    return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
-                                qcow2_compress);
-}
-
-static ssize_t coroutine_fn
-qcow2_co_decompress(BlockDriverState *bs, void *dest, size_t dest_size,
-                    const void *src, size_t src_size)
-{
-    return qcow2_co_do_compress(bs, dest, dest_size, src, src_size,
-                                qcow2_decompress);
-}
-
 /* XXX: put compressed sectors first, then all the cluster aligned
   tables to avoid losing bytes in alignment */
 static coroutine_fn int
@@ -3898,6 +3827,7 @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 {
    BDRVQcow2State *s = bs->opaque;
    QEMUIOVector hd_qiov;
+    struct iovec iov;
    int ret;
    size_t out_len;
    uint8_t *buf, *out_buf;
@@ -3933,8 +3863,7 @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,

    out_buf = g_malloc(s->cluster_size);

-    out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
-                                buf, s->cluster_size);
+    out_len = qcow2_co_compress(bs, out_buf, buf, s->cluster_size);
    if (out_len == -2) {
        ret = -EINVAL;
        goto fail;
@@ -3963,7 +3892,11 @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
        goto fail;
    }

-    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
+    iov = (struct iovec) {
+        .iov_base   = out_buf,
+        .iov_len    = out_len,
+    };
+    qemu_iovec_init_external(&hd_qiov, &iov, 1);

    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
    ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
@@ -3978,52 +3911,6 @@ fail:
    return ret;
 }

-static int coroutine_fn
-qcow2_co_preadv_compressed(BlockDriverState *bs,
-                           uint64_t file_cluster_offset,
-                           uint64_t offset,
-                           uint64_t bytes,
-                           QEMUIOVector *qiov)
-{
-    BDRVQcow2State *s = bs->opaque;
-    int ret = 0, csize, nb_csectors;
-    uint64_t coffset;
-    uint8_t *buf, *out_buf;
-    QEMUIOVector local_qiov;
-    int offset_in_cluster = offset_into_cluster(s, offset);
-
-    coffset = file_cluster_offset & s->cluster_offset_mask;
-    nb_csectors = ((file_cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
-    csize = nb_csectors * 512 - (coffset & 511);
-
-    buf = g_try_malloc(csize);
-    if (!buf) {
-        return -ENOMEM;
-    }
-    qemu_iovec_init_buf(&local_qiov, buf, csize);
-
-    out_buf = qemu_blockalign(bs, s->cluster_size);
-
-    BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
-    ret = bdrv_co_preadv(bs->file, coffset, csize, &local_qiov, 0);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
-        ret = -EIO;
-        goto fail;
-    }
-
-    qemu_iovec_from_buf(qiov, 0, out_buf + offset_in_cluster, bytes);
-
-fail:
-    qemu_vfree(out_buf);
-    g_free(buf);
-
-    return ret;
-}
-
 static int make_completely_empty(BlockDriverState *bs)
 {
    BDRVQcow2State *s = bs->opaque;
@@ -4228,60 +4115,6 @@ static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
    return ret;
 }

-static ssize_t qcow2_measure_crypto_hdr_init_func(QCryptoBlock *block,
-        size_t headerlen, void *opaque, Error **errp)
-{
-    size_t *headerlenp = opaque;
-
-    /* Stash away the payload size */
-    *headerlenp = headerlen;
-    return 0;
-}
-
-static ssize_t qcow2_measure_crypto_hdr_write_func(QCryptoBlock *block,
-        size_t offset, const uint8_t *buf, size_t buflen,
-        void *opaque, Error **errp)
-{
-    /* Discard the bytes, we're not actually writing to an image */
-    return buflen;
-}
-
-/* Determine the number of bytes for the LUKS payload */
-static bool qcow2_measure_luks_headerlen(QemuOpts *opts, size_t *len,
-                                         Error **errp)
-{
-    QDict *opts_qdict;
-    QDict *cryptoopts_qdict;
-    QCryptoBlockCreateOptions *cryptoopts;
-    QCryptoBlock *crypto;
-
-    /* Extract "encrypt." options into a qdict */
-    opts_qdict = qemu_opts_to_qdict(opts, NULL);
-    qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
-    qobject_unref(opts_qdict);
-
-    /* Build QCryptoBlockCreateOptions object from qdict */
-    qdict_put_str(cryptoopts_qdict, "format", "luks");
-    cryptoopts = block_crypto_create_opts_init(cryptoopts_qdict, errp);
-    qobject_unref(cryptoopts_qdict);
-    if (!cryptoopts) {
-        return false;
-    }
-
-    /* Fake LUKS creation in order to determine the payload size */
-    crypto = qcrypto_block_create(cryptoopts, "encrypt.",
-                                  qcow2_measure_crypto_hdr_init_func,
-                                  qcow2_measure_crypto_hdr_write_func,
-                                  len, errp);
-    qapi_free_QCryptoBlockCreateOptions(cryptoopts);
-    if (!crypto) {
-        return false;
-    }
-
-    qcrypto_block_free(crypto);
-    return true;
-}
-
 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
                                       Error **errp)
 {
@@ -4291,13 +4124,11 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
    uint64_t virtual_size; /* disk size as seen by guest */
    uint64_t refcount_bits;
    uint64_t l2_tables;
-    uint64_t luks_payload_size = 0;
    size_t cluster_size;
    int version;
    char *optstr;
    PreallocMode prealloc;
    bool has_backing_file;
-    bool has_luks;

    /* Parse image creation options */
    cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
@@ -4327,20 +4158,6 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
    has_backing_file = !!optstr;
    g_free(optstr);

-    optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
-    has_luks = optstr && strcmp(optstr, "luks") == 0;
-    g_free(optstr);
-
-    if (has_luks) {
-        size_t headerlen;
-
-        if (!qcow2_measure_luks_headerlen(opts, &headerlen, &local_err)) {
-            goto err;
-        }
-
-        luks_payload_size = ROUND_UP(headerlen, cluster_size);
-    }
-
    virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
    virtual_size = ROUND_UP(virtual_size, cluster_size);

@@ -4411,7 +4228,7 @@ static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
    info = g_new(BlockMeasureInfo, 1);
    info->fully_allocated =
        qcow2_calc_prealloc_size(virtual_size, cluster_size,
-                                 ctz32(refcount_bits)) + luks_payload_size;
+                                 ctz32(refcount_bits));

    /* Remove data clusters that are not required.  This overestimates the
     * required size because metadata needed for the fully allocated file is
@@ -4434,26 +4251,20 @@ static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return 0;
 }

-static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
-                                                  Error **errp)
+static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs)
 {
    BDRVQcow2State *s = bs->opaque;
    ImageInfoSpecific *spec_info;
    QCryptoBlockInfo *encrypt_info = NULL;
-    Error *local_err = NULL;

    if (s->crypto != NULL) {
-        encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            return NULL;
-        }
+        encrypt_info = qcrypto_block_get_info(s->crypto, &error_abort);
    }

    spec_info = g_new(ImageInfoSpecific, 1);
    *spec_info = (ImageInfoSpecific){
        .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
-        .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
+        .u.qcow2.data = g_new(ImageInfoSpecificQCow2, 1),
    };
    if (s->qcow_version == 2) {
        *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
@@ -4461,13 +4272,6 @@ static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
            .refcount_bits      = s->refcount_bits,
        };
    } else if (s->qcow_version == 3) {
-        Qcow2BitmapInfoList *bitmaps;
-        bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            qapi_free_ImageInfoSpecific(spec_info);
-            return NULL;
-        }
        *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
            .compat             = g_strdup("1.1"),
            .lazy_refcounts     = s->compatible_features &
@@ -4477,8 +4281,6 @@ static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
                                  QCOW2_INCOMPAT_CORRUPT,
            .has_corrupt        = true,
            .refcount_bits      = s->refcount_bits,
-            .has_bitmaps        = !!bitmaps,
-            .bitmaps            = bitmaps,
        };
    } else {
        /* if this assertion fails, this probably means a new version was
@@ -4998,12 +4800,6 @@ static QemuOptsList qcow2_create_opts = {
    }
 };

-static const char *const qcow2_strong_runtime_opts[] = {
-    "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
-
-    NULL
-};
-
 BlockDriver bdrv_qcow2 = {
    .format_name        = "qcow2",
    .instance_size      = sizeof(BDRVQcow2State),
@@ -5052,7 +4848,6 @@ BlockDriver bdrv_qcow2 = {
    .bdrv_inactivate            = qcow2_inactivate,

    .create_opts         = &qcow2_create_opts,
-    .strong_runtime_opts = qcow2_strong_runtime_opts,
    .bdrv_co_check       = qcow2_co_check,
    .bdrv_amend_options  = qcow2_amend_options,

--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -50,11 +50,11 @@

 /* 8 MB refcount table is enough for 2 PB images at 64k cluster size
 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_REFTABLE_SIZE (8 * MiB)
+#define QCOW_MAX_REFTABLE_SIZE S_8MiB

 /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_L1_SIZE (32 * MiB)
+#define QCOW_MAX_L1_SIZE S_32MiB

 /* Allow for an average of 1k per snapshot table entry, should be plenty of
 * space for snapshot names and IDs */
@@ -81,15 +81,15 @@
 #define MIN_REFCOUNT_CACHE_SIZE 4 /* clusters */

 #ifdef CONFIG_LINUX
-#define DEFAULT_L2_CACHE_MAX_SIZE (32 * MiB)
+#define DEFAULT_L2_CACHE_MAX_SIZE S_32MiB
 #define DEFAULT_CACHE_CLEAN_INTERVAL 600  /* seconds */
 #else
-#define DEFAULT_L2_CACHE_MAX_SIZE (8 * MiB)
+#define DEFAULT_L2_CACHE_MAX_SIZE S_8MiB
 /* Cache clean interval is currently available only on Linux, so must be 0 */
 #define DEFAULT_CACHE_CLEAN_INTERVAL 0
 #endif

-#define DEFAULT_CLUSTER_SIZE 65536
+#define DEFAULT_CLUSTER_SIZE S_64KiB

 #define QCOW2_OPT_LAZY_REFCOUNTS "lazy-refcounts"
 #define QCOW2_OPT_DISCARD_REQUEST "pass-discard-request"
@@ -281,7 +281,7 @@ typedef struct BDRVQcow2State {
    uint8_t *cluster_cache;
    uint8_t *cluster_data;
    uint64_t cluster_cache_offset;
-    QLIST_HEAD(, QCowL2Meta) cluster_allocs;
+    QLIST_HEAD(QCowClusterAlloc, QCowL2Meta) cluster_allocs;

    uint64_t *refcount_table;
    uint64_t refcount_table_offset;
@@ -616,6 +616,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                        bool exact_size);
 int qcow2_shrink_l1_table(BlockDriverState *bs, uint64_t max_size);
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
+int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
                          uint8_t *buf, int nb_sectors, bool enc, Error **errp);

@@ -684,8 +685,6 @@ int qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                                  void **refcount_table,
                                  int64_t *refcount_table_size);
 bool qcow2_load_dirty_bitmaps(BlockDriverState *bs, Error **errp);
-Qcow2BitmapInfoList *qcow2_get_bitmap_info_list(BlockDriverState *bs,
-                                                Error **errp);
 int qcow2_reopen_bitmaps_rw_hint(BlockDriverState *bs, bool *header_updated,
                                 Error **errp);
 int qcow2_reopen_bitmaps_rw(BlockDriverState *bs, Error **errp);
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -21,11 +21,16 @@
 /* Called with table_lock held.  */
 static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(
-        qiov, table->offsets, s->header.cluster_size * s->header.table_size);
+    QEMUIOVector qiov;
    int noffsets;
    int i, ret;

+    struct iovec iov = {
+        .iov_base = table->offsets,
+        .iov_len = s->header.cluster_size * s->header.table_size,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
    trace_qed_read_table(s, offset, table);

    qemu_co_mutex_unlock(&s->table_lock);
@@ -66,6 +71,7 @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
    unsigned int start, end, i;
    QEDTable *new_table;
+    struct iovec iov;
    QEMUIOVector qiov;
    size_t len_bytes;
    int ret;
@@ -79,7 +85,11 @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    len_bytes = (end - start) * sizeof(uint64_t);

    new_table = qemu_blockalign(s->bs, len_bytes);
-    qemu_iovec_init_buf(&qiov, new_table->offsets, len_bytes);
+    iov = (struct iovec) {
+        .iov_base = new_table->offsets,
+        .iov_len = len_bytes,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);

