Update version for 0.14.0-rc1

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
block: enable in_use flag
2011-02-07 13:36:28 -06:00 · 2011-02-07 12:55:32 +01:00 · 2011-02-07 12:55:29 +01:00 · 2011-02-07 12:55:27 +01:00 · 2011-02-07 12:55:26 +01:00 · 2011-02-07 12:55:25 +01:00
1301 changed files with 57647 additions and 166359 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -15,12 +15,6 @@ libdis*
 libhw32
 libhw64
 libuser
-linux-headers/asm
-qapi-generated
-qapi-types.[ch]
-qapi-visit.[ch]
-qmp-commands.h
-qmp-marshal.c
 qemu-doc.html
 qemu-tech.html
 qemu-doc.info
@@ -38,10 +32,8 @@ qemu-options.texi
 qemu-img-cmds.texi
 qemu-img-cmds.h
 qemu-io
-qemu-ga
 qemu-monitor.texi
 QMP/qmp-commands.txt
-test-coroutine
 .gdbinit
 *.a
 *.aux
@@ -52,9 +44,6 @@ test-coroutine
 *.ky
 *.log
 *.pdf
-*.cps
-*.fns
-*.kys
 *.pg
 *.pyc
 *.toc
@@ -62,8 +51,6 @@ test-coroutine
 *.vr
 *.d
 *.o
-*.swp
-*.orig
 .pc
 patches
 pc-bios/bios-pq/status
@@ -73,6 +60,3 @@ pc-bios/optionrom/multiboot.bin
 pc-bios/optionrom/multiboot.raw
 .stgit-*
 cscope.*
-tags
-TAGS
-*~
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,18 +4,3 @@
 [submodule "roms/seabios"]
 	path = roms/seabios
 	url = git://git.qemu.org/seabios.git/
-[submodule "roms/SLOF"]
-	path = roms/SLOF
-	url = git://git.qemu.org/SLOF.git
-[submodule "roms/ipxe"]
-	path = roms/ipxe
-	url = git://git.qemu.org/ipxe.git
-[submodule "roms/openbios"]
-	path = roms/openbios
-	url = git://git.qemu.org/openbios.git
-[submodule "roms/qemu-palcode"]
-	path = roms/qemu-palcode
-	url = git://repo.or.cz/qemu-palcode.git
-[submodule "roms/sgabios"]
-	path = roms/sgabios
-	url = git://git.qemu.org/sgabios.git
--- a/4
+++ b/4
@@ -68,10 +68,6 @@ keyword.  Example:
        printf("a was something else entirely.\n");
    }

-Note that 'else if' is considered a single statement; otherwise a long if/
-else if/else if/.../else sequence would need an indent for every else
-statement.
-
 An exception is the opening brace for a function; for reasons of tradition
 and clarity it comes on a line by itself:

--- a/8
+++ b/8
@@ -1,9 +1,3 @@
-This file documents changes for QEMU releases 0.12 and earlier.
-For changelog information for later releases, see
-http://wiki.qemu.org/ChangeLog or look at the git history for
-more detailed information.
-
-
 version 0.12.0:

  - Update to SeaBIOS 0.5.0
@@ -531,7 +525,7 @@ version 0.1.5:

 - ppc64 support + personality() patch (Rusty Russell)
 - first Alpha CPU patches (Falk Hueffner)
- - removed bfd.h dependency
+ - removed bfd.h dependancy
 - fixed shrd, shld, idivl and divl on PowerPC.
 - fixed buggy glibc PowerPC rint() function (test-i386 passes now on PowerPC).

--- a/11
+++ b/11
@@ -77,11 +77,11 @@ avoided.

 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
-use the replacement g_malloc/g_malloc0/g_realloc/g_free or
+use the replacement qemu_malloc/qemu_mallocz/qemu_realloc/qemu_free or
 qemu_vmalloc/qemu_memalign/qemu_vfree APIs.

-Please note that NULL check for the g_malloc result is redundant and
-that g_malloc() call with zero size is not allowed.
+Please note that NULL check for the qemu_malloc result is redundant and
+that qemu_malloc() call with zero size is not allowed.

 Memory allocated by qemu_vmalloc or qemu_memalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32 and user
@@ -108,7 +108,7 @@ int qemu_strnlen(const char *s, int max_len)
 There are also replacement character processing macros for isxyz and toxyz,
 so instead of e.g. isalnum you should use qemu_isalnum.

-Because of the memory management rules, you must use g_strdup/g_strndup
+Because of the memory management rules, you must use qemu_strdup/qemu_strndup
 instead of plain strdup/strndup.

 5. Printf-style functions
@@ -120,3 +120,6 @@ gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
+
+Currently many functions in QEMU are not following this rule but
+patches to add the attribute would be very much appreciated.
--- a/93
+++ b/93
@@ -56,13 +56,12 @@ M: Paul Brook <paul@codesourcery.com>
 Guest CPU cores (TCG):
 ----------------------
 Alpha
-M: Richard Henderson <rth@twiddle.net>
-S: Maintained
+M: qemu-devel@nongnu.org
+S: Orphan
 F: target-alpha/

 ARM
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: target-arm/

@@ -71,11 +70,6 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: target-cris/

-LM32
-M: Michael Walle <michael@walle.cc>
-S: Maintained
-F: target-lm32/
-
 M68K
 M: Paul Brook <paul@codesourcery.com>
 S: Maintained
@@ -116,12 +110,6 @@ M: qemu-devel@nongnu.org
 S: Odd Fixes
 F: target-i386/

-Xtensa
-M: Max Filippov <jcmvbkbc@gmail.com>
-W: http://wiki.osll.spb.ru/doku.php?id=etc:users:jcmvbkbc:qemu-target-xtensa
-S: Maintained
-F: target-xtensa/
-
 Guest CPU Cores (KVM):
 ----------------------

@@ -150,16 +138,6 @@ L: kvm@vger.kernel.org
 S: Supported
 F: target-i386/kvm.c

-Guest CPU Cores (Xen):
----------------------
-
-X86
-M: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-L: xen-devel@lists.xensource.com
-S: Supported
-F: xen-*
-F: */xen*
-
 ARM Machines
 ------------
 Gumstix
@@ -169,7 +147,6 @@ F: hw/gumstix.c

 Integrator CP
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/integratorcp.c

@@ -195,7 +172,6 @@ F: hw/palm.c

 Real View
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/realview*

@@ -206,13 +182,11 @@ F: hw/spitz.c

 Stellaris
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/stellaris.c

 Versatile PB
 M: Paul Brook <paul@codesourcery.com>
-M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/versatilepb.c

@@ -228,18 +202,6 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: hw/etraxfs.c

-LM32 Machines
-------------
-EVR32 and uclinux BSP
-M: Michael Walle <michael@walle.cc>
-S: Maintained
-F: hw/lm32_boards.c
-
-milkymist
-M: Michael Walle <michael@walle.cc>
-S: Maintained
-F: hw/milkymist.c
-
 M68K Machines
 -------------
 an5206
@@ -303,9 +265,9 @@ M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: hw/ppc_oldworld.c

-PReP
-M: Andreas Färber <andreas.faerber@web.de>
-S: Odd Fixes
+Prep
+M: qemu-devel@nongnu.org
+S: Orphan
 F: hw/ppc_prep.c

 SH4 Machines
@@ -346,18 +308,6 @@ M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
 F: hw/pc.[ch] hw/pc_piix.c

-Xtensa Machines
---------------
-sim
-M: Max Filippov <jcmvbkbc@gmail.com>
-S: Maintained
-F: hw/xtensa_sim.c
-
-Avnet LX60
-M: Max Filippov <jcmvbkbc@gmail.com>
-S: Maintained
-F: hw/xtensa_lx60.c
-
 Devices
 -------
 IDE
@@ -365,11 +315,6 @@ M: Kevin Wolf <kwolf@redhat.com>
 S: Odd Fixes
 F: hw/ide/

-OMAP
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: hw/omap*
-
 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
@@ -451,11 +396,6 @@ M: Anthony Liguori <aliguori@us.ibm.com>
 S: Maintained
 F: ui/

-Cocoa graphics
-M: Andreas Färber <andreas.faerber@web.de>
-S: Odd Fixes
-F: ui/cocoa.m
-
 Main loop
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
@@ -474,21 +414,9 @@ S: Maintained
 F: net/

 SLIRP
-M: Jan Kiszka <jan.kiszka@siemens.com>
-S: Maintained
+M: qemu-devel@nongnu.org
+S: Orphan
 F: slirp/
-T: git://git.kiszka.org/qemu.git queues/slirp
-
-Tracing
-M: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
-S: Maintained
-F: trace/
-T: git://repo.or.cz/qemu/stefanha.git tracing
-
-Checkpatch
-M: Blue Swirl <blauwirbel@gmail.com>
-S: Odd Fixes
-F: scripts/checkpatch.pl

 Usermode Emulation
 ------------------
@@ -535,7 +463,7 @@ S: Maintained
 F: tcg/ia64/

 MIPS target
-M: Aurelien Jarno <aurelien@aurel32.net>
+M: Aurelien Jarno <aurelien@aurel32.ne>
 S: Maintained
 F: tcg/mips/

@@ -559,8 +487,3 @@ SPARC target
 M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: tcg/sparc/
-
-TCI target
-M: Stefan Weil <sw@weilnetz.de>
-S: Maintained
-F: tcg/tci
--- a/218
+++ b/218
@@ -1,14 +1,9 @@
 # Makefile for QEMU.

-# Always point to the root of the build tree (needs GNU make).
-BUILD_DIR=$(CURDIR)
-
 GENERATED_HEADERS = config-host.h trace.h qemu-options.def
 ifeq ($(TRACE_BACKEND),dtrace)
 GENERATED_HEADERS += trace-dtrace.h
 endif
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c

 ifneq ($(wildcard config-host.mak),)
 # Put the all: rule here so that config-host.mak can contain dependencies.
@@ -42,7 +37,7 @@ else
 DOCS=
 endif

-SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
+SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory)
 SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
 SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %/config-devices.mak.d, $(TARGET_DIRS))

@@ -76,7 +71,7 @@ defconfig:

 -include config-all-devices.mak

-build-all: $(DOCS) $(TOOLS) $(CHECKS) recurse-all
+build-all: $(DOCS) $(TOOLS) recurse-all

 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
@@ -93,8 +88,6 @@ include $(SRC_PATH)/Makefile.objs
 endif

 $(common-obj-y): $(GENERATED_HEADERS)
-subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-timer-common.o
-
 $(filter %-softmmu,$(SUBDIR_RULES)): $(trace-obj-y) $(common-obj-y) subdir-libdis

 $(filter %-user,$(SUBDIR_RULES)): $(GENERATED_HEADERS) $(trace-obj-y) subdir-libdis-user subdir-libuser
@@ -111,8 +104,6 @@ audio/audio.o audio/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)

 QEMU_CFLAGS+=$(CURL_CFLAGS)

-QEMU_CFLAGS+=$(GLIB_CFLAGS)
-
 ui/cocoa.o: ui/cocoa.m

 ui/sdl.o audio/sdlaudio.o ui/sdl_zoom.o baum.o: QEMU_CFLAGS += $(SDL_CFLAGS)
@@ -121,118 +112,79 @@ ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)

 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)

-version.o: $(SRC_PATH)/version.rc config-host.h
+ifeq ($(TRACE_BACKEND),dtrace)
+trace.h: trace.h-timestamp trace-dtrace.h
+else
+trace.h: trace.h-timestamp
+endif
+trace.h-timestamp: $(SRC_PATH)/trace-events config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -h < $< > $@,"  GEN   trace.h")
+	@cmp -s $@ trace.h || cp $@ trace.h
+
+trace.c: trace.c-timestamp
+trace.c-timestamp: $(SRC_PATH)/trace-events config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -c < $< > $@,"  GEN   trace.c")
+	@cmp -s $@ trace.c || cp $@ trace.c
+
+trace.o: trace.c $(GENERATED_HEADERS)
+
+trace-dtrace.h: trace-dtrace.dtrace
+	$(call quiet-command,dtrace -o $@ -h -s $<, "  GEN   trace-dtrace.h")
+
+# Normal practice is to name DTrace probe file with a '.d' extension
+# but that gets picked up by QEMU's Makefile as an external dependancy
+# rule file. So we use '.dtrace' instead
+trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -d < $< > $@,"  GEN   trace-dtrace.dtrace")
+	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
+
+trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
+	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN trace-dtrace.o")
+
+simpletrace.o: simpletrace.c $(GENERATED_HEADERS)
+
+version.o: $(SRC_PATH)/version.rc config-host.mak
 	$(call quiet-command,$(WINDRES) -I. -o $@ $<,"  RC    $(TARGET_DIR)$@")

 version-obj-$(CONFIG_WIN32) += version.o
 ######################################################################
-# Support building shared library libcacard
-
-.PHONY: libcacard.la install-libcacard
-ifeq ($(LIBTOOL),)
-libcacard.la:
-	@echo "libtool is missing, please install and rerun configure"; exit 1
-
-install-libcacard:
-	@echo "libtool is missing, please install and rerun configure"; exit 1
-else
-libcacard.la: $(GENERATED_HEADERS) $(oslib-obj-y) qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
-	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" libcacard.la,)
-
-install-libcacard: libcacard.la
-	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" install-libcacard,)
-endif
-######################################################################

 qemu-img.o: qemu-img-cmds.h
-qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o qemu-ga.o: $(GENERATED_HEADERS)
+qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o: $(GENERATED_HEADERS)

-tools-obj-y = qemu-tool.o $(oslib-obj-y) $(trace-obj-y) \
-	qemu-timer-common.o cutils.o
+qemu-img$(EXESUF): qemu-img.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o

-qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y)
-qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y)
-qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y)
+qemu-nbd$(EXESUF): qemu-nbd.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o
+
+qemu-io$(EXESUF): qemu-io.o cmd.o qemu-tool.o qemu-error.o $(oslib-obj-y) $(trace-obj-y) $(block-obj-y) $(qobject-obj-y) $(version-obj-y) qemu-timer-common.o

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

-check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o check-qjson.o test-coroutine.o: $(GENERATED_HEADERS)
+check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o check-qjson.o: $(GENERATED_HEADERS)

-check-qint: check-qint.o qint.o $(tools-obj-y)
-check-qstring: check-qstring.o qstring.o $(tools-obj-y)
-check-qdict: check-qdict.o qdict.o qfloat.o qint.o qstring.o qbool.o qlist.o $(tools-obj-y)
-check-qlist: check-qlist.o qlist.o qint.o $(tools-obj-y)
-check-qfloat: check-qfloat.o qfloat.o $(tools-obj-y)
-check-qjson: check-qjson.o $(qobject-obj-y) $(tools-obj-y)
-test-coroutine: test-coroutine.o qemu-timer-common.o async.o $(coroutine-obj-y) $(tools-obj-y)
+CHECK_PROG_DEPS = qemu-malloc.o $(oslib-obj-y) $(trace-obj-y)

-$(qapi-obj-y): $(GENERATED_HEADERS)
-qapi-dir := $(BUILD_DIR)/qapi-generated
-test-visitor.o test-qmp-commands.o qemu-ga$(EXESUF): QEMU_CFLAGS += -I $(qapi-dir)
-qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)
-
-$(qapi-dir)/test-qapi-types.c $(qapi-dir)/test-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
-$(qapi-dir)/test-qapi-visit.c $(qapi-dir)/test-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
-$(qapi-dir)/test-qmp-commands.h $(qapi-dir)/test-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
-	    $(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
-
-$(qapi-dir)/qga-qapi-types.c $(qapi-dir)/qga-qapi-types.h :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
-$(qapi-dir)/qga-qapi-visit.c $(qapi-dir)/qga-qapi-visit.h :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
-$(qapi-dir)/qga-qmp-commands.h $(qapi-dir)/qga-qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
-
-qapi-types.c qapi-types.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "." < $<, "  GEN   $@")
-qapi-visit.c qapi-visit.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "."  < $<, "  GEN   $@")
-qmp-commands.h qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -m -o "." < $<, "  GEN   $@")
-
-test-visitor.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h) $(qapi-obj-y)
-test-visitor: test-visitor.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o
-
-test-qmp-commands.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h test-qmp-marshal.c test-qmp-commands.h) $(qapi-obj-y)
-test-qmp-commands: test-qmp-commands.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o $(qapi-dir)/test-qmp-marshal.o module.o
-
-QGALIB_OBJ=$(addprefix $(qapi-dir)/, qga-qapi-types.o qga-qapi-visit.o qga-qmp-marshal.o)
-QGALIB_GEN=$(addprefix $(qapi-dir)/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
-$(QGALIB_OBJ): $(QGALIB_GEN) $(GENERATED_HEADERS)
-$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN) $(GENERATED_HEADERS)
-
-qemu-ga$(EXESUF): qemu-ga.o $(qga-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qobject-obj-y) $(version-obj-y) $(QGALIB_OBJ)
-
-QEMULIBS=libhw32 libhw64 libuser libdis libdis-user
+check-qint: check-qint.o qint.o $(CHECK_PROG_DEPS)
+check-qstring: check-qstring.o qstring.o $(CHECK_PROG_DEPS)
+check-qdict: check-qdict.o qdict.o qfloat.o qint.o qstring.o qbool.o qlist.o $(CHECK_PROG_DEPS)
+check-qlist: check-qlist.o qlist.o qint.o $(CHECK_PROG_DEPS)
+check-qfloat: check-qfloat.o qfloat.o $(CHECK_PROG_DEPS)
+check-qjson: check-qjson.o qfloat.o qint.o qdict.o qstring.o qlist.o qbool.o qjson.o json-streamer.o json-lexer.o json-parser.o $(CHECK_PROG_DEPS)

 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
-	rm -f *.o *.d *.a *.lo $(TOOLS) $(CHECKS) qemu-ga TAGS cscope.* *.pod *~ */*~
-	rm -Rf .libs
-	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d qapi/*.o qapi/*.d qga/*.o qga/*.d
+	rm -f *.o *.d *.a $(TOOLS) TAGS cscope.* *.pod *~ */*~
+	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d
 	rm -f qemu-img-cmds.h
-	rm -f trace/*.o trace/*.d
 	rm -f trace.c trace.h trace.c-timestamp trace.h-timestamp
 	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
 	rm -f trace-dtrace.h trace-dtrace.h-timestamp
-	rm -f $(GENERATED_SOURCES)
-	rm -rf $(qapi-dir)
 	$(MAKE) -C tests clean
-	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
+	for d in $(ALL_SUBDIRS) libhw32 libhw64 libuser libdis libdis-user; do \
 	if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
 	rm -f $$d/qemu-options.def; \
        done
@@ -241,13 +193,9 @@ distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi
 	rm -f config-all-devices.mak
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
-	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps qemu-doc.dvi
-	rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys
-	rm -f qemu-doc.log qemu-doc.pdf qemu-doc.pg qemu-doc.toc qemu-doc.tp
-	rm -f qemu-doc.vr
-	rm -f config.log
+	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.dvi qemu-doc.fn qemu-doc.info qemu-doc.ky qemu-doc.log qemu-doc.pdf qemu-doc.pg qemu-doc.toc qemu-doc.tp qemu-doc.vr
 	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
-	for d in $(TARGET_DIRS) $(QEMULIBS); do \
+	for d in $(TARGET_DIRS) libhw32 libhw64 libuser libdis libdis-user; do \
 	rm -rf $$d || exit 1 ; \
        done

@@ -256,17 +204,16 @@ ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
 common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr

 ifdef INSTALL_BLOBS
-BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
+BLOBS=bios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
-pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
-pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
-bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
-mpc8544ds.dtb \
+gpxe-eepro100-80861209.rom \
+pxe-e1000.bin \
+pxe-ne2k_pci.bin pxe-pcnet.bin \
+pxe-rtl8139.bin pxe-virtio.bin \
+bamboo.dtb petalogix-s3adsp1800.dtb \
 multiboot.bin linuxboot.bin \
-s390-zipl.rom \
-spapr-rtas.bin slof.bin \
-palcode-clipper
+s390-zipl.rom
 else
 BLOBS=
 endif
@@ -308,19 +255,13 @@ endif
 test speed: all
 	$(MAKE) -C tests $@

-.PHONY: check
-check: $(patsubst %,run-check-%,$(CHECKS))
-
-run-check-%: %
-	./$<
-
 .PHONY: TAGS
 TAGS:
 	find "$(SRC_PATH)" -name '*.[hc]' -print0 | xargs -0 etags

 cscope:
 	rm -f ./cscope.*
-	find "$(SRC_PATH)" -name "*.[chsS]" -print | sed 's,^\./,,' > ./cscope.files
+	find . -name "*.[ch]" -print | sed 's,^\./,,' > ./cscope.files
 	cscope -b

 # documentation
@@ -389,5 +330,40 @@ tar:
 	cd /tmp && tar zcvf ~/$(FILE).tar.gz $(FILE) --exclude CVS --exclude .git --exclude .svn
 	rm -rf /tmp/$(FILE)

+SYSTEM_TARGETS=$(filter %-softmmu,$(TARGET_DIRS))
+SYSTEM_PROGS=$(patsubst qemu-system-i386,qemu, \
+             $(patsubst %-softmmu,qemu-system-%, \
+             $(SYSTEM_TARGETS)))
+
+USER_TARGETS=$(filter %-user,$(TARGET_DIRS))
+USER_PROGS=$(patsubst %-bsd-user,qemu-%, \
+           $(patsubst %-darwin-user,qemu-%, \
+           $(patsubst %-linux-user,qemu-%, \
+           $(USER_TARGETS))))
+
+# generate a binary distribution
+tarbin:
+	cd / && tar zcvf ~/qemu-$(VERSION)-$(ARCH).tar.gz \
+	$(patsubst %,$(bindir)/%, $(SYSTEM_PROGS)) \
+	$(patsubst %,$(bindir)/%, $(USER_PROGS)) \
+	$(bindir)/qemu-img \
+	$(bindir)/qemu-nbd \
+	$(datadir)/bios.bin \
+	$(datadir)/vgabios.bin \
+	$(datadir)/vgabios-cirrus.bin \
+	$(datadir)/ppc_rom.bin \
+	$(datadir)/openbios-sparc32 \
+	$(datadir)/openbios-sparc64 \
+	$(datadir)/openbios-ppc \
+	$(datadir)/pxe-ne2k_pci.bin \
+	$(datadir)/pxe-rtl8139.bin \
+	$(datadir)/pxe-pcnet.bin \
+	$(datadir)/pxe-e1000.bin \
+	$(docdir)/qemu-doc.html \
+	$(docdir)/qemu-tech.html \
+	$(mandir)/man1/qemu.1 \
+	$(mandir)/man1/qemu-img.1 \
+	$(mandir)/man8/qemu-nbd.8
+
 # Include automatically generated dependency files
-include $(wildcard *.d audio/*.d slirp/*.d block/*.d net/*.d ui/*.d qapi/*.d qga/*.d)
+-include $(wildcard *.d audio/*.d slirp/*.d block/*.d net/*.d ui/*.d)
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -9,8 +9,7 @@ include $(SRC_PATH)/rules.mak

