This is the delta between the qemu and qemu-kvm v0.15.1 versions

Signed-off-by: Bruce Rogers <brogers@suse.com>
Version 0.15.1
2018-02-09 11:41:11 -07:00 · 2011-10-11 09:46:03 -05:00 · 2011-10-05 11:33:31 -05:00 · 2011-10-03 14:42:24 -05:00 · 2011-10-03 14:42:16 -05:00 · 2011-10-03 14:41:44 -05:00
1075 changed files with 66841 additions and 72284 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -15,12 +15,7 @@ libdis*
 libhw32
 libhw64
 libuser
-linux-headers/asm
 qapi-generated
-qapi-types.[ch]
-qapi-visit.[ch]
-qmp-commands.h
-qmp-marshal.c
 qemu-doc.html
 qemu-tech.html
 qemu-doc.info
@@ -41,7 +36,6 @@ qemu-io
 qemu-ga
 qemu-monitor.texi
 QMP/qmp-commands.txt
-test-coroutine
 .gdbinit
 *.a
 *.aux
@@ -71,6 +65,8 @@ pc-bios/vgabios-pq/status
 pc-bios/optionrom/linuxboot.bin
 pc-bios/optionrom/multiboot.bin
 pc-bios/optionrom/multiboot.raw
+pc-bios/optionrom/extboot.bin
+pc-bios/optionrom/vapic.bin
 .stgit-*
 cscope.*
 tags
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,6 @@
 [submodule "roms/vgabios"]
 	path = roms/vgabios
-	url = git://git.qemu.org/vgabios.git/
+	url = git://git.kernel.org/pub/scm/virt/kvm/vgabios.git/
 [submodule "roms/seabios"]
 	path = roms/seabios
 	url = git://git.qemu.org/seabios.git/
@@ -10,12 +10,3 @@
 [submodule "roms/ipxe"]
 	path = roms/ipxe
 	url = git://git.qemu.org/ipxe.git
-[submodule "roms/openbios"]
-	path = roms/openbios
-	url = git://git.qemu.org/openbios.git
-[submodule "roms/qemu-palcode"]
-	path = roms/qemu-palcode
-	url = git://repo.or.cz/qemu-palcode.git
-[submodule "roms/sgabios"]
-	path = roms/sgabios
-	url = git://git.qemu.org/sgabios.git
--- a/4
+++ b/4
@@ -68,10 +68,6 @@ keyword.  Example:
        printf("a was something else entirely.\n");
    }

-Note that 'else if' is considered a single statement; otherwise a long if/
-else if/else if/.../else sequence would need an indent for every else
-statement.
-
 An exception is the opening brace for a function; for reasons of tradition
 and clarity it comes on a line by itself:

--- a/8
+++ b/8
@@ -77,11 +77,11 @@ avoided.

 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
-use the replacement g_malloc/g_malloc0/g_realloc/g_free or
+use the replacement qemu_malloc/qemu_mallocz/qemu_realloc/qemu_free or
 qemu_vmalloc/qemu_memalign/qemu_vfree APIs.

-Please note that NULL check for the g_malloc result is redundant and
-that g_malloc() call with zero size is not allowed.
+Please note that NULL check for the qemu_malloc result is redundant and
+that qemu_malloc() call with zero size is not allowed.

 Memory allocated by qemu_vmalloc or qemu_memalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32 and user
@@ -108,7 +108,7 @@ int qemu_strnlen(const char *s, int max_len)
 There are also replacement character processing macros for isxyz and toxyz,
 so instead of e.g. isalnum you should use qemu_isalnum.

-Because of the memory management rules, you must use g_strdup/g_strndup
+Because of the memory management rules, you must use qemu_strdup/qemu_strndup
 instead of plain strdup/strndup.

 5. Printf-style functions
--- a/70
+++ b/70
@@ -62,7 +62,6 @@ F: target-alpha/

 ARM
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: target-arm/

@@ -116,12 +115,6 @@ M: qemu-devel@nongnu.org
 S: Odd Fixes
 F: target-i386/

-Xtensa
-M: Max Filippov <jcmvbkbc@gmail.com>
-W: http://wiki.osll.spb.ru/doku.php?id=etc:users:jcmvbkbc:qemu-target-xtensa
-S: Maintained
-F: target-xtensa/
-
 Guest CPU Cores (KVM):
 ----------------------

@@ -150,16 +143,6 @@ L: kvm@vger.kernel.org
 S: Supported
 F: target-i386/kvm.c

-Guest CPU Cores (Xen):
----------------------
-
-X86
-M: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-L: xen-devel@lists.xensource.com
-S: Supported
-F: xen-*
-F: */xen*
-
 ARM Machines
 ------------
 Gumstix
@@ -169,7 +152,6 @@ F: hw/gumstix.c

 Integrator CP
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/integratorcp.c

@@ -195,7 +177,6 @@ F: hw/palm.c

 Real View
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/realview*

@@ -206,13 +187,11 @@ F: hw/spitz.c

 Stellaris
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/stellaris.c

 Versatile PB
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/versatilepb.c

@@ -303,9 +282,9 @@ M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: hw/ppc_oldworld.c

-PReP
-M: Andreas Färber <andreas.faerber@web.de>
-S: Odd Fixes
+Prep
+M: qemu-devel@nongnu.org
+S: Orphan
 F: hw/ppc_prep.c

 SH4 Machines
@@ -346,18 +325,6 @@ M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
 F: hw/pc.[ch] hw/pc_piix.c

-Xtensa Machines
---------------
-sim
-M: Max Filippov <jcmvbkbc@gmail.com>
-S: Maintained
-F: hw/xtensa_sim.c
-
-Avnet LX60
-M: Max Filippov <jcmvbkbc@gmail.com>
-S: Maintained
-F: hw/xtensa_lx60.c
-
 Devices
 -------
 IDE
@@ -365,11 +332,6 @@ M: Kevin Wolf <kwolf@redhat.com>
 S: Odd Fixes
 F: hw/ide/

-OMAP
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: hw/omap*
-
 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
@@ -451,11 +413,6 @@ M: Anthony Liguori <aliguori@us.ibm.com>
 S: Maintained
 F: ui/

-Cocoa graphics
-M: Andreas Färber <andreas.faerber@web.de>
-S: Odd Fixes
-F: ui/cocoa.m
-
 Main loop
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
@@ -474,21 +431,9 @@ S: Maintained
 F: net/

 SLIRP
-M: Jan Kiszka <jan.kiszka@siemens.com>
-S: Maintained
+M: qemu-devel@nongnu.org
+S: Orphan
 F: slirp/
-T: git://git.kiszka.org/qemu.git queues/slirp
-
-Tracing
-M: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
-S: Maintained
-F: trace/
-T: git://repo.or.cz/qemu/stefanha.git tracing
-
-Checkpatch
-M: Blue Swirl <blauwirbel@gmail.com>
-S: Odd Fixes
-F: scripts/checkpatch.pl

 Usermode Emulation
 ------------------
@@ -559,8 +504,3 @@ SPARC target
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: tcg/sparc/
-
-TCI target
-M: Stefan Weil <sw@weilnetz.de>
-S: Maintained
-F: tcg/tci
--- a/154
+++ b/154
@@ -1,14 +1,9 @@
 # Makefile for QEMU.

-# Always point to the root of the build tree (needs GNU make).
-BUILD_DIR=$(CURDIR)
-
 GENERATED_HEADERS = config-host.h trace.h qemu-options.def
 ifeq ($(TRACE_BACKEND),dtrace)
 GENERATED_HEADERS += trace-dtrace.h
 endif
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c

 ifneq ($(wildcard config-host.mak),)
 # Put the all: rule here so that config-host.mak can contain dependencies.
@@ -42,7 +37,7 @@ else
 DOCS=
 endif

-SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
+SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory)
 SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
 SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %/config-devices.mak.d, $(TARGET_DIRS))

@@ -76,7 +71,7 @@ defconfig:

 -include config-all-devices.mak

-build-all: $(DOCS) $(TOOLS) $(CHECKS) recurse-all
+build-all: $(DOCS) $(TOOLS) recurse-all

 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
@@ -93,7 +88,7 @@ include $(SRC_PATH)/Makefile.objs
 endif

 $(common-obj-y): $(GENERATED_HEADERS)
-subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-timer-common.o
+subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-malloc.o qemu-timer-common.o

 $(filter %-softmmu,$(SUBDIR_RULES)): $(trace-obj-y) $(common-obj-y) subdir-libdis

@@ -121,7 +116,7 @@ ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)

 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)

-version.o: $(SRC_PATH)/version.rc config-host.h
+version.o: $(SRC_PATH)/version.rc config-host.mak
 	$(call quiet-command,$(WINDRES) -I. -o $@ $<,"  RC    $(TARGET_DIR)$@")

 version-obj-$(CONFIG_WIN32) += version.o
@@ -136,7 +131,7 @@ libcacard.la:
 install-libcacard:
 	@echo "libtool is missing, please install and rerun configure"; exit 1
 else
-libcacard.la: $(GENERATED_HEADERS) $(oslib-obj-y) qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
+libcacard.la: $(GENERATED_HEADERS) $(oslib-obj-y) qemu-malloc.o qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" libcacard.la,)

 install-libcacard: libcacard.la
@@ -147,73 +142,61 @@ endif
 qemu-img.o: qemu-img-cmds.h
 qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o qemu-ga.o: $(GENERATED_HEADERS)

-tools-obj-y = qemu-tool.o $(oslib-obj-y) $(trace-obj-y) \
-	qemu-timer-common.o cutils.o
+qemu-img$(EXESUF): qemu-img.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o

-qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y)
-qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y)
-qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y)
+qemu-nbd$(EXESUF): qemu-nbd.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o
+
+qemu-io$(EXESUF): qemu-io.o cmd.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

-check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o check-qjson.o test-coroutine.o: $(GENERATED_HEADERS)
+check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o check-qjson.o: $(GENERATED_HEADERS)

-check-qint: check-qint.o qint.o $(tools-obj-y)
-check-qstring: check-qstring.o qstring.o $(tools-obj-y)
-check-qdict: check-qdict.o qdict.o qfloat.o qint.o qstring.o qbool.o qlist.o $(tools-obj-y)
-check-qlist: check-qlist.o qlist.o qint.o $(tools-obj-y)
-check-qfloat: check-qfloat.o qfloat.o $(tools-obj-y)
-check-qjson: check-qjson.o $(qobject-obj-y) $(tools-obj-y)
-test-coroutine: test-coroutine.o qemu-timer-common.o async.o $(coroutine-obj-y) $(tools-obj-y)
+CHECK_PROG_DEPS = qemu-malloc.o $(oslib-obj-y) $(trace-obj-y) qemu-tool.o
+
+check-qint: check-qint.o qint.o $(CHECK_PROG_DEPS)
+check-qstring: check-qstring.o qstring.o $(CHECK_PROG_DEPS)
+check-qdict: check-qdict.o qdict.o qfloat.o qint.o qstring.o qbool.o qlist.o $(CHECK_PROG_DEPS)
+check-qlist: check-qlist.o qlist.o qint.o $(CHECK_PROG_DEPS)
+check-qfloat: check-qfloat.o qfloat.o $(CHECK_PROG_DEPS)
+check-qjson: check-qjson.o qfloat.o qint.o qdict.o qstring.o qlist.o qbool.o qjson.o json-streamer.o json-lexer.o json-parser.o error.o qerror.o qemu-error.o $(CHECK_PROG_DEPS)

 $(qapi-obj-y): $(GENERATED_HEADERS)
-qapi-dir := $(BUILD_DIR)/qapi-generated
+qapi-dir := qapi-generated
 test-visitor.o test-qmp-commands.o qemu-ga$(EXESUF): QEMU_CFLAGS += -I $(qapi-dir)
-qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)

-$(qapi-dir)/test-qapi-types.c $(qapi-dir)/test-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
+$(qapi-dir)/test-qapi-types.c: $(qapi-dir)/test-qapi-types.h
+$(qapi-dir)/test-qapi-types.h: $(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
-$(qapi-dir)/test-qapi-visit.c $(qapi-dir)/test-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
+$(qapi-dir)/test-qapi-visit.c: $(qapi-dir)/test-qapi-visit.h
+$(qapi-dir)/test-qapi-visit.h: $(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
-$(qapi-dir)/test-qmp-commands.h $(qapi-dir)/test-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
+$(qapi-dir)/test-qmp-commands.h: $(qapi-dir)/test-qmp-marshal.c
+$(qapi-dir)/test-qmp-marshal.c: $(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
 	    $(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")

-$(qapi-dir)/qga-qapi-types.c $(qapi-dir)/qga-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py
+$(qapi-dir)/qga-qapi-types.c: $(qapi-dir)/qga-qapi-types.h
+$(qapi-dir)/qga-qapi-types.h: $(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
-$(qapi-dir)/qga-qapi-visit.c $(qapi-dir)/qga-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py
+$(qapi-dir)/qga-qapi-visit.c: $(qapi-dir)/qga-qapi-visit.h
+$(qapi-dir)/qga-qapi-visit.h: $(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
-$(qapi-dir)/qga-qmp-commands.h $(qapi-dir)/qga-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py
+$(qapi-dir)/qga-qmp-marshal.c: $(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")

-qapi-types.c qapi-types.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "." < $<, "  GEN   $@")
-qapi-visit.c qapi-visit.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "."  < $<, "  GEN   $@")
-qmp-commands.h qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -m -o "." < $<, "  GEN   $@")
-
 test-visitor.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h) $(qapi-obj-y)
-test-visitor: test-visitor.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o
+test-visitor: test-visitor.o qfloat.o qint.o qdict.o qstring.o qlist.o qbool.o $(qapi-obj-y) error.o osdep.o qemu-malloc.o $(oslib-obj-y) qjson.o json-streamer.o json-lexer.o json-parser.o qerror.o qemu-error.o qemu-tool.o $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o

 test-qmp-commands.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h test-qmp-marshal.c test-qmp-commands.h) $(qapi-obj-y)
-test-qmp-commands: test-qmp-commands.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o $(qapi-dir)/test-qmp-marshal.o module.o
+test-qmp-commands: test-qmp-commands.o qfloat.o qint.o qdict.o qstring.o qlist.o qbool.o $(qapi-obj-y) error.o osdep.o qemu-malloc.o $(oslib-obj-y) qjson.o json-streamer.o json-lexer.o json-parser.o qerror.o qemu-error.o qemu-tool.o $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o $(qapi-dir)/test-qmp-marshal.o module.o

-QGALIB_OBJ=$(addprefix $(qapi-dir)/, qga-qapi-types.o qga-qapi-visit.o qga-qmp-marshal.o)
-QGALIB_GEN=$(addprefix $(qapi-dir)/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
-$(QGALIB_OBJ): $(QGALIB_GEN) $(GENERATED_HEADERS)
-$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN) $(GENERATED_HEADERS)
+QGALIB=qga/guest-agent-command-state.o qga/guest-agent-commands.o
+QGALIB_GEN=$(addprefix $(qapi-dir)/, qga-qapi-types.c qga-qapi-types.h qga-qapi-visit.c qga-qmp-marshal.c)

-qemu-ga$(EXESUF): qemu-ga.o $(qga-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qobject-obj-y) $(version-obj-y) $(QGALIB_OBJ)
+$(QGALIB_GEN): $(GENERATED_HEADERS)
+$(QGALIB) qemu-ga.o: $(QGALIB_GEN) $(qapi-obj-y)
+qemu-ga$(EXESUF): qemu-ga.o $(QGALIB) qemu-tool.o qemu-error.o error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) $(qapi-obj-y) qemu-timer-common.o qemu-sockets.o module.o qapi/qmp-dispatch.o qapi/qmp-registry.o $(qapi-dir)/qga-qapi-visit.o $(qapi-dir)/qga-qapi-types.o $(qapi-dir)/qga-qmp-marshal.o

 QEMULIBS=libhw32 libhw64 libuser libdis libdis-user

@@ -221,15 +204,13 @@ clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
-	rm -f *.o *.d *.a *.lo $(TOOLS) $(CHECKS) qemu-ga TAGS cscope.* *.pod *~ */*~
+	rm -f *.o *.d *.a *.lo $(TOOLS) qemu-ga TAGS cscope.* *.pod *~ */*~
 	rm -Rf .libs
 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d qapi/*.o qapi/*.d qga/*.o qga/*.d
 	rm -f qemu-img-cmds.h
-	rm -f trace/*.o trace/*.d
 	rm -f trace.c trace.h trace.c-timestamp trace.h-timestamp
 	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
 	rm -f trace-dtrace.h trace-dtrace.h-timestamp
-	rm -f $(GENERATED_SOURCES)
 	rm -rf $(qapi-dir)
 	$(MAKE) -C tests clean
 	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
@@ -245,7 +226,6 @@ distclean: clean
 	rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys
 	rm -f qemu-doc.log qemu-doc.pdf qemu-doc.pg qemu-doc.toc qemu-doc.tp
 	rm -f qemu-doc.vr
-	rm -f config.log
 	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
 	for d in $(TARGET_DIRS) $(QEMULIBS); do \
 	rm -rf $$d || exit 1 ; \
@@ -256,7 +236,7 @@ ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
 common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr

 ifdef INSTALL_BLOBS
-BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
+BLOBS=bios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
@@ -265,8 +245,9 @@ bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 mpc8544ds.dtb \
 multiboot.bin linuxboot.bin \
 s390-zipl.rom \
-spapr-rtas.bin slof.bin \
-palcode-clipper
+spapr-rtas.bin slof.bin
+BLOBS += extboot.bin
+BLOBS += vapic.bin
 else
 BLOBS=
 endif
@@ -293,7 +274,12 @@ endif
 ifneq ($(BLOBS),)
 	$(INSTALL_DIR) "$(DESTDIR)$(datadir)"
 	set -e; for x in $(BLOBS); do \
+	    if [ -f $(SRC_PATH)/pc-bios/$$x ];then \
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(datadir)"; \
+	    fi \
+	    ; if [ -f pc-bios/optionrom/$$x ];then \
+		$(INSTALL_DATA) pc-bios/optionrom/$$x "$(DESTDIR)$(datadir)"; \
+	    fi \
 	done
 endif
 	$(INSTALL_DIR) "$(DESTDIR)$(datadir)/keymaps"
@@ -308,19 +294,13 @@ endif
 test speed: all
 	$(MAKE) -C tests $@

-.PHONY: check
-check: $(patsubst %,run-check-%,$(CHECKS))
-
-run-check-%: %
-	./$<
-
 .PHONY: TAGS
 TAGS:
 	find "$(SRC_PATH)" -name '*.[hc]' -print0 | xargs -0 etags

 cscope:
 	rm -f ./cscope.*
-	find "$(SRC_PATH)" -name "*.[chsS]" -print | sed 's,^\./,,' > ./cscope.files
+	find . -name "*.[ch]" -print | sed 's,^\./,,' > ./cscope.files
 	cscope -b

 # documentation
@@ -389,5 +369,43 @@ tar:
 	cd /tmp && tar zcvf ~/$(FILE).tar.gz $(FILE) --exclude CVS --exclude .git --exclude .svn
 	rm -rf /tmp/$(FILE)

+SYSTEM_TARGETS=$(filter %-softmmu,$(TARGET_DIRS))
+SYSTEM_PROGS=$(patsubst qemu-system-i386,qemu, \
+             $(patsubst %-softmmu,qemu-system-%, \
+             $(SYSTEM_TARGETS)))
+
+USER_TARGETS=$(filter %-user,$(TARGET_DIRS))
+USER_PROGS=$(patsubst %-bsd-user,qemu-%, \
+           $(patsubst %-darwin-user,qemu-%, \
+           $(patsubst %-linux-user,qemu-%, \
+           $(USER_TARGETS))))
+
+# generate a binary distribution
+tarbin:
+	cd / && tar zcvf ~/qemu-$(VERSION)-$(ARCH).tar.gz \
+	$(patsubst %,$(bindir)/%, $(SYSTEM_PROGS)) \
+	$(patsubst %,$(bindir)/%, $(USER_PROGS)) \
+	$(bindir)/qemu-img \
+	$(bindir)/qemu-nbd \
+	$(datadir)/bios.bin \
+	$(datadir)/vgabios.bin \
+	$(datadir)/vgabios-cirrus.bin \
+	$(datadir)/ppc_rom.bin \
+	$(datadir)/openbios-sparc32 \
+	$(datadir)/openbios-sparc64 \
+	$(datadir)/openbios-ppc \
+	$(datadir)/pxe-e1000.rom \
+	$(datadir)/pxe-eepro100.rom \
+	$(datadir)/pxe-ne2k_pci.rom \
+	$(datadir)/pxe-pcnet.rom \
+	$(datadir)/pxe-rtl8139.rom \
+	$(datadir)/pxe-virtio.rom \
+	$(datadir)/extboot.bin \
+	$(docdir)/qemu-doc.html \
+	$(docdir)/qemu-tech.html \
+	$(mandir)/man1/qemu.1 \
+	$(mandir)/man1/qemu-img.1 \
+	$(mandir)/man8/qemu-nbd.8
+
 # Include automatically generated dependency files
 -include $(wildcard *.d audio/*.d slirp/*.d block/*.d net/*.d ui/*.d qapi/*.d qga/*.d)
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -9,8 +9,7 @@ include $(SRC_PATH)/rules.mak

 $(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)

-QEMU_CFLAGS+=-I..
-QEMU_CFLAGS += $(GLIB_CFLAGS)
+QEMU_CFLAGS+=-I.. -I$(SRC_PATH)/fpu

 include $(SRC_PATH)/Makefile.objs

--- a/Makefile.objs
+++ b/Makefile.objs
@@ -2,7 +2,7 @@
 # QObject
 qobject-obj-y = qint.o qstring.o qdict.o qlist.o qfloat.o qbool.o
 qobject-obj-y += qjson.o json-lexer.o json-streamer.o json-parser.o
-qobject-obj-y += qerror.o error.o qemu-error.o
+qobject-obj-y += qerror.o error.o

 #######################################################################
 # oslib-obj-y is code depending on the OS (win32 vs posix)
@@ -10,24 +10,14 @@ oslib-obj-y = osdep.o
 oslib-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o
 oslib-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o

-#######################################################################
-# coroutines
-coroutine-obj-y = qemu-coroutine.o qemu-coroutine-lock.o
-ifeq ($(CONFIG_UCONTEXT_COROUTINE),y)
-coroutine-obj-$(CONFIG_POSIX) += coroutine-ucontext.o
-else
-coroutine-obj-$(CONFIG_POSIX) += coroutine-gthread.o
-endif
-coroutine-obj-$(CONFIG_WIN32) += coroutine-win32.o
-
 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = cutils.o cache-utils.o qemu-option.o module.o async.o
+block-obj-y = cutils.o cache-utils.o qemu-malloc.o qemu-option.o module.o async.o
 block-obj-y += nbd.o block.o aio.o aes.o qemu-config.o qemu-progress.o qemu-sockets.o
-block-obj-y += $(coroutine-obj-y) $(qobject-obj-y) $(version-obj-y)
 block-obj-$(CONFIG_POSIX) += posix-aio-compat.o
 block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
+block-obj-$(CONFIG_POSIX) += compatfd.o

 block-nested-y += raw.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o vvfat.o
 block-nested-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
@@ -36,7 +26,6 @@ block-nested-y += qed-check.o
 block-nested-y += parallels.o nbd.o blkdebug.o sheepdog.o blkverify.o
 block-nested-$(CONFIG_WIN32) += raw-win32.o
 block-nested-$(CONFIG_POSIX) += raw-posix.o
-block-nested-$(CONFIG_LIBISCSI) += iscsi.o
 block-nested-$(CONFIG_CURL) += curl.o
 block-nested-$(CONFIG_RBD) += rbd.o

@@ -77,13 +66,13 @@ common-obj-y = $(block-obj-y) blockdev.o
 common-obj-y += $(net-obj-y)
 common-obj-y += $(qobject-obj-y)
 common-obj-$(CONFIG_LINUX) += $(fsdev-obj-$(CONFIG_LINUX))
-common-obj-y += readline.o console.o cursor.o
+common-obj-y += readline.o console.o cursor.o qemu-error.o
 common-obj-y += $(oslib-obj-y)
 common-obj-$(CONFIG_WIN32) += os-win32.o
 common-obj-$(CONFIG_POSIX) += os-posix.o

-common-obj-y += tcg-runtime.o host-utils.o main-loop.o
-common-obj-y += irq.o input.o
+common-obj-y += tcg-runtime.o host-utils.o
+common-obj-y += irq.o ioport.o input.o
 common-obj-$(CONFIG_PTIMER) += ptimer.o
 common-obj-$(CONFIG_MAX7310) += max7310.o
 common-obj-$(CONFIG_WM8750) += wm8750.o
@@ -101,7 +90,6 @@ common-obj-y += i2c.o smbus.o smbus_eeprom.o
 common-obj-y += eeprom93xx.o
 common-obj-y += scsi-disk.o cdrom.o
 common-obj-y += scsi-generic.o scsi-bus.o
-common-obj-y += hid.o
 common-obj-y += usb.o usb-hub.o usb-$(HOST_USB).o usb-hid.o usb-msd.o usb-wacom.o
 common-obj-y += usb-serial.o usb-net.o usb-bus.o usb-desc.o
 common-obj-$(CONFIG_SSI) += ssi.o
@@ -158,13 +146,13 @@ common-obj-y += $(addprefix ui/, $(ui-obj-y))
 common-obj-$(CONFIG_VNC) += $(addprefix ui/, $(vnc-obj-y))

 common-obj-y += iov.o acl.o
-common-obj-$(CONFIG_POSIX) += compatfd.o
+#common-obj-$(CONFIG_POSIX) += compatfd.o
 common-obj-y += notify.o event_notifier.o
 common-obj-y += qemu-timer.o qemu-timer-common.o

 slirp-obj-y = cksum.o if.o ip_icmp.o ip_input.o ip_output.o
 slirp-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
-slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o arp_table.o
+slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o
 common-obj-$(CONFIG_SLIRP) += $(addprefix slirp/, $(slirp-obj-y))

 # xen backend driver support
@@ -178,18 +166,16 @@ user-obj-y =
 user-obj-y += envlist.o path.o
 user-obj-y += tcg-runtime.o host-utils.o
 user-obj-y += cutils.o cache-utils.o
-user-obj-y += $(trace-obj-y)

 ######################################################################
 # libhw

 hw-obj-y =
-hw-obj-y += vl.o loader.o
+hw-obj-y += loader.o
 hw-obj-$(CONFIG_VIRTIO) += virtio-console.o
-hw-obj-y += usb-libhw.o
 hw-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
 hw-obj-y += fw_cfg.o
-hw-obj-$(CONFIG_PCI) += pci.o pci_bridge.o
+hw-obj-$(CONFIG_PCI) += pci_bridge.o
 hw-obj-$(CONFIG_PCI) += msix.o msi.o
 hw-obj-$(CONFIG_PCI) += pci_host.o pcie_host.o
 hw-obj-$(CONFIG_PCI) += ioh3420.o xio3130_upstream.o xio3130_downstream.o
@@ -206,14 +192,16 @@ hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o

 hw-obj-$(CONFIG_SERIAL) += serial.o
 hw-obj-$(CONFIG_PARALLEL) += parallel.o
-hw-obj-$(CONFIG_I8254) += i8254.o
-hw-obj-$(CONFIG_PCSPK) += pcspk.o
+# Moved back to Makefile.target due to #include qemu-kvm.h:
+#hw-obj-$(CONFIG_I8254) += i8254.o
+#hw-obj-$(CONFIG_PCSPK) += pcspk.o
 hw-obj-$(CONFIG_PCKBD) += pckbd.o
 hw-obj-$(CONFIG_USB_UHCI) += usb-uhci.o
 hw-obj-$(CONFIG_USB_OHCI) += usb-ohci.o
 hw-obj-$(CONFIG_USB_EHCI) += usb-ehci.o
 hw-obj-$(CONFIG_FDC) += fdc.o
-hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
+# needs fixes for cpu hotplug, so moved to Makefile.target:
+# hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
 hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
 hw-obj-$(CONFIG_DMA) += dma.o
 hw-obj-$(CONFIG_HPET) += hpet.o
@@ -221,9 +209,9 @@ hw-obj-$(CONFIG_APPLESMC) += applesmc.o
 hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
 hw-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
 hw-obj-$(CONFIG_USB_REDIR) += usb-redir.o
-hw-obj-$(CONFIG_I8259) += i8259.o

 # PPC devices
+hw-obj-$(CONFIG_OPENPIC) += openpic.o
 hw-obj-$(CONFIG_PREP_PCI) += prep_pci.o
 # Mac shared devices
 hw-obj-$(CONFIG_MACIO) += macio.o
@@ -242,7 +230,6 @@ hw-obj-$(CONFIG_PPCE500_PCI) += ppce500_pci.o

 # MIPS devices
 hw-obj-$(CONFIG_PIIX4) += piix4.o
-hw-obj-$(CONFIG_G364FB) += g364fb.o

 # PCI watchdog devices
 hw-obj-$(CONFIG_PCI) += wdt_i6300esb.o
@@ -260,7 +247,6 @@ hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
 hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
 hw-obj-$(CONFIG_LAN9118) += lan9118.o
 hw-obj-$(CONFIG_NE2000_ISA) += ne2000-isa.o
-hw-obj-$(CONFIG_OPENCORES_ETH) += opencores_eth.o

 # IDE
 hw-obj-$(CONFIG_IDE_CORE) += ide/core.o ide/atapi.o
@@ -306,15 +292,11 @@ sound-obj-$(CONFIG_HDA) += intel-hda.o hda-audio.o
 adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
 hw-obj-$(CONFIG_SOUND) += $(sound-obj-y)

-9pfs-nested-$(CONFIG_VIRTFS)  = virtio-9p.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-coth.o cofs.o codir.o cofile.o
-9pfs-nested-$(CONFIG_VIRTFS) += coxattr.o virtio-9p-synth.o
-9pfs-nested-$(CONFIG_OPEN_BY_HANDLE) +=  virtio-9p-handle.o
+9pfs-nested-$(CONFIG_VIRTFS) = virtio-9p.o virtio-9p-debug.o
+9pfs-nested-$(CONFIG_VIRTFS) +=  virtio-9p-local.o virtio-9p-xattr.o
+9pfs-nested-$(CONFIG_VIRTFS) +=   virtio-9p-xattr-user.o virtio-9p-posix-acl.o

 hw-obj-$(CONFIG_REALLY_VIRTFS) += $(addprefix 9pfs/, $(9pfs-nested-y))
-$(addprefix 9pfs/, $(9pfs-nested-y)): QEMU_CFLAGS+=$(GLIB_CFLAGS)


 ######################################################################
@@ -344,12 +326,12 @@ trace.h: trace.h-timestamp trace-dtrace.h
 else
 trace.h: trace.h-timestamp
 endif
-trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+trace.h-timestamp: $(SRC_PATH)/trace-events config-host.mak
 	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -h < $< > $@,"  GEN   trace.h")
 	@cmp -s $@ trace.h || cp $@ trace.h

 trace.c: trace.c-timestamp
-trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+trace.c-timestamp: $(SRC_PATH)/trace-events config-host.mak
 	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -c < $< > $@,"  GEN   trace.c")
 	@cmp -s $@ trace.c || cp $@ trace.c

@@ -362,7 +344,7 @@ trace-dtrace.h: trace-dtrace.dtrace
 # but that gets picked up by QEMU's Makefile as an external dependency
 # rule file. So we use '.dtrace' instead
 trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
-trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events config-host.mak
 	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -d < $< > $@,"  GEN   trace-dtrace.dtrace")
 	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace

@@ -374,28 +356,20 @@ trace-dtrace.lo: trace-dtrace.dtrace
 	@echo "missing libtool. please install and rerun configure."; exit 1
 else
 trace-dtrace.lo: trace-dtrace.dtrace
-	$(call quiet-command,$(LIBTOOL) --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
+	$(call quiet-command,libtool --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
 endif

-trace/simple.o: trace/simple.c $(GENERATED_HEADERS)
+simpletrace.o: simpletrace.c $(GENERATED_HEADERS)

-trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace.o
-ifneq ($(TRACE_BACKEND),dtrace)
+ifeq ($(TRACE_BACKEND),dtrace)
+trace-obj-y = trace-dtrace.o
+else
 trace-obj-y = trace.o
+ifeq ($(TRACE_BACKEND),simple)
+trace-obj-y += simpletrace.o
+user-obj-y += qemu-timer-common.o
+endif
 endif
-
-trace-nested-$(CONFIG_TRACE_DEFAULT) += default.o
-
-trace-nested-$(CONFIG_TRACE_SIMPLE) += simple.o
-trace-obj-$(CONFIG_TRACE_SIMPLE) += qemu-timer-common.o
-
-trace-nested-$(CONFIG_TRACE_STDERR) += stderr.o
-
-trace-nested-y += control.o
-
-trace-obj-y += $(addprefix trace/, $(trace-nested-y))
-
-$(trace-obj-y): $(GENERATED_HEADERS)

 ######################################################################
 # smartcard
@@ -409,21 +383,8 @@ qapi-nested-y = qapi-visit-core.o qmp-input-visitor.o qmp-output-visitor.o qapi-
 qapi-nested-y += qmp-registry.o qmp-dispatch.o
 qapi-obj-y = $(addprefix qapi/, $(qapi-nested-y))

-common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o $(qapi-obj-y)
-common-obj-y += qmp.o hmp.o
-
-######################################################################
-# guest agent
-
-qga-nested-y = guest-agent-commands.o guest-agent-command-state.o
-qga-obj-y = $(addprefix qga/, $(qga-nested-y))
-qga-obj-y += qemu-ga.o qemu-sockets.o module.o qemu-option.o
-qga-obj-$(CONFIG_WIN32) += oslib-win32.o
-qga-obj-$(CONFIG_POSIX) += oslib-posix.o
-
 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

 vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)

-QEMU_CFLAGS+=$(GLIB_CFLAGS)
-
+vl.o: QEMU_CFLAGS+=$(GLIB_CFLAGS)
--- a/Makefile.target
+++ b/Makefile.target
@@ -27,8 +27,12 @@ ifdef CONFIG_USER_ONLY
 QEMU_PROG=qemu-$(TARGET_ARCH2)
 else
 # system emulator name
+ifeq ($(TARGET_ARCH), i386)
+QEMU_PROG=qemu$(EXESUF)
+else
 QEMU_PROG=qemu-system-$(TARGET_ARCH2)$(EXESUF)
 endif
+endif

 PROGS=$(QEMU_PROG)
 STPFILES=
@@ -40,7 +44,7 @@ endif
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

-ifdef CONFIG_TRACE_SYSTEMTAP
+ifdef CONFIG_SYSTEMTAP_TRACE
 stap: $(QEMU_PROG).stp

 ifdef CONFIG_USER_ONLY
@@ -67,28 +71,22 @@ all: $(PROGS) stap

 #########################################################
 # cpu emulator library
-libobj-y = exec.o translate-all.o cpu-exec.o translate.o
-libobj-y += tcg/tcg.o tcg/optimize.o
-libobj-$(CONFIG_TCG_INTERPRETER) += tci.o
+libobj-y = exec.o cpu-exec.o
+libobj-$(CONFIG_NO_CPU_EMULATION) += fake-exec.o
+libobj-$(CONFIG_CPU_EMULATION) += translate-all.o translate.o
+libobj-$(CONFIG_CPU_EMULATION) += tcg/tcg.o
 libobj-y += fpu/softfloat.o
 libobj-y += op_helper.o helper.o
 ifeq ($(TARGET_BASE_ARCH), i386)
 libobj-y += cpuid.o
 endif
-libobj-$(TARGET_SPARC64) += vis_helper.o
 libobj-$(CONFIG_NEED_MMU) += mmu.o
+
+libobj-$(CONFIG_KVM) += kvm-tpr-opt.o
+
 libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
-ifeq ($(TARGET_BASE_ARCH), sparc)
-libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
-libobj-y += cpu_init.o
-endif
-libobj-$(TARGET_SPARC) += int32_helper.o
-libobj-$(TARGET_SPARC64) += int64_helper.o

 libobj-y += disas.o
-libobj-$(CONFIG_TCI_DIS) += tci-dis.o
-
-tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci

 $(libobj-y): $(GENERATED_HEADERS)

@@ -102,7 +100,7 @@ tcg/tcg.o: cpu.h

 # HELPER_CFLAGS is used for all the code compiled with static register
 # variables
-op_helper.o ldst_helper.o user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+op_helper.o user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)

 # Note: this is a workaround. The real fix is to avoid compiling
 # cpu_signal_handler() in user-exec.c.
@@ -118,7 +116,7 @@ $(call set-vpath, $(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR
 QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
 obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
      elfload.o linuxload.o uaccess.o gdbstub.o cpu-uname.o \
-      user-exec.o $(oslib-obj-y)
+      qemu-malloc.o user-exec.o $(oslib-obj-y)

 obj-$(TARGET_HAS_BFLT) += flatload.o

@@ -194,17 +192,18 @@ endif #CONFIG_BSD_USER
 # System emulator target
 ifdef CONFIG_SOFTMMU

-obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o ioport.o
+obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o vl.o balloon.o
 # virtio has to be here due to weird dependency between PCI and virtio-net.
 # need to fix this properly
 obj-$(CONFIG_NO_PCI) += pci-stub.o
+obj-$(CONFIG_PCI) += pci.o
 obj-$(CONFIG_VIRTIO) += virtio.o virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial-bus.o
 obj-y += vhost_net.o
 obj-$(CONFIG_VHOST_NET) += vhost.o
 obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p-device.o
+obj-y += rwhandler.o
 obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
-obj-y += memory.o
 LIBS+=-lz

 QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
@@ -230,40 +229,53 @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o

 # Hardware support
 obj-i386-y += vga.o
-obj-i386-y += mc146818rtc.o pc.o
+obj-i386-y += mc146818rtc.o i8259.o pc.o
 obj-i386-y += cirrus_vga.o sga.o apic.o ioapic.o piix_pci.o
 obj-i386-y += vmport.o
 obj-i386-y += device-hotplug.o pci-hotplug.o smbios.o wdt_ib700.o
+obj-i386-y += extboot.o
 obj-i386-y += debugcon.o multiboot.o
 obj-i386-y += pc_piix.o
 obj-i386-$(CONFIG_KVM) += kvmclock.o
 obj-i386-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o
+obj-i386-y += testdev.o
+obj-i386-y += acpi.o acpi_piix4.o
+
+obj-i386-y += pcspk.o i8254.o
+obj-i386-$(CONFIG_KVM_PIT) += i8254-kvm.o
+obj-i386-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o
+
+# Hardware support
+obj-ia64-y += ide.o pckbd.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
+obj-ia64-y += fdc.o mc146818rtc.o serial.o i8259.o ipf.o
+obj-ia64-y += cirrus_vga.o parallel.o acpi.o piix_pci.o
+obj-ia64-y += usb-uhci.o
+obj-ia64-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o

 # shared objects
-obj-ppc-y = ppc.o ppc_booke.o
+obj-ppc-y = ppc.o
 obj-ppc-y += vga.o
 # PREP target
-obj-ppc-y += mc146818rtc.o
+obj-ppc-y += i8259.o mc146818rtc.o
 obj-ppc-y += ppc_prep.o
 # OldWorld PowerMac
 obj-ppc-y += ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += ppc_newworld.o
 # IBM pSeries (sPAPR)
-obj-ppc-$(CONFIG_PSERIES) += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
-obj-ppc-$(CONFIG_PSERIES) += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
-obj-ppc-$(CONFIG_PSERIES) += spapr_pci.o device-hotplug.o pci-hotplug.o
+ifeq ($(CONFIG_FDT)$(TARGET_PPC64),yy)
+obj-ppc-y += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
+obj-ppc-y += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
+endif
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
 # PowerPC E500 boards
-obj-ppc-y += ppce500_mpc8544ds.o mpc8544_guts.o ppce500_spin.o
+obj-ppc-y += ppce500_mpc8544ds.o mpc8544_guts.o
 # PowerPC 440 Xilinx ML507 reference board.
 obj-ppc-y += virtex_ml507.o
 obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
 obj-ppc-$(CONFIG_FDT) += device_tree.o
-# PowerPC OpenPIC
-obj-ppc-y += openpic.o

 # Xilinx PPC peripherals
 obj-ppc-y += xilinx_intc.o
@@ -294,9 +306,11 @@ obj-lm32-y += milkymist-vgafb.o
 obj-lm32-y += framebuffer.o

 obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
+obj-mips-y += pcspk.o i8254.o
+obj-mips-y += acpi.o acpi_piix4.o
 obj-mips-y += mips_addr.o mips_timer.o mips_int.o
-obj-mips-y += vga.o
-obj-mips-y += jazz_led.o
+obj-mips-y += vga.o i8259.o
+obj-mips-y += g364fb.o jazz_led.o
 obj-mips-y += gt64xxx.o mc146818rtc.o
 obj-mips-y += cirrus_vga.o
 obj-mips-$(CONFIG_FULONG) += bonito.o vt82c686.o mips_fulong2e.o
@@ -317,6 +331,7 @@ obj-microblaze-$(CONFIG_FDT) += device_tree.o
 # Boards
 obj-cris-y = cris_pic_cpu.o
 obj-cris-y += cris-boot.o
+obj-cris-y += etraxfs.o axis_dev88.o
 obj-cris-y += axis_dev88.o

 # IO blocks
@@ -358,7 +373,6 @@ obj-arm-y += omap2.o omap_dss.o soc_dma.o omap_gptimer.o omap_synctimer.o \
 obj-arm-y += omap_sx1.o palm.o tsc210x.o
 obj-arm-y += nseries.o blizzard.o onenand.o vga.o cbus.o tusb6010.o usb-musb.o
 obj-arm-y += mst_fpga.o mainstone.o
-obj-arm-y += z2.o
 obj-arm-y += musicpal.o bitbang_i2c.o marvell_88w8618_audio.o
 obj-arm-y += framebuffer.o
 obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
@@ -367,7 +381,6 @@ obj-arm-y += syborg_virtio.o
 obj-arm-y += vexpress.o
 obj-arm-y += strongarm.o
 obj-arm-y += collie.o
-obj-arm-y += pl041.o lm4549.o

 obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
 obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o
@@ -378,20 +391,17 @@ obj-m68k-y += m68k-semi.o dummy_m68k.o

 obj-s390x-y = s390-virtio-bus.o s390-virtio.o

-obj-alpha-y = mc146818rtc.o
+obj-alpha-y = i8259.o mc146818rtc.o
 obj-alpha-y += vga.o cirrus_vga.o
-obj-alpha-y += alpha_pci.o alpha_dp264.o alpha_typhoon.o

-obj-xtensa-y += xtensa_pic.o
-obj-xtensa-y += xtensa_sim.o
-obj-xtensa-y += xtensa_lx60.o
-obj-xtensa-y += xtensa-semi.o
-obj-xtensa-y += core-dc232b.o
-obj-xtensa-y += core-fsf.o
+ifeq ($(TARGET_ARCH), ia64)
+firmware.o: firmware.c
+	$(CC) $(HELPER_CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
+endif

 main.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

-monitor.o: hmp-commands.h qmp-commands-old.h
+monitor.o: hmp-commands.h qmp-commands.h

 $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)

@@ -399,22 +409,20 @@ obj-y += $(addprefix ../, $(common-obj-y))
 obj-y += $(addprefix ../libdis/, $(libdis-y))
 obj-y += $(libobj-y)
 obj-y += $(addprefix $(HWDIR)/, $(hw-obj-y))
-obj-y += $(addprefix ../, $(trace-obj-y))

 endif # CONFIG_SOFTMMU

 ifndef CONFIG_LINUX_USER
-ifndef CONFIG_BSD_USER
 # libcacard needs qemu-thread support, and besides is only needed by devices
-# so not requires with linux-user / bsd-user targets
+# so not requires with linux-user targets
 obj-$(CONFIG_SMARTCARD_NSS) += $(addprefix ../libcacard/, $(libcacard-y))
-endif # CONFIG_BSD_USER
 endif # CONFIG_LINUX_USER

+obj-y += $(addprefix ../, $(trace-obj-y))
 obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o

 $(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y)
-	$(call LINK,$^)
+	$(call LINK,$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y))


 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
@@ -423,14 +431,14 @@ gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 hmp-commands.h: $(SRC_PATH)/hmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

-qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx
+qmp-commands.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

 clean:
 	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
 	rm -f *.d */*.d tcg/*.o ide/*.o 9pfs/*.o
-	rm -f hmp-commands.h qmp-commands-old.h gdbstub-xml.c
-ifdef CONFIG_TRACE_SYSTEMTAP
+	rm -f hmp-commands.h qmp-commands.h gdbstub-xml.c
+ifdef CONFIG_SYSTEMTAP_TRACE
 	rm -f *.stp
 endif

@@ -441,7 +449,7 @@ ifneq ($(STRIP),)
 	$(STRIP) $(patsubst %,"$(DESTDIR)$(bindir)/%",$(PROGS))
 endif
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
+ifdef CONFIG_SYSTEMTAP_TRACE
 	$(INSTALL_DIR) "$(DESTDIR)$(datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp "$(DESTDIR)$(datadir)/../systemtap/tapset"
 endif
--- a/Makefile.user
+++ b/Makefile.user
@@ -17,9 +17,7 @@ all: $(user-obj-y)
 	@true

 clean:
-	for d in . trace; do \
-	rm -f $$d/*.o $$d/*.d $$d/*.a $$d/*~; \
-	done
+	rm -f *.o *.d *.a *~

 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/2
+++ b/2
@@ -1 +1 @@
-1.0,1
+0.15.1
--- a/a.out.h
+++ b/a.out.h
@@ -151,7 +151,7 @@ struct external_lineno {
 #define E_FILNMLEN	14	/* # characters in a file name		*/
 #define E_DIMNUM	4	/* # array dimensions in auxiliary entry */

-struct QEMU_PACKED external_syment
+struct __attribute__((packed)) external_syment
 {
  union {
    char e_name[E_SYMNMLEN];
--- a/acl.c
+++ b/acl.c
@@ -55,8 +55,8 @@ qemu_acl *qemu_acl_init(const char *aclname)
    if (acl)
        return acl;

-    acl = g_malloc(sizeof(*acl));
-    acl->aclname = g_strdup(aclname);
+    acl = qemu_malloc(sizeof(*acl));
+    acl->aclname = qemu_strdup(aclname);
    /* Deny by default, so there is no window of "open
     * access" between QEMU starting, and the user setting
     * up ACLs in the monitor */
@@ -65,7 +65,7 @@ qemu_acl *qemu_acl_init(const char *aclname)
    acl->nentries = 0;
    QTAILQ_INIT(&acl->entries);

-    acls = g_realloc(acls, sizeof(*acls) * (nacls +1));
+    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
    acls[nacls] = acl;
    nacls++;

@@ -95,13 +95,13 @@ int qemu_acl_party_is_allowed(qemu_acl *acl,

 void qemu_acl_reset(qemu_acl *acl)
 {
-    qemu_acl_entry *entry, *next_entry;
+    qemu_acl_entry *entry;

    /* Put back to deny by default, so there is no window
     * of "open access" while the user re-initializes the
     * access control list */
    acl->defaultDeny = 1;
-    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
+    QTAILQ_FOREACH(entry, &acl->entries, next) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
        free(entry->match);
        free(entry);
@@ -116,8 +116,8 @@ int qemu_acl_append(qemu_acl *acl,
 {
    qemu_acl_entry *entry;

-    entry = g_malloc(sizeof(*entry));
-    entry->match = g_strdup(match);
+    entry = qemu_malloc(sizeof(*entry));
+    entry->match = qemu_strdup(match);
    entry->deny = deny;

    QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
@@ -142,8 +142,8 @@ int qemu_acl_insert(qemu_acl *acl,
        return qemu_acl_append(acl, deny, match);


-    entry = g_malloc(sizeof(*entry));
-    entry->match = g_strdup(match);
+    entry = qemu_malloc(sizeof(*entry));
+    entry->match = qemu_strdup(match);
    entry->deny = deny;

    QTAILQ_FOREACH(tmp, &acl->entries, next) {
--- a/aio.c
+++ b/aio.c
@@ -75,13 +75,13 @@ int qemu_aio_set_fd_handler(int fd,
                 * releasing the walking_handlers lock.
                 */
                QLIST_REMOVE(node, node);
-                g_free(node);
+                qemu_free(node);
            }
        }
    } else {
        if (node == NULL) {
            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
+            node = qemu_mallocz(sizeof(AioHandler));
            node->fd = fd;
            QLIST_INSERT_HEAD(&aio_handlers, node, node);
        }
@@ -220,7 +220,7 @@ void qemu_aio_wait(void)

                if (tmp->deleted) {
                    QLIST_REMOVE(tmp, node);
-                    g_free(tmp);
+                    qemu_free(tmp);
                }
            }

--- a/arch_init.c
+++ b/arch_init.c
@@ -78,8 +78,6 @@ const char arch_config_name[] = CONFIG_QEMU_CONFDIR "/target-" TARGET_ARCH ".con
 #define QEMU_ARCH QEMU_ARCH_SH4
 #elif defined(TARGET_SPARC)
 #define QEMU_ARCH QEMU_ARCH_SPARC
-#elif defined(TARGET_XTENSA)
-#define QEMU_ARCH QEMU_ARCH_XTENSA
 #endif

 const uint32_t arch_type = QEMU_ARCH;
@@ -237,7 +235,7 @@ static void sort_ram_list(void)
    QLIST_FOREACH(block, &ram_list.blocks, next) {
        ++n;
    }
-    blocks = g_malloc(n * sizeof *blocks);
+    blocks = qemu_malloc(n * sizeof *blocks);
    n = 0;
    QLIST_FOREACH_SAFE(block, &ram_list.blocks, next, nblock) {
        blocks[n++] = block;
@@ -247,7 +245,7 @@ static void sort_ram_list(void)
    while (--n >= 0) {
        QLIST_INSERT_HEAD(&ram_list.blocks, blocks[n], next);
    }
-    g_free(blocks);
+    qemu_free(blocks);
 }

 int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
@@ -256,7 +254,6 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    uint64_t bytes_transferred_last;
    double bwidth = 0;
    uint64_t expected_time = 0;
-    int ret;

    if (stage < 0) {
        cpu_physical_memory_set_dirty_tracking(0);
@@ -264,8 +261,8 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    }

    if (cpu_physical_sync_dirty_bitmap(0, TARGET_PHYS_ADDR_MAX) != 0) {
-        qemu_file_set_error(f, -EINVAL);
-        return -EINVAL;
+        qemu_file_set_error(f);
+        return 0;
    }

    if (stage == 1) {
@@ -301,7 +298,7 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    bytes_transferred_last = bytes_transferred;
    bwidth = qemu_get_clock_ns(rt_clock);

-    while ((ret = qemu_file_rate_limit(f)) == 0) {
+    while (!qemu_file_rate_limit(f)) {
        int bytes_sent;

        bytes_sent = ram_save_block(f);
@@ -311,10 +308,6 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
        }
    }

-    if (ret < 0) {
-        return ret;
-    }
-
    bwidth = qemu_get_clock_ns(rt_clock) - bwidth;
    bwidth = (bytes_transferred - bytes_transferred_last) / bwidth;

@@ -376,7 +369,6 @@ int ram_load(QEMUFile *f, void *opaque, int version_id)
 {
    ram_addr_t addr;
    int flags;
-    int error;

    if (version_id < 3 || version_id > 4) {
        return -EINVAL;
@@ -457,15 +449,19 @@ int ram_load(QEMUFile *f, void *opaque, int version_id)

            qemu_get_buffer(f, host, TARGET_PAGE_SIZE);
        }
-        error = qemu_file_get_error(f);
-        if (error) {
-            return error;
+        if (qemu_file_has_error(f)) {
+            return -EIO;
        }
    } while (!(flags & RAM_SAVE_FLAG_EOS));

    return 0;
 }

+void qemu_service_io(void)
+{
+    qemu_notify_event();
+}
+
 #ifdef HAS_AUDIO
 struct soundhw {
    const char *name;
--- a/arch_init.h
+++ b/arch_init.h
@@ -17,7 +17,6 @@ enum {
    QEMU_ARCH_S390X = 512,
    QEMU_ARCH_SH4 = 1024,
    QEMU_ARCH_SPARC = 2048,
-    QEMU_ARCH_XTENSA = 4096,
 };

 extern const uint32_t arch_type;
--- a/async.c
+++ b/async.c
@@ -24,10 +24,93 @@

 #include "qemu-common.h"
 #include "qemu-aio.h"
-#include "main-loop.h"

-/* Anchor of the list of Bottom Halves belonging to the context */
-static struct QEMUBH *first_bh;
+/*
+ * An AsyncContext protects the callbacks of AIO requests and Bottom Halves
+ * against interfering with each other. A typical example is qcow2 that accepts
+ * asynchronous requests, but relies for manipulation of its metadata on
+ * synchronous bdrv_read/write that doesn't trigger any callbacks.
+ *
+ * However, these functions are often emulated using AIO which means that AIO
+ * callbacks must be run - but at the same time we must not run callbacks of
+ * other requests as they might start to modify metadata and corrupt the
+ * internal state of the caller of bdrv_read/write.
+ *
+ * To achieve the desired semantics we switch into a new AsyncContext.
+ * Callbacks must only be run if they belong to the current AsyncContext.
+ * Otherwise they need to be queued until their own context is active again.
+ * This is how you can make qemu_aio_wait() wait only for your own callbacks.
+ *
+ * The AsyncContexts form a stack. When you leave a AsyncContexts, you always
+ * return to the old ("parent") context.
+ */
+struct AsyncContext {
+    /* Consecutive number of the AsyncContext (position in the stack) */
+    int id;
+
+    /* Anchor of the list of Bottom Halves belonging to the context */
+    struct QEMUBH *first_bh;
+
+    /* Link to parent context */
+    struct AsyncContext *parent;
+};
+
+/* The currently active AsyncContext */
+static struct AsyncContext *async_context = &(struct AsyncContext) { 0 };
+
+/*
+ * Enter a new AsyncContext. Already scheduled Bottom Halves and AIO callbacks
+ * won't be called until this context is left again.
+ */
+void async_context_push(void)
+{
+    struct AsyncContext *new = qemu_mallocz(sizeof(*new));
+    new->parent = async_context;
+    new->id = async_context->id + 1;
+    async_context = new;
+}
+
+/* Run queued AIO completions and destroy Bottom Half */
+static void bh_run_aio_completions(void *opaque)
+{
+    QEMUBH **bh = opaque;
+    qemu_bh_delete(*bh);
+    qemu_free(bh);
+    qemu_aio_process_queue();
+}
+/*
+ * Leave the currently active AsyncContext. All Bottom Halves belonging to the
+ * old context are executed before changing the context.
+ */
+void async_context_pop(void)
+{
+    struct AsyncContext *old = async_context;
+    QEMUBH **bh;
+
+    /* Flush the bottom halves, we don't want to lose them */
+    while (qemu_bh_poll());
+
+    /* Switch back to the parent context */
+    async_context = async_context->parent;
+    qemu_free(old);
+
+    if (async_context == NULL) {
+        abort();
+    }
+
+    /* Schedule BH to run any queued AIO completions as soon as possible */
+    bh = qemu_malloc(sizeof(*bh));
+    *bh = qemu_bh_new(bh_run_aio_completions, bh);
+    qemu_bh_schedule(*bh);
+}
+
+/*
+ * Returns the ID of the currently active AsyncContext
+ */
+int get_async_context_id(void)
+{
+    return async_context->id;
+}

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
@@ -44,11 +127,11 @@ struct QEMUBH {
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
-    bh = g_malloc0(sizeof(QEMUBH));
+    bh = qemu_mallocz(sizeof(QEMUBH));
    bh->cb = cb;
    bh->opaque = opaque;
-    bh->next = first_bh;
-    first_bh = bh;
+    bh->next = async_context->first_bh;
+    async_context->first_bh = bh;
    return bh;
 }

@@ -56,12 +139,9 @@ int qemu_bh_poll(void)
 {
    QEMUBH *bh, **bhp, *next;
    int ret;
-    static int nesting = 0;
-
-    nesting++;

    ret = 0;
-    for (bh = first_bh; bh; bh = next) {
+    for (bh = async_context->first_bh; bh; bh = next) {
        next = bh->next;
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
@@ -72,20 +152,15 @@ int qemu_bh_poll(void)
        }
    }

-    nesting--;
-
    /* remove deleted bhs */
-    if (!nesting) {
-        bhp = &first_bh;
-        while (*bhp) {
-            bh = *bhp;
-            if (bh->deleted) {
-                *bhp = bh->next;
-                g_free(bh);
-            } else {
-                bhp = &bh->next;
-            }
-        }
+    bhp = &async_context->first_bh;
+    while (*bhp) {
+        bh = *bhp;
+        if (bh->deleted) {
+            *bhp = bh->next;
+            qemu_free(bh);
+        } else
+            bhp = &bh->next;
    }

    return ret;
@@ -124,7 +199,7 @@ void qemu_bh_update_timeout(int *timeout)
 {
    QEMUBH *bh;

-    for (bh = first_bh; bh; bh = bh->next) {
+    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -136,7 +136,7 @@ static void alsa_fini_poll (struct pollhlp *hlp)
        for (i = 0; i < hlp->count; ++i) {
            qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
        }
-        g_free (pfds);
+        qemu_free (pfds);
    }
    hlp->pfds = NULL;
    hlp->count = 0;
@@ -260,7 +260,7 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int mask)
    if (err < 0) {
        alsa_logerr (err, "Could not initialize poll mode\n"
                     "Could not obtain poll descriptors\n");
-        g_free (pfds);
+        qemu_free (pfds);
        return -1;
    }

@@ -288,7 +288,7 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int mask)
            while (i--) {
                qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
            }
-            g_free (pfds);
+            qemu_free (pfds);
            return -1;
        }
    }
@@ -816,7 +816,7 @@ static void alsa_fini_out (HWVoiceOut *hw)
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

    if (alsa->pcm_buf) {
-        g_free (alsa->pcm_buf);
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
@@ -979,7 +979,7 @@ static void alsa_fini_in (HWVoiceIn *hw)
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

    if (alsa->pcm_buf) {
-        g_free (alsa->pcm_buf);
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -196,7 +196,7 @@ void *audio_calloc (const char *funcname, int nmemb, size_t size)
        return NULL;
    }

-    return g_malloc0 (len);
+    return qemu_mallocz (len);
 }

 static char *audio_alloc_prefix (const char *s)
@@ -210,7 +210,7 @@ static char *audio_alloc_prefix (const char *s)
    }

    len = strlen (s);
-    r = g_malloc (len + sizeof (qemu_prefix));
+    r = qemu_malloc (len + sizeof (qemu_prefix));

    u = r + sizeof (qemu_prefix) - 1;

@@ -425,7 +425,7 @@ static void audio_print_options (const char *prefix,
        printf ("    %s\n", opt->descr);
    }