    /* Byteswap table */
    for (i = start; i < end; i++) {
--- a/block/qed.c
+++ b/block/qed.c
@@ -113,13 +113,18 @@ static int coroutine_fn qed_write_header(BDRVQEDState *s)
    int nsectors = DIV_ROUND_UP(sizeof(QEDHeader), BDRV_SECTOR_SIZE);
    size_t len = nsectors * BDRV_SECTOR_SIZE;
    uint8_t *buf;
+    struct iovec iov;
    QEMUIOVector qiov;
    int ret;

    assert(s->allocating_acb || s->allocating_write_reqs_plugged);

    buf = qemu_blockalign(s->bs, len);
-    qemu_iovec_init_buf(&qiov, buf, len);
+    iov = (struct iovec) {
+        .iov_base = buf,
+        .iov_len = len,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = bdrv_co_preadv(s->bs->file, 0, qiov.size, &qiov, 0);
    if (ret < 0) {
@@ -449,14 +454,11 @@ static int coroutine_fn bdrv_qed_do_open(BlockDriverState *bs, QDict *options,
        }

        ret = qed_read_string(bs->file, s->header.backing_filename_offset,
-                              s->header.backing_filename_size,
-                              bs->auto_backing_file,
-                              sizeof(bs->auto_backing_file));
+                              s->header.backing_filename_size, bs->backing_file,
+                              sizeof(bs->backing_file));
        if (ret < 0) {
            return ret;
        }
-        pstrcpy(bs->backing_file, sizeof(bs->backing_file),
-                bs->auto_backing_file);

        if (s->header.features & QED_F_BACKING_FORMAT_NO_PROBE) {
            pstrcpy(bs->backing_format, sizeof(bs->backing_format), "raw");
@@ -911,6 +913,7 @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
 {
    QEMUIOVector qiov;
    QEMUIOVector *backing_qiov = NULL;
+    struct iovec iov;
    int ret;

    /* Skip copy entirely if there is no work to do */
@@ -918,7 +921,11 @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
        return 0;
    }

-    qemu_iovec_init_buf(&qiov, qemu_blockalign(s->bs, len), len);
+    iov = (struct iovec) {
+        .iov_base = qemu_blockalign(s->bs, len),
+        .iov_len = len,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = qed_read_backing_file(s, pos, &qiov, &backing_qiov);

@@ -939,7 +946,7 @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
    }
    ret = 0;
 out:
-    qemu_vfree(qemu_iovec_buf(&qiov));
+    qemu_vfree(iov.iov_base);
    return ret;
 }

@@ -1440,12 +1447,8 @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
                                                  BdrvRequestFlags flags)
 {
    BDRVQEDState *s = bs->opaque;
-
-    /*
-     * Zero writes start without an I/O buffer.  If a buffer becomes necessary
-     * then it will be allocated during request processing.
-     */
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov;

    /* Fall back if the request is not aligned */
    if (qed_offset_into_cluster(s, offset) ||
@@ -1453,6 +1456,13 @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
        return -ENOTSUP;
    }

+    /* Zero writes start without an I/O buffer.  If a buffer becomes necessary
+     * then it will be allocated during request processing.
+     */
+    iov.iov_base = NULL;
+    iov.iov_len = bytes;
+
+    qemu_iovec_init_external(&qiov, &iov, 1);
    return qed_co_request(bs, offset >> BDRV_SECTOR_BITS, &qiov,
                          bytes >> BDRV_SECTOR_BITS,
                          QED_AIOCB_WRITE | QED_AIOCB_ZERO);
--- a/block/quorum.c
+++ b/block/quorum.c
@@ -1065,64 +1065,36 @@ static void quorum_del_child(BlockDriverState *bs, BdrvChild *child,
    bdrv_drained_end(bs);
 }

-static void quorum_gather_child_options(BlockDriverState *bs, QDict *target,
-                                        bool backing_overridden)
+static void quorum_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVQuorumState *s = bs->opaque;
-    QList *children_list;
+    QDict *opts;
+    QList *children;
    int i;

-    /*
-     * The generic implementation for gathering child options in
-     * bdrv_refresh_filename() would use the names of the children
-     * as specified for bdrv_open_child() or bdrv_attach_child(),
-     * which is "children.%u" with %u being a value
-     * (s->next_child_index) that is incremented each time a new child
-     * is added (and never decremented).  Since children can be
-     * deleted at runtime, there may be gaps in that enumeration.
-     * When creating a new quorum BDS and specifying the children for
-     * it through runtime options, the enumeration used there may not
-     * have any gaps, though.
-     *
-     * Therefore, we have to create a new gap-less enumeration here
-     * (which we can achieve by simply putting all of the children's
-     * full_open_options into a QList).
-     *
-     * XXX: Note that there are issues with the current child option
-     *      structure quorum uses (such as the fact that children do
-     *      not really have unique permanent names).  Therefore, this
-     *      is going to have to change in the future and ideally we
-     *      want quorum to be covered by the generic implementation.
-     */
-
-    children_list = qlist_new();
-    qdict_put(target, "children", children_list);
-
    for (i = 0; i < s->num_children; i++) {
-        qlist_append(children_list,
+        bdrv_refresh_filename(s->children[i]->bs);
+        if (!s->children[i]->bs->full_open_options) {
+            return;
+        }
+    }
+
+    children = qlist_new();
+    for (i = 0; i < s->num_children; i++) {
+        qlist_append(children,
                     qobject_ref(s->children[i]->bs->full_open_options));
    }
+
+    opts = qdict_new();
+    qdict_put_str(opts, "driver", "quorum");
+    qdict_put_int(opts, QUORUM_OPT_VOTE_THRESHOLD, s->threshold);
+    qdict_put_bool(opts, QUORUM_OPT_BLKVERIFY, s->is_blkverify);
+    qdict_put_bool(opts, QUORUM_OPT_REWRITE, s->rewrite_corrupted);
+    qdict_put(opts, "children", children);
+
+    bs->full_open_options = opts;
 }

-static char *quorum_dirname(BlockDriverState *bs, Error **errp)
-{
-    /* In general, there are multiple BDSs with different dirnames below this
-     * one; so there is no unique dirname we could return (unless all are equal
-     * by chance, or there is only one). Therefore, to be consistent, just
-     * always return NULL. */
-    error_setg(errp, "Cannot generate a base directory for quorum nodes");
-    return NULL;
-}
-
-static const char *const quorum_strong_runtime_opts[] = {
-    QUORUM_OPT_VOTE_THRESHOLD,
-    QUORUM_OPT_BLKVERIFY,
-    QUORUM_OPT_REWRITE,
-    QUORUM_OPT_READ_PATTERN,
-
-    NULL
-};
-
 static BlockDriver bdrv_quorum = {
    .format_name                        = "quorum",

@@ -1130,8 +1102,7 @@ static BlockDriver bdrv_quorum = {

    .bdrv_open                          = quorum_open,
    .bdrv_close                         = quorum_close,
-    .bdrv_gather_child_options          = quorum_gather_child_options,
-    .bdrv_dirname                       = quorum_dirname,
+    .bdrv_refresh_filename              = quorum_refresh_filename,

    .bdrv_co_flush_to_disk              = quorum_co_flush,

@@ -1147,8 +1118,6 @@ static BlockDriver bdrv_quorum = {

    .is_filter                          = true,
    .bdrv_recurse_is_first_non_filter   = quorum_recurse_is_first_non_filter,
-
-    .strong_runtime_opts                = quorum_strong_runtime_opts,
 };

 static void bdrv_quorum_init(void)
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -436,7 +436,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
            bs->file->bs->supported_zero_flags);

    if (bs->probed && !bdrv_is_read_only(bs)) {
-        bdrv_refresh_filename(bs->file->bs);
        fprintf(stderr,
                "WARNING: Image format was not specified for '%s' and probing "
                "guessed raw.\n"
@@ -532,13 +531,6 @@ static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
                                 read_flags, write_flags);
 }

-static const char *const raw_strong_runtime_opts[] = {
-    "offset",
-    "size",
-
-    NULL
-};
-
 BlockDriver bdrv_raw = {
    .format_name          = "raw",
    .instance_size        = sizeof(BDRVRawState),
@@ -568,8 +560,7 @@ BlockDriver bdrv_raw = {
    .bdrv_lock_medium     = &raw_lock_medium,
    .bdrv_co_ioctl        = &raw_co_ioctl,
    .create_opts          = &raw_create_opts,
-    .bdrv_has_zero_init   = &raw_has_zero_init,
-    .strong_runtime_opts  = raw_strong_runtime_opts,
+    .bdrv_has_zero_init   = &raw_has_zero_init
 };

 static void bdrv_raw_init(void)
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -1228,18 +1228,6 @@ static QemuOptsList qemu_rbd_create_opts = {
    }
 };

-static const char *const qemu_rbd_strong_runtime_opts[] = {
-    "pool",
-    "image",
-    "conf",
-    "snapshot",
-    "user",
-    "server.",
-    "password-secret",
-
-    NULL
-};
-
 static BlockDriver bdrv_rbd = {
    .format_name            = "rbd",
    .instance_size          = sizeof(BDRVRBDState),
@@ -1277,8 +1265,6 @@ static BlockDriver bdrv_rbd = {
 #ifdef LIBRBD_SUPPORTS_INVALIDATE
    .bdrv_co_invalidate_cache = qemu_rbd_co_invalidate_cache,
 #endif
-
-    .strong_runtime_opts    = qemu_rbd_strong_runtime_opts,
 };

 static void bdrv_rbd_init(void)
--- a/block/replication.c
+++ b/block/replication.c
@@ -20,7 +20,6 @@
 #include "block/block_backup.h"
 #include "sysemu/block-backend.h"
 #include "qapi/error.h"
-#include "qapi/qmp/qdict.h"
 #include "replication.h"

 typedef enum {
@@ -40,8 +39,8 @@ typedef struct BDRVReplicationState {
    char *top_id;
    ReplicationState *rs;
    Error *blocker;
-    bool orig_hidden_read_only;
-    bool orig_secondary_read_only;
+    int orig_hidden_flags;
+    int orig_secondary_flags;
    int error;
 } BDRVReplicationState;

@@ -219,6 +218,9 @@ static coroutine_fn int replication_co_readv(BlockDriverState *bs,
                                             QEMUIOVector *qiov)
 {
    BDRVReplicationState *s = bs->opaque;
+    BdrvChild *child = s->secondary_disk;
+    BlockJob *job = NULL;
+    CowRequest req;
    int ret;

    if (s->mode == REPLICATION_MODE_PRIMARY) {
@@ -231,9 +233,28 @@ static coroutine_fn int replication_co_readv(BlockDriverState *bs,
        return ret;
    }

+    if (child && child->bs) {
+        job = child->bs->job;
+    }
+
+    if (job) {
+        uint64_t remaining_bytes = remaining_sectors * BDRV_SECTOR_SIZE;
+
+        backup_wait_for_overlapping_requests(child->bs->job,
+                                             sector_num * BDRV_SECTOR_SIZE,
+                                             remaining_bytes);
+        backup_cow_request_begin(&req, child->bs->job,
+                                 sector_num * BDRV_SECTOR_SIZE,
+                                 remaining_bytes);
+        ret = bdrv_co_preadv(bs->file, sector_num * BDRV_SECTOR_SIZE,
+                             remaining_bytes, qiov, 0);
+        backup_cow_request_end(&req);
+        goto out;
+    }
+
    ret = bdrv_co_preadv(bs->file, sector_num * BDRV_SECTOR_SIZE,
                         remaining_sectors * BDRV_SECTOR_SIZE, qiov, 0);
-
+out:
    return replication_return_value(s, ret);
 }

@@ -350,38 +371,44 @@ static void secondary_do_checkpoint(BDRVReplicationState *s, Error **errp)
    }
 }