 $(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)

-QEMU_CFLAGS+=-I..
-QEMU_CFLAGS += $(GLIB_CFLAGS)
+QEMU_CFLAGS+=-I.. -I$(SRC_PATH)/fpu

 include $(SRC_PATH)/Makefile.objs

--- a/Makefile.objs
+++ b/Makefile.objs
@@ -2,30 +2,19 @@
 # QObject
 qobject-obj-y = qint.o qstring.o qdict.o qlist.o qfloat.o qbool.o
 qobject-obj-y += qjson.o json-lexer.o json-streamer.o json-parser.o
-qobject-obj-y += qerror.o error.o qemu-error.o
+qobject-obj-y += qerror.o

 #######################################################################
 # oslib-obj-y is code depending on the OS (win32 vs posix)
 oslib-obj-y = osdep.o
-oslib-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o
-oslib-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o
-
-#######################################################################
-# coroutines
-coroutine-obj-y = qemu-coroutine.o qemu-coroutine-lock.o
-ifeq ($(CONFIG_UCONTEXT_COROUTINE),y)
-coroutine-obj-$(CONFIG_POSIX) += coroutine-ucontext.o
-else
-coroutine-obj-$(CONFIG_POSIX) += coroutine-gthread.o
-endif
-coroutine-obj-$(CONFIG_WIN32) += coroutine-win32.o
+oslib-obj-$(CONFIG_WIN32) += oslib-win32.o
+oslib-obj-$(CONFIG_POSIX) += oslib-posix.o

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = cutils.o cache-utils.o qemu-option.o module.o async.o
-block-obj-y += nbd.o block.o aio.o aes.o qemu-config.o qemu-progress.o qemu-sockets.o
-block-obj-y += $(coroutine-obj-y) $(qobject-obj-y) $(version-obj-y)
+block-obj-y = cutils.o cache-utils.o qemu-malloc.o qemu-option.o module.o
+block-obj-y += nbd.o block.o aio.o aes.o qemu-config.o
 block-obj-$(CONFIG_POSIX) += posix-aio-compat.o
 block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o

@@ -36,7 +25,6 @@ block-nested-y += qed-check.o
 block-nested-y += parallels.o nbd.o blkdebug.o sheepdog.o blkverify.o
 block-nested-$(CONFIG_WIN32) += raw-win32.o
 block-nested-$(CONFIG_POSIX) += raw-posix.o
-block-nested-$(CONFIG_LIBISCSI) += iscsi.o
 block-nested-$(CONFIG_CURL) += curl.o
 block-nested-$(CONFIG_RBD) += rbd.o

@@ -57,14 +45,12 @@ net-nested-$(CONFIG_SLIRP) += slirp.o
 net-nested-$(CONFIG_VDE) += vde.o
 net-obj-y += $(addprefix net/, $(net-nested-y))

-ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS)$(CONFIG_PCI),yyy)
+ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS),yy)
 # Lots of the fsdev/9pcode is pulled in by vl.c via qemu_fsdev_add.
 # only pull in the actual virtio-9p device if we also enabled virtio.
 CONFIG_REALLY_VIRTFS=y
-fsdev-nested-y = qemu-fsdev.o
-else
-fsdev-nested-y = qemu-fsdev-dummy.o
 endif
+fsdev-nested-$(CONFIG_VIRTFS) = qemu-fsdev.o
 fsdev-obj-$(CONFIG_VIRTFS) += $(addprefix fsdev/, $(fsdev-nested-y))

 ######################################################################
@@ -77,13 +63,13 @@ common-obj-y = $(block-obj-y) blockdev.o
 common-obj-y += $(net-obj-y)
 common-obj-y += $(qobject-obj-y)
 common-obj-$(CONFIG_LINUX) += $(fsdev-obj-$(CONFIG_LINUX))
-common-obj-y += readline.o console.o cursor.o
+common-obj-y += readline.o console.o cursor.o async.o qemu-error.o
 common-obj-y += $(oslib-obj-y)
 common-obj-$(CONFIG_WIN32) += os-win32.o
 common-obj-$(CONFIG_POSIX) += os-posix.o

-common-obj-y += tcg-runtime.o host-utils.o main-loop.o
-common-obj-y += irq.o input.o
+common-obj-y += tcg-runtime.o host-utils.o
+common-obj-y += irq.o ioport.o input.o
 common-obj-$(CONFIG_PTIMER) += ptimer.o
 common-obj-$(CONFIG_MAX7310) += max7310.o
 common-obj-$(CONFIG_WM8750) += wm8750.o
@@ -101,7 +87,6 @@ common-obj-y += i2c.o smbus.o smbus_eeprom.o
 common-obj-y += eeprom93xx.o
 common-obj-y += scsi-disk.o cdrom.o
 common-obj-y += scsi-generic.o scsi-bus.o
-common-obj-y += hid.o
 common-obj-y += usb.o usb-hub.o usb-$(HOST_USB).o usb-hid.o usb-msd.o usb-wacom.o
 common-obj-y += usb-serial.o usb-net.o usb-bus.o usb-desc.o
 common-obj-$(CONFIG_SSI) += ssi.o
@@ -109,13 +94,12 @@ common-obj-$(CONFIG_SSI_SD) += ssi-sd.o
 common-obj-$(CONFIG_SD) += sd.o
 common-obj-y += bt.o bt-host.o bt-vhci.o bt-l2cap.o bt-sdp.o bt-hci.o bt-hid.o usb-bt.o
 common-obj-y += bt-hci-csr.o
-common-obj-y += buffered_file.o migration.o migration-tcp.o
+common-obj-y += buffered_file.o migration.o migration-tcp.o qemu-sockets.o
 common-obj-y += qemu-char.o savevm.o #aio.o
 common-obj-y += msmouse.o ps2.o
 common-obj-y += qdev.o qdev-properties.o
-common-obj-y += block-migration.o iohandler.o
+common-obj-y += block-migration.o
 common-obj-y += pflib.o
-common-obj-y += bitmap.o bitops.o

 common-obj-$(CONFIG_BRLAPI) += baum.o
 common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
@@ -141,35 +125,34 @@ common-obj-y += $(addprefix audio/, $(audio-obj-y))

 ui-obj-y += keymaps.o
 ui-obj-$(CONFIG_SDL) += sdl.o sdl_zoom.o x_keymap.o
-ui-obj-$(CONFIG_COCOA) += cocoa.o
 ui-obj-$(CONFIG_CURSES) += curses.o
-vnc-obj-y += vnc.o d3des.o
-vnc-obj-y += vnc-enc-zlib.o vnc-enc-hextile.o
-vnc-obj-y += vnc-enc-tight.o vnc-palette.o
-vnc-obj-y += vnc-enc-zrle.o
-vnc-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
-vnc-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
+ui-obj-y += vnc.o d3des.o
+ui-obj-y += vnc-enc-zlib.o vnc-enc-hextile.o
+ui-obj-y += vnc-enc-tight.o vnc-palette.o
+ui-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
+ui-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
+ui-obj-$(CONFIG_COCOA) += cocoa.o
 ifdef CONFIG_VNC_THREAD
-vnc-obj-y += vnc-jobs-async.o
+ui-obj-y += vnc-jobs-async.o
 else
-vnc-obj-y += vnc-jobs-sync.o
+ui-obj-y += vnc-jobs-sync.o
 endif
 common-obj-y += $(addprefix ui/, $(ui-obj-y))
-common-obj-$(CONFIG_VNC) += $(addprefix ui/, $(vnc-obj-y))

 common-obj-y += iov.o acl.o
-common-obj-$(CONFIG_POSIX) += compatfd.o
+common-obj-$(CONFIG_THREAD) += qemu-thread.o
+common-obj-$(CONFIG_IOTHREAD) += compatfd.o
 common-obj-y += notify.o event_notifier.o
 common-obj-y += qemu-timer.o qemu-timer-common.o

 slirp-obj-y = cksum.o if.o ip_icmp.o ip_input.o ip_output.o
 slirp-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
-slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o arp_table.o
+slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o
 common-obj-$(CONFIG_SLIRP) += $(addprefix slirp/, $(slirp-obj-y))

 # xen backend driver support
-common-obj-$(CONFIG_XEN_BACKEND) += xen_backend.o xen_devconfig.o
-common-obj-$(CONFIG_XEN_BACKEND) += xen_console.o xenfb.o xen_disk.o xen_nic.o
+common-obj-$(CONFIG_XEN) += xen_backend.o xen_devconfig.o
+common-obj-$(CONFIG_XEN) += xen_console.o xenfb.o xen_disk.o xen_nic.o

 ######################################################################
 # libuser
@@ -178,16 +161,13 @@ user-obj-y =
 user-obj-y += envlist.o path.o
 user-obj-y += tcg-runtime.o host-utils.o
 user-obj-y += cutils.o cache-utils.o
-user-obj-y += $(trace-obj-y)

 ######################################################################
 # libhw

 hw-obj-y =
 hw-obj-y += vl.o loader.o
-hw-obj-$(CONFIG_VIRTIO) += virtio-console.o
-hw-obj-y += usb-libhw.o
-hw-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
+hw-obj-$(CONFIG_VIRTIO) += virtio.o virtio-console.o
 hw-obj-y += fw_cfg.o
 hw-obj-$(CONFIG_PCI) += pci.o pci_bridge.o
 hw-obj-$(CONFIG_PCI) += msix.o msi.o
@@ -211,19 +191,13 @@ hw-obj-$(CONFIG_PCSPK) += pcspk.o
 hw-obj-$(CONFIG_PCKBD) += pckbd.o
 hw-obj-$(CONFIG_USB_UHCI) += usb-uhci.o
 hw-obj-$(CONFIG_USB_OHCI) += usb-ohci.o
-hw-obj-$(CONFIG_USB_EHCI) += usb-ehci.o
 hw-obj-$(CONFIG_FDC) += fdc.o
 hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
 hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
 hw-obj-$(CONFIG_DMA) += dma.o
-hw-obj-$(CONFIG_HPET) += hpet.o
-hw-obj-$(CONFIG_APPLESMC) += applesmc.o
-hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
-hw-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
-hw-obj-$(CONFIG_USB_REDIR) += usb-redir.o
-hw-obj-$(CONFIG_I8259) += i8259.o

 # PPC devices
+hw-obj-$(CONFIG_OPENPIC) += openpic.o
 hw-obj-$(CONFIG_PREP_PCI) += prep_pci.o
 # Mac shared devices
 hw-obj-$(CONFIG_MACIO) += macio.o
@@ -242,7 +216,6 @@ hw-obj-$(CONFIG_PPCE500_PCI) += ppce500_pci.o

 # MIPS devices
 hw-obj-$(CONFIG_PIIX4) += piix4.o
-hw-obj-$(CONFIG_G364FB) += g364fb.o

 # PCI watchdog devices
 hw-obj-$(CONFIG_PCI) += wdt_i6300esb.o
@@ -260,10 +233,9 @@ hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
 hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
 hw-obj-$(CONFIG_LAN9118) += lan9118.o
 hw-obj-$(CONFIG_NE2000_ISA) += ne2000-isa.o
-hw-obj-$(CONFIG_OPENCORES_ETH) += opencores_eth.o

 # IDE
-hw-obj-$(CONFIG_IDE_CORE) += ide/core.o ide/atapi.o
+hw-obj-$(CONFIG_IDE_CORE) += ide/core.o
 hw-obj-$(CONFIG_IDE_QDEV) += ide/qdev.o
 hw-obj-$(CONFIG_IDE_PCI) += ide/pci.o
 hw-obj-$(CONFIG_IDE_ISA) += ide/isa.o
@@ -286,7 +258,6 @@ hw-obj-$(CONFIG_VGA_PCI) += vga-pci.o
 hw-obj-$(CONFIG_VGA_ISA) += vga-isa.o
 hw-obj-$(CONFIG_VGA_ISA_MM) += vga-isa-mm.o
 hw-obj-$(CONFIG_VMWARE_VGA) += vmware_vga.o
-hw-obj-$(CONFIG_VMMOUSE) += vmmouse.o

 hw-obj-$(CONFIG_RC4030) += rc4030.o
 hw-obj-$(CONFIG_DP8393X) += dp8393x.o
@@ -306,16 +277,9 @@ sound-obj-$(CONFIG_HDA) += intel-hda.o hda-audio.o
 adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
 hw-obj-$(CONFIG_SOUND) += $(sound-obj-y)

-9pfs-nested-$(CONFIG_VIRTFS)  = virtio-9p.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o
-9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-coth.o cofs.o codir.o cofile.o
-9pfs-nested-$(CONFIG_VIRTFS) += coxattr.o virtio-9p-synth.o
-9pfs-nested-$(CONFIG_OPEN_BY_HANDLE) +=  virtio-9p-handle.o
-
-hw-obj-$(CONFIG_REALLY_VIRTFS) += $(addprefix 9pfs/, $(9pfs-nested-y))
-$(addprefix 9pfs/, $(9pfs-nested-y)): QEMU_CFLAGS+=$(GLIB_CFLAGS)
-
+hw-obj-$(CONFIG_REALLY_VIRTFS) += virtio-9p-debug.o
+hw-obj-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
+hw-obj-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o

 ######################################################################
 # libdis
@@ -340,90 +304,16 @@ libdis-$(CONFIG_SPARC_DIS) += sparc-dis.o
 # trace

 ifeq ($(TRACE_BACKEND),dtrace)
-trace.h: trace.h-timestamp trace-dtrace.h
+trace-obj-y = trace-dtrace.o
 else
-trace.h: trace.h-timestamp
-endif
-trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -h < $< > $@,"  GEN   trace.h")
-	@cmp -s $@ trace.h || cp $@ trace.h
-
-trace.c: trace.c-timestamp
-trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -c < $< > $@,"  GEN   trace.c")
-	@cmp -s $@ trace.c || cp $@ trace.c
-
-trace.o: trace.c $(GENERATED_HEADERS)
-
-trace-dtrace.h: trace-dtrace.dtrace
-	$(call quiet-command,dtrace -o $@ -h -s $<, "  GEN   trace-dtrace.h")
-
-# Normal practice is to name DTrace probe file with a '.d' extension
-# but that gets picked up by QEMU's Makefile as an external dependency
-# rule file. So we use '.dtrace' instead
-trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
-trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -d < $< > $@,"  GEN   trace-dtrace.dtrace")
-	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
-
-trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
-	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN trace-dtrace.o")
-
-ifeq ($(LIBTOOL),)
-trace-dtrace.lo: trace-dtrace.dtrace
-	@echo "missing libtool. please install and rerun configure."; exit 1
-else
-trace-dtrace.lo: trace-dtrace.dtrace
-	$(call quiet-command,$(LIBTOOL) --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
-endif
-
-trace/simple.o: trace/simple.c $(GENERATED_HEADERS)
-
-trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace.o
-ifneq ($(TRACE_BACKEND),dtrace)
 trace-obj-y = trace.o
+ifeq ($(TRACE_BACKEND),simple)
+trace-obj-y += simpletrace.o
+user-obj-y += qemu-timer-common.o
+endif
 endif
-
-trace-nested-$(CONFIG_TRACE_DEFAULT) += default.o
-
-trace-nested-$(CONFIG_TRACE_SIMPLE) += simple.o
-trace-obj-$(CONFIG_TRACE_SIMPLE) += qemu-timer-common.o
-
-trace-nested-$(CONFIG_TRACE_STDERR) += stderr.o
-
-trace-nested-y += control.o
-
-trace-obj-y += $(addprefix trace/, $(trace-nested-y))
-
-$(trace-obj-y): $(GENERATED_HEADERS)
-
-######################################################################
-# smartcard
-
-libcacard-y = cac.o event.o vcard.o vreader.o vcard_emul_nss.o vcard_emul_type.o card_7816.o
-
-######################################################################
-# qapi
-
-qapi-nested-y = qapi-visit-core.o qmp-input-visitor.o qmp-output-visitor.o qapi-dealloc-visitor.o
-qapi-nested-y += qmp-registry.o qmp-dispatch.o
-qapi-obj-y = $(addprefix qapi/, $(qapi-nested-y))
-
-common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o $(qapi-obj-y)
-common-obj-y += qmp.o hmp.o
-
-######################################################################
-# guest agent
-
-qga-nested-y = guest-agent-commands.o guest-agent-command-state.o
-qga-obj-y = $(addprefix qga/, $(qga-nested-y))
-qga-obj-y += qemu-ga.o qemu-sockets.o module.o qemu-option.o
-qga-obj-$(CONFIG_WIN32) += oslib-win32.o
-qga-obj-$(CONFIG_POSIX) += oslib-posix.o

 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

 vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)

-QEMU_CFLAGS+=$(GLIB_CFLAGS)
-
--- a/Makefile.target
+++ b/Makefile.target
@@ -3,7 +3,6 @@
 GENERATED_HEADERS = config-target.h
 CONFIG_NO_PCI = $(if $(subst n,,$(CONFIG_PCI)),n,y)
 CONFIG_NO_KVM = $(if $(subst n,,$(CONFIG_KVM)),n,y)
-CONFIG_NO_XEN = $(if $(subst n,,$(CONFIG_XEN)),n,y)

 include ../config-host.mak
 include config-devices.mak
@@ -15,10 +14,7 @@ endif

 TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
 $(call set-vpath, $(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw)
-ifdef CONFIG_LINUX
-QEMU_CFLAGS += -I../linux-headers
-endif
-QEMU_CFLAGS += -I.. -I$(TARGET_PATH) -DNEED_CPU_H
+QEMU_CFLAGS+= -I.. -I$(TARGET_PATH) -DNEED_CPU_H

 include $(SRC_PATH)/Makefile.objs

@@ -27,8 +23,12 @@ ifdef CONFIG_USER_ONLY
 QEMU_PROG=qemu-$(TARGET_ARCH2)
 else
 # system emulator name
+ifeq ($(TARGET_ARCH), i386)
+QEMU_PROG=qemu$(EXESUF)
+else
 QEMU_PROG=qemu-system-$(TARGET_ARCH2)$(EXESUF)
 endif
+endif

 PROGS=$(QEMU_PROG)
 STPFILES=
@@ -37,10 +37,12 @@ ifndef CONFIG_HAIKU
 LIBS+=-lm
 endif

+kvm.o kvm-all.o vhost.o vhost_net.o: QEMU_CFLAGS+=$(KVM_CFLAGS)
+
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

-ifdef CONFIG_TRACE_SYSTEMTAP
+ifdef CONFIG_SYSTEMTAP_TRACE
 stap: $(QEMU_PROG).stp

 ifdef CONFIG_USER_ONLY
@@ -68,27 +70,17 @@ all: $(PROGS) stap
 #########################################################
 # cpu emulator library
 libobj-y = exec.o translate-all.o cpu-exec.o translate.o
-libobj-y += tcg/tcg.o tcg/optimize.o
-libobj-$(CONFIG_TCG_INTERPRETER) += tci.o
-libobj-y += fpu/softfloat.o
+libobj-y += tcg/tcg.o
+libobj-$(CONFIG_SOFTFLOAT) += fpu/softfloat.o
+libobj-$(CONFIG_NOSOFTFLOAT) += fpu/softfloat-native.o
 libobj-y += op_helper.o helper.o
 ifeq ($(TARGET_BASE_ARCH), i386)
 libobj-y += cpuid.o
 endif
-libobj-$(TARGET_SPARC64) += vis_helper.o
 libobj-$(CONFIG_NEED_MMU) += mmu.o
 libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
-ifeq ($(TARGET_BASE_ARCH), sparc)
-libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
-libobj-y += cpu_init.o
-endif
-libobj-$(TARGET_SPARC) += int32_helper.o
-libobj-$(TARGET_SPARC64) += int64_helper.o

 libobj-y += disas.o
-libobj-$(CONFIG_TCI_DIS) += tci-dis.o
-
-tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci

 $(libobj-y): $(GENERATED_HEADERS)

@@ -102,10 +94,10 @@ tcg/tcg.o: cpu.h

 # HELPER_CFLAGS is used for all the code compiled with static register
 # variables
-op_helper.o ldst_helper.o user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+op_helper.o cpu-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)

 # Note: this is a workaround. The real fix is to avoid compiling
-# cpu_signal_handler() in user-exec.c.
+# cpu_signal_handler() in cpu-exec.c.
 signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)

 #########################################################
@@ -115,10 +107,10 @@ ifdef CONFIG_LINUX_USER

 $(call set-vpath, $(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR))

-QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
+QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
 obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
      elfload.o linuxload.o uaccess.o gdbstub.o cpu-uname.o \
-      user-exec.o $(oslib-obj-y)
+      qemu-malloc.o $(oslib-obj-y)

 obj-$(TARGET_HAS_BFLT) += flatload.o

@@ -156,7 +148,7 @@ LDFLAGS+=-Wl,-segaddr,__STD_PROG_ZONE,0x1000 -image_base 0x0e000000
 LIBS+=-lmx

 obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
-        gdbstub.o user-exec.o
+        gdbstub.o

 obj-i386-y += ioport-user.o

@@ -178,7 +170,7 @@ $(call set-vpath, $(SRC_PATH)/bsd-user)
 QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)

 obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
-        gdbstub.o uaccess.o user-exec.o
+        gdbstub.o uaccess.o

 obj-i386-y += ioport-user.o

@@ -194,76 +186,60 @@ endif #CONFIG_BSD_USER
 # System emulator target
 ifdef CONFIG_SOFTMMU

-obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o ioport.o
+obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o
 # virtio has to be here due to weird dependency between PCI and virtio-net.
 # need to fix this properly
 obj-$(CONFIG_NO_PCI) += pci-stub.o
-obj-$(CONFIG_VIRTIO) += virtio.o virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial-bus.o
+obj-$(CONFIG_VIRTIO) += virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial-bus.o
+obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
 obj-y += vhost_net.o
 obj-$(CONFIG_VHOST_NET) += vhost.o
-obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p-device.o
+obj-$(CONFIG_REALLY_VIRTFS) += virtio-9p.o
+obj-y += rwhandler.o
 obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
-obj-y += memory.o
 LIBS+=-lz

 QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
 QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
 QEMU_CFLAGS += $(VNC_JPEG_CFLAGS)
 QEMU_CFLAGS += $(VNC_PNG_CFLAGS)
-QEMU_CFLAGS += $(GLIB_CFLAGS)

-# xen support
-obj-$(CONFIG_XEN) += xen-all.o xen_machine_pv.o xen_domainbuild.o xen-mapcache.o
-obj-$(CONFIG_NO_XEN) += xen-stub.o
-
-obj-i386-$(CONFIG_XEN) += xen_platform.o
+# xen backend driver support
+obj-$(CONFIG_XEN) += xen_machine_pv.o xen_domainbuild.o

 # Inter-VM PCI shared memory
-CONFIG_IVSHMEM =
-ifeq ($(CONFIG_KVM), y)
-  ifeq ($(CONFIG_PCI), y)
-    CONFIG_IVSHMEM = y
-  endif
-endif
-obj-$(CONFIG_IVSHMEM) += ivshmem.o
+obj-$(CONFIG_KVM) += ivshmem.o

 # Hardware support
 obj-i386-y += vga.o
-obj-i386-y += mc146818rtc.o pc.o
-obj-i386-y += cirrus_vga.o sga.o apic.o ioapic.o piix_pci.o
-obj-i386-y += vmport.o
+obj-i386-y += mc146818rtc.o i8259.o pc.o
+obj-i386-y += cirrus_vga.o apic.o ioapic.o piix_pci.o
+obj-i386-y += vmmouse.o vmport.o hpet.o applesmc.o
 obj-i386-y += device-hotplug.o pci-hotplug.o smbios.o wdt_ib700.o
 obj-i386-y += debugcon.o multiboot.o
 obj-i386-y += pc_piix.o
-obj-i386-$(CONFIG_KVM) += kvmclock.o
 obj-i386-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o

 # shared objects
-obj-ppc-y = ppc.o ppc_booke.o
+obj-ppc-y = ppc.o
 obj-ppc-y += vga.o
 # PREP target
-obj-ppc-y += mc146818rtc.o
+obj-ppc-y += i8259.o mc146818rtc.o
 obj-ppc-y += ppc_prep.o
 # OldWorld PowerMac
 obj-ppc-y += ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += ppc_newworld.o
-# IBM pSeries (sPAPR)
-obj-ppc-$(CONFIG_PSERIES) += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
-obj-ppc-$(CONFIG_PSERIES) += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
-obj-ppc-$(CONFIG_PSERIES) += spapr_pci.o device-hotplug.o pci-hotplug.o
 # PowerPC 4xx boards
 obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
 # PowerPC E500 boards
-obj-ppc-y += ppce500_mpc8544ds.o mpc8544_guts.o ppce500_spin.o
+obj-ppc-y += ppce500_mpc8544ds.o
 # PowerPC 440 Xilinx ML507 reference board.
 obj-ppc-y += virtex_ml507.o
 obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
 obj-ppc-$(CONFIG_FDT) += device_tree.o
-# PowerPC OpenPIC
-obj-ppc-y += openpic.o

 # Xilinx PPC peripherals
 obj-ppc-y += xilinx_intc.o
@@ -271,52 +247,28 @@ obj-ppc-y += xilinx_timer.o
 obj-ppc-y += xilinx_uartlite.o
 obj-ppc-y += xilinx_ethlite.o

-# LM32 boards
-obj-lm32-y += lm32_boards.o
-obj-lm32-y += milkymist.o
-
-# LM32 peripherals
-obj-lm32-y += lm32_pic.o
-obj-lm32-y += lm32_juart.o
-obj-lm32-y += lm32_timer.o
-obj-lm32-y += lm32_uart.o
-obj-lm32-y += lm32_sys.o
-obj-lm32-y += milkymist-ac97.o
-obj-lm32-y += milkymist-hpdmc.o
-obj-lm32-y += milkymist-memcard.o
-obj-lm32-y += milkymist-minimac2.o
-obj-lm32-y += milkymist-pfpu.o
-obj-lm32-y += milkymist-softusb.o
-obj-lm32-y += milkymist-sysctl.o
-obj-lm32-$(CONFIG_OPENGL) += milkymist-tmu2.o
-obj-lm32-y += milkymist-uart.o
-obj-lm32-y += milkymist-vgafb.o
-obj-lm32-y += framebuffer.o
-
 obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
 obj-mips-y += mips_addr.o mips_timer.o mips_int.o
-obj-mips-y += vga.o
-obj-mips-y += jazz_led.o
+obj-mips-y += vga.o i8259.o
+obj-mips-y += g364fb.o jazz_led.o
 obj-mips-y += gt64xxx.o mc146818rtc.o
 obj-mips-y += cirrus_vga.o
 obj-mips-$(CONFIG_FULONG) += bonito.o vt82c686.o mips_fulong2e.o

 obj-microblaze-y = petalogix_s3adsp1800_mmu.o
-obj-microblaze-y += petalogix_ml605_mmu.o

 obj-microblaze-y += microblaze_pic_cpu.o
 obj-microblaze-y += xilinx_intc.o
 obj-microblaze-y += xilinx_timer.o
 obj-microblaze-y += xilinx_uartlite.o
 obj-microblaze-y += xilinx_ethlite.o
-obj-microblaze-y += xilinx_axidma.o
-obj-microblaze-y += xilinx_axienet.o

 obj-microblaze-$(CONFIG_FDT) += device_tree.o

 # Boards
 obj-cris-y = cris_pic_cpu.o
 obj-cris-y += cris-boot.o
+obj-cris-y += etraxfs.o axis_dev88.o
 obj-cris-y += axis_dev88.o

 # IO blocks
@@ -358,16 +310,11 @@ obj-arm-y += omap2.o omap_dss.o soc_dma.o omap_gptimer.o omap_synctimer.o \
 obj-arm-y += omap_sx1.o palm.o tsc210x.o
 obj-arm-y += nseries.o blizzard.o onenand.o vga.o cbus.o tusb6010.o usb-musb.o
 obj-arm-y += mst_fpga.o mainstone.o
-obj-arm-y += z2.o
 obj-arm-y += musicpal.o bitbang_i2c.o marvell_88w8618_audio.o
 obj-arm-y += framebuffer.o
 obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
 obj-arm-y += syborg_serial.o syborg_timer.o syborg_pointer.o syborg_rtc.o
 obj-arm-y += syborg_virtio.o
-obj-arm-y += vexpress.o
-obj-arm-y += strongarm.o
-obj-arm-y += collie.o
-obj-arm-y += pl041.o lm4549.o

 obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
 obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o
@@ -378,20 +325,11 @@ obj-m68k-y += m68k-semi.o dummy_m68k.o

 obj-s390x-y = s390-virtio-bus.o s390-virtio.o

-obj-alpha-y = mc146818rtc.o
-obj-alpha-y += vga.o cirrus_vga.o
-obj-alpha-y += alpha_pci.o alpha_dp264.o alpha_typhoon.o
-
-obj-xtensa-y += xtensa_pic.o
-obj-xtensa-y += xtensa_sim.o
-obj-xtensa-y += xtensa_lx60.o
-obj-xtensa-y += xtensa-semi.o
-obj-xtensa-y += core-dc232b.o
-obj-xtensa-y += core-fsf.o
+obj-alpha-y = alpha_palcode.o

 main.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

-monitor.o: hmp-commands.h qmp-commands-old.h
+monitor.o: hmp-commands.h qmp-commands.h

 $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)

@@ -399,22 +337,14 @@ obj-y += $(addprefix ../, $(common-obj-y))
 obj-y += $(addprefix ../libdis/, $(libdis-y))
 obj-y += $(libobj-y)
 obj-y += $(addprefix $(HWDIR)/, $(hw-obj-y))
-obj-y += $(addprefix ../, $(trace-obj-y))

 endif # CONFIG_SOFTMMU

-ifndef CONFIG_LINUX_USER
-ifndef CONFIG_BSD_USER
-# libcacard needs qemu-thread support, and besides is only needed by devices
-# so not requires with linux-user / bsd-user targets
-obj-$(CONFIG_SMARTCARD_NSS) += $(addprefix ../libcacard/, $(libcacard-y))
-endif # CONFIG_BSD_USER
-endif # CONFIG_LINUX_USER
-
+obj-y += $(addprefix ../, $(trace-obj-y))
 obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o

 $(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y)
-	$(call LINK,$^)
+	$(call LINK,$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y))


 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
@@ -423,14 +353,14 @@ gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 hmp-commands.h: $(SRC_PATH)/hmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

-qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx
+qmp-commands.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

 clean:
 	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
-	rm -f *.d */*.d tcg/*.o ide/*.o 9pfs/*.o
-	rm -f hmp-commands.h qmp-commands-old.h gdbstub-xml.c
-ifdef CONFIG_TRACE_SYSTEMTAP
+	rm -f *.d */*.d tcg/*.o ide/*.o
+	rm -f hmp-commands.h qmp-commands.h gdbstub-xml.c
+ifdef CONFIG_SYSTEMTAP_TRACE
 	rm -f *.stp
 endif

@@ -441,7 +371,7 @@ ifneq ($(STRIP),)
 	$(STRIP) $(patsubst %,"$(DESTDIR)$(bindir)/%",$(PROGS))
 endif
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
+ifdef CONFIG_SYSTEMTAP_TRACE
 	$(INSTALL_DIR) "$(DESTDIR)$(datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp "$(DESTDIR)$(datadir)/../systemtap/tapset"
 endif
--- a/Makefile.user
+++ b/Makefile.user
@@ -17,9 +17,7 @@ all: $(user-obj-y)
 	@true

 clean:
-	for d in . trace; do \
-	rm -f $$d/*.o $$d/*.d $$d/*.a $$d/*~; \
-	done
+	rm -f *.o *.d *.a *~

 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/QMP/qmp.py
+++ b/QMP/qmp.py
@@ -22,24 +22,19 @@ class QMPCapabilitiesError(QMPError):
    pass

 class QEMUMonitorProtocol:
-    def __init__(self, address, server=False):
+    def __init__(self, address):
        """
        Create a QEMUMonitorProtocol class.

        @param address: QEMU address, can be either a unix socket path (string)
                        or a tuple in the form ( address, port ) for a TCP
                        connection
-        @param server: server mode listens on the socket (bool)
-        @raise socket.error on socket connection errors
-        @note No connection is established, this is done by the connect() or
-              accept() methods
+        @note No connection is established, this is done by the connect() method
        """
        self.__events = []
        self.__address = address
        self.__sock = self.__get_sock()
-        if server:
-            self.__sock.bind(self.__address)
-            self.__sock.listen(1)
+        self.__sockfile = self.__sock.makefile()

    def __get_sock(self):
        if isinstance(self.__address, tuple):
@@ -48,18 +43,7 @@ class QEMUMonitorProtocol:
            family = socket.AF_UNIX
        return socket.socket(family, socket.SOCK_STREAM)

-    def __negotiate_capabilities(self):
-        self.__sockfile = self.__sock.makefile()
-        greeting = self.__json_read()
-        if greeting is None or not greeting.has_key('QMP'):
-            raise QMPConnectError
-        # Greeting seems ok, negotiate capabilities
-        resp = self.cmd('qmp_capabilities')
-        if "return" in resp:
-            return greeting
-        raise QMPCapabilitiesError
-
-    def __json_read(self, only_event=False):
+    def __json_read(self):
        while True:
            data = self.__sockfile.readline()
            if not data:
@@ -67,8 +51,7 @@ class QEMUMonitorProtocol:
            resp = json.loads(data)
            if 'event' in resp:
                self.__events.append(resp)
-                if not only_event:
-                    continue
+                continue
            return resp

    error = socket.error
@@ -83,19 +66,14 @@ class QEMUMonitorProtocol:
        @raise QMPCapabilitiesError if fails to negotiate capabilities
        """
        self.__sock.connect(self.__address)
-        return self.__negotiate_capabilities()
-
-    def accept(self):
-        """
-        Await connection from QMP Monitor and perform capabilities negotiation.
-
-        @return QMP greeting dict
-        @raise socket.error on socket connection errors
-        @raise QMPConnectError if the greeting is not received
-        @raise QMPCapabilitiesError if fails to negotiate capabilities
-        """
-        self.__sock, _ = self.__sock.accept()
-        return self.__negotiate_capabilities()
+        greeting = self.__json_read()
+        if greeting is None or not greeting.has_key('QMP'):
+            raise QMPConnectError
+        # Greeting seems ok, negotiate capabilities
+        resp = self.cmd('qmp_capabilities')
+        if "return" in resp:
+            return greeting
+        raise QMPCapabilitiesError

    def cmd_obj(self, qmp_cmd):
        """
@@ -128,11 +106,9 @@ class QEMUMonitorProtocol:
            qmp_cmd['id'] = id
        return self.cmd_obj(qmp_cmd)

-    def get_events(self, wait=False):
+    def get_events(self):
        """
        Get a list of available QMP events.
-
-        @param wait: block until an event is available (bool)
        """
        self.__sock.setblocking(0)
        try:
@@ -142,8 +118,6 @@ class QEMUMonitorProtocol:
                # No data available
                pass
        self.__sock.setblocking(1)
-        if not self.__events and wait:
-            self.__json_read(only_event=True)
        return self.__events

    def clear_events(self):
--- a/2
+++ b/2
@@ -1 +1 @@
-1.0,1
+0.13.91
--- a/a.out.h
+++ b/a.out.h
@@ -151,7 +151,7 @@ struct external_lineno {
 #define E_FILNMLEN	14	/* # characters in a file name		*/
 #define E_DIMNUM	4	/* # array dimensions in auxiliary entry */

-struct QEMU_PACKED external_syment
+struct __attribute__((packed)) external_syment
 {
  union {
    char e_name[E_SYMNMLEN];
--- a/acl.c
+++ b/acl.c
@@ -24,6 +24,7 @@


 #include "qemu-common.h"
+#include "sysemu.h"
 #include "acl.h"

 #ifdef CONFIG_FNMATCH
@@ -55,8 +56,8 @@ qemu_acl *qemu_acl_init(const char *aclname)
    if (acl)
        return acl;

-    acl = g_malloc(sizeof(*acl));
-    acl->aclname = g_strdup(aclname);
+    acl = qemu_malloc(sizeof(*acl));
+    acl->aclname = qemu_strdup(aclname);
    /* Deny by default, so there is no window of "open
     * access" between QEMU starting, and the user setting
     * up ACLs in the monitor */
@@ -65,7 +66,7 @@ qemu_acl *qemu_acl_init(const char *aclname)
    acl->nentries = 0;
    QTAILQ_INIT(&acl->entries);

-    acls = g_realloc(acls, sizeof(*acls) * (nacls +1));
+    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
    acls[nacls] = acl;
    nacls++;

@@ -95,13 +96,13 @@ int qemu_acl_party_is_allowed(qemu_acl *acl,

 void qemu_acl_reset(qemu_acl *acl)
 {
-    qemu_acl_entry *entry, *next_entry;
+    qemu_acl_entry *entry;

    /* Put back to deny by default, so there is no window
     * of "open access" while the user re-initializes the
     * access control list */
    acl->defaultDeny = 1;
-    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
+    QTAILQ_FOREACH(entry, &acl->entries, next) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
        free(entry->match);
        free(entry);
@@ -116,8 +117,8 @@ int qemu_acl_append(qemu_acl *acl,
 {
    qemu_acl_entry *entry;

-    entry = g_malloc(sizeof(*entry));
-    entry->match = g_strdup(match);
+    entry = qemu_malloc(sizeof(*entry));
+    entry->match = qemu_strdup(match);
    entry->deny = deny;

    QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
@@ -142,8 +143,8 @@ int qemu_acl_insert(qemu_acl *acl,
        return qemu_acl_append(acl, deny, match);


-    entry = g_malloc(sizeof(*entry));
-    entry->match = g_strdup(match);
+    entry = qemu_malloc(sizeof(*entry));
+    entry->match = qemu_strdup(match);
    entry->deny = deny;

    QTAILQ_FOREACH(tmp, &acl->entries, next) {
--- a/aio.c
+++ b/aio.c
@@ -75,13 +75,13 @@ int qemu_aio_set_fd_handler(int fd,
                 * releasing the walking_handlers lock.
                 */
                QLIST_REMOVE(node, node);
-                g_free(node);
+                qemu_free(node);
            }
        }
    } else {
        if (node == NULL) {
            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
+            node = qemu_mallocz(sizeof(AioHandler));
            node->fd = fd;
            QLIST_INSERT_HEAD(&aio_handlers, node, node);
        }
@@ -220,7 +220,7 @@ void qemu_aio_wait(void)

                if (tmp->deleted) {
                    QLIST_REMOVE(tmp, node);
-                    g_free(tmp);
+                    qemu_free(tmp);
                }
            }

--- a/alpha-dis.c
+++ b/alpha-dis.c
@@ -238,6 +238,10 @@ extern const unsigned alpha_num_operands;
 #define AXP_REG_SP	30
 #define AXP_REG_ZERO	31

+#define bfd_mach_alpha_ev4  0x10
+#define bfd_mach_alpha_ev5  0x20
+#define bfd_mach_alpha_ev6  0x30
+
 enum bfd_reloc_code_real {
    BFD_RELOC_23_PCREL_S2,
    BFD_RELOC_ALPHA_HINT
--- a/arch_init.c
+++ b/arch_init.c
@@ -64,8 +64,6 @@ const char arch_config_name[] = CONFIG_QEMU_CONFDIR "/target-" TARGET_ARCH ".con
 #define QEMU_ARCH QEMU_ARCH_I386
 #elif defined(TARGET_M68K)
 #define QEMU_ARCH QEMU_ARCH_M68K
-#elif defined(TARGET_LM32)
-#define QEMU_ARCH QEMU_ARCH_LM32
 #elif defined(TARGET_MICROBLAZE)
 #define QEMU_ARCH QEMU_ARCH_MICROBLAZE
 #elif defined(TARGET_MIPS)
@@ -78,8 +76,6 @@ const char arch_config_name[] = CONFIG_QEMU_CONFDIR "/target-" TARGET_ARCH ".con
 #define QEMU_ARCH QEMU_ARCH_SH4
 #elif defined(TARGET_SPARC)
 #define QEMU_ARCH QEMU_ARCH_SPARC
-#elif defined(TARGET_XTENSA)
-#define QEMU_ARCH QEMU_ARCH_XTENSA
 #endif

 const uint32_t arch_type = QEMU_ARCH;
@@ -237,7 +233,7 @@ static void sort_ram_list(void)
    QLIST_FOREACH(block, &ram_list.blocks, next) {
        ++n;
    }
-    blocks = g_malloc(n * sizeof *blocks);
+    blocks = qemu_malloc(n * sizeof *blocks);
    n = 0;
    QLIST_FOREACH_SAFE(block, &ram_list.blocks, next, nblock) {
        blocks[n++] = block;
@@ -247,7 +243,7 @@ static void sort_ram_list(void)
    while (--n >= 0) {
        QLIST_INSERT_HEAD(&ram_list.blocks, blocks[n], next);
    }
-    g_free(blocks);
+    qemu_free(blocks);
 }

 int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
@@ -256,7 +252,6 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    uint64_t bytes_transferred_last;
    double bwidth = 0;
    uint64_t expected_time = 0;
-    int ret;

    if (stage < 0) {
        cpu_physical_memory_set_dirty_tracking(0);
@@ -264,8 +259,8 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    }

    if (cpu_physical_sync_dirty_bitmap(0, TARGET_PHYS_ADDR_MAX) != 0) {
-        qemu_file_set_error(f, -EINVAL);
-        return -EINVAL;
+        qemu_file_set_error(f);
+        return 0;
    }

    if (stage == 1) {
@@ -301,7 +296,7 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
    bytes_transferred_last = bytes_transferred;
    bwidth = qemu_get_clock_ns(rt_clock);

-    while ((ret = qemu_file_rate_limit(f)) == 0) {
+    while (!qemu_file_rate_limit(f)) {
        int bytes_sent;

        bytes_sent = ram_save_block(f);
@@ -311,10 +306,6 @@ int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
        }
    }

-    if (ret < 0) {
-        return ret;
-    }
-
    bwidth = qemu_get_clock_ns(rt_clock) - bwidth;
    bwidth = (bytes_transferred - bytes_transferred_last) / bwidth;

@@ -376,7 +367,6 @@ int ram_load(QEMUFile *f, void *opaque, int version_id)
 {
    ram_addr_t addr;
    int flags;
-    int error;

    if (version_id < 3 || version_id > 4) {
        return -EINVAL;
@@ -457,15 +447,19 @@ int ram_load(QEMUFile *f, void *opaque, int version_id)

            qemu_get_buffer(f, host, TARGET_PAGE_SIZE);
        }
-        error = qemu_file_get_error(f);
-        if (error) {
-            return error;
+        if (qemu_file_has_error(f)) {
+            return -EIO;
        }
    } while (!(flags & RAM_SAVE_FLAG_EOS));

    return 0;
 }

+void qemu_service_io(void)
+{
+    qemu_notify_event();
+}
+
 #ifdef HAS_AUDIO
 struct soundhw {
    const char *name;
@@ -713,11 +707,6 @@ int audio_available(void)
 #endif
 }

-int tcg_available(void)
-{
-    return 1;
-}
-
 int kvm_available(void)
 {
 #ifdef CONFIG_KVM
--- a/arch_init.h
+++ b/arch_init.h
@@ -10,25 +10,24 @@ enum {
    QEMU_ARCH_CRIS = 4,
    QEMU_ARCH_I386 = 8,
    QEMU_ARCH_M68K = 16,
-    QEMU_ARCH_LM32 = 32,
-    QEMU_ARCH_MICROBLAZE = 64,
-    QEMU_ARCH_MIPS = 128,
-    QEMU_ARCH_PPC = 256,
-    QEMU_ARCH_S390X = 512,
-    QEMU_ARCH_SH4 = 1024,
-    QEMU_ARCH_SPARC = 2048,
-    QEMU_ARCH_XTENSA = 4096,
+    QEMU_ARCH_MICROBLAZE = 32,
+    QEMU_ARCH_MIPS = 64,
+    QEMU_ARCH_PPC = 128,
+    QEMU_ARCH_S390X = 256,
+    QEMU_ARCH_SH4 = 512,
+    QEMU_ARCH_SPARC = 1024,
 };

 extern const uint32_t arch_type;

 void select_soundhw(const char *optarg);
+int ram_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque);
+int ram_load(QEMUFile *f, void *opaque, int version_id);
 void do_acpitable_option(const char *optarg);
 void do_smbios_option(const char *optarg);
 void cpudef_init(void);
 int audio_available(void);
 void audio_init(qemu_irq *isa_pic, PCIBus *pci_bus);
-int tcg_available(void);
 int kvm_available(void);
 int xen_available(void);