-    g_free (uprefix);
+    qemu_free (uprefix);
 }

 static void audio_process_options (const char *prefix,
@@ -462,7 +462,7 @@ static void audio_process_options (const char *prefix,
         * (includes trailing zero) + zero + underscore (on behalf of
         * sizeof) */
        optlen = len + preflen + sizeof (qemu_prefix) + 1;
-        optname = g_malloc (optlen);
+        optname = qemu_malloc (optlen);

        pstrcpy (optname, optlen, qemu_prefix);

@@ -507,7 +507,7 @@ static void audio_process_options (const char *prefix,
            opt->overriddenp = &opt->overridden;
        }
        *opt->overriddenp = !def;
-        g_free (optname);
+        qemu_free (optname);
    }
 }

@@ -778,7 +778,7 @@ static void audio_detach_capture (HWVoiceOut *hw)

        QLIST_REMOVE (sw, entries);
        QLIST_REMOVE (sc, entries);
-        g_free (sc);
+        qemu_free (sc);
        if (was_active) {
            /* We have removed soft voice from the capture:
               this might have changed the overall status of the capture
@@ -818,7 +818,7 @@ static int audio_attach_capture (HWVoiceOut *hw)
        sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
        if (!sw->rate) {
            dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
-            g_free (sw);
+            qemu_free (sw);
            return -1;
        }
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
@@ -1743,7 +1743,7 @@ static int audio_driver_init (AudioState *s, struct audio_driver *drv)
 }

 static void audio_vm_change_state_handler (void *opaque, int running,
-                                           RunState state)
+                                           int reason)
 {
    AudioState *s = opaque;
    HWVoiceOut *hwo = NULL;
@@ -1907,7 +1907,7 @@ static void audio_init (void)
 void AUD_register_card (const char *name, QEMUSoundCard *card)
 {
    audio_init ();
-    card->name = g_strdup (name);
+    card->name = qemu_strdup (name);
    memset (&card->entries, 0, sizeof (card->entries));
    QLIST_INSERT_HEAD (&glob_audio_state.card_head, card, entries);
 }
@@ -1915,7 +1915,7 @@ void AUD_register_card (const char *name, QEMUSoundCard *card)
 void AUD_remove_card (QEMUSoundCard *card)
 {
    QLIST_REMOVE (card, entries);
-    g_free (card->name);
+    qemu_free (card->name);
 }


@@ -2000,11 +2000,11 @@ CaptureVoiceOut *AUD_add_capture (
        return cap;

    err3:
-        g_free (cap->hw.mix_buf);
+        qemu_free (cap->hw.mix_buf);
    err2:
-        g_free (cap);
+        qemu_free (cap);
    err1:
-        g_free (cb);
+        qemu_free (cb);
    err0:
        return NULL;
    }
@@ -2018,7 +2018,7 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
        if (cb->opaque == cb_opaque) {
            cb->ops.destroy (cb_opaque);
            QLIST_REMOVE (cb, entries);
-            g_free (cb);
+            qemu_free (cb);

            if (!cap->cb_head.lh_first) {
                SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
@@ -2036,11 +2036,11 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
                    }
                    QLIST_REMOVE (sw, entries);
                    QLIST_REMOVE (sc, entries);
-                    g_free (sc);
+                    qemu_free (sc);
                    sw = sw1;
                }
                QLIST_REMOVE (cap, entries);
-                g_free (cap);
+                qemu_free (cap);
            }
            return;
        }
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -72,7 +72,7 @@ static void glue (audio_init_nb_voices_, TYPE) (struct audio_driver *drv)
 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
    if (HWBUF) {
-        g_free (HWBUF);
+        qemu_free (HWBUF);
    }

    HWBUF = NULL;
@@ -93,7 +93,7 @@ static int glue (audio_pcm_hw_alloc_resources_, TYPE) (HW *hw)
 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
    if (sw->buf) {
-        g_free (sw->buf);
+        qemu_free (sw->buf);
    }

    if (sw->rate) {
@@ -123,7 +123,7 @@ static int glue (audio_pcm_sw_alloc_resources_, TYPE) (SW *sw)
    sw->rate = st_rate_start (sw->hw->info.freq, sw->info.freq);
 #endif
    if (!sw->rate) {
-        g_free (sw->buf);
+        qemu_free (sw->buf);
        sw->buf = NULL;
        return -1;
    }
@@ -160,10 +160,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
        [sw->info.swap_endianness]
        [audio_bits_to_index (sw->info.bits)];

-    sw->name = g_strdup (name);
+    sw->name = qemu_strdup (name);
    err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
    if (err) {
-        g_free (sw->name);
+        qemu_free (sw->name);
        sw->name = NULL;
    }
    return err;
@@ -173,7 +173,7 @@ static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
 {
    glue (audio_pcm_sw_free_resources_, TYPE) (sw);
    if (sw->name) {
-        g_free (sw->name);
+        qemu_free (sw->name);
        sw->name = NULL;
    }
 }
@@ -201,7 +201,7 @@ static void glue (audio_pcm_hw_gc_, TYPE) (HW **hwp)
        glue (s->nb_hw_voices_, TYPE) += 1;
        glue (audio_pcm_hw_free_resources_ ,TYPE) (hw);
        glue (hw->pcm_ops->fini_, TYPE) (hw);
-        g_free (hw);
+        qemu_free (hw);
        *hwp = NULL;
    }
 }
@@ -300,7 +300,7 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
 err1:
    glue (hw->pcm_ops->fini_, TYPE) (hw);
 err0:
-    g_free (hw);
+    qemu_free (hw);
    return NULL;
 }

@@ -368,7 +368,7 @@ err3:
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&hw);
 err2:
-    g_free (sw);
+    qemu_free (sw);
 err1:
    return NULL;
 }
@@ -378,7 +378,7 @@ static void glue (audio_close_, TYPE) (SW *sw)
    glue (audio_pcm_sw_fini_, TYPE) (sw);
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&sw->hw);
-    g_free (sw);
+    qemu_free (sw);
 }

 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -246,7 +246,7 @@ static int qesd_init_out (HWVoiceOut *hw, struct audsettings *as)
    esd->fd = -1;

 fail1:
-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
@@ -270,7 +270,7 @@ static void qesd_fini_out (HWVoiceOut *hw)

    audio_pt_fini (&esd->pt, AUDIO_FUNC);

-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }

@@ -453,7 +453,7 @@ static int qesd_init_in (HWVoiceIn *hw, struct audsettings *as)
    esd->fd = -1;

 fail1:
-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
@@ -477,7 +477,7 @@ static void qesd_fini_in (HWVoiceIn *hw)

    audio_pt_fini (&esd->pt, AUDIO_FUNC);

-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }

--- a/audio/fmodaudio.c
+++ b/audio/fmodaudio.c
@@ -343,7 +343,7 @@ static void fmod_fini_out (HWVoiceOut *hw)

 static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
-    int mode, channel;
+    int bits16, mode, channel;
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    struct audsettings obt_as = *as;

@@ -374,6 +374,7 @@ static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
+    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
@@ -404,7 +405,7 @@ static int fmod_ctl_out (HWVoiceOut *hw, int cmd, ...)

 static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
-    int mode;
+    int bits16, mode;
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    struct audsettings obt_as = *as;

@@ -431,6 +432,7 @@ static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
+    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -326,7 +326,7 @@ void *st_rate_start (int inrate, int outrate)

 void st_rate_stop (void *opaque)
 {
-    g_free (opaque);
+    qemu_free (opaque);
 }

 void mixeng_clear (struct st_sample *buf, int len)
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -508,7 +508,7 @@ static void oss_fini_out (HWVoiceOut *hw)
            }
        }
        else {
-            g_free (oss->pcm_buf);
+            qemu_free (oss->pcm_buf);
        }
        oss->pcm_buf = NULL;
    }
@@ -741,7 +741,7 @@ static void oss_fini_in (HWVoiceIn *hw)
    oss_anal_close (&oss->fd);

    if (oss->pcm_buf) {
-        g_free (oss->pcm_buf);
+        qemu_free (oss->pcm_buf);
        oss->pcm_buf = NULL;
    }
 }
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -339,7 +339,7 @@ static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
    return 0;

 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
    pa_simple_free (pa->s);
@@ -394,7 +394,7 @@ static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)
    return 0;

 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
    pa_simple_free (pa->s);
@@ -419,7 +419,7 @@ static void qpa_fini_out (HWVoiceOut *hw)
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }

@@ -439,7 +439,7 @@ static void qpa_fini_in (HWVoiceIn *hw)
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }

--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -30,7 +30,7 @@

 typedef struct WAVVoiceOut {
    HWVoiceOut hw;
-    FILE *f;
+    QEMUFile *f;
    int64_t old_ticks;
    void *pcm_buf;
    int total_samples;
@@ -76,10 +76,7 @@ static int wav_run_out (HWVoiceOut *hw, int live)
        dst = advance (wav->pcm_buf, rpos << hw->info.shift);

        hw->clip (dst, src, convert_samples);
-        if (fwrite (dst, convert_samples << hw->info.shift, 1, wav->f) != 1) {
-            dolog ("wav_run_out: fwrite of %d bytes failed\nReaons: %s\n",
-                   convert_samples << hw->info.shift, strerror (errno));
-        }
+        qemu_put_buffer (wav->f, dst, convert_samples << hw->info.shift);

        rpos = (rpos + convert_samples) % hw->samples;
        samples -= convert_samples;
@@ -155,20 +152,16 @@ static int wav_init_out (HWVoiceOut *hw, struct audsettings *as)
    le_store (hdr + 28, hw->info.freq << (bits16 + stereo), 4);
    le_store (hdr + 32, 1 << (bits16 + stereo), 2);

-    wav->f = fopen (conf.wav_path, "wb");
+    wav->f = qemu_fopen (conf.wav_path, "wb");
    if (!wav->f) {
        dolog ("Failed to open wave file `%s'\nReason: %s\n",
               conf.wav_path, strerror (errno));
-        g_free (wav->pcm_buf);
+        qemu_free (wav->pcm_buf);
        wav->pcm_buf = NULL;
        return -1;
    }

-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        dolog ("wav_init_out: failed to write header\nReason: %s\n",
-               strerror(errno));
-        return -1;
-    }
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));
    return 0;
 }

@@ -187,35 +180,16 @@ static void wav_fini_out (HWVoiceOut *hw)
    le_store (rlen, rifflen, 4);
    le_store (dlen, datalen, 4);

-    if (fseek (wav->f, 4, SEEK_SET)) {
-        dolog ("wav_fini_out: fseek to rlen failed\nReason: %s\n",
-               strerror(errno));
-        goto doclose;
-    }
-    if (fwrite (rlen, 4, 1, wav->f) != 1) {
-        dolog ("wav_fini_out: failed to write rlen\nReason: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
-    if (fseek (wav->f, 32, SEEK_CUR)) {
-        dolog ("wav_fini_out: fseek to dlen failed\nReason: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
-    if (fwrite (dlen, 4, 1, wav->f) != 1) {
-        dolog ("wav_fini_out: failed to write dlen\nReaons: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
+    qemu_fseek (wav->f, 4, SEEK_SET);
+    qemu_put_buffer (wav->f, rlen, 4);

- doclose:
-    if (fclose (wav->f))  {
-        dolog ("wav_fini_out: fclose %p failed\nReason: %s\n",
-               wav->f, strerror (errno));
-    }
+    qemu_fseek (wav->f, 32, SEEK_CUR);
+    qemu_put_buffer (wav->f, dlen, 4);
+
+    qemu_fclose (wav->f);
    wav->f = NULL;

-    g_free (wav->pcm_buf);
+    qemu_free (wav->pcm_buf);
    wav->pcm_buf = NULL;
 }

--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -3,7 +3,7 @@
 #include "audio.h"

 typedef struct {
-    FILE *f;
+    QEMUFile *f;
    int bytes;
    char *path;
    int freq;
@@ -35,50 +35,27 @@ static void wav_destroy (void *opaque)
    uint8_t dlen[4];
    uint32_t datalen = wav->bytes;
    uint32_t rifflen = datalen + 36;
-    Monitor *mon = cur_mon;

    if (wav->f) {
        le_store (rlen, rifflen, 4);
        le_store (dlen, datalen, 4);

-        if (fseek (wav->f, 4, SEEK_SET)) {
-            monitor_printf (mon, "wav_destroy: rlen fseek failed\nReason: %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fwrite (rlen, 4, 1, wav->f) != 1) {
-            monitor_printf (mon, "wav_destroy: rlen fwrite failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fseek (wav->f, 32, SEEK_CUR)) {
-            monitor_printf (mon, "wav_destroy: dlen fseek failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fwrite (dlen, 1, 4, wav->f) != 4) {
-            monitor_printf (mon, "wav_destroy: dlen fwrite failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-    doclose:
-        if (fclose (wav->f)) {
-            fprintf (stderr, "wav_destroy: fclose failed: %s",
-                     strerror (errno));
-        }
+        qemu_fseek (wav->f, 4, SEEK_SET);
+        qemu_put_buffer (wav->f, rlen, 4);
+
+        qemu_fseek (wav->f, 32, SEEK_CUR);
+        qemu_put_buffer (wav->f, dlen, 4);
+        qemu_fclose (wav->f);
    }

-    g_free (wav->path);
+    qemu_free (wav->path);
 }

 static void wav_capture (void *opaque, void *buf, int size)
 {
    WAVState *wav = opaque;

-    if (fwrite (buf, size, 1, wav->f) != 1) {
-        monitor_printf (cur_mon, "wav_capture: fwrite error\nReason: %s",
-                        strerror (errno));
-    }
+    qemu_put_buffer (wav->f, buf, size);
    wav->bytes += size;
 }

@@ -94,9 +71,9 @@ static void wav_capture_info (void *opaque)
    WAVState *wav = opaque;
    char *path = wav->path;

-    monitor_printf (cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
-                    wav->freq, wav->bits, wav->nchannels,
-                    path ? path : "<not available>", wav->bytes);
+    monitor_printf(cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
+                   wav->freq, wav->bits, wav->nchannels,
+                   path ? path : "<not available>", wav->bytes);
 }

 static struct capture_ops wav_capture_ops = {
@@ -121,13 +98,13 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    CaptureVoiceOut *cap;

    if (bits != 8 && bits != 16) {
-        monitor_printf (mon, "incorrect bit count %d, must be 8 or 16\n", bits);
+        monitor_printf(mon, "incorrect bit count %d, must be 8 or 16\n", bits);
        return -1;
    }

    if (nchannels != 1 && nchannels != 2) {
-        monitor_printf (mon, "incorrect channel count %d, must be 1 or 2\n",
-                        nchannels);
+        monitor_printf(mon, "incorrect channel count %d, must be 1 or 2\n",
+                       nchannels);
        return -1;
    }

@@ -143,7 +120,7 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    ops.capture = wav_capture;
    ops.destroy = wav_destroy;

-    wav = g_malloc0 (sizeof (*wav));
+    wav = qemu_mallocz (sizeof (*wav));

    shift = bits16 + stereo;
    hdr[34] = bits16 ? 0x10 : 0x08;
@@ -153,42 +130,32 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    le_store (hdr + 28, freq << shift, 4);
    le_store (hdr + 32, 1 << shift, 2);

-    wav->f = fopen (path, "wb");
+    wav->f = qemu_fopen (path, "wb");
    if (!wav->f) {
-        monitor_printf (mon, "Failed to open wave file `%s'\nReason: %s\n",
-                        path, strerror (errno));
-        g_free (wav);
+        monitor_printf(mon, "Failed to open wave file `%s'\nReason: %s\n",
+                       path, strerror (errno));
+        qemu_free (wav);
        return -1;
    }

-    wav->path = g_strdup (path);
+    wav->path = qemu_strdup (path);
    wav->bits = bits;
    wav->nchannels = nchannels;
    wav->freq = freq;

-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        monitor_printf (mon, "Failed to write header\nReason: %s\n",
-                        strerror (errno));
-        goto error_free;
-    }
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));

    cap = AUD_add_capture (&as, &ops, wav);
    if (!cap) {
-        monitor_printf (mon, "Failed to add audio capture\n");
-        goto error_free;
+        monitor_printf(mon, "Failed to add audio capture\n");
+        qemu_free (wav->path);
+        qemu_fclose (wav->f);
+        qemu_free (wav);
+        return -1;
    }

    wav->cap = cap;
    s->opaque = wav;
    s->ops = wav_capture_ops;
    return 0;
-
-error_free:
-    g_free (wav->path);
-    if (fclose (wav->f)) {
-        monitor_printf (mon, "Failed to close wave file\nReason: %s\n",
-                        strerror (errno));
-    }
-    g_free (wav);
-    return -1;
 }
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -222,9 +222,9 @@ static int winwave_init_out (HWVoiceOut *hw, struct audsettings *as)
    return 0;

 err4:
-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
 err3:
-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_out (wave);
 err1:
@@ -310,10 +310,10 @@ static void winwave_fini_out (HWVoiceOut *hw)
        wave->event = NULL;
    }

-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;

-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }

@@ -511,9 +511,9 @@ static int winwave_init_in (HWVoiceIn *hw, struct audsettings *as)
    return 0;

 err4:
-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
 err3:
-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_in (wave);
 err1:
@@ -550,10 +550,10 @@ static void winwave_fini_in (HWVoiceIn *hw)
        wave->event = NULL;
    }

-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;

-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }

--- a/balloon.c
+++ b/balloon.c
@@ -25,11 +25,12 @@
 */

 #include "monitor.h"
+#include "qjson.h"
+#include "qint.h"
 #include "cpu-common.h"
 #include "kvm.h"
 #include "balloon.h"
 #include "trace.h"
-#include "qmp-commands.h"

 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
@@ -51,16 +52,6 @@ int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
    return 0;
 }

-void qemu_remove_balloon_handler(void *opaque)
-{
-    if (balloon_opaque != opaque) {
-        return;
-    }
-    balloon_event_fn = NULL;
-    balloon_stat_fn = NULL;
-    balloon_opaque = NULL;
-}
-
 static int qemu_balloon(ram_addr_t target)
 {
    if (!balloon_event_fn) {
@@ -71,33 +62,76 @@ static int qemu_balloon(ram_addr_t target)
    return 1;
 }

-static int qemu_balloon_status(BalloonInfo *info)
+static int qemu_balloon_status(MonitorCompletion cb, void *opaque)
 {
    if (!balloon_stat_fn) {
        return 0;
    }
-    balloon_stat_fn(balloon_opaque, info);
+    balloon_stat_fn(balloon_opaque, cb, opaque);
    return 1;
 }

-BalloonInfo *qmp_query_balloon(Error **errp)
+static void print_balloon_stat(const char *key, QObject *obj, void *opaque)
 {
-    BalloonInfo *info;
+    Monitor *mon = opaque;
+
+    if (strcmp(key, "actual")) {
+        monitor_printf(mon, ",%s=%" PRId64, key,
+                       qint_get_int(qobject_to_qint(obj)));
+    }
+}
+
+void monitor_print_balloon(Monitor *mon, const QObject *data)
+{
+    QDict *qdict;
+
+    qdict = qobject_to_qdict(data);
+    if (!qdict_haskey(qdict, "actual")) {
+        return;
+    }
+    monitor_printf(mon, "balloon: actual=%" PRId64,
+                   qdict_get_int(qdict, "actual") >> 20);
+    qdict_iter(qdict, print_balloon_stat, mon);
+    monitor_printf(mon, "\n");
+}
+
+/**
+ * do_info_balloon(): Balloon information
+ *
+ * Make an asynchronous request for balloon info.  When the request completes
+ * a QDict will be returned according to the following specification:
+ *
+ * - "actual": current balloon value in bytes
+ * The following fields may or may not be present:
+ * - "mem_swapped_in": Amount of memory swapped in (bytes)
+ * - "mem_swapped_out": Amount of memory swapped out (bytes)
+ * - "major_page_faults": Number of major faults
+ * - "minor_page_faults": Number of minor faults
+ * - "free_mem": Total amount of free and unused memory (bytes)
+ * - "total_mem": Total amount of available memory (bytes)
+ *
+ * Example:
+ *
+ * { "actual": 1073741824, "mem_swapped_in": 0, "mem_swapped_out": 0,
+ *   "major_page_faults": 142, "minor_page_faults": 239245,
+ *   "free_mem": 1014185984, "total_mem": 1044668416 }
+ */
+int do_info_balloon(Monitor *mon, MonitorCompletion cb, void *opaque)
+{
+    int ret;

    if (kvm_enabled() && !kvm_has_sync_mmu()) {
-        error_set(errp, QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
-        return NULL;
+        qerror_report(QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
+        return -1;
    }

-    info = g_malloc0(sizeof(*info));
-
-    if (qemu_balloon_status(info) == 0) {
-        error_set(errp, QERR_DEVICE_NOT_ACTIVE, "balloon");
-        qapi_free_BalloonInfo(info);
-        return NULL;
+    ret = qemu_balloon_status(cb, opaque);
+    if (!ret) {
+        qerror_report(QERR_DEVICE_NOT_ACTIVE, "balloon");
+        return -1;
    }

-    return info;
+    return 0;
 }

 /**
--- a/balloon.h
+++ b/balloon.h
@@ -15,15 +15,16 @@
 #define _QEMU_BALLOON_H

 #include "monitor.h"
-#include "qapi-types.h"

 typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
-typedef void (QEMUBalloonStatus)(void *opaque, BalloonInfo *info);
+typedef void (QEMUBalloonStatus)(void *opaque, MonitorCompletion cb,
+                                 void *cb_data);

 int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
 			     QEMUBalloonStatus *stat_func, void *opaque);
-void qemu_remove_balloon_handler(void *opaque);

+void monitor_print_balloon(Monitor *mon, const QObject *data);
+int do_info_balloon(Monitor *mon, MonitorCompletion cb, void *opaque);
 int do_balloon(Monitor *mon, const QDict *params,
               MonitorCompletion cb, void *opaque);

--- a/bitmap.h
+++ b/bitmap.h
@@ -91,7 +91,7 @@ int slow_bitmap_intersects(const unsigned long *bitmap1,
 static inline unsigned long *bitmap_new(int nbits)
 {
    int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-    return g_malloc0(len);
+    return qemu_mallocz(len);
 }

 static inline void bitmap_zero(unsigned long *dst, int nbits)
--- a/block-migration.c
+++ b/block-migration.c
@@ -180,7 +180,7 @@ static void alloc_aio_bitmap(BlkMigDevState *bmds)
            BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1;
    bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8;

-    bmds->aio_bitmap = g_malloc0(bitmap_size);
+    bmds->aio_bitmap = qemu_mallocz(bitmap_size);
 }

 static void blk_mig_read_cb(void *opaque, int ret)
@@ -235,8 +235,8 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
        nr_sectors = total_sectors - cur_sector;
    }

-    blk = g_malloc(sizeof(BlkMigBlock));
-    blk->buf = g_malloc(BLOCK_SIZE);
+    blk = qemu_malloc(sizeof(BlkMigBlock));
+    blk->buf = qemu_malloc(BLOCK_SIZE);
    blk->bmds = bmds;
    blk->sector = cur_sector;
    blk->nr_sectors = nr_sectors;
@@ -263,9 +263,9 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,

 error:
    monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
-    qemu_file_set_error(f, -EIO);
-    g_free(blk->buf);
-    g_free(blk);
+    qemu_file_set_error(f);
+    qemu_free(blk->buf);
+    qemu_free(blk);
    return 0;
 }

@@ -290,7 +290,7 @@ static void init_blk_migration_it(void *opaque, BlockDriverState *bs)
            return;
        }

-        bmds = g_malloc0(sizeof(BlkMigDevState));
+        bmds = qemu_mallocz(sizeof(BlkMigDevState));
        bmds->bs = bs;
        bmds->bulk_completed = 0;
        bmds->total_sectors = sectors;
@@ -383,7 +383,6 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
    int64_t total_sectors = bmds->total_sectors;
    int64_t sector;
    int nr_sectors;
-    int ret = -EIO;

    for (sector = bmds->cur_dirty; sector < bmds->total_sectors;) {
        if (bmds_aio_inflight(bmds, sector)) {
@@ -396,8 +395,8 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
            } else {
                nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
            }
-            blk = g_malloc(sizeof(BlkMigBlock));
-            blk->buf = g_malloc(BLOCK_SIZE);
+            blk = qemu_malloc(sizeof(BlkMigBlock));
+            blk->buf = qemu_malloc(BLOCK_SIZE);
            blk->bmds = bmds;
            blk->sector = sector;
            blk->nr_sectors = nr_sectors;
@@ -419,14 +418,14 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
                block_mig_state.submitted++;
                bmds_set_aio_inflight(bmds, sector, nr_sectors, 1);
            } else {
-                ret = bdrv_read(bmds->bs, sector, blk->buf, nr_sectors);
-                if (ret < 0) {
+                if (bdrv_read(bmds->bs, sector, blk->buf,
+                              nr_sectors) < 0) {
                    goto error;
                }
                blk_send(f, blk);

-                g_free(blk->buf);
-                g_free(blk);
+                qemu_free(blk->buf);
+                qemu_free(blk);
            }

            bdrv_reset_dirty(bmds->bs, sector, nr_sectors);
@@ -440,9 +439,9 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,

 error:
    monitor_printf(mon, "Error reading sector %" PRId64 "\n", sector);
-    qemu_file_set_error(f, ret);
-    g_free(blk->buf);
-    g_free(blk);
+    qemu_file_set_error(f);
+    qemu_free(blk->buf);
+    qemu_free(blk);
    return 0;
 }

@@ -474,14 +473,14 @@ static void flush_blks(QEMUFile* f)
            break;
        }
        if (blk->ret < 0) {
-            qemu_file_set_error(f, blk->ret);
+            qemu_file_set_error(f);
            break;
        }
        blk_send(f, blk);

        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        g_free(blk->buf);
-        g_free(blk);
+        qemu_free(blk->buf);
+        qemu_free(blk);

        block_mig_state.read_done--;
        block_mig_state.transferred++;
@@ -521,7 +520,7 @@ static int is_stage2_completed(void)

        if ((remaining_dirty / bwidth) <=
            migrate_max_downtime()) {
-            /* finish stage2 because we think that we can finish remaining work
+            /* finish stage2 because we think that we can finish remaing work
               below max_downtime */

            return 1;
@@ -542,14 +541,14 @@ static void blk_mig_cleanup(Monitor *mon)
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
        bdrv_set_in_use(bmds->bs, 0);
        drive_put_ref(drive_get_by_blockdev(bmds->bs));
-        g_free(bmds->aio_bitmap);
-        g_free(bmds);
+        qemu_free(bmds->aio_bitmap);
+        qemu_free(bmds);
    }

    while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        g_free(blk->buf);
-        g_free(blk);
+        qemu_free(blk->buf);
+        qemu_free(blk);
    }

    monitor_printf(mon, "\n");
@@ -557,8 +556,6 @@ static void blk_mig_cleanup(Monitor *mon)

 static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
 {
-    int ret;
-
    DPRINTF("Enter save live stage %d submitted %d transferred %d\n",
            stage, block_mig_state.submitted, block_mig_state.transferred);

@@ -582,10 +579,9 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)

    flush_blks(f);

-    ret = qemu_file_get_error(f);
-    if (ret) {
+    if (qemu_file_has_error(f)) {
        blk_mig_cleanup(mon);
-        return ret;
+        return 0;
    }

    blk_mig_reset_dirty_cursor();
@@ -611,10 +607,9 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)

        flush_blks(f);

-        ret = qemu_file_get_error(f);
-        if (ret) {
+        if (qemu_file_has_error(f)) {
            blk_mig_cleanup(mon);
-            return ret;
+            return 0;
        }
    }

@@ -629,9 +624,8 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
        /* report completion */
        qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);

-        ret = qemu_file_get_error(f);
-        if (ret) {
-            return ret;
+        if (qemu_file_has_error(f)) {
+            return 0;
        }

        monitor_printf(mon, "Block migration completed\n");
@@ -652,7 +646,6 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
    uint8_t *buf;
    int64_t total_sectors = 0;
    int nr_sectors;
-    int ret;

    do {
        addr = qemu_get_be64(f);
@@ -661,6 +654,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
        addr >>= BDRV_SECTOR_BITS;

        if (flags & BLK_MIG_FLAG_DEVICE_BLOCK) {
+            int ret;
            /* get device name */
            len = qemu_get_byte(f);
            qemu_get_buffer(f, (uint8_t *)device_name, len);
@@ -689,12 +683,12 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
            }

-            buf = g_malloc(BLOCK_SIZE);
+            buf = qemu_malloc(BLOCK_SIZE);

            qemu_get_buffer(f, buf, BLOCK_SIZE);
            ret = bdrv_write(bs, addr, buf, nr_sectors);

-            g_free(buf);
+            qemu_free(buf);
            if (ret < 0) {
                return ret;
            }
@@ -710,9 +704,8 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
-        ret = qemu_file_get_error(f);
-        if (ret != 0) {
-            return ret;
+        if (qemu_file_has_error(f)) {
+            return -EIO;
        }
    } while (!(flags & BLK_MIG_FLAG_EOS));

--- a/block.c
+++ b/block.c
--- a/block.h
+++ b/block.h
@@ -4,7 +4,6 @@
 #include "qemu-aio.h"
 #include "qemu-common.h"
 #include "qemu-option.h"
-#include "qemu-coroutine.h"
 #include "qobject.h"

 /* block.c */
@@ -28,41 +27,6 @@ typedef struct QEMUSnapshotInfo {
    uint64_t vm_clock_nsec; /* VM clock relative to boot */
 } QEMUSnapshotInfo;

-/* Callbacks for block device models */
-typedef struct BlockDevOps {
-    /*
-     * Runs when virtual media changed (monitor commands eject, change)
-     * Argument load is true on load and false on eject.
-     * Beware: doesn't run when a host device's physical media
-     * changes.  Sure would be useful if it did.
-     * Device models with removable media must implement this callback.
-     */
-    void (*change_media_cb)(void *opaque, bool load);
-    /*
-     * Runs when an eject request is issued from the monitor, the tray
-     * is closed, and the medium is locked.
-     * Device models that do not implement is_medium_locked will not need
-     * this callback.  Device models that can lock the medium or tray might
-     * want to implement the callback and unlock the tray when "force" is
-     * true, even if they do not support eject requests.
-     */
-    void (*eject_request_cb)(void *opaque, bool force);
-    /*
-     * Is the virtual tray open?
-     * Device models implement this only when the device has a tray.
-     */
-    bool (*is_tray_open)(void *opaque);
-    /*
-     * Is the virtual medium locked into the device?
-     * Device models implement this only when device has such a lock.
-     */
-    bool (*is_medium_locked)(void *opaque);
-    /*
-     * Runs when the size changed (e.g. monitor command block_resize)
-     */
-    void (*resize_cb)(void *opaque);
-} BlockDevOps;
-
 #define BDRV_O_RDWR        0x0002
 #define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
 #define BDRV_O_NOCACHE     0x0020 /* do not use the host page cache */
@@ -86,11 +50,6 @@ typedef enum {
    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
 } BlockMonEventAction;

-void bdrv_iostatus_enable(BlockDriverState *bs);
-void bdrv_iostatus_reset(BlockDriverState *bs);
-void bdrv_iostatus_disable(BlockDriverState *bs);
-bool bdrv_iostatus_is_enabled(const BlockDriverState *bs);
-void bdrv_iostatus_set_err(BlockDriverState *bs, int error);
 void bdrv_mon_event(const BlockDriverState *bdrv,
                    BlockMonEventAction action, int is_read);
 void bdrv_info_print(Monitor *mon, const QObject *data);
@@ -109,21 +68,13 @@ int bdrv_create_file(const char* filename, QEMUOptionParameter *options);
 BlockDriverState *bdrv_new(const char *device_name);
 void bdrv_make_anon(BlockDriverState *bs);
 void bdrv_delete(BlockDriverState *bs);
-int bdrv_parse_cache_flags(const char *mode, int *flags);
 int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
 int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
              BlockDriver *drv);
 void bdrv_close(BlockDriverState *bs);
-int bdrv_attach_dev(BlockDriverState *bs, void *dev);
-void bdrv_attach_dev_nofail(BlockDriverState *bs, void *dev);
-void bdrv_detach_dev(BlockDriverState *bs, void *dev);
-void *bdrv_get_attached_dev(BlockDriverState *bs);
-void bdrv_set_dev_ops(BlockDriverState *bs, const BlockDevOps *ops,
-                      void *opaque);
-void bdrv_dev_eject_request(BlockDriverState *bs, bool force);
-bool bdrv_dev_has_removable_media(BlockDriverState *bs);
-bool bdrv_dev_is_tray_open(BlockDriverState *bs);
-bool bdrv_dev_is_medium_locked(BlockDriverState *bs);
+int bdrv_attach(BlockDriverState *bs, DeviceState *qdev);
+void bdrv_detach(BlockDriverState *bs, DeviceState *qdev);
+DeviceState *bdrv_get_attached(BlockDriverState *bs);
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
              uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
@@ -134,10 +85,8 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
                const void *buf, int count);
 int bdrv_pwrite_sync(BlockDriverState *bs, int64_t offset,
    const void *buf, int count);
-int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors, QEMUIOVector *qiov);
-int coroutine_fn bdrv_co_writev(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors, QEMUIOVector *qiov);
+int bdrv_write_sync(BlockDriverState *bs, int64_t sector_num,
+    const uint8_t *buf, int nb_sectors);
 int bdrv_truncate(BlockDriverState *bs, int64_t offset);
 int64_t bdrv_getlength(BlockDriverState *bs);
 int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
@@ -171,9 +120,6 @@ BlockDriverAIOCB *bdrv_aio_writev(BlockDriverState *bs, int64_t sector_num,
                                  BlockDriverCompletionFunc *cb, void *opaque);
 BlockDriverAIOCB *bdrv_aio_flush(BlockDriverState *bs,
                                 BlockDriverCompletionFunc *cb, void *opaque);
-BlockDriverAIOCB *bdrv_aio_discard(BlockDriverState *bs,
-                                   int64_t sector_num, int nb_sectors,
-                                   BlockDriverCompletionFunc *cb, void *opaque);
 void bdrv_aio_cancel(BlockDriverAIOCB *acb);

 typedef struct BlockRequest {
@@ -197,18 +143,12 @@ BlockDriverAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
        unsigned long int req, void *buf,
        BlockDriverCompletionFunc *cb, void *opaque);

-/* Invalidate any cached metadata used by image formats */
-void bdrv_invalidate_cache(BlockDriverState *bs);
-void bdrv_invalidate_cache_all(void);
-
 /* Ensure contents are flushed to disk.  */
 int bdrv_flush(BlockDriverState *bs);
-int coroutine_fn bdrv_co_flush(BlockDriverState *bs);
 void bdrv_flush_all(void);
 void bdrv_close_all(void);

 int bdrv_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
-int bdrv_co_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
 int bdrv_has_zero_init(BlockDriverState *bs);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
                      int *pnum);
@@ -238,13 +178,19 @@ int bdrv_get_translation_hint(BlockDriverState *bs);
 void bdrv_set_on_error(BlockDriverState *bs, BlockErrorAction on_read_error,
                       BlockErrorAction on_write_error);
 BlockErrorAction bdrv_get_on_error(BlockDriverState *bs, int is_read);
+void bdrv_set_removable(BlockDriverState *bs, int removable);
+int bdrv_is_removable(BlockDriverState *bs);
 int bdrv_is_read_only(BlockDriverState *bs);
 int bdrv_is_sg(BlockDriverState *bs);
 int bdrv_enable_write_cache(BlockDriverState *bs);
 int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
-void bdrv_lock_medium(BlockDriverState *bs, bool locked);
-void bdrv_eject(BlockDriverState *bs, int eject_flag);
+int bdrv_is_locked(BlockDriverState *bs);
+void bdrv_set_locked(BlockDriverState *bs, int locked);
+int bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_set_change_cb(BlockDriverState *bs,
+                        void (*change_cb)(void *opaque, int reason),
+                        void *opaque);
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
 BlockDriverState *bdrv_find(const char *name);
 BlockDriverState *bdrv_next(BlockDriverState *bs);
@@ -294,9 +240,6 @@ int bdrv_img_create(const char *filename, const char *fmt,
                    const char *base_filename, const char *base_fmt,
                    char *options, uint64_t img_size, int flags);

-void bdrv_set_buffer_alignment(BlockDriverState *bs, int align);
-void *qemu_blockalign(BlockDriverState *bs, size_t size);
-
 #define BDRV_SECTORS_PER_DIRTY_CHUNK 2048

 void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
@@ -308,23 +251,6 @@ int64_t bdrv_get_dirty_count(BlockDriverState *bs);
 void bdrv_set_in_use(BlockDriverState *bs, int in_use);
 int bdrv_in_use(BlockDriverState *bs);

-enum BlockAcctType {
-    BDRV_ACCT_READ,
-    BDRV_ACCT_WRITE,
-    BDRV_ACCT_FLUSH,
-    BDRV_MAX_IOTYPE,
-};
-
-typedef struct BlockAcctCookie {
-    int64_t bytes;
-    int64_t start_time_ns;
-    enum BlockAcctType type;
-} BlockAcctCookie;
-
-void bdrv_acct_start(BlockDriverState *bs, BlockAcctCookie *cookie,
-        int64_t bytes, enum BlockAcctType type);
-void bdrv_acct_done(BlockDriverState *bs, BlockAcctCookie *cookie);
-
 typedef enum {
    BLKDBG_L1_UPDATE,

@@ -376,43 +302,4 @@ typedef enum {
 #define BLKDBG_EVENT(bs, evt) bdrv_debug_event(bs, evt)
 void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event);

-
-/* Convenience for block device models */
-
-typedef struct BlockConf {
-    BlockDriverState *bs;
-    uint16_t physical_block_size;
-    uint16_t logical_block_size;
-    uint16_t min_io_size;
-    uint32_t opt_io_size;
-    int32_t bootindex;
-    uint32_t discard_granularity;
-} BlockConf;
-
-static inline unsigned int get_physical_block_exp(BlockConf *conf)
-{
-    unsigned int exp = 0, size;
-
-    for (size = conf->physical_block_size;
-        size > conf->logical_block_size;
-        size >>= 1) {
-        exp++;
-    }
-
-    return exp;
-}
-
-#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
-    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
-    DEFINE_PROP_UINT16("logical_block_size", _state,                    \
-                       _conf.logical_block_size, 512),                  \
-    DEFINE_PROP_UINT16("physical_block_size", _state,                   \
-                       _conf.physical_block_size, 512),                 \
-    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
-    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
-    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
-    DEFINE_PROP_UINT32("discard_granularity", _state, \
-                       _conf.discard_granularity, 0)
-
 #endif
-
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -214,7 +214,7 @@ static int add_rule(QemuOpts *opts, void *opaque)
    }

    /* Set attributes common for all actions */
-    rule = g_malloc0(sizeof(*rule));
+    rule = qemu_mallocz(sizeof(*rule));
    *rule = (struct BlkdebugRule) {
        .event  = event,
        .action = d->action,
@@ -392,11 +392,16 @@ static void blkdebug_close(BlockDriverState *bs)
    for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
            QLIST_REMOVE(rule, next);
-            g_free(rule);
+            qemu_free(rule);
        }
    }
 }

+static int blkdebug_flush(BlockDriverState *bs)
+{
+    return bdrv_flush(bs->file);
+}
+
 static BlockDriverAIOCB *blkdebug_aio_flush(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
@@ -449,6 +454,7 @@ static BlockDriver bdrv_blkdebug = {

    .bdrv_file_open     = blkdebug_open,
    .bdrv_close         = blkdebug_close,
+    .bdrv_flush         = blkdebug_flush,

    .bdrv_aio_readv     = blkdebug_aio_readv,
    .bdrv_aio_writev    = blkdebug_aio_writev,
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -116,6 +116,14 @@ static void blkverify_close(BlockDriverState *bs)
    s->test_file = NULL;
 }

+static int blkverify_flush(BlockDriverState *bs)
+{
+    BDRVBlkverifyState *s = bs->opaque;
+
+    /* Only flush test file, the raw file is not important */
+    return bdrv_flush(s->test_file);
+}
+
 static int64_t blkverify_getlength(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;
@@ -360,6 +368,7 @@ static BlockDriver bdrv_blkverify = {

    .bdrv_file_open     = blkverify_open,
    .bdrv_close         = blkverify_close,
+    .bdrv_flush         = blkverify_flush,

    .bdrv_aio_readv     = blkverify_aio_readv,
    .bdrv_aio_writev    = blkverify_aio_writev,
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -80,7 +80,6 @@ struct bochs_header {
 };

 typedef struct BDRVBochsState {
-    CoMutex lock;
    uint32_t *catalog_bitmap;
    int catalog_size;

@@ -137,7 +136,7 @@ static int bochs_open(BlockDriverState *bs, int flags)
    }

    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
-    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
    if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                   s->catalog_size * 4) != s->catalog_size * 4)
 	goto fail;
@@ -151,7 +150,6 @@ static int bochs_open(BlockDriverState *bs, int flags)

    s->extent_size = le32_to_cpu(bochs.extra.redolog.extent);

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -209,21 +207,10 @@ static int bochs_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int bochs_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVBochsState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = bochs_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void bochs_close(BlockDriverState *bs)
 {
    BDRVBochsState *s = bs->opaque;
-    g_free(s->catalog_bitmap);
+    qemu_free(s->catalog_bitmap);
 }

 static BlockDriver bdrv_bochs = {
@@ -231,7 +218,7 @@ static BlockDriver bdrv_bochs = {
    .instance_size	= sizeof(BDRVBochsState),
    .bdrv_probe		= bochs_probe,
    .bdrv_open		= bochs_open,
-    .bdrv_read          = bochs_co_read,
+    .bdrv_read		= bochs_read,
    .bdrv_close		= bochs_close,
 };

--- a/block/cloop.c
+++ b/block/cloop.c
@@ -27,10 +27,9 @@
 #include <zlib.h>

 typedef struct BDRVCloopState {
-    CoMutex lock;
    uint32_t block_size;
    uint32_t n_blocks;
-    uint64_t *offsets;
+    uint64_t* offsets;
    uint32_t sectors_per_block;
    uint32_t current_block;
    uint8_t *compressed_block;
@@ -40,23 +39,21 @@ typedef struct BDRVCloopState {

 static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
-    const char *magic_version_2_0 = "#!/bin/sh\n"
-        "#V2.0 Format\n"
-        "modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
-    int length = strlen(magic_version_2_0);
-    if (length > buf_size) {
-        length = buf_size;
-    }
-    if (!memcmp(magic_version_2_0, buf, length)) {
-        return 2;
-    }
+    const char* magic_version_2_0="#!/bin/sh\n"
+	"#V2.0 Format\n"
+	"modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
+    int length=strlen(magic_version_2_0);
+    if(length>buf_size)
+	length=buf_size;
+    if(!memcmp(magic_version_2_0,buf,length))
+	return 2;
    return 0;
 }

 static int cloop_open(BlockDriverState *bs, int flags)
 {
    BDRVCloopState *s = bs->opaque;
-    uint32_t offsets_size, max_compressed_block_size = 1, i;
+    uint32_t offsets_size,max_compressed_block_size=1,i;

    bs->read_only = 1;

@@ -73,32 +70,29 @@ static int cloop_open(BlockDriverState *bs, int flags)

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
-    s->offsets = g_malloc(offsets_size);
+    s->offsets = qemu_malloc(offsets_size);
    if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
            offsets_size) {
-        goto cloop_close;
+	goto cloop_close;
    }
    for(i=0;i<s->n_blocks;i++) {
-        s->offsets[i] = be64_to_cpu(s->offsets[i]);
-        if (i > 0) {
-            uint32_t size = s->offsets[i] - s->offsets[i - 1];
-            if (size > max_compressed_block_size) {
-                max_compressed_block_size = size;
-            }
-        }
+	s->offsets[i]=be64_to_cpu(s->offsets[i]);
+	if(i>0) {
+	    uint32_t size=s->offsets[i]-s->offsets[i-1];
+	    if(size>max_compressed_block_size)
+		max_compressed_block_size=size;
+	}
    }

    /* initialize zlib engine */
-    s->compressed_block = g_malloc(max_compressed_block_size + 1);
-    s->uncompressed_block = g_malloc(s->block_size);
-    if (inflateInit(&s->zstream) != Z_OK) {
-        goto cloop_close;
-    }
-    s->current_block = s->n_blocks;
+    s->compressed_block = qemu_malloc(max_compressed_block_size+1);
+    s->uncompressed_block = qemu_malloc(s->block_size);
+    if(inflateInit(&s->zstream) != Z_OK)
+	goto cloop_close;
+    s->current_block=s->n_blocks;

    s->sectors_per_block = s->block_size/512;
-    bs->total_sectors = s->n_blocks * s->sectors_per_block;
-    qemu_co_mutex_init(&s->lock);
+    bs->total_sectors = s->n_blocks*s->sectors_per_block;
    return 0;

 cloop_close:
@@ -109,30 +103,27 @@ static inline int cloop_read_block(BlockDriverState *bs, int block_num)
 {
    BDRVCloopState *s = bs->opaque;

-    if (s->current_block != block_num) {
-        int ret;
-        uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
+    if(s->current_block != block_num) {
+	int ret;
+        uint32_t bytes = s->offsets[block_num+1]-s->offsets[block_num];

        ret = bdrv_pread(bs->file, s->offsets[block_num], s->compressed_block,
                         bytes);
-        if (ret != bytes) {
+        if (ret != bytes)
            return -1;
-        }

-        s->zstream.next_in = s->compressed_block;
-        s->zstream.avail_in = bytes;
-        s->zstream.next_out = s->uncompressed_block;
-        s->zstream.avail_out = s->block_size;
-        ret = inflateReset(&s->zstream);
-        if (ret != Z_OK) {
-            return -1;
-        }
-        ret = inflate(&s->zstream, Z_FINISH);
-        if (ret != Z_STREAM_END || s->zstream.total_out != s->block_size) {
-            return -1;
-        }
+	s->zstream.next_in = s->compressed_block;
+	s->zstream.avail_in = bytes;
+	s->zstream.next_out = s->uncompressed_block;
+	s->zstream.avail_out = s->block_size;
+	ret = inflateReset(&s->zstream);
+	if(ret != Z_OK)
+	    return -1;
+	ret = inflate(&s->zstream, Z_FINISH);
+	if(ret != Z_STREAM_END || s->zstream.total_out != s->block_size)
+	    return -1;

-        s->current_block = block_num;
+	s->current_block = block_num;
    }
    return 0;
 }
@@ -143,48 +134,33 @@ static int cloop_read(BlockDriverState *bs, int64_t sector_num,
    BDRVCloopState *s = bs->opaque;
    int i;

-    for (i = 0; i < nb_sectors; i++) {
-        uint32_t sector_offset_in_block =
-            ((sector_num + i) % s->sectors_per_block),
-            block_num = (sector_num + i) / s->sectors_per_block;
-        if (cloop_read_block(bs, block_num) != 0) {
-            return -1;
-        }
-        memcpy(buf + i * 512,
-            s->uncompressed_block + sector_offset_in_block * 512, 512);
+    for(i=0;i<nb_sectors;i++) {
+	uint32_t sector_offset_in_block=((sector_num+i)%s->sectors_per_block),
+	    block_num=(sector_num+i)/s->sectors_per_block;
+	if(cloop_read_block(bs, block_num) != 0)
+	    return -1;
+	memcpy(buf+i*512,s->uncompressed_block+sector_offset_in_block*512,512);
    }
    return 0;
 }

-static coroutine_fn int cloop_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCloopState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cloop_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void cloop_close(BlockDriverState *bs)
 {
    BDRVCloopState *s = bs->opaque;
-    if (s->n_blocks > 0) {
-        g_free(s->offsets);
-    }
-    g_free(s->compressed_block);
-    g_free(s->uncompressed_block);
+    if(s->n_blocks>0)
+	free(s->offsets);
+    free(s->compressed_block);
+    free(s->uncompressed_block);
    inflateEnd(&s->zstream);
 }

 static BlockDriver bdrv_cloop = {
-    .format_name    = "cloop",
-    .instance_size  = sizeof(BDRVCloopState),
-    .bdrv_probe     = cloop_probe,
-    .bdrv_open      = cloop_open,
-    .bdrv_read      = cloop_co_read,
-    .bdrv_close     = cloop_close,
+    .format_name	= "cloop",
+    .instance_size	= sizeof(BDRVCloopState),
+    .bdrv_probe		= cloop_probe,
+    .bdrv_open		= cloop_open,
+    .bdrv_read		= cloop_read,
+    .bdrv_close		= cloop_close,
 };

 static void bdrv_cloop_init(void)
--- a/block/cow.c
+++ b/block/cow.c
@@ -42,7 +42,6 @@ struct cow_header_v2 {
 };

 typedef struct BDRVCowState {
-    CoMutex lock;
    int64_t cow_sectors_offset;
 } BDRVCowState;

@@ -85,7 +84,6 @@ static int cow_open(BlockDriverState *bs, int flags)

    bitmap_size = ((bs->total_sectors + 7) >> 3) + sizeof(cow_header);
    s->cow_sectors_offset = (bitmap_size + 511) & ~511;
-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -201,17 +199,6 @@ static int cow_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int cow_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCowState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cow_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int cow_write(BlockDriverState *bs, int64_t sector_num,
                     const uint8_t *buf, int nb_sectors)
 {
@@ -226,17 +213,6 @@ static int cow_write(BlockDriverState *bs, int64_t sector_num,
    return cow_update_bitmap(bs, sector_num, nb_sectors);
 }

-static coroutine_fn int cow_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCowState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cow_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void cow_close(BlockDriverState *bs)
 {
 }
@@ -306,9 +282,9 @@ exit:
    return ret;
 }

-static coroutine_fn int cow_co_flush(BlockDriverState *bs)
+static int cow_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }

 static QEMUOptionParameter cow_create_options[] = {
@@ -326,18 +302,16 @@ static QEMUOptionParameter cow_create_options[] = {
 };

 static BlockDriver bdrv_cow = {
-    .format_name    = "cow",
-    .instance_size  = sizeof(BDRVCowState),
-
-    .bdrv_probe     = cow_probe,
-    .bdrv_open      = cow_open,
-    .bdrv_close     = cow_close,
-    .bdrv_create    = cow_create,
-
-    .bdrv_read              = cow_co_read,
-    .bdrv_write             = cow_co_write,
-    .bdrv_co_flush_to_disk  = cow_co_flush,
-    .bdrv_is_allocated      = cow_is_allocated,
+    .format_name	= "cow",
+    .instance_size	= sizeof(BDRVCowState),
+    .bdrv_probe		= cow_probe,
+    .bdrv_open		= cow_open,
+    .bdrv_read		= cow_read,
+    .bdrv_write		= cow_write,
+    .bdrv_close		= cow_close,
+    .bdrv_create	= cow_create,
+    .bdrv_flush		= cow_flush,
+    .bdrv_is_allocated	= cow_is_allocated,

    .create_options = cow_create_options,
 };
--- a/block/curl.c
+++ b/block/curl.c
@@ -47,12 +47,7 @@ struct BDRVCURLState;

 typedef struct CURLAIOCB {
    BlockDriverAIOCB common;
-    QEMUBH *bh;
    QEMUIOVector *qiov;
-
-    int64_t sector_num;
-    int nb_sectors;
-
    size_t start;
    size_t end;
 } CURLAIOCB;
@@ -81,7 +76,6 @@ typedef struct BDRVCURLState {

 static void curl_clean_state(CURLState *s);
 static void curl_multi_do(void *arg);
-static int curl_aio_flush(void *opaque);

 static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
                        void *s, void *sp)
@@ -89,16 +83,14 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, curl_aio_flush,
-                                    NULL, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, NULL, NULL, s);
            break;
        case CURL_POLL_OUT:
-            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, curl_aio_flush,
-                                    NULL, s);
+            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, NULL, NULL, s);
            break;
        case CURL_POLL_INOUT:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, curl_multi_do,
-                                    curl_aio_flush, NULL, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_do,
+                                    curl_multi_do, NULL, NULL, s);
            break;
        case CURL_POLL_REMOVE:
            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL, NULL, NULL);
@@ -237,23 +229,6 @@ static void curl_multi_do(void *arg)
            {
                CURLState *state = NULL;
                curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, (char**)&state);
-
-                /* ACBs for successful messages get completed in curl_read_cb */
-                if (msg->data.result != CURLE_OK) {
-                    int i;
-                    for (i = 0; i < CURL_NUM_ACB; i++) {
-                        CURLAIOCB *acb = state->acb[i];
-
-                        if (acb == NULL) {
-                            continue;
-                        }
-
-                        acb->common.cb(acb->common.opaque, -EIO);
-                        qemu_aio_release(acb);
-                        state->acb[i] = NULL;
-                    }
-                }
-
                curl_clean_state(state);
                break;
            }
@@ -302,8 +277,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
    curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
    curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
-    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
-
+    
 #ifdef DEBUG_VERBOSE
    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
@@ -336,7 +310,7 @@ static int curl_open(BlockDriverState *bs, const char *filename, int flags)

    static int inited = 0;

-    file = g_strdup(filename);
+    file = qemu_strdup(filename);
    s->readahead_size = READ_AHEAD_SIZE;

    /* Parse a trailing ":readahead=#:" param, if present. */
@@ -416,25 +390,10 @@ out:
    curl_easy_cleanup(state->curl);
    state->curl = NULL;
 out_noclean:
-    g_free(file);
+    qemu_free(file);
    return -EINVAL;
 }

-static int curl_aio_flush(void *opaque)
-{
-    BDRVCURLState *s = opaque;
-    int i, j;
-
-    for (i=0; i < CURL_NUM_STATES; i++) {
-        for(j=0; j < CURL_NUM_ACB; j++) {
-            if (s->states[i].acb[j]) {
-                return 1;
-            }
-        }
-    }
-    return 0;
-}
-
 static void curl_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    // Do we have to implement canceling? Seems to work without...
@@ -445,86 +404,61 @@ static AIOPool curl_aio_pool = {
    .cancel             = curl_aio_cancel,
 };

-
-static void curl_readv_bh_cb(void *p)
+static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
 {
+    BDRVCURLState *s = bs->opaque;
+    CURLAIOCB *acb;
+    size_t start = sector_num * SECTOR_SIZE;
+    size_t end;
    CURLState *state;

-    CURLAIOCB *acb = p;
-    BDRVCURLState *s = acb->common.bs->opaque;
+    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;

-    qemu_bh_delete(acb->bh);
-    acb->bh = NULL;
-
-    size_t start = acb->sector_num * SECTOR_SIZE;
-    size_t end;
+    acb->qiov = qiov;

    // In case we have the requested data already (e.g. read-ahead),
    // we can just call the callback and be done.
-    switch (curl_find_buf(s, start, acb->nb_sectors * SECTOR_SIZE, acb)) {
+
+    switch (curl_find_buf(s, start, nb_sectors * SECTOR_SIZE, acb)) {
        case FIND_RET_OK:
            qemu_aio_release(acb);
            // fall through
        case FIND_RET_WAIT:
-            return;
+            return &acb->common;
        default:
            break;
    }

    // No cache found, so let's start a new request
+
    state = curl_init_state(s);
-    if (!state) {
-        acb->common.cb(acb->common.opaque, -EIO);
-        qemu_aio_release(acb);
-        return;
-    }
+    if (!state)
+        return NULL;

    acb->start = 0;
-    acb->end = (acb->nb_sectors * SECTOR_SIZE);
+    acb->end = (nb_sectors * SECTOR_SIZE);

    state->buf_off = 0;
    if (state->orig_buf)
-        g_free(state->orig_buf);
+        qemu_free(state->orig_buf);
    state->buf_start = start;
    state->buf_len = acb->end + s->readahead_size;
    end = MIN(start + state->buf_len, s->len) - 1;
-    state->orig_buf = g_malloc(state->buf_len);
+    state->orig_buf = qemu_malloc(state->buf_len);
    state->acb[0] = acb;

    snprintf(state->range, 127, "%zd-%zd", start, end);
    DPRINTF("CURL (AIO): Reading %d at %zd (%s)\n",
-            (acb->nb_sectors * SECTOR_SIZE), start, state->range);
+            (nb_sectors * SECTOR_SIZE), start, state->range);
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
    curl_multi_do(s);

-}
-
-static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    CURLAIOCB *acb;
-
-    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
-
-    if (!acb) {
-        return NULL;
-    }
-
-    acb->qiov = qiov;
-    acb->sector_num = sector_num;
-    acb->nb_sectors = nb_sectors;
-
-    acb->bh = qemu_bh_new(curl_readv_bh_cb, acb);
-
-    if (!acb->bh) {
-        DPRINTF("CURL: qemu_bh_new failed\n");
-        return NULL;
-    }
-
-    qemu_bh_schedule(acb->bh);
    return &acb->common;
 }

@@ -542,7 +476,7 @@ static void curl_close(BlockDriverState *bs)
            s->states[i].curl = NULL;
        }
        if (s->states[i].orig_buf) {
-            g_free(s->states[i].orig_buf);
+            qemu_free(s->states[i].orig_buf);
            s->states[i].orig_buf = NULL;
        }
    }
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -28,7 +28,6 @@
 #include <zlib.h>

 typedef struct BDRVDMGState {
-    CoMutex lock;
    /* each chunk contains a certain number of sectors,
     * offsets[i] is the offset in the .dmg file,
     * lengths[i] is the length of the compressed chunk,
@@ -128,11 +127,11 @@ static int dmg_open(BlockDriverState *bs, int flags)

 	    chunk_count = (count-204)/40;
 	    new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
-	    s->types = g_realloc(s->types, new_size/2);
-	    s->offsets = g_realloc(s->offsets, new_size);
-	    s->lengths = g_realloc(s->lengths, new_size);
-	    s->sectors = g_realloc(s->sectors, new_size);
-	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);
+	    s->types = qemu_realloc(s->types, new_size/2);
+	    s->offsets = qemu_realloc(s->offsets, new_size);
+	    s->lengths = qemu_realloc(s->lengths, new_size);
+	    s->sectors = qemu_realloc(s->sectors, new_size);
+	    s->sectorcounts = qemu_realloc(s->sectorcounts, new_size);

 	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
 		s->types[i] = read_uint32(bs, offset);
@@ -171,14 +170,13 @@ static int dmg_open(BlockDriverState *bs, int flags)
    }

    /* initialize zlib engine */
-    s->compressed_chunk = g_malloc(max_compressed_size+1);
-    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
+    s->compressed_chunk = qemu_malloc(max_compressed_size+1);
+    s->uncompressed_chunk = qemu_malloc(512*max_sectors_per_chunk);
    if(inflateInit(&s->zstream) != Z_OK)
 	goto fail;

    s->current_chunk = s->n_chunks;

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -282,17 +280,6 @@ static int dmg_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVDMGState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = dmg_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void dmg_close(BlockDriverState *bs)
 {
    BDRVDMGState *s = bs->opaque;
@@ -313,7 +300,7 @@ static BlockDriver bdrv_dmg = {
    .instance_size	= sizeof(BDRVDMGState),
    .bdrv_probe		= dmg_probe,
    .bdrv_open		= dmg_open,
-    .bdrv_read          = dmg_co_read,
+    .bdrv_read		= dmg_read,
    .bdrv_close		= dmg_close,
 };