-/* This function is supposed to be called twice:
- * first with writable = true, then with writable = false.
- * The first call puts s->hidden_disk and s->secondary_disk in
- * r/w mode, and the second puts them back in their original state.
- */
 static void reopen_backing_file(BlockDriverState *bs, bool writable,
                                Error **errp)
 {
    BDRVReplicationState *s = bs->opaque;
    BlockReopenQueue *reopen_queue = NULL;
+    int orig_hidden_flags, orig_secondary_flags;
+    int new_hidden_flags, new_secondary_flags;
    Error *local_err = NULL;

    if (writable) {
-        s->orig_hidden_read_only = bdrv_is_read_only(s->hidden_disk->bs);
-        s->orig_secondary_read_only = bdrv_is_read_only(s->secondary_disk->bs);
+        orig_hidden_flags = s->orig_hidden_flags =
+                                bdrv_get_flags(s->hidden_disk->bs);
+        new_hidden_flags = (orig_hidden_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        orig_secondary_flags = s->orig_secondary_flags =
+                                bdrv_get_flags(s->secondary_disk->bs);
+        new_secondary_flags = (orig_secondary_flags | BDRV_O_RDWR) &
+                                                     ~BDRV_O_INACTIVE;
+    } else {
+        orig_hidden_flags = (s->orig_hidden_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        new_hidden_flags = s->orig_hidden_flags;
+        orig_secondary_flags = (s->orig_secondary_flags | BDRV_O_RDWR) &
+                                                    ~BDRV_O_INACTIVE;
+        new_secondary_flags = s->orig_secondary_flags;
    }

    bdrv_subtree_drained_begin(s->hidden_disk->bs);
    bdrv_subtree_drained_begin(s->secondary_disk->bs);

-    if (s->orig_hidden_read_only) {
-        QDict *opts = qdict_new();
-        qdict_put_bool(opts, BDRV_OPT_READ_ONLY, !writable);
-        reopen_queue = bdrv_reopen_queue(reopen_queue, s->hidden_disk->bs,
-                                         opts);
+    if (orig_hidden_flags != new_hidden_flags) {
+        reopen_queue = bdrv_reopen_queue(reopen_queue, s->hidden_disk->bs, NULL,
+                                         new_hidden_flags);
    }

-    if (s->orig_secondary_read_only) {
-        QDict *opts = qdict_new();
-        qdict_put_bool(opts, BDRV_OPT_READ_ONLY, !writable);
+    if (!(orig_secondary_flags & BDRV_O_RDWR)) {
        reopen_queue = bdrv_reopen_queue(reopen_queue, s->secondary_disk->bs,
-                                         opts);
+                                         NULL, new_secondary_flags);
    }

    if (reopen_queue) {
@@ -616,6 +643,8 @@ static void replication_done(void *opaque, int ret)
    if (ret == 0) {
        s->stage = BLOCK_REPLICATION_DONE;

+        /* refresh top bs's filename */
+        bdrv_refresh_filename(bs);
        s->active_disk = NULL;
        s->secondary_disk = NULL;
        s->hidden_disk = NULL;
@@ -676,13 +705,6 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
    aio_context_release(aio_context);
 }

-static const char *const replication_strong_runtime_opts[] = {
-    REPLICATION_MODE,
-    REPLICATION_TOP_ID,
-
-    NULL
-};
-
 BlockDriver bdrv_replication = {
    .format_name                = "replication",
    .instance_size              = sizeof(BDRVReplicationState),
@@ -699,7 +721,6 @@ BlockDriver bdrv_replication = {
    .bdrv_recurse_is_first_non_filter = replication_recurse_is_first_non_filter,

    .has_variable_length        = true,
-    .strong_runtime_opts        = replication_strong_runtime_opts,
 };

 static void bdrv_replication_init(void)
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -28,7 +28,6 @@
 #include "sysemu/block-backend.h"
 #include "qemu/bitops.h"
 #include "qemu/cutils.h"
-#include "trace.h"

 #define SD_PROTO_VER 0x01

@@ -300,6 +299,19 @@ static inline size_t count_data_objs(const struct SheepdogInode *inode)
                        (1UL << inode->block_size_shift));
 }

+#undef DPRINTF
+#ifdef DEBUG_SDOG
+#define DEBUG_SDOG_PRINT 1
+#else
+#define DEBUG_SDOG_PRINT 0
+#endif
+#define DPRINTF(fmt, args...)                                           \
+    do {                                                                \
+        if (DEBUG_SDOG_PRINT) {                                         \
+            fprintf(stderr, "%s %d: " fmt, __func__, __LINE__, ##args); \
+        }                                                               \
+    } while (0)
+
 typedef struct SheepdogAIOCB SheepdogAIOCB;
 typedef struct BDRVSheepdogState BDRVSheepdogState;

@@ -379,12 +391,12 @@ struct BDRVSheepdogState {
    uint32_t aioreq_seq_num;

    /* Every aio request must be linked to either of these queues. */
-    QLIST_HEAD(, AIOReq) inflight_aio_head;
-    QLIST_HEAD(, AIOReq) failed_aio_head;
+    QLIST_HEAD(inflight_aio_head, AIOReq) inflight_aio_head;
+    QLIST_HEAD(failed_aio_head, AIOReq) failed_aio_head;

    CoMutex queue_lock;
    CoQueue overlapping_queue;
-    QLIST_HEAD(, SheepdogAIOCB) inflight_aiocb_head;
+    QLIST_HEAD(inflight_aiocb_head, SheepdogAIOCB) inflight_aiocb_head;
 };

 typedef struct BDRVSheepdogReopenState {
@@ -738,7 +750,7 @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
        Error *local_err = NULL;
        s->fd = get_sheep_fd(s, &local_err);
        if (s->fd < 0) {
-            trace_sheepdog_reconnect_to_sdog();
+            DPRINTF("Wait for connection to be established\n");
            error_report_err(local_err);
            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000000ULL);
        }
@@ -835,7 +847,7 @@ static void coroutine_fn aio_read_response(void *opaque)
        break;
    case AIOCB_FLUSH_CACHE:
        if (rsp.result == SD_RES_INVALID_PARMS) {
-            trace_sheepdog_aio_read_response();
+            DPRINTF("disable cache since the server doesn't support it\n");
            s->cache_flags = SD_FLAG_CMD_DIRECT;
            rsp.result = SD_RES_SUCCESS;
        }
@@ -1212,7 +1224,7 @@ static int find_vdi_name(BDRVSheepdogState *s, const char *filename,
    SheepdogVdiReq hdr;
    SheepdogVdiRsp *rsp = (SheepdogVdiRsp *)&hdr;
    unsigned int wlen, rlen = 0;
-    char buf[SD_MAX_VDI_LEN + SD_MAX_VDI_TAG_LEN] QEMU_NONSTRING;
+    char buf[SD_MAX_VDI_LEN + SD_MAX_VDI_TAG_LEN];

    fd = connect_to_sdog(s, errp);
    if (fd < 0) {
@@ -1627,7 +1639,7 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags,
    s->discard_supported = true;

    if (snap_id || tag[0]) {
-        trace_sheepdog_open(vid);
+        DPRINTF("%" PRIx32 " snapshot inode was open.\n", vid);
        s->is_snapshot = true;
    }

@@ -2240,7 +2252,7 @@ static void sd_close(BlockDriverState *bs)
    unsigned int wlen, rlen = 0;
    int fd, ret;

-    trace_sheepdog_close(s->name);
+    DPRINTF("%s\n", s->name);

    fd = connect_to_sdog(s, &local_err);
    if (fd < 0) {
@@ -2417,7 +2429,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
    char *buf;
    bool deleted;

-    trace_sheepdog_create_branch_snapshot(s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);

    buf = g_malloc(SD_INODE_SIZE);

@@ -2433,7 +2445,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
        goto out;
    }

-    trace_sheepdog_create_branch_created(vid);
+    DPRINTF("%" PRIx32 " is created.\n", vid);

    fd = connect_to_sdog(s, &local_err);
    if (fd < 0) {
@@ -2455,7 +2467,7 @@ static int sd_create_branch(BDRVSheepdogState *s)

    s->is_snapshot = false;
    ret = 0;
-    trace_sheepdog_create_branch_new(s->inode.vdi_id);
+    DPRINTF("%" PRIx32 " was newly created.\n", s->inode.vdi_id);

 out:
    g_free(buf);
@@ -2549,11 +2561,11 @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)
        }

        if (create) {
-            trace_sheepdog_co_rw_vector_update(inode->vdi_id, oid,
-                                  vid_to_data_oid(inode->data_vdi_id[idx], idx),
-                                  idx);
+            DPRINTF("update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld\n",
+                    inode->vdi_id, oid,
+                    vid_to_data_oid(inode->data_vdi_id[idx], idx), idx);
            oid = vid_to_data_oid(inode->vdi_id, idx);
-            trace_sheepdog_co_rw_vector_new(oid);
+            DPRINTF("new oid %" PRIx64 "\n", oid);
        }

        aio_req = alloc_aio_req(s, acb, oid, len, offset, flags, create,
@@ -2658,8 +2670,9 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    SheepdogInode *inode;
    unsigned int datalen;

-    trace_sheepdog_snapshot_create_info(sn_info->name, sn_info->id_str, s->name,
-                                        sn_info->vm_state_size, s->is_snapshot);
+    DPRINTF("sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " "
+            "is_snapshot %d\n", sn_info->name, sn_info->id_str,
+            s->name, sn_info->vm_state_size, s->is_snapshot);

    if (s->is_snapshot) {
        error_report("You can't create a snapshot of a snapshot VDI, "
@@ -2668,7 +2681,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        return -EINVAL;
    }

-    trace_sheepdog_snapshot_create(sn_info->name, sn_info->id_str);
+    DPRINTF("%s %s\n", sn_info->name, sn_info->id_str);

    s->inode.vm_state_size = sn_info->vm_state_size;
    s->inode.vm_clock_nsec = sn_info->vm_clock_nsec;
@@ -2713,8 +2726,8 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    }

    memcpy(&s->inode, inode, datalen);
-    trace_sheepdog_snapshot_create_inode(s->inode.name, s->inode.snap_id,
-                                         s->inode.vdi_id);
+    DPRINTF("s->inode: name %s snap_id %x oid %x\n",
+            s->inode.name, s->inode.snap_id, s->inode.vdi_id);

 cleanup:
    g_free(inode);
@@ -3203,15 +3216,6 @@ static QemuOptsList sd_create_opts = {
    }
 };

-static const char *const sd_strong_runtime_opts[] = {
-    "vdi",
-    "snap-id",
-    "tag",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_sheepdog = {
    .format_name                  = "sheepdog",
    .protocol_name                = "sheepdog",
@@ -3247,7 +3251,6 @@ static BlockDriver bdrv_sheepdog = {
    .bdrv_attach_aio_context      = sd_attach_aio_context,

    .create_opts                  = &sd_create_opts,
-    .strong_runtime_opts          = sd_strong_runtime_opts,
 };

 static BlockDriver bdrv_sheepdog_tcp = {
@@ -3285,7 +3288,6 @@ static BlockDriver bdrv_sheepdog_tcp = {
    .bdrv_attach_aio_context      = sd_attach_aio_context,

    .create_opts                  = &sd_create_opts,
-    .strong_runtime_opts          = sd_strong_runtime_opts,
 };

 static BlockDriver bdrv_sheepdog_unix = {
@@ -3323,7 +3325,6 @@ static BlockDriver bdrv_sheepdog_unix = {
    .bdrv_attach_aio_context      = sd_attach_aio_context,

    .create_opts                  = &sd_create_opts,
-    .strong_runtime_opts          = sd_strong_runtime_opts,
 };

 static void bdrv_sheepdog_init(void)
--- a/block/snapshot.c
+++ b/block/snapshot.c
@@ -63,7 +63,7 @@ int bdrv_snapshot_find(BlockDriverState *bs, QEMUSnapshotInfo *sn_info,
    }
    for (i = 0; i < nb_sns; i++) {
        sn = &sn_tab[i];
-        if (!strcmp(sn->name, name)) {
+        if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {
            *sn_info = *sn;
            ret = 0;
            break;
@@ -301,6 +301,26 @@ int bdrv_snapshot_delete(BlockDriverState *bs,
    return ret;
 }