--- a/arm-semi.c
+++ b/arm-semi.c
@@ -33,8 +33,8 @@
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
 #include "qemu-common.h"
+#include "sysemu.h"
 #include "gdbstub.h"
-#include "hw/arm-misc.h"
 #endif

 #define SYS_OPEN        0x01
@@ -370,88 +370,68 @@ uint32_t do_arm_semihosting(CPUState *env)
        return syscall_err;
 #endif
    case SYS_GET_CMDLINE:
+#ifdef CONFIG_USER_ONLY
+        /* Build a commandline from the original argv.  */
        {
-            /* Build a command-line from the original argv.
-             *
-             * The inputs are:
-             *     * ARG(0), pointer to a buffer of at least the size
-             *               specified in ARG(1).
-             *     * ARG(1), size of the buffer pointed to by ARG(0) in
-             *               bytes.
-             *
-             * The outputs are:
-             *     * ARG(0), pointer to null-terminated string of the
-             *               command line.
-             *     * ARG(1), length of the string pointed to by ARG(0).
-             */
+            char *arm_cmdline_buffer;
+            const char *host_cmdline_buffer;

-            char *output_buffer;
-            size_t input_size = ARG(1);
-            size_t output_size;
-            int status = 0;
-
-            /* Compute the size of the output string.  */
-#if !defined(CONFIG_USER_ONLY)
-            output_size = strlen(ts->boot_info->kernel_filename)
-                        + 1  /* Separating space.  */
-                        + strlen(ts->boot_info->kernel_cmdline)
-                        + 1; /* Terminating null byte.  */
-#else
            unsigned int i;
+            unsigned int arm_cmdline_len = ARG(1);
+            unsigned int host_cmdline_len =
+                ts->info->arg_end-ts->info->arg_start;

-            output_size = ts->info->arg_end - ts->info->arg_start;
-            if (!output_size) {
+            if (!arm_cmdline_len || host_cmdline_len > arm_cmdline_len) {
+                return -1; /* not enough space to store command line */
+            }
+
+            if (!host_cmdline_len) {
                /* We special-case the "empty command line" case (argc==0).
                   Just provide the terminating 0. */
-                output_size = 1;
-            }
-#endif
+                arm_cmdline_buffer = lock_user(VERIFY_WRITE, ARG(0), 1, 0);
+                arm_cmdline_buffer[0] = 0;
+                unlock_user(arm_cmdline_buffer, ARG(0), 1);

-            if (output_size > input_size) {
-                 /* Not enough space to store command-line arguments.  */
-                return -1;
+                /* Adjust the commandline length argument. */
+                SET_ARG(1, 0);
+                return 0;
            }

-            /* Adjust the command-line length.  */
-            SET_ARG(1, output_size - 1);
+            /* lock the buffers on the ARM side */
+            arm_cmdline_buffer =
+                lock_user(VERIFY_WRITE, ARG(0), host_cmdline_len, 0);
+            host_cmdline_buffer =
+                lock_user(VERIFY_READ, ts->info->arg_start,
+                                       host_cmdline_len, 1);

-            /* Lock the buffer on the ARM side.  */
-            output_buffer = lock_user(VERIFY_WRITE, ARG(0), output_size, 0);
-            if (!output_buffer) {
-                return -1;
-            }
+            if (arm_cmdline_buffer && host_cmdline_buffer)
+            {
+                /* the last argument is zero-terminated;
+                   no need for additional termination */
+                memcpy(arm_cmdline_buffer, host_cmdline_buffer,
+                       host_cmdline_len);

-            /* Copy the command-line arguments.  */
-#if !defined(CONFIG_USER_ONLY)
-            pstrcpy(output_buffer, output_size, ts->boot_info->kernel_filename);
-            pstrcat(output_buffer, output_size, " ");
-            pstrcat(output_buffer, output_size, ts->boot_info->kernel_cmdline);
-#else
-            if (output_size == 1) {
-                /* Empty command-line.  */
-                output_buffer[0] = '\0';
-                goto out;
-            }
-
-            if (copy_from_user(output_buffer, ts->info->arg_start,
-                               output_size)) {
-                status = -1;
-                goto out;
-            }
-
-            /* Separate arguments by white spaces.  */
-            for (i = 0; i < output_size - 1; i++) {
-                if (output_buffer[i] == 0) {
-                    output_buffer[i] = ' ';
+                /* separate arguments by white spaces */
+                for (i = 0; i < host_cmdline_len-1; i++) {
+                    if (arm_cmdline_buffer[i] == 0) {
+                        arm_cmdline_buffer[i] = ' ';
+                    }
                }
-            }
-        out:
-#endif
-            /* Unlock the buffer on the ARM side.  */
-            unlock_user(output_buffer, ARG(0), output_size);

-            return status;
+                /* Adjust the commandline length argument. */
+                SET_ARG(1, host_cmdline_len-1);
+            }
+
+            /* Unlock the buffers on the ARM side.  */
+            unlock_user(arm_cmdline_buffer, ARG(0), host_cmdline_len);
+            unlock_user((void*)host_cmdline_buffer, ts->info->arg_start, 0);
+
+            /* Return success if we could return a commandline.  */
+            return (arm_cmdline_buffer && host_cmdline_buffer) ? 0 : -1;
        }
+#else
+        return -1;
+#endif
    case SYS_HEAPINFO:
        {
            uint32_t *ptr;
@@ -461,16 +441,15 @@ uint32_t do_arm_semihosting(CPUState *env)
            /* Some C libraries assume the heap immediately follows .bss, so
               allocate it using sbrk.  */
            if (!ts->heap_limit) {
-                abi_ulong ret;
+                long ret;

                ts->heap_base = do_brk(0);
                limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
                /* Try a big heap, and reduce the size if that fails.  */
                for (;;) {
                    ret = do_brk(limit);
-                    if (ret >= limit) {
+                    if (ret != -1)
                        break;
-                    }
                    limit = (ts->heap_base >> 1) + (limit >> 1);
                }
                ts->heap_limit = limit;
--- a/arm.ld
+++ b/arm.ld
@@ -71,23 +71,23 @@ SECTIONS
  .data1   : { *(.data1) }
  .preinit_array     :
  {
-    PROVIDE (__preinit_array_start = .);
+    PROVIDE_HIDDEN (__preinit_array_start = .);
    KEEP (*(.preinit_array))
-    PROVIDE (__preinit_array_end = .);
+    PROVIDE_HIDDEN (__preinit_array_end = .);
  }
  .init_array     :
  {
-     PROVIDE (__init_array_start = .);
+     PROVIDE_HIDDEN (__init_array_start = .);
     KEEP (*(SORT(.init_array.*)))
     KEEP (*(.init_array))
-     PROVIDE (__init_array_end = .);
+     PROVIDE_HIDDEN (__init_array_end = .);
  }
  .fini_array     :
  {
-    PROVIDE (__fini_array_start = .);
+    PROVIDE_HIDDEN (__fini_array_start = .);
    KEEP (*(.fini_array))
    KEEP (*(SORT(.fini_array.*)))
-    PROVIDE (__fini_array_end = .);
+    PROVIDE_HIDDEN (__fini_array_end = .);
  }
  .ctors         :
  {
--- a/async.c
+++ b/async.c
@@ -24,10 +24,93 @@

 #include "qemu-common.h"
 #include "qemu-aio.h"
-#include "main-loop.h"

-/* Anchor of the list of Bottom Halves belonging to the context */
-static struct QEMUBH *first_bh;
+/*
+ * An AsyncContext protects the callbacks of AIO requests and Bottom Halves
+ * against interfering with each other. A typical example is qcow2 that accepts
+ * asynchronous requests, but relies for manipulation of its metadata on
+ * synchronous bdrv_read/write that doesn't trigger any callbacks.
+ *
+ * However, these functions are often emulated using AIO which means that AIO
+ * callbacks must be run - but at the same time we must not run callbacks of
+ * other requests as they might start to modify metadata and corrupt the
+ * internal state of the caller of bdrv_read/write.
+ *
+ * To achieve the desired semantics we switch into a new AsyncContext.
+ * Callbacks must only be run if they belong to the current AsyncContext.
+ * Otherwise they need to be queued until their own context is active again.
+ * This is how you can make qemu_aio_wait() wait only for your own callbacks.
+ *
+ * The AsyncContexts form a stack. When you leave a AsyncContexts, you always
+ * return to the old ("parent") context.
+ */
+struct AsyncContext {
+    /* Consecutive number of the AsyncContext (position in the stack) */
+    int id;
+
+    /* Anchor of the list of Bottom Halves belonging to the context */
+    struct QEMUBH *first_bh;
+
+    /* Link to parent context */
+    struct AsyncContext *parent;
+};
+
+/* The currently active AsyncContext */
+static struct AsyncContext *async_context = &(struct AsyncContext) { 0 };
+
+/*
+ * Enter a new AsyncContext. Already scheduled Bottom Halves and AIO callbacks
+ * won't be called until this context is left again.
+ */
+void async_context_push(void)
+{
+    struct AsyncContext *new = qemu_mallocz(sizeof(*new));
+    new->parent = async_context;
+    new->id = async_context->id + 1;
+    async_context = new;
+}
+
+/* Run queued AIO completions and destroy Bottom Half */
+static void bh_run_aio_completions(void *opaque)
+{
+    QEMUBH **bh = opaque;
+    qemu_bh_delete(*bh);
+    qemu_free(bh);
+    qemu_aio_process_queue();
+}
+/*
+ * Leave the currently active AsyncContext. All Bottom Halves belonging to the
+ * old context are executed before changing the context.
+ */
+void async_context_pop(void)
+{
+    struct AsyncContext *old = async_context;
+    QEMUBH **bh;
+
+    /* Flush the bottom halves, we don't want to lose them */
+    while (qemu_bh_poll());
+
+    /* Switch back to the parent context */
+    async_context = async_context->parent;
+    qemu_free(old);
+
+    if (async_context == NULL) {
+        abort();
+    }
+
+    /* Schedule BH to run any queued AIO completions as soon as possible */
+    bh = qemu_malloc(sizeof(*bh));
+    *bh = qemu_bh_new(bh_run_aio_completions, bh);
+    qemu_bh_schedule(*bh);
+}
+
+/*
+ * Returns the ID of the currently active AsyncContext
+ */
+int get_async_context_id(void)
+{
+    return async_context->id;
+}

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
@@ -44,25 +127,21 @@ struct QEMUBH {
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
-    bh = g_malloc0(sizeof(QEMUBH));
+    bh = qemu_mallocz(sizeof(QEMUBH));
    bh->cb = cb;
    bh->opaque = opaque;
-    bh->next = first_bh;
-    first_bh = bh;
+    bh->next = async_context->first_bh;
+    async_context->first_bh = bh;
    return bh;
 }

 int qemu_bh_poll(void)
 {
-    QEMUBH *bh, **bhp, *next;
+    QEMUBH *bh, **bhp;
    int ret;
-    static int nesting = 0;
-
-    nesting++;

    ret = 0;
-    for (bh = first_bh; bh; bh = next) {
-        next = bh->next;
+    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
            if (!bh->idle)
@@ -72,20 +151,15 @@ int qemu_bh_poll(void)
        }
    }

-    nesting--;
-
    /* remove deleted bhs */
-    if (!nesting) {
-        bhp = &first_bh;
-        while (*bhp) {
-            bh = *bhp;
-            if (bh->deleted) {
-                *bhp = bh->next;
-                g_free(bh);
-            } else {
-                bhp = &bh->next;
-            }
-        }
+    bhp = &async_context->first_bh;
+    while (*bhp) {
+        bh = *bhp;
+        if (bh->deleted) {
+            *bhp = bh->next;
+            qemu_free(bh);
+        } else
+            bhp = &bh->next;
    }

    return ret;
@@ -124,7 +198,7 @@ void qemu_bh_update_timeout(int *timeout)
 {
    QEMUBH *bh;

-    for (bh = first_bh; bh; bh = bh->next) {
+    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -136,7 +136,7 @@ static void alsa_fini_poll (struct pollhlp *hlp)
        for (i = 0; i < hlp->count; ++i) {
            qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
        }
-        g_free (pfds);
+        qemu_free (pfds);
    }
    hlp->pfds = NULL;
    hlp->count = 0;
@@ -260,7 +260,7 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int mask)
    if (err < 0) {
        alsa_logerr (err, "Could not initialize poll mode\n"
                     "Could not obtain poll descriptors\n");
-        g_free (pfds);
+        qemu_free (pfds);
        return -1;
    }

@@ -288,7 +288,7 @@ static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int mask)
            while (i--) {
                qemu_set_fd_handler (pfds[i].fd, NULL, NULL, NULL);
            }
-            g_free (pfds);
+            qemu_free (pfds);
            return -1;
        }
    }
@@ -816,7 +816,7 @@ static void alsa_fini_out (HWVoiceOut *hw)
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

    if (alsa->pcm_buf) {
-        g_free (alsa->pcm_buf);
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
@@ -979,7 +979,7 @@ static void alsa_fini_in (HWVoiceIn *hw)
    alsa_anal_close (&alsa->handle, &alsa->pollhlp);

    if (alsa->pcm_buf) {
-        g_free (alsa->pcm_buf);
+        qemu_free (alsa->pcm_buf);
        alsa->pcm_buf = NULL;
    }
 }
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -196,7 +196,7 @@ void *audio_calloc (const char *funcname, int nmemb, size_t size)
        return NULL;
    }

-    return g_malloc0 (len);
+    return qemu_mallocz (len);
 }

 static char *audio_alloc_prefix (const char *s)
@@ -210,7 +210,7 @@ static char *audio_alloc_prefix (const char *s)
    }

    len = strlen (s);
-    r = g_malloc (len + sizeof (qemu_prefix));
+    r = qemu_malloc (len + sizeof (qemu_prefix));

    u = r + sizeof (qemu_prefix) - 1;

@@ -425,7 +425,7 @@ static void audio_print_options (const char *prefix,
        printf ("    %s\n", opt->descr);
    }

-    g_free (uprefix);
+    qemu_free (uprefix);
 }

 static void audio_process_options (const char *prefix,
@@ -462,7 +462,7 @@ static void audio_process_options (const char *prefix,
         * (includes trailing zero) + zero + underscore (on behalf of
         * sizeof) */
        optlen = len + preflen + sizeof (qemu_prefix) + 1;
-        optname = g_malloc (optlen);
+        optname = qemu_malloc (optlen);

        pstrcpy (optname, optlen, qemu_prefix);

@@ -507,7 +507,7 @@ static void audio_process_options (const char *prefix,
            opt->overriddenp = &opt->overridden;
        }
        *opt->overriddenp = !def;
-        g_free (optname);
+        qemu_free (optname);
    }
 }

@@ -778,7 +778,7 @@ static void audio_detach_capture (HWVoiceOut *hw)

        QLIST_REMOVE (sw, entries);
        QLIST_REMOVE (sc, entries);
-        g_free (sc);
+        qemu_free (sc);
        if (was_active) {
            /* We have removed soft voice from the capture:
               this might have changed the overall status of the capture
@@ -818,7 +818,7 @@ static int audio_attach_capture (HWVoiceOut *hw)
        sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
        if (!sw->rate) {
            dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
-            g_free (sw);
+            qemu_free (sw);
            return -1;
        }
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
@@ -1114,7 +1114,7 @@ static int audio_is_timer_needed (void)
 static void audio_reset_timer (AudioState *s)
 {
    if (audio_is_timer_needed ()) {
-        qemu_mod_timer (s->ts, qemu_get_clock_ns (vm_clock) + 1);
+        qemu_mod_timer (s->ts, qemu_get_clock (vm_clock) + 1);
    }
    else {
        qemu_del_timer (s->ts);
@@ -1743,7 +1743,7 @@ static int audio_driver_init (AudioState *s, struct audio_driver *drv)
 }

 static void audio_vm_change_state_handler (void *opaque, int running,
-                                           RunState state)
+                                           int reason)
 {
    AudioState *s = opaque;
    HWVoiceOut *hwo = NULL;
@@ -1820,7 +1820,7 @@ static void audio_init (void)
    QLIST_INIT (&s->cap_head);
    atexit (audio_atexit);

-    s->ts = qemu_new_timer_ns (vm_clock, audio_timer, s);
+    s->ts = qemu_new_timer (vm_clock, audio_timer, s);
    if (!s->ts) {
        hw_error("Could not create audio timer\n");
    }
@@ -1907,7 +1907,7 @@ static void audio_init (void)
 void AUD_register_card (const char *name, QEMUSoundCard *card)
 {
    audio_init ();
-    card->name = g_strdup (name);
+    card->name = qemu_strdup (name);
    memset (&card->entries, 0, sizeof (card->entries));
    QLIST_INSERT_HEAD (&glob_audio_state.card_head, card, entries);
 }
@@ -1915,7 +1915,7 @@ void AUD_register_card (const char *name, QEMUSoundCard *card)
 void AUD_remove_card (QEMUSoundCard *card)
 {
    QLIST_REMOVE (card, entries);
-    g_free (card->name);
+    qemu_free (card->name);
 }


@@ -2000,11 +2000,11 @@ CaptureVoiceOut *AUD_add_capture (
        return cap;

    err3:
-        g_free (cap->hw.mix_buf);
+        qemu_free (cap->hw.mix_buf);
    err2:
-        g_free (cap);
+        qemu_free (cap);
    err1:
-        g_free (cb);
+        qemu_free (cb);
    err0:
        return NULL;
    }
@@ -2018,7 +2018,7 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
        if (cb->opaque == cb_opaque) {
            cb->ops.destroy (cb_opaque);
            QLIST_REMOVE (cb, entries);
-            g_free (cb);
+            qemu_free (cb);

            if (!cap->cb_head.lh_first) {
                SWVoiceOut *sw = cap->hw.sw_head.lh_first, *sw1;
@@ -2036,11 +2036,11 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
                    }
                    QLIST_REMOVE (sw, entries);
                    QLIST_REMOVE (sc, entries);
-                    g_free (sc);
+                    qemu_free (sc);
                    sw = sw1;
                }
                QLIST_REMOVE (cap, entries);
-                g_free (cap);
+                qemu_free (cap);
            }
            return;
        }
--- a/audio/audio_pt_int.c
+++ b/audio/audio_pt_int.c
@@ -6,6 +6,8 @@
 #include "audio_int.h"
 #include "audio_pt_int.h"

+#include <signal.h>
+
 static void GCC_FMT_ATTR(3, 4) logerr (struct audio_pt *pt, int err,
                                       const char *fmt, ...)
 {
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -72,7 +72,7 @@ static void glue (audio_init_nb_voices_, TYPE) (struct audio_driver *drv)
 static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)
 {
    if (HWBUF) {
-        g_free (HWBUF);
+        qemu_free (HWBUF);
    }

    HWBUF = NULL;
@@ -93,7 +93,7 @@ static int glue (audio_pcm_hw_alloc_resources_, TYPE) (HW *hw)
 static void glue (audio_pcm_sw_free_resources_, TYPE) (SW *sw)
 {
    if (sw->buf) {
-        g_free (sw->buf);
+        qemu_free (sw->buf);
    }

    if (sw->rate) {
@@ -123,7 +123,7 @@ static int glue (audio_pcm_sw_alloc_resources_, TYPE) (SW *sw)
    sw->rate = st_rate_start (sw->hw->info.freq, sw->info.freq);
 #endif
    if (!sw->rate) {
-        g_free (sw->buf);
+        qemu_free (sw->buf);
        sw->buf = NULL;
        return -1;
    }
@@ -160,10 +160,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
        [sw->info.swap_endianness]
        [audio_bits_to_index (sw->info.bits)];

-    sw->name = g_strdup (name);
+    sw->name = qemu_strdup (name);
    err = glue (audio_pcm_sw_alloc_resources_, TYPE) (sw);
    if (err) {
-        g_free (sw->name);
+        qemu_free (sw->name);
        sw->name = NULL;
    }
    return err;
@@ -173,7 +173,7 @@ static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
 {
    glue (audio_pcm_sw_free_resources_, TYPE) (sw);
    if (sw->name) {
-        g_free (sw->name);
+        qemu_free (sw->name);
        sw->name = NULL;
    }
 }
@@ -201,7 +201,7 @@ static void glue (audio_pcm_hw_gc_, TYPE) (HW **hwp)
        glue (s->nb_hw_voices_, TYPE) += 1;
        glue (audio_pcm_hw_free_resources_ ,TYPE) (hw);
        glue (hw->pcm_ops->fini_, TYPE) (hw);
-        g_free (hw);
+        qemu_free (hw);
        *hwp = NULL;
    }
 }
@@ -300,7 +300,7 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
 err1:
    glue (hw->pcm_ops->fini_, TYPE) (hw);
 err0:
-    g_free (hw);
+    qemu_free (hw);
    return NULL;
 }

@@ -368,7 +368,7 @@ err3:
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&hw);
 err2:
-    g_free (sw);
+    qemu_free (sw);
 err1:
    return NULL;
 }
@@ -378,7 +378,7 @@ static void glue (audio_close_, TYPE) (SW *sw)
    glue (audio_pcm_sw_fini_, TYPE) (sw);
    glue (audio_pcm_hw_del_sw_, TYPE) (sw);
    glue (audio_pcm_hw_gc_, TYPE) (&sw->hw);
-    g_free (sw);
+    qemu_free (sw);
 }

 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -56,7 +56,7 @@ typedef struct coreaudioVoiceOut {

 static void coreaudio_logstatus (OSStatus status)
 {
-    const char *str = "BUG";
+    char *str = "BUG";

    switch(status) {
    case kAudioHardwareNoError:
@@ -104,7 +104,7 @@ static void coreaudio_logstatus (OSStatus status)
        break;

    default:
-        AUD_log (AUDIO_CAP, "Reason: status code %" PRId32 "\n", (int32_t)status);
+        AUD_log (AUDIO_CAP, "Reason: status code %ld\n", status);
        return;
    }

@@ -360,8 +360,8 @@ static int coreaudio_init_out (HWVoiceOut *hw, struct audsettings *as)
        &core->audioDevicePropertyBufferFrameSize);
    if (status != kAudioHardwareNoError) {
        coreaudio_logerr2 (status, typ,
-                           "Could not set device buffer frame size %" PRIu32 "\n",
-                           (uint32_t)core->audioDevicePropertyBufferFrameSize);
+                           "Could not set device buffer frame size %ld\n",
+                           core->audioDevicePropertyBufferFrameSize);
        return -1;
    }