--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1,591 +0,0 @@
-/*
- * QEMU Block driver for iSCSI images
- *
- * Copyright (c) 2010-2011 Ronnie Sahlberg <ronniesahlberg@gmail.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "config-host.h"
-
-#include <poll.h>
-#include "qemu-common.h"
-#include "qemu-error.h"
-#include "block_int.h"
-#include "trace.h"
-
-#include <iscsi/iscsi.h>
-#include <iscsi/scsi-lowlevel.h>
-
-
-typedef struct IscsiLun {
-    struct iscsi_context *iscsi;
-    int lun;
-    int block_size;
-    unsigned long num_blocks;
-} IscsiLun;
-
-typedef struct IscsiAIOCB {
-    BlockDriverAIOCB common;
-    QEMUIOVector *qiov;
-    QEMUBH *bh;
-    IscsiLun *iscsilun;
-    struct scsi_task *task;
-    uint8_t *buf;
-    int status;
-    int canceled;
-    size_t read_size;
-    size_t read_offset;
-} IscsiAIOCB;
-
-struct IscsiTask {
-    IscsiLun *iscsilun;
-    BlockDriverState *bs;
-    int status;
-    int complete;
-};
-
-static void
-iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
-                    void *private_data)
-{
-}
-
-static void
-iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-    IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
-    IscsiLun *iscsilun = acb->iscsilun;
-
-    acb->common.cb(acb->common.opaque, -ECANCELED);
-    acb->canceled = 1;
-
-    /* send a task mgmt call to the target to cancel the task on the target */
-    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
-                                     iscsi_abort_task_cb, NULL);
-
-    /* then also cancel the task locally in libiscsi */
-    iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task);
-}
-
-static AIOPool iscsi_aio_pool = {
-    .aiocb_size         = sizeof(IscsiAIOCB),
-    .cancel             = iscsi_aio_cancel,
-};
-
-
-static void iscsi_process_read(void *arg);
-static void iscsi_process_write(void *arg);
-
-static int iscsi_process_flush(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-
-    return iscsi_queue_length(iscsilun->iscsi) > 0;
-}
-
-static void
-iscsi_set_events(IscsiLun *iscsilun)
-{
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), iscsi_process_read,
-                           (iscsi_which_events(iscsi) & POLLOUT)
-                           ? iscsi_process_write : NULL,
-                           iscsi_process_flush, NULL, iscsilun);
-}
-
-static void
-iscsi_process_read(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    iscsi_service(iscsi, POLLIN);
-    iscsi_set_events(iscsilun);
-}
-
-static void
-iscsi_process_write(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    iscsi_service(iscsi, POLLOUT);
-    iscsi_set_events(iscsilun);
-}
-
-
-static int
-iscsi_schedule_bh(QEMUBHFunc *cb, IscsiAIOCB *acb)
-{
-    acb->bh = qemu_bh_new(cb, acb);
-    if (!acb->bh) {
-        error_report("oom: could not create iscsi bh");
-        return -EIO;
-    }
-
-    qemu_bh_schedule(acb->bh);
-    return 0;
-}
-
-static void
-iscsi_readv_writev_bh_cb(void *p)
-{
-    IscsiAIOCB *acb = p;
-
-    qemu_bh_delete(acb->bh);
-
-    if (acb->canceled == 0) {
-        acb->common.cb(acb->common.opaque, acb->status);
-    }
-
-    qemu_aio_release(acb);
-}
-
-
-static void
-iscsi_aio_write10_cb(struct iscsi_context *iscsi, int status,
-                     void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    trace_iscsi_aio_write10_cb(iscsi, status, acb, acb->canceled);
-
-    g_free(acb->buf);
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status < 0) {
-        error_report("Failed to write10 data to iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
-{
-    return sector * BDRV_SECTOR_SIZE / iscsilun->block_size;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
-                 QEMUIOVector *qiov, int nb_sectors,
-                 BlockDriverCompletionFunc *cb,
-                 void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-    size_t size;
-    int fua = 0;
-
-    /* set FUA on writes when cache mode is write through */
-    if (!(bs->open_flags & BDRV_O_CACHE_WB)) {
-        fua = 1;
-    }
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-    trace_iscsi_aio_writev(iscsi, sector_num, nb_sectors, opaque, acb);
-
-    acb->iscsilun = iscsilun;
-    acb->qiov     = qiov;
-
-    acb->canceled   = 0;
-
-    /* XXX we should pass the iovec to write10 to avoid the extra copy */
-    /* this will allow us to get rid of 'buf' completely */
-    size = nb_sectors * BDRV_SECTOR_SIZE;
-    acb->buf = g_malloc(size);
-    qemu_iovec_to_buffer(acb->qiov, acb->buf);
-    acb->task = iscsi_write10_task(iscsi, iscsilun->lun, acb->buf, size,
-                              sector_qemu2lun(sector_num, iscsilun),
-                              fua, 0, iscsilun->block_size,
-                              iscsi_aio_write10_cb, acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send write10 command. %s",
-                     iscsi_get_error(iscsi));
-        g_free(acb->buf);
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-static void
-iscsi_aio_read10_cb(struct iscsi_context *iscsi, int status,
-                    void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    trace_iscsi_aio_read10_cb(iscsi, status, acb, acb->canceled);
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status != 0) {
-        error_report("Failed to read10 data from iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
-                QEMUIOVector *qiov, int nb_sectors,
-                BlockDriverCompletionFunc *cb,
-                void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-    size_t qemu_read_size, lun_read_size;
-    int i;
-
-    qemu_read_size = BDRV_SECTOR_SIZE * (size_t)nb_sectors;
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-    trace_iscsi_aio_readv(iscsi, sector_num, nb_sectors, opaque, acb);
-
-    acb->iscsilun = iscsilun;
-    acb->qiov     = qiov;
-
-    acb->canceled    = 0;
-    acb->read_size   = qemu_read_size;
-    acb->buf         = NULL;
-
-    /* If LUN blocksize is bigger than BDRV_BLOCK_SIZE a read from QEMU
-     * may be misaligned to the LUN, so we may need to read some extra
-     * data.
-     */
-    acb->read_offset = 0;
-    if (iscsilun->block_size > BDRV_SECTOR_SIZE) {
-        uint64_t bdrv_offset = BDRV_SECTOR_SIZE * sector_num;
-
-        acb->read_offset  = bdrv_offset % iscsilun->block_size;
-    }
-
-    lun_read_size  = (qemu_read_size + iscsilun->block_size
-                     + acb->read_offset - 1)
-                     / iscsilun->block_size * iscsilun->block_size;
-    acb->task = iscsi_read10_task(iscsi, iscsilun->lun,
-                             sector_qemu2lun(sector_num, iscsilun),
-                             lun_read_size, iscsilun->block_size,
-                             iscsi_aio_read10_cb, acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send read10 command. %s",
-                     iscsi_get_error(iscsi));
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    for (i = 0; i < acb->qiov->niov; i++) {
-        scsi_task_add_data_in_buffer(acb->task,
-                acb->qiov->iov[i].iov_len,
-                acb->qiov->iov[i].iov_base);
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-
-static void
-iscsi_synccache10_cb(struct iscsi_context *iscsi, int status,
-                     void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status < 0) {
-        error_report("Failed to sync10 data on iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_flush(BlockDriverState *bs,
-                BlockDriverCompletionFunc *cb, void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-
-    acb->iscsilun = iscsilun;
-    acb->canceled   = 0;
-
-    acb->task = iscsi_synchronizecache10_task(iscsi, iscsilun->lun,
-                                         0, 0, 0, 0,
-                                         iscsi_synccache10_cb,
-                                         acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send synchronizecache10 command. %s",
-                     iscsi_get_error(iscsi));
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-static int64_t
-iscsi_getlength(BlockDriverState *bs)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    int64_t len;
-
-    len  = iscsilun->num_blocks;
-    len *= iscsilun->block_size;
-
-    return len;
-}
-
-static void
-iscsi_readcapacity10_cb(struct iscsi_context *iscsi, int status,
-                        void *command_data, void *opaque)
-{
-    struct IscsiTask *itask = opaque;
-    struct scsi_readcapacity10 *rc10;
-    struct scsi_task *task = command_data;
-
-    if (status != 0) {
-        error_report("iSCSI: Failed to read capacity of iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        itask->status   = 1;
-        itask->complete = 1;
-        scsi_free_scsi_task(task);
-        return;
-    }
-
-    rc10 = scsi_datain_unmarshall(task);
-    if (rc10 == NULL) {
-        error_report("iSCSI: Failed to unmarshall readcapacity10 data.");
-        itask->status   = 1;
-        itask->complete = 1;
-        scsi_free_scsi_task(task);
-        return;
-    }
-
-    itask->iscsilun->block_size = rc10->block_size;
-    itask->iscsilun->num_blocks = rc10->lba;
-    itask->bs->total_sectors = (uint64_t)rc10->lba *
-                               rc10->block_size / BDRV_SECTOR_SIZE ;
-
-    itask->status   = 0;
-    itask->complete = 1;
-    scsi_free_scsi_task(task);
-}
-
-
-static void
-iscsi_connect_cb(struct iscsi_context *iscsi, int status, void *command_data,
-                 void *opaque)
-{
-    struct IscsiTask *itask = opaque;
-    struct scsi_task *task;
-
-    if (status != 0) {
-        itask->status   = 1;
-        itask->complete = 1;
-        return;
-    }
-
-    task = iscsi_readcapacity10_task(iscsi, itask->iscsilun->lun, 0, 0,
-                                   iscsi_readcapacity10_cb, opaque);
-    if (task == NULL) {
-        error_report("iSCSI: failed to send readcapacity command.");
-        itask->status   = 1;
-        itask->complete = 1;
-        return;
-    }
-}
-
-/*
- * We support iscsi url's on the form
- * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
- */
-static int iscsi_open(BlockDriverState *bs, const char *filename, int flags)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = NULL;
-    struct iscsi_url *iscsi_url = NULL;
-    struct IscsiTask task;
-    int ret;
-
-    if ((BDRV_SECTOR_SIZE % 512) != 0) {
-        error_report("iSCSI: Invalid BDRV_SECTOR_SIZE. "
-                     "BDRV_SECTOR_SIZE(%lld) is not a multiple "
-                     "of 512", BDRV_SECTOR_SIZE);
-        return -EINVAL;
-    }
-
-    memset(iscsilun, 0, sizeof(IscsiLun));
-
-    /* Should really append the KVM name after the ':' here */
-    iscsi = iscsi_create_context("iqn.2008-11.org.linux-kvm:");
-    if (iscsi == NULL) {
-        error_report("iSCSI: Failed to create iSCSI context.");
-        ret = -ENOMEM;
-        goto failed;
-    }
-
-    iscsi_url = iscsi_parse_full_url(iscsi, filename);
-    if (iscsi_url == NULL) {
-        error_report("Failed to parse URL : %s %s", filename,
-                     iscsi_get_error(iscsi));
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_set_targetname(iscsi, iscsi_url->target)) {
-        error_report("iSCSI: Failed to set target name.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_url->user != NULL) {
-        ret = iscsi_set_initiator_username_pwd(iscsi, iscsi_url->user,
-                                              iscsi_url->passwd);
-        if (ret != 0) {
-            error_report("Failed to set initiator username and password");
-            ret = -EINVAL;
-            goto failed;
-        }
-    }
-    if (iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL) != 0) {
-        error_report("iSCSI: Failed to set session type to normal.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C);
-
-    task.iscsilun = iscsilun;
-    task.status = 0;
-    task.complete = 0;
-    task.bs = bs;
-
-    iscsilun->iscsi = iscsi;
-    iscsilun->lun   = iscsi_url->lun;
-
-    if (iscsi_full_connect_async(iscsi, iscsi_url->portal, iscsi_url->lun,
-                                 iscsi_connect_cb, &task)
-        != 0) {
-        error_report("iSCSI: Failed to start async connect.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    while (!task.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_aio_wait();
-    }
-    if (task.status != 0) {
-        error_report("iSCSI: Failed to connect to LUN : %s",
-                     iscsi_get_error(iscsi));
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_url != NULL) {
-        iscsi_destroy_url(iscsi_url);
-    }
-    return 0;
-
-failed:
-    if (iscsi_url != NULL) {
-        iscsi_destroy_url(iscsi_url);
-    }
-    if (iscsi != NULL) {
-        iscsi_destroy_context(iscsi);
-    }
-    memset(iscsilun, 0, sizeof(IscsiLun));
-    return ret;
-}
-
-static void iscsi_close(BlockDriverState *bs)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), NULL, NULL, NULL, NULL, NULL);
-    iscsi_destroy_context(iscsi);
-    memset(iscsilun, 0, sizeof(IscsiLun));
-}
-
-static BlockDriver bdrv_iscsi = {
-    .format_name     = "iscsi",
-    .protocol_name   = "iscsi",
-
-    .instance_size   = sizeof(IscsiLun),
-    .bdrv_file_open  = iscsi_open,
-    .bdrv_close      = iscsi_close,
-
-    .bdrv_getlength  = iscsi_getlength,
-
-    .bdrv_aio_readv  = iscsi_aio_readv,
-    .bdrv_aio_writev = iscsi_aio_writev,
-    .bdrv_aio_flush  = iscsi_aio_flush,
-};
-
-static void iscsi_block_init(void)
-{
-    bdrv_register(&bdrv_iscsi);
-}
-
-block_init(iscsi_block_init);
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -28,7 +28,6 @@

 #include "qemu-common.h"
 #include "nbd.h"
-#include "block_int.h"
 #include "module.h"
 #include "qemu_socket.h"

@@ -47,9 +46,7 @@
 #endif

 typedef struct BDRVNBDState {
-    CoMutex lock;
    int sock;
-    uint32_t nbdflags;
    off_t size;
    size_t blocksize;
    char *export_name; /* An NBD server may export several devices */
@@ -68,7 +65,7 @@ static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
    const char *unixpath;
    int err = -EINVAL;

-    file = g_strdup(filename);
+    file = qemu_strdup(filename);

    export_name = strstr(file, EN_OPTSTR);
    if (export_name) {
@@ -77,7 +74,7 @@ static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
        }
        export_name[0] = 0; /* truncate 'file' */
        export_name += strlen(EN_OPTSTR);
-        s->export_name = g_strdup(export_name);
+        s->export_name = qemu_strdup(export_name);
    }

    /* extract the host_spec - fail if it's not nbd:... */
@@ -90,18 +87,18 @@ static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
        if (unixpath[0] != '/') { /* We demand  an absolute path*/
            goto out;
        }
-        s->host_spec = g_strdup(unixpath);
+        s->host_spec = qemu_strdup(unixpath);
    } else {
-        s->host_spec = g_strdup(host_spec);
+        s->host_spec = qemu_strdup(host_spec);
    }

    err = 0;

 out:
-    g_free(file);
+    qemu_free(file);
    if (err != 0) {
-        g_free(s->export_name);
-        g_free(s->host_spec);
+        qemu_free(s->export_name);
+        qemu_free(s->host_spec);
    }
    return err;
 }
@@ -113,6 +110,7 @@ static int nbd_establish_connection(BlockDriverState *bs)
    int ret;
    off_t size;
    size_t blocksize;
+    uint32_t nbdflags;

    if (s->host_spec[0] == '/') {
        sock = unix_socket_outgoing(s->host_spec);
@@ -127,7 +125,7 @@ static int nbd_establish_connection(BlockDriverState *bs)
    }

    /* NBD handshake */
-    ret = nbd_receive_negotiate(sock, s->export_name, &s->nbdflags, &size,
+    ret = nbd_receive_negotiate(sock, s->export_name, &nbdflags, &size,
                                &blocksize);
    if (ret == -1) {
        logout("Failed to negotiate with the NBD server\n");
@@ -176,7 +174,6 @@ static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
     */
    result = nbd_establish_connection(bs);

-    qemu_co_mutex_init(&s->lock);
    return result;
 }

@@ -240,33 +237,11 @@ static int nbd_write(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int nbd_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVNBDState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = nbd_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
-static coroutine_fn int nbd_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVNBDState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = nbd_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void nbd_close(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;
-    g_free(s->export_name);
-    g_free(s->host_spec);
+    qemu_free(s->export_name);
+    qemu_free(s->host_spec);

    nbd_teardown_connection(bs);
 }
@@ -282,8 +257,8 @@ static BlockDriver bdrv_nbd = {
    .format_name	= "nbd",
    .instance_size	= sizeof(BDRVNBDState),
    .bdrv_file_open	= nbd_open,
-    .bdrv_read          = nbd_co_read,
-    .bdrv_write         = nbd_co_write,
+    .bdrv_read		= nbd_read,
+    .bdrv_write		= nbd_write,
    .bdrv_close		= nbd_close,
    .bdrv_getlength	= nbd_getlength,
    .protocol_name	= "nbd",
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -43,10 +43,9 @@ struct parallels_header {
    uint32_t catalog_entries;
    uint32_t nb_sectors;
    char padding[24];
-} QEMU_PACKED;
+} __attribute__((packed));

 typedef struct BDRVParallelsState {
-    CoMutex lock;

    uint32_t *catalog_bitmap;
    int catalog_size;
@@ -89,18 +88,17 @@ static int parallels_open(BlockDriverState *bs, int flags)
    s->tracks = le32_to_cpu(ph.tracks);

    s->catalog_size = le32_to_cpu(ph.catalog_entries);
-    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
    if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
 	s->catalog_size * 4)
 	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    if (s->catalog_bitmap)
-	g_free(s->catalog_bitmap);
+	qemu_free(s->catalog_bitmap);
    return -1;
 }

@@ -136,21 +134,10 @@ static int parallels_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int parallels_co_read(BlockDriverState *bs, int64_t sector_num,
-                                          uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVParallelsState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = parallels_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void parallels_close(BlockDriverState *bs)
 {
    BDRVParallelsState *s = bs->opaque;
-    g_free(s->catalog_bitmap);
+    qemu_free(s->catalog_bitmap);
 }

 static BlockDriver bdrv_parallels = {
@@ -158,7 +145,7 @@ static BlockDriver bdrv_parallels = {
    .instance_size	= sizeof(BDRVParallelsState),
    .bdrv_probe		= parallels_probe,
    .bdrv_open		= parallels_open,
-    .bdrv_read          = parallels_co_read,
+    .bdrv_read		= parallels_read,
    .bdrv_close		= parallels_close,
 };

--- a/block/qcow.c
+++ b/block/qcow.c
@@ -26,7 +26,6 @@
 #include "module.h"
 #include <zlib.h>
 #include "aes.h"
-#include "migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -74,8 +73,6 @@ typedef struct BDRVQcowState {
    uint32_t crypt_method_header;
    AES_KEY aes_encrypt_key;
    AES_KEY aes_decrypt_key;
-    CoMutex lock;
-    Error *migration_blocker;
 } BDRVQcowState;

 static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
@@ -131,7 +128,7 @@ static int qcow_open(BlockDriverState *bs, int flags)
    s->l1_size = (header.size + (1LL << shift) - 1) >> shift;

    s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
    if (!s->l1_table)
        goto fail;
    if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
@@ -141,13 +138,13 @@ static int qcow_open(BlockDriverState *bs, int flags)
        be64_to_cpus(&s->l1_table[i]);
    }
    /* alloc L2 cache */
-    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
    if (!s->l2_cache)
        goto fail;
-    s->cluster_cache = g_malloc(s->cluster_size);
+    s->cluster_cache = qemu_malloc(s->cluster_size);
    if (!s->cluster_cache)
        goto fail;
-    s->cluster_data = g_malloc(s->cluster_size);
+    s->cluster_data = qemu_malloc(s->cluster_size);
    if (!s->cluster_data)
        goto fail;
    s->cluster_cache_offset = -1;
@@ -161,21 +158,13 @@ static int qcow_open(BlockDriverState *bs, int flags)
            goto fail;
        bs->backing_file[len] = '\0';
    }
-
-    /* Disable migration when qcow images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "qcow", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
-    qemu_co_mutex_init(&s->lock);
    return 0;

 fail:
-    g_free(s->l1_table);
-    g_free(s->l2_cache);
-    g_free(s->cluster_cache);
-    g_free(s->cluster_data);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    return -1;
 }

@@ -200,6 +189,24 @@ static int qcow_set_key(BlockDriverState *bs, const char *key)
        return -1;
    if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
        return -1;
+#if 0
+    /* test */
+    {
+        uint8_t in[16];
+        uint8_t out[16];
+        uint8_t tmp[16];
+        for(i=0;i<16;i++)
+            in[i] = i;
+        AES_encrypt(in, tmp, &s->aes_encrypt_key);
+        AES_decrypt(tmp, out, &s->aes_decrypt_key);
+        for(i = 0; i < 16; i++)
+            printf(" %02x", tmp[i]);
+        printf("\n");
+        for(i = 0; i < 16; i++)
+            printf(" %02x", out[i]);
+        printf("\n");
+    }
+#endif
    return 0;
 }

@@ -433,193 +440,364 @@ static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
    return 0;
 }

-static int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
-                         int nb_sectors, QEMUIOVector *qiov)
+#if 0
+
+static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+                     uint8_t *buf, int nb_sectors)
 {
    BDRVQcowState *s = bs->opaque;
-    int index_in_cluster;
-    int ret = 0, n;
+    int ret, index_in_cluster, n;
    uint64_t cluster_offset;
-    struct iovec hd_iov;
-    QEMUIOVector hd_qiov;
-    uint8_t *buf;
-    void *orig_buf;

-    if (qiov->niov > 1) {
-        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-    } else {
-        orig_buf = NULL;
-        buf = (uint8_t *)qiov->iov->iov_base;
-    }
-
-    qemu_co_mutex_lock(&s->lock);
-
-    while (nb_sectors != 0) {
-        /* prepare next request */
-        cluster_offset = get_cluster_offset(bs, sector_num << 9,
-                                                 0, 0, 0, 0);
+    while (nb_sectors > 0) {
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
        n = s->cluster_sectors - index_in_cluster;
-        if (n > nb_sectors) {
+        if (n > nb_sectors)
            n = nb_sectors;
-        }
-
        if (!cluster_offset) {
            if (bs->backing_hd) {
                /* read from the base image */
-                hd_iov.iov_base = (void *)buf;
-                hd_iov.iov_len = n * 512;
-                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_readv(bs->backing_hd, sector_num,
-                                    n, &hd_qiov);
-                qemu_co_mutex_lock(&s->lock);
-                if (ret < 0) {
-                    goto fail;
-                }
+                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
+                if (ret < 0)
+                    return -1;
            } else {
-                /* Note: in this case, no need to wait */
                memset(buf, 0, 512 * n);
            }
        } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
-            /* add AIO support for compressed blocks ? */
-            if (decompress_cluster(bs, cluster_offset) < 0) {
-                goto fail;
-            }
-            memcpy(buf,
-                   s->cluster_cache + index_in_cluster * 512, 512 * n);
+            if (decompress_cluster(bs, cluster_offset) < 0)
+                return -1;
+            memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
        } else {
-            if ((cluster_offset & 511) != 0) {
-                goto fail;
-            }
-            hd_iov.iov_base = (void *)buf;
-            hd_iov.iov_len = n * 512;
-            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-            qemu_co_mutex_unlock(&s->lock);
-            ret = bdrv_co_readv(bs->file,
-                                (cluster_offset >> 9) + index_in_cluster,
-                                n, &hd_qiov);
-            qemu_co_mutex_lock(&s->lock);
-            if (ret < 0) {
-                break;
-            }
+            ret = bdrv_pread(bs->file, cluster_offset + index_in_cluster * 512, buf, n * 512);
+            if (ret != n * 512)
+                return -1;
            if (s->crypt_method) {
-                encrypt_sectors(s, sector_num, buf, buf,
-                                n, 0,
+                encrypt_sectors(s, sector_num, buf, buf, n, 0,
                                &s->aes_decrypt_key);
            }
        }
-        ret = 0;
-
        nb_sectors -= n;
        sector_num += n;
        buf += n * 512;
    }
+    return 0;
+}
+#endif

-done:
-    qemu_co_mutex_unlock(&s->lock);
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    QEMUIOVector *qiov;
+    uint8_t *buf;
+    void *orig_buf;
+    int nb_sectors;
+    int n;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    struct iovec hd_iov;
+    bool is_write;
+    QEMUBH *bh;
+    QEMUIOVector hd_qiov;
+    BlockDriverAIOCB *hd_aiocb;
+} QCowAIOCB;

-    if (qiov->niov > 1) {
-        qemu_iovec_from_buffer(qiov, orig_buf, qiov->size);
-        qemu_vfree(orig_buf);
-    }
-
-    return ret;
-
-fail:
-    ret = -EIO;
-    goto done;
+static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = container_of(blockacb, QCowAIOCB, common);
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
 }

-static int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
-                          int nb_sectors, QEMUIOVector *qiov)
+static AIOPool qcow_aio_pool = {
+    .aiocb_size         = sizeof(QCowAIOCB),
+    .cancel             = qcow_aio_cancel,
+};
+
+static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque, int is_write)
 {
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(&qcow_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->qiov = qiov;
+    acb->is_write = is_write;
+
+    if (qiov->niov > 1) {
+        acb->buf = acb->orig_buf = qemu_blockalign(bs, qiov->size);
+        if (is_write)
+            qemu_iovec_to_buffer(qiov, acb->buf);
+    } else {
+        acb->buf = (uint8_t *)qiov->iov->iov_base;
+    }
+    acb->nb_sectors = nb_sectors;
+    acb->n = 0;
+    acb->cluster_offset = 0;
+    return acb;
+}
+
+static void qcow_aio_read_cb(void *opaque, int ret);
+static void qcow_aio_write_cb(void *opaque, int ret);
+
+static void qcow_aio_rw_bh(void *opaque)
+{
+    QCowAIOCB *acb = opaque;
+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+
+    if (acb->is_write) {
+        qcow_aio_write_cb(opaque, 0);
+    } else {
+        qcow_aio_read_cb(opaque, 0);
+    }
+}
+
+static int qcow_schedule_bh(QEMUBHFunc *cb, QCowAIOCB *acb)
+{
+    if (acb->bh) {
+        return -EIO;
+    }
+
+    acb->bh = qemu_bh_new(cb, acb);
+    if (!acb->bh) {
+        return -EIO;
+    }
+
+    qemu_bh_schedule(acb->bh);
+
+    return 0;
+}
+
+static void qcow_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0)
+        goto done;
+
+ redo:
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
+                            acb->n, 0,
+                            &s->aes_decrypt_key);
+        }
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    /* prepare next AIO request */
+    acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9,
+                                             0, 0, 0, 0);
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+
+    if (!acb->cluster_offset) {
+        if (bs->backing_hd) {
+            /* read from the base image */
+            acb->hd_iov.iov_base = (void *)acb->buf;
+            acb->hd_iov.iov_len = acb->n * 512;
+            qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+            acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num,
+                &acb->hd_qiov, acb->n, qcow_aio_read_cb, acb);
+            if (acb->hd_aiocb == NULL) {
+                ret = -EIO;
+                goto done;
+            }
+        } else {
+            /* Note: in this case, no need to wait */
+            memset(acb->buf, 0, 512 * acb->n);
+            goto redo;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        if (decompress_cluster(bs, acb->cluster_offset) < 0) {
+            ret = -EIO;
+            goto done;
+        }
+        memcpy(acb->buf,
+               s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
+        goto redo;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto done;
+        }
+        acb->hd_iov.iov_base = (void *)acb->buf;
+        acb->hd_iov.iov_len = acb->n * 512;
+        qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+        acb->hd_aiocb = bdrv_aio_readv(bs->file,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            &acb->hd_qiov, acb->n, qcow_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL) {
+            ret = -EIO;
+            goto done;
+        }
+    }
+
+    return;
+
+done:
+    if (acb->qiov->niov > 1) {
+        qemu_iovec_from_buffer(acb->qiov, acb->orig_buf, acb->qiov->size);
+        qemu_vfree(acb->orig_buf);
+    }
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow_aio_readv(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    QCowAIOCB *acb;
+    int ret;
+
+    acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    if (!acb)
+        return NULL;
+
+    ret = qcow_schedule_bh(qcow_aio_rw_bh, acb);
+    if (ret < 0) {
+        if (acb->qiov->niov > 1) {
+            qemu_vfree(acb->orig_buf);
+        }
+        qemu_aio_release(acb);
+        return NULL;
+    }
+
+    return &acb->common;
+}
+
+static void qcow_aio_write_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster;
    uint64_t cluster_offset;
    const uint8_t *src_buf;
-    int ret = 0, n;
-    uint8_t *cluster_data = NULL;
-    struct iovec hd_iov;
-    QEMUIOVector hd_qiov;
-    uint8_t *buf;
-    void *orig_buf;
+
+    acb->hd_aiocb = NULL;
+
+    if (ret < 0)
+        goto done;
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+    cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, 1, 0,
+                                        index_in_cluster,
+                                        index_in_cluster + acb->n);
+    if (!cluster_offset || (cluster_offset & 511) != 0) {
+        ret = -EIO;
+        goto done;
+    }
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(s->cluster_size);
+            if (!acb->cluster_data) {
+                ret = -ENOMEM;
+                goto done;
+            }
+        }
+        encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
+                        acb->n, 1, &s->aes_encrypt_key);
+        src_buf = acb->cluster_data;
+    } else {
+        src_buf = acb->buf;
+    }
+
+    acb->hd_iov.iov_base = (void *)src_buf;
+    acb->hd_iov.iov_len = acb->n * 512;
+    qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+    acb->hd_aiocb = bdrv_aio_writev(bs->file,
+                                    (cluster_offset >> 9) + index_in_cluster,
+                                    &acb->hd_qiov, acb->n,
+                                    qcow_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL) {
+        ret = -EIO;
+        goto done;
+    }
+    return;
+
+done:
+    if (acb->qiov->niov > 1)
+        qemu_vfree(acb->orig_buf);
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow_aio_writev(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;
+    int ret;

    s->cluster_cache_offset = -1; /* disable compressed cache */

-    if (qiov->niov > 1) {
-        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-        qemu_iovec_to_buffer(qiov, buf);
-    } else {
-        orig_buf = NULL;
-        buf = (uint8_t *)qiov->iov->iov_base;
+    acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
+    if (!acb)
+        return NULL;
+
+
+    ret = qcow_schedule_bh(qcow_aio_rw_bh, acb);
+    if (ret < 0) {
+        if (acb->qiov->niov > 1) {
+            qemu_vfree(acb->orig_buf);
+        }
+        qemu_aio_release(acb);
+        return NULL;
    }

-    qemu_co_mutex_lock(&s->lock);
-
-    while (nb_sectors != 0) {
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-        n = s->cluster_sectors - index_in_cluster;
-        if (n > nb_sectors) {
-            n = nb_sectors;
-        }
-        cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0,
-                                            index_in_cluster,
-                                            index_in_cluster + n);
-        if (!cluster_offset || (cluster_offset & 511) != 0) {
-            ret = -EIO;
-            break;
-        }
-        if (s->crypt_method) {
-            if (!cluster_data) {
-                cluster_data = g_malloc0(s->cluster_size);
-            }
-            encrypt_sectors(s, sector_num, cluster_data, buf,
-                            n, 1, &s->aes_encrypt_key);
-            src_buf = cluster_data;
-        } else {
-            src_buf = buf;
-        }
-
-        hd_iov.iov_base = (void *)src_buf;
-        hd_iov.iov_len = n * 512;
-        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-        qemu_co_mutex_unlock(&s->lock);
-        ret = bdrv_co_writev(bs->file,
-                             (cluster_offset >> 9) + index_in_cluster,
-                             n, &hd_qiov);
-        qemu_co_mutex_lock(&s->lock);
-        if (ret < 0) {
-            break;
-        }
-        ret = 0;
-
-        nb_sectors -= n;
-        sector_num += n;
-        buf += n * 512;
-    }
-    qemu_co_mutex_unlock(&s->lock);
-
-    if (qiov->niov > 1) {
-        qemu_vfree(orig_buf);
-    }
-    g_free(cluster_data);
-
-    return ret;
+    return &acb->common;
 }

 static void qcow_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-
-    g_free(s->l1_table);
-    g_free(s->l2_cache);
-    g_free(s->cluster_cache);
-    g_free(s->cluster_data);
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
 }

 static int qcow_create(const char *filename, QEMUOptionParameter *options)
@@ -747,7 +925,9 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
    if (nb_sectors != s->cluster_sectors)
        return -EINVAL;

-    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    if (!out_buf)
+        return -1;

    /* best compression, small window, no zlib header */
    memset(&strm, 0, sizeof(strm));
@@ -755,8 +935,8 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
                       Z_DEFLATED, -12,
                       9, Z_DEFAULT_STRATEGY);
    if (ret != 0) {
-        ret = -EINVAL;
-        goto fail;
+        qemu_free(out_buf);
+        return -1;
    }

    strm.avail_in = s->cluster_size;
@@ -766,9 +946,9 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,

    ret = deflate(&strm, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
+        qemu_free(out_buf);
        deflateEnd(&strm);
-        ret = -EINVAL;
-        goto fail;
+        return -1;
    }
    out_len = strm.next_out - out_buf;

@@ -776,34 +956,30 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = bdrv_write(bs, sector_num, buf, s->cluster_sectors);
-        if (ret < 0) {
-            goto fail;
-        }
+        bdrv_write(bs, sector_num, buf, s->cluster_sectors);
    } else {
        cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
                                            out_len, 0, 0);
-        if (cluster_offset == 0) {
-            ret = -EIO;
-            goto fail;
-        }
-
        cluster_offset &= s->cluster_offset_mask;
-        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
-        if (ret < 0) {
-            goto fail;
+        if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
+            qemu_free(out_buf);
+            return -1;
        }
    }

-    ret = 0;
-fail:
-    g_free(out_buf);
-    return ret;
+    qemu_free(out_buf);
+    return 0;
 }

-static coroutine_fn int qcow_co_flush(BlockDriverState *bs)
+static int qcow_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
+}
+
+static BlockDriverAIOCB *qcow_aio_flush(BlockDriverState *bs,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
@@ -840,16 +1016,15 @@ static BlockDriver bdrv_qcow = {
    .bdrv_open		= qcow_open,
    .bdrv_close		= qcow_close,
    .bdrv_create	= qcow_create,
-
-    .bdrv_co_readv          = qcow_co_readv,
-    .bdrv_co_writev         = qcow_co_writev,
-    .bdrv_co_flush_to_disk  = qcow_co_flush,
-    .bdrv_is_allocated      = qcow_is_allocated,
-
-    .bdrv_set_key           = qcow_set_key,
-    .bdrv_make_empty        = qcow_make_empty,
-    .bdrv_write_compressed  = qcow_write_compressed,
-    .bdrv_get_info          = qcow_get_info,
+    .bdrv_flush		= qcow_flush,
+    .bdrv_is_allocated	= qcow_is_allocated,
+    .bdrv_set_key	= qcow_set_key,
+    .bdrv_make_empty	= qcow_make_empty,
+    .bdrv_aio_readv	= qcow_aio_readv,
+    .bdrv_aio_writev	= qcow_aio_writev,
+    .bdrv_aio_flush	= qcow_aio_flush,
+    .bdrv_write_compressed = qcow_write_compressed,
+    .bdrv_get_info	= qcow_get_info,

    .create_options = qcow_create_options,
 };
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -49,9 +49,9 @@ Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
    Qcow2Cache *c;
    int i;

-    c = g_malloc0(sizeof(*c));
+    c = qemu_mallocz(sizeof(*c));
    c->size = num_tables;
-    c->entries = g_malloc0(sizeof(*c->entries) * num_tables);
+    c->entries = qemu_mallocz(sizeof(*c->entries) * num_tables);
    c->writethrough = writethrough;

    for (i = 0; i < c->size; i++) {
@@ -70,8 +70,8 @@ int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c)
        qemu_vfree(c->entries[i].table);
    }

-    g_free(c->entries);
-    g_free(c);
+    qemu_free(c->entries);
+    qemu_free(c);

    return 0;
 }
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -53,18 +53,18 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
    }

 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
+    printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
 #endif

    new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = g_malloc0(align_offset(new_l1_size2, 512));
+    new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512));
    memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));

    /* write new table (align to cluster) */
    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
    new_l1_table_offset = qcow2_alloc_clusters(bs, new_l1_size2);
    if (new_l1_table_offset < 0) {
-        g_free(new_l1_table);
+        qemu_free(new_l1_table);
        return new_l1_table_offset;
    }

@@ -90,14 +90,14 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
    if (ret < 0) {
        goto fail;
    }
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);
    qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
    s->l1_table_offset = new_l1_table_offset;
    s->l1_table = new_l1_table;
    s->l1_size = new_l1_size;
    return 0;
 fail:
-    g_free(new_l1_table);
+    qemu_free(new_l1_table);
    qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2);
    return ret;
 }
@@ -381,10 +381,10 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
 * For a given offset of the disk image, find the cluster offset in
 * qcow2 file. The offset is stored in *cluster_offset.
 *
- * on entry, *num is the number of contiguous sectors we'd like to
+ * on entry, *num is the number of contiguous clusters we'd like to
 * access following offset.
 *
- * on exit, *num is the number of contiguous sectors we can read.
+ * on exit, *num is the number of contiguous clusters we can read.
 *
 * Return 0, if the offset is found
 * Return -errno, otherwise.
@@ -568,10 +568,8 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    }

    cluster_offset = be64_to_cpu(l2_table[l2_index]);
-    if (cluster_offset & QCOW_OFLAG_COPIED) {
-        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-        return 0;
-    }
+    if (cluster_offset & QCOW_OFLAG_COPIED)
+        return cluster_offset & ~QCOW_OFLAG_COPIED;

    if (cluster_offset)
        qcow2_free_any_clusters(bs, cluster_offset, 1);
@@ -614,7 +612,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
    if (m->nb_clusters == 0)
        return 0;

-    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));
+    old_cluster = qemu_malloc(m->nb_clusters * sizeof(uint64_t));

    /* copy content of unmodified sectors */
    start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
@@ -685,7 +683,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)

    ret = 0;
 err:
-    g_free(old_cluster);
+    qemu_free(old_cluster);
    return ret;
 }

@@ -696,15 +694,15 @@ err:
 * If the offset is not found, allocate a new cluster.
 *
 * If the cluster was already allocated, m->nb_clusters is set to 0,
- * other fields in m are meaningless.
+ * m->depends_on is set to NULL and the other fields in m are meaningless.
 *
 * If the cluster is newly allocated, m->nb_clusters is set to the number of
- * contiguous clusters that have been allocated. In this case, the other
- * fields of m are valid and contain information about the first allocated
- * cluster.
+ * contiguous clusters that have been allocated. This may be 0 if the request
+ * conflict with another write request in flight; in this case, m->depends_on
+ * is set and the remaining fields of m are meaningless.
 *
- * If the request conflicts with another write request in flight, the coroutine
- * is queued and will be reentered when the dependency has completed.
+ * If m->nb_clusters is non-zero, the other fields of m are valid and contain
+ * information about the first allocated cluster.
 *
 * Return 0 on success and -errno in error cases
 */
@@ -723,7 +721,6 @@ int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
        return ret;
    }

-again:
    nb_clusters = size_to_clusters(s, n_end << 9);

    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
@@ -738,6 +735,7 @@ again:

        cluster_offset &= ~QCOW_OFLAG_COPIED;
        m->nb_clusters = 0;
+        m->depends_on = NULL;

        goto out;
    }
@@ -778,28 +776,28 @@ again:
     */
    QLIST_FOREACH(old_alloc, &s->cluster_allocs, next_in_flight) {

-        uint64_t start = offset >> s->cluster_bits;
-        uint64_t end = start + nb_clusters;
-        uint64_t old_start = old_alloc->offset >> s->cluster_bits;
-        uint64_t old_end = old_start + old_alloc->nb_clusters;
+        uint64_t end_offset = offset + nb_clusters * s->cluster_size;
+        uint64_t old_offset = old_alloc->offset;
+        uint64_t old_end_offset = old_alloc->offset +
+            old_alloc->nb_clusters * s->cluster_size;

-        if (end < old_start || start > old_end) {
+        if (end_offset < old_offset || offset > old_end_offset) {
            /* No intersection */
        } else {
-            if (start < old_start) {
+            if (offset < old_offset) {
                /* Stop at the start of a running allocation */
-                nb_clusters = old_start - start;
+                nb_clusters = (old_offset - offset) >> s->cluster_bits;
            } else {
                nb_clusters = 0;
            }

            if (nb_clusters == 0) {
-                /* Wait for the dependency to complete. We need to recheck
-                 * the free/allocated clusters when we continue. */
-                qemu_co_mutex_unlock(&s->lock);
-                qemu_co_queue_wait(&old_alloc->dependent_requests);
-                qemu_co_mutex_lock(&s->lock);
-                goto again;
+                /* Set dependency and wait for a callback */
+                m->depends_on = old_alloc;
+                m->nb_clusters = 0;
+                *num = 0;
+
+                goto out_wait_dependency;
            }
        }
    }
@@ -808,11 +806,6 @@ again:
        abort();
    }

-    /* save info needed for meta data update */
-    m->offset = offset;
-    m->n_start = n_start;
-    m->nb_clusters = nb_clusters;
-
    QLIST_INSERT_HEAD(&s->cluster_allocs, m, next_in_flight);

    /* allocate a new cluster */
@@ -823,6 +816,11 @@ again:
        goto fail;
    }

+    /* save info needed for meta data update */
+    m->offset = offset;
+    m->n_start = n_start;
+    m->nb_clusters = nb_clusters;
+
 out:
    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
    if (ret < 0) {
@@ -836,6 +834,9 @@ out:

    return 0;

+out_wait_dependency:
+    return qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
+
 fail:
    qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
 fail_put:
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -41,7 +41,7 @@ int qcow2_refcount_init(BlockDriverState *bs)
    int ret, refcount_table_size2, i;

    refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
-    s->refcount_table = g_malloc(refcount_table_size2);
+    s->refcount_table = qemu_malloc(refcount_table_size2);
    if (s->refcount_table_size > 0) {
        BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
        ret = bdrv_pread(bs->file, s->refcount_table_offset,
@@ -59,7 +59,7 @@ int qcow2_refcount_init(BlockDriverState *bs)
 void qcow2_refcount_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-    g_free(s->refcount_table);
+    qemu_free(s->refcount_table);
 }


@@ -323,8 +323,8 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t meta_offset = (blocks_used * refcount_block_clusters) *
        s->cluster_size;
    uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
-    uint16_t *new_blocks = g_malloc0(blocks_clusters * s->cluster_size);
-    uint64_t *new_table = g_malloc0(table_size * sizeof(uint64_t));
+    uint16_t *new_blocks = qemu_mallocz(blocks_clusters * s->cluster_size);
+    uint64_t *new_table = qemu_mallocz(table_size * sizeof(uint64_t));

    assert(meta_offset >= (s->free_cluster_index * s->cluster_size));

@@ -349,7 +349,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
    ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
        blocks_clusters * s->cluster_size);
-    g_free(new_blocks);
+    qemu_free(new_blocks);
    if (ret < 0) {
        goto fail_table;
    }
@@ -385,7 +385,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t old_table_offset = s->refcount_table_offset;
    uint64_t old_table_size = s->refcount_table_size;

-    g_free(s->refcount_table);
+    qemu_free(s->refcount_table);
    s->refcount_table = new_table;
    s->refcount_table_size = table_size;
    s->refcount_table_offset = table_offset;
@@ -403,7 +403,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    return new_block;

 fail_table:
-    g_free(new_table);
+    qemu_free(new_table);
 fail_block:
    if (*refcount_block != NULL) {
        qcow2_cache_put(bs, s->refcount_block_cache, (void**) refcount_block);
@@ -422,7 +422,7 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
    int ret;

 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "update_refcount: offset=%" PRId64 " size=%" PRId64 " addend=%d\n",
+    printf("update_refcount: offset=%" PRId64 " size=%" PRId64 " addend=%d\n",
           offset, length, addend);
 #endif
    if (length < 0) {
@@ -556,7 +556,7 @@ retry:
        }
    }
 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
+    printf("alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
            size,
            (s->free_cluster_index - nb_clusters) << s->cluster_bits);
 #endif
@@ -680,6 +680,24 @@ void qcow2_free_any_clusters(BlockDriverState *bs,



+void qcow2_create_refcount_update(QCowCreateState *s, int64_t offset,
+    int64_t size)
+{
+    int refcount;
+    int64_t start, last, cluster_offset;
+    uint16_t *p;
+
+    start = offset & ~(s->cluster_size - 1);
+    last = (offset + size - 1)  & ~(s->cluster_size - 1);
+    for(cluster_offset = start; cluster_offset <= last;
+        cluster_offset += s->cluster_size) {
+        p = &s->refcount_block[cluster_offset >> s->cluster_bits];
+        refcount = be16_to_cpu(*p);
+        refcount++;
+        *p = cpu_to_be16(refcount);
+    }
+}
+
 /* update the refcounts of snapshots and the copied flag */
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend)
@@ -702,7 +720,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    l1_size2 = l1_size * sizeof(uint64_t);
    if (l1_table_offset != s->l1_table_offset) {
        if (l1_size2 != 0) {
-            l1_table = g_malloc0(align_offset(l1_size2, 512));
+            l1_table = qemu_mallocz(align_offset(l1_size2, 512));
        } else {
            l1_table = NULL;
        }
@@ -829,7 +847,7 @@ fail:
            be64_to_cpus(&l1_table[i]);
    }
    if (l1_allocated)
-        g_free(l1_table);
+        qemu_free(l1_table);
    return ret;
 }

@@ -903,7 +921,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,

    /* Read L2 table from disk */
    l2_size = s->l2_size * sizeof(uint64_t);
-    l2_table = g_malloc(l2_size);
+    l2_table = qemu_malloc(l2_size);

    if (bdrv_pread(bs->file, l2_offset, l2_table, l2_size) != l2_size)
        goto fail;
@@ -961,12 +979,12 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
        }
    }

-    g_free(l2_table);
+    qemu_free(l2_table);
    return 0;

 fail:
    fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
-    g_free(l2_table);
+    qemu_free(l2_table);
    return -EIO;
 }

@@ -999,7 +1017,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
    if (l1_size2 == 0) {
        l1_table = NULL;
    } else {
-        l1_table = g_malloc(l1_size2);
+        l1_table = qemu_malloc(l1_size2);
        if (bdrv_pread(bs->file, l1_table_offset,
                       l1_table, l1_size2) != l1_size2)
            goto fail;
@@ -1047,13 +1065,13 @@ static int check_refcounts_l1(BlockDriverState *bs,
            }
        }
    }
-    g_free(l1_table);
+    qemu_free(l1_table);
    return 0;

 fail:
    fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
    res->check_errors++;
-    g_free(l1_table);
+    qemu_free(l1_table);
    return -EIO;
 }

@@ -1074,7 +1092,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)

    size = bdrv_getlength(bs->file);
    nb_clusters = size_to_clusters(s, size);
-    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
+    refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));

    /* header */
    inc_refcounts(bs, res, refcount_table, nb_clusters,
@@ -1160,7 +1178,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
    ret = 0;

 fail:
-    g_free(refcount_table);
+    qemu_free(refcount_table);

    return ret;
 }
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -26,7 +26,7 @@
 #include "block_int.h"
 #include "block/qcow2.h"

-typedef struct QEMU_PACKED QCowSnapshotHeader {
+typedef struct __attribute__((packed)) QCowSnapshotHeader {
    /* header is 8 byte aligned */
    uint64_t l1_table_offset;

@@ -52,10 +52,10 @@ void qcow2_free_snapshots(BlockDriverState *bs)
    int i;

    for(i = 0; i < s->nb_snapshots; i++) {
-        g_free(s->snapshots[i].name);
-        g_free(s->snapshots[i].id_str);
+        qemu_free(s->snapshots[i].name);
+        qemu_free(s->snapshots[i].id_str);
    }
-    g_free(s->snapshots);
+    qemu_free(s->snapshots);
    s->snapshots = NULL;
    s->nb_snapshots = 0;
 }
@@ -76,7 +76,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
    }

    offset = s->snapshots_offset;
-    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
    for(i = 0; i < s->nb_snapshots; i++) {
        offset = align_offset(offset, 8);
        if (bdrv_pread(bs->file, offset, &h, sizeof(h)) != sizeof(h))
@@ -96,13 +96,13 @@ int qcow2_read_snapshots(BlockDriverState *bs)

        offset += extra_data_size;

-        sn->id_str = g_malloc(id_str_size + 1);
+        sn->id_str = qemu_malloc(id_str_size + 1);
        if (bdrv_pread(bs->file, offset, sn->id_str, id_str_size) != id_str_size)
            goto fail;
        offset += id_str_size;
        sn->id_str[id_str_size] = '\0';

-        sn->name = g_malloc(name_size + 1);
+        sn->name = qemu_malloc(name_size + 1);
        if (bdrv_pread(bs->file, offset, sn->name, name_size) != name_size)
            goto fail;
        offset += name_size;
@@ -252,10 +252,10 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
        return -ENOENT;

-    sn->id_str = g_strdup(sn_info->id_str);
+    sn->id_str = qemu_strdup(sn_info->id_str);
    if (!sn->id_str)
        goto fail;
-    sn->name = g_strdup(sn_info->name);
+    sn->name = qemu_strdup(sn_info->name);
    if (!sn->name)
        goto fail;
    sn->vm_state_size = sn_info->vm_state_size;
@@ -278,7 +278,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    sn->l1_size = s->l1_size;

    if (s->l1_size != 0) {
-        l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+        l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
    } else {
        l1_table = NULL;
    }
@@ -289,13 +289,13 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (bdrv_pwrite_sync(bs->file, sn->l1_table_offset,
                    l1_table, s->l1_size * sizeof(uint64_t)) < 0)
        goto fail;
-    g_free(l1_table);
+    qemu_free(l1_table);
    l1_table = NULL;

-    snapshots1 = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
    if (s->snapshots) {
        memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
-        g_free(s->snapshots);
+        qemu_free(s->snapshots);
    }
    s->snapshots = snapshots1;
    s->snapshots[s->nb_snapshots++] = *sn;
@@ -303,15 +303,12 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (qcow2_write_snapshots(bs) < 0)
        goto fail;
 #ifdef DEBUG_ALLOC
-    {
-      BdrvCheckResult result = {0};
-      qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 fail:
-    g_free(sn->name);
-    g_free(l1_table);
+    qemu_free(sn->name);
+    qemu_free(l1_table);
    return -1;
 }

@@ -356,10 +353,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
        goto fail;

 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 fail:
@@ -386,8 +380,8 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
        return ret;
    qcow2_free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));

-    g_free(sn->id_str);
-    g_free(sn->name);
+    qemu_free(sn->id_str);
+    qemu_free(sn->name);
    memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
    s->nb_snapshots--;
    ret = qcow2_write_snapshots(bs);
@@ -396,10 +390,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
        return ret;
    }
 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 }
@@ -416,7 +407,7 @@ int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        return s->nb_snapshots;
    }

-    sn_tab = g_malloc0(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
    for(i = 0; i < s->nb_snapshots; i++) {
        sn_info = sn_tab + i;
        sn = s->snapshots + i;
@@ -448,11 +439,11 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name)
    s->l1_size = sn->l1_size;
    l1_size2 = s->l1_size * sizeof(uint64_t);
    if (s->l1_table != NULL) {
-        g_free(s->l1_table);
+        qemu_free(s->l1_table);
    }

    s->l1_table_offset = sn->l1_table_offset;
-    s->l1_table = g_malloc0(align_offset(l1_size2, 512));
+    s->l1_table = qemu_mallocz(align_offset(l1_size2, 512));

    if (bdrv_pread(bs->file, sn->l1_table_offset,
                   s->l1_table, l1_size2) != l1_size2) {
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -87,7 +87,6 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
    while (offset < end_offset) {

 #ifdef DEBUG_EXT
-        BDRVQcowState *s = bs->opaque;
        /* Sanity check */
        if (offset > s->cluster_size)
            printf("qcow2_read_extension: suspicious offset %lu\n", offset);
@@ -217,7 +216,7 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    }
    s->l1_table_offset = header.l1_table_offset;
    if (s->l1_size > 0) {
-        s->l1_table = g_malloc0(
+        s->l1_table = qemu_mallocz(
            align_offset(s->l1_size * sizeof(uint64_t), 512));
        ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
                         s->l1_size * sizeof(uint64_t));
@@ -235,12 +234,11 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    s->refcount_block_cache = qcow2_cache_create(bs, REFCOUNT_CACHE_SIZE,
        writethrough);

-    s->cluster_cache = g_malloc(s->cluster_size);
+    s->cluster_cache = qemu_malloc(s->cluster_size);
    /* one more sector for decompressed data alignment */
-    s->cluster_data = qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
+    s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
                                  + 512);
    s->cluster_cache_offset = -1;
-    s->flags = flags;

    ret = qcow2_refcount_init(bs);
    if (ret != 0) {
@@ -278,26 +276,20 @@ static int qcow2_open(BlockDriverState *bs, int flags)
        goto fail;
    }

-    /* Initialise locks */
-    qemu_co_mutex_init(&s->lock);
-
 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return ret;

 fail:
    qcow2_free_snapshots(bs);
    qcow2_refcount_close(bs);
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);
    if (s->l2_table_cache) {
        qcow2_cache_destroy(bs, s->l2_table_cache);
    }
-    g_free(s->cluster_cache);
-    qemu_vfree(s->cluster_data);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    return ret;
 }

@@ -377,250 +369,397 @@ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
    return n1;
 }

-static int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
-                          int remaining_sectors, QEMUIOVector *qiov)
-{
-    BDRVQcowState *s = bs->opaque;
-    int index_in_cluster, n1;
-    int ret;
-    int cur_nr_sectors; /* number of sectors in current iteration */
-    uint64_t cluster_offset = 0;
-    uint64_t bytes_done = 0;
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    QEMUIOVector *qiov;
+    int remaining_sectors;
+    int cur_nr_sectors;	/* number of sectors in current iteration */
+    uint64_t bytes_done;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    bool is_write;
+    BlockDriverAIOCB *hd_aiocb;
    QEMUIOVector hd_qiov;
-    uint8_t *cluster_data = NULL;
+    QEMUBH *bh;
+    QCowL2Meta l2meta;
+    QLIST_ENTRY(QCowAIOCB) next_depend;
+} QCowAIOCB;

-    qemu_iovec_init(&hd_qiov, qiov->niov);
-
-    qemu_co_mutex_lock(&s->lock);
-
-    while (remaining_sectors != 0) {
-
-        /* prepare next request */
-        cur_nr_sectors = remaining_sectors;
-        if (s->crypt_method) {
-            cur_nr_sectors = MIN(cur_nr_sectors,
-                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
-        }
-
-        ret = qcow2_get_cluster_offset(bs, sector_num << 9,
-            &cur_nr_sectors, &cluster_offset);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-
-        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-            cur_nr_sectors * 512);
-
-        if (!cluster_offset) {
-
-            if (bs->backing_hd) {
-                /* read from the base image */
-                n1 = qcow2_backing_read1(bs->backing_hd, &hd_qiov,
-                    sector_num, cur_nr_sectors);
-                if (n1 > 0) {
-                    BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
-                    qemu_co_mutex_unlock(&s->lock);
-                    ret = bdrv_co_readv(bs->backing_hd, sector_num,
-                                        n1, &hd_qiov);
-                    qemu_co_mutex_lock(&s->lock);
-                    if (ret < 0) {
-                        goto fail;
-                    }
-                }
-            } else {
-                /* Note: in this case, no need to wait */
-                qemu_iovec_memset(&hd_qiov, 0, 512 * cur_nr_sectors);
-            }
-        } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
-            /* add AIO support for compressed blocks ? */
-            ret = qcow2_decompress_cluster(bs, cluster_offset);
-            if (ret < 0) {
-                goto fail;
-            }
-
-            qemu_iovec_from_buffer(&hd_qiov,
-                s->cluster_cache + index_in_cluster * 512,
-                512 * cur_nr_sectors);
-        } else {
-            if ((cluster_offset & 511) != 0) {
-                ret = -EIO;
-                goto fail;
-            }
-
-            if (s->crypt_method) {
-                /*
-                 * For encrypted images, read everything into a temporary
-                 * contiguous buffer on which the AES functions can work.
-                 */
-                if (!cluster_data) {
-                    cluster_data =
-                        qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-                }
-
-                assert(cur_nr_sectors <=
-                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
-                qemu_iovec_reset(&hd_qiov);
-                qemu_iovec_add(&hd_qiov, cluster_data,
-                    512 * cur_nr_sectors);
-            }
-
-            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-            qemu_co_mutex_unlock(&s->lock);
-            ret = bdrv_co_readv(bs->file,
-                                (cluster_offset >> 9) + index_in_cluster,
-                                cur_nr_sectors, &hd_qiov);
-            qemu_co_mutex_lock(&s->lock);
-            if (ret < 0) {
-                goto fail;
-            }
-            if (s->crypt_method) {
-                qcow2_encrypt_sectors(s, sector_num,  cluster_data,
-                    cluster_data, cur_nr_sectors, 0, &s->aes_decrypt_key);
-                qemu_iovec_reset(&hd_qiov);
-                qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-                    cur_nr_sectors * 512);
-                qemu_iovec_from_buffer(&hd_qiov, cluster_data,
-                    512 * cur_nr_sectors);
-            }
-        }
-
-        remaining_sectors -= cur_nr_sectors;
-        sector_num += cur_nr_sectors;
-        bytes_done += cur_nr_sectors * 512;
-    }
-    ret = 0;
-
-fail:
-    qemu_co_mutex_unlock(&s->lock);
-
-    qemu_iovec_destroy(&hd_qiov);
-    qemu_vfree(cluster_data);
-
-    return ret;
+static void qcow2_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = container_of(blockacb, QCowAIOCB, common);
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
 }