+int bdrv_snapshot_delete_by_id_or_name(BlockDriverState *bs,
+                                       const char *id_or_name,
+                                       Error **errp)
+{
+    int ret;
+    Error *local_err = NULL;
+
+    ret = bdrv_snapshot_delete(bs, id_or_name, NULL, &local_err);
+    if (ret == -ENOENT || ret == -EINVAL) {
+        error_free(local_err);
+        local_err = NULL;
+        ret = bdrv_snapshot_delete(bs, NULL, id_or_name, &local_err);
+    }
+
+    if (ret < 0) {
+        error_propagate(errp, local_err);
+    }
+    return ret;
+}
+
 int bdrv_snapshot_list(BlockDriverState *bs,
                       QEMUSnapshotInfo **psn_info)
 {
@@ -428,8 +448,7 @@ int bdrv_all_delete_snapshot(const char *name, BlockDriverState **first_bad_bs,
        aio_context_acquire(ctx);
        if (bdrv_can_snapshot(bs) &&
                bdrv_snapshot_find(bs, snapshot, name) >= 0) {
-            ret = bdrv_snapshot_delete(bs, snapshot->id_str,
-                                       snapshot->name, err);
+            ret = bdrv_snapshot_delete_by_id_or_name(bs, name, err);
        }
        aio_context_release(ctx);
        if (ret < 0) {
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -41,17 +41,27 @@
 #include "qapi/qmp/qstring.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
-#include "trace.h"

-/*
+/* DEBUG_SSH=1 enables the DPRINTF (debugging printf) statements in
+ * this block driver code.
+ *
 * TRACE_LIBSSH2=<bitmask> enables tracing in libssh2 itself.  Note
 * that this requires that libssh2 was specially compiled with the
 * `./configure --enable-debug' option, so most likely you will have
 * to compile it yourself.  The meaning of <bitmask> is described
 * here: http://www.libssh2.org/libssh2_trace.html
 */
+#define DEBUG_SSH     0
 #define TRACE_LIBSSH2 0 /* or try: LIBSSH2_TRACE_SFTP */

+#define DPRINTF(fmt, ...)                           \
+    do {                                            \
+        if (DEBUG_SSH) {                            \
+            fprintf(stderr, "ssh: %-15s " fmt "\n", \
+                    __func__, ##__VA_ARGS__);       \
+        }                                           \
+    } while (0)
+
 typedef struct BDRVSSHState {
    /* Coroutine. */
    CoMutex lock;
@@ -326,7 +336,7 @@ static int check_host_key_knownhosts(BDRVSSHState *s,
    switch (r) {
    case LIBSSH2_KNOWNHOST_CHECK_MATCH:
        /* OK */
-        trace_ssh_check_host_key_knownhosts(found->key);
+        DPRINTF("host key OK: %s", found->key);
        break;
    case LIBSSH2_KNOWNHOST_CHECK_MISMATCH:
        ret = -EINVAL;
@@ -711,7 +721,8 @@ static int connect_to_ssh(BDRVSSHState *s, BlockdevOptionsSsh *opts,
    }

    /* Open the remote file. */
-    trace_ssh_connect_to_ssh(opts->path, ssh_flags, creat_mode);
+    DPRINTF("opening file %s flags=0x%x creat_mode=0%o",
+            opts->path, ssh_flags, creat_mode);
    s->sftp_handle = libssh2_sftp_open(s->sftp, opts->path, ssh_flags,
                                       creat_mode);
    if (!s->sftp_handle) {
@@ -879,7 +890,7 @@ static int coroutine_fn ssh_co_create_opts(const char *filename, QemuOpts *opts,
    /* Get desired file size. */
    ssh_opts->size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                              BDRV_SECTOR_SIZE);
-    trace_ssh_co_create_opts(ssh_opts->size);
+    DPRINTF("total_size=%" PRIi64, ssh_opts->size);

    uri_options = qdict_new();
    ret = parse_uri(filename, uri_options, errp);
@@ -935,7 +946,7 @@ static void restart_coroutine(void *opaque)
    BDRVSSHState *s = bs->opaque;
    AioContext *ctx = bdrv_get_aio_context(bs);

-    trace_ssh_restart_coroutine(restart->co);
+    DPRINTF("co=%p", restart->co);
    aio_set_fd_handler(ctx, s->sock, false, NULL, NULL, NULL, NULL);

    aio_co_wake(restart->co);
@@ -963,12 +974,13 @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
        wr_handler = restart_coroutine;
    }

-    trace_ssh_co_yield(s->sock, rd_handler, wr_handler);
+    DPRINTF("s->sock=%d rd_handler=%p wr_handler=%p", s->sock,
+            rd_handler, wr_handler);

    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
                       false, rd_handler, wr_handler, NULL, &restart);
    qemu_coroutine_yield();
-    trace_ssh_co_yield_back(s->sock);
+    DPRINTF("s->sock=%d - back", s->sock);
 }

 /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
@@ -991,7 +1003,7 @@ static void ssh_seek(BDRVSSHState *s, int64_t offset, int flags)
    bool force = (flags & SSH_SEEK_FORCE) != 0;

    if (force || op_read != s->offset_op_read || offset != s->offset) {
-        trace_ssh_seek(offset);
+        DPRINTF("seeking to offset=%" PRIi64, offset);
        libssh2_sftp_seek64(s->sftp_handle, offset);
        s->offset = offset;
        s->offset_op_read = op_read;
@@ -1007,7 +1019,7 @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
    char *buf, *end_of_vec;
    struct iovec *i;

-    trace_ssh_read(offset, size);
+    DPRINTF("offset=%" PRIi64 " size=%zu", offset, size);

    ssh_seek(s, offset, SSH_SEEK_READ);

@@ -1026,9 +1038,9 @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
     */
    for (got = 0; got < size; ) {
    again:
-        trace_ssh_read_buf(buf, end_of_vec - buf);
+        DPRINTF("sftp_read buf=%p size=%zu", buf, end_of_vec - buf);
        r = libssh2_sftp_read(s->sftp_handle, buf, end_of_vec - buf);
-        trace_ssh_read_return(r);
+        DPRINTF("sftp_read returned %zd", r);

        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
            co_yield(s, bs);
@@ -1082,7 +1094,7 @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
    char *buf, *end_of_vec;
    struct iovec *i;

-    trace_ssh_write(offset, size);
+    DPRINTF("offset=%" PRIi64 " size=%zu", offset, size);

    ssh_seek(s, offset, SSH_SEEK_WRITE);

@@ -1096,9 +1108,9 @@ static int ssh_write(BDRVSSHState *s, BlockDriverState *bs,

    for (written = 0; written < size; ) {
    again:
-        trace_ssh_write_buf(buf, end_of_vec - buf);
+        DPRINTF("sftp_write buf=%p size=%zu", buf, end_of_vec - buf);
        r = libssh2_sftp_write(s->sftp_handle, buf, end_of_vec - buf);
-        trace_ssh_write_return(r);
+        DPRINTF("sftp_write returned %zd", r);

        if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
            co_yield(s, bs);
@@ -1175,7 +1187,7 @@ static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
 {
    int r;

-    trace_ssh_flush();
+    DPRINTF("fsync");
 again:
    r = libssh2_sftp_fsync(s->sftp_handle);
    if (r == LIBSSH2_ERROR_EAGAIN || r == LIBSSH2_ERROR_TIMEOUT) {
@@ -1226,7 +1238,7 @@ static int64_t ssh_getlength(BlockDriverState *bs)

    /* Note we cannot make a libssh2 call here. */
    length = (int64_t) s->attrs.filesize;
-    trace_ssh_getlength(length);
+    DPRINTF("length=%" PRIi64, length);

    return length;
 }
@@ -1254,17 +1266,6 @@ static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
    return ssh_grow_file(s, offset, errp);
 }

-static const char *const ssh_strong_runtime_opts[] = {
-    "host",
-    "port",
-    "path",
-    "user",
-    "host_key_check",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_ssh = {
    .format_name                  = "ssh",
    .protocol_name                = "ssh",
@@ -1281,7 +1282,6 @@ static BlockDriver bdrv_ssh = {
    .bdrv_co_truncate             = ssh_co_truncate,
    .bdrv_co_flush_to_disk        = ssh_co_flush,
    .create_opts                  = &ssh_create_opts,
-    .strong_runtime_opts          = ssh_strong_runtime_opts,
 };

 static void bdrv_ssh_init(void)
--- a/block/stream.c
+++ b/block/stream.c
@@ -34,16 +34,21 @@ typedef struct StreamBlockJob {
    BlockDriverState *base;
    BlockdevOnError on_error;
    char *backing_file_str;
-    bool bs_read_only;
+    int bs_flags;
 } StreamBlockJob;

 static int coroutine_fn stream_populate(BlockBackend *blk,
                                        int64_t offset, uint64_t bytes,
                                        void *buf)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    struct iovec iov = {
+        .iov_base = buf,
+        .iov_len  = bytes,
+    };
+    QEMUIOVector qiov;

    assert(bytes < SIZE_MAX);
+    qemu_iovec_init_external(&qiov, &iov, 1);

    /* Copy-on-read the unallocated clusters */
    return blk_co_preadv(blk, offset, qiov.size, &qiov, BDRV_REQ_COPY_ON_READ);
@@ -84,10 +89,10 @@ static void stream_clean(Job *job)
    BlockDriverState *bs = blk_bs(bjob->blk);

    /* Reopen the image back in read-only mode if necessary */
-    if (s->bs_read_only) {
+    if (s->bs_flags != bdrv_get_flags(bs)) {
        /* Give up write permissions before making it read-only */
        blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, &error_abort);
-        bdrv_reopen_set_read_only(bs, true, NULL);
+        bdrv_reopen(bs, s->bs_flags, NULL);
    }

    g_free(s->backing_file_str);
@@ -221,12 +226,12 @@ void stream_start(const char *job_id, BlockDriverState *bs,
 {
    StreamBlockJob *s;
    BlockDriverState *iter;
-    bool bs_read_only;
+    int orig_bs_flags;

    /* Make sure that the image is opened in read-write mode */
-    bs_read_only = bdrv_is_read_only(bs);
-    if (bs_read_only) {
-        if (bdrv_reopen_set_read_only(bs, false, errp) != 0) {
+    orig_bs_flags = bdrv_get_flags(bs);
+    if (!(orig_bs_flags & BDRV_O_RDWR)) {
+        if (bdrv_reopen(bs, orig_bs_flags | BDRV_O_RDWR, errp) != 0) {
            return;
        }
    }
@@ -256,7 +261,7 @@ void stream_start(const char *job_id, BlockDriverState *bs,

    s->base = base;
    s->backing_file_str = g_strdup(backing_file_str);
-    s->bs_read_only = bs_read_only;
+    s->bs_flags = orig_bs_flags;

    s->on_error = on_error;
    trace_stream_start(bs, base, s);
@@ -264,7 +269,7 @@ void stream_start(const char *job_id, BlockDriverState *bs,
    return;

 fail:
-    if (bs_read_only) {
-        bdrv_reopen_set_read_only(bs, true, NULL);
+    if (orig_bs_flags != bdrv_get_flags(bs)) {
+        bdrv_reopen(bs, orig_bs_flags, NULL);
    }
 }
--- a/block/throttle-groups.c
+++ b/block/throttle-groups.c
@@ -415,9 +415,6 @@ static void coroutine_fn throttle_group_restart_queue_entry(void *opaque)
    }

    g_free(data);
-
-    atomic_dec(&tgm->restart_pending);
-    aio_wait_kick();
 }

 static void throttle_group_restart_queue(ThrottleGroupMember *tgm, bool is_write)
@@ -433,8 +430,6 @@ static void throttle_group_restart_queue(ThrottleGroupMember *tgm, bool is_write
     * be no timer pending on this tgm at this point */
    assert(!timer_pending(tgm->throttle_timers.timers[is_write]));

-    atomic_inc(&tgm->restart_pending);
-
    co = qemu_coroutine_create(throttle_group_restart_queue_entry, rd);
    aio_co_enter(tgm->aio_context, co);
 }
@@ -543,7 +538,6 @@ void throttle_group_register_tgm(ThrottleGroupMember *tgm,

    tgm->throttle_state = ts;
    tgm->aio_context = ctx;
-    atomic_set(&tgm->restart_pending, 0);

    qemu_mutex_lock(&tg->lock);
    /* If the ThrottleGroup is new set this ThrottleGroupMember as the token */
@@ -590,9 +584,6 @@ void throttle_group_unregister_tgm(ThrottleGroupMember *tgm)
        return;
    }