--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -246,7 +246,7 @@ static int qesd_init_out (HWVoiceOut *hw, struct audsettings *as)
    esd->fd = -1;

 fail1:
-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
@@ -270,7 +270,7 @@ static void qesd_fini_out (HWVoiceOut *hw)

    audio_pt_fini (&esd->pt, AUDIO_FUNC);

-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }

@@ -453,7 +453,7 @@ static int qesd_init_in (HWVoiceIn *hw, struct audsettings *as)
    esd->fd = -1;

 fail1:
-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
    return -1;
 }
@@ -477,7 +477,7 @@ static void qesd_fini_in (HWVoiceIn *hw)

    audio_pt_fini (&esd->pt, AUDIO_FUNC);

-    g_free (esd->pcm_buf);
+    qemu_free (esd->pcm_buf);
    esd->pcm_buf = NULL;
 }

--- a/audio/fmodaudio.c
+++ b/audio/fmodaudio.c
@@ -343,7 +343,7 @@ static void fmod_fini_out (HWVoiceOut *hw)

 static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
-    int mode, channel;
+    int bits16, mode, channel;
    FMODVoiceOut *fmd = (FMODVoiceOut *) hw;
    struct audsettings obt_as = *as;

@@ -374,6 +374,7 @@ static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
+    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
@@ -404,7 +405,7 @@ static int fmod_ctl_out (HWVoiceOut *hw, int cmd, ...)

 static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
 {
-    int mode;
+    int bits16, mode;
    FMODVoiceIn *fmd = (FMODVoiceIn *) hw;
    struct audsettings obt_as = *as;

@@ -431,6 +432,7 @@ static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
    /* FMOD always operates on little endian frames? */
    obt_as.endianness = 0;
    audio_pcm_init_info (&hw->info, &obt_as);
+    bits16 = (mode & FSOUND_16BITS) != 0;
    hw->samples = conf.nb_samples;
    return 0;
 }
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -326,7 +326,7 @@ void *st_rate_start (int inrate, int outrate)

 void st_rate_stop (void *opaque)
 {
-    g_free (opaque);
+    qemu_free (opaque);
 }

 void mixeng_clear (struct st_sample *buf, int len)
--- a/audio/mixeng_template.h
+++ b/audio/mixeng_template.h
@@ -46,7 +46,7 @@ static mixeng_real inline glue (conv_, ET) (IN_T v)
 #endif
 #else  /* !RECIPROCAL */
 #ifdef SIGNED
-    return nv / (mixeng_real) ((mixeng_real) IN_MAX - IN_MIN);
+    return nv / (mixeng_real) (IN_MAX - IN_MIN);
 #else
    return (nv - HALF) / (mixeng_real) IN_MAX;
 #endif
@@ -63,7 +63,7 @@ static IN_T inline glue (clip_, ET) (mixeng_real v)
    }

 #ifdef SIGNED
-    return ENDIAN_CONVERT ((IN_T) (v * ((mixeng_real) IN_MAX - IN_MIN)));
+    return ENDIAN_CONVERT ((IN_T) (v * (IN_MAX - IN_MIN)));
 #else
    return ENDIAN_CONVERT ((IN_T) ((v * IN_MAX) + HALF));
 #endif
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -46,7 +46,7 @@ static int no_run_out (HWVoiceOut *hw, int live)
    int64_t ticks;
    int64_t bytes;

-    now = qemu_get_clock_ns (vm_clock);
+    now = qemu_get_clock (vm_clock);
    ticks = now - no->old_ticks;
    bytes = muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
    bytes = audio_MIN (bytes, INT_MAX);
@@ -102,7 +102,7 @@ static int no_run_in (HWVoiceIn *hw)
    int samples = 0;

    if (dead) {
-        int64_t now = qemu_get_clock_ns (vm_clock);
+        int64_t now = qemu_get_clock (vm_clock);
        int64_t ticks = now - no->old_ticks;
        int64_t bytes =
            muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -508,7 +508,7 @@ static void oss_fini_out (HWVoiceOut *hw)
            }
        }
        else {
-            g_free (oss->pcm_buf);
+            qemu_free (oss->pcm_buf);
        }
        oss->pcm_buf = NULL;
    }
@@ -741,7 +741,7 @@ static void oss_fini_in (HWVoiceIn *hw)
    oss_anal_close (&oss->fd);

    if (oss->pcm_buf) {
-        g_free (oss->pcm_buf);
+        qemu_free (oss->pcm_buf);
        oss->pcm_buf = NULL;
    }
 }
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -339,7 +339,7 @@ static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
    return 0;

 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
    pa_simple_free (pa->s);
@@ -394,7 +394,7 @@ static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)
    return 0;

 fail3:
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
    pa_simple_free (pa->s);
@@ -419,7 +419,7 @@ static void qpa_fini_out (HWVoiceOut *hw)
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }

@@ -439,7 +439,7 @@ static void qpa_fini_in (HWVoiceIn *hw)
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
-    g_free (pa->pcm_buf);
+    qemu_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }

--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -32,6 +32,7 @@
 #elif defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__)
 #include <pthread.h>
 #endif
+#include <signal.h>
 #endif

 #define AUDIO_CAP "sdl"
@@ -138,36 +139,36 @@ static int aud_to_sdlfmt (audfmt_e fmt)
    }
 }

-static int sdl_to_audfmt(int sdlfmt, audfmt_e *fmt, int *endianness)
+static int sdl_to_audfmt (int sdlfmt, audfmt_e *fmt, int *endianess)
 {
    switch (sdlfmt) {
    case AUDIO_S8:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_S8;
        break;

    case AUDIO_U8:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_U8;
        break;

    case AUDIO_S16LSB:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_S16;
        break;

    case AUDIO_U16LSB:
-        *endianness = 0;
+        *endianess = 0;
        *fmt = AUD_FMT_U16;
        break;

    case AUDIO_S16MSB:
-        *endianness = 1;
+        *endianess = 1;
        *fmt = AUD_FMT_S16;
        break;

    case AUDIO_U16MSB:
-        *endianness = 1;
+        *endianess = 1;
        *fmt = AUD_FMT_U16;
        break;

@@ -337,7 +338,7 @@ static int sdl_init_out (HWVoiceOut *hw, struct audsettings *as)
    SDLVoiceOut *sdl = (SDLVoiceOut *) hw;
    SDLAudioState *s = &glob_sdl;
    SDL_AudioSpec req, obt;
-    int endianness;
+    int endianess;
    int err;
    audfmt_e effective_fmt;
    struct audsettings obt_as;
@@ -353,7 +354,7 @@ static int sdl_init_out (HWVoiceOut *hw, struct audsettings *as)
        return -1;
    }

-    err = sdl_to_audfmt(obt.format, &effective_fmt, &endianness);
+    err = sdl_to_audfmt (obt.format, &effective_fmt, &endianess);
    if (err) {
        sdl_close (s);
        return -1;
@@ -362,7 +363,7 @@ static int sdl_init_out (HWVoiceOut *hw, struct audsettings *as)
    obt_as.freq = obt.freq;
    obt_as.nchannels = obt.channels;
    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
+    obt_as.endianness = endianess;

    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = obt.samples;
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -81,7 +81,7 @@ static void spice_audio_fini (void *opaque)
 static void rate_start (SpiceRateCtl *rate)
 {
    memset (rate, 0, sizeof (*rate));
-    rate->start_ticks = qemu_get_clock_ns (vm_clock);
+    rate->start_ticks = qemu_get_clock (vm_clock);
 }

 static int rate_get_samples (struct audio_pcm_info *info, SpiceRateCtl *rate)
@@ -91,7 +91,7 @@ static int rate_get_samples (struct audio_pcm_info *info, SpiceRateCtl *rate)
    int64_t bytes;
    int64_t samples;

-    now = qemu_get_clock_ns (vm_clock);
+    now = qemu_get_clock (vm_clock);
    ticks = now - rate->start_ticks;
    bytes = muldiv64 (ticks, info->bytes_per_second, get_ticks_per_sec ());
    samples = (bytes - rate->bytes_sent) >> info->shift;
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -30,7 +30,7 @@

 typedef struct WAVVoiceOut {
    HWVoiceOut hw;
-    FILE *f;
+    QEMUFile *f;
    int64_t old_ticks;
    void *pcm_buf;
    int total_samples;
@@ -52,7 +52,7 @@ static int wav_run_out (HWVoiceOut *hw, int live)
    int rpos, decr, samples;
    uint8_t *dst;
    struct st_sample *src;
-    int64_t now = qemu_get_clock_ns (vm_clock);
+    int64_t now = qemu_get_clock (vm_clock);
    int64_t ticks = now - wav->old_ticks;
    int64_t bytes =
        muldiv64 (ticks, hw->info.bytes_per_second, get_ticks_per_sec ());
@@ -76,10 +76,7 @@ static int wav_run_out (HWVoiceOut *hw, int live)
        dst = advance (wav->pcm_buf, rpos << hw->info.shift);

        hw->clip (dst, src, convert_samples);
-        if (fwrite (dst, convert_samples << hw->info.shift, 1, wav->f) != 1) {
-            dolog ("wav_run_out: fwrite of %d bytes failed\nReaons: %s\n",
-                   convert_samples << hw->info.shift, strerror (errno));
-        }
+        qemu_put_buffer (wav->f, dst, convert_samples << hw->info.shift);

        rpos = (rpos + convert_samples) % hw->samples;
        samples -= convert_samples;
@@ -155,20 +152,16 @@ static int wav_init_out (HWVoiceOut *hw, struct audsettings *as)
    le_store (hdr + 28, hw->info.freq << (bits16 + stereo), 4);
    le_store (hdr + 32, 1 << (bits16 + stereo), 2);

-    wav->f = fopen (conf.wav_path, "wb");
+    wav->f = qemu_fopen (conf.wav_path, "wb");
    if (!wav->f) {
        dolog ("Failed to open wave file `%s'\nReason: %s\n",
               conf.wav_path, strerror (errno));
-        g_free (wav->pcm_buf);
+        qemu_free (wav->pcm_buf);
        wav->pcm_buf = NULL;
        return -1;
    }

-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        dolog ("wav_init_out: failed to write header\nReason: %s\n",
-               strerror(errno));
-        return -1;
-    }
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));
    return 0;
 }

@@ -187,35 +180,16 @@ static void wav_fini_out (HWVoiceOut *hw)
    le_store (rlen, rifflen, 4);
    le_store (dlen, datalen, 4);

-    if (fseek (wav->f, 4, SEEK_SET)) {
-        dolog ("wav_fini_out: fseek to rlen failed\nReason: %s\n",
-               strerror(errno));
-        goto doclose;
-    }
-    if (fwrite (rlen, 4, 1, wav->f) != 1) {
-        dolog ("wav_fini_out: failed to write rlen\nReason: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
-    if (fseek (wav->f, 32, SEEK_CUR)) {
-        dolog ("wav_fini_out: fseek to dlen failed\nReason: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
-    if (fwrite (dlen, 4, 1, wav->f) != 1) {
-        dolog ("wav_fini_out: failed to write dlen\nReaons: %s\n",
-               strerror (errno));
-        goto doclose;
-    }
+    qemu_fseek (wav->f, 4, SEEK_SET);
+    qemu_put_buffer (wav->f, rlen, 4);

- doclose:
-    if (fclose (wav->f))  {
-        dolog ("wav_fini_out: fclose %p failed\nReason: %s\n",
-               wav->f, strerror (errno));
-    }
+    qemu_fseek (wav->f, 32, SEEK_CUR);
+    qemu_put_buffer (wav->f, dlen, 4);
+
+    qemu_fclose (wav->f);
    wav->f = NULL;

-    g_free (wav->pcm_buf);
+    qemu_free (wav->pcm_buf);
    wav->pcm_buf = NULL;
 }

--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -3,7 +3,7 @@
 #include "audio.h"

 typedef struct {
-    FILE *f;
+    QEMUFile *f;
    int bytes;
    char *path;
    int freq;
@@ -35,50 +35,27 @@ static void wav_destroy (void *opaque)
    uint8_t dlen[4];
    uint32_t datalen = wav->bytes;
    uint32_t rifflen = datalen + 36;
-    Monitor *mon = cur_mon;

    if (wav->f) {
        le_store (rlen, rifflen, 4);
        le_store (dlen, datalen, 4);

-        if (fseek (wav->f, 4, SEEK_SET)) {
-            monitor_printf (mon, "wav_destroy: rlen fseek failed\nReason: %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fwrite (rlen, 4, 1, wav->f) != 1) {
-            monitor_printf (mon, "wav_destroy: rlen fwrite failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fseek (wav->f, 32, SEEK_CUR)) {
-            monitor_printf (mon, "wav_destroy: dlen fseek failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-        if (fwrite (dlen, 1, 4, wav->f) != 4) {
-            monitor_printf (mon, "wav_destroy: dlen fwrite failed\nReason %s\n",
-                            strerror (errno));
-            goto doclose;
-        }
-    doclose:
-        if (fclose (wav->f)) {
-            fprintf (stderr, "wav_destroy: fclose failed: %s",
-                     strerror (errno));
-        }
+        qemu_fseek (wav->f, 4, SEEK_SET);
+        qemu_put_buffer (wav->f, rlen, 4);
+
+        qemu_fseek (wav->f, 32, SEEK_CUR);
+        qemu_put_buffer (wav->f, dlen, 4);
+        qemu_fclose (wav->f);
    }

-    g_free (wav->path);
+    qemu_free (wav->path);
 }

 static void wav_capture (void *opaque, void *buf, int size)
 {
    WAVState *wav = opaque;

-    if (fwrite (buf, size, 1, wav->f) != 1) {
-        monitor_printf (cur_mon, "wav_capture: fwrite error\nReason: %s",
-                        strerror (errno));
-    }
+    qemu_put_buffer (wav->f, buf, size);
    wav->bytes += size;
 }

@@ -94,9 +71,9 @@ static void wav_capture_info (void *opaque)
    WAVState *wav = opaque;
    char *path = wav->path;

-    monitor_printf (cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
-                    wav->freq, wav->bits, wav->nchannels,
-                    path ? path : "<not available>", wav->bytes);
+    monitor_printf(cur_mon, "Capturing audio(%d,%d,%d) to %s: %d bytes\n",
+                   wav->freq, wav->bits, wav->nchannels,
+                   path ? path : "<not available>", wav->bytes);
 }

 static struct capture_ops wav_capture_ops = {
@@ -121,13 +98,13 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    CaptureVoiceOut *cap;

    if (bits != 8 && bits != 16) {
-        monitor_printf (mon, "incorrect bit count %d, must be 8 or 16\n", bits);
+        monitor_printf(mon, "incorrect bit count %d, must be 8 or 16\n", bits);
        return -1;
    }

    if (nchannels != 1 && nchannels != 2) {
-        monitor_printf (mon, "incorrect channel count %d, must be 1 or 2\n",
-                        nchannels);
+        monitor_printf(mon, "incorrect channel count %d, must be 1 or 2\n",
+                       nchannels);
        return -1;
    }

@@ -143,7 +120,7 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    ops.capture = wav_capture;
    ops.destroy = wav_destroy;

-    wav = g_malloc0 (sizeof (*wav));
+    wav = qemu_mallocz (sizeof (*wav));

    shift = bits16 + stereo;
    hdr[34] = bits16 ? 0x10 : 0x08;
@@ -153,42 +130,32 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    le_store (hdr + 28, freq << shift, 4);
    le_store (hdr + 32, 1 << shift, 2);

-    wav->f = fopen (path, "wb");
+    wav->f = qemu_fopen (path, "wb");
    if (!wav->f) {
-        monitor_printf (mon, "Failed to open wave file `%s'\nReason: %s\n",
-                        path, strerror (errno));
-        g_free (wav);
+        monitor_printf(mon, "Failed to open wave file `%s'\nReason: %s\n",
+                       path, strerror (errno));
+        qemu_free (wav);
        return -1;
    }

-    wav->path = g_strdup (path);
+    wav->path = qemu_strdup (path);
    wav->bits = bits;
    wav->nchannels = nchannels;
    wav->freq = freq;

-    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        monitor_printf (mon, "Failed to write header\nReason: %s\n",
-                        strerror (errno));
-        goto error_free;
-    }
+    qemu_put_buffer (wav->f, hdr, sizeof (hdr));

    cap = AUD_add_capture (&as, &ops, wav);
    if (!cap) {
-        monitor_printf (mon, "Failed to add audio capture\n");
-        goto error_free;
+        monitor_printf(mon, "Failed to add audio capture\n");
+        qemu_free (wav->path);
+        qemu_fclose (wav->f);
+        qemu_free (wav);
+        return -1;
    }

    wav->cap = cap;
    s->opaque = wav;
    s->ops = wav_capture_ops;
    return 0;
-
-error_free:
-    g_free (wav->path);
-    if (fclose (wav->f)) {
-        monitor_printf (mon, "Failed to close wave file\nReason: %s\n",
-                        strerror (errno));
-    }
-    g_free (wav);
-    return -1;
 }
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -222,9 +222,9 @@ static int winwave_init_out (HWVoiceOut *hw, struct audsettings *as)
    return 0;

 err4:
-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
 err3:
-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_out (wave);
 err1:
@@ -310,10 +310,10 @@ static void winwave_fini_out (HWVoiceOut *hw)
        wave->event = NULL;
    }

-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;

-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }

@@ -511,9 +511,9 @@ static int winwave_init_in (HWVoiceIn *hw, struct audsettings *as)
    return 0;

 err4:
-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
 err3:
-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
 err2:
    winwave_anal_close_in (wave);
 err1:
@@ -550,10 +550,10 @@ static void winwave_fini_in (HWVoiceIn *hw)
        wave->event = NULL;
    }

-    g_free (wave->pcm_buf);
+    qemu_free (wave->pcm_buf);
    wave->pcm_buf = NULL;

-    g_free (wave->hdrs);
+    qemu_free (wave->hdrs);
    wave->hdrs = NULL;
 }

--- a/balloon.c
+++ b/balloon.c
@@ -1,9 +1,7 @@
 /*
- * Generic Balloon handlers and management
+ * QEMU System Emulator
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
- * Copyright (C) 2011 Red Hat, Inc.
- * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -24,80 +22,106 @@
 * THE SOFTWARE.
 */

+#include "sysemu.h"
 #include "monitor.h"
+#include "qjson.h"
+#include "qint.h"
 #include "cpu-common.h"
 #include "kvm.h"
 #include "balloon.h"
 #include "trace.h"
-#include "qmp-commands.h"

-static QEMUBalloonEvent *balloon_event_fn;
-static QEMUBalloonStatus *balloon_stat_fn;
-static void *balloon_opaque;

-int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
-                             QEMUBalloonStatus *stat_func, void *opaque)
+static QEMUBalloonEvent *qemu_balloon_event;
+void *qemu_balloon_event_opaque;
+
+void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque)
 {
-    if (balloon_event_fn || balloon_stat_fn || balloon_opaque) {
-        /* We're already registered one balloon handler.  How many can
-         * a guest really have?
-         */
-        error_report("Another balloon device already registered");
-        return -1;
-    }
-    balloon_event_fn = event_func;
-    balloon_stat_fn = stat_func;
-    balloon_opaque = opaque;
-    return 0;
+    qemu_balloon_event = func;
+    qemu_balloon_event_opaque = opaque;
 }

-void qemu_remove_balloon_handler(void *opaque)
+int qemu_balloon(ram_addr_t target, MonitorCompletion cb, void *opaque)
 {
-    if (balloon_opaque != opaque) {
+    if (qemu_balloon_event) {
+        trace_balloon_event(qemu_balloon_event_opaque, target);
+        qemu_balloon_event(qemu_balloon_event_opaque, target, cb, opaque);
+        return 1;
+    } else {
+        return 0;
+    }
+}
+
+int qemu_balloon_status(MonitorCompletion cb, void *opaque)
+{
+    if (qemu_balloon_event) {
+        qemu_balloon_event(qemu_balloon_event_opaque, 0, cb, opaque);
+        return 1;
+    } else {
+        return 0;
+    }
+}
+
+static void print_balloon_stat(const char *key, QObject *obj, void *opaque)
+{
+    Monitor *mon = opaque;
+
+    if (strcmp(key, "actual"))
+        monitor_printf(mon, ",%s=%" PRId64, key,
+                       qint_get_int(qobject_to_qint(obj)));
+}
+
+void monitor_print_balloon(Monitor *mon, const QObject *data)
+{
+    QDict *qdict;
+
+    qdict = qobject_to_qdict(data);
+    if (!qdict_haskey(qdict, "actual"))
        return;
-    }
-    balloon_event_fn = NULL;
-    balloon_stat_fn = NULL;
-    balloon_opaque = NULL;
+
+    monitor_printf(mon, "balloon: actual=%" PRId64,
+                   qdict_get_int(qdict, "actual") >> 20);
+    qdict_iter(qdict, print_balloon_stat, mon);
+    monitor_printf(mon, "\n");
 }

-static int qemu_balloon(ram_addr_t target)
+/**
+ * do_info_balloon(): Balloon information
+ *
+ * Make an asynchronous request for balloon info.  When the request completes
+ * a QDict will be returned according to the following specification:
+ *
+ * - "actual": current balloon value in bytes
+ * The following fields may or may not be present:
+ * - "mem_swapped_in": Amount of memory swapped in (bytes)
+ * - "mem_swapped_out": Amount of memory swapped out (bytes)
+ * - "major_page_faults": Number of major faults
+ * - "minor_page_faults": Number of minor faults
+ * - "free_mem": Total amount of free and unused memory (bytes)
+ * - "total_mem": Total amount of available memory (bytes)
+ *
+ * Example:
+ *
+ * { "actual": 1073741824, "mem_swapped_in": 0, "mem_swapped_out": 0,
+ *   "major_page_faults": 142, "minor_page_faults": 239245,
+ *   "free_mem": 1014185984, "total_mem": 1044668416 }
+ */
+int do_info_balloon(Monitor *mon, MonitorCompletion cb, void *opaque)
 {
-    if (!balloon_event_fn) {
-        return 0;
-    }
-    trace_balloon_event(balloon_opaque, target);
-    balloon_event_fn(balloon_opaque, target);
-    return 1;
-}
-
-static int qemu_balloon_status(BalloonInfo *info)
-{
-    if (!balloon_stat_fn) {
-        return 0;
-    }
-    balloon_stat_fn(balloon_opaque, info);
-    return 1;
-}
-
-BalloonInfo *qmp_query_balloon(Error **errp)
-{
-    BalloonInfo *info;
+    int ret;

    if (kvm_enabled() && !kvm_has_sync_mmu()) {
-        error_set(errp, QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
-        return NULL;
+        qerror_report(QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
+        return -1;
    }