-static void run_dependent_requests(BDRVQcowState *s, QCowL2Meta *m)
+static AIOPool qcow2_aio_pool = {
+    .aiocb_size         = sizeof(QCowAIOCB),
+    .cancel             = qcow2_aio_cancel,
+};
+
+static void qcow2_aio_read_cb(void *opaque, int ret);
+static void qcow2_aio_write_cb(void *opaque, int ret);
+
+static void qcow2_aio_rw_bh(void *opaque)
 {
+    QCowAIOCB *acb = opaque;
+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+
+    if (acb->is_write) {
+        qcow2_aio_write_cb(opaque, 0);
+    } else {
+        qcow2_aio_read_cb(opaque, 0);
+    }
+}
+
+static int qcow2_schedule_bh(QEMUBHFunc *cb, QCowAIOCB *acb)
+{
+    if (acb->bh)
+        return -EIO;
+
+    acb->bh = qemu_bh_new(cb, acb);
+    if (!acb->bh)
+        return -EIO;
+
+    qemu_bh_schedule(acb->bh);
+
+    return 0;
+}
+
+static void qcow2_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster, n1;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0)
+        goto done;
+
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            qcow2_encrypt_sectors(s, acb->sector_num,  acb->cluster_data,
+                acb->cluster_data, acb->cur_nr_sectors, 0, &s->aes_decrypt_key);
+            qemu_iovec_reset(&acb->hd_qiov);
+            qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+                acb->cur_nr_sectors * 512);
+            qemu_iovec_from_buffer(&acb->hd_qiov, acb->cluster_data,
+                512 * acb->cur_nr_sectors);
+        }
+    }
+
+    acb->remaining_sectors -= acb->cur_nr_sectors;
+    acb->sector_num += acb->cur_nr_sectors;
+    acb->bytes_done += acb->cur_nr_sectors * 512;
+
+    if (acb->remaining_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    /* prepare next AIO request */
+    acb->cur_nr_sectors = acb->remaining_sectors;
+    if (s->crypt_method) {
+        acb->cur_nr_sectors = MIN(acb->cur_nr_sectors,
+            QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
+    }
+
+    ret = qcow2_get_cluster_offset(bs, acb->sector_num << 9,
+        &acb->cur_nr_sectors, &acb->cluster_offset);
+    if (ret < 0) {
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+
+    qemu_iovec_reset(&acb->hd_qiov);
+    qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+        acb->cur_nr_sectors * 512);
+
+    if (!acb->cluster_offset) {
+
+        if (bs->backing_hd) {
+            /* read from the base image */
+            n1 = qcow2_backing_read1(bs->backing_hd, &acb->hd_qiov,
+                acb->sector_num, acb->cur_nr_sectors);
+            if (n1 > 0) {
+                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
+                acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num,
+                                    &acb->hd_qiov, n1, qcow2_aio_read_cb, acb);
+                if (acb->hd_aiocb == NULL) {
+                    ret = -EIO;
+                    goto done;
+                }
+            } else {
+                ret = qcow2_schedule_bh(qcow2_aio_rw_bh, acb);
+                if (ret < 0)
+                    goto done;
+            }
+        } else {
+            /* Note: in this case, no need to wait */
+            qemu_iovec_memset(&acb->hd_qiov, 0, 512 * acb->cur_nr_sectors);
+            ret = qcow2_schedule_bh(qcow2_aio_rw_bh, acb);
+            if (ret < 0)
+                goto done;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        ret = qcow2_decompress_cluster(bs, acb->cluster_offset);
+        if (ret < 0) {
+            goto done;
+        }
+
+        qemu_iovec_from_buffer(&acb->hd_qiov,
+            s->cluster_cache + index_in_cluster * 512,
+            512 * acb->cur_nr_sectors);
+
+        ret = qcow2_schedule_bh(qcow2_aio_rw_bh, acb);
+        if (ret < 0)
+            goto done;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto done;
+        }
+
+        if (s->crypt_method) {
+            /*
+             * For encrypted images, read everything into a temporary
+             * contiguous buffer on which the AES functions can work.
+             */
+            if (!acb->cluster_data) {
+                acb->cluster_data =
+                    qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
+            }
+
+            assert(acb->cur_nr_sectors <=
+                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
+            qemu_iovec_reset(&acb->hd_qiov);
+            qemu_iovec_add(&acb->hd_qiov, acb->cluster_data,
+                512 * acb->cur_nr_sectors);
+        }
+
+        BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+        acb->hd_aiocb = bdrv_aio_readv(bs->file,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            &acb->hd_qiov, acb->cur_nr_sectors,
+                            qcow2_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL) {
+            ret = -EIO;
+            goto done;
+        }
+    }
+
+    return;
+done:
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_iovec_destroy(&acb->hd_qiov);
+    qemu_aio_release(acb);
+}
+
+static QCowAIOCB *qcow2_aio_setup(BlockDriverState *bs, int64_t sector_num,
+                                  QEMUIOVector *qiov, int nb_sectors,
+                                  BlockDriverCompletionFunc *cb,
+                                  void *opaque, int is_write)
+{
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(&qcow2_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->qiov = qiov;
+    acb->is_write = is_write;
+
+    qemu_iovec_init(&acb->hd_qiov, qiov->niov);
+
+    acb->bytes_done = 0;
+    acb->remaining_sectors = nb_sectors;
+    acb->cur_nr_sectors = 0;
+    acb->cluster_offset = 0;
+    acb->l2meta.nb_clusters = 0;
+    QLIST_INIT(&acb->l2meta.dependent_requests);
+    return acb;
+}
+
+static BlockDriverAIOCB *qcow2_aio_readv(BlockDriverState *bs,
+                                         int64_t sector_num,
+                                         QEMUIOVector *qiov, int nb_sectors,
+                                         BlockDriverCompletionFunc *cb,
+                                         void *opaque)
+{
+    QCowAIOCB *acb;
+    int ret;
+
+    acb = qcow2_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    if (!acb)
+        return NULL;
+
+    ret = qcow2_schedule_bh(qcow2_aio_rw_bh, acb);
+    if (ret < 0) {
+        qemu_iovec_destroy(&acb->hd_qiov);
+        qemu_aio_release(acb);
+        return NULL;
+    }
+
+    return &acb->common;
+}
+
+static void run_dependent_requests(QCowL2Meta *m)
+{
+    QCowAIOCB *req;
+    QCowAIOCB *next;
+
    /* Take the request off the list of running requests */
    if (m->nb_clusters != 0) {
        QLIST_REMOVE(m, next_in_flight);
    }

    /* Restart all dependent requests */
-    if (!qemu_co_queue_empty(&m->dependent_requests)) {
-        qemu_co_mutex_unlock(&s->lock);
-        while(qemu_co_queue_next(&m->dependent_requests));
-        qemu_co_mutex_lock(&s->lock);
+    QLIST_FOREACH_SAFE(req, &m->dependent_requests, next_depend, next) {
+        qcow2_aio_write_cb(req, 0);
    }
+
+    /* Empty the list for the next part of the request */
+    QLIST_INIT(&m->dependent_requests);
 }

-static int qcow2_co_writev(BlockDriverState *bs,
-                           int64_t sector_num,
-                           int remaining_sectors,
-                           QEMUIOVector *qiov)
+static void qcow2_aio_write_cb(void *opaque, int ret)
 {
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster;
    int n_end;
+
+    acb->hd_aiocb = NULL;
+
+    if (ret >= 0) {
+        ret = qcow2_alloc_cluster_link_l2(bs, &acb->l2meta);
+    }
+
+    run_dependent_requests(&acb->l2meta);
+
+    if (ret < 0)
+        goto done;
+
+    acb->remaining_sectors -= acb->cur_nr_sectors;
+    acb->sector_num += acb->cur_nr_sectors;
+    acb->bytes_done += acb->cur_nr_sectors * 512;
+
+    if (acb->remaining_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    n_end = index_in_cluster + acb->remaining_sectors;
+    if (s->crypt_method &&
+        n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
+        n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
+
+    ret = qcow2_alloc_cluster_offset(bs, acb->sector_num << 9,
+        index_in_cluster, n_end, &acb->cur_nr_sectors, &acb->l2meta);
+    if (ret < 0) {
+        goto done;
+    }
+
+    acb->cluster_offset = acb->l2meta.cluster_offset;
+
+    /* Need to wait for another request? If so, we are done for now. */
+    if (acb->l2meta.nb_clusters == 0 && acb->l2meta.depends_on != NULL) {
+        QLIST_INSERT_HEAD(&acb->l2meta.depends_on->dependent_requests,
+            acb, next_depend);
+        return;
+    }
+
+    assert((acb->cluster_offset & 511) == 0);
+
+    qemu_iovec_reset(&acb->hd_qiov);
+    qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+        acb->cur_nr_sectors * 512);
+
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
+                                             s->cluster_size);
+        }
+
+        assert(acb->hd_qiov.size <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
+        qemu_iovec_to_buffer(&acb->hd_qiov, acb->cluster_data);
+
+        qcow2_encrypt_sectors(s, acb->sector_num, acb->cluster_data,
+            acb->cluster_data, acb->cur_nr_sectors, 1, &s->aes_encrypt_key);
+
+        qemu_iovec_reset(&acb->hd_qiov);
+        qemu_iovec_add(&acb->hd_qiov, acb->cluster_data,
+            acb->cur_nr_sectors * 512);
+    }
+
+    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+    acb->hd_aiocb = bdrv_aio_writev(bs->file,
+                                    (acb->cluster_offset >> 9) + index_in_cluster,
+                                    &acb->hd_qiov, acb->cur_nr_sectors,
+                                    qcow2_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL) {
+        ret = -EIO;
+        goto fail;
+    }
+
+    return;
+
+fail:
+    if (acb->l2meta.nb_clusters != 0) {
+        QLIST_REMOVE(&acb->l2meta, next_in_flight);
+    }
+done:
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_iovec_destroy(&acb->hd_qiov);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow2_aio_writev(BlockDriverState *bs,
+                                          int64_t sector_num,
+                                          QEMUIOVector *qiov, int nb_sectors,
+                                          BlockDriverCompletionFunc *cb,
+                                          void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;
    int ret;
-    int cur_nr_sectors; /* number of sectors in current iteration */
-    uint64_t cluster_offset;
-    QEMUIOVector hd_qiov;
-    uint64_t bytes_done = 0;
-    uint8_t *cluster_data = NULL;
-    QCowL2Meta l2meta = {
-        .nb_clusters = 0,
-    };
-
-    qemu_co_queue_init(&l2meta.dependent_requests);
-
-    qemu_iovec_init(&hd_qiov, qiov->niov);

    s->cluster_cache_offset = -1; /* disable compressed cache */

-    qemu_co_mutex_lock(&s->lock);
+    acb = qcow2_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
+    if (!acb)
+        return NULL;

-    while (remaining_sectors != 0) {
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-        n_end = index_in_cluster + remaining_sectors;
-        if (s->crypt_method &&
-            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors) {
-            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
-        }
-
-        ret = qcow2_alloc_cluster_offset(bs, sector_num << 9,
-            index_in_cluster, n_end, &cur_nr_sectors, &l2meta);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        cluster_offset = l2meta.cluster_offset;
-        assert((cluster_offset & 511) == 0);
-
-        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-            cur_nr_sectors * 512);
-
-        if (s->crypt_method) {
-            if (!cluster_data) {
-                cluster_data = qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS *
-                                                 s->cluster_size);
-            }
-
-            assert(hd_qiov.size <=
-                   QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-            qemu_iovec_to_buffer(&hd_qiov, cluster_data);
-
-            qcow2_encrypt_sectors(s, sector_num, cluster_data,
-                cluster_data, cur_nr_sectors, 1, &s->aes_encrypt_key);
-
-            qemu_iovec_reset(&hd_qiov);
-            qemu_iovec_add(&hd_qiov, cluster_data,
-                cur_nr_sectors * 512);
-        }
-
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-        qemu_co_mutex_unlock(&s->lock);
-        ret = bdrv_co_writev(bs->file,
-                             (cluster_offset >> 9) + index_in_cluster,
-                             cur_nr_sectors, &hd_qiov);
-        qemu_co_mutex_lock(&s->lock);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        ret = qcow2_alloc_cluster_link_l2(bs, &l2meta);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        run_dependent_requests(s, &l2meta);
-
-        remaining_sectors -= cur_nr_sectors;
-        sector_num += cur_nr_sectors;
-        bytes_done += cur_nr_sectors * 512;
+    ret = qcow2_schedule_bh(qcow2_aio_rw_bh, acb);
+    if (ret < 0) {
+        qemu_iovec_destroy(&acb->hd_qiov);
+        qemu_aio_release(acb);
+        return NULL;
    }
-    ret = 0;

-fail:
-    run_dependent_requests(s, &l2meta);
-
-    qemu_co_mutex_unlock(&s->lock);
-
-    qemu_iovec_destroy(&hd_qiov);
-    qemu_vfree(cluster_data);
-
-    return ret;
+    return &acb->common;
 }

 static void qcow2_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);

    qcow2_cache_flush(bs, s->l2_table_cache);
    qcow2_cache_flush(bs, s->refcount_block_cache);
@@ -628,42 +767,11 @@ static void qcow2_close(BlockDriverState *bs)
    qcow2_cache_destroy(bs, s->l2_table_cache);
    qcow2_cache_destroy(bs, s->refcount_block_cache);

-    g_free(s->cluster_cache);
-    qemu_vfree(s->cluster_data);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    qcow2_refcount_close(bs);
 }

-static void qcow2_invalidate_cache(BlockDriverState *bs)
-{
-    BDRVQcowState *s = bs->opaque;
-    int flags = s->flags;
-    AES_KEY aes_encrypt_key;
-    AES_KEY aes_decrypt_key;
-    uint32_t crypt_method = 0;
-
-    /*
-     * Backing files are read-only which makes all of their metadata immutable,
-     * that means we don't have to worry about reopening them here.
-     */
-
-    if (s->crypt_method) {
-        crypt_method = s->crypt_method;
-        memcpy(&aes_encrypt_key, &s->aes_encrypt_key, sizeof(aes_encrypt_key));
-        memcpy(&aes_decrypt_key, &s->aes_decrypt_key, sizeof(aes_decrypt_key));
-    }
-
-    qcow2_close(bs);
-
-    memset(s, 0, sizeof(BDRVQcowState));
-    qcow2_open(bs, flags);
-
-    if (crypt_method) {
-        s->crypt_method = crypt_method;
-        memcpy(&s->aes_encrypt_key, &aes_encrypt_key, sizeof(aes_encrypt_key));
-        memcpy(&s->aes_decrypt_key, &aes_decrypt_key, sizeof(aes_decrypt_key));
-    }
-}
-
 /*
 * Updates the variable length parts of the qcow2 header, i.e. the backing file
 * name and all extensions. qcow2 was not designed to allow such changes, so if
@@ -773,7 +881,7 @@ static int preallocate(BlockDriverState *bs)

    nb_sectors = bdrv_getlength(bs) >> 9;
    offset = 0;
-    qemu_co_queue_init(&meta.dependent_requests);
+    QLIST_INIT(&meta.dependent_requests);
    meta.cluster_offset = 0;

    while (nb_sectors) {
@@ -791,7 +899,7 @@ static int preallocate(BlockDriverState *bs)

        /* There are no dependent requests, but we need to remove our request
         * from the list of in-flight requests */
-        run_dependent_requests(bs->opaque, &meta);
+        run_dependent_requests(&meta);

        /* TODO Preallocate data if requested */

@@ -883,9 +991,9 @@ static int qcow2_create2(const char *filename, int64_t total_size,
    }

    /* Write an empty refcount table */
-    refcount_table = g_malloc0(cluster_size);
+    refcount_table = qemu_mallocz(cluster_size);
    ret = bdrv_pwrite(bs, cluster_size, refcount_table, cluster_size);
-    g_free(refcount_table);
+    qemu_free(refcount_table);

    if (ret < 0) {
        goto out;
@@ -1010,17 +1118,11 @@ static int qcow2_make_empty(BlockDriverState *bs)
    return 0;
 }

-static coroutine_fn int qcow2_co_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors)
+static int qcow2_discard(BlockDriverState *bs, int64_t sector_num,
+    int nb_sectors)
 {
-    int ret;
-    BDRVQcowState *s = bs->opaque;
-
-    qemu_co_mutex_lock(&s->lock);
-    ret = qcow2_discard_clusters(bs, sector_num << BDRV_SECTOR_BITS,
+    return qcow2_discard_clusters(bs, sector_num << BDRV_SECTOR_BITS,
        nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
 }

 static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
@@ -1083,7 +1185,7 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
    if (nb_sectors != s->cluster_sectors)
        return -EINVAL;

-    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);

    /* best compression, small window, no zlib header */
    memset(&strm, 0, sizeof(strm));
@@ -1091,8 +1193,8 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
                       Z_DEFLATED, -12,
                       9, Z_DEFAULT_STRATEGY);
    if (ret != 0) {
-        ret = -EINVAL;
-        goto fail;
+        qemu_free(out_buf);
+        return -1;
    }

    strm.avail_in = s->cluster_size;
@@ -1102,9 +1204,9 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,

    ret = deflate(&strm, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
+        qemu_free(out_buf);
        deflateEnd(&strm);
-        ret = -EINVAL;
-        goto fail;
+        return -1;
    }
    out_len = strm.next_out - out_buf;

@@ -1112,56 +1214,60 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = bdrv_write(bs, sector_num, buf, s->cluster_sectors);
-        if (ret < 0) {
-            goto fail;
-        }
+        bdrv_write(bs, sector_num, buf, s->cluster_sectors);
    } else {
        cluster_offset = qcow2_alloc_compressed_cluster_offset(bs,
            sector_num << 9, out_len);
-        if (!cluster_offset) {
-            ret = -EIO;
-            goto fail;
-        }
+        if (!cluster_offset)
+            return -1;
        cluster_offset &= s->cluster_offset_mask;
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
-        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
-        if (ret < 0) {
-            goto fail;
+        if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
+            qemu_free(out_buf);
+            return -1;
        }
    }

-    ret = 0;
-fail:
-    g_free(out_buf);
-    return ret;
+    qemu_free(out_buf);
+    return 0;
 }

-static int qcow2_co_flush_to_os(BlockDriverState *bs)
+static int qcow2_flush(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
    int ret;

-    qemu_co_mutex_lock(&s->lock);
    ret = qcow2_cache_flush(bs, s->l2_table_cache);
    if (ret < 0) {
-        qemu_co_mutex_unlock(&s->lock);
        return ret;
    }

    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
    if (ret < 0) {
-        qemu_co_mutex_unlock(&s->lock);
        return ret;
    }
-    qemu_co_mutex_unlock(&s->lock);

-    return 0;
+    return bdrv_flush(bs->file);
 }

-static int qcow2_co_flush_to_disk(BlockDriverState *bs)
+static BlockDriverAIOCB *qcow2_aio_flush(BlockDriverState *bs,
+                                         BlockDriverCompletionFunc *cb,
+                                         void *opaque)
 {
-    return bdrv_co_flush(bs->file);
+    BDRVQcowState *s = bs->opaque;
+    int ret;
+
+    ret = qcow2_cache_flush(bs, s->l2_table_cache);
+    if (ret < 0) {
+        return NULL;
+    }
+
+    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
+    if (ret < 0) {
+        return NULL;
+    }
+
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int64_t qcow2_vm_state_offset(BDRVQcowState *s)
@@ -1276,16 +1382,16 @@ static BlockDriver bdrv_qcow2 = {
    .bdrv_open          = qcow2_open,
    .bdrv_close         = qcow2_close,
    .bdrv_create        = qcow2_create,
+    .bdrv_flush         = qcow2_flush,
    .bdrv_is_allocated  = qcow2_is_allocated,
    .bdrv_set_key       = qcow2_set_key,
    .bdrv_make_empty    = qcow2_make_empty,

-    .bdrv_co_readv          = qcow2_co_readv,
-    .bdrv_co_writev         = qcow2_co_writev,
-    .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
-    .bdrv_co_flush_to_disk  = qcow2_co_flush_to_disk,
+    .bdrv_aio_readv     = qcow2_aio_readv,
+    .bdrv_aio_writev    = qcow2_aio_writev,
+    .bdrv_aio_flush     = qcow2_aio_flush,

-    .bdrv_co_discard        = qcow2_co_discard,
+    .bdrv_discard           = qcow2_discard,
    .bdrv_truncate          = qcow2_truncate,
    .bdrv_write_compressed  = qcow2_write_compressed,

@@ -1301,8 +1407,6 @@ static BlockDriver bdrv_qcow2 = {

    .bdrv_change_backing_file   = qcow2_change_backing_file,

-    .bdrv_invalidate_cache      = qcow2_invalidate_cache,
-
    .create_options = qcow2_create_options,
    .bdrv_check = qcow2_check,
 };
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -26,7 +26,6 @@
 #define BLOCK_QCOW2_H

 #include "aes.h"
-#include "qemu-coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -115,8 +114,6 @@ typedef struct BDRVQcowState {
    int64_t free_cluster_index;
    int64_t free_byte_offset;

-    CoMutex lock;
-
    uint32_t crypt_method; /* current crypt method, 0 if no key yet */
    uint32_t crypt_method_header;
    AES_KEY aes_encrypt_key;
@@ -125,8 +122,6 @@ typedef struct BDRVQcowState {
    int snapshots_size;
    int nb_snapshots;
    QCowSnapshot *snapshots;
-
-    int flags;
 } BDRVQcowState;

 /* XXX: use std qcow open function ? */
@@ -150,7 +145,8 @@ typedef struct QCowL2Meta
    int n_start;
    int nb_available;
    int nb_clusters;
-    CoQueue dependent_requests;
+    struct QCowL2Meta *depends_on;
+    QLIST_HEAD(QCowAioDependencies, QCowAIOCB) dependent_requests;

    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;
@@ -190,6 +186,8 @@ void qcow2_free_clusters(BlockDriverState *bs,
 void qcow2_free_any_clusters(BlockDriverState *bs,
    uint64_t cluster_offset, int nb_clusters);

+void qcow2_create_refcount_update(QCowCreateState *s, int64_t offset,
+    int64_t size);
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend);

--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -197,7 +197,7 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
    };
    int ret;

-    check.used_clusters = g_malloc0(((check.nclusters + 31) / 32) *
+    check.used_clusters = qemu_mallocz(((check.nclusters + 31) / 32) *
                                       sizeof(check.used_clusters[0]));

    ret = qed_check_l1_table(&check, s->l1_table);
@@ -206,6 +206,6 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
        qed_check_for_leaks(&check);
    }

-    g_free(check.used_clusters);
+    qemu_free(check.used_clusters);
    return ret;
 }
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -108,7 +108,7 @@ static void qed_find_cluster_cb(void *opaque, int ret)

 out:
    find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
-    g_free(find_cluster_cb);
+    qemu_free(find_cluster_cb);
 }

 /**
@@ -152,7 +152,7 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
        return;
    }

-    find_cluster_cb = g_malloc(sizeof(*find_cluster_cb));
+    find_cluster_cb = qemu_malloc(sizeof(*find_cluster_cb));
    find_cluster_cb->s = s;
    find_cluster_cb->pos = pos;
    find_cluster_cb->len = len;
--- a/block/qed-gencb.c
+++ b/block/qed-gencb.c
@@ -15,7 +15,7 @@

 void *gencb_alloc(size_t len, BlockDriverCompletionFunc *cb, void *opaque)
 {
-    GenericCB *gencb = g_malloc(len);
+    GenericCB *gencb = qemu_malloc(len);
    gencb->cb = cb;
    gencb->opaque = opaque;
    return gencb;
@@ -27,6 +27,6 @@ void gencb_complete(void *opaque, int ret)
    BlockDriverCompletionFunc *cb = gencb->cb;
    void *user_opaque = gencb->opaque;

-    g_free(gencb);
+    qemu_free(gencb);
    cb(user_opaque, ret);
 }
--- a/block/qed-l2-cache.c
+++ b/block/qed-l2-cache.c
@@ -74,7 +74,7 @@ void qed_free_l2_cache(L2TableCache *l2_cache)

    QTAILQ_FOREACH_SAFE(entry, &l2_cache->entries, node, next_entry) {
        qemu_vfree(entry->table);
-        g_free(entry);
+        qemu_free(entry);
    }
 }

@@ -89,7 +89,7 @@ CachedL2Table *qed_alloc_l2_cache_entry(L2TableCache *l2_cache)
 {
    CachedL2Table *entry;

-    entry = g_malloc0(sizeof(*entry));
+    entry = qemu_mallocz(sizeof(*entry));
    entry->ref++;

    trace_qed_alloc_l2_cache_entry(l2_cache, entry);
@@ -111,7 +111,7 @@ void qed_unref_l2_cache_entry(CachedL2Table *entry)
    trace_qed_unref_l2_cache_entry(entry, entry->ref);
    if (entry->ref == 0) {
        qemu_vfree(entry->table);
-        g_free(entry);
+        qemu_free(entry);
    }
 }

--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -179,12 +179,16 @@ int qed_read_l1_table_sync(BDRVQEDState *s)
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_read_table(s, s->header.l1_table_offset,
                   s->l1_table, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    return ret;
 }

@@ -201,11 +205,15 @@ int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_write_l1_table(s, index, n, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    return ret;
 }

@@ -274,11 +282,14 @@ int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request, uint64_t offset
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_read_l2_table(s, request, offset, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
    return ret;
 }

@@ -296,10 +307,13 @@ int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
    return ret;
 }
--- a/block/qed.c
+++ b/block/qed.c
@@ -16,7 +16,6 @@
 #include "trace.h"
 #include "qed.h"
 #include "qerror.h"
-#include "migration.h"

 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -389,6 +388,7 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    if (ret < 0) {
        return ret;
    }
+    ret = 0; /* ret should always be 0 or -errno */
    qed_header_le_to_cpu(&le_header, &s->header);

    if (s->header.magic != QED_MAGIC) {
@@ -505,12 +505,6 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    s->need_check_timer = qemu_new_timer_ns(vm_clock,
                                            qed_need_check_timer_cb, s);

-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "qed", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
-
 out:
    if (ret) {
        qed_free_l2_cache(&s->l2_cache);
@@ -523,9 +517,6 @@ static void bdrv_qed_close(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;

-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
-
    qed_cancel_need_check_timer(s);
    qemu_free_timer(s->need_check_timer);

@@ -542,6 +533,11 @@ static void bdrv_qed_close(BlockDriverState *bs)
    qemu_vfree(s->l1_table);
 }

+static int bdrv_qed_flush(BlockDriverState *bs)
+{
+    return bdrv_flush(bs->file);
+}
+
 static int qed_create(const char *filename, uint32_t cluster_size,
                      uint64_t image_size, uint32_t table_size,
                      const char *backing_file, const char *backing_fmt)
@@ -599,7 +595,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,
        goto out;
    }

-    l1_table = g_malloc0(l1_size);
+    l1_table = qemu_mallocz(l1_size);
    ret = bdrv_pwrite(bs, header.l1_table_offset, l1_table, l1_size);
    if (ret < 0) {
        goto out;
@@ -607,7 +603,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,

    ret = 0; /* success */
 out:
-    g_free(l1_table);
+    qemu_free(l1_table);
    bdrv_delete(bs);
    return ret;
 }
@@ -684,12 +680,16 @@ static int bdrv_qed_is_allocated(BlockDriverState *bs, int64_t sector_num,
    };
    QEDRequest request = { .l2_table = NULL };

+    async_context_push();
+
    qed_find_cluster(s, &request, pos, len, qed_is_allocated_cb, &cb);

    while (cb.is_allocated == -1) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    qed_unref_l2_cache_entry(request.l2_table);

    return cb.is_allocated;
@@ -1423,20 +1423,18 @@ static int bdrv_qed_change_backing_file(BlockDriverState *bs,
    }

    /* Prepare new header */
-    buffer = g_malloc(buffer_len);
+    buffer = qemu_malloc(buffer_len);

    qed_header_cpu_to_le(&new_header, &le_header);
    memcpy(buffer, &le_header, sizeof(le_header));
    buffer_len = sizeof(le_header);

-    if (backing_file) {
-        memcpy(buffer + buffer_len, backing_file, backing_file_len);
-        buffer_len += backing_file_len;
-    }
+    memcpy(buffer + buffer_len, backing_file, backing_file_len);
+    buffer_len += backing_file_len;

    /* Write new header */
    ret = bdrv_pwrite_sync(bs->file, 0, buffer, buffer_len);
-    g_free(buffer);
+    qemu_free(buffer);
    if (ret == 0) {
        memcpy(&s->header, &new_header, sizeof(new_header));
    }
@@ -1485,6 +1483,7 @@ static BlockDriver bdrv_qed = {
    .bdrv_open                = bdrv_qed_open,
    .bdrv_close               = bdrv_qed_close,
    .bdrv_create              = bdrv_qed_create,
+    .bdrv_flush               = bdrv_qed_flush,
    .bdrv_is_allocated        = bdrv_qed_is_allocated,
    .bdrv_make_empty          = bdrv_qed_make_empty,
    .bdrv_aio_readv           = bdrv_qed_aio_readv,
--- a/block/qed.h
+++ b/block/qed.h
@@ -164,8 +164,6 @@ typedef struct {

    /* Periodic flush and clear need check flag */
    QEMUTimer *need_check_timer;
-
-    Error *migration_blocker;
 } BDRVQEDState;

 enum {
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -230,19 +230,13 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
        }
    }

-    /* We're falling back to POSIX AIO in some cases so init always */
-    if (paio_init() < 0) {
-        goto out_free_buf;
-    }
-
 #ifdef CONFIG_LINUX_AIO
-    /*
-     * Currently Linux do AIO only for files opened with O_DIRECT
-     * specified so check NOCACHE flag too
-     */
    if ((bdrv_flags & (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO)) ==
                      (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO)) {

+        /* We're falling back to POSIX AIO in some cases */
+        paio_init();
+
        s->aio_ctx = laio_init();
        if (!s->aio_ctx) {
            goto out_free_buf;
@@ -251,6 +245,9 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
    } else
 #endif
    {
+        if (paio_init() < 0) {
+            goto out_free_buf;
+        }
 #ifdef CONFIG_LINUX_AIO
        s->use_aio = 0;
 #endif
@@ -296,6 +293,273 @@ static int raw_open(BlockDriverState *bs, const char *filename, int flags)
 #endif
 */

+/*
+ * offset and count are in bytes, but must be multiples of 512 for files
+ * opened with O_DIRECT. buf must be aligned to 512 bytes then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pread_aligned(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return ret;
+
+    ret = pread(s->fd, buf, count, offset);
+    if (ret == count)
+        return ret;
+
+    /* Allow reads beyond the end (needed for pwrite) */
+    if ((ret == 0) && bs->growable) {
+        int64_t size = raw_getlength(bs);
+        if (offset >= size) {
+            memset(buf, 0, count);
+            return count;
+        }
+    }
+
+    DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] read failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+    /* Try harder for CDrom. */
+    if (s->type != FTYPE_FILE) {
+        ret = pread(s->fd, buf, count, offset);
+        if (ret == count)
+            return ret;
+        ret = pread(s->fd, buf, count, offset);
+        if (ret == count)
+            return ret;
+
+        DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                          "] retry read failed %d : %d = %s\n",
+                          s->fd, bs->filename, offset, buf, count,
+                          bs->total_sectors, ret, errno, strerror(errno));
+    }
+
+    return  (ret < 0) ? -errno : ret;
+}
+
+/*
+ * offset and count are in bytes, but must be multiples of the sector size
+ * for files opened with O_DIRECT. buf must be aligned to sector size bytes
+ * then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pwrite_aligned(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return -errno;
+
+    ret = pwrite(s->fd, buf, count, offset);
+    if (ret == count)
+        return ret;
+
+    DEBUG_BLOCK_PRINT("raw_pwrite(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] write failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+    return  (ret < 0) ? -errno : ret;
+}
+
+
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pread_aligned to do the actual read.
+ */
+static int raw_pread(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    unsigned sector_mask = bs->buffer_alignment - 1;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL)  {
+
+        if (offset & sector_mask) {
+            /* align offset on a sector size bytes boundary */
+
+            shift = offset & sector_mask;
+            size = (shift + count + sector_mask) & ~sector_mask;
+            if (size > s->aligned_buf_size)
+                size = s->aligned_buf_size;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf, size);
+            if (ret < 0)
+                return ret;
+
+            size = bs->buffer_alignment - shift;
+            if (size > count)
+                size = count;
+            memcpy(buf, s->aligned_buf + shift, size);
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & sector_mask || (uintptr_t) buf & sector_mask) {
+
+            /* read on aligned buffer */
+
+            while (count) {
+
+                size = (count + sector_mask) & ~sector_mask;
+                if (size > s->aligned_buf_size)
+                    size = s->aligned_buf_size;
+
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0) {
+                    return ret;
+                } else if (ret == 0) {
+                    fprintf(stderr, "raw_pread: read beyond end of file\n");
+                    abort();
+                }
+
+                size = ret;
+                if (size > count)
+                    size = count;
+
+                memcpy(buf, s->aligned_buf, size);
+
+                buf += size;
+                offset += size;
+                count -= size;
+                sum += size;
+            }
+
+            return sum;
+        }
+    }
+
+    return raw_pread_aligned(bs, offset, buf, count) + sum;
+}
+
+static int raw_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    int ret;
+
+    ret = raw_pread(bs, sector_num * BDRV_SECTOR_SIZE, buf,
+                    nb_sectors * BDRV_SECTOR_SIZE);
+    if (ret == (nb_sectors * BDRV_SECTOR_SIZE))
+        ret = 0;
+    return ret;
+}
+
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pwrite_aligned to do the actual write.
+ */
+static int raw_pwrite(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    unsigned sector_mask = bs->buffer_alignment - 1;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL) {
+
+        if (offset & sector_mask) {
+            /* align offset on a sector size bytes boundary */
+            shift = offset & sector_mask;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf,
+                                    bs->buffer_alignment);
+            if (ret < 0)
+                return ret;
+
+            size = bs->buffer_alignment - shift;
+            if (size > count)
+                size = count;
+            memcpy(s->aligned_buf + shift, buf, size);
+
+            ret = raw_pwrite_aligned(bs, offset - shift, s->aligned_buf,
+                                     bs->buffer_alignment);
+            if (ret < 0)
+                return ret;
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & sector_mask || (uintptr_t) buf & sector_mask) {
+
+            while ((size = (count & ~sector_mask)) != 0) {
+
+                if (size > s->aligned_buf_size)
+                    size = s->aligned_buf_size;
+
+                memcpy(s->aligned_buf, buf, size);
+
+                ret = raw_pwrite_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0)
+                    return ret;
+
+                buf += ret;
+                offset += ret;
+                count -= ret;
+                sum += ret;
+            }
+            /* here, count < sector_size because (count & ~sector_mask) == 0 */
+            if (count) {
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf,
+                                     bs->buffer_alignment);
+                if (ret < 0)
+                    return ret;
+                 memcpy(s->aligned_buf, buf, count);
+
+                 ret = raw_pwrite_aligned(bs, offset, s->aligned_buf,
+                                     bs->buffer_alignment);
+                 if (ret < 0)
+                     return ret;
+                 if (count < ret)
+                     ret = count;
+
+                 sum += ret;
+            }
+            return sum;
+        }
+    }
+    return raw_pwrite_aligned(bs, offset, buf, count) + sum;
+}
+
+static int raw_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    int ret;
+    ret = raw_pwrite(bs, sector_num * BDRV_SECTOR_SIZE, buf,
+                     nb_sectors * BDRV_SECTOR_SIZE);
+    if (ret == (nb_sectors * BDRV_SECTOR_SIZE))
+        ret = 0;
+    return ret;
+}
+
 /*
 * Check if all memory in this vector is sector aligned.
 */
@@ -323,7 +587,7 @@ static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,

    /*
     * If O_DIRECT is used the buffer needs to be aligned on a sector
-     * boundary.  Check if this is the case or tell the low-level
+     * boundary.  Check if this is the case or telll the low-level
     * driver that it needs to copy the buffer.
     */
    if (s->aligned_buf) {
@@ -382,24 +646,10 @@ static void raw_close(BlockDriverState *bs)
 static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
-    struct stat st;
-
-    if (fstat(s->fd, &st)) {
-        return -errno;
-    }
-
-    if (S_ISREG(st.st_mode)) {
-        if (ftruncate(s->fd, offset) < 0) {
-            return -errno;
-        }
-    } else if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
-       if (offset > raw_getlength(bs)) {
-           return -EINVAL;
-       }
-    } else {
+    if (s->type != FTYPE_FILE)
        return -ENOTSUP;
-    }
-
+    if (ftruncate(s->fd, offset) < 0)
+        return -errno;
    return 0;
 }

@@ -583,6 +833,12 @@ static int raw_create(const char *filename, QEMUOptionParameter *options)
    return result;
 }

+static int raw_flush(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    return qemu_fdatasync(s->fd);
+}
+
 #ifdef CONFIG_XFS
 static int xfs_discard(BDRVRawState *s, int64_t sector_num, int nb_sectors)
 {
@@ -602,8 +858,7 @@ static int xfs_discard(BDRVRawState *s, int64_t sector_num, int nb_sectors)
 }
 #endif

-static coroutine_fn int raw_co_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors)
+static int raw_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
 {
 #ifdef CONFIG_XFS
    BDRVRawState *s = bs->opaque;
@@ -631,9 +886,12 @@ static BlockDriver bdrv_file = {
    .instance_size = sizeof(BDRVRawState),
    .bdrv_probe = NULL, /* no probe for protocols */
    .bdrv_file_open = raw_open,
+    .bdrv_read = raw_read,
+    .bdrv_write = raw_write,
    .bdrv_close = raw_close,
    .bdrv_create = raw_create,
-    .bdrv_co_discard = raw_co_discard,
+    .bdrv_flush = raw_flush,
+    .bdrv_discard = raw_discard,

    .bdrv_aio_readv = raw_aio_readv,
    .bdrv_aio_writev = raw_aio_writev,
@@ -902,12 +1160,14 @@ static BlockDriver bdrv_host_device = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv	= raw_aio_readv,
    .bdrv_aio_writev	= raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
@@ -994,7 +1254,7 @@ static int floppy_media_changed(BlockDriverState *bs)
    return ret;
 }

-static void floppy_eject(BlockDriverState *bs, int eject_flag)
+static int floppy_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;
    int fd;
@@ -1009,6 +1269,8 @@ static void floppy_eject(BlockDriverState *bs, int eject_flag)
            perror("FDEJECT");
        close(fd);
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_floppy = {
@@ -1021,12 +1283,14 @@ static BlockDriver bdrv_host_floppy = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
@@ -1084,7 +1348,7 @@ static int cdrom_is_inserted(BlockDriverState *bs)
    return 0;
 }

-static void cdrom_eject(BlockDriverState *bs, int eject_flag)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;

@@ -1095,9 +1359,11 @@ static void cdrom_eject(BlockDriverState *bs, int eject_flag)
        if (ioctl(s->fd, CDROMCLOSETRAY, NULL) < 0)
            perror("CDROMEJECT");
    }
+
+    return 0;
 }

-static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
 {
    BDRVRawState *s = bs->opaque;

@@ -1108,6 +1374,8 @@ static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
         */
        /* perror("CDROM_LOCKDOOR"); */
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_cdrom = {
@@ -1120,12 +1388,14 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength     = raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
@@ -1133,7 +1403,7 @@ static BlockDriver bdrv_host_cdrom = {
    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
-    .bdrv_lock_medium   = cdrom_lock_medium,
+    .bdrv_set_locked    = cdrom_set_locked,

    /* generic scsi device */
    .bdrv_ioctl         = hdev_ioctl,
@@ -1194,12 +1464,12 @@ static int cdrom_is_inserted(BlockDriverState *bs)
    return raw_getlength(bs) > 0;
 }

-static void cdrom_eject(BlockDriverState *bs, int eject_flag)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;

    if (s->fd < 0)
-        return;
+        return -ENOTSUP;

    (void) ioctl(s->fd, CDIOCALLOW);

@@ -1211,15 +1481,17 @@ static void cdrom_eject(BlockDriverState *bs, int eject_flag)
            perror("CDIOCCLOSE");
    }

-    cdrom_reopen(bs);
+    if (cdrom_reopen(bs) < 0)
+        return -ENOTSUP;
+    return 0;
 }

-static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
 {
    BDRVRawState *s = bs->opaque;

    if (s->fd < 0)
-        return;
+        return -ENOTSUP;
    if (ioctl(s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
        /*
         * Note: an error can happen if the distribution automatically
@@ -1227,6 +1499,8 @@ static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
         */
        /* perror("CDROM_LOCKDOOR"); */
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_cdrom = {
@@ -1239,12 +1513,14 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength     = raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
@@ -1252,7 +1528,7 @@ static BlockDriver bdrv_host_cdrom = {
    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
-    .bdrv_lock_medium   = cdrom_lock_medium,
+    .bdrv_set_locked    = cdrom_set_locked,
 };
 #endif /* __FreeBSD__ */

--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -41,7 +41,6 @@ typedef struct BDRVRawState {
 int qemu_ftruncate64(int fd, int64_t length)
 {
    LARGE_INTEGER li;
-    DWORD dw;
    LONG high;
    HANDLE h;
    BOOL res;
@@ -54,15 +53,12 @@ int qemu_ftruncate64(int fd, int64_t length)
    /* get current position, ftruncate do not change position */
    li.HighPart = 0;
    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
-    if (li.LowPart == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
+    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
 	return -1;
-    }

    high = length >> 32;
-    dw = SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN);
-    if (dw == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
+    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
 	return -1;
-    }
    res = SetEndOfFile(h);

    /* back to old position */
@@ -281,11 +277,9 @@ static BlockDriver bdrv_file = {
    .bdrv_file_open	= raw_open,
    .bdrv_close		= raw_close,
    .bdrv_create	= raw_create,
-
-    .bdrv_read              = raw_read,
-    .bdrv_write             = raw_write,
-    .bdrv_co_flush_to_disk  = raw_flush,
-
+    .bdrv_flush		= raw_flush,
+    .bdrv_read		= raw_read,
+    .bdrv_write		= raw_write,
    .bdrv_truncate	= raw_truncate,
    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
@@ -399,6 +393,41 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
    return 0;
 }

+#if 0
+/***********************************************/
+/* removable device additional commands */
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return 1;
+}
+
+static int raw_media_changed(BlockDriverState *bs)
+{
+    return -ENOTSUP;
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    DWORD ret_count;
+
+    if (s->type == FTYPE_FILE)
+        return -ENOTSUP;
+    if (eject_flag) {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_EJECT_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    } else {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_LOAD_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    }
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    return -ENOTSUP;
+}
+#endif
+
 static int hdev_has_zero_init(BlockDriverState *bs)
 {
    return 0;
@@ -411,12 +440,11 @@ static BlockDriver bdrv_host_device = {
    .bdrv_probe_device	= hdev_probe_device,
    .bdrv_file_open	= hdev_open,
    .bdrv_close		= raw_close,
+    .bdrv_flush		= raw_flush,
    .bdrv_has_zero_init = hdev_has_zero_init,

-    .bdrv_read              = raw_read,
-    .bdrv_write             = raw_write,
-    .bdrv_co_flush_to_disk  = raw_flush,
-
+    .bdrv_read		= raw_read,
+    .bdrv_write	        = raw_write,
    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
--- a/block/raw.c
+++ b/block/raw.c
@@ -9,25 +9,45 @@ static int raw_open(BlockDriverState *bs, int flags)
    return 0;
 }

-static int coroutine_fn raw_co_readv(BlockDriverState *bs, int64_t sector_num,
-                                     int nb_sectors, QEMUIOVector *qiov)
+static int raw_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
 {
-    return bdrv_co_readv(bs->file, sector_num, nb_sectors, qiov);
+    return bdrv_read(bs->file, sector_num, buf, nb_sectors);
 }

-static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
-                                      int nb_sectors, QEMUIOVector *qiov)
+static int raw_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
 {
-    return bdrv_co_writev(bs->file, sector_num, nb_sectors, qiov);
+    return bdrv_write(bs->file, sector_num, buf, nb_sectors);
+}
+
+static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
+    int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+}
+
+static BlockDriverAIOCB *raw_aio_writev(BlockDriverState *bs,
+    int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
 }

 static void raw_close(BlockDriverState *bs)
 {
 }

-static int coroutine_fn raw_co_flush(BlockDriverState *bs)
+static int raw_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
+}
+
+static BlockDriverAIOCB *raw_aio_flush(BlockDriverState *bs,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int64_t raw_getlength(BlockDriverState *bs)
@@ -45,10 +65,9 @@ static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)
   return 1; /* everything can be opened as raw image */
 }

-static int coroutine_fn raw_co_discard(BlockDriverState *bs,
-                                       int64_t sector_num, int nb_sectors)
+static int raw_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
 {
-    return bdrv_co_discard(bs->file, sector_num, nb_sectors);
+    return bdrv_discard(bs->file, sector_num, nb_sectors);
 }

 static int raw_is_inserted(BlockDriverState *bs)
@@ -56,19 +75,15 @@ static int raw_is_inserted(BlockDriverState *bs)
    return bdrv_is_inserted(bs->file);
 }

-static int raw_media_changed(BlockDriverState *bs)
+static int raw_eject(BlockDriverState *bs, int eject_flag)
 {
-    return bdrv_media_changed(bs->file);
+    return bdrv_eject(bs->file, eject_flag);
 }

-static void raw_eject(BlockDriverState *bs, int eject_flag)
+static int raw_set_locked(BlockDriverState *bs, int locked)
 {
-    bdrv_eject(bs->file, eject_flag);
-}
-
-static void raw_lock_medium(BlockDriverState *bs, bool locked)
-{
-    bdrv_lock_medium(bs->file, locked);
+    bdrv_set_locked(bs->file, locked);
+    return 0;
 }

 static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
@@ -105,26 +120,26 @@ static int raw_has_zero_init(BlockDriverState *bs)
 static BlockDriver bdrv_raw = {
    .format_name        = "raw",

-    /* It's really 0, but we need to make g_malloc() happy */
+    /* It's really 0, but we need to make qemu_malloc() happy */
    .instance_size      = 1,

    .bdrv_open          = raw_open,
    .bdrv_close         = raw_close,
-
-    .bdrv_co_readv          = raw_co_readv,
-    .bdrv_co_writev         = raw_co_writev,
-    .bdrv_co_flush_to_disk  = raw_co_flush,
-    .bdrv_co_discard        = raw_co_discard,
-
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
+    .bdrv_flush         = raw_flush,
    .bdrv_probe         = raw_probe,
    .bdrv_getlength     = raw_getlength,
    .bdrv_truncate      = raw_truncate,

-    .bdrv_is_inserted   = raw_is_inserted,
-    .bdrv_media_changed = raw_media_changed,
-    .bdrv_eject         = raw_eject,
-    .bdrv_lock_medium   = raw_lock_medium,
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
+    .bdrv_aio_flush     = raw_aio_flush,
+    .bdrv_discard       = raw_discard,

+    .bdrv_is_inserted   = raw_is_inserted,
+    .bdrv_eject         = raw_eject,
+    .bdrv_set_locked    = raw_set_locked,
    .bdrv_ioctl         = raw_ioctl,
    .bdrv_aio_ioctl     = raw_aio_ioctl,

--- a/block/rbd.c
+++ b/block/rbd.c
@@ -13,33 +13,35 @@

 #include "qemu-common.h"
 #include "qemu-error.h"
+
 #include "block_int.h"

 #include <rbd/librbd.h>

+
+
 /*
 * When specifying the image filename use:
 *
 * rbd:poolname/devicename[@snapshotname][:option1=value1[:option2=value2...]]
 *
- * poolname must be the name of an existing rados pool.
+ * poolname must be the name of an existing rados pool
 *
- * devicename is the name of the rbd image.
+ * devicename is the basename for all objects used to
+ * emulate the raw device.
 *
- * Each option given is used to configure rados, and may be any valid
- * Ceph option, "id", or "conf".
+ * Each option given is used to configure rados, and may be
+ * any Ceph option, or "conf". The "conf" option specifies
+ * a Ceph configuration file to read.
 *
- * The "id" option indicates what user we should authenticate as to
- * the Ceph cluster.  If it is excluded we will use the Ceph default
- * (normally 'admin').
+ * Metadata information (image size, ...) is stored in an
+ * object with the name "devicename.rbd".
 *
- * The "conf" option specifies a Ceph configuration file to read.  If
- * it is not specified, we will read from the default Ceph locations
- * (e.g., /etc/ceph/ceph.conf).  To avoid reading _any_ configuration
- * file, specify conf=/dev/null.
+ * The raw device is split into 4MB sized objects by default.
+ * The sequencenumber is encoded in a 12 byte long hex-string,
+ * and is attached to the devicename, separated by a dot.
+ * e.g. "devicename.1234567890ab"
 *
- * Configuration values containing :, @, or = can be escaped with a
- * leading "\".
 */

 #define OBJ_MAX_SIZE (1UL << OBJ_DEFAULT_OBJ_ORDER)
@@ -102,15 +104,8 @@ static int qemu_rbd_next_tok(char *dst, int dst_len,
    *p = NULL;

    if (delim != '\0') {
-        for (end = src; *end; ++end) {
-            if (*end == delim) {
-                break;
-            }
-            if (*end == '\\' && end[1] != '\0') {
-                end++;
-            }
-        }
-        if (*end == delim) {
+        end = strchr(src, delim);
+        if (end) {
            *p = end + 1;
            *end = '\0';
        }
@@ -129,19 +124,6 @@ static int qemu_rbd_next_tok(char *dst, int dst_len,
    return 0;
 }

-static void qemu_rbd_unescape(char *src)
-{
-    char *p;
-
-    for (p = src; *src; ++src, ++p) {
-        if (*src == '\\' && src[1] != '\0') {
-            src++;
-        }
-        *p = *src;
-    }
-    *p = '\0';
-}
-
 static int qemu_rbd_parsename(const char *filename,
                              char *pool, int pool_len,
                              char *snap, int snap_len,
@@ -156,7 +138,7 @@ static int qemu_rbd_parsename(const char *filename,
        return -EINVAL;
    }

-    buf = g_strdup(start);
+    buf = qemu_strdup(start);
    p = buf;
    *snap = '\0';
    *conf = '\0';
@@ -166,7 +148,6 @@ static int qemu_rbd_parsename(const char *filename,
        ret = -EINVAL;
        goto done;
    }
-    qemu_rbd_unescape(pool);

    if (strchr(p, '@')) {
        ret = qemu_rbd_next_tok(name, name_len, p, '@', "object name", &p);
@@ -174,11 +155,9 @@ static int qemu_rbd_parsename(const char *filename,
            goto done;
        }
        ret = qemu_rbd_next_tok(snap, snap_len, p, ':', "snap name", &p);
-        qemu_rbd_unescape(snap);
    } else {
        ret = qemu_rbd_next_tok(name, name_len, p, ':', "object name", &p);
    }
-    qemu_rbd_unescape(name);
    if (ret < 0 || !p) {
        goto done;
    }
@@ -186,38 +165,10 @@ static int qemu_rbd_parsename(const char *filename,
    ret = qemu_rbd_next_tok(conf, conf_len, p, '\0', "configuration", &p);

 done:
-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

-static char *qemu_rbd_parse_clientname(const char *conf, char *clientname)
-{
-    const char *p = conf;
-
-    while (*p) {
-        int len;
-        const char *end = strchr(p, ':');
-
-        if (end) {
-            len = end - p;
-        } else {
-            len = strlen(p);
-        }
-
-        if (strncmp(p, "id=", 3) == 0) {
-            len -= 3;
-            strncpy(clientname, p + 3, len);
-            clientname[len] = '\0';
-            return clientname;
-        }
-        if (end == NULL) {
-            break;
-        }
-        p = end + 1;
-    }
-    return NULL;
-}
-
 static int qemu_rbd_set_conf(rados_t cluster, const char *conf)
 {
    char *p, *buf;
@@ -225,7 +176,7 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf)
    char value[RBD_MAX_CONF_VAL_SIZE];
    int ret = 0;

-    buf = g_strdup(conf);
+    buf = qemu_strdup(conf);
    p = buf;

    while (p) {
@@ -234,7 +185,6 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf)
        if (ret < 0) {
            break;
        }
-        qemu_rbd_unescape(name);

        if (!p) {
            error_report("conf option %s has no value", name);
@@ -247,27 +197,24 @@ static int qemu_rbd_set_conf(rados_t cluster, const char *conf)
        if (ret < 0) {
            break;
        }
-        qemu_rbd_unescape(value);

-        if (strcmp(name, "conf") == 0) {
-            ret = rados_conf_read_file(cluster, value);
-            if (ret < 0) {
-                error_report("error reading conf file %s", value);
-                break;
-            }
-        } else if (strcmp(name, "id") == 0) {
-            /* ignore, this is parsed by qemu_rbd_parse_clientname() */
-        } else {
+        if (strcmp(name, "conf")) {
            ret = rados_conf_set(cluster, name, value);
            if (ret < 0) {
                error_report("invalid conf option %s", name);
                ret = -EINVAL;
                break;
            }
+        } else {
+            ret = rados_conf_read_file(cluster, value);
+            if (ret < 0) {
+                error_report("error reading conf file %s", value);
+                break;
+            }
        }
    }

-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

@@ -280,8 +227,6 @@ static int qemu_rbd_create(const char *filename, QEMUOptionParameter *options)
    char name[RBD_MAX_IMAGE_NAME_SIZE];
    char snap_buf[RBD_MAX_SNAP_NAME_SIZE];
    char conf[RBD_MAX_CONF_SIZE];
-    char clientname_buf[RBD_MAX_CONF_SIZE];
-    char *clientname;
    rados_t cluster;
    rados_ioctx_t io_ctx;
    int ret;
@@ -314,15 +259,17 @@ static int qemu_rbd_create(const char *filename, QEMUOptionParameter *options)
        options++;
    }

-    clientname = qemu_rbd_parse_clientname(conf, clientname_buf);
-    if (rados_create(&cluster, clientname) < 0) {
+    if (rados_create(&cluster, NULL) < 0) {
        error_report("error initializing");
        return -EIO;
    }

    if (strstr(conf, "conf=") == NULL) {
-        /* try default location, but ignore failure */
-        rados_conf_read_file(cluster, NULL);
+        if (rados_conf_read_file(cluster, NULL) < 0) {
+            error_report("error reading config file");
+            rados_shutdown(cluster);
+            return -EIO;
+        }
    }

    if (conf[0] != '\0' &&
@@ -394,7 +341,7 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
    acb->bh = qemu_bh_new(rbd_aio_bh_cb, acb);
    qemu_bh_schedule(acb->bh);
 done:
-    g_free(rcb);
+    qemu_free(rcb);
 }

 /*
@@ -411,14 +358,15 @@ static void qemu_rbd_aio_event_reader(void *opaque)
        char *p = (char *)&s->event_rcb;

        /* now read the rcb pointer that was sent from a non qemu thread */
-        ret = read(s->fds[RBD_FD_READ], p + s->event_reader_pos,
-                   sizeof(s->event_rcb) - s->event_reader_pos);
-        if (ret > 0) {
-            s->event_reader_pos += ret;
-            if (s->event_reader_pos == sizeof(s->event_rcb)) {
-                s->event_reader_pos = 0;
-                qemu_rbd_complete_aio(s->event_rcb);
-                s->qemu_aio_count--;
+        if ((ret = read(s->fds[RBD_FD_READ], p + s->event_reader_pos,
+                        sizeof(s->event_rcb) - s->event_reader_pos)) > 0) {
+            if (ret > 0) {
+                s->event_reader_pos += ret;
+                if (s->event_reader_pos == sizeof(s->event_rcb)) {
+                    s->event_reader_pos = 0;
+                    qemu_rbd_complete_aio(s->event_rcb);
+                    s->qemu_aio_count--;
+                }
            }
        }
    } while (ret < 0 && errno == EINTR);
@@ -437,8 +385,6 @@ static int qemu_rbd_open(BlockDriverState *bs, const char *filename, int flags)
    char pool[RBD_MAX_POOL_NAME_SIZE];
    char snap_buf[RBD_MAX_SNAP_NAME_SIZE];
    char conf[RBD_MAX_CONF_SIZE];
-    char clientname_buf[RBD_MAX_CONF_SIZE];
-    char *clientname;
    int r;

    if (qemu_rbd_parsename(filename, pool, sizeof(pool),
@@ -447,48 +393,55 @@ static int qemu_rbd_open(BlockDriverState *bs, const char *filename, int flags)
                           conf, sizeof(conf)) < 0) {
        return -EINVAL;
    }
+    s->snap = NULL;
+    if (snap_buf[0] != '\0') {
+        s->snap = qemu_strdup(snap_buf);
+    }

-    clientname = qemu_rbd_parse_clientname(conf, clientname_buf);
-    r = rados_create(&s->cluster, clientname);
+    r = rados_create(&s->cluster, NULL);
    if (r < 0) {
        error_report("error initializing");
        return r;
    }

-    s->snap = NULL;
-    if (snap_buf[0] != '\0') {
-        s->snap = g_strdup(snap_buf);
-    }
-
    if (strstr(conf, "conf=") == NULL) {
-        /* try default location, but ignore failure */
-        rados_conf_read_file(s->cluster, NULL);
+        r = rados_conf_read_file(s->cluster, NULL);
+        if (r < 0) {
+            error_report("error reading config file");
+            rados_shutdown(s->cluster);
+            return r;
+        }
    }

    if (conf[0] != '\0') {
        r = qemu_rbd_set_conf(s->cluster, conf);
        if (r < 0) {
            error_report("error setting config options");
-            goto failed_shutdown;
+            rados_shutdown(s->cluster);
+            return r;
        }
    }

    r = rados_connect(s->cluster);
    if (r < 0) {
        error_report("error connecting");
-        goto failed_shutdown;
+        rados_shutdown(s->cluster);
+        return r;
    }

    r = rados_ioctx_create(s->cluster, pool, &s->io_ctx);
    if (r < 0) {
        error_report("error opening pool %s", pool);
-        goto failed_shutdown;
+        rados_shutdown(s->cluster);
+        return r;
    }

    r = rbd_open(s->io_ctx, s->name, &s->image, s->snap);
    if (r < 0) {
        error_report("error reading header from %s", s->name);
-        goto failed_open;
+        rados_ioctx_destroy(s->io_ctx);
+        rados_shutdown(s->cluster);
+        return r;
    }

    bs->read_only = (s->snap != NULL);
@@ -509,11 +462,8 @@ static int qemu_rbd_open(BlockDriverState *bs, const char *filename, int flags)

 failed:
    rbd_close(s->image);
-failed_open:
    rados_ioctx_destroy(s->io_ctx);
-failed_shutdown:
    rados_shutdown(s->cluster);
-    g_free(s->snap);
    return r;
 }

@@ -528,7 +478,7 @@ static void qemu_rbd_close(BlockDriverState *bs)

    rbd_close(s->image);
    rados_ioctx_destroy(s->io_ctx);
-    g_free(s->snap);
+    qemu_free(s->snap);
    rados_shutdown(s->cluster);
 }

@@ -594,7 +544,7 @@ static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
    ret = qemu_rbd_send_pipe(rcb->s, rcb);
    if (ret < 0) {
        error_report("failed writing to acb->s->fds");
-        g_free(rcb);
+        qemu_free(rcb);
    }
 }

@@ -655,7 +605,7 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,

    s->qemu_aio_count++; /* All the RADOSCB */

-    rcb = g_malloc(sizeof(RADOSCB));
+    rcb = qemu_malloc(sizeof(RADOSCB));
    rcb->done = 0;
    rcb->acb = acb;
    rcb->buf = buf;
@@ -679,7 +629,7 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,
    return &acb->common;

 failed:
-    g_free(rcb);
+    qemu_free(rcb);
    s->qemu_aio_count--;
    qemu_aio_release(acb);
    return NULL;
@@ -705,17 +655,6 @@ static BlockDriverAIOCB *qemu_rbd_aio_writev(BlockDriverState *bs,
    return rbd_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
 }