-    /* Wait for throttle_group_restart_queue_entry() coroutines to finish */
-    AIO_WAIT_WHILE(tgm->aio_context, atomic_read(&tgm->restart_pending) > 0);
-
    qemu_mutex_lock(&tg->lock);
    for (i = 0; i < 2; i++) {
        assert(tgm->pending_reqs[i] == 0);
--- a/block/throttle.c
+++ b/block/throttle.c
@@ -227,12 +227,6 @@ static void coroutine_fn throttle_co_drain_end(BlockDriverState *bs)
    atomic_dec(&tgm->io_limits_disabled);
 }

-static const char *const throttle_strong_runtime_opts[] = {
-    QEMU_OPT_THROTTLE_GROUP_NAME,
-
-    NULL
-};
-
 static BlockDriver bdrv_throttle = {
    .format_name                        =   "throttle",
    .instance_size                      =   sizeof(ThrottleGroupMember),
@@ -265,7 +259,6 @@ static BlockDriver bdrv_throttle = {
    .bdrv_co_drain_end                  =   throttle_co_drain_end,

    .is_filter                          =   true,
-    .strong_runtime_opts                =   throttle_strong_runtime_opts,
 };

 static void bdrv_throttle_init(void)
--- a/block/trace-events
+++ b/block/trace-events
@@ -156,54 +156,3 @@ nvme_cmd_map_qiov_iov(void *s, int i, void *page, int pages) "s %p iov[%d] %p pa

 # block/iscsi.c
 iscsi_xcopy(void *src_lun, uint64_t src_off, void *dst_lun, uint64_t dst_off, uint64_t bytes, int ret) "src_lun %p offset %"PRIu64" dst_lun %p offset %"PRIu64" bytes %"PRIu64" ret %d"
-
-# block/nbd-client.c
-nbd_read_reply_entry_fail(int ret, const char *err) "ret = %d, err: %s"
-nbd_co_request_fail(uint64_t from, uint32_t len, uint64_t handle, uint16_t flags, uint16_t type, const char *name, int ret, const char *err) "Request failed { .from = %" PRIu64", .len = %" PRIu32 ", .handle = %" PRIu64 ", .flags = 0x%" PRIx16 ", .type = %" PRIu16 " (%s) } ret = %d, err: %s"
-
-# block/ssh.c
-ssh_restart_coroutine(void *co) "co=%p"
-ssh_flush(void) "fsync"
-ssh_check_host_key_knownhosts(const char *key) "host key OK: %s"
-ssh_connect_to_ssh(char *path, int flags, int mode) "opening file %s flags=0x%x creat_mode=0%o"
-ssh_co_yield(int sock, void *rd_handler, void *wr_handler) "s->sock=%d rd_handler=%p wr_handler=%p"
-ssh_co_yield_back(int sock) "s->sock=%d - back"
-ssh_getlength(int64_t length) "length=%" PRIi64
-ssh_co_create_opts(uint64_t size) "total_size=%" PRIu64
-ssh_read(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
-ssh_read_buf(void *buf, size_t size) "sftp_read buf=%p size=%zu"
-ssh_read_return(ssize_t ret) "sftp_read returned %zd"
-ssh_write(int64_t offset, size_t size) "offset=%" PRIi64 " size=%zu"
-ssh_write_buf(void *buf, size_t size) "sftp_write buf=%p size=%zu"
-ssh_write_return(ssize_t ret) "sftp_write returned %zd"
-ssh_seek(int64_t offset) "seeking to offset=%" PRIi64
-
-# block/curl.c
-curl_timer_cb(long timeout_ms) "timer callback timeout_ms %ld"
-curl_sock_cb(int action, int fd) "sock action %d on fd %d"
-curl_read_cb(size_t realsize) "just reading %zu bytes"
-curl_open(const char *file) "opening %s"
-curl_open_size(uint64_t size) "size = %" PRIu64
-curl_setup_preadv(uint64_t bytes, uint64_t start, const char *range) "reading %" PRIu64 " at %" PRIu64 " (%s)"
-curl_close(void) "close"
-
-# block/file-posix.c
-file_xfs_write_zeroes(const char *error) "cannot write zero range (%s)"
-file_xfs_discard(const char *error) "cannot punch hole (%s)"
-file_FindEjectableOpticalMedia(const char *media) "Matching using %s"
-file_setup_cdrom(const char *partition) "Using %s as optical disc"
-file_hdev_is_sg(int type, int version) "SG device found: type=%d, version=%d"
-
-# block/sheepdog.c
-sheepdog_reconnect_to_sdog(void) "Wait for connection to be established"
-sheepdog_aio_read_response(void) "disable cache since the server doesn't support it"
-sheepdog_open(uint32_t vid) "0x%" PRIx32 " snapshot inode was open"
-sheepdog_close(const char *name) "%s"
-sheepdog_create_branch_snapshot(uint32_t vdi) "0x%" PRIx32 " is snapshot"
-sheepdog_create_branch_created(uint32_t vdi) "0x%" PRIx32 " is created"
-sheepdog_create_branch_new(uint32_t vdi) "0x%" PRIx32 " was newly created"
-sheepdog_co_rw_vector_update(uint32_t vdi, uint64_t oid, uint64_t data, long idx) "update ino (%" PRIu32 ") %" PRIu64 " %" PRIu64 " %ld"
-sheepdog_co_rw_vector_new(uint64_t oid) "new oid 0x%" PRIx64
-sheepdog_snapshot_create_info(const char *sn_name, const char *id, const char *name, int64_t size, int is_snapshot) "sn_info: name %s id_str %s s: name %s vm_state_size %" PRId64 " " "is_snapshot %d"
-sheepdog_snapshot_create(const char *sn_name, const char *id) "%s %s"
-sheepdog_snapshot_create_inode(const char *name, uint32_t snap, uint32_t vdi) "s->inode: name %s snap_id 0x%" PRIx32 " vdi 0x%" PRIx32
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -85,8 +85,7 @@
 #define BLOCK_OPT_STATIC "static"

 #define SECTOR_SIZE 512
-#define DEFAULT_CLUSTER_SIZE 1048576
-/* Note: can't use 1 * MiB, because it's passed to stringify() */
+#define DEFAULT_CLUSTER_SIZE S_1MiB

 #if defined(CONFIG_VDI_DEBUG)
 #define VDI_DEBUG 1
@@ -204,10 +203,10 @@ static void vdi_header_to_cpu(VdiHeader *header)
    header->block_extra = le32_to_cpu(header->block_extra);
    header->blocks_in_image = le32_to_cpu(header->blocks_in_image);
    header->blocks_allocated = le32_to_cpu(header->blocks_allocated);
-    header->uuid_image = qemu_uuid_bswap(header->uuid_image);
-    header->uuid_last_snap = qemu_uuid_bswap(header->uuid_last_snap);
-    header->uuid_link = qemu_uuid_bswap(header->uuid_link);
-    header->uuid_parent = qemu_uuid_bswap(header->uuid_parent);
+    qemu_uuid_bswap(&header->uuid_image);
+    qemu_uuid_bswap(&header->uuid_last_snap);
+    qemu_uuid_bswap(&header->uuid_link);
+    qemu_uuid_bswap(&header->uuid_parent);
 }

 static void vdi_header_to_le(VdiHeader *header)
@@ -228,16 +227,15 @@ static void vdi_header_to_le(VdiHeader *header)
    header->block_extra = cpu_to_le32(header->block_extra);
    header->blocks_in_image = cpu_to_le32(header->blocks_in_image);
    header->blocks_allocated = cpu_to_le32(header->blocks_allocated);
-    header->uuid_image = qemu_uuid_bswap(header->uuid_image);
-    header->uuid_last_snap = qemu_uuid_bswap(header->uuid_last_snap);
-    header->uuid_link = qemu_uuid_bswap(header->uuid_link);
-    header->uuid_parent = qemu_uuid_bswap(header->uuid_parent);
+    qemu_uuid_bswap(&header->uuid_image);
+    qemu_uuid_bswap(&header->uuid_last_snap);
+    qemu_uuid_bswap(&header->uuid_link);
+    qemu_uuid_bswap(&header->uuid_parent);
 }

 static void vdi_header_print(VdiHeader *header)
 {
-    char uuidstr[37];
-    QemuUUID uuid;
+    char uuid[37];
    logout("text        %s", header->text);
    logout("signature   0x%08x\n", header->signature);
    logout("header size 0x%04x\n", header->header_size);
@@ -256,18 +254,14 @@ static void vdi_header_print(VdiHeader *header)
    logout("block extra 0x%04x\n", header->block_extra);
    logout("blocks tot. 0x%04x\n", header->blocks_in_image);
    logout("blocks all. 0x%04x\n", header->blocks_allocated);
-    uuid = header->uuid_image;
-    qemu_uuid_unparse(&uuid, uuidstr);
-    logout("uuid image  %s\n", uuidstr);
-    uuid = header->uuid_last_snap;
-    qemu_uuid_unparse(&uuid, uuidstr);
-    logout("uuid snap   %s\n", uuidstr);
-    uuid = header->uuid_link;
-    qemu_uuid_unparse(&uuid, uuidstr);
-    logout("uuid link   %s\n", uuidstr);
-    uuid = header->uuid_parent;
-    qemu_uuid_unparse(&uuid, uuidstr);
-    logout("uuid parent %s\n", uuidstr);
+    qemu_uuid_unparse(&header->uuid_image, uuid);
+    logout("uuid image  %s\n", uuid);
+    qemu_uuid_unparse(&header->uuid_last_snap, uuid);
+    logout("uuid snap   %s\n", uuid);
+    qemu_uuid_unparse(&header->uuid_link, uuid);
+    logout("uuid link   %s\n", uuid);
+    qemu_uuid_unparse(&header->uuid_parent, uuid);
+    logout("uuid parent %s\n", uuid);
 }

 static int coroutine_fn vdi_co_check(BlockDriverState *bs, BdrvCheckResult *res,
@@ -374,7 +368,6 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
    size_t bmap_size;
    int ret;
    Error *local_err = NULL;
-    QemuUUID uuid_link, uuid_parent;

    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
@@ -402,9 +395,6 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    uuid_link = header.uuid_link;
-    uuid_parent = header.uuid_parent;
-
    if (header.disk_size % SECTOR_SIZE != 0) {
        /* 'VBoxManage convertfromraw' can create images with odd disk sizes.
           We accept them but round the disk size to the next multiple of
@@ -454,11 +444,11 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
                   (uint64_t)header.blocks_in_image * header.block_size);
        ret = -ENOTSUP;
        goto fail;
-    } else if (!qemu_uuid_is_null(&uuid_link)) {
+    } else if (!qemu_uuid_is_null(&header.uuid_link)) {
        error_setg(errp, "unsupported VDI image (non-NULL link UUID)");
        ret = -ENOTSUP;
        goto fail;
-    } else if (!qemu_uuid_is_null(&uuid_parent)) {
+    } else if (!qemu_uuid_is_null(&header.uuid_parent)) {
        error_setg(errp, "unsupported VDI image (non-NULL parent UUID)");
        ret = -ENOTSUP;
        goto fail;
@@ -743,7 +733,6 @@ static int coroutine_fn vdi_co_do_create(BlockdevCreateOptions *create_options,
    BlockDriverState *bs_file = NULL;
    BlockBackend *blk = NULL;
    uint32_t *bmap = NULL;
-    QemuUUID uuid;

    assert(create_options->driver == BLOCKDEV_DRIVER_VDI);
    vdi_opts = &create_options->u.vdi;
@@ -830,10 +819,8 @@ static int coroutine_fn vdi_co_do_create(BlockdevCreateOptions *create_options,
    if (image_type == VDI_TYPE_STATIC) {
        header.blocks_allocated = blocks;
    }
-    qemu_uuid_generate(&uuid);
-    header.uuid_image = uuid;
-    qemu_uuid_generate(&uuid);
-    header.uuid_last_snap = uuid;
+    qemu_uuid_generate(&header.uuid_image);
+    qemu_uuid_generate(&header.uuid_last_snap);
    /* There is no need to set header.uuid_link or header.uuid_parent here. */
    if (VDI_DEBUG) {
        vdi_header_print(&header);
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -803,7 +803,6 @@ int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s, bool *flushed,

    if (logs.valid) {
        if (bs->read_only) {
-            bdrv_refresh_filename(bs);
            ret = -EPERM;
            error_setg(errp,
                       "VHDX image file '%s' opened read-only, but "
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -398,7 +398,7 @@ typedef struct BDRVVHDXState {

    bool log_replayed_on_open;