-    info = g_malloc0(sizeof(*info));
-
-    if (qemu_balloon_status(info) == 0) {
-        error_set(errp, QERR_DEVICE_NOT_ACTIVE, "balloon");
-        qapi_free_BalloonInfo(info);
-        return NULL;
+    ret = qemu_balloon_status(cb, opaque);
+    if (!ret) {
+        qerror_report(QERR_DEVICE_NOT_ACTIVE, "balloon");
+        return -1;
    }

-    return info;
+    return 0;
 }

 /**
@@ -106,7 +130,6 @@ BalloonInfo *qmp_query_balloon(Error **errp)
 int do_balloon(Monitor *mon, const QDict *params,
 	       MonitorCompletion cb, void *opaque)
 {
-    int64_t target;
    int ret;

    if (kvm_enabled() && !kvm_has_sync_mmu()) {
@@ -114,12 +137,7 @@ int do_balloon(Monitor *mon, const QDict *params,
        return -1;
    }

-    target = qdict_get_int(params, "value");
-    if (target <= 0) {
-        qerror_report(QERR_INVALID_PARAMETER_VALUE, "target", "a size");
-        return -1;
-    }
-    ret = qemu_balloon(target);
+    ret = qemu_balloon(qdict_get_int(params, "value"), cb, opaque);
    if (ret == 0) {
        qerror_report(QERR_DEVICE_NOT_ACTIVE, "balloon");
        return -1;
--- a/balloon.h
+++ b/balloon.h
@@ -15,15 +15,18 @@
 #define _QEMU_BALLOON_H

 #include "monitor.h"
-#include "qapi-types.h"

-typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
-typedef void (QEMUBalloonStatus)(void *opaque, BalloonInfo *info);
+typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target,
+                                MonitorCompletion cb, void *cb_data);

-int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
-			     QEMUBalloonStatus *stat_func, void *opaque);
-void qemu_remove_balloon_handler(void *opaque);
+void qemu_add_balloon_handler(QEMUBalloonEvent *func, void *opaque);

+int qemu_balloon(ram_addr_t target, MonitorCompletion cb, void *opaque);
+
+int qemu_balloon_status(MonitorCompletion cb, void *opaque);
+
+void monitor_print_balloon(Monitor *mon, const QObject *data);
+int do_info_balloon(Monitor *mon, MonitorCompletion cb, void *opaque);
 int do_balloon(Monitor *mon, const QDict *params,
               MonitorCompletion cb, void *opaque);

--- a/bitmap.c
+++ b/bitmap.c
@@ -1,256 +0,0 @@
-/*
- * Bitmap Module
- *
- * Stolen from linux/src/lib/bitmap.c
- *
- * Copyright (C) 2010 Corentin Chary
- *
- * This source code is licensed under the GNU General Public License,
- * Version 2.
- */
-
-#include "bitops.h"
-#include "bitmap.h"
-
-/*
- * bitmaps provide an array of bits, implemented using an an
- * array of unsigned longs.  The number of valid bits in a
- * given bitmap does _not_ need to be an exact multiple of
- * BITS_PER_LONG.
- *
- * The possible unused bits in the last, partially used word
- * of a bitmap are 'don't care'.  The implementation makes
- * no particular effort to keep them zero.  It ensures that
- * their value will not affect the results of any operation.
- * The bitmap operations that return Boolean (bitmap_empty,
- * for example) or scalar (bitmap_weight, for example) results
- * carefully filter out these unused bits from impacting their
- * results.
- *
- * These operations actually hold to a slightly stronger rule:
- * if you don't input any bitmaps to these ops that have some
- * unused bits set, then they won't output any set unused bits
- * in output bitmaps.
- *
- * The byte ordering of bitmaps is more natural on little
- * endian architectures.
- */
-
-int slow_bitmap_empty(const unsigned long *bitmap, int bits)
-{
-    int k, lim = bits/BITS_PER_LONG;
-
-    for (k = 0; k < lim; ++k) {
-        if (bitmap[k]) {
-            return 0;
-        }
-    }
-    if (bits % BITS_PER_LONG) {
-        if (bitmap[k] & BITMAP_LAST_WORD_MASK(bits)) {
-            return 0;
-        }
-    }
-
-    return 1;
-}
-
-int slow_bitmap_full(const unsigned long *bitmap, int bits)
-{
-    int k, lim = bits/BITS_PER_LONG;
-
-    for (k = 0; k < lim; ++k) {
-        if (~bitmap[k]) {
-            return 0;
-        }
-    }
-
-    if (bits % BITS_PER_LONG) {
-        if (~bitmap[k] & BITMAP_LAST_WORD_MASK(bits)) {
-            return 0;
-        }
-    }
-
-    return 1;
-}
-
-int slow_bitmap_equal(const unsigned long *bitmap1,
-                      const unsigned long *bitmap2, int bits)
-{
-    int k, lim = bits/BITS_PER_LONG;
-
-    for (k = 0; k < lim; ++k) {
-        if (bitmap1[k] != bitmap2[k]) {
-            return 0;
-        }
-    }
-
-    if (bits % BITS_PER_LONG) {
-        if ((bitmap1[k] ^ bitmap2[k]) & BITMAP_LAST_WORD_MASK(bits)) {
-            return 0;
-        }
-    }
-
-    return 1;
-}
-
-void slow_bitmap_complement(unsigned long *dst, const unsigned long *src,
-                            int bits)
-{
-    int k, lim = bits/BITS_PER_LONG;
-
-    for (k = 0; k < lim; ++k) {
-        dst[k] = ~src[k];
-    }
-
-    if (bits % BITS_PER_LONG) {
-        dst[k] = ~src[k] & BITMAP_LAST_WORD_MASK(bits);
-    }
-}
-
-int slow_bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
-                    const unsigned long *bitmap2, int bits)
-{
-    int k;
-    int nr = BITS_TO_LONGS(bits);
-    unsigned long result = 0;
-
-    for (k = 0; k < nr; k++) {
-        result |= (dst[k] = bitmap1[k] & bitmap2[k]);
-    }
-    return result != 0;
-}
-
-void slow_bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
-                    const unsigned long *bitmap2, int bits)
-{
-    int k;
-    int nr = BITS_TO_LONGS(bits);
-
-    for (k = 0; k < nr; k++) {
-        dst[k] = bitmap1[k] | bitmap2[k];
-    }
-}
-
-void slow_bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
-                     const unsigned long *bitmap2, int bits)
-{
-    int k;
-    int nr = BITS_TO_LONGS(bits);
-
-    for (k = 0; k < nr; k++) {
-        dst[k] = bitmap1[k] ^ bitmap2[k];
-    }
-}
-
-int slow_bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
-                       const unsigned long *bitmap2, int bits)
-{
-    int k;
-    int nr = BITS_TO_LONGS(bits);
-    unsigned long result = 0;
-
-    for (k = 0; k < nr; k++) {
-        result |= (dst[k] = bitmap1[k] & ~bitmap2[k]);
-    }
-    return result != 0;
-}
-
-#define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) % BITS_PER_LONG))
-
-void bitmap_set(unsigned long *map, int start, int nr)
-{
-    unsigned long *p = map + BIT_WORD(start);
-    const int size = start + nr;
-    int bits_to_set = BITS_PER_LONG - (start % BITS_PER_LONG);
-    unsigned long mask_to_set = BITMAP_FIRST_WORD_MASK(start);
-
-    while (nr - bits_to_set >= 0) {
-        *p |= mask_to_set;
-        nr -= bits_to_set;
-        bits_to_set = BITS_PER_LONG;
-        mask_to_set = ~0UL;
-        p++;
-    }
-    if (nr) {
-        mask_to_set &= BITMAP_LAST_WORD_MASK(size);
-        *p |= mask_to_set;
-    }
-}
-
-void bitmap_clear(unsigned long *map, int start, int nr)
-{
-    unsigned long *p = map + BIT_WORD(start);
-    const int size = start + nr;
-    int bits_to_clear = BITS_PER_LONG - (start % BITS_PER_LONG);
-    unsigned long mask_to_clear = BITMAP_FIRST_WORD_MASK(start);
-
-    while (nr - bits_to_clear >= 0) {
-        *p &= ~mask_to_clear;
-        nr -= bits_to_clear;
-        bits_to_clear = BITS_PER_LONG;
-        mask_to_clear = ~0UL;
-        p++;
-    }
-    if (nr) {
-        mask_to_clear &= BITMAP_LAST_WORD_MASK(size);
-        *p &= ~mask_to_clear;
-    }
-}
-
-#define ALIGN_MASK(x,mask)      (((x)+(mask))&~(mask))
-
-/**
- * bitmap_find_next_zero_area - find a contiguous aligned zero area
- * @map: The address to base the search on
- * @size: The bitmap size in bits
- * @start: The bitnumber to start searching at
- * @nr: The number of zeroed bits we're looking for
- * @align_mask: Alignment mask for zero area
- *
- * The @align_mask should be one less than a power of 2; the effect is that
- * the bit offset of all zero areas this function finds is multiples of that
- * power of 2. A @align_mask of 0 means no alignment is required.
- */
-unsigned long bitmap_find_next_zero_area(unsigned long *map,
-					 unsigned long size,
-					 unsigned long start,
-					 unsigned int nr,
-					 unsigned long align_mask)
-{
-    unsigned long index, end, i;
-again:
-    index = find_next_zero_bit(map, size, start);
-
-    /* Align allocation */
-    index = ALIGN_MASK(index, align_mask);
-
-    end = index + nr;
-    if (end > size) {
-        return end;
-    }
-    i = find_next_bit(map, end, index);
-    if (i < end) {
-        start = i + 1;
-        goto again;
-    }
-    return index;
-}
-
-int slow_bitmap_intersects(const unsigned long *bitmap1,
-                           const unsigned long *bitmap2, int bits)
-{
-    int k, lim = bits/BITS_PER_LONG;
-
-    for (k = 0; k < lim; ++k) {
-        if (bitmap1[k] & bitmap2[k]) {
-            return 1;
-        }
-    }
-
-    if (bits % BITS_PER_LONG) {
-        if ((bitmap1[k] & bitmap2[k]) & BITMAP_LAST_WORD_MASK(bits)) {
-            return 1;
-        }
-    }
-    return 0;
-}
--- a/bitmap.h
+++ b/bitmap.h
@@ -1,222 +0,0 @@
-/*
- * Bitmap Module
- *
- * Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
- *
- * Mostly inspired by (stolen from) linux/bitmap.h and linux/bitops.h
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING.LIB file in the top-level directory.
- */
-
-#ifndef BITMAP_H
-#define BITMAP_H
-
-#include "qemu-common.h"
-#include "bitops.h"
-
-/*
- * The available bitmap operations and their rough meaning in the
- * case that the bitmap is a single unsigned long are thus:
- *
- * Note that nbits should be always a compile time evaluable constant.
- * Otherwise many inlines will generate horrible code.
- *
- * bitmap_zero(dst, nbits)			*dst = 0UL
- * bitmap_fill(dst, nbits)			*dst = ~0UL
- * bitmap_copy(dst, src, nbits)			*dst = *src
- * bitmap_and(dst, src1, src2, nbits)		*dst = *src1 & *src2
- * bitmap_or(dst, src1, src2, nbits)		*dst = *src1 | *src2
- * bitmap_xor(dst, src1, src2, nbits)		*dst = *src1 ^ *src2
- * bitmap_andnot(dst, src1, src2, nbits)	*dst = *src1 & ~(*src2)
- * bitmap_complement(dst, src, nbits)		*dst = ~(*src)
- * bitmap_equal(src1, src2, nbits)		Are *src1 and *src2 equal?
- * bitmap_intersects(src1, src2, nbits) 	Do *src1 and *src2 overlap?
- * bitmap_empty(src, nbits)			Are all bits zero in *src?
- * bitmap_full(src, nbits)			Are all bits set in *src?
- * bitmap_set(dst, pos, nbits)			Set specified bit area
- * bitmap_clear(dst, pos, nbits)		Clear specified bit area
- * bitmap_find_next_zero_area(buf, len, pos, n, mask)	Find bit free area
- */
-
-/*
- * Also the following operations apply to bitmaps.
- *
- * set_bit(bit, addr)			*addr |= bit
- * clear_bit(bit, addr)			*addr &= ~bit
- * change_bit(bit, addr)		*addr ^= bit
- * test_bit(bit, addr)			Is bit set in *addr?
- * test_and_set_bit(bit, addr)		Set bit and return old value
- * test_and_clear_bit(bit, addr)	Clear bit and return old value
- * test_and_change_bit(bit, addr)	Change bit and return old value
- * find_first_zero_bit(addr, nbits)	Position first zero bit in *addr
- * find_first_bit(addr, nbits)		Position first set bit in *addr
- * find_next_zero_bit(addr, nbits, bit)	Position next zero bit in *addr >= bit
- * find_next_bit(addr, nbits, bit)	Position next set bit in *addr >= bit
- */
-
-#define BITMAP_LAST_WORD_MASK(nbits)                                    \
-    (                                                                   \
-        ((nbits) % BITS_PER_LONG) ?                                     \
-        (1UL<<((nbits) % BITS_PER_LONG))-1 : ~0UL                       \
-        )
-
-#define DECLARE_BITMAP(name,bits)                  \
-	unsigned long name[BITS_TO_LONGS(bits)]
-
-#define small_nbits(nbits)                      \
-	((nbits) <= BITS_PER_LONG)
-
-int slow_bitmap_empty(const unsigned long *bitmap, int bits);
-int slow_bitmap_full(const unsigned long *bitmap, int bits);
-int slow_bitmap_equal(const unsigned long *bitmap1,
-                   const unsigned long *bitmap2, int bits);
-void slow_bitmap_complement(unsigned long *dst, const unsigned long *src,
-                         int bits);
-void slow_bitmap_shift_right(unsigned long *dst,
-                          const unsigned long *src, int shift, int bits);
-void slow_bitmap_shift_left(unsigned long *dst,
-                         const unsigned long *src, int shift, int bits);
-int slow_bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
-                 const unsigned long *bitmap2, int bits);
-void slow_bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
-                 const unsigned long *bitmap2, int bits);
-void slow_bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
-                  const unsigned long *bitmap2, int bits);
-int slow_bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
-                    const unsigned long *bitmap2, int bits);
-int slow_bitmap_intersects(const unsigned long *bitmap1,
-			const unsigned long *bitmap2, int bits);
-
-static inline unsigned long *bitmap_new(int nbits)
-{
-    int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-    return g_malloc0(len);
-}
-
-static inline void bitmap_zero(unsigned long *dst, int nbits)
-{
-    if (small_nbits(nbits)) {
-        *dst = 0UL;
-    } else {
-        int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-        memset(dst, 0, len);
-    }
-}
-
-static inline void bitmap_fill(unsigned long *dst, int nbits)
-{
-    size_t nlongs = BITS_TO_LONGS(nbits);
-    if (!small_nbits(nbits)) {
-        int len = (nlongs - 1) * sizeof(unsigned long);
-        memset(dst, 0xff,  len);
-    }
-    dst[nlongs - 1] = BITMAP_LAST_WORD_MASK(nbits);
-}
-
-static inline void bitmap_copy(unsigned long *dst, const unsigned long *src,
-                               int nbits)
-{
-    if (small_nbits(nbits)) {
-        *dst = *src;
-    } else {
-        int len = BITS_TO_LONGS(nbits) * sizeof(unsigned long);
-        memcpy(dst, src, len);
-    }
-}
-
-static inline int bitmap_and(unsigned long *dst, const unsigned long *src1,
-                             const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return (*dst = *src1 & *src2) != 0;
-    }
-    return slow_bitmap_and(dst, src1, src2, nbits);
-}
-
-static inline void bitmap_or(unsigned long *dst, const unsigned long *src1,
-			const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        *dst = *src1 | *src2;
-    } else {
-        slow_bitmap_or(dst, src1, src2, nbits);
-    }
-}
-
-static inline void bitmap_xor(unsigned long *dst, const unsigned long *src1,
-			const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        *dst = *src1 ^ *src2;
-    } else {
-        slow_bitmap_xor(dst, src1, src2, nbits);
-    }
-}
-
-static inline int bitmap_andnot(unsigned long *dst, const unsigned long *src1,
-			const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return (*dst = *src1 & ~(*src2)) != 0;
-    }
-    return slow_bitmap_andnot(dst, src1, src2, nbits);
-}
-
-static inline void bitmap_complement(unsigned long *dst, const unsigned long *src,
-			int nbits)
-{
-    if (small_nbits(nbits)) {
-        *dst = ~(*src) & BITMAP_LAST_WORD_MASK(nbits);
-    } else {
-        slow_bitmap_complement(dst, src, nbits);
-    }
-}
-
-static inline int bitmap_equal(const unsigned long *src1,
-			const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return ! ((*src1 ^ *src2) & BITMAP_LAST_WORD_MASK(nbits));
-    } else {
-        return slow_bitmap_equal(src1, src2, nbits);
-    }
-}
-
-static inline int bitmap_empty(const unsigned long *src, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return ! (*src & BITMAP_LAST_WORD_MASK(nbits));
-    } else {
-        return slow_bitmap_empty(src, nbits);
-    }
-}
-
-static inline int bitmap_full(const unsigned long *src, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return ! (~(*src) & BITMAP_LAST_WORD_MASK(nbits));
-    } else {
-        return slow_bitmap_full(src, nbits);
-    }
-}
-
-static inline int bitmap_intersects(const unsigned long *src1,
-			const unsigned long *src2, int nbits)
-{
-    if (small_nbits(nbits)) {
-        return ((*src1 & *src2) & BITMAP_LAST_WORD_MASK(nbits)) != 0;
-    } else {
-        return slow_bitmap_intersects(src1, src2, nbits);
-    }
-}
-
-void bitmap_set(unsigned long *map, int i, int len);
-void bitmap_clear(unsigned long *map, int start, int nr);
-unsigned long bitmap_find_next_zero_area(unsigned long *map,
-					 unsigned long size,
-					 unsigned long start,
-					 unsigned int nr,
-					 unsigned long align_mask);
-
-#endif /* BITMAP_H */
--- a/bitops.c
+++ b/bitops.c
@@ -1,142 +0,0 @@
-/*
- * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- * Copyright (C) 2008 IBM Corporation
- * Written by Rusty Russell <rusty@rustcorp.com.au>
- * (Inspired by David Howell's find_next_bit implementation)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include "bitops.h"
-
-#define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)
-
-/*
- * Find the next set bit in a memory region.
- */
-unsigned long find_next_bit(const unsigned long *addr, unsigned long size,
-			    unsigned long offset)
-{
-    const unsigned long *p = addr + BITOP_WORD(offset);
-    unsigned long result = offset & ~(BITS_PER_LONG-1);
-    unsigned long tmp;
-
-    if (offset >= size) {
-        return size;
-    }
-    size -= result;
-    offset %= BITS_PER_LONG;
-    if (offset) {
-        tmp = *(p++);
-        tmp &= (~0UL << offset);
-        if (size < BITS_PER_LONG) {
-            goto found_first;
-        }
-        if (tmp) {
-            goto found_middle;
-        }
-        size -= BITS_PER_LONG;
-        result += BITS_PER_LONG;
-    }
-    while (size & ~(BITS_PER_LONG-1)) {
-        if ((tmp = *(p++))) {
-            goto found_middle;
-        }
-        result += BITS_PER_LONG;
-        size -= BITS_PER_LONG;
-    }
-    if (!size) {
-        return result;
-    }
-    tmp = *p;
-
-found_first:
-    tmp &= (~0UL >> (BITS_PER_LONG - size));
-    if (tmp == 0UL) {		/* Are any bits set? */
-        return result + size;	/* Nope. */
-    }
-found_middle:
-    return result + bitops_ffsl(tmp);
-}
-
-/*
- * This implementation of find_{first,next}_zero_bit was stolen from
- * Linus' asm-alpha/bitops.h.
- */
-unsigned long find_next_zero_bit(const unsigned long *addr, unsigned long size,
-				 unsigned long offset)
-{
-    const unsigned long *p = addr + BITOP_WORD(offset);
-    unsigned long result = offset & ~(BITS_PER_LONG-1);
-    unsigned long tmp;
-
-    if (offset >= size) {
-        return size;
-    }
-    size -= result;
-    offset %= BITS_PER_LONG;
-    if (offset) {
-        tmp = *(p++);
-        tmp |= ~0UL >> (BITS_PER_LONG - offset);
-        if (size < BITS_PER_LONG) {
-            goto found_first;
-        }
-        if (~tmp) {
-            goto found_middle;
-        }
-        size -= BITS_PER_LONG;
-        result += BITS_PER_LONG;
-    }
-    while (size & ~(BITS_PER_LONG-1)) {
-        if (~(tmp = *(p++))) {
-            goto found_middle;
-        }
-        result += BITS_PER_LONG;
-        size -= BITS_PER_LONG;
-    }
-    if (!size) {
-        return result;
-    }
-    tmp = *p;
-
-found_first:
-    tmp |= ~0UL << size;
-    if (tmp == ~0UL) {	/* Are any bits zero? */
-        return result + size;	/* Nope. */
-    }
-found_middle:
-    return result + ffz(tmp);
-}
-
-unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
-{
-    unsigned long words;
-    unsigned long tmp;
-
-    /* Start at final word. */
-    words = size / BITS_PER_LONG;
-
-    /* Partial final word? */
-    if (size & (BITS_PER_LONG-1)) {
-        tmp = (addr[words] & (~0UL >> (BITS_PER_LONG
-                                       - (size & (BITS_PER_LONG-1)))));
-        if (tmp) {
-            goto found;
-        }
-    }
-
-    while (words) {
-        tmp = addr[--words];
-        if (tmp) {
-        found:
-            return words * BITS_PER_LONG + bitops_flsl(tmp);
-        }
-    }
-
-    /* Not found */
-    return size;
-}
--- a/bitops.h
+++ b/bitops.h
@@ -1,272 +0,0 @@
-/*
- * Bitops Module
- *
- * Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
- *
- * Mostly inspired by (stolen from) linux/bitmap.h and linux/bitops.h
- *
- * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
- * See the COPYING.LIB file in the top-level directory.
- */
-
-#ifndef BITOPS_H
-#define BITOPS_H
-
-#include "qemu-common.h"
-
-#define BITS_PER_BYTE           CHAR_BIT
-#define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
-
-#define BIT(nr)			(1UL << (nr))
-#define BIT_MASK(nr)		(1UL << ((nr) % BITS_PER_LONG))
-#define BIT_WORD(nr)		((nr) / BITS_PER_LONG)
-#define BITS_TO_LONGS(nr)	DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
-
-/**
- * bitops_ffs - find first bit in word.
- * @word: The word to search
- *
- * Undefined if no bit exists, so code should check against 0 first.
- */
-static unsigned long bitops_ffsl(unsigned long word)
-{
-	int num = 0;
-
-#if LONG_MAX > 0x7FFFFFFF
-	if ((word & 0xffffffff) == 0) {
-		num += 32;
-		word >>= 32;
-	}
-#endif
-	if ((word & 0xffff) == 0) {
-		num += 16;
-		word >>= 16;
-	}
-	if ((word & 0xff) == 0) {
-		num += 8;
-		word >>= 8;
-	}
-	if ((word & 0xf) == 0) {
-		num += 4;
-		word >>= 4;
-	}
-	if ((word & 0x3) == 0) {
-		num += 2;
-		word >>= 2;
-	}
-	if ((word & 0x1) == 0) {
-		num += 1;
-        }
-	return num;
-}
-
-/**
- * bitops_fls - find last (most-significant) set bit in a long word
- * @word: the word to search
- *
- * Undefined if no set bit exists, so code should check against 0 first.
- */
-static inline unsigned long bitops_flsl(unsigned long word)
-{
-	int num = BITS_PER_LONG - 1;
-
-#if LONG_MAX > 0x7FFFFFFF
-	if (!(word & (~0ul << 32))) {
-		num -= 32;
-		word <<= 32;
-	}
-#endif
-	if (!(word & (~0ul << (BITS_PER_LONG-16)))) {
-		num -= 16;
-		word <<= 16;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-8)))) {
-		num -= 8;
-		word <<= 8;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-4)))) {
-		num -= 4;
-		word <<= 4;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-2)))) {
-		num -= 2;
-
-		word <<= 2;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-1))))
-		num -= 1;
-	return num;
-}
-
-/**
- * ffz - find first zero in word.
- * @word: The word to search
- *
- * Undefined if no zero exists, so code should check against ~0UL first.
- */
-static inline unsigned long ffz(unsigned long word)
-{
-    return bitops_ffsl(~word);
-}
-
-/**
- * set_bit - Set a bit in memory
- * @nr: the bit to set
- * @addr: the address to start counting from
- */
-static inline void set_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-
-	*p  |= mask;
-}
-
-/**
- * clear_bit - Clears a bit in memory
- * @nr: Bit to clear
- * @addr: Address to start counting from
- */
-static inline void clear_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-
-	*p &= ~mask;
-}
-
-/**
- * change_bit - Toggle a bit in memory
- * @nr: Bit to change
- * @addr: Address to start counting from
- */
-static inline void change_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-
-	*p ^= mask;
-}
-
-/**
- * test_and_set_bit - Set a bit and return its old value
- * @nr: Bit to set
- * @addr: Address to count from
- */
-static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-	unsigned long old = *p;
-
-	*p = old | mask;
-	return (old & mask) != 0;
-}
-
-/**
- * test_and_clear_bit - Clear a bit and return its old value
- * @nr: Bit to clear
- * @addr: Address to count from
- */
-static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-	unsigned long old = *p;
-
-	*p = old & ~mask;
-	return (old & mask) != 0;
-}
-
-/**
- * test_and_change_bit - Change a bit and return its old value
- * @nr: Bit to change
- * @addr: Address to count from
- */
-static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
-{
-	unsigned long mask = BIT_MASK(nr);
-	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
-	unsigned long old = *p;
-
-	*p = old ^ mask;
-	return (old & mask) != 0;
-}
-
-/**
- * test_bit - Determine whether a bit is set
- * @nr: bit number to test
- * @addr: Address to start counting from
- */
-static inline int test_bit(int nr, const volatile unsigned long *addr)
-{
-	return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1)));
-}
-
-/**
- * find_last_bit - find the last set bit in a memory region
- * @addr: The address to start the search at
- * @size: The maximum size to search
- *
- * Returns the bit number of the first set bit, or size.
- */
-unsigned long find_last_bit(const unsigned long *addr,
-                            unsigned long size);
-
-/**
- * find_next_bit - find the next set bit in a memory region
- * @addr: The address to base the search on
- * @offset: The bitnumber to start searching at
- * @size: The bitmap size in bits
- */
-unsigned long find_next_bit(const unsigned long *addr,
-				   unsigned long size, unsigned long offset);
-
-/**
- * find_next_zero_bit - find the next cleared bit in a memory region
- * @addr: The address to base the search on
- * @offset: The bitnumber to start searching at
- * @size: The bitmap size in bits
- */
-
-unsigned long find_next_zero_bit(const unsigned long *addr,
-                                 unsigned long size,
-                                 unsigned long offset);
-
-/**
- * find_first_bit - find the first set bit in a memory region
- * @addr: The address to start the search at
- * @size: The maximum size to search
- *
- * Returns the bit number of the first set bit.
- */
-static inline unsigned long find_first_bit(const unsigned long *addr,
-                                           unsigned long size)
-{
-    return find_next_bit(addr, size, 0);
-}
-
-/**
- * find_first_zero_bit - find the first cleared bit in a memory region
- * @addr: The address to start the search at
- * @size: The maximum size to search
- *
- * Returns the bit number of the first cleared bit.
- */
-static inline unsigned long find_first_zero_bit(const unsigned long *addr,
-                                                unsigned long size)
-{
-    return find_next_zero_bit(addr, size, 0);
-}
-
-static inline unsigned long hweight_long(unsigned long w)
-{
-    unsigned long count;
-
-    for (count = 0; w; w >>= 1) {
-        count += w & 1;
-    }
-    return count;
-}
-
-#endif
--- a/block-migration.c
+++ b/block-migration.c
@@ -62,6 +62,7 @@ typedef struct BlkMigBlock {
    QEMUIOVector qiov;
    BlockDriverAIOCB *aiocb;
    int ret;
+    int64_t time;
    QSIMPLEQ_ENTRY(BlkMigBlock) entry;
 } BlkMigBlock;