-static int qemu_rbd_co_flush(BlockDriverState *bs)
-{
-#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 1)
-    /* rbd_flush added in 0.1.1 */
-    BDRVRBDState *s = bs->opaque;
-    return rbd_flush(s->image);
-#else
-    return 0;
-#endif
-}
-
 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
    BDRVRBDState *s = bs->opaque;
@@ -800,18 +739,18 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
    int max_snaps = RBD_MAX_SNAPS;

    do {
-        snaps = g_malloc(sizeof(*snaps) * max_snaps);
+        snaps = qemu_malloc(sizeof(*snaps) * max_snaps);
        snap_count = rbd_snap_list(s->image, snaps, &max_snaps);
        if (snap_count < 0) {
-            g_free(snaps);
+            qemu_free(snaps);
        }
    } while (snap_count == -ERANGE);

    if (snap_count <= 0) {
-        goto done;
+        return snap_count;
    }

-    sn_tab = g_malloc0(snap_count * sizeof(QEMUSnapshotInfo));
+    sn_tab = qemu_mallocz(snap_count * sizeof(QEMUSnapshotInfo));

    for (i = 0; i < snap_count; i++) {
        const char *snap_name = snaps[i].name;
@@ -827,7 +766,6 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
    }
    rbd_snap_list_end(snaps);

- done:
    *psn_tab = sn_tab;
    return snap_count;
 }
@@ -858,12 +796,11 @@ static BlockDriver bdrv_rbd = {
    .bdrv_truncate      = qemu_rbd_truncate,
    .protocol_name      = "rbd",

-    .bdrv_aio_readv         = qemu_rbd_aio_readv,
-    .bdrv_aio_writev        = qemu_rbd_aio_writev,
-    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
+    .bdrv_aio_readv     = qemu_rbd_aio_readv,
+    .bdrv_aio_writev    = qemu_rbd_aio_writev,

-    .bdrv_snapshot_create   = qemu_rbd_snap_create,
-    .bdrv_snapshot_list     = qemu_rbd_snap_list,
+    .bdrv_snapshot_create = qemu_rbd_snap_create,
+    .bdrv_snapshot_list = qemu_rbd_snap_list,
 };

 static void bdrv_rbd_init(void)
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -66,7 +66,7 @@
 * 20 - 31 (12 bits): reserved data object space
 * 32 - 55 (24 bits): vdi object space
 * 56 - 59 ( 4 bits): reserved vdi object space
- * 60 - 63 ( 4 bits): object type identifier space
+ * 60 - 63 ( 4 bits): object type indentifier space
 */

 #define VDI_SPACE_SHIFT   32
@@ -274,7 +274,7 @@ struct SheepdogAIOCB {
    int ret;
    enum AIOCBState aiocb_type;

-    Coroutine *coroutine;
+    QEMUBH *bh;
    void (*aio_done_func)(SheepdogAIOCB *);

    int canceled;
@@ -295,10 +295,6 @@ typedef struct BDRVSheepdogState {
    char *port;
    int fd;

-    CoMutex lock;
-    Coroutine *co_send;
-    Coroutine *co_recv;
-
    uint32_t aioreq_seq_num;
    QLIST_HEAD(outstanding_aio_head, AIOReq) outstanding_aio_head;
 } BDRVSheepdogState;
@@ -350,16 +346,19 @@ static const char * sd_strerror(int err)
 /*
 * Sheepdog I/O handling:
 *
- * 1. In sd_co_rw_vector, we send the I/O requests to the server and
- *    link the requests to the outstanding_list in the
- *    BDRVSheepdogState.  The function exits without waiting for
- *    receiving the response.
+ * 1. In the sd_aio_readv/writev, read/write requests are added to the
+ *    QEMU Bottom Halves.
 *
- * 2. We receive the response in aio_read_response, the fd handler to
+ * 2. In sd_readv_writev_bh_cb, the callbacks of BHs, we send the I/O
+ *    requests to the server and link the requests to the
+ *    outstanding_list in the BDRVSheepdogState.  we exits the
+ *    function without waiting for receiving the response.
+ *
+ * 3. We receive the response in aio_read_response, the fd handler to
 *    the sheepdog connection.  If metadata update is needed, we send
 *    the write request to the vdi object in sd_write_done, the write
- *    completion function.  We switch back to sd_co_readv/writev after
- *    all the requests belonging to the AIOCB are finished.
+ *    completion function.  The AIOCB callback is not called until all
+ *    the requests belonging to the AIOCB are finished.
 */

 static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
@@ -369,7 +368,7 @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
 {
    AIOReq *aio_req;

-    aio_req = g_malloc(sizeof(*aio_req));
+    aio_req = qemu_malloc(sizeof(*aio_req));
    aio_req->aiocb = acb;
    aio_req->iov_offset = iov_offset;
    aio_req->oid = oid;
@@ -391,15 +390,15 @@ static inline int free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
    SheepdogAIOCB *acb = aio_req->aiocb;
    QLIST_REMOVE(aio_req, outstanding_aio_siblings);
    QLIST_REMOVE(aio_req, aioreq_siblings);
-    g_free(aio_req);
+    qemu_free(aio_req);

    return !QLIST_EMPTY(&acb->aioreq_head);
 }

-static void coroutine_fn sd_finish_aiocb(SheepdogAIOCB *acb)
+static void sd_finish_aiocb(SheepdogAIOCB *acb)
 {
    if (!acb->canceled) {
-        qemu_coroutine_enter(acb->coroutine, NULL);
+        acb->common.cb(acb->common.opaque, acb->ret);
    }
    qemu_aio_release(acb);
 }
@@ -412,8 +411,7 @@ static void sd_aio_cancel(BlockDriverAIOCB *blockacb)
     * Sheepdog cannot cancel the requests which are already sent to
     * the servers, so we just complete the request with -EIO here.
     */
-    acb->ret = -EIO;
-    qemu_coroutine_enter(acb->coroutine, NULL);
+    acb->common.cb(acb->common.opaque, -EIO);
    acb->canceled = 1;
 }

@@ -437,12 +435,24 @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,

    acb->aio_done_func = NULL;
    acb->canceled = 0;
-    acb->coroutine = qemu_coroutine_self();
+    acb->bh = NULL;
    acb->ret = 0;
    QLIST_INIT(&acb->aioreq_head);
    return acb;
 }

+static int sd_schedule_bh(QEMUBHFunc *cb, SheepdogAIOCB *acb)
+{
+    if (acb->bh) {
+        error_report("bug: %d %d", acb->aiocb_type, acb->aiocb_type);
+        return -EIO;
+    }
+
+    acb->bh = qemu_bh_new(cb, acb);
+    qemu_bh_schedule(acb->bh);
+    return 0;
+}
+
 #ifdef _WIN32

 struct msghdr {
@@ -460,7 +470,7 @@ static ssize_t sendmsg(int s, const struct msghdr *msg, int flags)
    for (i = 0; i < msg->msg_iovlen; i++) {
        size += msg->msg_iov[i].iov_len;
    }
-    buf = g_malloc(size);
+    buf = qemu_malloc(size);

    p = buf;
    for (i = 0; i < msg->msg_iovlen; i++) {
@@ -470,7 +480,7 @@ static ssize_t sendmsg(int s, const struct msghdr *msg, int flags)

    ret = send(s, buf, size, flags);

-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

@@ -484,7 +494,7 @@ static ssize_t recvmsg(int s, struct msghdr *msg, int flags)
    for (i = 0; i < msg->msg_iovlen; i++) {
        size += msg->msg_iov[i].iov_len;
    }
-    buf = g_malloc(size);
+    buf = qemu_malloc(size);

    ret = qemu_recv(s, buf, size, flags);
    if (ret < 0) {
@@ -497,7 +507,7 @@ static ssize_t recvmsg(int s, struct msghdr *msg, int flags)
        p += msg->msg_iov[i].iov_len;
    }
 out:
-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

@@ -625,13 +635,7 @@ static int do_readv_writev(int sockfd, struct iovec *iov, int len,
 again:
    ret = do_send_recv(sockfd, iov, len, iov_offset, write);
    if (ret < 0) {
-        if (errno == EINTR) {
-            goto again;
-        }
-        if (errno == EAGAIN) {
-            if (qemu_in_coroutine()) {
-                qemu_coroutine_yield();
-            }
+        if (errno == EINTR || errno == EAGAIN) {
            goto again;
        }
        error_report("failed to recv a rsp, %s", strerror(errno));
@@ -735,7 +739,7 @@ out:
    return ret;
 }

-static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
+static int add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
                           struct iovec *iov, int niov, int create,
                           enum AIOCBState aiocb_type);

@@ -743,7 +747,7 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
 * This function searchs pending requests to the object `oid', and
 * sends them.
 */
-static void coroutine_fn send_pending_req(BDRVSheepdogState *s, uint64_t oid, uint32_t id)
+static void send_pending_req(BDRVSheepdogState *s, uint64_t oid, uint32_t id)
 {
    AIOReq *aio_req, *next;
    SheepdogAIOCB *acb;
@@ -777,7 +781,7 @@ static void coroutine_fn send_pending_req(BDRVSheepdogState *s, uint64_t oid, ui
 * This function is registered as a fd handler, and called from the
 * main loop when s->fd is ready for reading responses.
 */
-static void coroutine_fn aio_read_response(void *opaque)
+static void aio_read_response(void *opaque)
 {
    SheepdogObjRsp rsp;
    BDRVSheepdogState *s = opaque;
@@ -789,14 +793,14 @@ static void coroutine_fn aio_read_response(void *opaque)
    unsigned long idx;

    if (QLIST_EMPTY(&s->outstanding_aio_head)) {
-        goto out;
+        return;
    }

    /* read a header */
    ret = do_read(fd, &rsp, sizeof(rsp));
    if (ret) {
        error_report("failed to get the header, %s", strerror(errno));
-        goto out;
+        return;
    }

    /* find the right aio_req from the outstanding_aio list */
@@ -807,7 +811,7 @@ static void coroutine_fn aio_read_response(void *opaque)
    }
    if (!aio_req) {
        error_report("cannot find aio_req %x", rsp.id);
-        goto out;
+        return;
    }

    acb = aio_req->aiocb;
@@ -843,7 +847,7 @@ static void coroutine_fn aio_read_response(void *opaque)
                       aio_req->iov_offset);
        if (ret) {
            error_report("failed to get the data, %s", strerror(errno));
-            goto out;
+            return;
        }
        break;
    }
@@ -857,30 +861,10 @@ static void coroutine_fn aio_read_response(void *opaque)
    if (!rest) {
        /*
         * We've finished all requests which belong to the AIOCB, so
-         * we can switch back to sd_co_readv/writev now.
+         * we can call the callback now.
         */
        acb->aio_done_func(acb);
    }
-out:
-    s->co_recv = NULL;
-}
-
-static void co_read_response(void *opaque)
-{
-    BDRVSheepdogState *s = opaque;
-
-    if (!s->co_recv) {
-        s->co_recv = qemu_coroutine_create(aio_read_response);
-    }
-
-    qemu_coroutine_enter(s->co_recv, opaque);
-}
-
-static void co_write_request(void *opaque)
-{
-    BDRVSheepdogState *s = opaque;
-
-    qemu_coroutine_enter(s->co_send, NULL);
 }

 static int aio_flush_request(void *opaque)
@@ -940,7 +924,7 @@ static int get_sheep_fd(BDRVSheepdogState *s)
        return -1;
    }

-    qemu_aio_set_fd_handler(fd, co_read_response, NULL, aio_flush_request,
+    qemu_aio_set_fd_handler(fd, aio_read_response, NULL, aio_flush_request,
                            NULL, s);
    return fd;
 }
@@ -968,7 +952,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
    char *p, *q;
    int nr_sep;

-    p = q = g_strdup(filename);
+    p = q = qemu_strdup(filename);

    /* count the number of separators */
    nr_sep = 0;
@@ -1008,7 +992,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
    }

    if (s->addr == NULL) {
-        g_free(q);
+        qemu_free(q);
    }

    return 0;
@@ -1064,7 +1048,7 @@ out:
    return ret;
 }

-static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
+static int add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
                           struct iovec *iov, int niov, int create,
                           enum AIOCBState aiocb_type)
 {
@@ -1107,16 +1091,11 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,

    hdr.id = aio_req->id;

-    qemu_co_mutex_lock(&s->lock);
-    s->co_send = qemu_coroutine_self();
-    qemu_aio_set_fd_handler(s->fd, co_read_response, co_write_request,
-                            aio_flush_request, NULL, s);
    set_cork(s->fd, 1);

    /* send a header */
    ret = do_write(s->fd, &hdr, sizeof(hdr));
    if (ret) {
-        qemu_co_mutex_unlock(&s->lock);
        error_report("failed to send a req, %s", strerror(errno));
        return -EIO;
    }
@@ -1124,16 +1103,12 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
    if (wlen) {
        ret = do_writev(s->fd, iov, wlen, aio_req->iov_offset);
        if (ret) {
-            qemu_co_mutex_unlock(&s->lock);
            error_report("failed to send a data, %s", strerror(errno));
            return -EIO;
        }
    }

    set_cork(s->fd, 0);
-    qemu_aio_set_fd_handler(s->fd, co_read_response, NULL,
-                            aio_flush_request, NULL, s);
-    qemu_co_mutex_unlock(&s->lock);

    return 0;
 }
@@ -1235,7 +1210,7 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)
        goto out;
    }

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), 0, SD_INODE_SIZE, 0);

    closesocket(fd);
@@ -1250,15 +1225,14 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)

    bs->total_sectors = s->inode.vdi_size / SECTOR_SIZE;
    strncpy(s->name, vdi, sizeof(s->name));
-    qemu_co_mutex_init(&s->lock);
-    g_free(buf);
+    qemu_free(buf);
    return 0;
 out:
    qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
    if (s->fd >= 0) {
        closesocket(s->fd);
    }
-    g_free(buf);
+    qemu_free(buf);
    return -1;
 }

@@ -1317,7 +1291,7 @@ static int sd_prealloc(const char *filename)
    BlockDriverState *bs = NULL;
    uint32_t idx, max_idx;
    int64_t vdi_size;
-    void *buf = g_malloc0(SD_DATA_OBJ_SIZE);
+    void *buf = qemu_mallocz(SD_DATA_OBJ_SIZE);
    int ret;

    ret = bdrv_file_open(&bs, filename, BDRV_O_RDWR);
@@ -1350,7 +1324,7 @@ out:
    if (bs) {
        bdrv_delete(bs);
    }
-    g_free(buf);
+    qemu_free(buf);

    return ret;
 }
@@ -1470,7 +1444,7 @@ static void sd_close(BlockDriverState *bs)

    qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
    closesocket(s->fd);
-    g_free(s->addr);
+    qemu_free(s->addr);
 }

 static int64_t sd_getlength(BlockDriverState *bs)
@@ -1517,9 +1491,9 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
 /*
 * This function is called after writing data objects.  If we need to
 * update metadata, this sends a write request to the vdi object.
- * Otherwise, this switches back to sd_co_readv/writev.
+ * Otherwise, this calls the AIOCB callback.
 */
-static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
+static void sd_write_done(SheepdogAIOCB *acb)
 {
    int ret;
    BDRVSheepdogState *s = acb->common.bs->opaque;
@@ -1568,7 +1542,7 @@ static int sd_create_branch(BDRVSheepdogState *s)

    dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);

    ret = do_sd_create(s->name, s->inode.vdi_size, s->inode.vdi_id, &vid, 1,
                       s->addr, s->port);
@@ -1600,7 +1574,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
    dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);

 out:
-    g_free(buf);
+    qemu_free(buf);

    return ret;
 }
@@ -1613,11 +1587,8 @@ out:
 * waiting the response.  The responses are received in the
 * `aio_read_response' function which is called from the main loop as
 * a fd handler.
- *
- * Returns 1 when we need to wait a response, 0 when there is no sent
- * request and -errno in error cases.
 */
-static int coroutine_fn sd_co_rw_vector(void *p)
+static void sd_readv_writev_bh_cb(void *p)
 {
    SheepdogAIOCB *acb = p;
    int ret = 0;
@@ -1629,6 +1600,9 @@ static int coroutine_fn sd_co_rw_vector(void *p)
    SheepdogInode *inode = &s->inode;
    AIOReq *aio_req;

+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+
    if (acb->aiocb_type == AIOCB_WRITE_UDATA && s->is_snapshot) {
        /*
         * In the case we open the snapshot VDI, Sheepdog creates the
@@ -1710,47 +1684,42 @@ static int coroutine_fn sd_co_rw_vector(void *p)
    }
 out:
    if (QLIST_EMPTY(&acb->aioreq_head)) {
-        return acb->ret;
+        sd_finish_aiocb(acb);
    }
-    return 1;
 }

-static int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
-                        int nb_sectors, QEMUIOVector *qiov)
+static BlockDriverAIOCB *sd_aio_writev(BlockDriverState *bs, int64_t sector_num,
+                                       QEMUIOVector *qiov, int nb_sectors,
+                                       BlockDriverCompletionFunc *cb,
+                                       void *opaque)
 {
    SheepdogAIOCB *acb;
-    int ret;

    if (bs->growable && sector_num + nb_sectors > bs->total_sectors) {
        /* TODO: shouldn't block here */
        if (sd_truncate(bs, (sector_num + nb_sectors) * SECTOR_SIZE) < 0) {
-            return -EIO;
+            return NULL;
        }
        bs->total_sectors = sector_num + nb_sectors;
    }

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, cb, opaque);
    acb->aio_done_func = sd_write_done;
    acb->aiocb_type = AIOCB_WRITE_UDATA;

-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        qemu_aio_release(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
-
-    return acb->ret;
+    sd_schedule_bh(sd_readv_writev_bh_cb, acb);
+    return &acb->common;
 }

-static int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
-                       int nb_sectors, QEMUIOVector *qiov)
+static BlockDriverAIOCB *sd_aio_readv(BlockDriverState *bs, int64_t sector_num,
+                                      QEMUIOVector *qiov, int nb_sectors,
+                                      BlockDriverCompletionFunc *cb,
+                                      void *opaque)
 {
    SheepdogAIOCB *acb;
-    int i, ret;
+    int i;

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, cb, opaque);
    acb->aiocb_type = AIOCB_READ_UDATA;
    acb->aio_done_func = sd_finish_aiocb;

@@ -1762,15 +1731,8 @@ static int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
        memset(qiov->iov[i].iov_base, 0, qiov->iov[i].iov_len);
    }

-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        qemu_aio_release(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
-
-    return acb->ret;
+    sd_schedule_bh(sd_readv_writev_bh_cb, acb);
+    return &acb->common;
 }

 static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -1824,7 +1786,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        goto cleanup;
    }

-    inode = (SheepdogInode *)g_malloc(datalen);
+    inode = (SheepdogInode *)qemu_malloc(datalen);

    ret = read_object(fd, (char *)inode, vid_to_vdi_oid(new_vid),
                      s->inode.nr_copies, datalen, 0);
@@ -1854,7 +1816,7 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    uint32_t snapid = 0;
    int ret = -ENOENT, fd;

-    old_s = g_malloc(sizeof(BDRVSheepdogState));
+    old_s = qemu_malloc(sizeof(BDRVSheepdogState));

    memcpy(old_s, s, sizeof(BDRVSheepdogState));

@@ -1880,7 +1842,7 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
        goto out;
    }

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), s->inode.nr_copies,
                      SD_INODE_SIZE, 0);

@@ -1901,15 +1863,15 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)

    s->is_snapshot = 1;

-    g_free(buf);
-    g_free(old_s);
+    qemu_free(buf);
+    qemu_free(old_s);

    return 0;
 out:
    /* recover bdrv_sd_state */
    memcpy(s, old_s, sizeof(BDRVSheepdogState));
-    g_free(buf);
-    g_free(old_s);
+    qemu_free(buf);
+    qemu_free(old_s);

    error_report("failed to open. recover old bdrv_sd_state.");

@@ -1936,7 +1898,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
    uint64_t hval;
    uint32_t vid;

-    vdi_inuse = g_malloc(max);
+    vdi_inuse = qemu_malloc(max);

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
@@ -1958,7 +1920,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        goto out;
    }

-    sn_tab = g_malloc0(nr * sizeof(*sn_tab));
+    sn_tab = qemu_mallocz(nr * sizeof(*sn_tab));

    /* calculate a vdi id with hash function */
    hval = fnv_64a_buf(s->name, strlen(s->name), FNV1A_64_INIT);
@@ -2001,7 +1963,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 out:
    *psn_tab = sn_tab;

-    g_free(vdi_inuse);
+    qemu_free(vdi_inuse);

    return found;
 }
@@ -2100,8 +2062,8 @@ BlockDriver bdrv_sheepdog = {
    .bdrv_getlength = sd_getlength,
    .bdrv_truncate  = sd_truncate,

-    .bdrv_co_readv  = sd_co_readv,
-    .bdrv_co_writev = sd_co_writev,
+    .bdrv_aio_readv     = sd_aio_readv,
+    .bdrv_aio_writev    = sd_aio_writev,

    .bdrv_snapshot_create   = sd_snapshot_create,
    .bdrv_snapshot_goto     = sd_snapshot_goto,
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -52,7 +52,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
@@ -115,13 +114,8 @@ void uuid_unparse(const uuid_t uu, char *out);
 */
 #define VDI_TEXT "<<< QEMU VM Virtual Disk Image >>>\n"

-/* A never-allocated block; semantically arbitrary content. */
-#define VDI_UNALLOCATED 0xffffffffU
-
-/* A discarded (no longer allocated) block; semantically zero-filled. */
-#define VDI_DISCARDED   0xfffffffeU
-
-#define VDI_IS_ALLOCATED(X) ((X) < VDI_DISCARDED)
+/* Unallocated blocks use this index (no need to convert endianness). */
+#define VDI_UNALLOCATED UINT32_MAX

 #if !defined(CONFIG_UUID)
 void uuid_generate(uuid_t out)
@@ -204,8 +198,6 @@ typedef struct {
    uint32_t bmap_sector;
    /* VDI header (converted to host endianness). */
    VdiHeader header;
-
-    Error *migration_blocker;
 } BDRVVdiState;

 /* Change UUID from little endian (IPRT = VirtualBox format) to big endian
@@ -309,16 +301,16 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res)
    uint32_t *bmap;
    logout("\n");

-    bmap = g_malloc(s->header.blocks_in_image * sizeof(uint32_t));
+    bmap = qemu_malloc(s->header.blocks_in_image * sizeof(uint32_t));
    memset(bmap, 0xff, s->header.blocks_in_image * sizeof(uint32_t));

    /* Check block map and value of blocks_allocated. */
    for (block = 0; block < s->header.blocks_in_image; block++) {
        uint32_t bmap_entry = le32_to_cpu(s->bmap[block]);
-        if (VDI_IS_ALLOCATED(bmap_entry)) {
+        if (bmap_entry != VDI_UNALLOCATED) {
            if (bmap_entry < s->header.blocks_in_image) {
                blocks_allocated++;
-                if (!VDI_IS_ALLOCATED(bmap[bmap_entry])) {
+                if (bmap[bmap_entry] == VDI_UNALLOCATED) {
                    bmap[bmap_entry] = bmap_entry;
                } else {
                    fprintf(stderr, "ERROR: block index %" PRIu32
@@ -339,7 +331,7 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res)
        res->corruptions++;
    }

-    g_free(bmap);
+    qemu_free(bmap);

    return 0;
 }
@@ -451,22 +443,16 @@ static int vdi_open(BlockDriverState *bs, int flags)
    bmap_size = header.blocks_in_image * sizeof(uint32_t);
    bmap_size = (bmap_size + SECTOR_SIZE - 1) / SECTOR_SIZE;
    if (bmap_size > 0) {
-        s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
+        s->bmap = qemu_malloc(bmap_size * SECTOR_SIZE);
    }
    if (bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size) < 0) {
        goto fail_free_bmap;
    }

-    /* Disable migration when vdi images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "vdi", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
    return 0;

 fail_free_bmap:
-    g_free(s->bmap);
+    qemu_free(s->bmap);

 fail:
    return -1;
@@ -486,7 +472,7 @@ static int vdi_is_allocated(BlockDriverState *bs, int64_t sector_num,
        n_sectors = nb_sectors;
    }
    *pnum = n_sectors;
-    return VDI_IS_ALLOCATED(bmap_entry);
+    return bmap_entry != VDI_UNALLOCATED;
 }

 static void vdi_aio_cancel(BlockDriverAIOCB *blockacb)
@@ -617,7 +603,7 @@ static void vdi_aio_read_cb(void *opaque, int ret)
    /* prepare next AIO request */
    acb->n_sectors = n_sectors;
    bmap_entry = le32_to_cpu(s->bmap[block_index]);
-    if (!VDI_IS_ALLOCATED(bmap_entry)) {
+    if (bmap_entry == VDI_UNALLOCATED) {
        /* Block not allocated, return zeros, no need to wait. */
        memset(acb->buf, 0, n_sectors * SECTOR_SIZE);
        ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
@@ -699,7 +685,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
        if (acb->header_modified) {
            VdiHeader *header = acb->block_buffer;
            logout("now writing modified header\n");
-            assert(VDI_IS_ALLOCATED(acb->bmap_first));
+            assert(acb->bmap_first != VDI_UNALLOCATED);
            *header = s->header;
            vdi_header_to_le(header);
            acb->header_modified = 0;
@@ -713,12 +699,12 @@ static void vdi_aio_write_cb(void *opaque, int ret)
                goto done;
            }
            return;
-        } else if (VDI_IS_ALLOCATED(acb->bmap_first)) {
+        } else if (acb->bmap_first != VDI_UNALLOCATED) {
            /* One or more new blocks were allocated. */
            uint64_t offset;
            uint32_t bmap_first;
            uint32_t bmap_last;
-            g_free(acb->block_buffer);
+            qemu_free(acb->block_buffer);
            acb->block_buffer = NULL;
            bmap_first = acb->bmap_first;
            bmap_last = acb->bmap_last;
@@ -763,7 +749,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
    /* prepare next AIO request */
    acb->n_sectors = n_sectors;
    bmap_entry = le32_to_cpu(s->bmap[block_index]);
-    if (!VDI_IS_ALLOCATED(bmap_entry)) {
+    if (bmap_entry == VDI_UNALLOCATED) {
        /* Allocate new block and write to it. */
        uint64_t offset;
        uint8_t *block;
@@ -774,7 +760,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
                 (uint64_t)bmap_entry * s->block_sectors;
        block = acb->block_buffer;
        if (block == NULL) {
-            block = g_malloc0(s->block_size);
+            block = qemu_mallocz(s->block_size);
            acb->block_buffer = block;
            acb->bmap_first = block_index;
            assert(!acb->header_modified);
@@ -920,7 +906,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)

    bmap = NULL;
    if (bmap_size > 0) {
-        bmap = (uint32_t *)g_malloc0(bmap_size);
+        bmap = (uint32_t *)qemu_mallocz(bmap_size);
    }
    for (i = 0; i < blocks; i++) {
        if (image_type == VDI_TYPE_STATIC) {
@@ -932,7 +918,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
    if (write(fd, bmap, bmap_size) < 0) {
        result = -errno;
    }
-    g_free(bmap);
+    qemu_free(bmap);
    if (image_type == VDI_TYPE_STATIC) {
        if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
            result = -errno;
@@ -948,18 +934,12 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)

 static void vdi_close(BlockDriverState *bs)
 {
-    BDRVVdiState *s = bs->opaque;
-
-    g_free(s->bmap);
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
 }

-static coroutine_fn int vdi_co_flush(BlockDriverState *bs)
+static int vdi_flush(BlockDriverState *bs)
 {
    logout("\n");
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }


@@ -995,7 +975,7 @@ static BlockDriver bdrv_vdi = {
    .bdrv_open = vdi_open,
    .bdrv_close = vdi_close,
    .bdrv_create = vdi_create,
-    .bdrv_co_flush_to_disk = vdi_co_flush,
+    .bdrv_flush = vdi_flush,
    .bdrv_is_allocated = vdi_is_allocated,
    .bdrv_make_empty = vdi_make_empty,

--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -26,15 +26,9 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"
-#include <zlib.h>

 #define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')
 #define VMDK4_MAGIC (('K' << 24) | ('D' << 16) | ('M' << 8) | 'V')
-#define VMDK4_COMPRESSION_DEFLATE 1
-#define VMDK4_FLAG_RGD (1 << 1)
-#define VMDK4_FLAG_COMPRESS (1 << 16)
-#define VMDK4_FLAG_MARKER (1 << 17)

 typedef struct {
    uint32_t version;
@@ -57,21 +51,18 @@ typedef struct {
    int64_t desc_offset;
    int64_t desc_size;
    int32_t num_gtes_per_gte;
-    int64_t gd_offset;
    int64_t rgd_offset;
+    int64_t gd_offset;
    int64_t grain_offset;
    char filler[1];
    char check_bytes[4];
-    uint16_t compressAlgorithm;
-} QEMU_PACKED VMDK4Header;
+} __attribute__((packed)) VMDK4Header;

 #define L2_CACHE_SIZE 16

 typedef struct VmdkExtent {
    BlockDriverState *file;
    bool flat;
-    bool compressed;
-    bool has_marker;
    int64_t sectors;
    int64_t end_sector;
    int64_t flat_start_offset;
@@ -91,14 +82,12 @@ typedef struct VmdkExtent {
 } VmdkExtent;

 typedef struct BDRVVmdkState {
-    CoMutex lock;
    int desc_offset;
    bool cid_updated;
    uint32_t parent_cid;
    int num_extents;
    /* Extent array with num_extents entries, ascend ordered by address */
    VmdkExtent *extents;
-    Error *migration_blocker;
 } BDRVVmdkState;

 typedef struct VmdkMetaData {
@@ -109,12 +98,6 @@ typedef struct VmdkMetaData {
    int valid;
 } VmdkMetaData;

-typedef struct VmdkGrainMarker {
-    uint64_t lba;
-    uint32_t size;
-    uint8_t  data[0];
-} VmdkGrainMarker;
-
 static int vmdk_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    uint32_t magic;
@@ -182,42 +165,24 @@ static void vmdk_free_extents(BlockDriverState *bs)
 {
    int i;
    BDRVVmdkState *s = bs->opaque;
-    VmdkExtent *e;

    for (i = 0; i < s->num_extents; i++) {
-        e = &s->extents[i];
-        g_free(e->l1_table);
-        g_free(e->l2_cache);
-        g_free(e->l1_backup_table);
-        if (e->file != bs->file) {
-            bdrv_delete(e->file);
-        }
+        qemu_free(s->extents[i].l1_table);
+        qemu_free(s->extents[i].l2_cache);
+        qemu_free(s->extents[i].l1_backup_table);
    }
-    g_free(s->extents);
-}
-
-static void vmdk_free_last_extent(BlockDriverState *bs)
-{
-    BDRVVmdkState *s = bs->opaque;
-
-    if (s->num_extents == 0) {
-        return;
-    }
-    s->num_extents--;
-    s->extents = g_realloc(s->extents, s->num_extents * sizeof(VmdkExtent));
+    qemu_free(s->extents);
 }

 static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
 {
    char desc[DESC_SIZE];
-    uint32_t cid = 0xffffffff;
+    uint32_t cid;
    const char *p_name, *cid_str;
    size_t cid_str_size;
    BDRVVmdkState *s = bs->opaque;
-    int ret;

-    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {
        return 0;
    }

@@ -229,7 +194,6 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
        cid_str_size = sizeof("CID");
    }

-    desc[DESC_SIZE - 1] = '\0';
    p_name = strstr(desc, cid_str);
    if (p_name != NULL) {
        p_name += cid_str_size;
@@ -244,19 +208,13 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
    char desc[DESC_SIZE], tmp_desc[DESC_SIZE];
    char *p_name, *tmp_str;
    BDRVVmdkState *s = bs->opaque;
-    int ret;

-    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
-    if (ret < 0) {
-        return ret;
+    memset(desc, 0, sizeof(desc));
+    if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {
+        return -EIO;
    }

-    desc[DESC_SIZE - 1] = '\0';
    tmp_str = strstr(desc, "parentCID");
-    if (tmp_str == NULL) {
-        return -EINVAL;
-    }
-
    pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);
    p_name = strstr(desc, "CID");
    if (p_name != NULL) {
@@ -265,11 +223,9 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
        pstrcat(desc, sizeof(desc), tmp_desc);
    }

-    ret = bdrv_pwrite_sync(bs->file, s->desc_offset, desc, DESC_SIZE);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pwrite_sync(bs->file, s->desc_offset, desc, DESC_SIZE) < 0) {
+        return -EIO;
    }
-
    return 0;
 }

@@ -297,12 +253,10 @@ static int vmdk_parent_open(BlockDriverState *bs)
    char *p_name;
    char desc[DESC_SIZE + 1];
    BDRVVmdkState *s = bs->opaque;
-    int ret;

    desc[DESC_SIZE] = '\0';
-    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE) != DESC_SIZE) {
+        return -1;
    }

    p_name = strstr(desc, "parentFileNameHint");
@@ -312,10 +266,10 @@ static int vmdk_parent_open(BlockDriverState *bs)
        p_name += sizeof("parentFileNameHint") + 1;
        end_name = strchr(p_name, '\"');
        if (end_name == NULL) {
-            return -EINVAL;
+            return -1;
        }
        if ((end_name - p_name) > sizeof(bs->backing_file) - 1) {
-            return -EINVAL;
+            return -1;
        }

        pstrcpy(bs->backing_file, end_name - p_name + 1, p_name);
@@ -335,7 +289,7 @@ static VmdkExtent *vmdk_add_extent(BlockDriverState *bs,
    VmdkExtent *extent;
    BDRVVmdkState *s = bs->opaque;

-    s->extents = g_realloc(s->extents,
+    s->extents = qemu_realloc(s->extents,
                              (s->num_extents + 1) * sizeof(VmdkExtent));
    extent = &s->extents[s->num_extents];
    s->num_extents++;
@@ -367,7 +321,7 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent)

    /* read the L1 table */
    l1_size = extent->l1_size * sizeof(uint32_t);
-    extent->l1_table = g_malloc(l1_size);
+    extent->l1_table = qemu_malloc(l1_size);
    ret = bdrv_pread(extent->file,
                    extent->l1_table_offset,
                    extent->l1_table,
@@ -380,7 +334,7 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent)
    }

    if (extent->l1_backup_table_offset) {
-        extent->l1_backup_table = g_malloc(l1_size);
+        extent->l1_backup_table = qemu_malloc(l1_size);
        ret = bdrv_pread(extent->file,
                        extent->l1_backup_table_offset,
                        extent->l1_backup_table,
@@ -394,27 +348,27 @@ static int vmdk_init_tables(BlockDriverState *bs, VmdkExtent *extent)
    }

    extent->l2_cache =
-        g_malloc(extent->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
+        qemu_malloc(extent->l2_size * L2_CACHE_SIZE * sizeof(uint32_t));
    return 0;
 fail_l1b:
-    g_free(extent->l1_backup_table);
+    qemu_free(extent->l1_backup_table);
 fail_l1:
-    g_free(extent->l1_table);
+    qemu_free(extent->l1_table);
    return ret;
 }

-static int vmdk_open_vmdk3(BlockDriverState *bs,
-                           BlockDriverState *file,
-                           int flags)
+static int vmdk_open_vmdk3(BlockDriverState *bs, int flags)
 {
    int ret;
    uint32_t magic;
    VMDK3Header header;
+    BDRVVmdkState *s = bs->opaque;
    VmdkExtent *extent;

-    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
+    s->desc_offset = 0x200;
+    ret = bdrv_pread(bs->file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
-        return ret;
+        goto fail;
    }
    extent = vmdk_add_extent(bs,
                             bs->file, false,
@@ -424,58 +378,58 @@ static int vmdk_open_vmdk3(BlockDriverState *bs,
                             le32_to_cpu(header.granularity));
    ret = vmdk_init_tables(bs, extent);
    if (ret) {
-        /* free extent allocated by vmdk_add_extent */
-        vmdk_free_last_extent(bs);
+        /* vmdk_init_tables cleans up on fail, so only free allocation of
+         * vmdk_add_extent here. */
+        goto fail;
    }
+    return 0;
+ fail:
+    vmdk_free_extents(bs);
    return ret;
 }

-static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
-                               int64_t desc_offset);
-
-static int vmdk_open_vmdk4(BlockDriverState *bs,
-                           BlockDriverState *file,
-                           int flags)
+static int vmdk_open_vmdk4(BlockDriverState *bs, int flags)
 {
    int ret;
    uint32_t magic;
    uint32_t l1_size, l1_entry_sectors;
    VMDK4Header header;
+    BDRVVmdkState *s = bs->opaque;
    VmdkExtent *extent;
-    int64_t l1_backup_offset = 0;

-    ret = bdrv_pread(file, sizeof(magic), &header, sizeof(header));
+    s->desc_offset = 0x200;
+    ret = bdrv_pread(bs->file, sizeof(magic), &header, sizeof(header));
    if (ret < 0) {
-        return ret;
-    }
-    if (header.capacity == 0 && header.desc_offset) {
-        return vmdk_open_desc_file(bs, flags, header.desc_offset << 9);
+        goto fail;
    }
    l1_entry_sectors = le32_to_cpu(header.num_gtes_per_gte)
                        * le64_to_cpu(header.granularity);
-    if (l1_entry_sectors <= 0) {
-        return -EINVAL;
-    }
    l1_size = (le64_to_cpu(header.capacity) + l1_entry_sectors - 1)
                / l1_entry_sectors;
-    if (le32_to_cpu(header.flags) & VMDK4_FLAG_RGD) {
-        l1_backup_offset = le64_to_cpu(header.rgd_offset) << 9;
-    }
-    extent = vmdk_add_extent(bs, file, false,
+    extent = vmdk_add_extent(bs, bs->file, false,
                          le64_to_cpu(header.capacity),
                          le64_to_cpu(header.gd_offset) << 9,
-                          l1_backup_offset,
+                          le64_to_cpu(header.rgd_offset) << 9,
                          l1_size,
                          le32_to_cpu(header.num_gtes_per_gte),
                          le64_to_cpu(header.granularity));
-    extent->compressed =
-        le16_to_cpu(header.compressAlgorithm) == VMDK4_COMPRESSION_DEFLATE;
-    extent->has_marker = le32_to_cpu(header.flags) & VMDK4_FLAG_MARKER;
+    if (extent->l1_entry_sectors <= 0) {
+        ret = -EINVAL;
+        goto fail;
+    }
+    /* try to open parent images, if exist */
+    ret = vmdk_parent_open(bs);
+    if (ret) {
+        goto fail;
+    }
+    s->parent_cid = vmdk_read_cid(bs, 1);
    ret = vmdk_init_tables(bs, extent);
    if (ret) {
-        /* free extent allocated by vmdk_add_extent */
-        vmdk_free_last_extent(bs);
+        goto fail;
    }
+    return 0;
+ fail:
+    vmdk_free_extents(bs);
    return ret;
 }

@@ -506,31 +460,6 @@ static int vmdk_parse_description(const char *desc, const char *opt_name,
    return 0;
 }

-/* Open an extent file and append to bs array */
-static int vmdk_open_sparse(BlockDriverState *bs,
-                            BlockDriverState *file,
-                            int flags)
-{
-    uint32_t magic;
-
-    if (bdrv_pread(file, 0, &magic, sizeof(magic)) != sizeof(magic)) {
-        return -EIO;
-    }
-
-    magic = be32_to_cpu(magic);
-    switch (magic) {
-        case VMDK3_MAGIC:
-            return vmdk_open_vmdk3(bs, file, flags);
-            break;
-        case VMDK4_MAGIC:
-            return vmdk_open_vmdk4(bs, file, flags);
-            break;
-        default:
-            return -EINVAL;
-            break;
-    }
-}
-
 static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
        const char *desc_file_path)
 {
@@ -541,8 +470,6 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
    const char *p = desc;
    int64_t sectors = 0;
    int64_t flat_offset;
-    char extent_path[PATH_MAX];
-    BlockDriverState *extent_file;

    while (*p) {
        /* parse extent line:
@@ -577,29 +504,24 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            goto next_line;
        }

-        path_combine(extent_path, sizeof(extent_path),
-                desc_file_path, fname);
-        ret = bdrv_file_open(&extent_file, extent_path, bs->open_flags);
-        if (ret) {
-            return ret;
-        }
-
        /* save to extents array */
        if (!strcmp(type, "FLAT")) {
            /* FLAT extent */
+            char extent_path[PATH_MAX];
+            BlockDriverState *extent_file;
            VmdkExtent *extent;

-            extent = vmdk_add_extent(bs, extent_file, true, sectors,
-                            0, 0, 0, 0, sectors);
-            extent->flat_start_offset = flat_offset << 9;
-        } else if (!strcmp(type, "SPARSE")) {
-            /* SPARSE extent */
-            ret = vmdk_open_sparse(bs, extent_file, bs->open_flags);
+            path_combine(extent_path, sizeof(extent_path),
+                    desc_file_path, fname);
+            ret = bdrv_file_open(&extent_file, extent_path, bs->open_flags);
            if (ret) {
-                bdrv_delete(extent_file);
                return ret;
            }
+            extent = vmdk_add_extent(bs, extent_file, true, sectors,
+                            0, 0, 0, 0, sectors);
+            extent->flat_start_offset = flat_offset;
        } else {
+            /* SPARSE extent, not supported for now */
            fprintf(stderr,
                "VMDK: Not supported extent type \"%s\""".\n", type);
            return -ENOTSUP;
@@ -614,15 +536,14 @@ next_line:
    return 0;
 }

-static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
-                               int64_t desc_offset)
+static int vmdk_open_desc_file(BlockDriverState *bs, int flags)
 {
    int ret;
    char buf[2048];
    char ct[128];
    BDRVVmdkState *s = bs->opaque;

-    ret = bdrv_pread(bs->file, desc_offset, buf, sizeof(buf));
+    ret = bdrv_pread(bs->file, 0, buf, sizeof(buf));
    if (ret < 0) {
        return ret;
    }
@@ -630,49 +551,42 @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
    if (vmdk_parse_description(buf, "createType", ct, sizeof(ct))) {
        return -EINVAL;
    }
-    if (strcmp(ct, "monolithicFlat") &&
-        strcmp(ct, "twoGbMaxExtentSparse") &&
-        strcmp(ct, "twoGbMaxExtentFlat")) {
+    if (strcmp(ct, "monolithicFlat")) {
        fprintf(stderr,
                "VMDK: Not supported image type \"%s\""".\n", ct);
        return -ENOTSUP;
    }
    s->desc_offset = 0;
-    return vmdk_parse_extents(buf, bs, bs->file->filename);
+    ret = vmdk_parse_extents(buf, bs, bs->file->filename);
+    if (ret) {
+        return ret;
+    }
+
+    /* try to open parent images, if exist */
+    if (vmdk_parent_open(bs)) {
+        qemu_free(s->extents);
+        return -EINVAL;
+    }
+    s->parent_cid = vmdk_read_cid(bs, 1);
+    return 0;
 }

 static int vmdk_open(BlockDriverState *bs, int flags)
 {
-    int ret;
-    BDRVVmdkState *s = bs->opaque;
+    uint32_t magic;

-    if (vmdk_open_sparse(bs, bs->file, flags) == 0) {
-        s->desc_offset = 0x200;
+    if (bdrv_pread(bs->file, 0, &magic, sizeof(magic)) != sizeof(magic)) {
+        return -EIO;
+    }
+
+    magic = be32_to_cpu(magic);
+    if (magic == VMDK3_MAGIC) {
+        return vmdk_open_vmdk3(bs, flags);
+    } else if (magic == VMDK4_MAGIC) {
+        return vmdk_open_vmdk4(bs, flags);
    } else {
-        ret = vmdk_open_desc_file(bs, flags, 0);
-        if (ret) {
-            goto fail;
-        }
+        return vmdk_open_desc_file(bs, flags);
    }
-    /* try to open parent images, if exist */
-    ret = vmdk_parent_open(bs);
-    if (ret) {
-        goto fail;
-    }
-    s->parent_cid = vmdk_read_cid(bs, 1);
-    qemu_co_mutex_init(&s->lock);
-
-    /* Disable migration when VMDK images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "vmdk", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
-    return 0;
-
-fail:
-    vmdk_free_extents(bs);
-    return ret;
 }

 static int get_whole_cluster(BlockDriverState *bs,
@@ -758,7 +672,6 @@ static int get_cluster_offset(BlockDriverState *bs,
        return 0;
    }

-    offset -= (extent->end_sector - extent->sectors) * SECTOR_SIZE;
    l1_index = (offset >> 9) / extent->l1_entry_sectors;
    if (l1_index >= extent->l1_size) {
        return -1;
@@ -811,12 +724,10 @@ static int get_cluster_offset(BlockDriverState *bs,

        /* Avoid the L2 tables update for the images that have snapshots. */
        *cluster_offset = bdrv_getlength(extent->file);
-        if (!extent->compressed) {
-            bdrv_truncate(
-                extent->file,
-                *cluster_offset + (extent->cluster_sectors << 9)
-            );
-        }
+        bdrv_truncate(
+            extent->file,
+            *cluster_offset + (extent->cluster_sectors << 9)
+        );

        *cluster_offset >>= 9;
        tmp = cpu_to_le32(*cluster_offset);
@@ -887,113 +798,6 @@ static int vmdk_is_allocated(BlockDriverState *bs, int64_t sector_num,
    return ret;
 }

-static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
-                            int64_t offset_in_cluster, const uint8_t *buf,
-                            int nb_sectors, int64_t sector_num)
-{
-    int ret;
-    VmdkGrainMarker *data = NULL;
-    uLongf buf_len;
-    const uint8_t *write_buf = buf;
-    int write_len = nb_sectors * 512;
-
-    if (extent->compressed) {
-        if (!extent->has_marker) {
-            ret = -EINVAL;
-            goto out;
-        }
-        buf_len = (extent->cluster_sectors << 9) * 2;
-        data = g_malloc(buf_len + sizeof(VmdkGrainMarker));
-        if (compress(data->data, &buf_len, buf, nb_sectors << 9) != Z_OK ||
-                buf_len == 0) {
-            ret = -EINVAL;
-            goto out;
-        }
-        data->lba = sector_num;
-        data->size = buf_len;
-        write_buf = (uint8_t *)data;
-        write_len = buf_len + sizeof(VmdkGrainMarker);
-    }
-    ret = bdrv_pwrite(extent->file,
-                        cluster_offset + offset_in_cluster,
-                        write_buf,
-                        write_len);
-    if (ret != write_len) {
-        ret = ret < 0 ? ret : -EIO;
-        goto out;
-    }
-    ret = 0;
- out:
-    g_free(data);
-    return ret;
-}
-
-static int vmdk_read_extent(VmdkExtent *extent, int64_t cluster_offset,
-                            int64_t offset_in_cluster, uint8_t *buf,
-                            int nb_sectors)
-{
-    int ret;
-    int cluster_bytes, buf_bytes;
-    uint8_t *cluster_buf, *compressed_data;
-    uint8_t *uncomp_buf;
-    uint32_t data_len;
-    VmdkGrainMarker *marker;
-    uLongf buf_len;
-
-
-    if (!extent->compressed) {
-        ret = bdrv_pread(extent->file,
-                          cluster_offset + offset_in_cluster,
-                          buf, nb_sectors * 512);
-        if (ret == nb_sectors * 512) {
-            return 0;
-        } else {
-            return -EIO;
-        }
-    }
-    cluster_bytes = extent->cluster_sectors * 512;
-    /* Read two clusters in case GrainMarker + compressed data > one cluster */
-    buf_bytes = cluster_bytes * 2;
-    cluster_buf = g_malloc(buf_bytes);
-    uncomp_buf = g_malloc(cluster_bytes);
-    ret = bdrv_pread(extent->file,
-                cluster_offset,
-                cluster_buf, buf_bytes);
-    if (ret < 0) {
-        goto out;
-    }
-    compressed_data = cluster_buf;
-    buf_len = cluster_bytes;
-    data_len = cluster_bytes;
-    if (extent->has_marker) {
-        marker = (VmdkGrainMarker *)cluster_buf;
-        compressed_data = marker->data;
-        data_len = le32_to_cpu(marker->size);
-    }
-    if (!data_len || data_len > buf_bytes) {
-        ret = -EINVAL;
-        goto out;
-    }
-    ret = uncompress(uncomp_buf, &buf_len, compressed_data, data_len);
-    if (ret != Z_OK) {
-        ret = -EINVAL;
-        goto out;
-
-    }
-    if (offset_in_cluster < 0 ||
-            offset_in_cluster + nb_sectors * 512 > buf_len) {
-        ret = -EINVAL;
-        goto out;
-    }
-    memcpy(buf, uncomp_buf + offset_in_cluster, nb_sectors * 512);
-    ret = 0;
-
- out:
-    g_free(uncomp_buf);
-    g_free(cluster_buf);
-    return ret;
-}
-
 static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
                    uint8_t *buf, int nb_sectors)
 {
@@ -1030,10 +834,10 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
                memset(buf, 0, 512 * n);
            }
        } else {
-            ret = vmdk_read_extent(extent,
-                            cluster_offset, index_in_cluster * 512,
-                            buf, n);
-            if (ret) {
+            ret = bdrv_pread(extent->file,
+                            cluster_offset + index_in_cluster * 512,
+                            buf, n * 512);
+            if (ret < 0) {
                return ret;
            }
        }
@@ -1044,17 +848,6 @@ static int vmdk_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int vmdk_co_read(BlockDriverState *bs, int64_t sector_num,
-                                     uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVmdkState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vmdk_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
                     const uint8_t *buf, int nb_sectors)
 {
@@ -1082,25 +875,8 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
                                bs,
                                extent,
                                &m_data,
-                                sector_num << 9, !extent->compressed,
+                                sector_num << 9, 1,
                                &cluster_offset);
-        if (extent->compressed) {
-            if (ret == 0) {
-                /* Refuse write to allocated cluster for streamOptimized */
-                fprintf(stderr,
-                        "VMDK: can't write to allocated cluster"
-                        " for streamOptimized\n");
-                return -EIO;
-            } else {
-                /* allocate */
-                ret = get_cluster_offset(
-                                        bs,
-                                        extent,
-                                        &m_data,
-                                        sector_num << 9, 1,
-                                        &cluster_offset);
-            }
-        }
        if (ret) {
            return -EINVAL;
        }
@@ -1110,10 +886,11 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
            n = nb_sectors;
        }

-        ret = vmdk_write_extent(extent,
-                        cluster_offset, index_in_cluster * 512,
-                        buf, n, sector_num);
-        if (ret) {
+        ret = bdrv_pwrite(extent->file,
+                        cluster_offset + index_in_cluster * 512,
+                        buf,
+                        n * 512);
+        if (ret < 0) {
            return ret;
        }
        if (m_data.valid) {
@@ -1129,30 +906,15 @@ static int vmdk_write(BlockDriverState *bs, int64_t sector_num,
        /* update CID on the first write every time the virtual disk is
         * opened */
        if (!s->cid_updated) {
-            ret = vmdk_write_cid(bs, time(NULL));
-            if (ret < 0) {
-                return ret;
-            }
+            vmdk_write_cid(bs, time(NULL));
            s->cid_updated = true;
        }
    }
    return 0;
 }

-static coroutine_fn int vmdk_co_write(BlockDriverState *bs, int64_t sector_num,
-                                      const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVmdkState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vmdk_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}

-
-static int vmdk_create_extent(const char *filename, int64_t filesize,
-                              bool flat, bool compress)
+static int vmdk_create_extent(const char *filename, int64_t filesize, bool flat)
 {
    int ret, i;
    int fd = 0;
@@ -1176,9 +938,7 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
    magic = cpu_to_be32(VMDK4_MAGIC);
    memset(&header, 0, sizeof(header));
    header.version = 1;
-    header.flags =
-        3 | (compress ? VMDK4_FLAG_COMPRESS | VMDK4_FLAG_MARKER : 0);
-    header.compressAlgorithm = compress ? VMDK4_COMPRESSION_DEFLATE : 0;
+    header.flags = 3; /* ?? */
    header.capacity = filesize / 512;
    header.granularity = 128;
    header.num_gtes_per_gte = 512;
@@ -1208,7 +968,6 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
    header.rgd_offset = cpu_to_le64(header.rgd_offset);
    header.gd_offset = cpu_to_le64(header.gd_offset);
    header.grain_offset = cpu_to_le64(header.grain_offset);
-    header.compressAlgorithm = cpu_to_le16(header.compressAlgorithm);

    header.check_bytes[0] = 0xa;
    header.check_bytes[1] = 0x20;
@@ -1350,7 +1109,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    const char *fmt = NULL;
    int flags = 0;
    int ret = 0;
-    bool flat, split, compress;
+    bool flat, split;
    char ext_desc_lines[BUF_SIZE] = "";
    char path[PATH_MAX], prefix[PATH_MAX], postfix[PATH_MAX];
    const int64_t split_size = 0x80000000;  /* VMDK has constant split size */
@@ -1399,8 +1158,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    } else if (strcmp(fmt, "monolithicFlat") &&
               strcmp(fmt, "monolithicSparse") &&
               strcmp(fmt, "twoGbMaxExtentSparse") &&
-               strcmp(fmt, "twoGbMaxExtentFlat") &&
-               strcmp(fmt, "streamOptimized")) {
+               strcmp(fmt, "twoGbMaxExtentFlat")) {
        fprintf(stderr, "VMDK: Unknown subformat: %s\n", fmt);
        return -EINVAL;
    }
@@ -1408,7 +1166,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
              strcmp(fmt, "twoGbMaxExtentSparse"));
    flat = !(strcmp(fmt, "monolithicFlat") &&
             strcmp(fmt, "twoGbMaxExtentFlat"));
-    compress = !strcmp(fmt, "streamOptimized");
    if (flat) {
        desc_extent_line = "RW %lld FLAT \"%s\" 0\n";
    } else {
@@ -1430,6 +1187,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
            bdrv_delete(bs);
            return -EINVAL;
        }
+        filesize = bdrv_getlength(bs);
        parent_cid = vmdk_read_cid(bs, 0);
        bdrv_delete(bs);
        relative_path(parent_filename, sizeof(parent_filename),
@@ -1462,7 +1220,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
        snprintf(ext_filename, sizeof(ext_filename), "%s%s",
                path, desc_filename);

-        if (vmdk_create_extent(ext_filename, size, flat, compress)) {
+        if (vmdk_create_extent(ext_filename, size, flat)) {
            return -EINVAL;
        }
        filesize -= size;
@@ -1513,22 +1271,17 @@ exit:

 static void vmdk_close(BlockDriverState *bs)
 {
-    BDRVVmdkState *s = bs->opaque;
-
    vmdk_free_extents(bs);
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
 }

-static coroutine_fn int vmdk_co_flush(BlockDriverState *bs)
+static int vmdk_flush(BlockDriverState *bs)
 {
    int i, ret, err;
    BDRVVmdkState *s = bs->opaque;

-    ret = bdrv_co_flush(bs->file);
+    ret = bdrv_flush(bs->file);
    for (i = 0; i < s->num_extents; i++) {
-        err = bdrv_co_flush(s->extents[i].file);
+        err = bdrv_flush(s->extents[i].file);
        if (err < 0) {
            ret = err;
        }
@@ -1581,7 +1334,7 @@ static QEMUOptionParameter vmdk_create_options[] = {
        .type = OPT_STRING,
        .help =
            "VMDK flat extent format, can be one of "
-            "{monolithicSparse (default) | monolithicFlat | twoGbMaxExtentSparse | twoGbMaxExtentFlat | streamOptimized} "
+            "{monolithicSparse (default) | monolithicFlat | twoGbMaxExtentSparse | twoGbMaxExtentFlat} "
    },
    { NULL }
 };
@@ -1591,12 +1344,12 @@ static BlockDriver bdrv_vmdk = {
    .instance_size  = sizeof(BDRVVmdkState),
    .bdrv_probe     = vmdk_probe,
    .bdrv_open      = vmdk_open,
-    .bdrv_read      = vmdk_co_read,
-    .bdrv_write     = vmdk_co_write,
+    .bdrv_read      = vmdk_read,
+    .bdrv_write     = vmdk_write,
    .bdrv_close     = vmdk_close,
    .bdrv_create    = vmdk_create,
-    .bdrv_co_flush_to_disk  = vmdk_co_flush,
-    .bdrv_is_allocated      = vmdk_is_allocated,
+    .bdrv_flush     = vmdk_flush,
+    .bdrv_is_allocated  = vmdk_is_allocated,
    .bdrv_get_allocated_file_size  = vmdk_get_allocated_file_size,

    .create_options = vmdk_create_options,
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -25,7 +25,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 /**************************************************************/

@@ -111,7 +110,6 @@ struct vhd_dyndisk_header {
 };

 typedef struct BDRVVPCState {
-    CoMutex lock;
    uint8_t footer_buf[HEADER_SIZE];
    uint64_t free_data_block_offset;
    int max_table_entries;
@@ -129,8 +127,6 @@ typedef struct BDRVVPCState {

    uint64_t last_bitmap;
 #endif
-
-    Error *migration_blocker;
 } BDRVVPCState;

 static uint32_t vpc_checksum(uint8_t* buf, size_t size)
@@ -160,7 +156,6 @@ static int vpc_open(BlockDriverState *bs, int flags)
    struct vhd_dyndisk_header* dyndisk_header;
    uint8_t buf[HEADER_SIZE];
    uint32_t checksum;
-    int err = -1;

    if (bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE) != HEADER_SIZE)
        goto fail;
@@ -181,11 +176,6 @@ static int vpc_open(BlockDriverState *bs, int flags)
    bs->total_sectors = (int64_t)
        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;

-    if (bs->total_sectors >= 65535 * 16 * 255) {
-        err = -EFBIG;
-        goto fail;
-    }
-
    if (bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf, HEADER_SIZE)
            != HEADER_SIZE)
        goto fail;
@@ -200,7 +190,7 @@ static int vpc_open(BlockDriverState *bs, int flags)
    s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;

    s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
-    s->pagetable = g_malloc(s->max_table_entries * 4);
+    s->pagetable = qemu_malloc(s->max_table_entries * 4);

    s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
    if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
@@ -224,23 +214,15 @@ static int vpc_open(BlockDriverState *bs, int flags)
    s->last_bitmap_offset = (int64_t) -1;

 #ifdef CACHE
-    s->pageentry_u8 = g_malloc(512);
+    s->pageentry_u8 = qemu_malloc(512);
    s->pageentry_u32 = s->pageentry_u8;
    s->pageentry_u16 = s->pageentry_u8;
    s->last_pagetable = -1;
 #endif

-    qemu_co_mutex_init(&s->lock);
-
-    /* Disable migration when VHD images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "vpc", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
    return 0;
 fail:
-    return err;
+    return -1;
 }

 /*
@@ -362,11 +344,8 @@ static int64_t alloc_block(BlockDriverState* bs, int64_t sector_num)

    // Initialize the block's bitmap
    memset(bitmap, 0xff, s->bitmap_size);
-    ret = bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
+    bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
        s->bitmap_size);
-    if (ret < 0) {
-        return ret;
-    }