-    QLIST_HEAD(, VHDXRegionEntry) regions;
+    QLIST_HEAD(VHDXRegionHead, VHDXRegionEntry) regions;
 } BDRVVHDXState;

 void vhdx_guid_generate(MSGUID *guid);
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -27,7 +27,6 @@
 #include "qapi/error.h"
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
-#include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
@@ -387,14 +386,12 @@ static int vmdk_parent_open(BlockDriverState *bs)
            ret = -EINVAL;
            goto out;
        }
-        if ((end_name - p_name) > sizeof(bs->auto_backing_file) - 1) {
+        if ((end_name - p_name) > sizeof(bs->backing_file) - 1) {
            ret = -EINVAL;
            goto out;
        }

-        pstrcpy(bs->auto_backing_file, end_name - p_name + 1, p_name);
-        pstrcpy(bs->backing_file, sizeof(bs->backing_file),
-                bs->auto_backing_file);
+        pstrcpy(bs->backing_file, end_name - p_name + 1, p_name);
    }

 out:
@@ -482,7 +479,6 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
                     extent->l1_table,
                     l1_size);
    if (ret < 0) {
-        bdrv_refresh_filename(extent->file->bs);
        error_setg_errno(errp, -ret,
                         "Could not read l1 table from extent '%s'",
                         extent->file->bs->filename);
@@ -503,7 +499,6 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent,
                         extent->l1_backup_table,
                         l1_size);
        if (ret < 0) {
-            bdrv_refresh_filename(extent->file->bs);
            error_setg_errno(errp, -ret,
                             "Could not read l1 backup table from extent '%s'",
                             extent->file->bs->filename);
@@ -535,7 +530,6 @@ static int vmdk_open_vmfs_sparse(BlockDriverState *bs,

    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
-        bdrv_refresh_filename(file->bs);
        error_setg_errno(errp, -ret,
                         "Could not read header from file '%s'",
                         file->bs->filename);
@@ -613,7 +607,6 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,

    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
-        bdrv_refresh_filename(file->bs);
        error_setg_errno(errp, -ret,
                         "Could not read header from file '%s'",
                         file->bs->filename);
@@ -868,13 +861,13 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
        if (!path_is_absolute(fname) && !path_has_protocol(fname) &&
            !desc_file_path[0])
        {
-            bdrv_refresh_filename(bs->file->bs);
            error_setg(errp, "Cannot use relative extent paths with VMDK "
                       "descriptor file '%s'", bs->file->bs->filename);
            return -EINVAL;
        }

-        extent_path = path_combine(desc_file_path, fname);
+        extent_path = g_malloc0(PATH_MAX);
+        path_combine(extent_path, PATH_MAX, desc_file_path, fname);

        ret = snprintf(extent_opt_prefix, 32, "extents.%d", s->num_extents);
        assert(ret < 32);
@@ -1378,6 +1371,7 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
    VmdkGrainMarker *data = NULL;
    uLongf buf_len;
    QEMUIOVector local_qiov;
+    struct iovec iov;
    int64_t write_offset;
    int64_t write_end_sector;

@@ -1405,7 +1399,11 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
        data->size = cpu_to_le32(buf_len);

        n_bytes = buf_len + sizeof(VmdkGrainMarker);
-        qemu_iovec_init_buf(&local_qiov, data, n_bytes);
+        iov = (struct iovec) {
+            .iov_base   = data,
+            .iov_len    = n_bytes,
+        };
+        qemu_iovec_init_external(&local_qiov, &iov, 1);

        BLKDBG_EVENT(extent->file, BLKDBG_WRITE_COMPRESSED);
    } else {
@@ -1743,17 +1741,35 @@ static int coroutine_fn vmdk_co_pwrite_zeroes(BlockDriverState *bs,
    return ret;
 }

-static int vmdk_init_extent(BlockBackend *blk,
-                            int64_t filesize, bool flat,
-                            bool compress, bool zeroed_grain,
-                            Error **errp)
+static int vmdk_create_extent(const char *filename, int64_t filesize,
+                              bool flat, bool compress, bool zeroed_grain,
+                              QemuOpts *opts, Error **errp)
 {
    int ret, i;
+    BlockBackend *blk = NULL;
    VMDK4Header header;
+    Error *local_err = NULL;
    uint32_t tmp, magic, grains, gd_sectors, gt_size, gt_count;
    uint32_t *gd_buf = NULL;
    int gd_buf_size;

+    ret = bdrv_create_file(filename, opts, &local_err);
+    if (ret < 0) {
+        error_propagate(errp, local_err);
+        goto exit;
+    }
+
+    blk = blk_new_open(filename, NULL, NULL,
+                       BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
+                       &local_err);
+    if (blk == NULL) {
+        error_propagate(errp, local_err);
+        ret = -EIO;
+        goto exit;
+    }
+
+    blk_set_allow_write_beyond_eof(blk, true);
+
    if (flat) {
        ret = blk_truncate(blk, filesize, PREALLOC_MODE_OFF, errp);
        goto exit;
@@ -1847,50 +1863,15 @@ static int vmdk_init_extent(BlockBackend *blk,
                     gd_buf, gd_buf_size, 0);
    if (ret < 0) {
        error_setg(errp, QERR_IO_ERROR);
+        goto exit;
    }

    ret = 0;
-exit:
-    g_free(gd_buf);
-    return ret;
-}
-
-static int vmdk_create_extent(const char *filename, int64_t filesize,
-                              bool flat, bool compress, bool zeroed_grain,
-                              BlockBackend **pbb,
-                              QemuOpts *opts, Error **errp)
-{
-    int ret;
-    BlockBackend *blk = NULL;
-    Error *local_err = NULL;
-
-    ret = bdrv_create_file(filename, opts, &local_err);
-    if (ret < 0) {
-        error_propagate(errp, local_err);
-        goto exit;
-    }
-
-    blk = blk_new_open(filename, NULL, NULL,
-                       BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
-                       &local_err);
-    if (blk == NULL) {
-        error_propagate(errp, local_err);
-        ret = -EIO;
-        goto exit;
-    }
-
-    blk_set_allow_write_beyond_eof(blk, true);
-
-    ret = vmdk_init_extent(blk, filesize, flat, compress, zeroed_grain, errp);
 exit:
    if (blk) {
-        if (pbb) {
-            *pbb = blk;
-        } else {
-            blk_unref(blk);
-            blk = NULL;
-        }
+        blk_unref(blk);
    }
+    g_free(gd_buf);
    return ret;
 }

@@ -1934,57 +1915,33 @@ static int filename_decompose(const char *filename, char *path, char *prefix,
    return VMDK_OK;
 }

-/*
- * idx == 0: get or create the descriptor file (also the image file if in a
- *           non-split format.
- * idx >= 1: get the n-th extent if in a split subformat
- */
-typedef BlockBackend *(*vmdk_create_extent_fn)(int64_t size,
-                                               int idx,
-                                               bool flat,
-                                               bool split,
-                                               bool compress,
-                                               bool zeroed_grain,
-                                               void *opaque,
-                                               Error **errp);
-
-static void vmdk_desc_add_extent(GString *desc,
-                                 const char *extent_line_fmt,
-                                 int64_t size, const char *filename)
+static int coroutine_fn vmdk_co_create_opts(const char *filename, QemuOpts *opts,
+                                            Error **errp)
 {
-    char *basename = g_path_get_basename(filename);
-
-    g_string_append_printf(desc, extent_line_fmt,
-                           DIV_ROUND_UP(size, BDRV_SECTOR_SIZE), basename);
-    g_free(basename);
-}
-
-static int coroutine_fn vmdk_co_do_create(int64_t size,
-                                          BlockdevVmdkSubformat subformat,
-                                          BlockdevVmdkAdapterType adapter_type,
-                                          const char *backing_file,
-                                          const char *hw_version,
-                                          bool compat6,
-                                          bool zeroed_grain,
-                                          vmdk_create_extent_fn extent_fn,
-                                          void *opaque,
-                                          Error **errp)
-{
-    int extent_idx;
-    BlockBackend *blk = NULL;
-    BlockBackend *extent_blk;
+    int idx = 0;
+    BlockBackend *new_blk = NULL;
    Error *local_err = NULL;
    char *desc = NULL;
+    int64_t total_size = 0, filesize;
+    char *adapter_type = NULL;
+    char *backing_file = NULL;
+    char *hw_version = NULL;
+    char *fmt = NULL;
    int ret = 0;
    bool flat, split, compress;
    GString *ext_desc_lines;
+    char *path = g_malloc0(PATH_MAX);
+    char *prefix = g_malloc0(PATH_MAX);
+    char *postfix = g_malloc0(PATH_MAX);
+    char *desc_line = g_malloc0(BUF_SIZE);
+    char *ext_filename = g_malloc0(PATH_MAX);
+    char *desc_filename = g_malloc0(PATH_MAX);
    const int64_t split_size = 0x80000000;  /* VMDK has constant split size */
-    int64_t extent_size;
-    int64_t created_size = 0;
-    const char *extent_line_fmt;
+    const char *desc_extent_line;
    char *parent_desc_line = g_malloc0(BUF_SIZE);
    uint32_t parent_cid = 0xffffffff;
    uint32_t number_heads = 16;
+    bool zeroed_grain = false;
    uint32_t desc_offset = 0, desc_len;
    const char desc_template[] =
        "# Disk DescriptorFile\n"
@@ -2008,35 +1965,71 @@ static int coroutine_fn vmdk_co_do_create(int64_t size,

    ext_desc_lines = g_string_new(NULL);

+    if (filename_decompose(filename, path, prefix, postfix, PATH_MAX, errp)) {
+        ret = -EINVAL;
+        goto exit;
+    }
    /* Read out options */
-    if (compat6) {
-        if (hw_version) {
+    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
+                          BDRV_SECTOR_SIZE);
+    adapter_type = qemu_opt_get_del(opts, BLOCK_OPT_ADAPTER_TYPE);
+    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
+    hw_version = qemu_opt_get_del(opts, BLOCK_OPT_HWVERSION);
+    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_COMPAT6, false)) {
+        if (strcmp(hw_version, "undefined")) {
            error_setg(errp,
                       "compat6 cannot be enabled with hwversion set");
            ret = -EINVAL;
            goto exit;
        }
-        hw_version = "6";
+        g_free(hw_version);
+        hw_version = g_strdup("6");
    }
-    if (!hw_version) {
-        hw_version = "4";
+    if (strcmp(hw_version, "undefined") == 0) {
+        g_free(hw_version);
+        hw_version = g_strdup("4");
+    }
+    fmt = qemu_opt_get_del(opts, BLOCK_OPT_SUBFMT);
+    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ZEROED_GRAIN, false)) {
+        zeroed_grain = true;
    }