@@ -77,7 +78,6 @@ typedef struct BlkMigState {
    int prev_progress;
    int bulk_completed;
    long double total_time;
-    long double prev_time_offset;
    int reads;
 } BlkMigState;

@@ -131,10 +131,16 @@ uint64_t blk_mig_bytes_total(void)
    return sum << BDRV_SECTOR_BITS;
 }

+static inline void add_avg_read_time(int64_t time)
+{
+    block_mig_state.reads++;
+    block_mig_state.total_time += time;
+}
+
 static inline long double compute_read_bwidth(void)
 {
    assert(block_mig_state.total_time != 0);
-    return (block_mig_state.reads / block_mig_state.total_time) * BLOCK_SIZE;
+    return  (block_mig_state.reads * BLOCK_SIZE)/ block_mig_state.total_time;
 }

 static int bmds_aio_inflight(BlkMigDevState *bmds, int64_t sector)
@@ -180,19 +186,18 @@ static void alloc_aio_bitmap(BlkMigDevState *bmds)
            BDRV_SECTORS_PER_DIRTY_CHUNK * 8 - 1;
    bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * 8;

-    bmds->aio_bitmap = g_malloc0(bitmap_size);
+    bmds->aio_bitmap = qemu_mallocz(bitmap_size);
 }

 static void blk_mig_read_cb(void *opaque, int ret)
 {
-    long double curr_time = qemu_get_clock_ns(rt_clock);
    BlkMigBlock *blk = opaque;

    blk->ret = ret;

-    block_mig_state.reads++;
-    block_mig_state.total_time += (curr_time - block_mig_state.prev_time_offset);
-    block_mig_state.prev_time_offset = curr_time;
+    blk->time = qemu_get_clock_ns(rt_clock) - blk->time;
+
+    add_avg_read_time(blk->time);

    QSIMPLEQ_INSERT_TAIL(&block_mig_state.blk_list, blk, entry);
    bmds_set_aio_inflight(blk->bmds, blk->sector, blk->nr_sectors, 0);
@@ -235,8 +240,8 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
        nr_sectors = total_sectors - cur_sector;
    }

-    blk = g_malloc(sizeof(BlkMigBlock));
-    blk->buf = g_malloc(BLOCK_SIZE);
+    blk = qemu_malloc(sizeof(BlkMigBlock));
+    blk->buf = qemu_malloc(BLOCK_SIZE);
    blk->bmds = bmds;
    blk->sector = cur_sector;
    blk->nr_sectors = nr_sectors;
@@ -245,9 +250,7 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
    blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
    qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);

-    if (block_mig_state.submitted == 0) {
-        block_mig_state.prev_time_offset = qemu_get_clock_ns(rt_clock);
-    }
+    blk->time = qemu_get_clock_ns(rt_clock);

    blk->aiocb = bdrv_aio_readv(bs, cur_sector, &blk->qiov,
                                nr_sectors, blk_mig_read_cb, blk);
@@ -263,9 +266,9 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,

 error:
    monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
-    qemu_file_set_error(f, -EIO);
-    g_free(blk->buf);
-    g_free(blk);
+    qemu_file_set_error(f);
+    qemu_free(blk->buf);
+    qemu_free(blk);
    return 0;
 }

@@ -290,7 +293,7 @@ static void init_blk_migration_it(void *opaque, BlockDriverState *bs)
            return;
        }

-        bmds = g_malloc0(sizeof(BlkMigDevState));
+        bmds = qemu_mallocz(sizeof(BlkMigDevState));
        bmds->bs = bs;
        bmds->bulk_completed = 0;
        bmds->total_sectors = sectors;
@@ -383,7 +386,6 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
    int64_t total_sectors = bmds->total_sectors;
    int64_t sector;
    int nr_sectors;
-    int ret = -EIO;

    for (sector = bmds->cur_dirty; sector < bmds->total_sectors;) {
        if (bmds_aio_inflight(bmds, sector)) {
@@ -396,8 +398,8 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
            } else {
                nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
            }
-            blk = g_malloc(sizeof(BlkMigBlock));
-            blk->buf = g_malloc(BLOCK_SIZE);
+            blk = qemu_malloc(sizeof(BlkMigBlock));
+            blk->buf = qemu_malloc(BLOCK_SIZE);
            blk->bmds = bmds;
            blk->sector = sector;
            blk->nr_sectors = nr_sectors;
@@ -407,9 +409,7 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
                blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
                qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);

-                if (block_mig_state.submitted == 0) {
-                    block_mig_state.prev_time_offset = qemu_get_clock_ns(rt_clock);
-                }
+                blk->time = qemu_get_clock_ns(rt_clock);

                blk->aiocb = bdrv_aio_readv(bmds->bs, sector, &blk->qiov,
                                            nr_sectors, blk_mig_read_cb, blk);
@@ -419,14 +419,14 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
                block_mig_state.submitted++;
                bmds_set_aio_inflight(bmds, sector, nr_sectors, 1);
            } else {
-                ret = bdrv_read(bmds->bs, sector, blk->buf, nr_sectors);
-                if (ret < 0) {
+                if (bdrv_read(bmds->bs, sector, blk->buf,
+                              nr_sectors) < 0) {
                    goto error;
                }
                blk_send(f, blk);

-                g_free(blk->buf);
-                g_free(blk);
+                qemu_free(blk->buf);
+                qemu_free(blk);
            }

            bdrv_reset_dirty(bmds->bs, sector, nr_sectors);
@@ -440,9 +440,9 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,

 error:
    monitor_printf(mon, "Error reading sector %" PRId64 "\n", sector);
-    qemu_file_set_error(f, ret);
-    g_free(blk->buf);
-    g_free(blk);
+    qemu_file_set_error(f);
+    qemu_free(blk->buf);
+    qemu_free(blk);
    return 0;
 }

@@ -474,14 +474,14 @@ static void flush_blks(QEMUFile* f)
            break;
        }
        if (blk->ret < 0) {
-            qemu_file_set_error(f, blk->ret);
+            qemu_file_set_error(f);
            break;
        }
        blk_send(f, blk);

        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        g_free(blk->buf);
-        g_free(blk);
+        qemu_free(blk->buf);
+        qemu_free(blk);

        block_mig_state.read_done--;
        block_mig_state.transferred++;
@@ -521,7 +521,7 @@ static int is_stage2_completed(void)

        if ((remaining_dirty / bwidth) <=
            migrate_max_downtime()) {
-            /* finish stage2 because we think that we can finish remaining work
+            /* finish stage2 because we think that we can finish remaing work
               below max_downtime */

            return 1;
@@ -542,14 +542,14 @@ static void blk_mig_cleanup(Monitor *mon)
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.bmds_list, entry);
        bdrv_set_in_use(bmds->bs, 0);
        drive_put_ref(drive_get_by_blockdev(bmds->bs));
-        g_free(bmds->aio_bitmap);
-        g_free(bmds);
+        qemu_free(bmds->aio_bitmap);
+        qemu_free(bmds);
    }

    while ((blk = QSIMPLEQ_FIRST(&block_mig_state.blk_list)) != NULL) {
        QSIMPLEQ_REMOVE_HEAD(&block_mig_state.blk_list, entry);
-        g_free(blk->buf);
-        g_free(blk);
+        qemu_free(blk->buf);
+        qemu_free(blk);
    }

    monitor_printf(mon, "\n");
@@ -557,8 +557,6 @@ static void blk_mig_cleanup(Monitor *mon)

 static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
 {
-    int ret;
-
    DPRINTF("Enter save live stage %d submitted %d transferred %d\n",
            stage, block_mig_state.submitted, block_mig_state.transferred);

@@ -582,10 +580,9 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)

    flush_blks(f);

-    ret = qemu_file_get_error(f);
-    if (ret) {
+    if (qemu_file_has_error(f)) {
        blk_mig_cleanup(mon);
-        return ret;
+        return 0;
    }

    blk_mig_reset_dirty_cursor();
@@ -611,10 +608,9 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)

        flush_blks(f);

-        ret = qemu_file_get_error(f);
-        if (ret) {
+        if (qemu_file_has_error(f)) {
            blk_mig_cleanup(mon);
-            return ret;
+            return 0;
        }
    }

@@ -629,9 +625,8 @@ static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
        /* report completion */
        qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);

-        ret = qemu_file_get_error(f);
-        if (ret) {
-            return ret;
+        if (qemu_file_has_error(f)) {
+            return 0;
        }

        monitor_printf(mon, "Block migration completed\n");
@@ -652,7 +647,6 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
    uint8_t *buf;
    int64_t total_sectors = 0;
    int nr_sectors;
-    int ret;

    do {
        addr = qemu_get_be64(f);
@@ -661,6 +655,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
        addr >>= BDRV_SECTOR_BITS;

        if (flags & BLK_MIG_FLAG_DEVICE_BLOCK) {
+            int ret;
            /* get device name */
            len = qemu_get_byte(f);
            qemu_get_buffer(f, (uint8_t *)device_name, len);
@@ -677,7 +672,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                bs_prev = bs;
                total_sectors = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
                if (total_sectors <= 0) {
-                    error_report("Error getting length of block device %s",
+                    error_report("Error getting length of block device %s\n",
                                 device_name);
                    return -EINVAL;
                }
@@ -689,12 +684,12 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                nr_sectors = BDRV_SECTORS_PER_DIRTY_CHUNK;
            }

-            buf = g_malloc(BLOCK_SIZE);
+            buf = qemu_malloc(BLOCK_SIZE);

            qemu_get_buffer(f, buf, BLOCK_SIZE);
            ret = bdrv_write(bs, addr, buf, nr_sectors);

-            g_free(buf);
+            qemu_free(buf);
            if (ret < 0) {
                return ret;
            }
@@ -710,9 +705,8 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
-        ret = qemu_file_get_error(f);
-        if (ret != 0) {
-            return ret;
+        if (qemu_file_has_error(f)) {
+            return -EIO;
        }
    } while (!(flags & BLK_MIG_FLAG_EOS));

--- a/block.c
+++ b/block.c
--- a/block.h
+++ b/block.h
@@ -4,7 +4,6 @@
 #include "qemu-aio.h"
 #include "qemu-common.h"
 #include "qemu-option.h"
-#include "qemu-coroutine.h"
 #include "qobject.h"

 /* block.c */
@@ -28,41 +27,6 @@ typedef struct QEMUSnapshotInfo {
    uint64_t vm_clock_nsec; /* VM clock relative to boot */
 } QEMUSnapshotInfo;

-/* Callbacks for block device models */
-typedef struct BlockDevOps {
-    /*
-     * Runs when virtual media changed (monitor commands eject, change)
-     * Argument load is true on load and false on eject.
-     * Beware: doesn't run when a host device's physical media
-     * changes.  Sure would be useful if it did.
-     * Device models with removable media must implement this callback.
-     */
-    void (*change_media_cb)(void *opaque, bool load);
-    /*
-     * Runs when an eject request is issued from the monitor, the tray
-     * is closed, and the medium is locked.
-     * Device models that do not implement is_medium_locked will not need
-     * this callback.  Device models that can lock the medium or tray might
-     * want to implement the callback and unlock the tray when "force" is
-     * true, even if they do not support eject requests.
-     */
-    void (*eject_request_cb)(void *opaque, bool force);
-    /*
-     * Is the virtual tray open?
-     * Device models implement this only when the device has a tray.
-     */
-    bool (*is_tray_open)(void *opaque);
-    /*
-     * Is the virtual medium locked into the device?
-     * Device models implement this only when device has such a lock.
-     */
-    bool (*is_medium_locked)(void *opaque);
-    /*
-     * Runs when the size changed (e.g. monitor command block_resize)
-     */
-    void (*resize_cb)(void *opaque);
-} BlockDevOps;
-
 #define BDRV_O_RDWR        0x0002
 #define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
 #define BDRV_O_NOCACHE     0x0020 /* do not use the host page cache */
@@ -86,11 +50,6 @@ typedef enum {
    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
 } BlockMonEventAction;

-void bdrv_iostatus_enable(BlockDriverState *bs);
-void bdrv_iostatus_reset(BlockDriverState *bs);
-void bdrv_iostatus_disable(BlockDriverState *bs);
-bool bdrv_iostatus_is_enabled(const BlockDriverState *bs);
-void bdrv_iostatus_set_err(BlockDriverState *bs, int error);
 void bdrv_mon_event(const BlockDriverState *bdrv,
                    BlockMonEventAction action, int is_read);
 void bdrv_info_print(Monitor *mon, const QObject *data);
@@ -107,23 +66,14 @@ int bdrv_create(BlockDriver *drv, const char* filename,
    QEMUOptionParameter *options);
 int bdrv_create_file(const char* filename, QEMUOptionParameter *options);
 BlockDriverState *bdrv_new(const char *device_name);
-void bdrv_make_anon(BlockDriverState *bs);
 void bdrv_delete(BlockDriverState *bs);
-int bdrv_parse_cache_flags(const char *mode, int *flags);
 int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
 int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
              BlockDriver *drv);
 void bdrv_close(BlockDriverState *bs);
-int bdrv_attach_dev(BlockDriverState *bs, void *dev);
-void bdrv_attach_dev_nofail(BlockDriverState *bs, void *dev);
-void bdrv_detach_dev(BlockDriverState *bs, void *dev);
-void *bdrv_get_attached_dev(BlockDriverState *bs);
-void bdrv_set_dev_ops(BlockDriverState *bs, const BlockDevOps *ops,
-                      void *opaque);
-void bdrv_dev_eject_request(BlockDriverState *bs, bool force);
-bool bdrv_dev_has_removable_media(BlockDriverState *bs);
-bool bdrv_dev_is_tray_open(BlockDriverState *bs);
-bool bdrv_dev_is_medium_locked(BlockDriverState *bs);
+int bdrv_attach(BlockDriverState *bs, DeviceState *qdev);
+void bdrv_detach(BlockDriverState *bs, DeviceState *qdev);
+DeviceState *bdrv_get_attached(BlockDriverState *bs);
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
              uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
@@ -134,13 +84,10 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
                const void *buf, int count);
 int bdrv_pwrite_sync(BlockDriverState *bs, int64_t offset,
    const void *buf, int count);
-int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors, QEMUIOVector *qiov);
-int coroutine_fn bdrv_co_writev(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors, QEMUIOVector *qiov);
+int bdrv_write_sync(BlockDriverState *bs, int64_t sector_num,
+    const uint8_t *buf, int nb_sectors);
 int bdrv_truncate(BlockDriverState *bs, int64_t offset);
 int64_t bdrv_getlength(BlockDriverState *bs);
-int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
 void bdrv_guess_geometry(BlockDriverState *bs, int *pcyls, int *pheads, int *psecs);
 int bdrv_commit(BlockDriverState *bs);
@@ -162,7 +109,7 @@ int bdrv_check(BlockDriverState *bs, BdrvCheckResult *res);
 typedef struct BlockDriverAIOCB BlockDriverAIOCB;
 typedef void BlockDriverCompletionFunc(void *opaque, int ret);
 typedef void BlockDriverDirtyHandler(BlockDriverState *bs, int64_t sector,
-                                     int sector_num);
+				     int sector_num);
 BlockDriverAIOCB *bdrv_aio_readv(BlockDriverState *bs, int64_t sector_num,
                                 QEMUIOVector *iov, int nb_sectors,
                                 BlockDriverCompletionFunc *cb, void *opaque);
@@ -170,10 +117,7 @@ BlockDriverAIOCB *bdrv_aio_writev(BlockDriverState *bs, int64_t sector_num,
                                  QEMUIOVector *iov, int nb_sectors,
                                  BlockDriverCompletionFunc *cb, void *opaque);
 BlockDriverAIOCB *bdrv_aio_flush(BlockDriverState *bs,
-                                 BlockDriverCompletionFunc *cb, void *opaque);
-BlockDriverAIOCB *bdrv_aio_discard(BlockDriverState *bs,
-                                   int64_t sector_num, int nb_sectors,
-                                   BlockDriverCompletionFunc *cb, void *opaque);
+				 BlockDriverCompletionFunc *cb, void *opaque);
 void bdrv_aio_cancel(BlockDriverAIOCB *acb);

 typedef struct BlockRequest {
@@ -197,22 +141,19 @@ BlockDriverAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
        unsigned long int req, void *buf,
        BlockDriverCompletionFunc *cb, void *opaque);

-/* Invalidate any cached metadata used by image formats */
-void bdrv_invalidate_cache(BlockDriverState *bs);
-void bdrv_invalidate_cache_all(void);
-
 /* Ensure contents are flushed to disk.  */
 int bdrv_flush(BlockDriverState *bs);
-int coroutine_fn bdrv_co_flush(BlockDriverState *bs);
 void bdrv_flush_all(void);
 void bdrv_close_all(void);

 int bdrv_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
-int bdrv_co_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
 int bdrv_has_zero_init(BlockDriverState *bs);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
-                      int *pnum);
+	int *pnum);