    // Write new footer (the old one will be overwritten)
    s->free_data_block_offset += s->block_size + s->bitmap_size;
@@ -422,17 +401,6 @@ static int vpc_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int vpc_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVPCState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vpc_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int vpc_write(BlockDriverState *bs, int64_t sector_num,
    const uint8_t *buf, int nb_sectors)
 {
@@ -469,20 +437,9 @@ static int vpc_write(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int vpc_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
+static int vpc_flush(BlockDriverState *bs)
 {
-    int ret;
-    BDRVVPCState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vpc_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
-static coroutine_fn int vpc_co_flush(BlockDriverState *bs)
-{
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }

 /*
@@ -630,11 +587,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)

    memcpy(dyndisk_header->magic, "cxsparse", 8);

-    /*
-     * Note: The spec is actually wrong here for data_offset, it says
-     * 0xFFFFFFFF, but MS tools expect all 64 bits to be set.
-     */
-    dyndisk_header->data_offset = be64_to_cpu(0xFFFFFFFFFFFFFFFFULL);
+    dyndisk_header->data_offset = be64_to_cpu(0xFFFFFFFF);
    dyndisk_header->table_offset = be64_to_cpu(3 * 512);
    dyndisk_header->version = be32_to_cpu(0x00010000);
    dyndisk_header->block_size = be32_to_cpu(block_size);
@@ -660,13 +613,10 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
 static void vpc_close(BlockDriverState *bs)
 {
    BDRVVPCState *s = bs->opaque;
-    g_free(s->pagetable);
+    qemu_free(s->pagetable);
 #ifdef CACHE
-    g_free(s->pageentry_u8);
+    qemu_free(s->pageentry_u8);
 #endif
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
 }

 static QEMUOptionParameter vpc_create_options[] = {
@@ -681,16 +631,14 @@ static QEMUOptionParameter vpc_create_options[] = {
 static BlockDriver bdrv_vpc = {
    .format_name    = "vpc",
    .instance_size  = sizeof(BDRVVPCState),
-
    .bdrv_probe     = vpc_probe,
    .bdrv_open      = vpc_open,
+    .bdrv_read      = vpc_read,
+    .bdrv_write     = vpc_write,
+    .bdrv_flush     = vpc_flush,
    .bdrv_close     = vpc_close,
    .bdrv_create    = vpc_create,

-    .bdrv_read              = vpc_co_read,
-    .bdrv_write             = vpc_co_write,
-    .bdrv_co_flush_to_disk  = vpc_co_flush,
-
    .create_options = vpc_create_options,
 };

--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -27,7 +27,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 #ifndef S_IWGRP
 #define S_IWGRP 0
@@ -87,7 +86,8 @@ static inline void array_init(array_t* array,unsigned int item_size)

 static inline void array_free(array_t* array)
 {
-    g_free(array->pointer);
+    if(array->pointer)
+        free(array->pointer);
    array->size=array->next=0;
 }

@@ -101,7 +101,7 @@ static inline int array_ensure_allocated(array_t* array, int index)
 {
    if((index + 1) * array->item_size > array->size) {
 	int new_size = (index + 32) * array->item_size;
-	array->pointer = g_realloc(array->pointer, new_size);
+	array->pointer = qemu_realloc(array->pointer, new_size);
 	if (!array->pointer)
 	    return -1;
 	array->size = new_size;
@@ -127,7 +127,7 @@ static inline void* array_get_next(array_t* array) {
 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
    if((array->next+count)*array->item_size>array->size) {
 	int increment=count*array->item_size;
-	array->pointer=g_realloc(array->pointer,array->size+increment);
+	array->pointer=qemu_realloc(array->pointer,array->size+increment);
 	if(!array->pointer)
            return NULL;
 	array->size+=increment;
@@ -159,7 +159,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun
    is=array->item_size;
    from=array->pointer+index_from*is;
    to=array->pointer+index_to*is;
-    buf=g_malloc(is*count);
+    buf=qemu_malloc(is*count);
    memcpy(buf,from,is*count);

    if(index_to<index_from)
@@ -169,7 +169,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun

    memcpy(to,buf,is*count);

-    g_free(buf);
+    free(buf);

    return 0;
 }
@@ -200,7 +200,7 @@ static int array_index(array_t* array, void* pointer)
 }

 /* These structures are used to fake a disk and the VFAT filesystem.
- * For this reason we need to use QEMU_PACKED. */
+ * For this reason we need to use __attribute__((packed)). */

 typedef struct bootsector_t {
    uint8_t jump[3];
@@ -224,7 +224,7 @@ typedef struct bootsector_t {
 	    uint8_t signature;
 	    uint32_t id;
 	    uint8_t volume_label[11];
-	} QEMU_PACKED fat16;
+	} __attribute__((packed)) fat16;
 	struct {
 	    uint32_t sectors_per_fat;
 	    uint16_t flags;
@@ -233,12 +233,12 @@ typedef struct bootsector_t {
 	    uint16_t info_sector;
 	    uint16_t backup_boot_sector;
 	    uint16_t ignored;
-	} QEMU_PACKED fat32;
+	} __attribute__((packed)) fat32;
    } u;
    uint8_t fat_type[8];
    uint8_t ignored[0x1c0];
    uint8_t magic[2];
-} QEMU_PACKED bootsector_t;
+} __attribute__((packed)) bootsector_t;

 typedef struct {
    uint8_t head;
@@ -253,7 +253,7 @@ typedef struct partition_t {
    mbr_chs_t end_CHS;
    uint32_t start_sector_long;
    uint32_t length_sector_long;
-} QEMU_PACKED partition_t;
+} __attribute__((packed)) partition_t;

 typedef struct mbr_t {
    uint8_t ignored[0x1b8];
@@ -261,7 +261,7 @@ typedef struct mbr_t {
    uint8_t ignored2[2];
    partition_t partition[4];
    uint8_t magic[2];
-} QEMU_PACKED mbr_t;
+} __attribute__((packed)) mbr_t;

 typedef struct direntry_t {
    uint8_t name[8];
@@ -276,7 +276,7 @@ typedef struct direntry_t {
    uint16_t mdate;
    uint16_t begin;
    uint32_t size;
-} QEMU_PACKED direntry_t;
+} __attribute__((packed)) direntry_t;

 /* this structure are used to transparently access the files */

@@ -318,7 +318,6 @@ static void print_mapping(const struct mapping_t* mapping);
 /* here begins the real VVFAT driver */

 typedef struct BDRVVVFATState {
-    CoMutex lock;
    BlockDriverState* bs; /* pointer to parent */
    unsigned int first_sectors_number; /* 1 for a single partition, 0x40 for a disk with partition table */
    unsigned char first_sectors[0x40*0x200];
@@ -351,8 +350,6 @@ typedef struct BDRVVVFATState {
    array_t commits;
    const char* path;
    int downcase_short_names;
-
-    Error *migration_blocker;
 } BDRVVVFATState;

 /* take the sector position spos and convert it to Cylinder/Head/Sector position
@@ -731,11 +728,11 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	if(first_cluster == 0 && (is_dotdot || is_dot))
 	    continue;

-	buffer=(char*)g_malloc(length);
+	buffer=(char*)qemu_malloc(length);
 	snprintf(buffer,length,"%s/%s",dirname,entry->d_name);

 	if(stat(buffer,&st)<0) {
-            g_free(buffer);
+	    free(buffer);
            continue;
 	}

@@ -758,7 +755,7 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	    direntry->begin=0; /* do that later */
        if (st.st_size > 0x7fffffff) {
 	    fprintf(stderr, "File %s is larger than 2GB\n", buffer);
-            g_free(buffer);
+	    free(buffer);
            closedir(dir);
 	    return -2;
        }
@@ -802,7 +799,6 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	/* root directory */
 	int cur = s->directory.next;
 	array_ensure_allocated(&(s->directory), ROOT_ENTRIES - 1);
-	s->directory.next = ROOT_ENTRIES;
 	memset(array_get(&(s->directory), cur), 0,
 		(ROOT_ENTRIES - cur) * sizeof(direntry_t));
    }
@@ -829,6 +825,20 @@ static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
    return s->faked_sectors + s->sectors_per_cluster * cluster_num;
 }

+static inline uint32_t sector_offset_in_cluster(BDRVVVFATState* s,off_t sector_num)
+{
+    return (sector_num-s->first_sectors_number-2*s->sectors_per_fat)%s->sectors_per_cluster;
+}
+
+#ifdef DBG
+static direntry_t* get_direntry_for_mapping(BDRVVVFATState* s,mapping_t* mapping)
+{
+    if(mapping->mode==MODE_UNDEFINED)
+	return 0;
+    return (direntry_t*)(s->directory.pointer+sizeof(direntry_t)*mapping->dir_index);
+}
+#endif
+
 static int init_directories(BDRVVVFATState* s,
 	const char* dirname)
 {
@@ -840,7 +850,7 @@ static int init_directories(BDRVVVFATState* s,
    memset(&(s->first_sectors[0]),0,0x40*0x200);

    s->cluster_size=s->sectors_per_cluster*0x200;
-    s->cluster_buffer=g_malloc(s->cluster_size);
+    s->cluster_buffer=qemu_malloc(s->cluster_size);

    /*
     * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
@@ -874,7 +884,7 @@ static int init_directories(BDRVVVFATState* s,
    mapping->dir_index = 0;
    mapping->info.dir.parent_mapping_index = -1;
    mapping->first_mapping_index = -1;
-    mapping->path = g_strdup(dirname);
+    mapping->path = qemu_strdup(dirname);
    i = strlen(mapping->path);
    if (i > 0 && mapping->path[i - 1] == '/')
 	mapping->path[i - 1] = '\0';
@@ -919,8 +929,11 @@ static int init_directories(BDRVVVFATState* s,
 	cluster = mapping->end;

 	if(cluster > s->cluster_count) {
-	    fprintf(stderr,"Directory does not fit in FAT%d (capacity %.2f MB)\n",
-		    s->fat_type, s->sector_count / 2000.0);
+	    fprintf(stderr,"Directory does not fit in FAT%d (capacity %s)\n",
+		    s->fat_type,
+		    s->fat_type == 12 ? s->sector_count == 2880 ? "1.44 MB"
+								: "2.88 MB"
+				      : "504MB");
 	    return -EINVAL;
 	}

@@ -954,7 +967,7 @@ static int init_directories(BDRVVVFATState* s,
    bootsector->number_of_fats=0x2; /* number of FATs */
    bootsector->root_entries=cpu_to_le16(s->sectors_of_root_directory*0x10);
    bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
-    bootsector->media_type=(s->first_sectors_number>1?0xf8:0xf0); /* media descriptor (f8=hd, f0=3.5 fd)*/
+    bootsector->media_type=(s->fat_type!=12?0xf8:s->sector_count==5760?0xf9:0xf8); /* media descriptor */
    s->fat.pointer[0] = bootsector->media_type;
    bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
    bootsector->sectors_per_track=cpu_to_le16(s->bs->secs);
@@ -963,7 +976,7 @@ static int init_directories(BDRVVVFATState* s,
    bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);

    /* LATER TODO: if FAT32, this is wrong */
-    bootsector->u.fat16.drive_number=s->first_sectors_number==1?0:0x80; /* fda=0, hda=0x80 */
+    bootsector->u.fat16.drive_number=s->fat_type==12?0:0x80; /* assume this is hda (TODO) */
    bootsector->u.fat16.current_head=0;
    bootsector->u.fat16.signature=0x29;
    bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
@@ -985,6 +998,7 @@ static int is_consistent(BDRVVVFATState *s);
 static int vvfat_open(BlockDriverState *bs, const char* dirname, int flags)
 {
    BDRVVVFATState *s = bs->opaque;
+    int floppy = 0;
    int i;

 #ifdef DEBUG
@@ -998,8 +1012,11 @@ DLOG(if (stderr == NULL) {

    s->bs = bs;

+    s->fat_type=16;
    /* LATER TODO: if FAT32, adjust */
    s->sectors_per_cluster=0x10;
+    /* 504MB disk*/
+    bs->cyls=1024; bs->heads=16; bs->secs=63;

    s->current_cluster=0xffffffff;

@@ -1014,6 +1031,16 @@ DLOG(if (stderr == NULL) {
    if (!strstart(dirname, "fat:", NULL))
 	return -1;

+    if (strstr(dirname, ":floppy:")) {
+	floppy = 1;
+	s->fat_type = 12;
+	s->first_sectors_number = 1;
+	s->sectors_per_cluster=2;
+	bs->cyls = 80; bs->heads = 2; bs->secs = 36;
+    }
+
+    s->sector_count=bs->cyls*bs->heads*bs->secs;
+
    if (strstr(dirname, ":32:")) {
 	fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. You are welcome to do so!\n");
 	s->fat_type = 32;
@@ -1021,31 +1048,9 @@ DLOG(if (stderr == NULL) {
 	s->fat_type = 16;
    } else if (strstr(dirname, ":12:")) {
 	s->fat_type = 12;
+	s->sector_count=2880;
    }

-    if (strstr(dirname, ":floppy:")) {
-	/* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
-	if (!s->fat_type) {
-	    s->fat_type = 12;
-	    bs->secs = 36;
-	    s->sectors_per_cluster=2;
-	} else {
-	    bs->secs=(s->fat_type == 12 ? 18 : 36);
-	    s->sectors_per_cluster=1;
-	}
-	s->first_sectors_number = 1;
-	bs->cyls=80; bs->heads=2;
-    } else {
-	/* 32MB or 504MB disk*/
-	if (!s->fat_type) {
-	    s->fat_type = 16;
-	}
-	bs->cyls=(s->fat_type == 12 ? 64 : 1024);
-	bs->heads=16; bs->secs=63;
-    }
-
-    s->sector_count=bs->cyls*bs->heads*bs->secs-(s->first_sectors_number-1);
-
    if (strstr(dirname, ":rw:")) {
 	if (enable_write_target(s))
 	    return -1;
@@ -1069,22 +1074,12 @@ DLOG(if (stderr == NULL) {

    if(s->first_sectors_number==0x40)
 	init_mbr(s);
-    else {
-        /* MS-DOS does not like to know about CHS (?). */
+
+    /* for some reason or other, MS-DOS does not like to know about CHS... */
+    if (floppy)
 	bs->heads = bs->cyls = bs->secs = 0;
-    }

    //    assert(is_consistent(s));
-    qemu_co_mutex_init(&s->lock);
-
-    /* Disable migration when vvfat is used rw */
-    if (s->qcow) {
-        error_set(&s->migration_blocker,
-                  QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-                  "vvfat (rw)", bs->device_name, "live migration");
-        migrate_add_blocker(s->migration_blocker);
-    }
-
    return 0;
 }

@@ -1143,6 +1138,25 @@ static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_
    return mapping;
 }

+/*
+ * This function simply compares path == mapping->path. Since the mappings
+ * are sorted by cluster, this is expensive: O(n).
+ */
+static inline mapping_t* find_mapping_for_path(BDRVVVFATState* s,
+	const char* path)
+{
+    int i;
+
+    for (i = 0; i < s->mapping.next; i++) {
+	mapping_t* mapping = array_get(&(s->mapping), i);
+	if (mapping->first_mapping_index < 0 &&
+		!strcmp(path, mapping->path))
+	    return mapping;
+    }
+
+    return NULL;
+}
+
 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
 {
    if(!mapping)
@@ -1209,6 +1223,23 @@ read_cluster_directory:
 }

 #ifdef DEBUG
+static void hexdump(const void* address, uint32_t len)
+{
+    const unsigned char* p = address;
+    int i, j;
+
+    for (i = 0; i < len; i += 16) {
+	for (j = 0; j < 16 && i + j < len; j++)
+	    fprintf(stderr, "%02x ", p[i + j]);
+	for (; j < 16; j++)
+	    fprintf(stderr, "   ");
+	fprintf(stderr, " ");
+	for (j = 0; j < 16 && i + j < len; j++)
+	    fprintf(stderr, "%c", (p[i + j] < ' ' || p[i + j] > 0x7f) ? '.' : p[i + j]);
+	fprintf(stderr, "\n");
+    }
+}
+
 static void print_direntry(const direntry_t* direntry)
 {
    int j = 0;
@@ -1262,19 +1293,19 @@ static int vvfat_read(BlockDriverState *bs, int64_t sector_num,
    int i;

    for(i=0;i<nb_sectors;i++,sector_num++) {
-	if (sector_num >= bs->total_sectors)
+	if (sector_num >= s->sector_count)
 	   return -1;
 	if (s->qcow) {
 	    int n;
-            if (bdrv_is_allocated(s->qcow, sector_num, nb_sectors-i, &n)) {
+	    if (s->qcow->drv->bdrv_is_allocated(s->qcow,
+			sector_num, nb_sectors-i, &n)) {
 DLOG(fprintf(stderr, "sectors %d+%d allocated\n", (int)sector_num, n));
-                if (bdrv_read(s->qcow, sector_num, buf + i*0x200, n)) {
-                    return -1;
-                }
-                i += n - 1;
-                sector_num += n - 1;
-                continue;
-            }
+		if (s->qcow->drv->bdrv_read(s->qcow, sector_num, buf+i*0x200, n))
+		    return -1;
+		i += n - 1;
+		sector_num += n - 1;
+		continue;
+	    }
 DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
 	}
 	if(sector_num<s->faked_sectors) {
@@ -1288,7 +1319,7 @@ DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
 	    uint32_t sector=sector_num-s->faked_sectors,
 	    sector_offset_in_cluster=(sector%s->sectors_per_cluster),
 	    cluster_num=sector/s->sectors_per_cluster;
-	    if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
+	    if(read_cluster(s, cluster_num) != 0) {
 		/* LATER TODO: strict: return -1; */
 		memset(buf+i*0x200,0,0x200);
 		continue;
@@ -1299,17 +1330,6 @@ DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
    return 0;
 }

-static coroutine_fn int vvfat_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVVFATState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vvfat_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 /* LATER TODO: statify all functions */

 /*
@@ -1355,7 +1375,7 @@ DLOG(fprintf(stderr, "clear_commits (%d commits)\n", s->commits.next));
 	assert(commit->path || commit->action == ACTION_WRITEOUT);
 	if (commit->action != ACTION_WRITEOUT) {
 	    assert(commit->path);
-            g_free(commit->path);
+	    free(commit->path);
 	} else
 	    assert(commit->path == NULL);
    }
@@ -1528,7 +1548,7 @@ static inline int cluster_was_modified(BDRVVVFATState* s, uint32_t cluster_num)
 	return 0;

    for (i = 0; !was_modified && i < s->sectors_per_cluster; i++)
-	was_modified = bdrv_is_allocated(s->qcow,
+	was_modified = s->qcow->drv->bdrv_is_allocated(s->qcow,
 		cluster2sector(s, cluster_num) + i, 1, &dummy);

    return was_modified;
@@ -1618,10 +1638,10 @@ static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,

 	    /* rename */
 	    if (strcmp(basename, basename2))
-		schedule_rename(s, cluster_num, g_strdup(path));
+		schedule_rename(s, cluster_num, qemu_strdup(path));
 	} else if (is_file(direntry))
 	    /* new file */
-	    schedule_new_file(s, g_strdup(path), cluster_num);
+	    schedule_new_file(s, qemu_strdup(path), cluster_num);
 	else {
            abort();
 	    return 0;
@@ -1677,16 +1697,16 @@ static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,
 		int64_t offset = cluster2sector(s, cluster_num);

 		vvfat_close_current_file(s);
-                for (i = 0; i < s->sectors_per_cluster; i++) {
-                    if (!bdrv_is_allocated(s->qcow, offset + i, 1, &dummy)) {
-                        if (vvfat_read(s->bs, offset, s->cluster_buffer, 1)) {
-                            return -1;
-                        }
-                        if (bdrv_write(s->qcow, offset, s->cluster_buffer, 1)) {
-                            return -2;
-                        }
-                    }
-                }
+		for (i = 0; i < s->sectors_per_cluster; i++)
+		    if (!s->qcow->drv->bdrv_is_allocated(s->qcow,
+				offset + i, 1, &dummy)) {
+			if (vvfat_read(s->bs,
+				    offset, s->cluster_buffer, 1))
+			    return -1;
+			if (s->qcow->drv->bdrv_write(s->qcow,
+				    offset, s->cluster_buffer, 1))
+			    return -2;
+		    }
 	    }
 	}

@@ -1715,13 +1735,13 @@ static int check_directory_consistency(BDRVVVFATState *s,
 	int cluster_num, const char* path)
 {
    int ret = 0;
-    unsigned char* cluster = g_malloc(s->cluster_size);
+    unsigned char* cluster = qemu_malloc(s->cluster_size);
    direntry_t* direntries = (direntry_t*)cluster;
    mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);

    long_file_name lfn;
    int path_len = strlen(path);
-    char path2[PATH_MAX + 1];
+    char path2[PATH_MAX];

    assert(path_len < PATH_MAX); /* len was tested before! */
    pstrcpy(path2, sizeof(path2), path);
@@ -1738,10 +1758,10 @@ static int check_directory_consistency(BDRVVVFATState *s,
 	mapping->mode &= ~MODE_DELETED;

 	if (strcmp(basename, basename2))
-	    schedule_rename(s, cluster_num, g_strdup(path));
+	    schedule_rename(s, cluster_num, qemu_strdup(path));
    } else
 	/* new directory */
-	schedule_mkdir(s, cluster_num, g_strdup(path));
+	schedule_mkdir(s, cluster_num, qemu_strdup(path));

    lfn_init(&lfn);
    do {
@@ -1762,14 +1782,14 @@ DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)clu
 	if (subret) {
 	    fprintf(stderr, "Error fetching direntries\n");
 	fail:
-            g_free(cluster);
+	    free(cluster);
 	    return 0;
 	}

 	for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
 	    int cluster_count = 0;

-DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
+DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i));
 	    if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
 		    is_free(direntries + i))
 		continue;
@@ -1830,7 +1850,7 @@ DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i))
 	cluster_num = modified_fat_get(s, cluster_num);
    } while(!fat_eof(s, cluster_num));

-    g_free(cluster);
+    free(cluster);
    return ret;
 }

@@ -1856,7 +1876,7 @@ DLOG(checkpoint());
     */
    if (s->fat2 == NULL) {
 	int size = 0x200 * s->sectors_per_fat;
-	s->fat2 = g_malloc(size);
+	s->fat2 = qemu_malloc(size);
 	memcpy(s->fat2, s->fat.pointer, size);
    }
    check = vvfat_read(s->bs,
@@ -1975,9 +1995,8 @@ static int remove_mapping(BDRVVVFATState* s, int mapping_index)
    mapping_t* first_mapping = array_get(&(s->mapping), 0);

    /* free mapping */
-    if (mapping->first_mapping_index < 0) {
-        g_free(mapping->path);
-    }
+    if (mapping->first_mapping_index < 0)
+	free(mapping->path);

    /* remove from s->mapping */
    array_remove(&(s->mapping), mapping_index);
@@ -2199,7 +2218,7 @@ static int commit_one_file(BDRVVVFATState* s,
    uint32_t first_cluster = c;
    mapping_t* mapping = find_mapping_for_cluster(s, c);
    uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = g_malloc(s->cluster_size);
+    char* cluster = qemu_malloc(s->cluster_size);
    uint32_t i;
    int fd = 0;

@@ -2213,15 +2232,11 @@ static int commit_one_file(BDRVVVFATState* s,
    if (fd < 0) {
 	fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
 		strerror(errno), errno);
-        g_free(cluster);
 	return fd;
    }
-    if (offset > 0) {
-        if (lseek(fd, offset, SEEK_SET) != offset) {
-            g_free(cluster);
-            return -3;
-        }
-    }
+    if (offset > 0)
+	if (lseek(fd, offset, SEEK_SET) != offset)
+	    return -3;

    while (offset < size) {
 	uint32_t c1;
@@ -2237,15 +2252,11 @@ static int commit_one_file(BDRVVVFATState* s,
 	ret = vvfat_read(s->bs, cluster2sector(s, c),
 	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);

-        if (ret < 0) {
-            g_free(cluster);
-            return ret;
-        }
+	if (ret < 0)
+	    return ret;

-        if (write(fd, cluster, rest_size) < 0) {
-            g_free(cluster);
-            return -2;
-        }
+	if (write(fd, cluster, rest_size) < 0)
+	    return -2;

 	offset += rest_size;
 	c = c1;
@@ -2254,11 +2265,9 @@ static int commit_one_file(BDRVVVFATState* s,
    if (ftruncate(fd, size)) {
        perror("ftruncate()");
        close(fd);
-        g_free(cluster);
        return -4;
    }
    close(fd);
-    g_free(cluster);

    return commit_mappings(s, first_cluster, dir_index);
 }
@@ -2374,7 +2383,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
 			    mapping_t* m = find_mapping_for_cluster(s,
 				    begin_of_direntry(d));
 			    int l = strlen(m->path);
-			    char* new_path = g_malloc(l + diff + 1);
+			    char* new_path = qemu_malloc(l + diff + 1);

 			    assert(!strncmp(m->path, mapping->path, l2));

@@ -2390,7 +2399,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
 		}
 	    }

-            g_free(old_path);
+	    free(old_path);
 	    array_remove(&(s->commits), i);
 	    continue;
 	} else if (commit->action == ACTION_MKDIR) {
@@ -2631,9 +2640,7 @@ static int do_commit(BDRVVVFATState* s)
 	return ret;
    }

-    if (s->qcow->drv->bdrv_make_empty) {
-        s->qcow->drv->bdrv_make_empty(s->qcow);
-    }
+    s->qcow->drv->bdrv_make_empty(s->qcow);

    memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));

@@ -2728,7 +2735,7 @@ DLOG(checkpoint());
     * Use qcow backend. Commit later.
     */
 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
-    ret = bdrv_write(s->qcow, sector_num, buf, nb_sectors);
+    ret = s->qcow->drv->bdrv_write(s->qcow, sector_num, buf, nb_sectors);
    if (ret < 0) {
 	fprintf(stderr, "Error writing to qcow backend\n");
 	return ret;
@@ -2747,17 +2754,6 @@ DLOG(checkpoint());
    return 0;
 }

-static coroutine_fn int vvfat_co_write(BlockDriverState *bs, int64_t sector_num,
-                                       const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVVFATState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vvfat_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int vvfat_is_allocated(BlockDriverState *bs,
 	int64_t sector_num, int nb_sectors, int* n)
 {
@@ -2779,7 +2775,7 @@ static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
 static void write_target_close(BlockDriverState *bs) {
    BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
    bdrv_delete(s->qcow);
-    g_free(s->qcow_filename);
+    free(s->qcow_filename);
 }

 static BlockDriver vvfat_write_target = {
@@ -2798,7 +2794,7 @@ static int enable_write_target(BDRVVVFATState *s)

    array_init(&(s->commits), sizeof(commit_t));

-    s->qcow_filename = g_malloc(1024);
+    s->qcow_filename = qemu_malloc(1024);
    get_tmp_filename(s->qcow_filename, 1024);

    bdrv_qcow = bdrv_find_format("qcow");
@@ -2826,7 +2822,7 @@ static int enable_write_target(BDRVVVFATState *s)

    s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
    s->bs->backing_hd->drv = &vvfat_write_target;
-    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
+    s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
    *(void**)s->bs->backing_hd->opaque = s;

    return 0;
@@ -2840,20 +2836,16 @@ static void vvfat_close(BlockDriverState *bs)
    array_free(&(s->fat));
    array_free(&(s->directory));
    array_free(&(s->mapping));
-    g_free(s->cluster_buffer);
-
-    if (s->qcow) {
-        migrate_del_blocker(s->migration_blocker);
-        error_free(s->migration_blocker);
-    }
+    if(s->cluster_buffer)
+        free(s->cluster_buffer);
 }

 static BlockDriver bdrv_vvfat = {
    .format_name	= "vvfat",
    .instance_size	= sizeof(BDRVVVFATState),
    .bdrv_file_open	= vvfat_open,
-    .bdrv_read          = vvfat_co_read,
-    .bdrv_write         = vvfat_co_write,
+    .bdrv_read		= vvfat_read,
+    .bdrv_write		= vvfat_write,
    .bdrv_close		= vvfat_close,
    .bdrv_is_allocated	= vvfat_is_allocated,
    .protocol_name	= "fat",
@@ -2886,5 +2878,11 @@ static void checkpoint(void) {
    direntry = array_get(&(vvv->directory), mapping->dir_index);
    assert(!memcmp(direntry->name, "USB     H  ", 11) || direntry->name[0]==0);
 #endif
+    return;
+    /* avoid compiler warnings: */
+    hexdump(NULL, 100);
+    remove_mapping(vvv, 0);
+    print_mapping(NULL);
+    print_direntry(NULL);
 }
 #endif
--- a/block_int.h
+++ b/block_int.h
@@ -27,9 +27,6 @@
 #include "block.h"
 #include "qemu-option.h"
 #include "qemu-queue.h"
-#include "qemu-coroutine.h"
-#include "qemu-timer.h"
-#include "qapi-types.h"

 #define BLOCK_FLAG_ENCRYPT	1
 #define BLOCK_FLAG_COMPAT6	4
@@ -63,6 +60,7 @@ struct BlockDriver {
                      const uint8_t *buf, int nb_sectors);
    void (*bdrv_close)(BlockDriverState *bs);
    int (*bdrv_create)(const char *filename, QEMUOptionParameter *options);
+    int (*bdrv_flush)(BlockDriverState *bs);
    int (*bdrv_is_allocated)(BlockDriverState *bs, int64_t sector_num,
                             int nb_sectors, int *pnum);
    int (*bdrv_set_key)(BlockDriverState *bs, const char *key);
@@ -76,34 +74,8 @@ struct BlockDriver {
        BlockDriverCompletionFunc *cb, void *opaque);
    BlockDriverAIOCB *(*bdrv_aio_flush)(BlockDriverState *bs,
        BlockDriverCompletionFunc *cb, void *opaque);
-    BlockDriverAIOCB *(*bdrv_aio_discard)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque);
-
-    int coroutine_fn (*bdrv_co_readv)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
-    int coroutine_fn (*bdrv_co_writev)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
-    int coroutine_fn (*bdrv_co_discard)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors);
-
-    /*
-     * Invalidate any cached meta-data.
-     */
-    void (*bdrv_invalidate_cache)(BlockDriverState *bs);
-
-    /*
-     * Flushes all data that was already written to the OS all the way down to
-     * the disk (for example raw-posix calls fsync()).
-     */
-    int coroutine_fn (*bdrv_co_flush_to_disk)(BlockDriverState *bs);
-
-    /*
-     * Flushes all internal caches to the OS. The data may still sit in a
-     * writeback cache of the host OS, but it will survive a crash of the qemu
-     * process.
-     */
-    int coroutine_fn (*bdrv_co_flush_to_os)(BlockDriverState *bs);
+    int (*bdrv_discard)(BlockDriverState *bs, int64_t sector_num,
+                        int nb_sectors);

    int (*bdrv_aio_multiwrite)(BlockDriverState *bs, BlockRequest *reqs,
        int num_reqs);
@@ -140,8 +112,8 @@ struct BlockDriver {
    /* removable device specific */
    int (*bdrv_is_inserted)(BlockDriverState *bs);
    int (*bdrv_media_changed)(BlockDriverState *bs);
-    void (*bdrv_eject)(BlockDriverState *bs, int eject_flag);
-    void (*bdrv_lock_medium)(BlockDriverState *bs, bool locked);
+    int (*bdrv_eject)(BlockDriverState *bs, int eject_flag);
+    int (*bdrv_set_locked)(BlockDriverState *bs, int locked);

    /* to control generic scsi devices */
    int (*bdrv_ioctl)(BlockDriverState *bs, unsigned long int req, void *buf);
@@ -176,23 +148,27 @@ struct BlockDriverState {
    int read_only; /* if true, the media is read only */
    int keep_read_only; /* if true, the media was requested to stay read only */
    int open_flags; /* flags used to open the file, re-used for re-open */
+    int removable; /* if true, the media can be removed */
+    int locked;    /* if true, the media cannot temporarily be ejected */
+    int tray_open; /* if true, the virtual tray is open */
    int encrypted; /* if true, the media is encrypted */
    int valid_key; /* if true, a valid encryption key has been set */
    int sg;        /* if true, the device is a /dev/sg* */
+    /* event callback when inserting/removing */
+    void (*change_cb)(void *opaque, int reason);
+    void *change_opaque;

    BlockDriver *drv; /* NULL means no media */
    void *opaque;

-    void *dev;                  /* attached device model, if any */
-    /* TODO change to DeviceState when all users are qdevified */
-    const BlockDevOps *dev_ops;
-    void *dev_opaque;
+    DeviceState *peer;

    char filename[1024];
    char backing_file[1024]; /* if non zero, the image is a diff of
                                this file image */
    char backing_format[16]; /* if non-zero and backing_file exists */
    int is_temporary;
+    int media_changed;

    BlockDriverState *backing_hd;
    BlockDriverState *file;
@@ -202,9 +178,10 @@ struct BlockDriverState {
    void *sync_aiocb;

    /* I/O stats (display with "info blockstats"). */
-    uint64_t nr_bytes[BDRV_MAX_IOTYPE];
-    uint64_t nr_ops[BDRV_MAX_IOTYPE];
-    uint64_t total_time_ns[BDRV_MAX_IOTYPE];
+    uint64_t rd_bytes;
+    uint64_t wr_bytes;
+    uint64_t rd_ops;
+    uint64_t wr_ops;
    uint64_t wr_highest_sector;

    /* Whether the disk can expand beyond total_sectors */
@@ -220,8 +197,6 @@ struct BlockDriverState {
       drivers. They are not used by the block driver */
    int cyls, heads, secs, translation;
    BlockErrorAction on_read_error, on_write_error;
-    bool iostatus_enabled;
-    BlockDeviceIoStatus iostatus;
    char device_name[32];
    unsigned long *dirty_bitmap;
    int64_t dirty_count;
@@ -230,6 +205,9 @@ struct BlockDriverState {
    void *private;
 };

+#define CHANGE_MEDIA    0x01
+#define CHANGE_SIZE     0x02
+
 struct BlockDriverAIOCB {
    AIOPool *pool;
    BlockDriverState *bs;
@@ -244,8 +222,45 @@ void *qemu_aio_get(AIOPool *pool, BlockDriverState *bs,
                   BlockDriverCompletionFunc *cb, void *opaque);
 void qemu_aio_release(void *p);

+void *qemu_blockalign(BlockDriverState *bs, size_t size);
+
 #ifdef _WIN32
 int is_windows_drive(const char *filename);
 #endif

+typedef struct BlockConf {
+    BlockDriverState *bs;
+    uint16_t physical_block_size;
+    uint16_t logical_block_size;
+    uint16_t min_io_size;
+    uint32_t opt_io_size;
+    int32_t bootindex;
+    uint32_t discard_granularity;
+} BlockConf;
+
+static inline unsigned int get_physical_block_exp(BlockConf *conf)
+{
+    unsigned int exp = 0, size;
+
+    for (size = conf->physical_block_size;
+        size > conf->logical_block_size;
+        size >>= 1) {
+        exp++;
+    }
+
+    return exp;
+}
+
+#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
+    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
+    DEFINE_PROP_UINT16("logical_block_size", _state,                    \
+                       _conf.logical_block_size, 512),                  \
+    DEFINE_PROP_UINT16("physical_block_size", _state,                   \
+                       _conf.physical_block_size, 512),                 \
+    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
+    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
+    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
+    DEFINE_PROP_UINT32("discard_granularity", _state, \
+                       _conf.discard_granularity, 0)
+
 #endif /* BLOCK_INT_H */
--- a/blockdev.c
+++ b/blockdev.c
@@ -14,8 +14,11 @@
 #include "qemu-option.h"
 #include "qemu-config.h"
 #include "sysemu.h"
+#include "hw/qdev.h"
 #include "block_int.h"

+DriveInfo *extboot_drive = NULL;
+
 static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);

 static const char *const if_name[IF_COUNT] = {
@@ -181,9 +184,9 @@ static void drive_uninit(DriveInfo *dinfo)
 {
    qemu_opts_del(dinfo->opts);
    bdrv_delete(dinfo->bdrv);
-    g_free(dinfo->id);
+    qemu_free(dinfo->id);
    QTAILQ_REMOVE(&drives, dinfo, next);
-    g_free(dinfo);
+    qemu_free(dinfo);
 }

 void drive_put_ref(DriveInfo *dinfo)
@@ -235,6 +238,7 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    int on_read_error, on_write_error;
    const char *devaddr;
    DriveInfo *dinfo;
+    int is_extboot = 0;
    int snapshot = 0;
    int ret;

@@ -320,9 +324,18 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    }

    if ((buf = qemu_opt_get(opts, "cache")) != NULL) {
-        if (bdrv_parse_cache_flags(buf, &bdrv_flags) != 0) {
-            error_report("invalid cache option");
-            return NULL;
+        if (!strcmp(buf, "off") || !strcmp(buf, "none")) {
+            bdrv_flags |= BDRV_O_NOCACHE | BDRV_O_CACHE_WB;
+        } else if (!strcmp(buf, "writeback")) {
+            bdrv_flags |= BDRV_O_CACHE_WB;
+        } else if (!strcmp(buf, "unsafe")) {
+            bdrv_flags |= BDRV_O_CACHE_WB;
+            bdrv_flags |= BDRV_O_NO_FLUSH;
+        } else if (!strcmp(buf, "writethrough")) {
+            /* this is the default */
+        } else {
+           error_report("invalid cache option");
+           return NULL;
        }
    }

@@ -353,6 +366,12 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
        }
    }

+    is_extboot = qemu_opt_get_bool(opts, "boot", 0);
+    if (is_extboot && extboot_drive) {
+        fprintf(stderr, "qemu: two bootable drives specified\n");
+        return NULL;
+    }
+
    on_write_error = BLOCK_ERR_STOP_ENOSPC;
    if ((buf = qemu_opt_get(opts, "werror")) != NULL) {
        if (type != IF_IDE && type != IF_SCSI && type != IF_VIRTIO && type != IF_NONE) {
@@ -432,12 +451,12 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)

    /* init */

-    dinfo = g_malloc0(sizeof(*dinfo));
+    dinfo = qemu_mallocz(sizeof(*dinfo));
    if ((buf = qemu_opts_id(opts)) != NULL) {
-        dinfo->id = g_strdup(buf);
+        dinfo->id = qemu_strdup(buf);
    } else {
        /* no id supplied -> create one */
-        dinfo->id = g_malloc0(32);
+        dinfo->id = qemu_mallocz(32);
        if (type == IF_IDE || type == IF_SCSI)
            mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
        if (max_devs)
@@ -458,6 +477,10 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
        strncpy(dinfo->serial, serial, sizeof(dinfo->serial) - 1);
    QTAILQ_INSERT_TAIL(&drives, dinfo, next);

+    if (is_extboot) {
+        extboot_drive = dinfo;
+    }
+
    bdrv_set_on_error(dinfo->bdrv, on_read_error, on_write_error);

    switch(type) {
@@ -473,12 +496,17 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
            }
 	    break;
 	case MEDIA_CDROM:
+            bdrv_set_removable(dinfo->bdrv, 1);
            dinfo->media_cd = 1;
 	    break;
 	}
        break;
    case IF_SD:
+        /* FIXME: This isn't really a floppy, but it's a reasonable
+           approximation.  */
    case IF_FLOPPY:
+        bdrv_set_removable(dinfo->bdrv, 1);
+        break;
    case IF_PFLASH:
    case IF_MTD:
        break;
@@ -527,9 +555,9 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)

 err:
    bdrv_delete(dinfo->bdrv);
-    g_free(dinfo->id);
+    qemu_free(dinfo->id);
    QTAILQ_REMOVE(&drives, dinfo, next);
-    g_free(dinfo);
+    qemu_free(dinfo);
    return NULL;
 }

@@ -631,13 +659,13 @@ out:

 static int eject_device(Monitor *mon, BlockDriverState *bs, int force)
 {
-    if (!bdrv_dev_has_removable_media(bs)) {
-        qerror_report(QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));
-        return -1;
-    }
-    if (bdrv_dev_is_medium_locked(bs) && !bdrv_dev_is_tray_open(bs)) {
-        bdrv_dev_eject_request(bs, force);
-        if (!force) {
+    if (!force) {
+        if (!bdrv_is_removable(bs)) {
+            qerror_report(QERR_DEVICE_NOT_REMOVABLE,
+                           bdrv_get_device_name(bs));
+            return -1;
+        }
+        if (bdrv_is_locked(bs)) {
            qerror_report(QERR_DEVICE_LOCKED, bdrv_get_device_name(bs));
            return -1;
        }
@@ -735,12 +763,12 @@ int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data)
    bdrv_flush(bs);
    bdrv_close(bs);

-    /* if we have a device attached to this BlockDriverState
+    /* if we have a device associated with this BlockDriverState (bs->peer)
     * then we need to make the drive anonymous until the device
     * can be removed.  If this is a drive with no device backing
     * then we can just get rid of the block driver state right here.
     */
-    if (bdrv_get_attached_dev(bs)) {
+    if (bs->peer) {
        bdrv_make_anon(bs);
    } else {
        drive_uninit(drive_get_by_blockdev(bs));
--- a/blockdev.h
+++ b/blockdev.h
@@ -66,4 +66,6 @@ int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data);
 int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, QObject **ret_data);
 int do_block_resize(Monitor *mon, const QDict *qdict, QObject **ret_data);

+extern DriveInfo *extboot_drive;
+
 #endif
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -905,8 +905,7 @@ int main(int argc, char **argv)
        cpu_model = "any";
 #endif
    }
-    tcg_exec_init(0);
-    cpu_exec_init_all();
+    cpu_exec_init_all(0);
    /* NOTE: we need to init the CPU at this stage to get
       qemu_host_page_size */
    env = cpu_init(cpu_model);
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -94,7 +94,7 @@ void *qemu_vmalloc(size_t size)
    return p;
 }

-void *g_malloc(size_t size)
+void *qemu_malloc(size_t size)
 {
    char * p;
    size += 16;
@@ -104,12 +104,12 @@ void *g_malloc(size_t size)
 }

 /* We use map, which is always zero initialized.  */
-void * g_malloc0(size_t size)
+void * qemu_mallocz(size_t size)
 {
-    return g_malloc(size);
+    return qemu_malloc(size);
 }

-void g_free(void *ptr)
+void qemu_free(void *ptr)
 {
    /* FIXME: We should unmark the reserved pages here.  However this gets
       complicated when one target page spans multiple host pages, so we
@@ -119,18 +119,18 @@ void g_free(void *ptr)
    munmap(p, *p);
 }

-void *g_realloc(void *ptr, size_t size)
+void *qemu_realloc(void *ptr, size_t size)
 {
    size_t old_size, copy;
    void *new_ptr;

    if (!ptr)
-        return g_malloc(size);
+        return qemu_malloc(size);
    old_size = *(size_t *)((char *)ptr - 16);
    copy = old_size < size ? old_size : size;
-    new_ptr = g_malloc(size);
+    new_ptr = qemu_malloc(size);
    memcpy(new_ptr, ptr, copy);
-    g_free(ptr);
+    qemu_free(ptr);
    return new_ptr;
 }

--- a/bsd-user/syscall.c
+++ b/bsd-user/syscall.c
@@ -231,7 +231,7 @@ static abi_long do_freebsd_sysctl(abi_ulong namep, int32_t namelen, abi_ulong ol
    void *hnamep, *holdp, *hnewp = NULL;
    size_t holdlen;
    abi_ulong oldlen = 0;
-    int32_t *snamep = g_malloc(sizeof(int32_t) * namelen), *p, *q, i;
+    int32_t *snamep = qemu_malloc(sizeof(int32_t) * namelen), *p, *q, i;
    uint32_t kind = 0;

    if (oldlenp)
@@ -255,7 +255,7 @@ static abi_long do_freebsd_sysctl(abi_ulong namep, int32_t namelen, abi_ulong ol
    unlock_user(holdp, oldp, holdlen);
    if (hnewp)
        unlock_user(hnewp, newp, 0);
-    g_free(snamep);
+    qemu_free(snamep);
    return ret;
 }
 #endif
--- a/bswap.h
+++ b/bswap.h
@@ -4,7 +4,6 @@
 #include "config-host.h"

 #include <inttypes.h>
-#include "softfloat.h"

 #ifdef CONFIG_MACHINE_BSWAP_H
 #include <sys/endian.h>
@@ -238,476 +237,4 @@ static inline uint32_t qemu_bswap_len(uint32_t value, int len)
    return bswap32(value) >> (32 - 8 * len);
 }

-typedef union {
-    float32 f;
-    uint32_t l;
-} CPU_FloatU;
-
-typedef union {
-    float64 d;
-#if defined(HOST_WORDS_BIGENDIAN)
-    struct {
-        uint32_t upper;
-        uint32_t lower;
-    } l;
-#else
-    struct {
-        uint32_t lower;
-        uint32_t upper;
-    } l;
-#endif
-    uint64_t ll;
-} CPU_DoubleU;
-
-typedef union {
-     floatx80 d;
-     struct {
-         uint64_t lower;
-         uint16_t upper;
-     } l;
-} CPU_LDoubleU;
-
-typedef union {
-    float128 q;
-#if defined(HOST_WORDS_BIGENDIAN)
-    struct {
-        uint32_t upmost;
-        uint32_t upper;
-        uint32_t lower;
-        uint32_t lowest;
-    } l;
-    struct {
-        uint64_t upper;
-        uint64_t lower;
-    } ll;
-#else
-    struct {
-        uint32_t lowest;
-        uint32_t lower;
-        uint32_t upper;
-        uint32_t upmost;
-    } l;
-    struct {
-        uint64_t lower;
-        uint64_t upper;
-    } ll;
-#endif
-} CPU_QuadU;
-
-/* unaligned/endian-independent pointer access */
-
-/*
- * the generic syntax is:
- *
- * load: ld{type}{sign}{size}{endian}_p(ptr)
- *
- * store: st{type}{size}{endian}_p(ptr, val)
- *
- * Note there are small differences with the softmmu access API!
- *
- * type is:
- * (empty): integer access
- *   f    : float access
- *
- * sign is:
- * (empty): for floats or 32 bit size
- *   u    : unsigned
- *   s    : signed
- *
- * size is:
- *   b: 8 bits
- *   w: 16 bits
- *   l: 32 bits
- *   q: 64 bits
- *
- * endian is:
- * (empty): 8 bit access
- *   be   : big endian
- *   le   : little endian
- */
-static inline int ldub_p(const void *ptr)
-{
-    return *(uint8_t *)ptr;
-}
-
-static inline int ldsb_p(const void *ptr)
-{
-    return *(int8_t *)ptr;
-}
-
-static inline void stb_p(void *ptr, int v)
-{
-    *(uint8_t *)ptr = v;
-}
-
-/* NOTE: on arm, putting 2 in /proc/sys/debug/alignment so that the
-   kernel handles unaligned load/stores may give better results, but
-   it is a system wide setting : bad */
-#if defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
-
-/* conservative code for little endian unaligned accesses */
-static inline int lduw_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return val;
-#else
-    const uint8_t *p = ptr;
-    return p[0] | (p[1] << 8);
-#endif
-}
-
-static inline int ldsw_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return (int16_t)val;
-#else
-    const uint8_t *p = ptr;
-    return (int16_t)(p[0] | (p[1] << 8));
-#endif
-}
-
-static inline int ldl_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return val;
-#else
-    const uint8_t *p = ptr;
-    return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
-#endif
-}
-
-static inline uint64_t ldq_le_p(const void *ptr)
-{
-    const uint8_t *p = ptr;
-    uint32_t v1, v2;
-    v1 = ldl_le_p(p);
-    v2 = ldl_le_p(p + 4);
-    return v1 | ((uint64_t)v2 << 32);
-}
-
-static inline void stw_le_p(void *ptr, int v)
-{
-#ifdef _ARCH_PPC
-    __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*(uint16_t *)ptr) : "r" (v), "r" (ptr));
-#else
-    uint8_t *p = ptr;
-    p[0] = v;
-    p[1] = v >> 8;
-#endif
-}
-
-static inline void stl_le_p(void *ptr, int v)
-{
-#ifdef _ARCH_PPC
-    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
-#else
-    uint8_t *p = ptr;
-    p[0] = v;
-    p[1] = v >> 8;
-    p[2] = v >> 16;
-    p[3] = v >> 24;
-#endif
-}
-
-static inline void stq_le_p(void *ptr, uint64_t v)
-{
-    uint8_t *p = ptr;
-    stl_le_p(p, (uint32_t)v);
-    stl_le_p(p + 4, v >> 32);
-}
-
-/* float access */
-
-static inline float32 ldfl_le_p(const void *ptr)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.i = ldl_le_p(ptr);
-    return u.f;
-}
-
-static inline void stfl_le_p(void *ptr, float32 v)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.f = v;
-    stl_le_p(ptr, u.i);
-}
-
-static inline float64 ldfq_le_p(const void *ptr)
-{
-    CPU_DoubleU u;
-    u.l.lower = ldl_le_p(ptr);
-    u.l.upper = ldl_le_p(ptr + 4);
-    return u.d;
-}
-
-static inline void stfq_le_p(void *ptr, float64 v)
-{
-    CPU_DoubleU u;
-    u.d = v;
-    stl_le_p(ptr, u.l.lower);
-    stl_le_p(ptr + 4, u.l.upper);
-}
-
-#else
-
-static inline int lduw_le_p(const void *ptr)
-{
-    return *(uint16_t *)ptr;
-}
-
-static inline int ldsw_le_p(const void *ptr)
-{
-    return *(int16_t *)ptr;
-}
-
-static inline int ldl_le_p(const void *ptr)
-{
-    return *(uint32_t *)ptr;
-}
-
-static inline uint64_t ldq_le_p(const void *ptr)
-{
-    return *(uint64_t *)ptr;
-}
-
-static inline void stw_le_p(void *ptr, int v)
-{
-    *(uint16_t *)ptr = v;
-}
-
-static inline void stl_le_p(void *ptr, int v)
-{
-    *(uint32_t *)ptr = v;
-}
-
-static inline void stq_le_p(void *ptr, uint64_t v)
-{
-    *(uint64_t *)ptr = v;
-}
-
-/* float access */
-
-static inline float32 ldfl_le_p(const void *ptr)
-{
-    return *(float32 *)ptr;
-}
-
-static inline float64 ldfq_le_p(const void *ptr)
-{
-    return *(float64 *)ptr;
-}
-
-static inline void stfl_le_p(void *ptr, float32 v)
-{
-    *(float32 *)ptr = v;
-}
-
-static inline void stfq_le_p(void *ptr, float64 v)
-{
-    *(float64 *)ptr = v;
-}
-#endif
-
-#if !defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
-
-static inline int lduw_be_p(const void *ptr)
-{
-#if defined(__i386__)
-    int val;
-    asm volatile ("movzwl %1, %0\n"
-                  "xchgb %b0, %h0\n"
-                  : "=q" (val)
-                  : "m" (*(uint16_t *)ptr));
-    return val;
-#else
-    const uint8_t *b = ptr;
-    return ((b[0] << 8) | b[1]);
-#endif
-}
-
-static inline int ldsw_be_p(const void *ptr)
-{
-#if defined(__i386__)
-    int val;
-    asm volatile ("movzwl %1, %0\n"
-                  "xchgb %b0, %h0\n"
-                  : "=q" (val)
-                  : "m" (*(uint16_t *)ptr));
-    return (int16_t)val;
-#else
-    const uint8_t *b = ptr;
-    return (int16_t)((b[0] << 8) | b[1]);
-#endif
-}
-
-static inline int ldl_be_p(const void *ptr)
-{
-#if defined(__i386__) || defined(__x86_64__)
-    int val;
-    asm volatile ("movl %1, %0\n"
-                  "bswap %0\n"
-                  : "=r" (val)
-                  : "m" (*(uint32_t *)ptr));
-    return val;
-#else
-    const uint8_t *b = ptr;
-    return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
-#endif
-}
-
-static inline uint64_t ldq_be_p(const void *ptr)
-{
-    uint32_t a,b;
-    a = ldl_be_p(ptr);
-    b = ldl_be_p((uint8_t *)ptr + 4);
-    return (((uint64_t)a<<32)|b);
-}
-
-static inline void stw_be_p(void *ptr, int v)
-{
-#if defined(__i386__)
-    asm volatile ("xchgb %b0, %h0\n"
-                  "movw %w0, %1\n"
-                  : "=q" (v)
-                  : "m" (*(uint16_t *)ptr), "0" (v));
-#else
-    uint8_t *d = (uint8_t *) ptr;
-    d[0] = v >> 8;
-    d[1] = v;
-#endif
-}
-
-static inline void stl_be_p(void *ptr, int v)
-{
-#if defined(__i386__) || defined(__x86_64__)
-    asm volatile ("bswap %0\n"
-                  "movl %0, %1\n"
-                  : "=r" (v)
-                  : "m" (*(uint32_t *)ptr), "0" (v));
-#else
-    uint8_t *d = (uint8_t *) ptr;
-    d[0] = v >> 24;
-    d[1] = v >> 16;
-    d[2] = v >> 8;
-    d[3] = v;
-#endif
-}
-
-static inline void stq_be_p(void *ptr, uint64_t v)
-{
-    stl_be_p(ptr, v >> 32);
-    stl_be_p((uint8_t *)ptr + 4, v);
-}
-
-/* float access */
-
-static inline float32 ldfl_be_p(const void *ptr)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.i = ldl_be_p(ptr);
-    return u.f;
-}
-
-static inline void stfl_be_p(void *ptr, float32 v)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.f = v;
-    stl_be_p(ptr, u.i);
-}
-
-static inline float64 ldfq_be_p(const void *ptr)
-{
-    CPU_DoubleU u;
-    u.l.upper = ldl_be_p(ptr);
-    u.l.lower = ldl_be_p((uint8_t *)ptr + 4);
-    return u.d;
-}
-
-static inline void stfq_be_p(void *ptr, float64 v)
-{
-    CPU_DoubleU u;
-    u.d = v;
-    stl_be_p(ptr, u.l.upper);
-    stl_be_p((uint8_t *)ptr + 4, u.l.lower);
-}
-
-#else
-
-static inline int lduw_be_p(const void *ptr)
-{
-    return *(uint16_t *)ptr;
-}
-
-static inline int ldsw_be_p(const void *ptr)
-{
-    return *(int16_t *)ptr;
-}
-
-static inline int ldl_be_p(const void *ptr)
-{
-    return *(uint32_t *)ptr;
-}
-
-static inline uint64_t ldq_be_p(const void *ptr)
-{
-    return *(uint64_t *)ptr;
-}
-
-static inline void stw_be_p(void *ptr, int v)
-{
-    *(uint16_t *)ptr = v;
-}
-
-static inline void stl_be_p(void *ptr, int v)
-{
-    *(uint32_t *)ptr = v;
-}
-
-static inline void stq_be_p(void *ptr, uint64_t v)
-{
-    *(uint64_t *)ptr = v;
-}
-
-/* float access */
-
-static inline float32 ldfl_be_p(const void *ptr)
-{
-    return *(float32 *)ptr;
-}
-
-static inline float64 ldfq_be_p(const void *ptr)
-{
-    return *(float64 *)ptr;
-}
-
-static inline void stfl_be_p(void *ptr, float32 v)
-{
-    *(float32 *)ptr = v;
-}
-
-static inline void stfq_be_p(void *ptr, float64 v)
-{
-    *(float64 *)ptr = v;
-}
-
-#endif
-
 #endif /* BSWAP_H */
--- a/bt-host.c
+++ b/bt-host.c
@@ -177,7 +177,7 @@ struct HCIInfo *bt_host_hci(const char *id)
    }
 # endif

-    s = g_malloc0(sizeof(struct bt_host_hci_s));
+    s = qemu_mallocz(sizeof(struct bt_host_hci_s));
    s->fd = fd;
    s->hci.cmd_send = bt_host_cmd;
    s->hci.sco_send = bt_host_sco;
--- a/bt-vhci.c
+++ b/bt-vhci.c
@@ -156,7 +156,7 @@ void bt_vhci_init(struct HCIInfo *info)
        exit(-1);
    }

-    s = g_malloc0(sizeof(struct bt_vhci_s));
+    s = qemu_mallocz(sizeof(struct bt_vhci_s));
    s->fd = fd;
    s->info = info ?: qemu_next_hci();
    s->info->opaque = s;
--- a/buffered_file.c
+++ b/buffered_file.c
@@ -27,6 +27,7 @@ typedef struct QEMUFileBuffered
    BufferedCloseFunc *close;
    void *opaque;
    QEMUFile *file;
+    int has_error;
    int freeze_output;
    size_t bytes_xfer;
    size_t xfer_limit;
@@ -55,7 +56,7 @@ static void buffered_append(QEMUFileBuffered *s,

        s->buffer_capacity += size + 1024;

-        tmp = g_realloc(s->buffer, s->buffer_capacity);
+        tmp = qemu_realloc(s->buffer, s->buffer_capacity);
        if (tmp == NULL) {
            fprintf(stderr, "qemu file buffer expansion failed\n");
            exit(1);
@@ -71,11 +72,9 @@ static void buffered_append(QEMUFileBuffered *s,
 static void buffered_flush(QEMUFileBuffered *s)
 {
    size_t offset = 0;
-    int error;

-    error = qemu_file_get_error(s->file);
-    if (error != 0) {
-        DPRINTF("flush when error, bailing: %s\n", strerror(-error));
+    if (s->has_error) {
+        DPRINTF("flush when error, bailing\n");
        return;
    }

@@ -94,7 +93,7 @@ static void buffered_flush(QEMUFileBuffered *s)

        if (ret <= 0) {
            DPRINTF("error flushing data, %zd\n", ret);
-            qemu_file_set_error(s->file, ret);
+            s->has_error = 1;
            break;
        } else {
            DPRINTF("flushed %zd byte(s)\n", ret);
@@ -110,15 +109,14 @@ static void buffered_flush(QEMUFileBuffered *s)
 static int buffered_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int size)
 {
    QEMUFileBuffered *s = opaque;
-    int offset = 0, error;
+    int offset = 0;
    ssize_t ret;

    DPRINTF("putting %d bytes at %" PRId64 "\n", size, pos);

-    error = qemu_file_get_error(s->file);
-    if (error) {
-        DPRINTF("flush when error, bailing: %s\n", strerror(-error));
-        return error;
+    if (s->has_error) {
+        DPRINTF("flush when error, bailing\n");
+        return -EINVAL;
    }

    DPRINTF("unfreezing output\n");
@@ -141,7 +139,7 @@ static int buffered_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, in

        if (ret <= 0) {
            DPRINTF("error putting\n");
-            qemu_file_set_error(s->file, ret);
+            s->has_error = 1;
            offset = -EINVAL;
            break;
        }
@@ -175,37 +173,29 @@ static int buffered_close(void *opaque)

    DPRINTF("closing\n");