-    if (adapter_type != BLOCKDEV_VMDK_ADAPTER_TYPE_IDE) {
+    if (!adapter_type) {
+        adapter_type = g_strdup("ide");
+    } else if (strcmp(adapter_type, "ide") &&
+               strcmp(adapter_type, "buslogic") &&
+               strcmp(adapter_type, "lsilogic") &&
+               strcmp(adapter_type, "legacyESX")) {
+        error_setg(errp, "Unknown adapter type: '%s'", adapter_type);
+        ret = -EINVAL;
+        goto exit;
+    }
+    if (strcmp(adapter_type, "ide") != 0) {
        /* that's the number of heads with which vmware operates when
           creating, exporting, etc. vmdk files with a non-ide adapter type */
        number_heads = 255;
    }
-    split = (subformat == BLOCKDEV_VMDK_SUBFORMAT_TWOGBMAXEXTENTFLAT) ||
-            (subformat == BLOCKDEV_VMDK_SUBFORMAT_TWOGBMAXEXTENTSPARSE);
-    flat = (subformat == BLOCKDEV_VMDK_SUBFORMAT_MONOLITHICFLAT) ||
-           (subformat == BLOCKDEV_VMDK_SUBFORMAT_TWOGBMAXEXTENTFLAT);
-    compress = subformat == BLOCKDEV_VMDK_SUBFORMAT_STREAMOPTIMIZED;
-
+    if (!fmt) {
+        /* Default format to monolithicSparse */
+        fmt = g_strdup("monolithicSparse");
+    } else if (strcmp(fmt, "monolithicFlat") &&
+               strcmp(fmt, "monolithicSparse") &&
+               strcmp(fmt, "twoGbMaxExtentSparse") &&
+               strcmp(fmt, "twoGbMaxExtentFlat") &&
+               strcmp(fmt, "streamOptimized")) {
+        error_setg(errp, "Unknown subformat: '%s'", fmt);
+        ret = -EINVAL;
+        goto exit;
+    }
+    split = !(strcmp(fmt, "twoGbMaxExtentFlat") &&
+              strcmp(fmt, "twoGbMaxExtentSparse"));
+    flat = !(strcmp(fmt, "monolithicFlat") &&
+             strcmp(fmt, "twoGbMaxExtentFlat"));
+    compress = !strcmp(fmt, "streamOptimized");
    if (flat) {
-        extent_line_fmt = "RW %" PRId64 " FLAT \"%s\" 0\n";
+        desc_extent_line = "RW %" PRId64 " FLAT \"%s\" 0\n";
    } else {
-        extent_line_fmt = "RW %" PRId64 " SPARSE \"%s\"\n";
+        desc_extent_line = "RW %" PRId64 " SPARSE \"%s\"\n";
    }
    if (flat && backing_file) {
        error_setg(errp, "Flat image can't have backing file");
@@ -2048,111 +2041,106 @@ static int coroutine_fn vmdk_co_do_create(int64_t size,
        ret = -ENOTSUP;
        goto exit;
    }
-
-    /* Create extents */
-    if (split) {
-        extent_size = split_size;
-    } else {
-        extent_size = size;
-    }
-    if (!split && !flat) {
-        created_size = extent_size;
-    } else {
-        created_size = 0;
-    }
-    /* Get the descriptor file BDS */
-    blk = extent_fn(created_size, 0, flat, split, compress, zeroed_grain,
-                    opaque, errp);
-    if (!blk) {
-        ret = -EIO;
-        goto exit;
-    }
-    if (!split && !flat) {
-        vmdk_desc_add_extent(ext_desc_lines, extent_line_fmt, created_size,
-                             blk_bs(blk)->filename);
-    }
-
    if (backing_file) {
-        BlockBackend *backing;
-        char *full_backing =
-            bdrv_get_full_backing_filename_from_filename(blk_bs(blk)->filename,
-                                                         backing_file,
-                                                         &local_err);
+        BlockBackend *blk;
+        char *full_backing = g_new0(char, PATH_MAX);
+        bdrv_get_full_backing_filename_from_filename(filename, backing_file,
+                                                     full_backing, PATH_MAX,
+                                                     &local_err);
        if (local_err) {
+            g_free(full_backing);
            error_propagate(errp, local_err);
            ret = -ENOENT;
            goto exit;
        }
-        assert(full_backing);

-        backing = blk_new_open(full_backing, NULL, NULL,
-                               BDRV_O_NO_BACKING, errp);
+        blk = blk_new_open(full_backing, NULL, NULL,
+                           BDRV_O_NO_BACKING, errp);
        g_free(full_backing);
-        if (backing == NULL) {
+        if (blk == NULL) {
            ret = -EIO;
            goto exit;
        }
-        if (strcmp(blk_bs(backing)->drv->format_name, "vmdk")) {
-            error_setg(errp, "Invalid backing file format: %s. Must be vmdk",
-                       blk_bs(backing)->drv->format_name);
-            blk_unref(backing);
+        if (strcmp(blk_bs(blk)->drv->format_name, "vmdk")) {
+            blk_unref(blk);
            ret = -EINVAL;
            goto exit;
        }
-        ret = vmdk_read_cid(blk_bs(backing), 0, &parent_cid);
-        blk_unref(backing);
+        ret = vmdk_read_cid(blk_bs(blk), 0, &parent_cid);
+        blk_unref(blk);
        if (ret) {
-            error_setg(errp, "Failed to read parent CID");
            goto exit;
        }
        snprintf(parent_desc_line, BUF_SIZE,
                "parentFileNameHint=\"%s\"", backing_file);
    }
-    extent_idx = 1;
-    while (created_size < size) {
-        int64_t cur_size = MIN(size - created_size, extent_size);
-        extent_blk = extent_fn(cur_size, extent_idx, flat, split, compress,
-                               zeroed_grain, opaque, errp);
-        if (!extent_blk) {
+
+    /* Create extents */
+    filesize = total_size;
+    while (filesize > 0) {
+        int64_t size = filesize;
+
+        if (split && size > split_size) {
+            size = split_size;
+        }
+        if (split) {
+            snprintf(desc_filename, PATH_MAX, "%s-%c%03d%s",
+                    prefix, flat ? 'f' : 's', ++idx, postfix);
+        } else if (flat) {
+            snprintf(desc_filename, PATH_MAX, "%s-flat%s", prefix, postfix);
+        } else {
+            snprintf(desc_filename, PATH_MAX, "%s%s", prefix, postfix);
+        }
+        snprintf(ext_filename, PATH_MAX, "%s%s", path, desc_filename);
+
+        if (vmdk_create_extent(ext_filename, size,
+                               flat, compress, zeroed_grain, opts, errp)) {
            ret = -EINVAL;
            goto exit;
        }
-        vmdk_desc_add_extent(ext_desc_lines, extent_line_fmt, cur_size,
-                             blk_bs(extent_blk)->filename);
-        created_size += cur_size;
-        extent_idx++;
-        blk_unref(extent_blk);
-    }
+        filesize -= size;

-    /* Check whether we got excess extents */
-    extent_blk = extent_fn(-1, extent_idx, flat, split, compress, zeroed_grain,
-                           opaque, NULL);
-    if (extent_blk) {
-        blk_unref(extent_blk);
-        error_setg(errp, "List of extents contains unused extents");
-        ret = -EINVAL;
-        goto exit;
+        /* Format description line */
+        snprintf(desc_line, BUF_SIZE,
+                    desc_extent_line, size / BDRV_SECTOR_SIZE, desc_filename);
+        g_string_append(ext_desc_lines, desc_line);
    }
-
    /* generate descriptor file */
    desc = g_strdup_printf(desc_template,
                           g_random_int(),
                           parent_cid,
-                           BlockdevVmdkSubformat_str(subformat),
+                           fmt,
                           parent_desc_line,
                           ext_desc_lines->str,
                           hw_version,
-                           size /
+                           total_size /
                               (int64_t)(63 * number_heads * BDRV_SECTOR_SIZE),
                           number_heads,
-                           BlockdevVmdkAdapterType_str(adapter_type));
+                           adapter_type);
    desc_len = strlen(desc);
    /* the descriptor offset = 0x200 */
    if (!split && !flat) {
        desc_offset = 0x200;
+    } else {
+        ret = bdrv_create_file(filename, opts, &local_err);
+        if (ret < 0) {
+            error_propagate(errp, local_err);
+            goto exit;
+        }
    }

-    ret = blk_pwrite(blk, desc_offset, desc, desc_len, 0);
+    new_blk = blk_new_open(filename, NULL, NULL,
+                           BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
+                           &local_err);
+    if (new_blk == NULL) {
+        error_propagate(errp, local_err);
+        ret = -EIO;
+        goto exit;
+    }
+
+    blk_set_allow_write_beyond_eof(new_blk, true);
+
+    ret = blk_pwrite(new_blk, desc_offset, desc, desc_len, 0);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Could not write description");
        goto exit;
@@ -2160,152 +2148,12 @@ static int coroutine_fn vmdk_co_do_create(int64_t size,
    /* bdrv_pwrite write padding zeros to align to sector, we don't need that
     * for description file */
    if (desc_offset == 0) {
-        ret = blk_truncate(blk, desc_len, PREALLOC_MODE_OFF, errp);
-        if (ret < 0) {
-            goto exit;
-        }
+        ret = blk_truncate(new_blk, desc_len, PREALLOC_MODE_OFF, errp);
    }
-    ret = 0;
 exit:
-    if (blk) {
-        blk_unref(blk);
+    if (new_blk) {
+        blk_unref(new_blk);
    }
-    g_free(desc);
-    g_free(parent_desc_line);
-    g_string_free(ext_desc_lines, true);
-    return ret;
-}
-
-typedef struct {
-    char *path;
-    char *prefix;
-    char *postfix;
-    QemuOpts *opts;
-} VMDKCreateOptsData;
-
-static BlockBackend *vmdk_co_create_opts_cb(int64_t size, int idx,
-                                            bool flat, bool split, bool compress,
-                                            bool zeroed_grain, void *opaque,
-                                            Error **errp)
-{
-    BlockBackend *blk = NULL;
-    BlockDriverState *bs = NULL;
-    VMDKCreateOptsData *data = opaque;
-    char *ext_filename = NULL;
-    char *rel_filename = NULL;
-
-    /* We're done, don't create excess extents. */
-    if (size == -1) {
-        assert(errp == NULL);
-        return NULL;
-    }
-
-    if (idx == 0) {
-        rel_filename = g_strdup_printf("%s%s", data->prefix, data->postfix);
-    } else if (split) {
-        rel_filename = g_strdup_printf("%s-%c%03d%s",
-                                       data->prefix,
-                                       flat ? 'f' : 's', idx, data->postfix);
-    } else {
-        assert(idx == 1);
-        rel_filename = g_strdup_printf("%s-flat%s", data->prefix, data->postfix);
-    }
-
-    ext_filename = g_strdup_printf("%s%s", data->path, rel_filename);
-    g_free(rel_filename);
-
-    if (vmdk_create_extent(ext_filename, size,
-                           flat, compress, zeroed_grain, &blk, data->opts,
-                           errp)) {
-        goto exit;
-    }
-    bdrv_unref(bs);
-exit:
-    g_free(ext_filename);
-    return blk;
-}
-
-static int coroutine_fn vmdk_co_create_opts(const char *filename, QemuOpts *opts,
-                                            Error **errp)
-{
-    Error *local_err = NULL;
-    char *desc = NULL;
-    int64_t total_size = 0;
-    char *adapter_type = NULL;
-    BlockdevVmdkAdapterType adapter_type_enum;
-    char *backing_file = NULL;
-    char *hw_version = NULL;
-    char *fmt = NULL;
-    BlockdevVmdkSubformat subformat;
-    int ret = 0;
-    char *path = g_malloc0(PATH_MAX);
-    char *prefix = g_malloc0(PATH_MAX);
-    char *postfix = g_malloc0(PATH_MAX);
-    char *desc_line = g_malloc0(BUF_SIZE);
-    char *ext_filename = g_malloc0(PATH_MAX);
-    char *desc_filename = g_malloc0(PATH_MAX);
-    char *parent_desc_line = g_malloc0(BUF_SIZE);
-    bool zeroed_grain;
-    bool compat6;
-    VMDKCreateOptsData data;
-
-    if (filename_decompose(filename, path, prefix, postfix, PATH_MAX, errp)) {
-        ret = -EINVAL;
-        goto exit;
-    }
-    /* Read out options */
-    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
-                          BDRV_SECTOR_SIZE);
-    adapter_type = qemu_opt_get_del(opts, BLOCK_OPT_ADAPTER_TYPE);
-    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    hw_version = qemu_opt_get_del(opts, BLOCK_OPT_HWVERSION);
-    compat6 = qemu_opt_get_bool_del(opts, BLOCK_OPT_COMPAT6, false);
-    if (strcmp(hw_version, "undefined") == 0) {
-        g_free(hw_version);
-        hw_version = NULL;
-    }
-    fmt = qemu_opt_get_del(opts, BLOCK_OPT_SUBFMT);
-    zeroed_grain = qemu_opt_get_bool_del(opts, BLOCK_OPT_ZEROED_GRAIN, false);
-
-    if (adapter_type) {
-        adapter_type_enum = qapi_enum_parse(&BlockdevVmdkAdapterType_lookup,
-                                            adapter_type,
-                                            BLOCKDEV_VMDK_ADAPTER_TYPE_IDE,
-                                            &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-            goto exit;
-        }
-    } else {
-        adapter_type_enum = BLOCKDEV_VMDK_ADAPTER_TYPE_IDE;
-    }
-
-    if (!fmt) {
-        /* Default format to monolithicSparse */
-        subformat = BLOCKDEV_VMDK_SUBFORMAT_MONOLITHICSPARSE;
-    } else {
-        subformat = qapi_enum_parse(&BlockdevVmdkSubformat_lookup,
-                                    fmt,
-                                    BLOCKDEV_VMDK_SUBFORMAT_MONOLITHICSPARSE,
-                                    &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-            goto exit;
-        }
-    }
-    data = (VMDKCreateOptsData){
-        .prefix = prefix,
-        .postfix = postfix,
-        .path = path,
-        .opts = opts,
-    };
-    ret = vmdk_co_do_create(total_size, subformat, adapter_type_enum,
-                            backing_file, hw_version, compat6, zeroed_grain,
-                            vmdk_co_create_opts_cb, &data, errp);
-
-exit:
    g_free(adapter_type);
    g_free(backing_file);
    g_free(hw_version);
@@ -2318,86 +2166,7 @@ exit:
    g_free(ext_filename);
    g_free(desc_filename);
    g_free(parent_desc_line);
-    return ret;
-}
-
-static BlockBackend *vmdk_co_create_cb(int64_t size, int idx,
-                                       bool flat, bool split, bool compress,
-                                       bool zeroed_grain, void *opaque,
-                                       Error **errp)
-{
-    int ret;
-    BlockDriverState *bs;
-    BlockBackend *blk;
-    BlockdevCreateOptionsVmdk *opts = opaque;
-
-    if (idx == 0) {
-        bs = bdrv_open_blockdev_ref(opts->file, errp);
-    } else {
-        int i;
-        BlockdevRefList *list = opts->extents;
-        for (i = 1; i < idx; i++) {
-            if (!list || !list->next) {
-                error_setg(errp, "Extent [%d] not specified", i);
-                return NULL;
-            }
-            list = list->next;
-        }
-        if (!list) {
-            error_setg(errp, "Extent [%d] not specified", idx - 1);
-            return NULL;
-        }
-        bs = bdrv_open_blockdev_ref(list->value, errp);
-    }
-    if (!bs) {
-        return NULL;
-    }
-    blk = blk_new(BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE | BLK_PERM_RESIZE,
-                  BLK_PERM_ALL);
-    if (blk_insert_bs(blk, bs, errp)) {
-        bdrv_unref(bs);
-        return NULL;
-    }
-    blk_set_allow_write_beyond_eof(blk, true);
-    bdrv_unref(bs);
-
-    if (size != -1) {
-        ret = vmdk_init_extent(blk, size, flat, compress, zeroed_grain, errp);
-        if (ret) {
-            blk_unref(blk);
-            blk = NULL;
-        }
-    }
-    return blk;
-}
-
-static int coroutine_fn vmdk_co_create(BlockdevCreateOptions *create_options,
-                                       Error **errp)
-{
-    int ret;
-    BlockdevCreateOptionsVmdk *opts;
-
-    opts = &create_options->u.vmdk;
-
-    /* Validate options */
-    if (!QEMU_IS_ALIGNED(opts->size, BDRV_SECTOR_SIZE)) {
-        error_setg(errp, "Image size must be a multiple of 512 bytes");
-        ret = -EINVAL;
-        goto out;
-    }
-
-    ret = vmdk_co_do_create(opts->size,
-                            opts->subformat,
-                            opts->adapter_type,
-                            opts->backing_file,
-                            opts->hwversion,
-                            false,
-                            opts->zeroed_grain,
-                            vmdk_co_create_cb,
-                            opts, errp);
-    return ret;
-
-out:
+    g_string_free(ext_desc_lines, true);
    return ret;
 }

@@ -2472,7 +2241,6 @@ static ImageInfo *vmdk_get_extent_info(VmdkExtent *extent)
 {
    ImageInfo *info = g_new0(ImageInfo, 1);

-    bdrv_refresh_filename(extent->file->bs);
    *info = (ImageInfo){
        .filename         = g_strdup(extent->file->bs->filename),
        .format           = g_strdup(extent->type),
@@ -2546,8 +2314,7 @@ static int coroutine_fn vmdk_co_check(BlockDriverState *bs,
    return ret;
 }

-static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs,
-                                                 Error **errp)
+static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)
 {
    int i;
    BDRVVmdkState *s = bs->opaque;
@@ -2604,23 +2371,6 @@ static int vmdk_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
    return 0;
 }

-static void vmdk_gather_child_options(BlockDriverState *bs, QDict *target,
-                                      bool backing_overridden)
-{
-    /* No children but file and backing can be explicitly specified (TODO) */
-    qdict_put(target, "file",
-              qobject_ref(bs->file->bs->full_open_options));
-
-    if (backing_overridden) {
-        if (bs->backing) {
-            qdict_put(target, "backing",
-                      qobject_ref(bs->backing->bs->full_open_options));
-        } else {
-            qdict_put_null(target, "backing");
-        }
-    }
-}
-
 static QemuOptsList vmdk_create_opts = {
    .name = "vmdk-create-opts",
    .head = QTAILQ_HEAD_INITIALIZER(vmdk_create_opts.head),
@@ -2684,7 +2434,6 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_co_pwrite_zeroes        = vmdk_co_pwrite_zeroes,
    .bdrv_close                   = vmdk_close,
    .bdrv_co_create_opts          = vmdk_co_create_opts,
-    .bdrv_co_create               = vmdk_co_create,
    .bdrv_co_flush_to_disk        = vmdk_co_flush,
    .bdrv_co_block_status         = vmdk_co_block_status,
    .bdrv_get_allocated_file_size = vmdk_get_allocated_file_size,
@@ -2692,7 +2441,6 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_get_specific_info       = vmdk_get_specific_info,
    .bdrv_refresh_limits          = vmdk_refresh_limits,
    .bdrv_get_info                = vmdk_get_info,
-    .bdrv_gather_child_options    = vmdk_gather_child_options,

    .supports_backing             = true,
    .create_opts                  = &vmdk_create_opts,
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -187,7 +187,7 @@ static uint32_t vpc_checksum(uint8_t* buf, size_t size)
 static int vpc_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    if (buf_size >= 8 && !strncmp((char *)buf, "conectix", 8))
-        return 100;
+	return 100;
    return 0;
 }

@@ -979,7 +979,6 @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
    int64_t total_size;
    int disk_type;
    int ret = -EIO;
-    QemuUUID uuid;

    assert(opts->driver == BLOCKDEV_DRIVER_VPC);
    vpc_opts = &opts->u.vpc;
@@ -1063,8 +1062,7 @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,

    footer->type = cpu_to_be32(disk_type);

-    qemu_uuid_generate(&uuid);
-    footer->uuid = uuid;
+    qemu_uuid_generate(&footer->uuid);

    footer->checksum = cpu_to_be32(vpc_checksum(buf, HEADER_SIZE));

@@ -1218,12 +1216,6 @@ static QemuOptsList vpc_create_opts = {
    }
 };

-static const char *const vpc_strong_runtime_opts[] = {
-    VPC_OPT_SIZE_CALC,
-
-    NULL
-};
-
 static BlockDriver bdrv_vpc = {
    .format_name    = "vpc",
    .instance_size  = sizeof(BDRVVPCState),
@@ -1244,7 +1236,6 @@ static BlockDriver bdrv_vpc = {

    .create_opts            = &vpc_create_opts,
    .bdrv_has_zero_init     = vpc_has_zero_init,
-    .strong_runtime_opts    = vpc_strong_runtime_opts,
 };

 static void bdrv_vpc_init(void)
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -3253,16 +3253,6 @@ static void vvfat_close(BlockDriverState *bs)
    }
 }

-static const char *const vvfat_strong_runtime_opts[] = {
-    "dir",
-    "fat-type",
-    "floppy",
-    "label",
-    "rw",
-
-    NULL
-};
-
 static BlockDriver bdrv_vvfat = {
    .format_name            = "vvfat",
    .protocol_name          = "fat",
@@ -3277,8 +3267,6 @@ static BlockDriver bdrv_vvfat = {
    .bdrv_co_preadv         = vvfat_co_preadv,
    .bdrv_co_pwritev        = vvfat_co_pwritev,
    .bdrv_co_block_status   = vvfat_co_block_status,
-
-    .strong_runtime_opts    = vvfat_strong_runtime_opts,
 };

 static void bdrv_vvfat_init(void)
--- a/block/vxhs.c
+++ b/block/vxhs.c
@@ -556,16 +556,6 @@ static int64_t vxhs_getlength(BlockDriverState *bs)
    return vdisk_size;
 }

-static const char *const vxhs_strong_runtime_opts[] = {
-    VXHS_OPT_VDISK_ID,
-    "tls-creds",
-    VXHS_OPT_HOST,
-    VXHS_OPT_PORT,
-    VXHS_OPT_SERVER".",
-
-    NULL
-};
-
 static BlockDriver bdrv_vxhs = {
    .format_name                  = "vxhs",
    .protocol_name                = "vxhs",
@@ -577,7 +567,6 @@ static BlockDriver bdrv_vxhs = {
    .bdrv_getlength               = vxhs_getlength,
    .bdrv_aio_preadv              = vxhs_aio_preadv,
    .bdrv_aio_pwritev             = vxhs_aio_pwritev,
-    .strong_runtime_opts          = vxhs_strong_runtime_opts,
 };

 static void bdrv_vxhs_init(void)
--- a/blockdev-nbd.c
+++ b/blockdev-nbd.c
@@ -140,13 +140,11 @@ void qmp_nbd_server_start(SocketAddressLegacy *addr,
 }

 void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
-                        bool has_writable, bool writable,
-                        bool has_bitmap, const char *bitmap, Error **errp)
+                        bool has_writable, bool writable, Error **errp)
 {
    BlockDriverState *bs = NULL;
    BlockBackend *on_eject_blk;
    NBDExport *exp;
-    int64_t len;

    if (!nbd_server) {
        error_setg(errp, "NBD server not running");
@@ -169,13 +167,6 @@ void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
        return;
    }

-    len = bdrv_getlength(bs);
-    if (len < 0) {
-        error_setg_errno(errp, -len,
-                         "Failed to determine the NBD export's length");
-        return;
-    }
-
    if (!has_writable) {
        writable = false;
    }
@@ -183,13 +174,14 @@ void qmp_nbd_server_add(const char *device, bool has_name, const char *name,
        writable = false;
    }

-    exp = nbd_export_new(bs, 0, len, name, NULL, bitmap,
-                         writable ? 0 : NBD_FLAG_READ_ONLY,
+    exp = nbd_export_new(bs, 0, -1, writable ? 0 : NBD_FLAG_READ_ONLY,
                         NULL, false, on_eject_blk, errp);
    if (!exp) {
        return;
    }

+    nbd_export_set_name(exp, name);
+
    /* The list of named exports has a strong reference to this export now and
     * our only way of accessing it is through nbd_export_find(), so we can drop
     * the strong reference that is @exp. */
@@ -222,13 +214,31 @@ void qmp_nbd_server_remove(const char *name,

 void qmp_nbd_server_stop(Error **errp)
 {
-    if (!nbd_server) {
-        error_setg(errp, "NBD server not running");
-        return;
-    }
-
    nbd_export_close_all();

    nbd_server_free(nbd_server);
    nbd_server = NULL;
 }
+
+void qmp_x_nbd_server_add_bitmap(const char *name, const char *bitmap,
+                                 bool has_bitmap_export_name,
+                                 const char *bitmap_export_name,
+                                 Error **errp)
+{
+    NBDExport *exp;
+
+    if (!nbd_server) {
+        error_setg(errp, "NBD server not running");
+        return;
+    }
+
+    exp = nbd_export_find(name);
+    if (exp == NULL) {
+        error_setg(errp, "Export '%s' is not found", name);
+        return;
+    }
+
+    nbd_export_bitmap(exp, bitmap,
+                      has_bitmap_export_name ? bitmap_export_name : bitmap,
+                      errp);
+}
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.50
 .1.1.1