-    while (!qemu_file_get_error(s->file) && s->buffer_size) {
+    while (!s->has_error && s->buffer_size) {
        buffered_flush(s);
        if (s->freeze_output)
-            s->wait_for_unfreeze(s->opaque);
+            s->wait_for_unfreeze(s);
    }

    ret = s->close(s->opaque);

    qemu_del_timer(s->timer);
    qemu_free_timer(s->timer);
-    g_free(s->buffer);
-    g_free(s);
+    qemu_free(s->buffer);
+    qemu_free(s);

    return ret;
 }

-/*
- * The meaning of the return values is:
- *   0: We can continue sending
- *   1: Time to stop
- *   negative: There has been an error
- */
 static int buffered_rate_limit(void *opaque)
 {
    QEMUFileBuffered *s = opaque;
-    int ret;

-    ret = qemu_file_get_error(s->file);
-    if (ret) {
-        return ret;
-    }
+    if (s->has_error)
+        return 0;
+
    if (s->freeze_output)
        return 1;

@@ -218,9 +208,9 @@ static int buffered_rate_limit(void *opaque)
 static int64_t buffered_set_rate_limit(void *opaque, int64_t new_rate)
 {
    QEMUFileBuffered *s = opaque;
-    if (qemu_file_get_error(s->file)) {
+    if (s->has_error)
        goto out;
-    }
+
    if (new_rate > SIZE_MAX) {
        new_rate = SIZE_MAX;
    }
@@ -242,7 +232,7 @@ static void buffered_rate_tick(void *opaque)
 {
    QEMUFileBuffered *s = opaque;

-    if (qemu_file_get_error(s->file)) {
+    if (s->has_error) {
        buffered_close(s);
        return;
    }
@@ -269,7 +259,7 @@ QEMUFile *qemu_fopen_ops_buffered(void *opaque,
 {
    QEMUFileBuffered *s;

-    s = g_malloc0(sizeof(*s));
+    s = qemu_mallocz(sizeof(*s));

    s->opaque = opaque;
    s->xfer_limit = bytes_per_sec / 10;
--- a/cache-utils.h
+++ b/cache-utils.h
@@ -34,7 +34,28 @@ static inline void flush_icache_range(unsigned long start, unsigned long stop)
    asm volatile ("isync" : : : "memory");
 }

+/*
+ * Is this correct for PPC?
+ */
+static inline void dma_flush_range(unsigned long start, unsigned long stop)
+{
+}
+
+#elif defined(__ia64__)
+static inline void flush_icache_range(unsigned long start, unsigned long stop)
+{
+    while (start < stop) {
+	asm volatile ("fc %0" :: "r"(start));
+	start += 32;
+    }
+    asm volatile (";;sync.i;;srlz.i;;");
+}
+#define dma_flush_range(start, end) flush_icache_range(start, end)
+#define qemu_cache_utils_init(envp) do { (void) (envp); } while (0)
 #else
+static inline void dma_flush_range(unsigned long start, unsigned long stop)
+{
+}
 #define qemu_cache_utils_init(envp) do { (void) (envp); } while (0)
 #endif

--- a/check-qdict.c
+++ b/check-qdict.c
@@ -56,9 +56,9 @@ START_TEST(qdict_put_obj_test)

    // destroy doesn't exit yet
    QDECREF(qi);
-    g_free(ent->key);
-    g_free(ent);
-    g_free(qdict);
+    qemu_free(ent->key);
+    qemu_free(ent);
+    qemu_free(qdict);
 }
 END_TEST

--- a/check-qfloat.c
+++ b/check-qfloat.c
@@ -33,7 +33,7 @@ START_TEST(qfloat_from_double_test)
    fail_unless(qobject_type(QOBJECT(qf)) == QTYPE_QFLOAT);

    // destroy doesn't exit yet
-    g_free(qf);
+    qemu_free(qf);
 }
 END_TEST

--- a/check-qint.c
+++ b/check-qint.c
@@ -32,7 +32,7 @@ START_TEST(qint_from_int_test)
    fail_unless(qobject_type(QOBJECT(qi)) == QTYPE_QINT);

    // destroy doesn't exit yet
-    g_free(qi);
+    qemu_free(qi);
 }
 END_TEST

--- a/check-qlist.c
+++ b/check-qlist.c
@@ -30,7 +30,7 @@ START_TEST(qlist_new_test)
    fail_unless(qobject_type(QOBJECT(qlist)) == QTYPE_QLIST);

    // destroy doesn't exist yet
-    g_free(qlist);
+    qemu_free(qlist);
 }
 END_TEST

@@ -51,8 +51,8 @@ START_TEST(qlist_append_test)

    // destroy doesn't exist yet
    QDECREF(qi);
-    g_free(entry);
-    g_free(qlist);
+    qemu_free(entry);
+    qemu_free(qlist);
 }
 END_TEST

@@ -65,7 +65,7 @@ START_TEST(qobject_to_qlist_test)
    fail_unless(qobject_to_qlist(QOBJECT(qlist)) == qlist);

    // destroy doesn't exist yet
-    g_free(qlist);
+    qemu_free(qlist);
 }
 END_TEST

--- a/check-qstring.c
+++ b/check-qstring.c
@@ -32,8 +32,8 @@ START_TEST(qstring_from_str_test)
    fail_unless(qobject_type(QOBJECT(qstring)) == QTYPE_QSTRING);

    // destroy doesn't exit yet
-    g_free(qstring->string);
-    g_free(qstring);
+    qemu_free(qstring->string);
+    qemu_free(qstring);
 }
 END_TEST

--- a/cmd.c
+++ b/cmd.c
@@ -45,11 +45,13 @@ compare(const void *a, const void *b)
 		      ((const cmdinfo_t *)b)->name);
 }

-void add_command(const cmdinfo_t *ci)
+void
+add_command(
+	const cmdinfo_t	*ci)
 {
-    cmdtab = g_realloc((void *)cmdtab, ++ncmds * sizeof(*cmdtab));
-    cmdtab[ncmds - 1] = *ci;
-    qsort(cmdtab, ncmds, sizeof(*cmdtab), compare);
+	cmdtab = realloc((void *)cmdtab, ++ncmds * sizeof(*cmdtab));
+	cmdtab[ncmds - 1] = *ci;
+	qsort(cmdtab, ncmds, sizeof(*cmdtab), compare);
 }

 static int
@@ -120,10 +122,16 @@ find_command(
 	return NULL;
 }

-void add_user_command(char *optarg)
+void
+add_user_command(char *optarg)
 {
-    cmdline = g_realloc(cmdline, ++ncmdline * sizeof(char *));
-    cmdline[ncmdline-1] = optarg;
+	ncmdline++;
+	cmdline = realloc(cmdline, sizeof(char*) * (ncmdline));
+	if (!cmdline) {
+		perror("realloc");
+		exit(1);
+	}
+	cmdline[ncmdline-1] = optarg;
 }

 static int
@@ -152,44 +160,45 @@ static void prep_fetchline(void *opaque)

 static char *get_prompt(void);

-void command_loop(void)
+void
+command_loop(void)
 {
-    int c, i, j = 0, done = 0, fetchable = 0, prompted = 0;
-    char *input;
-    char **v;
-    const cmdinfo_t *ct;
+	int		c, i, j = 0, done = 0, fetchable = 0, prompted = 0;
+	char		*input;
+	char		**v;
+	const cmdinfo_t	*ct;

-    for (i = 0; !done && i < ncmdline; i++) {
-        input = strdup(cmdline[i]);
-        if (!input) {
-            fprintf(stderr, _("cannot strdup command '%s': %s\n"),
-                    cmdline[i], strerror(errno));
-            exit(1);
-        }
-        v = breakline(input, &c);
-        if (c) {
-            ct = find_command(v[0]);
-            if (ct) {
-                if (ct->flags & CMD_FLAG_GLOBAL) {
-                    done = command(ct, c, v);
-                } else {
-                    j = 0;
-                    while (!done && (j = args_command(j))) {
-                        done = command(ct, c, v);
-                    }
-                }
-            } else {
-                fprintf(stderr, _("command \"%s\" not found\n"), v[0]);
-            }
+	for (i = 0; !done && i < ncmdline; i++) {
+		input = strdup(cmdline[i]);
+		if (!input) {
+			fprintf(stderr,
+				_("cannot strdup command '%s': %s\n"),
+				cmdline[i], strerror(errno));
+			exit(1);
+		}
+		v = breakline(input, &c);
+		if (c) {
+			ct = find_command(v[0]);
+			if (ct) {
+				if (ct->flags & CMD_FLAG_GLOBAL)
+					done = command(ct, c, v);
+				else {
+					j = 0;
+					while (!done && (j = args_command(j)))
+						done = command(ct, c, v);
+				}
+			} else
+				fprintf(stderr, _("command \"%s\" not found\n"),
+					v[0]);
+		}
+		doneline(input, v);
+	}
+	if (cmdline) {
+		free(cmdline);
+		return;
 	}
-        doneline(input, v);
-    }
-    if (cmdline) {
-        g_free(cmdline);
-        return;
-    }

-    while (!done) {
+	while (!done) {
        if (!prompted) {
            printf("%s", get_prompt());
            fflush(stdout);
@@ -203,24 +212,22 @@ void command_loop(void)
        if (!fetchable) {
            continue;
        }
-        input = fetchline();
-        if (input == NULL) {
-            break;
-        }
-        v = breakline(input, &c);
-        if (c) {
-            ct = find_command(v[0]);
-            if (ct) {
-                done = command(ct, c, v);
-            } else {
-                fprintf(stderr, _("command \"%s\" not found\n"), v[0]);
-            }
-        }
-        doneline(input, v);
+		if ((input = fetchline()) == NULL)
+			break;
+		v = breakline(input, &c);
+		if (c) {
+			ct = find_command(v[0]);
+			if (ct)
+				done = command(ct, c, v);
+			else
+				fprintf(stderr, _("command \"%s\" not found\n"),
+					v[0]);
+		}
+		doneline(input, v);

        prompted = 0;
        fetchable = 0;
-    }
+	}
    qemu_aio_set_fd_handler(STDIN_FILENO, NULL, NULL, NULL, NULL, NULL);
 }

@@ -324,32 +331,29 @@ static char *qemu_strsep(char **input, const char *delim)
    return result;
 }

-char **breakline(char *input, int *count)
+char **
+breakline(
+	char	*input,
+	int	*count)
 {
-    int c = 0;
-    char *p;
-    char **rval = calloc(sizeof(char *), 1);
-    char **tmp;
+	int	c = 0;
+	char	*p;
+	char	**rval = calloc(sizeof(char *), 1);

-    while (rval && (p = qemu_strsep(&input, " ")) != NULL) {
-        if (!*p) {
-            continue;
-        }
-        c++;
-        tmp = realloc(rval, sizeof(*rval) * (c + 1));
-        if (!tmp) {
-            free(rval);
-            rval = NULL;
-            c = 0;
-            break;
-        } else {
-            rval = tmp;
-        }
-        rval[c - 1] = p;
-        rval[c] = NULL;
-    }
-    *count = c;
-    return rval;
+	while (rval && (p = qemu_strsep(&input, " ")) != NULL) {
+		if (!*p)
+			continue;
+		c++;
+		rval = realloc(rval, sizeof(*rval) * (c + 1));
+		if (!rval) {
+			c = 0;
+			break;
+		}
+		rval[c - 1] = p;
+		rval[c] = NULL;
+	}
+	*count = c;
+	return rval;
 }

 void
@@ -385,7 +389,7 @@ cvtnum(
 	if (sp[1] != '\0')
 		return -1LL;

-	c = qemu_tolower(*sp);
+	c = tolower(*sp);
 	switch (c) {
 	default:
 		return i;
--- a/compatfd.c
+++ b/compatfd.c
@@ -119,17 +119,9 @@ int qemu_signalfd(const sigset_t *mask)
 bool qemu_signalfd_available(void)
 {
 #ifdef CONFIG_SIGNALFD
-    sigset_t mask;
-    int fd;
-    bool ok;
-    sigemptyset(&mask);
    errno = 0;
-    fd = syscall(SYS_signalfd, -1, &mask, _NSIG / 8);
-    ok = (errno != ENOSYS);
-    if (fd >= 0) {
-        close(fd);
-    }
-    return ok;
+    syscall(SYS_signalfd, -1, NULL, _NSIG / 8);
+    return errno != ENOSYS;
 #else
    return false;
 #endif
--- a/compiler.h
+++ b/compiler.h
@@ -5,36 +5,19 @@

 #include "config-host.h"

-/*----------------------------------------------------------------------------
-| The macro QEMU_GNUC_PREREQ tests for minimum version of the GNU C compiler.
-| The code is a copy of SOFTFLOAT_GNUC_PREREQ, see softfloat-macros.h.
-*----------------------------------------------------------------------------*/
-#if defined(__GNUC__) && defined(__GNUC_MINOR__)
-# define QEMU_GNUC_PREREQ(maj, min) \
-         ((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-#else
-# define QEMU_GNUC_PREREQ(maj, min) 0
-#endif
-
 #define QEMU_NORETURN __attribute__ ((__noreturn__))
-
-#if QEMU_GNUC_PREREQ(3, 4)
+#ifdef CONFIG_GCC_ATTRIBUTE_WARN_UNUSED_RESULT
 #define QEMU_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
 #else
 #define QEMU_WARN_UNUSED_RESULT
 #endif

-#if defined(_WIN32)
-# define QEMU_PACKED __attribute__((gcc_struct, packed))
-#else
-# define QEMU_PACKED __attribute__((packed))
-#endif
-
 #define QEMU_BUILD_BUG_ON(x) \
    typedef char qemu_build_bug_on__##__LINE__[(x)?-1:1];

 #if defined __GNUC__
-# if !QEMU_GNUC_PREREQ(4, 4)
+# if (__GNUC__ < 4) || \
+     defined(__GNUC_MINOR__) && (__GNUC__ == 4) && (__GNUC_MINOR__ < 4)
   /* gcc versions before 4.4.x don't support gnu_printf, so use printf. */
 #  define GCC_ATTR __attribute__((__unused__, format(printf, 1, 2)))
 #  define GCC_FMT_ATTR(n, m) __attribute__((format(printf, n, m)))
--- a/501
+++ b/501
@@ -92,9 +92,18 @@ libs_tools=""
 audio_pt_int=""
 audio_win_int=""
 cc_i386=i386-pc-linux-gnu-gcc
-libs_qga=""

-target_list=""
+target_list="x86_64-softmmu"
+
+kvm_version() {
+    local fname="$(dirname "$0")/KVM_VERSION"
+
+    if test -f "$fname"; then
+        cat "$fname"
+    else
+        echo "qemu-kvm-devel"
+    fi
+}

 # Default value for a variable defining feature "foo".
 #  * foo="no"  feature will only be used if --enable-foo arg is given
@@ -114,6 +123,7 @@ curl=""
 curses=""
 docs=""
 fdt=""
+kvm=""
 nptl=""
 sdl=""
 vnc="yes"
@@ -129,17 +139,14 @@ xen=""
 xen_ctrl_version=""
 linux_aio=""
 attr=""
-libattr=""
+vhost_net=""
 xfs=""

-vhost_net="no"
-kvm="no"
 gprof="no"
 debug_tcg="no"
 debug_mon="no"
 debug="no"
 strip_opt="yes"
-tcg_interpreter="no"
 bigendian="no"
 mingw32="no"
 EXESUF=""
@@ -149,7 +156,6 @@ datadir="\${prefix}/share/qemu"
 docdir="\${prefix}/share/doc/qemu"
 bindir="\${prefix}/bin"
 libdir="\${prefix}/lib"
-includedir="\${prefix}/include"
 sysconfdir="\${prefix}/etc"
 confsuffix="/qemu"
 slirp="yes"
@@ -167,12 +173,16 @@ darwin_user="no"
 bsd_user="no"
 guest_base=""
 uname_release=""
+io_thread="yes"
 mixemu="no"
+kvm_cap_pit="yes"
+kvm_cap_device_assignment="yes"
 aix="no"
 blobs="yes"
-pkgversion=""
-check_utests=""
-pie=""
+pkgversion=" ($(kvm_version))"
+cpu_emulation="yes"
+check_utests="no"
+user_pie="no"
 zero_malloc=""
 trace_backend="nop"
 trace_file="trace"
@@ -182,9 +192,7 @@ smartcard=""
 smartcard_nss=""
 usb_redir=""
 opengl=""
-zlib="yes"
 guest_agent="yes"
-libiscsi=""

 # parse CC options first
 for opt do
@@ -223,15 +231,14 @@ done
 # Using uname is really, really broken.  Once we have the right set of checks
 # we can eliminate it's usage altogether

-cc="${CC-${cross_prefix}gcc}"
-ar="${AR-${cross_prefix}ar}"
-objcopy="${OBJCOPY-${cross_prefix}objcopy}"
-ld="${LD-${cross_prefix}ld}"
-libtool="${LIBTOOL-${cross_prefix}libtool}"
-strip="${STRIP-${cross_prefix}strip}"
-windres="${WINDRES-${cross_prefix}windres}"
-pkg_config="${PKG_CONFIG-${cross_prefix}pkg-config}"
-sdl_config="${SDL_CONFIG-${cross_prefix}sdl-config}"
+cc="${cross_prefix}${CC-gcc}"
+ar="${cross_prefix}${AR-ar}"
+objcopy="${cross_prefix}${OBJCOPY-objcopy}"
+ld="${cross_prefix}${LD-ld}"
+strip="${cross_prefix}${STRIP-strip}"
+windres="${cross_prefix}${WINDRES-windres}"
+pkg_config="${cross_prefix}${PKG_CONFIG-pkg-config}"
+sdl_config="${cross_prefix}${SDL_CONFIG-sdl-config}"

 # default flags for all hosts
 QEMU_CFLAGS="-fno-strict-aliasing $QEMU_CFLAGS"
@@ -240,7 +247,7 @@ QEMU_CFLAGS="-Wall -Wundef -Wwrite-strings -Wmissing-prototypes $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wstrict-prototypes -Wredundant-decls $QEMU_CFLAGS"
 QEMU_CFLAGS="-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE $QEMU_CFLAGS"
 QEMU_CFLAGS="-D_FORTIFY_SOURCE=2 $QEMU_CFLAGS"
-QEMU_INCLUDES="-I. -I\$(SRC_PATH) -I\$(SRC_PATH)/fpu"
+QEMU_INCLUDES="-I. -I\$(SRC_PATH)"
 LDFLAGS="-g $LDFLAGS"

 # make source path absolute
@@ -287,12 +294,6 @@ elif check_define __s390__ ; then
  else
    cpu="s390"
  fi
-elif check_define __ARMEB__ ; then
-  cpu="armv4b"
-elif check_define __ARMEL__ ; then
-  cpu="armv4l"
-elif check_define __hppa__ ; then
-  cpu="hppa"
 else
  cpu=`uname -m`
 fi
@@ -313,7 +314,7 @@ case "$cpu" in
  armv*l)
    cpu="armv4l"
  ;;
-  hppa|parisc|parisc64)
+  parisc|parisc64)
    cpu="hppa"
  ;;
  mips*)
@@ -477,6 +478,13 @@ Haiku)
  if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
    audio_possible_drivers="$audio_possible_drivers fmod"
  fi
+  if [ "$cpu" = "ia64" ] ; then
+     xen="no"
+     target_list="ia64-softmmu"
+     cpu_emulation="no"
+     gdbstub="no"
+     slirp="no"
+  fi
 ;;
 esac

@@ -505,7 +513,6 @@ if test "$mingw32" = "yes" ; then
  bindir="\${prefix}"
  sysconfdir="\${prefix}"
  confsuffix=""
-  guest_agent="no"
 fi

 werror=""
@@ -561,22 +568,12 @@ for opt do
  ;;
  --libdir=*) libdir="$optarg"
  ;;
-  --includedir=*) includedir="$optarg"
-  ;;
  --datadir=*) datadir="$optarg"
  ;;
  --docdir=*) docdir="$optarg"
  ;;
  --sysconfdir=*) sysconfdir="$optarg"
  ;;
-  --sbindir=*|--libexecdir=*|--sharedstatedir=*|--localstatedir=*|\
-  --oldincludedir=*|--datarootdir=*|--infodir=*|--localedir=*|\
-  --htmldir=*|--dvidir=*|--pdfdir=*|--psdir=*)
-    # These switches are silently ignored, for compatibility with
-    # autoconf-generated configure scripts. This allows QEMU's
-    # configure to be used by RPM and similar macros that set
-    # lots of directory switches by default.
-  ;;
  --disable-sdl) sdl="no"
  ;;
  --enable-sdl) sdl="yes"
@@ -664,18 +661,18 @@ for opt do
  ;;
  --enable-kvm) kvm="yes"
  ;;
-  --disable-tcg-interpreter) tcg_interpreter="no"
+  --disable-kvm-pit) kvm_cap_pit="no"
  ;;
-  --enable-tcg-interpreter) tcg_interpreter="yes"
+  --enable-kvm-pit) kvm_cap_pit="yes"
+  ;;
+  --disable-kvm-device-assignment) kvm_cap_device_assignment="no"
+  ;;
+  --enable-kvm-device-assignment) kvm_cap_device_assignment="yes"
  ;;
  --disable-spice) spice="no"
  ;;
  --enable-spice) spice="yes"
  ;;
-  --disable-libiscsi) libiscsi="no"
-  ;;
-  --enable-libiscsi) libiscsi="yes"
-  ;;
  --enable-profiler) profiler="yes"
  ;;
  --enable-cocoa)
@@ -709,9 +706,9 @@ for opt do
  ;;
  --disable-guest-base) guest_base="no"
  ;;
-  --enable-pie) pie="yes"
+  --enable-user-pie) user_pie="yes"
  ;;
-  --disable-pie) pie="no"
+  --disable-user-pie) user_pie="no"
  ;;
  --enable-uname-release=*) uname_release="$optarg"
  ;;
@@ -751,6 +748,8 @@ for opt do
  ;;
  --enable-attr) attr="yes"
  ;;
+  --enable-io-thread) io_thread="yes"
+  ;;
  --disable-blobs) blobs="no"
  ;;
  --with-pkgversion=*) pkgversion=" ($optarg)"
@@ -759,6 +758,8 @@ for opt do
  ;;
  --enable-docs) docs="yes"
  ;;
+  --disable-cpu-emulation) cpu_emulation="no"
+  ;;
  --disable-vhost-net) vhost_net="no"
  ;;
  --enable-vhost-net) vhost_net="yes"
@@ -767,6 +768,8 @@ for opt do
  ;;
  --enable-opengl) opengl="yes"
  ;;
+  --*dir)
+  ;;
  --disable-rbd) rbd="no"
  ;;
  --enable-rbd) rbd="yes"
@@ -783,8 +786,6 @@ for opt do
  ;;
  --enable-usb-redir) usb_redir="yes"
  ;;
-  --disable-zlib-test) zlib="no"
-  ;;
  --enable-guest-agent) guest_agent="yes"
  ;;
  --disable-guest-agent) guest_agent="no"
@@ -878,7 +879,6 @@ if [ "$softmmu" = "yes" ] ; then
    default_target_list="\
 i386-softmmu \
 x86_64-softmmu \
-alpha-softmmu \
 arm-softmmu \
 cris-softmmu \
 lm32-softmmu \
@@ -897,8 +897,6 @@ sh4eb-softmmu \
 sparc-softmmu \
 sparc64-softmmu \
 s390x-softmmu \
-xtensa-softmmu \
-xtensaeb-softmmu \
 "
 fi
 # the following are Linux specific
@@ -1021,7 +1019,10 @@ echo "  --enable-bluez           enable bluez stack connectivity"
 echo "  --disable-slirp          disable SLIRP userspace network connectivity"
 echo "  --disable-kvm            disable KVM acceleration support"
 echo "  --enable-kvm             enable KVM acceleration support"
-echo "  --enable-tcg-interpreter enable TCG with bytecode interpreter (TCI)"
+echo "  --disable-kvm-pit        disable KVM pit support"
+echo "  --enable-kvm-pit         enable KVM pit support"
+echo "  --disable-kvm-device-assignment  disable KVM device assignment support"
+echo "  --enable-kvm-device-assignment   enable KVM device assignment support"
 echo "  --disable-nptl           disable usermode NPTL support"
 echo "  --enable-nptl            enable usermode NPTL support"
 echo "  --enable-system          enable all system emulation targets"
@@ -1037,13 +1038,12 @@ echo "  --disable-bsd-user       disable all BSD usermode emulation targets"
 echo "  --enable-guest-base      enable GUEST_BASE support for usermode"
 echo "                           emulation targets"
 echo "  --disable-guest-base     disable GUEST_BASE support"
-echo "  --enable-pie             build Position Independent Executables"
-echo "  --disable-pie            do not build Position Independent Executables"
+echo "  --enable-user-pie        build usermode emulation targets as PIE"
+echo "  --disable-user-pie       do not build usermode emulation targets as PIE"
 echo "  --fmod-lib               path to FMOD library"
 echo "  --fmod-inc               path to FMOD includes"
 echo "  --oss-lib                path to OSS library"
 echo "  --enable-uname-release=R Return R for uname -r in usermode emulation"
-echo "  --cpu=CPU                Build for host CPU [$cpu]"
 echo "  --sparc_cpu=V            Build qemu for Sparc architecture v7, v8, v8plus, v8plusa, v9"
 echo "  --disable-uuid           disable uuid support"
 echo "  --enable-uuid            enable uuid support"
@@ -1053,7 +1053,9 @@ echo "  --disable-linux-aio      disable Linux AIO support"
 echo "  --enable-linux-aio       enable Linux AIO support"
 echo "  --disable-attr           disables attr and xattr support"
 echo "  --enable-attr            enable attr and xattr support"
+echo "  --enable-io-thread       enable IO thread"
 echo "  --disable-blobs          disable installing provided firmware blobs"
+echo "  --disable-cpu-emulation  disables use of qemu cpu emulation code"
 echo "  --enable-docs            enable documentation build"
 echo "  --disable-docs           disable documentation build"
 echo "  --disable-vhost-net      disable vhost-net acceleration support"
@@ -1065,8 +1067,6 @@ echo "                           Default:trace-<pid>"
 echo "  --disable-spice          disable spice"
 echo "  --enable-spice           enable spice"
 echo "  --enable-rbd             enable building the rados block device (rbd)"
-echo "  --disable-libiscsi       disable iscsi support"
-echo "  --enable-libiscsi        enable iscsi support"
 echo "  --disable-smartcard      disable smartcard support"
 echo "  --enable-smartcard       enable smartcard support"
 echo "  --disable-smartcard-nss  disable smartcard nss support"
@@ -1100,62 +1100,11 @@ cat > $TMPC << EOF
 int main(void) { return 0; }
 EOF
 for flag in $gcc_flags; do
-    if compile_prog "$flag -Werror" "" ; then
+    if compile_prog "-Werror $QEMU_CFLAGS" "-Werror $flag" ; then
 	QEMU_CFLAGS="$QEMU_CFLAGS $flag"
    fi
 done

-if test "$static" = "yes" ; then
-  if test "$pie" = "yes" ; then
-    echo "static and pie are mutually incompatible"
-    exit 1
-  else
-    pie="no"
-  fi
-fi
-
-if test "$pie" = ""; then
-  case "$cpu-$targetos" in
-    i386-Linux|x86_64-Linux|i386-OpenBSD|x86_64-OpenBSD)
-      ;;
-    *)
-      pie="no"
-      ;;
-  esac
-fi
-
-if test "$pie" != "no" ; then
-  cat > $TMPC << EOF
-
-#ifdef __linux__
-#  define THREAD __thread
-#else
-#  define THREAD
-#endif
-
-static THREAD int tls_var;
-
-int main(void) { return tls_var; }
-
-EOF
-  if compile_prog "-fPIE -DPIE" "-pie"; then
-    QEMU_CFLAGS="-fPIE -DPIE $QEMU_CFLAGS"
-    LDFLAGS="-pie $LDFLAGS"
-    pie="yes"
-    if compile_prog "" "-Wl,-z,relro -Wl,-z,now" ; then
-      LDFLAGS="-Wl,-z,relro -Wl,-z,now $LDFLAGS"
-    fi
-  else
-    if test "$pie" = "yes"; then
-      echo "PIE not available due to missing toolchain support"
-      exit 1
-    else
-      echo "Disabling PIE due to missing toolchain support"
-      pie="no"
-    fi
-  fi
-fi
-
 #
 # Solaris specific configure tool chain decisions
 #
@@ -1289,20 +1238,18 @@ fi
 ##########################################
 # zlib check

-if test "$zlib" != "no" ; then
-    cat > $TMPC << EOF
+cat > $TMPC << EOF
 #include <zlib.h>
 int main(void) { zlibVersion(); return 0; }
 EOF
-    if compile_prog "" "-lz" ; then
-        :
-    else
-        echo
-        echo "Error: zlib check failed"
-        echo "Make sure to have the zlib libs and headers installed."
-        echo
-        exit 1
-    fi
+if compile_prog "" "-lz" ; then
+    :
+else
+    echo
+    echo "Error: zlib check failed"
+    echo "Make sure to have the zlib libs and headers installed."
+    echo
+    exit 1
 fi

 ##########################################
@@ -1418,15 +1365,17 @@ fi
 # pkg-config probe

 if ! has $pkg_config; then
-  echo "Error: pkg-config binary '$pkg_config' not found"
-  exit 1
+  echo warning: proceeding without "$pkg_config" >&2
+  pkg_config=/bin/false
 fi

 ##########################################
 # libtool probe

-if ! has $libtool; then
+if ! has libtool; then
    libtool=
+else
+    libtool=libtool
 fi

 ##########################################
@@ -1893,7 +1842,7 @@ if test "$check_utests" != "no" ; then
 #include <check.h>
 int main(void) { suite_create("qemu test"); return 0; }
 EOF
-  check_libs=`$pkg_config --libs check 2>/dev/null`
+  check_libs=`$pkg_config --libs check`
  if compile_prog "" $check_libs ; then
    check_utests=yes
    libs_tools="$check_libs $libs_tools"
@@ -1927,14 +1876,37 @@ fi

 ##########################################
 # glib support probe
-if $pkg_config --modversion gthread-2.0 > /dev/null 2>&1 ; then
-    glib_cflags=`$pkg_config --cflags gthread-2.0 2>/dev/null`
-    glib_libs=`$pkg_config --libs gthread-2.0 2>/dev/null`
-    LIBS="$glib_libs $LIBS"
-    libs_qga="$glib_libs $libs_qga"
-else
-    echo "glib-2.0 required to compile QEMU"
-    exit 1
+if test "$guest_agent" != "no" ; then
+    if $pkg_config --modversion glib-2.0 > /dev/null 2>&1 ; then
+        glib_cflags=`$pkg_config --cflags glib-2.0 2>/dev/null`
+        glib_libs=`$pkg_config --libs glib-2.0 2>/dev/null`
+        libs_softmmu="$glib_libs $libs_softmmu"
+        libs_tools="$glib_libs $libs_tools"
+    else
+        echo "glib-2.0 required to compile QEMU"
+        exit 1
+    fi
+fi
+
+##########################################
+# libpci header probe for kvm_cap_device_assignment
+if test $kvm_cap_device_assignment = "yes" ; then
+  cat > $TMPC << EOF
+#include <pci/header.h>
+#ifndef PCI_VENDOR_ID
+#error NO LIBPCI HEADER
+#endif
+int main(void) { return 0; }
+EOF
+  if compile_prog "" "" ; then
+    kvm_cap_device_assignment=yes
+  else
+    echo
+    echo "Error: libpci header check failed"
+    echo "Disable KVM Device Assignment capability."
+    echo
+    kvm_cap_device_assignment=no
+  fi
 fi

 ##########################################
@@ -2020,20 +1992,12 @@ if test "$attr" != "no" ; then
  cat > $TMPC <<EOF
 #include <stdio.h>
 #include <sys/types.h>
-#ifdef CONFIG_LIBATTR
 #include <attr/xattr.h>
-#else
-#include <sys/xattr.h>
-#endif
 int main(void) { getxattr(NULL, NULL, NULL, 0); setxattr(NULL, NULL, NULL, 0, 0); return 0; }
 EOF
-  if compile_prog "" "" ; then
-    attr=yes
-  # Older distros have <attr/xattr.h>, and need -lattr:
-  elif compile_prog "-DCONFIG_LIBATTR" "-lattr" ; then
+  if compile_prog "" "-lattr" ; then
    attr=yes
    LIBS="-lattr $LIBS"
-    libattr=yes
  else
    if test "$attr" = "yes" ; then
      feature_not_found "ATTR"
@@ -2248,6 +2212,12 @@ EOF

 if compile_prog "" "" ; then
  signalfd=yes
+elif test "$kvm" = "yes" -a "$io_thread" != "yes"; then
+  echo
+  echo "ERROR: Host kernel lacks signalfd() support,"
+  echo "but KVM depends on it when the IO thread is disabled."
+  echo
+  exit 1
 fi

 # check if eventfd is supported
@@ -2257,7 +2227,7 @@ cat > $TMPC << EOF

 int main(void)
 {
-    int efd = eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC);
+    int efd = eventfd(0, 0);
    return 0;
 }
 EOF
@@ -2414,25 +2384,6 @@ if compile_prog "" "" ; then
  bswap_h=yes
 fi

-##########################################
-# Do we have libiscsi
-if test "$libiscsi" != "no" ; then
-  cat > $TMPC << EOF
-#include <iscsi/iscsi.h>
-int main(void) { iscsi_create_context(""); return 0; }
-EOF
-  if compile_prog "-Werror" "-liscsi" ; then
-    libiscsi="yes"
-    LIBS="$LIBS -liscsi"
-  else
-    if test "$libiscsi" = "yes" ; then
-      feature_not_found "libiscsi"
-    fi
-    libiscsi="no"
-  fi
-fi
-
-
 ##########################################
 # Do we need librt
 cat > $TMPC <<EOF
@@ -2464,6 +2415,23 @@ if compile_prog "" "" ; then
    need_offsetof=no
 fi

+##########################################
+# check if the compiler understands attribute warn_unused_result
+#
+# This could be smarter, but gcc -Werror does not error out even when warning
+# about attribute warn_unused_result
+
+gcc_attribute_warn_unused_result=no
+cat > $TMPC << EOF
+#if defined(__GNUC__) && (__GNUC__ < 4) && defined(__GNUC_MINOR__) && (__GNUC__ < 4)
+#error gcc 3.3 or older
+#endif
+int main(void) { return 0;}
+EOF
+if compile_prog "" ""; then
+    gcc_attribute_warn_unused_result=yes
+fi
+
 # spice probe
 if test "$spice" != "no" ; then
  cat > $TMPC << EOF
@@ -2622,7 +2590,7 @@ fi
 # __sync_fetch_and_and requires at least -march=i486. Many toolchains
 # use i686 as default anyway, but for those that don't, an explicit
 # specification is necessary
-if test "$vhost_net" = "yes" && test "$cpu" = "i386"; then
+if test $vhost_net = "yes" && test $cpu = "i386"; then
  cat > $TMPC << EOF
 int sfaa(unsigned *ptr)
 {
@@ -2641,45 +2609,6 @@ EOF
  fi
 fi

-##########################################
-# check if we have makecontext
-
-ucontext_coroutine=no
-if test "$darwin" != "yes"; then
-  cat > $TMPC << EOF
-#include <ucontext.h>
-int main(void) { makecontext(0, 0, 0); }
-EOF
-  if compile_prog "" "" ; then
-      ucontext_coroutine=yes
-  fi
-fi
-
-##########################################
-# check if we have open_by_handle_at
-
-open_by_hande_at=no
-cat > $TMPC << EOF
-#include <fcntl.h>
-int main(void) { struct file_handle fh; open_by_handle_at(0, &fh, 0); }
-EOF
-if compile_prog "" "" ; then
-    open_by_handle_at=yes
-fi
-
-########################################
-# check if we have linux/magic.h
-
-linux_magic_h=no
-cat > $TMPC << EOF
-#include <linux/magic.h>
-int main(void) {
-}
-EOF
-if compile_prog "" "" ; then
-    linux_magic_h=yes
-fi
-
 ##########################################
 # End of CC checks
 # After here, no more $cc or $ld runs
@@ -2741,8 +2670,8 @@ if test "$softmmu" = yes ; then
      tools="qemu-ga\$(EXESUF) $tools"
    fi
    if [ "$check_utests" = "yes" ]; then
-      checks="check-qint check-qstring check-qdict check-qlist"
-      checks="check-qfloat check-qjson test-coroutine $checks"
+      tools="check-qint check-qstring check-qdict check-qlist $tools"
+      tools="check-qfloat check-qjson $tools"
    fi
  fi
 fi
@@ -2762,7 +2691,6 @@ echo "Install prefix    $prefix"
 echo "BIOS directory    `eval echo $datadir`"
 echo "binary directory  `eval echo $bindir`"
 echo "library directory `eval echo $libdir`"
-echo "include directory `eval echo $includedir`"
 echo "config directory  `eval echo $sysconfdir`"
 if test "$mingw32" = "no" ; then
 echo "Manual directory  `eval echo $mandir`"
@@ -2815,6 +2743,7 @@ if test -n "$sparc_cpu"; then
    echo "Target Sparc Arch $sparc_cpu"
 fi
 echo "xen support       $xen"
+echo "CPU emulation     $cpu_emulation"
 echo "brlapi support    $brlapi"
 echo "bluez  support    $bluez"
 echo "Documentation     $docs"
@@ -2822,13 +2751,15 @@ echo "Documentation     $docs"
 echo "uname -r          $uname_release"
 echo "NPTL support      $nptl"
 echo "GUEST_BASE        $guest_base"
-echo "PIE               $pie"
+echo "PIE user targets  $user_pie"
 echo "vde support       $vde"
+echo "IO thread         $io_thread"
 echo "Linux AIO support $linux_aio"
 echo "ATTR/XATTR support $attr"
 echo "Install blobs     $blobs"
 echo "KVM support       $kvm"
-echo "TCG interpreter   $tcg_interpreter"
+echo "KVM PIT support   $kvm_cap_pit"
+echo "KVM device assig. $kvm_cap_device_assignment"
 echo "fdt support       $fdt"
 echo "preadv support    $preadv"
 echo "fdatasync         $fdatasync"
@@ -2844,10 +2775,9 @@ echo "xfsctl support    $xfs"
 echo "nss used          $smartcard_nss"
 echo "usb net redir     $usb_redir"
 echo "OpenGL support    $opengl"
-echo "libiscsi support  $libiscsi"
 echo "build guest agent $guest_agent"

-if test "$sdl_too_old" = "yes"; then
+if test $sdl_too_old = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
 fi

@@ -2863,7 +2793,6 @@ echo all: >> $config_host_mak
 echo "prefix=$prefix" >> $config_host_mak
 echo "bindir=$bindir" >> $config_host_mak
 echo "libdir=$libdir" >> $config_host_mak
-echo "includedir=$includedir" >> $config_host_mak
 echo "mandir=$mandir" >> $config_host_mak
 echo "datadir=$datadir" >> $config_host_mak
 echo "sysconfdir=$sysconfdir" >> $config_host_mak
@@ -2877,15 +2806,6 @@ case "$cpu" in
  armv4b|armv4l)
    ARCH=arm
  ;;
-  *)
-    if test "$tcg_interpreter" = "yes" ; then
-        echo "Unsupported CPU = $cpu, will use TCG with TCI (experimental)"
-        ARCH=tci
-    else
-        echo "Unsupported CPU = $cpu, try --enable-tcg-interpreter"
-        exit 1
-    fi
-  ;;
 esac
 echo "ARCH=$ARCH" >> $config_host_mak
 if test "$debug_tcg" = "yes" ; then
@@ -2944,7 +2864,7 @@ fi
 if test "$static" = "yes" ; then
  echo "CONFIG_STATIC=y" >> $config_host_mak
 fi
-if test "$profiler" = "yes" ; then
+if test $profiler = "yes" ; then
  echo "CONFIG_PROFILER=y" >> $config_host_mak
 fi
 if test "$slirp" = "yes" ; then
@@ -3093,15 +3013,15 @@ if test "$xen" = "yes" ; then
  echo "CONFIG_XEN_BACKEND=y" >> $config_host_mak
  echo "CONFIG_XEN_CTRL_INTERFACE_VERSION=$xen_ctrl_version" >> $config_host_mak
 fi
+if test "$io_thread" = "yes" ; then
+  echo "CONFIG_IOTHREAD=y" >> $config_host_mak
+fi
 if test "$linux_aio" = "yes" ; then
  echo "CONFIG_LINUX_AIO=y" >> $config_host_mak
 fi
 if test "$attr" = "yes" ; then
  echo "CONFIG_ATTR=y" >> $config_host_mak
 fi
-if test "$libattr" = "yes" ; then
-  echo "CONFIG_LIBATTR=y" >> $config_host_mak
-fi
 if test "$linux" = "yes" ; then
  if test "$attr" = "yes" ; then
    echo "CONFIG_VIRTFS=y" >> $config_host_mak
@@ -3122,15 +3042,20 @@ fi
 if test "$signalfd" = "yes" ; then
  echo "CONFIG_SIGNALFD=y" >> $config_host_mak
 fi
-if test "$tcg_interpreter" = "yes" ; then
-  echo "CONFIG_TCG_INTERPRETER=y" >> $config_host_mak
-fi
 if test "$need_offsetof" = "yes" ; then
  echo "CONFIG_NEED_OFFSETOF=y" >> $config_host_mak
 fi
+if test "$gcc_attribute_warn_unused_result" = "yes" ; then
+  echo "CONFIG_GCC_ATTRIBUTE_WARN_UNUSED_RESULT=y" >> $config_host_mak
+fi
 if test "$fdatasync" = "yes" ; then
  echo "CONFIG_FDATASYNC=y" >> $config_host_mak
 fi
+if test $cpu_emulation = "yes"; then
+  echo "CONFIG_CPU_EMULATION=y" >> $config_host_mak
+else
+  echo "CONFIG_NO_CPU_EMULATION=y" >> $config_host_mak
+fi
 if test "$madvise" = "yes" ; then
  echo "CONFIG_MADVISE=y" >> $config_host_mak
 fi
@@ -3158,10 +3083,6 @@ if test "$opengl" = "yes" ; then
  echo "CONFIG_OPENGL=y" >> $config_host_mak
 fi

-if test "$libiscsi" = "yes" ; then
-  echo "CONFIG_LIBISCSI=y" >> $config_host_mak
-fi
-
 # XXX: suppress that
 if [ "$bsd" = "yes" ] ; then
  echo "CONFIG_BSD=y" >> $config_host_mak
@@ -3176,18 +3097,6 @@ if test "$rbd" = "yes" ; then
  echo "CONFIG_RBD=y" >> $config_host_mak
 fi

-if test "$ucontext_coroutine" = "yes" ; then
-  echo "CONFIG_UCONTEXT_COROUTINE=y" >> $config_host_mak
-fi
-
-if test "$open_by_handle_at" = "yes" ; then
-  echo "CONFIG_OPEN_BY_HANDLE=y" >> $config_host_mak
-fi
-
-if test "$linux_magic_h" = "yes" ; then
-  echo "CONFIG_LINUX_MAGIC_H=y" >> $config_host_mak
-fi
-
 # USB host support
 case "$usb" in
 linux)
@@ -3201,38 +3110,20 @@ bsd)
 ;;
 esac

-# use default implementation for tracing backend-specific routines
-trace_default=yes
 echo "TRACE_BACKEND=$trace_backend" >> $config_host_mak
-if test "$trace_backend" = "nop"; then
-  echo "CONFIG_TRACE_NOP=y" >> $config_host_mak
-fi
 if test "$trace_backend" = "simple"; then
-  echo "CONFIG_TRACE_SIMPLE=y" >> $config_host_mak
-  trace_default=no
-  # Set the appropriate trace file.
+  echo "CONFIG_SIMPLE_TRACE=y" >> $config_host_mak
+fi
+# Set the appropriate trace file.
+if test "$trace_backend" = "simple"; then
  trace_file="\"$trace_file-\" FMT_pid"
 fi
-if test "$trace_backend" = "stderr"; then
-  echo "CONFIG_TRACE_STDERR=y" >> $config_host_mak
-  trace_default=no
-fi
-if test "$trace_backend" = "ust"; then
-  echo "CONFIG_TRACE_UST=y" >> $config_host_mak
-fi
-if test "$trace_backend" = "dtrace"; then
-  echo "CONFIG_TRACE_DTRACE=y" >> $config_host_mak
-  if test "$trace_backend_stap" = "yes" ; then
-    echo "CONFIG_TRACE_SYSTEMTAP=y" >> $config_host_mak
-  fi
+if test "$trace_backend" = "dtrace" -a "$trace_backend_stap" = "yes" ; then
+  echo "CONFIG_SYSTEMTAP_TRACE=y" >> $config_host_mak
 fi
 echo "CONFIG_TRACE_FILE=$trace_file" >> $config_host_mak
-if test "$trace_default" = "yes"; then
-  echo "CONFIG_TRACE_DEFAULT=y" >> $config_host_mak
-fi

 echo "TOOLS=$tools" >> $config_host_mak
-echo "CHECKS=$checks" >> $config_host_mak
 echo "ROMS=$roms" >> $config_host_mak
 echo "MAKE=$make" >> $config_host_mak
 echo "INSTALL=$install" >> $config_host_mak
@@ -3263,7 +3154,6 @@ echo "ARLIBS_END=$arlibs_end" >> $config_host_mak
 echo "LIBS+=$LIBS" >> $config_host_mak
 echo "LIBS_TOOLS+=$libs_tools" >> $config_host_mak
 echo "EXESUF=$EXESUF" >> $config_host_mak
-echo "LIBS_QGA+=$libs_qga" >> $config_host_mak

 # generate list of library paths for linker script

@@ -3282,6 +3172,9 @@ for d in libdis libdis-user; do
    symlink $source_path/Makefile.dis $d/Makefile
    echo > $d/config.mak
 done
+if test "$static" = "no" -a "$user_pie" = "yes" ; then
+  echo "QEMU_CFLAGS+=-fpie" > libdis-user/config.mak
+fi

 for target in $target_list; do
 target_dir="$target"
@@ -3290,7 +3183,7 @@ target_arch2=`echo $target | cut -d '-' -f 1`
 target_bigendian="no"

 case "$target_arch2" in
-  armeb|lm32|m68k|microblaze|mips|mipsn32|mips64|ppc|ppcemb|ppc64|ppc64abi32|s390x|sh4eb|sparc|sparc64|sparc32plus|xtensaeb)
+  armeb|lm32|m68k|microblaze|mips|mipsn32|mips64|ppc|ppcemb|ppc64|ppc64abi32|s390x|sh4eb|sparc|sparc64|sparc32plus)
  target_bigendian=yes
  ;;
 esac
@@ -3370,6 +3263,9 @@ case "$target_arch2" in
    target_phys_bits=64
    target_long_alignment=8
  ;;
+  ia64)
+    target_phys_bits=64
+  ;;
  alpha)
    target_phys_bits=64
    target_long_alignment=8
@@ -3427,7 +3323,7 @@ case "$target_arch2" in
  ;;
  ppc)
    gdb_xml_files="power-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_phys_bits=64
+    target_phys_bits=32
    target_nptl="yes"
    target_libs_softmmu="$fdt_libs"
  ;;
@@ -3485,10 +3381,6 @@ case "$target_arch2" in
  unicore32)
    target_phys_bits=32
  ;;
-  xtensa|xtensaeb)
-    TARGET_ARCH=xtensa
-    target_phys_bits=32
-  ;;
  *)
    echo "Unsupported target CPU"
    exit 1
@@ -3516,12 +3408,10 @@ case "$target_arch2" in
    if test "$xen" = "yes" -a "$target_softmmu" = "yes" ; then
      target_phys_bits=64
      echo "CONFIG_XEN=y" >> $config_target_mak
-    else
-      echo "CONFIG_NO_XEN=y" >> $config_target_mak
+      if test "$cpu" = "i386" -o "$cpu" = "x86_64"; then
+          echo "CONFIG_XEN_MAPCACHE=y" >> $config_target_mak
+      fi
    fi
-    ;;
-  *)
-    echo "CONFIG_NO_XEN=y" >> $config_target_mak
 esac
 case "$target_arch2" in
  i386|x86_64|ppcemb|ppc|ppc64|s390x)
@@ -3535,14 +3425,17 @@ case "$target_arch2" in
      \( "$target_arch2" = "x86_64" -a "$cpu" = "i386"   \) -o \
      \( "$target_arch2" = "i386"   -a "$cpu" = "x86_64" \) \) ; then
      echo "CONFIG_KVM=y" >> $config_target_mak
-      if test "$vhost_net" = "yes" ; then
+      if test $vhost_net = "yes" ; then
        echo "CONFIG_VHOST_NET=y" >> $config_target_mak
      fi
+      if test $kvm_cap_pit = "yes" ; then
+        echo "CONFIG_KVM_PIT=y" >> $config_target_mak
+      fi
+      if test $kvm_cap_device_assignment = "yes" ; then
+        echo "CONFIG_KVM_DEVICE_ASSIGNMENT=y" >> $config_target_mak
+      fi
    fi
 esac
-if test "$target_arch2" = "ppc64" -a "$fdt" = "yes"; then
-  echo "CONFIG_PSERIES=y" >> $config_target_mak
-fi
 if test "$target_bigendian" = "yes" ; then
  echo "TARGET_WORDS_BIGENDIAN=y" >> $config_target_mak
 fi
@@ -3595,9 +3488,7 @@ cflags=""
 includes=""
 ldflags=""

-if test "$tcg_interpreter" = "yes"; then
-  includes="-I\$(SRC_PATH)/tcg/tci $includes"
-elif test "$ARCH" = "sparc64" ; then
+if test "$ARCH" = "sparc64" ; then
  includes="-I\$(SRC_PATH)/tcg/sparc $includes"
 elif test "$ARCH" = "s390x" ; then
  includes="-I\$(SRC_PATH)/tcg/s390 $includes"
@@ -3607,6 +3498,7 @@ else
  includes="-I\$(SRC_PATH)/tcg/\$(ARCH) $includes"
 fi
 includes="-I\$(SRC_PATH)/tcg $includes"
+includes="-I\$(SRC_PATH)/fpu $includes"

 if test "$target_user_only" = "yes" ; then
    libdis_config_mak=libdis-user/config.mak
@@ -3668,16 +3560,8 @@ for i in $ARCH $TARGET_BASE_ARCH ; do
    echo "CONFIG_SPARC_DIS=y"  >> $config_target_mak
    echo "CONFIG_SPARC_DIS=y"  >> $libdis_config_mak
  ;;
-  xtensa*)
-    echo "CONFIG_XTENSA_DIS=y"  >> $config_target_mak
-    echo "CONFIG_XTENSA_DIS=y"  >> $libdis_config_mak
-  ;;
  esac
 done
-if test "$tcg_interpreter" = "yes" ; then
-  echo "CONFIG_TCI_DIS=y"  >> $config_target_mak
-  echo "CONFIG_TCI_DIS=y"  >> $libdis_config_mak
-fi

 case "$ARCH" in
 alpha)
@@ -3700,6 +3584,12 @@ if test "$target_softmmu" = "yes" ; then
  esac
 fi

+if test "$target_user_only" = "yes" -a "$static" = "no" -a \
+	"$user_pie" = "yes" ; then
+  cflags="-fpie $cflags"
+  ldflags="-pie $ldflags"
+fi
+
 if test "$target_softmmu" = "yes" -a \( \
        "$TARGET_ARCH" = "microblaze" -o \
        "$TARGET_ARCH" = "cris" \) ; then
@@ -3718,12 +3608,7 @@ if test "$gprof" = "yes" ; then
  fi
 fi

-if test "$ARCH" = "tci"; then
-  linker_script=""
-else
-  linker_script="-Wl,-T../config-host.ld -Wl,-T,\$(SRC_PATH)/\$(ARCH).ld"
-fi
-
+linker_script="-Wl,-T../config-host.ld -Wl,-T,\$(SRC_PATH)/\$(ARCH).ld"
 if test "$target_linux_user" = "yes" -o "$target_bsd_user" = "yes" ; then
  case "$ARCH" in
  sparc)
@@ -3767,20 +3652,14 @@ DIRS="tests tests/cris slirp audio block net pc-bios/optionrom"
 DIRS="$DIRS pc-bios/spapr-rtas"
 DIRS="$DIRS roms/seabios roms/vgabios"
 DIRS="$DIRS fsdev ui"
-DIRS="$DIRS qapi qapi-generated"
-DIRS="$DIRS qga trace"
+DIRS="$DIRS qapi"
+DIRS="$DIRS qga"
 FILES="Makefile tests/Makefile qdict-test-data.txt"
 FILES="$FILES tests/cris/Makefile tests/cris/.gdbinit"
 FILES="$FILES pc-bios/optionrom/Makefile pc-bios/keymaps"
 FILES="$FILES pc-bios/spapr-rtas/Makefile"
 FILES="$FILES roms/seabios/Makefile roms/vgabios/Makefile"
-for bios_file in \
-    $source_path/pc-bios/*.bin \
-    $source_path/pc-bios/*.rom \
-    $source_path/pc-bios/*.dtb \
-    $source_path/pc-bios/openbios-* \
-    $source_path/pc-bios/palcode-*
-do
+for bios_file in $source_path/pc-bios/*.bin $source_path/pc-bios/*.rom $source_path/pc-bios/*.dtb $source_path/pc-bios/openbios-*; do
    FILES="$FILES pc-bios/`basename $bios_file`"
 done
 mkdir -p $DIRS
@@ -3821,8 +3700,10 @@ fi

 d=libuser
 mkdir -p $d
-mkdir -p $d/trace
 symlink $source_path/Makefile.user $d/Makefile
+if test "$static" = "no" -a "$user_pie" = "yes" ; then
+  echo "QEMU_CFLAGS+=-fpie" > $d/config.mak
+fi

 if test "$docs" = "yes" ; then
  mkdir -p QMP
--- a/console.c
+++ b/console.c
@@ -115,7 +115,6 @@ typedef enum {
 /* ??? This is mis-named.
   It is used for both text and graphical consoles.  */
 struct TextConsole {
-    int index;
    console_type_t console_type;
    DisplayState *ds;
    /* Graphic console state.  */
@@ -178,17 +177,12 @@ void vga_hw_screen_dump(const char *filename)
    TextConsole *previous_active_console;

    previous_active_console = active_console;
-
+    active_console = consoles[0];
    /* There is currently no way of specifying which screen we want to dump,
       so always dump the first one.  */
-    console_select(0);
-    if (consoles[0] && consoles[0]->hw_screen_dump) {
+    if (consoles[0] && consoles[0]->hw_screen_dump)
        consoles[0]->hw_screen_dump(consoles[0]->hw, filename);
-    }
-
-    if (previous_active_console) {
-        console_select(previous_active_console->index);
-    }
+    active_console = previous_active_console;
 }

 void vga_hw_text_update(console_ch_t *chardata)
@@ -349,7 +343,6 @@ static const uint32_t dmask4[4] = {

 static uint32_t color_table[2][8];

-#ifndef CONFIG_CURSES
 enum color_names {
    COLOR_BLACK   = 0,
    COLOR_RED     = 1,
@@ -360,7 +353,6 @@ enum color_names {
    COLOR_CYAN    = 6,
    COLOR_WHITE   = 7
 };
-#endif

 static const uint32_t color_table_rgb[2][8] = {
    {   /* dark */
@@ -469,7 +461,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
            font_data = *font_ptr++;
            if (t_attrib->uline
                && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFF;
+                font_data = 0xFFFF;
            }
            ((uint32_t *)d)[0] = (dmask16[(font_data >> 4)] & xorcol) ^ bgcol;
            ((uint32_t *)d)[1] = (dmask16[(font_data >> 0) & 0xf] & xorcol) ^ bgcol;
@@ -482,7 +474,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
            font_data = *font_ptr++;
            if (t_attrib->uline
                && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFF;
+                font_data = 0xFFFF;
            }
            ((uint32_t *)d)[0] = (dmask4[(font_data >> 6)] & xorcol) ^ bgcol;
            ((uint32_t *)d)[1] = (dmask4[(font_data >> 4) & 3] & xorcol) ^ bgcol;
@@ -495,7 +487,7 @@ static void vga_putcharxy(DisplayState *ds, int x, int y, int ch,
        for(i = 0; i < FONT_HEIGHT; i++) {
            font_data = *font_ptr++;
            if (t_attrib->uline && ((i == FONT_HEIGHT - 2) || (i == FONT_HEIGHT - 3))) {
-                font_data = 0xFF;
+                font_data = 0xFFFF;
            }
            ((uint32_t *)d)[0] = (-((font_data >> 7)) & xorcol) ^ bgcol;
            ((uint32_t *)d)[1] = (-((font_data >> 6) & 1) & xorcol) ^ bgcol;
@@ -524,7 +516,7 @@ static void text_console_resize(TextConsole *s)
    if (s->width < w1)
        w1 = s->width;

-    cells = g_malloc(s->width * s->total_height * sizeof(TextCell));
+    cells = qemu_malloc(s->width * s->total_height * sizeof(TextCell));
    for(y = 0; y < s->total_height; y++) {
        c = &cells[y * s->width];
        if (w1 > 0) {
@@ -539,7 +531,7 @@ static void text_console_resize(TextConsole *s)
            c++;
        }
    }
-    g_free(s->cells);
+    qemu_free(s->cells);
    s->cells = cells;
 }

@@ -1110,20 +1102,35 @@ static int console_puts(CharDriverState *chr, const uint8_t *buf, int len)
    return len;
 }

+static void console_send_event(CharDriverState *chr, int event)
+{
+    TextConsole *s = chr->opaque;
+    int i;
+
+    if (event == CHR_EVENT_FOCUS) {
+        for(i = 0; i < nb_consoles; i++) {
+            if (consoles[i] == s) {
+                console_select(i);
+                break;
+            }
+        }
+    }
+}
+
 static void kbd_send_chars(void *opaque)
 {
    TextConsole *s = opaque;
    int len;
    uint8_t buf[16];

-    len = qemu_chr_be_can_write(s->chr);
+    len = qemu_chr_can_read(s->chr);
    if (len > s->out_fifo.count)
        len = s->out_fifo.count;
    if (len > 0) {
        if (len > sizeof(buf))
            len = sizeof(buf);
        qemu_fifo_read(&s->out_fifo, buf, len);
-        qemu_chr_be_write(s->chr, buf, len);
+        qemu_chr_read(s->chr, buf, len);
    }
    /* characters are pending: we send them a bit later (XXX:
       horrible, should change char device API) */
@@ -1245,7 +1252,7 @@ static TextConsole *new_console(DisplayState *ds, console_type_t console_type)

    if (nb_consoles >= MAX_CONSOLES)
        return NULL;
-    s = g_malloc0(sizeof(TextConsole));
+    s = qemu_mallocz(sizeof(TextConsole));
    if (!active_console || ((active_console->console_type != GRAPHIC_CONSOLE) &&
        (console_type == GRAPHIC_CONSOLE))) {
        active_console = s;
@@ -1253,7 +1260,6 @@ static TextConsole *new_console(DisplayState *ds, console_type_t console_type)
    s->ds = ds;
    s->console_type = console_type;
    if (console_type != GRAPHIC_CONSOLE) {
-        s->index = nb_consoles;
        consoles[nb_consoles++] = s;
    } else {
        /* HACK: Put graphical consoles before text consoles.  */
@@ -1261,9 +1267,7 @@ static TextConsole *new_console(DisplayState *ds, console_type_t console_type)
            if (consoles[i - 1]->console_type == GRAPHIC_CONSOLE)
                break;
            consoles[i] = consoles[i - 1];
-            consoles[i]->index = i;
        }
-        s->index = i;
        consoles[i] = s;
        nb_consoles++;
    }
@@ -1272,7 +1276,7 @@ static TextConsole *new_console(DisplayState *ds, console_type_t console_type)

 static DisplaySurface* defaultallocator_create_displaysurface(int width, int height)
 {
-    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));

    int linesize = width * 4;
    qemu_alloc_display(surface, width, height, linesize,
@@ -1298,10 +1302,10 @@ void qemu_alloc_display(DisplaySurface *surface, int width, int height,
    surface->linesize = linesize;
    surface->pf = pf;
    if (surface->flags & QEMU_ALLOCATED_FLAG) {
-        data = g_realloc(surface->data,
+        data = qemu_realloc(surface->data,
                            surface->linesize * surface->height);
    } else {
-        data = g_malloc(surface->linesize * surface->height);
+        data = qemu_malloc(surface->linesize * surface->height);
    }
    surface->data = (uint8_t *)data;
    surface->flags = newflags | QEMU_ALLOCATED_FLAG;
@@ -1313,7 +1317,7 @@ void qemu_alloc_display(DisplaySurface *surface, int width, int height,
 DisplaySurface* qemu_create_displaysurface_from(int width, int height, int bpp,
                                              int linesize, uint8_t *data)
 {
-    DisplaySurface *surface = (DisplaySurface*) g_malloc0(sizeof(DisplaySurface));
+    DisplaySurface *surface = (DisplaySurface*) qemu_mallocz(sizeof(DisplaySurface));

    surface->width = width;
    surface->height = height;
@@ -1332,8 +1336,8 @@ static void defaultallocator_free_displaysurface(DisplaySurface *surface)
    if (surface == NULL)
        return;
    if (surface->flags & QEMU_ALLOCATED_FLAG)
-        g_free(surface->data);
-    g_free(surface);
+        qemu_free(surface->data);
+    qemu_free(surface);
 }

 static struct DisplayAllocator default_allocator = {
@@ -1344,7 +1348,7 @@ static struct DisplayAllocator default_allocator = {

 static void dumb_display_init(void)
 {
-    DisplayState *ds = g_malloc0(sizeof(DisplayState));
+    DisplayState *ds = qemu_mallocz(sizeof(DisplayState));
    int width = 640;
    int height = 480;

@@ -1399,14 +1403,14 @@ DisplayState *graphic_console_init(vga_hw_update_ptr update,
    TextConsole *s;
    DisplayState *ds;

-    ds = (DisplayState *) g_malloc0(sizeof(DisplayState));
+    ds = (DisplayState *) qemu_mallocz(sizeof(DisplayState));
    ds->allocator = &default_allocator; 
    ds->surface = qemu_create_displaysurface(ds, 640, 480);

    s = new_console(ds, GRAPHIC_CONSOLE);
    if (s == NULL) {
        qemu_free_displaysurface(ds);
-        g_free(ds);
+        qemu_free(ds);
        return NULL;
    }
    s->hw_update = update;
@@ -1458,6 +1462,7 @@ static void text_console_do_init(CharDriverState *chr, DisplayState *ds)
    s = chr->opaque;

    chr->chr_write = console_puts;
+    chr->chr_send_event = console_send_event;

    s->out_fifo.buf = s->out_fifo_buf;
    s->out_fifo.buf_size = sizeof(s->out_fifo_buf);
@@ -1516,7 +1521,7 @@ int text_console_init(QemuOpts *opts, CharDriverState **_chr)
    unsigned width;
    unsigned height;

-    chr = g_malloc0(sizeof(CharDriverState));
+    chr = qemu_mallocz(sizeof(CharDriverState));

    if (n_text_consoles == 128) {
        fprintf(stderr, "Too many text consoles\n");
@@ -1540,7 +1545,7 @@ int text_console_init(QemuOpts *opts, CharDriverState **_chr)
    }

    if (!s) {
-        g_free(chr);
+        free(chr);
        return -EBUSY;
    }

--- a/console.h
+++ b/console.h
@@ -328,12 +328,7 @@ static inline int ds_get_bytes_per_pixel(DisplayState *ds)
    return ds->surface->pf.bytes_per_pixel;
 }

-#ifdef CONFIG_CURSES
-#include <curses.h>
-typedef chtype console_ch_t;
-#else
 typedef unsigned long console_ch_t;
-#endif
 static inline void console_write_ch(console_ch_t *dest, uint32_t ch)
 {
    if (!(ch & 0xff))
@@ -383,6 +378,8 @@ char *vnc_display_local_addr(DisplayState *ds);
 #ifdef CONFIG_VNC
 int vnc_display_password(DisplayState *ds, const char *password);
 int vnc_display_pw_expire(DisplayState *ds, time_t expires);
+void do_info_vnc_print(Monitor *mon, const QObject *data);
+void do_info_vnc(Monitor *mon, QObject **ret_data);
 #else
 static inline int vnc_display_password(DisplayState *ds, const char *password)
 {
@@ -394,6 +391,13 @@ static inline int vnc_display_pw_expire(DisplayState *ds, time_t expires)
    qerror_report(QERR_FEATURE_DISABLED, "vnc");
    return -ENODEV;
 };
+static inline void do_info_vnc(Monitor *mon, QObject **ret_data)
+{
+};
+static inline void do_info_vnc_print(Monitor *mon, const QObject *data)
+{
+    monitor_printf(mon, "VNC support disabled\n");
+};
 #endif

 /* curses.c */
--- a/coroutine-gthread.c
+++ b/coroutine-gthread.c
@@ -1,131 +0,0 @@
-/*
- * GThread coroutine initialization code
- *
- * Copyright (C) 2006  Anthony Liguori <anthony@codemonkey.ws>
- * Copyright (C) 2011  Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.0 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <glib.h>
-#include "qemu-common.h"
-#include "qemu-coroutine-int.h"
-
-typedef struct {
-    Coroutine base;
-    GThread *thread;
-    bool runnable;
-    CoroutineAction action;
-} CoroutineGThread;
-
-static GCond *coroutine_cond;
-static GStaticMutex coroutine_lock = G_STATIC_MUTEX_INIT;
-static GStaticPrivate coroutine_key = G_STATIC_PRIVATE_INIT;
-
-static void __attribute__((constructor)) coroutine_init(void)
-{
-    if (!g_thread_supported()) {
-        g_thread_init(NULL);
-    }
-
-    coroutine_cond = g_cond_new();
-}
-
-static void coroutine_wait_runnable_locked(CoroutineGThread *co)
-{
-    while (!co->runnable) {
-        g_cond_wait(coroutine_cond, g_static_mutex_get_mutex(&coroutine_lock));
-    }
-}
-
-static void coroutine_wait_runnable(CoroutineGThread *co)
-{
-    g_static_mutex_lock(&coroutine_lock);
-    coroutine_wait_runnable_locked(co);
-    g_static_mutex_unlock(&coroutine_lock);
-}
-
-static gpointer coroutine_thread(gpointer opaque)
-{
-    CoroutineGThread *co = opaque;
-
-    g_static_private_set(&coroutine_key, co, NULL);
-    coroutine_wait_runnable(co);
-    co->base.entry(co->base.entry_arg);
-    qemu_coroutine_switch(&co->base, co->base.caller, COROUTINE_TERMINATE);
-    return NULL;
-}
-
-Coroutine *qemu_coroutine_new(void)
-{
-    CoroutineGThread *co;
-
-    co = g_malloc0(sizeof(*co));
-    co->thread = g_thread_create_full(coroutine_thread, co, 0, TRUE, TRUE,
-                                      G_THREAD_PRIORITY_NORMAL, NULL);
-    if (!co->thread) {
-        g_free(co);
-        return NULL;
-    }
-    return &co->base;
-}
-
-void qemu_coroutine_delete(Coroutine *co_)
-{
-    CoroutineGThread *co = DO_UPCAST(CoroutineGThread, base, co_);
-
-    g_thread_join(co->thread);
-    g_free(co);
-}
-
-CoroutineAction qemu_coroutine_switch(Coroutine *from_,
-                                      Coroutine *to_,
-                                      CoroutineAction action)
-{
-    CoroutineGThread *from = DO_UPCAST(CoroutineGThread, base, from_);
-    CoroutineGThread *to = DO_UPCAST(CoroutineGThread, base, to_);
-
-    g_static_mutex_lock(&coroutine_lock);
-    from->runnable = false;
-    from->action = action;
-    to->runnable = true;
-    to->action = action;
-    g_cond_broadcast(coroutine_cond);
-
-    if (action != COROUTINE_TERMINATE) {
-        coroutine_wait_runnable_locked(from);
-    }
-    g_static_mutex_unlock(&coroutine_lock);
-    return from->action;
-}
-
-Coroutine *qemu_coroutine_self(void)
-{
-    CoroutineGThread *co = g_static_private_get(&coroutine_key);
-
-    if (!co) {
-        co = g_malloc0(sizeof(*co));
-        co->runnable = true;
-        g_static_private_set(&coroutine_key, co, (GDestroyNotify)g_free);
-    }
-
-    return &co->base;
-}
-
-bool qemu_in_coroutine(void)
-{
-    CoroutineGThread *co = g_static_private_get(&coroutine_key);
-
-    return co && co->base.caller;
-}
--- a/coroutine-ucontext.c
+++ b/coroutine-ucontext.c
@@ -1,232 +0,0 @@
-/*
- * ucontext coroutine initialization code
- *
- * Copyright (C) 2006  Anthony Liguori <anthony@codemonkey.ws>
- * Copyright (C) 2011  Kevin Wolf <kwolf@redhat.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.0 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-/* XXX Is there a nicer way to disable glibc's stack check for longjmp? */
-#ifdef _FORTIFY_SOURCE
-#undef _FORTIFY_SOURCE
-#endif
-#include <stdlib.h>
-#include <setjmp.h>
-#include <stdint.h>
-#include <pthread.h>
-#include <ucontext.h>
-#include "qemu-common.h"
-#include "qemu-coroutine-int.h"
-
-enum {
-    /* Maximum free pool size prevents holding too many freed coroutines */
-    POOL_MAX_SIZE = 64,
-};
-
-/** Free list to speed up creation */
-static QLIST_HEAD(, Coroutine) pool = QLIST_HEAD_INITIALIZER(pool);
-static unsigned int pool_size;
-
-typedef struct {
-    Coroutine base;
-    void *stack;
-    jmp_buf env;
-} CoroutineUContext;
-
-/**
- * Per-thread coroutine bookkeeping
- */
-typedef struct {
-    /** Currently executing coroutine */
-    Coroutine *current;
-
-    /** The default coroutine */
-    CoroutineUContext leader;
-} CoroutineThreadState;
-
-static pthread_key_t thread_state_key;
-
-/*
- * va_args to makecontext() must be type 'int', so passing
- * the pointer we need may require several int args. This
- * union is a quick hack to let us do that
- */
-union cc_arg {
-    void *p;
-    int i[2];
-};
-
-static CoroutineThreadState *coroutine_get_thread_state(void)
-{
-    CoroutineThreadState *s = pthread_getspecific(thread_state_key);
-
-    if (!s) {
-        s = g_malloc0(sizeof(*s));
-        s->current = &s->leader.base;
-        pthread_setspecific(thread_state_key, s);
-    }
-    return s;
-}
-
-static void qemu_coroutine_thread_cleanup(void *opaque)
-{
-    CoroutineThreadState *s = opaque;
-
-    g_free(s);
-}
-
-static void __attribute__((destructor)) coroutine_cleanup(void)
-{
-    Coroutine *co;
-    Coroutine *tmp;
-
-    QLIST_FOREACH_SAFE(co, &pool, pool_next, tmp) {
-        g_free(DO_UPCAST(CoroutineUContext, base, co)->stack);
-        g_free(co);
-    }
-}
-
-static void __attribute__((constructor)) coroutine_init(void)
-{
-    int ret;
-
-    ret = pthread_key_create(&thread_state_key, qemu_coroutine_thread_cleanup);
-    if (ret != 0) {
-        fprintf(stderr, "unable to create leader key: %s\n", strerror(errno));
-        abort();
-    }
-}
-
-static void coroutine_trampoline(int i0, int i1)
-{
-    union cc_arg arg;
-    CoroutineUContext *self;
-    Coroutine *co;
-
-    arg.i[0] = i0;
-    arg.i[1] = i1;
-    self = arg.p;
-    co = &self->base;
-
-    /* Initialize longjmp environment and switch back the caller */
-    if (!setjmp(self->env)) {
-        longjmp(*(jmp_buf *)co->entry_arg, 1);
-    }
-
-    while (true) {
-        co->entry(co->entry_arg);
-        qemu_coroutine_switch(co, co->caller, COROUTINE_TERMINATE);
-    }
-}
-
-static Coroutine *coroutine_new(void)
-{
-    const size_t stack_size = 1 << 20;
-    CoroutineUContext *co;
-    ucontext_t old_uc, uc;
-    jmp_buf old_env;
-    union cc_arg arg = {0};
-
-    /* The ucontext functions preserve signal masks which incurs a system call
-     * overhead.  setjmp()/longjmp() does not preserve signal masks but only
-     * works on the current stack.  Since we need a way to create and switch to
-     * a new stack, use the ucontext functions for that but setjmp()/longjmp()
-     * for everything else.
-     */
-
-    if (getcontext(&uc) == -1) {
-        abort();
-    }
-
-    co = g_malloc0(sizeof(*co));
-    co->stack = g_malloc(stack_size);
-    co->base.entry_arg = &old_env; /* stash away our jmp_buf */
-
-    uc.uc_link = &old_uc;
-    uc.uc_stack.ss_sp = co->stack;
-    uc.uc_stack.ss_size = stack_size;
-    uc.uc_stack.ss_flags = 0;
-
-    arg.p = co;
-
-    makecontext(&uc, (void (*)(void))coroutine_trampoline,
-                2, arg.i[0], arg.i[1]);
-
-    /* swapcontext() in, longjmp() back out */
-    if (!setjmp(old_env)) {
-        swapcontext(&old_uc, &uc);
-    }
-    return &co->base;
-}
-
-Coroutine *qemu_coroutine_new(void)
-{
-    Coroutine *co;
-
-    co = QLIST_FIRST(&pool);
-    if (co) {
-        QLIST_REMOVE(co, pool_next);
-        pool_size--;
-    } else {
-        co = coroutine_new();
-    }
-    return co;
-}
-
-void qemu_coroutine_delete(Coroutine *co_)
-{
-    CoroutineUContext *co = DO_UPCAST(CoroutineUContext, base, co_);
-
-    if (pool_size < POOL_MAX_SIZE) {
-        QLIST_INSERT_HEAD(&pool, &co->base, pool_next);
-        co->base.caller = NULL;
-        pool_size++;
-        return;
-    }
-
-    g_free(co->stack);
-    g_free(co);
-}
-
-CoroutineAction qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
-                                      CoroutineAction action)
-{
-    CoroutineUContext *from = DO_UPCAST(CoroutineUContext, base, from_);
-    CoroutineUContext *to = DO_UPCAST(CoroutineUContext, base, to_);
-    CoroutineThreadState *s = coroutine_get_thread_state();
-    int ret;
-
-    s->current = to_;
-
-    ret = setjmp(from->env);
-    if (ret == 0) {
-        longjmp(to->env, action);
-    }
-    return ret;
-}
-
-Coroutine *qemu_coroutine_self(void)
-{
-    CoroutineThreadState *s = coroutine_get_thread_state();
-
-    return s->current;
-}
-
-bool qemu_in_coroutine(void)
-{
-    CoroutineThreadState *s = pthread_getspecific(thread_state_key);
-
-    return s && s->current->caller;
-}
--- a/coroutine-win32.c
+++ b/coroutine-win32.c
@@ -1,92 +0,0 @@
-/*
- * Win32 coroutine initialization code
- *
- * Copyright (c) 2011 Kevin Wolf <kwolf@redhat.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu-common.h"
-#include "qemu-coroutine-int.h"
-
-typedef struct
-{
-    Coroutine base;
-
-    LPVOID fiber;
-    CoroutineAction action;
-} CoroutineWin32;
-
-static __thread CoroutineWin32 leader;
-static __thread Coroutine *current;
-
-CoroutineAction qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
-                                      CoroutineAction action)
-{
-    CoroutineWin32 *from = DO_UPCAST(CoroutineWin32, base, from_);
-    CoroutineWin32 *to = DO_UPCAST(CoroutineWin32, base, to_);
-
-    current = to_;
-
-    to->action = action;
-    SwitchToFiber(to->fiber);
-    return from->action;
-}
-
-static void CALLBACK coroutine_trampoline(void *co_)
-{
-    Coroutine *co = co_;
-
-    while (true) {
-        co->entry(co->entry_arg);
-        qemu_coroutine_switch(co, co->caller, COROUTINE_TERMINATE);
-    }
-}
-
-Coroutine *qemu_coroutine_new(void)
-{
-    const size_t stack_size = 1 << 20;
-    CoroutineWin32 *co;
-
-    co = g_malloc0(sizeof(*co));
-    co->fiber = CreateFiber(stack_size, coroutine_trampoline, &co->base);
-    return &co->base;
-}
-
-void qemu_coroutine_delete(Coroutine *co_)
-{
-    CoroutineWin32 *co = DO_UPCAST(CoroutineWin32, base, co_);
-
-    DeleteFiber(co->fiber);
-    g_free(co);
-}
-
-Coroutine *qemu_coroutine_self(void)
-{
-    if (!current) {
-        current = &leader.base;
-        leader.fiber = ConvertThreadToFiber(NULL);
-    }
-    return current;
-}
-
-bool qemu_in_coroutine(void)
-{
-    return current && current->caller;
-}
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -20,7 +20,6 @@
 #define CPU_ALL_H

 #include "qemu-common.h"
-#include "qemu-tls.h"
 #include "cpu-common.h"

 /* some important defines:
@@ -36,6 +35,8 @@
 * TARGET_WORDS_BIGENDIAN : same for target cpu
 */

+#include "softfloat.h"
+
 #if defined(HOST_WORDS_BIGENDIAN) != defined(TARGET_WORDS_BIGENDIAN)
 #define BSWAP_NEEDED
 #endif
@@ -113,6 +114,64 @@ static inline void tswap64s(uint64_t *s)
 #define bswaptls(s) bswap64s(s)
 #endif

+typedef union {
+    float32 f;
+    uint32_t l;
+} CPU_FloatU;
+
+/* NOTE: arm FPA is horrible as double 32 bit words are stored in big
+   endian ! */
+typedef union {
+    float64 d;
+#if defined(HOST_WORDS_BIGENDIAN)
+    struct {
+        uint32_t upper;
+        uint32_t lower;
+    } l;
+#else
+    struct {
+        uint32_t lower;
+        uint32_t upper;
+    } l;
+#endif
+    uint64_t ll;
+} CPU_DoubleU;
+
+typedef union {
+     floatx80 d;
+     struct {
+         uint64_t lower;
+         uint16_t upper;
+     } l;
+} CPU_LDoubleU;
+
+typedef union {
+    float128 q;
+#if defined(HOST_WORDS_BIGENDIAN)
+    struct {
+        uint32_t upmost;
+        uint32_t upper;
+        uint32_t lower;
+        uint32_t lowest;
+    } l;
+    struct {
+        uint64_t upper;
+        uint64_t lower;
+    } ll;
+#else
+    struct {
+        uint32_t lowest;
+        uint32_t lower;
+        uint32_t upper;
+        uint32_t upmost;
+    } l;
+    struct {
+        uint64_t lower;
+        uint64_t upper;
+    } ll;
+#endif
+} CPU_QuadU;
+
 /* CPU memory access without any memory or io remapping */

 /*
@@ -148,8 +207,392 @@ static inline void tswap64s(uint64_t *s)
 *   user   : user mode access using soft MMU
 *   kernel : kernel mode access using soft MMU
 */
+static inline int ldub_p(const void *ptr)
+{
+    return *(uint8_t *)ptr;
+}

-/* target-endianness CPU memory access functions */
+static inline int ldsb_p(const void *ptr)
+{
+    return *(int8_t *)ptr;
+}
+
+static inline void stb_p(void *ptr, int v)
+{
+    *(uint8_t *)ptr = v;
+}
+
+/* NOTE: on arm, putting 2 in /proc/sys/debug/alignment so that the
+   kernel handles unaligned load/stores may give better results, but
+   it is a system wide setting : bad */
+#if defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
+
+/* conservative code for little endian unaligned accesses */
+static inline int lduw_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return val;
+#else
+    const uint8_t *p = ptr;
+    return p[0] | (p[1] << 8);
+#endif
+}
+
+static inline int ldsw_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return (int16_t)val;
+#else
+    const uint8_t *p = ptr;
+    return (int16_t)(p[0] | (p[1] << 8));
+#endif
+}
+
+static inline int ldl_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return val;
+#else
+    const uint8_t *p = ptr;
+    return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
+#endif
+}
+
+static inline uint64_t ldq_le_p(const void *ptr)
+{
+    const uint8_t *p = ptr;
+    uint32_t v1, v2;
+    v1 = ldl_le_p(p);
+    v2 = ldl_le_p(p + 4);
+    return v1 | ((uint64_t)v2 << 32);
+}
+
+static inline void stw_le_p(void *ptr, int v)
+{
+#ifdef _ARCH_PPC
+    __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*(uint16_t *)ptr) : "r" (v), "r" (ptr));
+#else
+    uint8_t *p = ptr;
+    p[0] = v;
+    p[1] = v >> 8;
+#endif
+}
+
+static inline void stl_le_p(void *ptr, int v)
+{
+#ifdef _ARCH_PPC
+    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
+#else
+    uint8_t *p = ptr;
+    p[0] = v;
+    p[1] = v >> 8;
+    p[2] = v >> 16;
+    p[3] = v >> 24;
+#endif
+}
+
+static inline void stq_le_p(void *ptr, uint64_t v)
+{
+    uint8_t *p = ptr;
+    stl_le_p(p, (uint32_t)v);
+    stl_le_p(p + 4, v >> 32);
+}
+
+/* float access */
+
+static inline float32 ldfl_le_p(const void *ptr)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.i = ldl_le_p(ptr);
+    return u.f;
+}
+
+static inline void stfl_le_p(void *ptr, float32 v)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.f = v;
+    stl_le_p(ptr, u.i);
+}
+
+static inline float64 ldfq_le_p(const void *ptr)
+{
+    CPU_DoubleU u;
+    u.l.lower = ldl_le_p(ptr);
+    u.l.upper = ldl_le_p(ptr + 4);
+    return u.d;
+}
+
+static inline void stfq_le_p(void *ptr, float64 v)
+{
+    CPU_DoubleU u;
+    u.d = v;
+    stl_le_p(ptr, u.l.lower);
+    stl_le_p(ptr + 4, u.l.upper);
+}
+
+#else
+
+static inline int lduw_le_p(const void *ptr)
+{
+    return *(uint16_t *)ptr;
+}
+
+static inline int ldsw_le_p(const void *ptr)
+{
+    return *(int16_t *)ptr;
+}
+
+static inline int ldl_le_p(const void *ptr)
+{
+    return *(uint32_t *)ptr;
+}
+
+static inline uint64_t ldq_le_p(const void *ptr)
+{
+    return *(uint64_t *)ptr;
+}
+
+static inline void stw_le_p(void *ptr, int v)
+{
+    *(uint16_t *)ptr = v;
+}
+
+static inline void stl_le_p(void *ptr, int v)
+{
+    *(uint32_t *)ptr = v;
+}
+
+static inline void stq_le_p(void *ptr, uint64_t v)
+{
+    *(uint64_t *)ptr = v;
+}
+
+/* float access */
+
+static inline float32 ldfl_le_p(const void *ptr)
+{
+    return *(float32 *)ptr;
+}
+
+static inline float64 ldfq_le_p(const void *ptr)
+{
+    return *(float64 *)ptr;
+}
+
+static inline void stfl_le_p(void *ptr, float32 v)
+{
+    *(float32 *)ptr = v;
+}
+
+static inline void stfq_le_p(void *ptr, float64 v)
+{
+    *(float64 *)ptr = v;
+}
+#endif
+
+#if !defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
+
+static inline int lduw_be_p(const void *ptr)
+{
+#if defined(__i386__)
+    int val;
+    asm volatile ("movzwl %1, %0\n"
+                  "xchgb %b0, %h0\n"
+                  : "=q" (val)
+                  : "m" (*(uint16_t *)ptr));
+    return val;
+#else
+    const uint8_t *b = ptr;
+    return ((b[0] << 8) | b[1]);
+#endif
+}
+
+static inline int ldsw_be_p(const void *ptr)
+{
+#if defined(__i386__)
+    int val;
+    asm volatile ("movzwl %1, %0\n"
+                  "xchgb %b0, %h0\n"
+                  : "=q" (val)
+                  : "m" (*(uint16_t *)ptr));
+    return (int16_t)val;
+#else
+    const uint8_t *b = ptr;
+    return (int16_t)((b[0] << 8) | b[1]);
+#endif
+}
+
+static inline int ldl_be_p(const void *ptr)
+{
+#if defined(__i386__) || defined(__x86_64__)
+    int val;
+    asm volatile ("movl %1, %0\n"
+                  "bswap %0\n"
+                  : "=r" (val)
+                  : "m" (*(uint32_t *)ptr));
+    return val;
+#else
+    const uint8_t *b = ptr;
+    return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
+#endif
+}
+
+static inline uint64_t ldq_be_p(const void *ptr)
+{
+    uint32_t a,b;
+    a = ldl_be_p(ptr);
+    b = ldl_be_p((uint8_t *)ptr + 4);
+    return (((uint64_t)a<<32)|b);
+}
+
+static inline void stw_be_p(void *ptr, int v)
+{
+#if defined(__i386__)
+    asm volatile ("xchgb %b0, %h0\n"
+                  "movw %w0, %1\n"
+                  : "=q" (v)
+                  : "m" (*(uint16_t *)ptr), "0" (v));
+#else
+    uint8_t *d = (uint8_t *) ptr;
+    d[0] = v >> 8;
+    d[1] = v;
+#endif
+}
+
+static inline void stl_be_p(void *ptr, int v)
+{
+#if defined(__i386__) || defined(__x86_64__)
+    asm volatile ("bswap %0\n"
+                  "movl %0, %1\n"
+                  : "=r" (v)
+                  : "m" (*(uint32_t *)ptr), "0" (v));
+#else
+    uint8_t *d = (uint8_t *) ptr;
+    d[0] = v >> 24;
+    d[1] = v >> 16;
+    d[2] = v >> 8;
+    d[3] = v;
+#endif
+}
+
+static inline void stq_be_p(void *ptr, uint64_t v)
+{
+    stl_be_p(ptr, v >> 32);
+    stl_be_p((uint8_t *)ptr + 4, v);
+}
+
+/* float access */
+
+static inline float32 ldfl_be_p(const void *ptr)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.i = ldl_be_p(ptr);
+    return u.f;
+}
+
+static inline void stfl_be_p(void *ptr, float32 v)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.f = v;
+    stl_be_p(ptr, u.i);
+}
+
+static inline float64 ldfq_be_p(const void *ptr)
+{
+    CPU_DoubleU u;
+    u.l.upper = ldl_be_p(ptr);
+    u.l.lower = ldl_be_p((uint8_t *)ptr + 4);
+    return u.d;
+}
+
+static inline void stfq_be_p(void *ptr, float64 v)
+{
+    CPU_DoubleU u;
+    u.d = v;
+    stl_be_p(ptr, u.l.upper);
+    stl_be_p((uint8_t *)ptr + 4, u.l.lower);
+}
+
+#else
+
+static inline int lduw_be_p(const void *ptr)
+{
+    return *(uint16_t *)ptr;
+}
+
+static inline int ldsw_be_p(const void *ptr)
+{
+    return *(int16_t *)ptr;
+}
+
+static inline int ldl_be_p(const void *ptr)
+{
+    return *(uint32_t *)ptr;
+}
+
+static inline uint64_t ldq_be_p(const void *ptr)
+{
+    return *(uint64_t *)ptr;
+}
+
+static inline void stw_be_p(void *ptr, int v)
+{
+    *(uint16_t *)ptr = v;
+}
+
+static inline void stl_be_p(void *ptr, int v)
+{
+    *(uint32_t *)ptr = v;
+}
+
+static inline void stq_be_p(void *ptr, uint64_t v)
+{
+    *(uint64_t *)ptr = v;
+}
+
+/* float access */
+
+static inline float32 ldfl_be_p(const void *ptr)
+{
+    return *(float32 *)ptr;
+}
+
+static inline float64 ldfq_be_p(const void *ptr)
+{
+    return *(float64 *)ptr;
+}
+
+static inline void stfl_be_p(void *ptr, float32 v)
+{
+    *(float32 *)ptr = v;
+}
+
+static inline void stfq_be_p(void *ptr, float64 v)
+{
+    *(float64 *)ptr = v;
+}
+
+#endif
+
+/* target CPU memory access functions */
 #if defined(TARGET_WORDS_BIGENDIAN)
 #define lduw_p(p) lduw_be_p(p)
 #define ldsw_p(p) ldsw_be_p(p)
@@ -291,6 +734,7 @@ extern unsigned long reserved_va;

 /* ??? These should be the larger of unsigned long and target_ulong.  */
 extern unsigned long qemu_real_host_page_size;
+extern unsigned long qemu_host_page_bits;
 extern unsigned long qemu_host_page_size;
 extern unsigned long qemu_host_page_mask;

@@ -335,8 +779,7 @@ void cpu_dump_statistics(CPUState *env, FILE *f, fprintf_function cpu_fprintf,
 void QEMU_NORETURN cpu_abort(CPUState *env, const char *fmt, ...)
    GCC_FMT_ATTR(2, 3);
 extern CPUState *first_cpu;
-DECLARE_TLS(CPUState *,cpu_single_env);
-#define cpu_single_env get_tls(cpu_single_env)
+extern CPUState *cpu_single_env;

 /* Flags for use in ENV->INTERRUPT_PENDING.

@@ -489,7 +932,7 @@ typedef struct RAMBlock {

 typedef struct RAMList {
    uint8_t *phys_dirty;
-    QLIST_HEAD(, RAMBlock) blocks;
+    QLIST_HEAD(ram, RAMBlock) blocks;
 } RAMList;
 extern RAMList ram_list;

--- a/cpu-common.h
+++ b/cpu-common.h
@@ -3,6 +3,10 @@

 /* CPU interfaces that are target indpendent.  */

+#if defined(__arm__) || defined(__sparc__) || defined(__mips__) || defined(__hppa__) || defined(__ia64__)
+#define WORDS_ALIGNED
+#endif
+
 #ifdef TARGET_PHYS_ADDR_BITS
 #include "targphys.h"
 #endif
@@ -23,15 +27,7 @@ enum device_endian {
 };

 /* address in the RAM (different from a physical address) */
-#if defined(CONFIG_XEN_BACKEND) && TARGET_PHYS_ADDR_BITS == 64
-typedef uint64_t ram_addr_t;
-#  define RAM_ADDR_MAX UINT64_MAX
-#  define RAM_ADDR_FMT "%" PRIx64
-#else
 typedef unsigned long ram_addr_t;
-#  define RAM_ADDR_MAX ULONG_MAX
-#  define RAM_ADDR_FMT "%lx"
-#endif

 /* memory API */

@@ -172,7 +168,6 @@ void cpu_physical_memory_write_rom(target_phys_addr_t addr,
 #define IO_MEM_ROM         (1 << IO_MEM_SHIFT) /* hardcoded offset */
 #define IO_MEM_UNASSIGNED  (2 << IO_MEM_SHIFT)
 #define IO_MEM_NOTDIRTY    (3 << IO_MEM_SHIFT)
-#define IO_MEM_SUBPAGE_RAM (4 << IO_MEM_SHIFT)

 /* Acts like a ROM when read and like a device when written.  */
 #define IO_MEM_ROMD        (1)
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -19,7 +19,9 @@
 #include "config.h"
 #include "cpu.h"
 #include "disas.h"
+#if !defined(TARGET_IA64)
 #include "tcg.h"
+#endif
 #include "qemu-barrier.h"

 int tb_invalidated_flag;
@@ -86,7 +88,7 @@ static TranslationBlock *tb_find_slow(CPUState *env,
 {
    TranslationBlock *tb, **ptb1;
    unsigned int h;
-    tb_page_addr_t phys_pc, phys_page1;
+    tb_page_addr_t phys_pc, phys_page1, phys_page2;
    target_ulong virt_page2;

    tb_invalidated_flag = 0;
@@ -94,6 +96,7 @@ static TranslationBlock *tb_find_slow(CPUState *env,
    /* find translated block using physical mappings */
    phys_pc = get_page_addr_code(env, pc);
    phys_page1 = phys_pc & TARGET_PAGE_MASK;
+    phys_page2 = -1;
    h = tb_phys_hash_func(phys_pc);
    ptb1 = &tb_phys_hash[h];
    for(;;) {
@@ -106,8 +109,6 @@ static TranslationBlock *tb_find_slow(CPUState *env,
            tb->flags == flags) {
            /* check next page if needed */
            if (tb->page_addr[1] != -1) {
-                tb_page_addr_t phys_page2;
-
                virt_page2 = (pc & TARGET_PAGE_MASK) +
                    TARGET_PAGE_SIZE;
                phys_page2 = get_page_addr_code(env, virt_page2);
@@ -217,14 +218,13 @@ int cpu_exec(CPUState *env)
 #elif defined(TARGET_ARM)
 #elif defined(TARGET_UNICORE32)
 #elif defined(TARGET_PPC)
-    env->reserve_addr = -1;
 #elif defined(TARGET_LM32)
 #elif defined(TARGET_MICROBLAZE)
 #elif defined(TARGET_MIPS)
 #elif defined(TARGET_SH4)
 #elif defined(TARGET_CRIS)
 #elif defined(TARGET_S390X)
-#elif defined(TARGET_XTENSA)
+#elif defined(TARGET_IA64)
    /* XXXXX */
 #else
 #error unsupported target CPU
@@ -490,12 +490,6 @@ int cpu_exec(CPUState *env)
                        do_interrupt(env);
                        next_tb = 0;
                    }
-#elif defined(TARGET_XTENSA)
-                    if (interrupt_request & CPU_INTERRUPT_HARD) {
-                        env->exception_index = EXC_IRQ;
-                        do_interrupt(env);
-                        next_tb = 0;
-                    }
 #endif
                   /* Don't use the cached interrupt_request value,
                      do_interrupt may have updated the EXITTB flag. */
@@ -622,10 +616,10 @@ int cpu_exec(CPUState *env)
 #elif defined(TARGET_MICROBLAZE)
 #elif defined(TARGET_MIPS)
 #elif defined(TARGET_SH4)
+#elif defined(TARGET_IA64)
 #elif defined(TARGET_ALPHA)
 #elif defined(TARGET_CRIS)
 #elif defined(TARGET_S390X)
-#elif defined(TARGET_XTENSA)
    /* XXXXX */
 #else
 #error unsupported target CPU
--- a/cpus.c
+++ b/cpus.c
--- a/cpus.h
+++ b/cpus.h
@@ -2,10 +2,12 @@
 #define QEMU_CPUS_H

 /* cpus.c */
-void qemu_init_cpu_loop(void);
+int qemu_init_main_loop(void);
+void qemu_main_loop_start(void);
 void resume_all_vcpus(void);
 void pause_all_vcpus(void);
 void cpu_stop_current(void);
+bool qemu_system_is_ready(void);

 void cpu_synchronize_all_states(void);
 void cpu_synchronize_all_post_reset(void);
@@ -14,6 +16,8 @@ void cpu_synchronize_all_post_init(void);
 /* vl.c */
 extern int smp_cores;
 extern int smp_threads;
+void vm_state_notify(int running, int reason);
+bool cpu_exec_all(void);
 void set_numa_modes(void);
 void set_cpu_log(const char *optarg);
 void set_cpu_log_filename(const char *optarg);
--- a/cris-dis.c
+++ b/cris-dis.c
@@ -1396,32 +1396,32 @@ get_opcode_entry (unsigned int insn,
  /* Allocate and clear the opcode-table.  */
  if (opc_table == NULL)
    {
-      opc_table = g_malloc (65536 * sizeof (opc_table[0]));
+      opc_table = qemu_malloc (65536 * sizeof (opc_table[0]));

      memset (opc_table, 0, 65536 * sizeof (const struct cris_opcode *));

      dip_prefixes
-	= g_malloc (65536 * sizeof (const struct cris_opcode **));
+	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));

      memset (dip_prefixes, 0, 65536 * sizeof (dip_prefixes[0]));

      bdapq_m1_prefixes
-	= g_malloc (65536 * sizeof (const struct cris_opcode **));
+	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));

      memset (bdapq_m1_prefixes, 0, 65536 * sizeof (bdapq_m1_prefixes[0]));

      bdapq_m2_prefixes
-	= g_malloc (65536 * sizeof (const struct cris_opcode **));
+	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));

      memset (bdapq_m2_prefixes, 0, 65536 * sizeof (bdapq_m2_prefixes[0]));

      bdapq_m4_prefixes
-	= g_malloc (65536 * sizeof (const struct cris_opcode **));
+	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));

      memset (bdapq_m4_prefixes, 0, 65536 * sizeof (bdapq_m4_prefixes[0]));

      rest_prefixes
-	= g_malloc (65536 * sizeof (const struct cris_opcode **));
+	= qemu_malloc (65536 * sizeof (const struct cris_opcode **));

      memset (rest_prefixes, 0, 65536 * sizeof (rest_prefixes[0]));
    }
--- a/cursor.c
+++ b/cursor.c
@@ -98,7 +98,7 @@ QEMUCursor *cursor_alloc(int width, int height)
    QEMUCursor *c;
    int datasize = width * height * sizeof(uint32_t);

-    c = g_malloc0(sizeof(QEMUCursor) + datasize);
+    c = qemu_mallocz(sizeof(QEMUCursor) + datasize);
    c->width  = width;
    c->height = height;
    c->refcount = 1;
@@ -117,7 +117,7 @@ void cursor_put(QEMUCursor *c)
    c->refcount--;
    if (c->refcount)
        return;
-    g_free(c);
+    qemu_free(c);
 }

 int cursor_get_mono_bpl(QEMUCursor *c)
--- a/cutils.c
+++ b/cutils.c
@@ -136,7 +136,7 @@ int qemu_fdatasync(int fd)

 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)
 {
-    qiov->iov = g_malloc(alloc_hint * sizeof(struct iovec));
+    qiov->iov = qemu_malloc(alloc_hint * sizeof(struct iovec));
    qiov->niov = 0;
    qiov->nalloc = alloc_hint;
    qiov->size = 0;
@@ -160,7 +160,7 @@ void qemu_iovec_add(QEMUIOVector *qiov, void *base, size_t len)

    if (qiov->niov == qiov->nalloc) {
        qiov->nalloc = 2 * qiov->nalloc + 1;
-        qiov->iov = g_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
+        qiov->iov = qemu_realloc(qiov->iov, qiov->nalloc * sizeof(struct iovec));
    }
    qiov->iov[qiov->niov].iov_base = base;
    qiov->iov[qiov->niov].iov_len = len;
@@ -217,10 +217,7 @@ void qemu_iovec_destroy(QEMUIOVector *qiov)
 {
    assert(qiov->nalloc != -1);

-    qemu_iovec_reset(qiov);
-    g_free(qiov->iov);
-    qiov->nalloc = 0;
-    qiov->iov = NULL;
+    qemu_free(qiov->iov);
 }

 void qemu_iovec_reset(QEMUIOVector *qiov)
@@ -318,34 +315,18 @@ int fcntl_setfl(int fd, int flag)
 }
 #endif

-static int64_t suffix_mul(char suffix, int64_t unit)
-{
-    switch (qemu_toupper(suffix)) {
-    case STRTOSZ_DEFSUFFIX_B:
-        return 1;
-    case STRTOSZ_DEFSUFFIX_KB:
-        return unit;
-    case STRTOSZ_DEFSUFFIX_MB:
-        return unit * unit;
-    case STRTOSZ_DEFSUFFIX_GB:
-        return unit * unit * unit;
-    case STRTOSZ_DEFSUFFIX_TB:
-        return unit * unit * unit * unit;
-    }
-    return -1;
-}
-
 /*
 * Convert string to bytes, allowing either B/b for bytes, K/k for KB,
- * M/m for MB, G/g for GB or T/t for TB. End pointer will be returned
- * in *end, if not NULL. Return -1 on error.
+ * M/m for MB, G/g for GB or T/t for TB. Default without any postfix
+ * is MB. End pointer will be returned in *end, if not NULL. A valid
+ * value must be terminated by whitespace, ',' or '\0'. Return -1 on
+ * error.
 */
-int64_t strtosz_suffix_unit(const char *nptr, char **end,
-                            const char default_suffix, int64_t unit)
+int64_t strtosz_suffix(const char *nptr, char **end, const char default_suffix)
 {
    int64_t retval = -1;
    char *endptr;
-    unsigned char c;
+    unsigned char c, d;
    int mul_required = 0;
    double val, mul, integral, fraction;

@@ -358,17 +339,59 @@ int64_t strtosz_suffix_unit(const char *nptr, char **end,
    if (fraction != 0) {
        mul_required = 1;
    }
+    /*
+     * Any whitespace character is fine for terminating the number,
+     * in addition we accept ',' to handle strings where the size is
+     * part of a multi token argument.
+     */
    c = *endptr;
-    mul = suffix_mul(c, unit);
-    if (mul >= 0) {
-        endptr++;
-    } else {
-        mul = suffix_mul(default_suffix, unit);
-        assert(mul >= 0);
+    d = c;
+    if (qemu_isspace(c) || c == '\0' || c == ',') {
+        c = 0;
+        if (default_suffix) {
+            d = default_suffix;
+        } else {
+            d = c;
+        }
    }
-    if (mul == 1 && mul_required) {
+    switch (qemu_toupper(d)) {
+    case STRTOSZ_DEFSUFFIX_B:
+        mul = 1;
+        if (mul_required) {
+            goto fail;
+        }
+        break;
+    case STRTOSZ_DEFSUFFIX_KB:
+        mul = 1 << 10;
+        break;
+    case 0:
+        if (mul_required) {
+            goto fail;
+        }
+    case STRTOSZ_DEFSUFFIX_MB:
+        mul = 1ULL << 20;
+        break;
+    case STRTOSZ_DEFSUFFIX_GB:
+        mul = 1ULL << 30;
+        break;
+    case STRTOSZ_DEFSUFFIX_TB:
+        mul = 1ULL << 40;
+        break;
+    default:
        goto fail;
    }
+    /*
+     * If not terminated by whitespace, ',', or \0, increment endptr
+     * to point to next character, then check that we are terminated
+     * by an appropriate separating character, ie. whitespace, ',', or
+     * \0. If not, we are seeing trailing garbage, thus fail.
+     */
+    if (c != 0) {
+        endptr++;
+        if (!qemu_isspace(*endptr) && *endptr != ',' && *endptr != 0) {
+            goto fail;
+        }
+    }
    if ((val * mul >= INT64_MAX) || val < 0) {
        goto fail;
    }
@@ -382,24 +405,7 @@ fail:
    return retval;
 }

-int64_t strtosz_suffix(const char *nptr, char **end, const char default_suffix)
-{
-    return strtosz_suffix_unit(nptr, end, default_suffix, 1024);
-}
-
 int64_t strtosz(const char *nptr, char **end)
 {
    return strtosz_suffix(nptr, end, STRTOSZ_DEFSUFFIX_MB);
 }
-
-int qemu_parse_fd(const char *param)
-{
-    int fd;
-    char *endptr = NULL;
-
-    fd = strtol(param, &endptr, 10);
-    if (*endptr || (fd == 0 && param == endptr)) {
-        return -1;
-    }
-    return fd;
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Bruce Rogers	36f5bc4fdb	This is the delta between the qemu and qemu-kvm v0.15.1 versions Signed-off-by: Bruce Rogers <brogers@suse.com>	2018-02-09 11:41:11 -07:00
Justin M. Forbes	82b2b32a32	Version 0.15.1 Signed-off-by: Justin M. Forbes <jforbes@redhat.com>	2011-10-11 09:46:03 -05:00
Stefan Hajnoczi	4a81ab81e4	qed: fix use-after-free during l2 cache commit QED's metadata caching strategy allows two parallel requests to race for metadata lookup. The first one to complete will populate the metadata cache and the second one will drop the data it just read in favor of the cached data. There is a use-after-free in qed_read_l2_table_cb() and qed_commit_l2_update() where l2_table->offset was used after the l2_table may have been freed due to a metadata lookup race. Fix this by keeping the l2_offset in a local variable and not reaching into the possibly freed l2_table. Reported-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-10-05 11:33:31 -05:00
Jan Kiszka	68e3508eaf	sdl: Fix termination in -no-shutdown mode Just like the monitor does, we need to clear no_shutdown before calling qemu_system_shutdown_request on quit requests. Otherwise, QEMU just stops the VM. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-10-03 14:42:24 -05:00
Kevin Wolf	fb524042db	Fix termination by signal with -no-shutdown On signals such as SIGTERM qemu should exit instead of just stopping the VM even with -no-shutdown. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-10-03 14:42:16 -05:00
Brad	336398391a	Add support for finding libpng via pkg-config. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-10-03 14:41:44 -05:00
Brad	672aefeb5e	Check for presence of compiler -pthread flag. OpenBSD / FreeBSD and some other OS's require the use of cc -pthread to link threaded programs so have QEMU's configure script check for the presence of the flag and use it if so. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>	2011-10-03 14:41:23 -05:00
Brad	6a10ccca80	Allow overriding the location of Samba's smbd. Allow overriding the location of Samba's smbd. Pretty much every OS I look at has some means of changing this path (patching) so lets just make it easier for OS developers creating packages and/or end users to override the location. Signed-off-by: Brad Smith <brad@comstyle.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>	2011-10-03 14:40:52 -05:00
Gerd Hoffmann	7095e71576	Fix linker scripts Remove PROVIDE_HIDDEN and ONLY_IF_{RO,RW} from linker scripts to make them work with older binutils versions. Fixes *-bsd-user build on OpenBSD 4.9 which ships binutils 2.15. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>	2011-10-03 14:40:25 -05:00
Brad	91b31d6158	Fix install(1) usage to be compatible with OpenBSD's install(1). Fix install(1) usage to be compatible with OpenBSD's install(1). When creating a directory via the -d flag the -p flag cannot be used at the same time. Also in the context of installing QEMU it doesn't make sense to use the -p flag anyway so use the [default] -c flag instead. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-10-03 14:39:58 -05:00
Jan Kiszka	b89f4a7d2a	Fix qjson test of solidus encoding "\/" is supposed to be decoded as "/", but there is no need to encode "/" via escape. Fix the existing test and add a second one expressing this. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Acked-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>	2011-10-03 14:38:17 -05:00
Luiz Capitulino	fbdd7c8bd5	configure: Copy test data to build directory The QDict unit-tests (check-qdict) will fail when ran on a different build directory. That's, it only works when ran on the source dir. This happens because its data file (qdict-test-data.txt) is not copied to the build dir. Fix it. Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com> Conflicts: configure	2011-10-03 14:37:44 -05:00
Jamie Iles	e19a4e89ae	monitor: fix build breakage for !CONFIG_VNC Commit `c62f6d1` (monitor: fix build breakage with --disable-vnc) conditionalised some VNC setup code but left an unused variable. Move the variable into the conditional code to fix the build breakage. Cc: Luiz Capitulino <lcapitulino@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Jamie Iles <jamie@jamieiles.com> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>	2011-08-31 15:09:31 -05:00
TeLeMan	ff5acedd8f	monitor: fix build breakage with --disable-vnc The breakage was introduced by the commit `1366108981` Signed-off-by: TeLeMan <geleman@gmail.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-08-31 15:09:25 -05:00
Brad	2af86a2ff7	Fix forcing multicast msgs to loopback on OpenBSD. Fix forcing multicast msgs to loopback on OpenBSD. e.g. $ sudo qemu -m 128 -no-fd-bootchk \ -hda virtual.img -boot n -nographic \ -net nic,vlan=0,model=rtl8139,macaddr=52:54:00:12:34:03 \ -net user -tftp /usr/src/sys/arch/i386/compile/TEST -bootp pxeboot \ -net nic,vlan=1,model=rtl8139,macaddr=52:54:00:23:03:01 \ -net tap,vlan=1,script=no \ -net nic,vlan=3,model=rtl8139,macaddr=52:54:00:23:03:03 \ -net socket,vlan=3,mcast=230.0.0.1:10003 setsockopt(SOL_IP, IP_MULTICAST_LOOP): Invalid argument qemu: -net socket,vlan=3,mcast=230.0.0.1:10003: Device 'socket' could not be initialized Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>	2011-08-31 15:08:26 -05:00
Justin M. Forbes	e62ad8314a	Merge branch 'stable-0.15' of git://git.qemu.org/qemu	2011-08-14 10:55:05 -05:00
Anthony Liguori	76e4e1d237	Update version to 0.15.0 Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-08-08 13:27:32 -05:00
Kevin Wolf	4fbe5233fd	qcow2: Fix L1 table size after bdrv_snapshot_goto When loading an internal snapshot whose L1 table is smaller than the current L1 table, the size of the current L1 would be shrunk to the snapshot's L1 size in memory, but not on disk. This lead to incorrect refcount updates and eventuelly to image corruption. Instead of writing the new L1 size to disk, this simply retains the bigger L1 size that is currently in use and makes sure that the unused part is zeroed. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Tested-by: Philipp Hahn <hahn@univention.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `35d7ace74b`)	2011-08-05 07:25:45 -05:00
Justin M. Forbes	4bea41dbaa	Merge branch 'stable-0.15' of git://git.qemu.org/qemu	2011-08-04 16:40:07 -05:00
Anthony Liguori	e2f775205a	Revert "floppy: save and restore DIR register" This reverts commit `7d905f716b`. The use of subsections by this commit are broken because of a fundamental limitations of subsections in the current protocol. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-08-04 16:19:04 -05:00
Richard Henderson	51dd7a94c7	alpha-softmmu: Disable for the 0.15 release branch. The system emulation code was not merged before the branch. Let's leave that work for the next release. Signed-off-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-08-04 16:19:04 -05:00
Wolfgang Mauerer	9096de69ff	vhost build fix for i386 vhost.c uses __sync_fetch_and_and(), which is only available for -march=i486 and above (see https://bugzilla.redhat.com/show_bug.cgi?id=624279). Signed-off-by: Wolfgang Mauerer <wolfgang.mauerer@siemens.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit `023367e6cd`)	2011-08-04 16:19:04 -05:00
Michael Roth	09afeef1ab	guest agent: add --enable-guest-agent config option QAPI will require glib/python, but for now the guest agent is the only user. For now, make these dependencies an explicit guest agent one, and give users the option to disable it if need be. Once QAPI is adopted in core QEMU code, we would basically revert this patch. Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-08-04 16:19:04 -05:00
Peter Maydell	01825a8ddf	user: Restore debug usage message for '-d ?' in user mode emulation The code which prints the debug usage message on '-d ?' for *-user has to come before the check for "not enough arguments", so that "qemu-foo -d ?" prints the list of possible debug log items rather than the generic usage message. (This was inadvertently broken in commit c235d73.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-08-04 16:19:04 -05:00
Michael Walle	ae2dd33693	lm32: softusb: claim to support full speed The QEMU keyboard and mouse reports themselves as full speed devices, though they are actually low speed devices. Until this is fixed, claim that we are supporting full speed devices. Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Walle <michael@walle.cc> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>	2011-08-04 01:25:39 +02:00
Peter Maydell	a80f53aee3	user: Restore debug usage message for '-d ?' in user mode emulation The code which prints the debug usage message on '-d ?' for *-user has to come before the check for "not enough arguments", so that "qemu-foo -d ?" prints the list of possible debug log items rather than the generic usage message. (This was inadvertently broken in commit c235d73.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-08-02 14:38:17 -05:00
Michael Roth	88ca9f047b	Makefile: add missing deps on $(GENERATED_HEADERS) This fixes a build issue with make -j6+ due to qapi-generated files being built before $(GENERATED_HEADERS) have been created. Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>	2011-07-31 15:56:52 -05:00
Anthony Liguori	898517b0bc	Update version to 0.15.0-rc2	2011-07-31 15:38:11 -05:00
Anthony Liguori	9dc9f2b820	Bump version to 0.15.0-rc1 Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-07-29 17:14:11 -05:00
Justin M. Forbes	ef942b795a	Merge branch 'for-upstream-0.15' of git://git.linaro.org/people/pmaydell/qemu-arm	2011-07-29 10:14:01 -05:00
Amit Shah	868aa386b8	virtio-balloon: Unregister savevm section on device unplug Migrating after unplugging a virtio-balloon device resulted in an error message on the destination: Unknown savevm section or instance '0000:00:04.0/virtio-balloon' 0 load of migration failed Fix this by unregistering the section on device unplug. Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>	2011-07-28 15:10:39 +05:30
Amit Shah	7e10be8c74	virtio-balloon: Add exit handler, fix memleaks Add an exit handler that will free up RAM after a virtio-balloon device is unplugged. Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>	2011-07-28 15:10:33 +05:30
Amit Shah	9843621e3b	balloon: Reject negative balloon values Negative balloon values don't make sense, reject them and throw a qerror with QERR_INVALID_PARAMETER_VALUE. Reported-by: Mike Cao <bcao@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>	2011-07-28 15:10:27 +05:30
Amit Shah	ab640dbfc0	virtio-balloon: Check if balloon registration failed Multiple balloon registrations are not allowed; check if the registration with the qemu balloon api succeeded. If not, fail the device init. Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>	2011-07-28 15:10:19 +05:30
Amit Shah	eaa8b2778c	balloon: Don't allow multiple balloon handler registrations Multiple balloon devices don't make sense; disallow more than one registration attempt to register handlers. Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com>	2011-07-28 15:09:49 +05:30
Peter Maydell	7ec7f28019	target-arm: UNDEF on a VCVTT/VCVTB UNPREDICTABLE to avoid TCG assert VCVTT/VCVTB with bit 8 set is UNPREDICTABLE; we choose to UNDEF. This avoids a TCG assert later when the VCVTT/VCVTB code tries to use a source register that wasn't ever set up. We pull the check for the presence of the half-precision extension up in to this common code as well. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-07-27 09:29:22 +00:00
Peter Maydell	31b1308046	target-arm: Handle UNDEF and UNPREDICTABLE cases for VLDM, VSTM Handle the UNDEF and UNPREDICTABLE cases for VLDM and VSTM. In particular, we now generate an undef exception for overlarge imm8 values rather than generating 1000+ TCG ops and hitting an assertion. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-07-27 09:29:22 +00:00
Peter Maydell	4ec648dd6e	target-arm: Support v6 barriers in linux-user mode ARMv6 implemented various operations as special cases of cp15 accesses which are true instructions in v7; this includes barriers (DMB, DSB, ISB). Catch this special case at translate time, so that it works in linux-user mode (which doesn't provide a functional get_cp15 helper) as well as system mode. Includes minor cleanup of the existing cases (single switch statement, and doing the "OK in user mode?" test explicitly rather than hiding it in cp15_user_ok()). Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-07-27 09:29:22 +00:00
Peter Maydell	e961d129e1	target-arm: Mark 1136r1 as a v6K core The 1136r1 is actually a v6K core (unlike the 1136r0); mark it as such, thus enabling the TLS registers, NOP hints, CLREX, half and byte wide exclusive load/stores, etc. The VA-to-PA translation registers are not present on 1136r1, so introduce a new feature flag for them, which is enabled on 11MPCore and all v7 cores. Signed-off-by: Peter Maydell <peter.maydell@linaro.org>	2011-07-26 14:58:43 +00:00
Amit Shah	8959459386	virtio-balloon: Fix header comment; add Copyright Signed-off-by: Amit Shah <amit.shah@redhat.com>	2011-07-26 11:21:15 +05:30
Amit Shah	e2b40e003a	balloon: Fix header comment; add Copyright Signed-off-by: Amit Shah <amit.shah@redhat.com>	2011-07-26 11:21:14 +05:30
Amit Shah	1a39b0fcff	balloon: Separate out stat and balloon handling Passing on '0' as ballooning target to indicate retrieval of stats is bad API. It also makes 'balloon 0' in the monitor cause a segfault. Have two different functions handle the different functionality instead. Detailed explanation from Markus's review: 1. do_info_balloon() is an info_async() method. It receives a callback with argument, to be called exactly once (callback frees the argument). It passes the callback via qemu_balloon_status() and indirectly through qemu_balloon_event to virtio_balloon_to_target(). virtio_balloon_to_target() executes its balloon stats half. It stores the callback in the device state. If it can't send a stats request, it resets stats and calls the callback right away. Else, it sends a stats request. The device model runs the callback when it receives the answer. Works. 2. do_balloon() is a cmd_async() method. It receives a callback with argument, to be called when the command completes. do_balloon() calls it right before it succeeds. Odd, but should work. Nevertheless, it passes the callback on via qemu_ballon() and indirectly through qemu_balloon_event to virtio_balloon_to_target(). a. If the argument is non-zero, virtio_balloon_to_target() executes its balloon half, which doesn't use the callback in any way. Odd, but works. b. If the argument is zero, virtio_balloon_to_target() executes its balloon stats half, just like in 1. It either calls the callback right away, or arranges for it to be called later. Thus, the callback runs twice: use after free and double free. Test case: start with -S -device virtio-balloon, execute "balloon 0" in human monitor. Runs the callback first from virtio_balloon_to_target(), then again from do_balloon(). Reported-by: Mike Cao <bcao@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>	2011-07-26 11:21:14 +05:30
Amit Shah	4a97e18b87	virtio-balloon: Separate status handling into separate function Separate out the code to retrieve balloon info from the code that sets balloon values. This will be used to separate the two callbacks from balloon.c and help cope with 'balloon 0' on the monitor. Currently, 'balloon 0' causes a segfault in monitor_resume(). Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>	2011-07-26 11:21:13 +05:30
Amit Shah	f1ee0a0ebd	balloon: Simplify code flow Replace: if (foo) { ... } else { return 0; } by if (!foo) { return 0; } ... Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>	2011-07-26 11:21:13 +05:30
Amit Shah	3583bc031e	balloon: Add braces around if statements Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>	2011-07-26 11:21:12 +05:30
Amit Shah	2798b5e174	balloon: Make functions, local vars static balloon.h had function declarations for a couple of functions that are local to balloon.c. Make them static. Drop the 'qemu_' prefix for balloon.c-local variables, and make them static. Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com>	2011-07-26 11:21:12 +05:30
@@ -1 +1 @@
 .0,1
 .15.1