+#define BDRV_TYPE_HD     0
+#define BDRV_TYPE_CDROM  1
+#define BDRV_TYPE_FLOPPY 2
 #define BIOS_ATA_TRANSLATION_AUTO   0
 #define BIOS_ATA_TRANSLATION_NONE   1
 #define BIOS_ATA_TRANSLATION_LBA    2
@@ -221,30 +162,28 @@ int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,

 void bdrv_set_geometry_hint(BlockDriverState *bs,
                            int cyls, int heads, int secs);
+void bdrv_set_type_hint(BlockDriverState *bs, int type);
 void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
 void bdrv_get_geometry_hint(BlockDriverState *bs,
                            int *pcyls, int *pheads, int *psecs);
-typedef enum FDriveType {
-    FDRIVE_DRV_144  = 0x00,   /* 1.44 MB 3"5 drive      */
-    FDRIVE_DRV_288  = 0x01,   /* 2.88 MB 3"5 drive      */
-    FDRIVE_DRV_120  = 0x02,   /* 1.2  MB 5"25 drive     */
-    FDRIVE_DRV_NONE = 0x03,   /* No drive connected     */
-} FDriveType;
-
-void bdrv_get_floppy_geometry_hint(BlockDriverState *bs, int *nb_heads,
-                                   int *max_track, int *last_sect,
-                                   FDriveType drive_in, FDriveType *drive);
+int bdrv_get_type_hint(BlockDriverState *bs);
 int bdrv_get_translation_hint(BlockDriverState *bs);
 void bdrv_set_on_error(BlockDriverState *bs, BlockErrorAction on_read_error,
                       BlockErrorAction on_write_error);
 BlockErrorAction bdrv_get_on_error(BlockDriverState *bs, int is_read);
+void bdrv_set_removable(BlockDriverState *bs, int removable);
+int bdrv_is_removable(BlockDriverState *bs);
 int bdrv_is_read_only(BlockDriverState *bs);
 int bdrv_is_sg(BlockDriverState *bs);
 int bdrv_enable_write_cache(BlockDriverState *bs);
 int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
-void bdrv_lock_medium(BlockDriverState *bs, bool locked);
-void bdrv_eject(BlockDriverState *bs, int eject_flag);
+int bdrv_is_locked(BlockDriverState *bs);
+void bdrv_set_locked(BlockDriverState *bs, int locked);
+int bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_set_change_cb(BlockDriverState *bs,
+                        void (*change_cb)(void *opaque, int reason),
+                        void *opaque);
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
 BlockDriverState *bdrv_find(const char *name);
 BlockDriverState *bdrv_next(BlockDriverState *bs);
@@ -294,9 +233,6 @@ int bdrv_img_create(const char *filename, const char *fmt,
                    const char *base_filename, const char *base_fmt,
                    char *options, uint64_t img_size, int flags);

-void bdrv_set_buffer_alignment(BlockDriverState *bs, int align);
-void *qemu_blockalign(BlockDriverState *bs, size_t size);
-
 #define BDRV_SECTORS_PER_DIRTY_CHUNK 2048

 void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
@@ -308,23 +244,6 @@ int64_t bdrv_get_dirty_count(BlockDriverState *bs);
 void bdrv_set_in_use(BlockDriverState *bs, int in_use);
 int bdrv_in_use(BlockDriverState *bs);

-enum BlockAcctType {
-    BDRV_ACCT_READ,
-    BDRV_ACCT_WRITE,
-    BDRV_ACCT_FLUSH,
-    BDRV_MAX_IOTYPE,
-};
-
-typedef struct BlockAcctCookie {
-    int64_t bytes;
-    int64_t start_time_ns;
-    enum BlockAcctType type;
-} BlockAcctCookie;
-
-void bdrv_acct_start(BlockDriverState *bs, BlockAcctCookie *cookie,
-        int64_t bytes, enum BlockAcctType type);
-void bdrv_acct_done(BlockDriverState *bs, BlockAcctCookie *cookie);
-
 typedef enum {
    BLKDBG_L1_UPDATE,

@@ -376,43 +295,4 @@ typedef enum {
 #define BLKDBG_EVENT(bs, evt) bdrv_debug_event(bs, evt)
 void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event);

-
-/* Convenience for block device models */
-
-typedef struct BlockConf {
-    BlockDriverState *bs;
-    uint16_t physical_block_size;
-    uint16_t logical_block_size;
-    uint16_t min_io_size;
-    uint32_t opt_io_size;
-    int32_t bootindex;
-    uint32_t discard_granularity;
-} BlockConf;
-
-static inline unsigned int get_physical_block_exp(BlockConf *conf)
-{
-    unsigned int exp = 0, size;
-
-    for (size = conf->physical_block_size;
-        size > conf->logical_block_size;
-        size >>= 1) {
-        exp++;
-    }
-
-    return exp;
-}
-
-#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
-    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
-    DEFINE_PROP_UINT16("logical_block_size", _state,                    \
-                       _conf.logical_block_size, 512),                  \
-    DEFINE_PROP_UINT16("physical_block_size", _state,                   \
-                       _conf.physical_block_size, 512),                 \
-    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
-    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
-    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
-    DEFINE_PROP_UINT32("discard_granularity", _state, \
-                       _conf.discard_granularity, 0)
-
 #endif
-
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -214,7 +214,7 @@ static int add_rule(QemuOpts *opts, void *opaque)
    }

    /* Set attributes common for all actions */
-    rule = g_malloc0(sizeof(*rule));
+    rule = qemu_mallocz(sizeof(*rule));
    *rule = (struct BlkdebugRule) {
        .event  = event,
        .action = d->action,
@@ -392,11 +392,16 @@ static void blkdebug_close(BlockDriverState *bs)
    for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
            QLIST_REMOVE(rule, next);
-            g_free(rule);
+            qemu_free(rule);
        }
    }
 }

+static int blkdebug_flush(BlockDriverState *bs)
+{
+    return bdrv_flush(bs->file);
+}
+
 static BlockDriverAIOCB *blkdebug_aio_flush(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
@@ -449,6 +454,7 @@ static BlockDriver bdrv_blkdebug = {

    .bdrv_file_open     = blkdebug_open,
    .bdrv_close         = blkdebug_close,
+    .bdrv_flush         = blkdebug_flush,

    .bdrv_aio_readv     = blkdebug_aio_readv,
    .bdrv_aio_writev    = blkdebug_aio_writev,
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -116,6 +116,14 @@ static void blkverify_close(BlockDriverState *bs)
    s->test_file = NULL;
 }

+static int blkverify_flush(BlockDriverState *bs)
+{
+    BDRVBlkverifyState *s = bs->opaque;
+
+    /* Only flush test file, the raw file is not important */
+    return bdrv_flush(s->test_file);
+}
+
 static int64_t blkverify_getlength(BlockDriverState *bs)
 {
    BDRVBlkverifyState *s = bs->opaque;
@@ -360,6 +368,7 @@ static BlockDriver bdrv_blkverify = {

    .bdrv_file_open     = blkverify_open,
    .bdrv_close         = blkverify_close,
+    .bdrv_flush         = blkverify_flush,

    .bdrv_aio_readv     = blkverify_aio_readv,
    .bdrv_aio_writev    = blkverify_aio_writev,
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -80,7 +80,6 @@ struct bochs_header {
 };

 typedef struct BDRVBochsState {
-    CoMutex lock;
    uint32_t *catalog_bitmap;
    int catalog_size;

@@ -137,7 +136,7 @@ static int bochs_open(BlockDriverState *bs, int flags)
    }

    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
-    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
    if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
                   s->catalog_size * 4) != s->catalog_size * 4)
 	goto fail;
@@ -151,7 +150,6 @@ static int bochs_open(BlockDriverState *bs, int flags)

    s->extent_size = le32_to_cpu(bochs.extra.redolog.extent);

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -209,21 +207,10 @@ static int bochs_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int bochs_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVBochsState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = bochs_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void bochs_close(BlockDriverState *bs)
 {
    BDRVBochsState *s = bs->opaque;
-    g_free(s->catalog_bitmap);
+    qemu_free(s->catalog_bitmap);
 }

 static BlockDriver bdrv_bochs = {
@@ -231,7 +218,7 @@ static BlockDriver bdrv_bochs = {
    .instance_size	= sizeof(BDRVBochsState),
    .bdrv_probe		= bochs_probe,
    .bdrv_open		= bochs_open,
-    .bdrv_read          = bochs_co_read,
+    .bdrv_read		= bochs_read,
    .bdrv_close		= bochs_close,
 };

--- a/block/cloop.c
+++ b/block/cloop.c
@@ -27,10 +27,9 @@
 #include <zlib.h>

 typedef struct BDRVCloopState {
-    CoMutex lock;
    uint32_t block_size;
    uint32_t n_blocks;
-    uint64_t *offsets;
+    uint64_t* offsets;
    uint32_t sectors_per_block;
    uint32_t current_block;
    uint8_t *compressed_block;
@@ -40,23 +39,21 @@ typedef struct BDRVCloopState {

 static int cloop_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
-    const char *magic_version_2_0 = "#!/bin/sh\n"
-        "#V2.0 Format\n"
-        "modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
-    int length = strlen(magic_version_2_0);
-    if (length > buf_size) {
-        length = buf_size;
-    }
-    if (!memcmp(magic_version_2_0, buf, length)) {
-        return 2;
-    }
+    const char* magic_version_2_0="#!/bin/sh\n"
+	"#V2.0 Format\n"
+	"modprobe cloop file=$0 && mount -r -t iso9660 /dev/cloop $1\n";
+    int length=strlen(magic_version_2_0);
+    if(length>buf_size)
+	length=buf_size;
+    if(!memcmp(magic_version_2_0,buf,length))
+	return 2;
    return 0;
 }

 static int cloop_open(BlockDriverState *bs, int flags)
 {
    BDRVCloopState *s = bs->opaque;
-    uint32_t offsets_size, max_compressed_block_size = 1, i;
+    uint32_t offsets_size,max_compressed_block_size=1,i;

    bs->read_only = 1;

@@ -73,32 +70,29 @@ static int cloop_open(BlockDriverState *bs, int flags)

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
-    s->offsets = g_malloc(offsets_size);
+    s->offsets = qemu_malloc(offsets_size);
    if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
            offsets_size) {
-        goto cloop_close;
+	goto cloop_close;
    }
    for(i=0;i<s->n_blocks;i++) {
-        s->offsets[i] = be64_to_cpu(s->offsets[i]);
-        if (i > 0) {
-            uint32_t size = s->offsets[i] - s->offsets[i - 1];
-            if (size > max_compressed_block_size) {
-                max_compressed_block_size = size;
-            }
-        }
+	s->offsets[i]=be64_to_cpu(s->offsets[i]);
+	if(i>0) {
+	    uint32_t size=s->offsets[i]-s->offsets[i-1];
+	    if(size>max_compressed_block_size)
+		max_compressed_block_size=size;
+	}
    }

    /* initialize zlib engine */
-    s->compressed_block = g_malloc(max_compressed_block_size + 1);
-    s->uncompressed_block = g_malloc(s->block_size);
-    if (inflateInit(&s->zstream) != Z_OK) {
-        goto cloop_close;
-    }
-    s->current_block = s->n_blocks;
+    s->compressed_block = qemu_malloc(max_compressed_block_size+1);
+    s->uncompressed_block = qemu_malloc(s->block_size);
+    if(inflateInit(&s->zstream) != Z_OK)
+	goto cloop_close;
+    s->current_block=s->n_blocks;

    s->sectors_per_block = s->block_size/512;
-    bs->total_sectors = s->n_blocks * s->sectors_per_block;
-    qemu_co_mutex_init(&s->lock);
+    bs->total_sectors = s->n_blocks*s->sectors_per_block;
    return 0;

 cloop_close:
@@ -109,30 +103,27 @@ static inline int cloop_read_block(BlockDriverState *bs, int block_num)
 {
    BDRVCloopState *s = bs->opaque;

-    if (s->current_block != block_num) {
-        int ret;
-        uint32_t bytes = s->offsets[block_num + 1] - s->offsets[block_num];
+    if(s->current_block != block_num) {
+	int ret;
+        uint32_t bytes = s->offsets[block_num+1]-s->offsets[block_num];

        ret = bdrv_pread(bs->file, s->offsets[block_num], s->compressed_block,
                         bytes);
-        if (ret != bytes) {
+        if (ret != bytes)
            return -1;
-        }

-        s->zstream.next_in = s->compressed_block;
-        s->zstream.avail_in = bytes;
-        s->zstream.next_out = s->uncompressed_block;
-        s->zstream.avail_out = s->block_size;
-        ret = inflateReset(&s->zstream);
-        if (ret != Z_OK) {
-            return -1;
-        }
-        ret = inflate(&s->zstream, Z_FINISH);
-        if (ret != Z_STREAM_END || s->zstream.total_out != s->block_size) {
-            return -1;
-        }
+	s->zstream.next_in = s->compressed_block;
+	s->zstream.avail_in = bytes;
+	s->zstream.next_out = s->uncompressed_block;
+	s->zstream.avail_out = s->block_size;
+	ret = inflateReset(&s->zstream);
+	if(ret != Z_OK)
+	    return -1;
+	ret = inflate(&s->zstream, Z_FINISH);
+	if(ret != Z_STREAM_END || s->zstream.total_out != s->block_size)
+	    return -1;

-        s->current_block = block_num;
+	s->current_block = block_num;
    }
    return 0;
 }
@@ -143,48 +134,33 @@ static int cloop_read(BlockDriverState *bs, int64_t sector_num,
    BDRVCloopState *s = bs->opaque;
    int i;

-    for (i = 0; i < nb_sectors; i++) {
-        uint32_t sector_offset_in_block =
-            ((sector_num + i) % s->sectors_per_block),
-            block_num = (sector_num + i) / s->sectors_per_block;
-        if (cloop_read_block(bs, block_num) != 0) {
-            return -1;
-        }
-        memcpy(buf + i * 512,
-            s->uncompressed_block + sector_offset_in_block * 512, 512);
+    for(i=0;i<nb_sectors;i++) {
+	uint32_t sector_offset_in_block=((sector_num+i)%s->sectors_per_block),
+	    block_num=(sector_num+i)/s->sectors_per_block;
+	if(cloop_read_block(bs, block_num) != 0)
+	    return -1;
+	memcpy(buf+i*512,s->uncompressed_block+sector_offset_in_block*512,512);
    }
    return 0;
 }

-static coroutine_fn int cloop_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCloopState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cloop_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void cloop_close(BlockDriverState *bs)
 {
    BDRVCloopState *s = bs->opaque;
-    if (s->n_blocks > 0) {
-        g_free(s->offsets);
-    }
-    g_free(s->compressed_block);
-    g_free(s->uncompressed_block);
+    if(s->n_blocks>0)
+	free(s->offsets);
+    free(s->compressed_block);
+    free(s->uncompressed_block);
    inflateEnd(&s->zstream);
 }

 static BlockDriver bdrv_cloop = {
-    .format_name    = "cloop",
-    .instance_size  = sizeof(BDRVCloopState),
-    .bdrv_probe     = cloop_probe,
-    .bdrv_open      = cloop_open,
-    .bdrv_read      = cloop_co_read,
-    .bdrv_close     = cloop_close,
+    .format_name	= "cloop",
+    .instance_size	= sizeof(BDRVCloopState),
+    .bdrv_probe		= cloop_probe,
+    .bdrv_open		= cloop_open,
+    .bdrv_read		= cloop_read,
+    .bdrv_close		= cloop_close,
 };

 static void bdrv_cloop_init(void)
--- a/block/cow.c
+++ b/block/cow.c
@@ -42,7 +42,6 @@ struct cow_header_v2 {
 };

 typedef struct BDRVCowState {
-    CoMutex lock;
    int64_t cow_sectors_offset;
 } BDRVCowState;

@@ -85,7 +84,6 @@ static int cow_open(BlockDriverState *bs, int flags)

    bitmap_size = ((bs->total_sectors + 7) >> 3) + sizeof(cow_header);
    s->cow_sectors_offset = (bitmap_size + 511) & ~511;
-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -201,17 +199,6 @@ static int cow_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int cow_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCowState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cow_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int cow_write(BlockDriverState *bs, int64_t sector_num,
                     const uint8_t *buf, int nb_sectors)
 {
@@ -226,17 +213,6 @@ static int cow_write(BlockDriverState *bs, int64_t sector_num,
    return cow_update_bitmap(bs, sector_num, nb_sectors);
 }

-static coroutine_fn int cow_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVCowState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = cow_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void cow_close(BlockDriverState *bs)
 {
 }
@@ -306,9 +282,9 @@ exit:
    return ret;
 }

-static coroutine_fn int cow_co_flush(BlockDriverState *bs)
+static int cow_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }

 static QEMUOptionParameter cow_create_options[] = {
@@ -326,18 +302,16 @@ static QEMUOptionParameter cow_create_options[] = {
 };

 static BlockDriver bdrv_cow = {
-    .format_name    = "cow",
-    .instance_size  = sizeof(BDRVCowState),
-
-    .bdrv_probe     = cow_probe,
-    .bdrv_open      = cow_open,
-    .bdrv_close     = cow_close,
-    .bdrv_create    = cow_create,
-
-    .bdrv_read              = cow_co_read,
-    .bdrv_write             = cow_co_write,
-    .bdrv_co_flush_to_disk  = cow_co_flush,
-    .bdrv_is_allocated      = cow_is_allocated,
+    .format_name	= "cow",
+    .instance_size	= sizeof(BDRVCowState),
+    .bdrv_probe		= cow_probe,
+    .bdrv_open		= cow_open,
+    .bdrv_read		= cow_read,
+    .bdrv_write		= cow_write,
+    .bdrv_close		= cow_close,
+    .bdrv_create	= cow_create,
+    .bdrv_flush		= cow_flush,
+    .bdrv_is_allocated	= cow_is_allocated,

    .create_options = cow_create_options,
 };
--- a/block/curl.c
+++ b/block/curl.c
@@ -47,12 +47,7 @@ struct BDRVCURLState;

 typedef struct CURLAIOCB {
    BlockDriverAIOCB common;
-    QEMUBH *bh;
    QEMUIOVector *qiov;
-
-    int64_t sector_num;
-    int nb_sectors;
-
    size_t start;
    size_t end;
 } CURLAIOCB;
@@ -81,7 +76,6 @@ typedef struct BDRVCURLState {

 static void curl_clean_state(CURLState *s);
 static void curl_multi_do(void *arg);
-static int curl_aio_flush(void *opaque);

 static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
                        void *s, void *sp)
@@ -89,16 +83,14 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, curl_aio_flush,
-                                    NULL, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, NULL, NULL, s);
            break;
        case CURL_POLL_OUT:
-            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, curl_aio_flush,
-                                    NULL, s);
+            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, NULL, NULL, s);
            break;
        case CURL_POLL_INOUT:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, curl_multi_do,
-                                    curl_aio_flush, NULL, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_do,
+                                    curl_multi_do, NULL, NULL, s);
            break;
        case CURL_POLL_REMOVE:
            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL, NULL, NULL);
@@ -237,23 +229,6 @@ static void curl_multi_do(void *arg)
            {
                CURLState *state = NULL;
                curl_easy_getinfo(msg->easy_handle, CURLINFO_PRIVATE, (char**)&state);
-
-                /* ACBs for successful messages get completed in curl_read_cb */
-                if (msg->data.result != CURLE_OK) {
-                    int i;
-                    for (i = 0; i < CURL_NUM_ACB; i++) {
-                        CURLAIOCB *acb = state->acb[i];
-
-                        if (acb == NULL) {
-                            continue;
-                        }
-
-                        acb->common.cb(acb->common.opaque, -EIO);
-                        qemu_aio_release(acb);
-                        state->acb[i] = NULL;
-                    }
-                }
-
                curl_clean_state(state);
                break;
            }
@@ -302,8 +277,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
    curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1);
    curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1);
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
-    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
-
+    
 #ifdef DEBUG_VERBOSE
    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
@@ -336,7 +310,7 @@ static int curl_open(BlockDriverState *bs, const char *filename, int flags)

    static int inited = 0;

-    file = g_strdup(filename);
+    file = qemu_strdup(filename);
    s->readahead_size = READ_AHEAD_SIZE;

    /* Parse a trailing ":readahead=#:" param, if present. */
@@ -416,25 +390,10 @@ out:
    curl_easy_cleanup(state->curl);
    state->curl = NULL;
 out_noclean:
-    g_free(file);
+    qemu_free(file);
    return -EINVAL;
 }

-static int curl_aio_flush(void *opaque)
-{
-    BDRVCURLState *s = opaque;
-    int i, j;
-
-    for (i=0; i < CURL_NUM_STATES; i++) {
-        for(j=0; j < CURL_NUM_ACB; j++) {
-            if (s->states[i].acb[j]) {
-                return 1;
-            }
-        }
-    }
-    return 0;
-}
-
 static void curl_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    // Do we have to implement canceling? Seems to work without...
@@ -445,86 +404,61 @@ static AIOPool curl_aio_pool = {
    .cancel             = curl_aio_cancel,
 };

-
-static void curl_readv_bh_cb(void *p)
+static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
 {
+    BDRVCURLState *s = bs->opaque;
+    CURLAIOCB *acb;
+    size_t start = sector_num * SECTOR_SIZE;
+    size_t end;
    CURLState *state;

-    CURLAIOCB *acb = p;
-    BDRVCURLState *s = acb->common.bs->opaque;
+    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;

-    qemu_bh_delete(acb->bh);
-    acb->bh = NULL;
-
-    size_t start = acb->sector_num * SECTOR_SIZE;
-    size_t end;
+    acb->qiov = qiov;

    // In case we have the requested data already (e.g. read-ahead),
    // we can just call the callback and be done.
-    switch (curl_find_buf(s, start, acb->nb_sectors * SECTOR_SIZE, acb)) {
+
+    switch (curl_find_buf(s, start, nb_sectors * SECTOR_SIZE, acb)) {
        case FIND_RET_OK:
            qemu_aio_release(acb);
            // fall through
        case FIND_RET_WAIT:
-            return;
+            return &acb->common;
        default:
            break;
    }

    // No cache found, so let's start a new request
+
    state = curl_init_state(s);
-    if (!state) {
-        acb->common.cb(acb->common.opaque, -EIO);
-        qemu_aio_release(acb);
-        return;
-    }
+    if (!state)
+        return NULL;

    acb->start = 0;
-    acb->end = (acb->nb_sectors * SECTOR_SIZE);
+    acb->end = (nb_sectors * SECTOR_SIZE);

    state->buf_off = 0;
    if (state->orig_buf)
-        g_free(state->orig_buf);
+        qemu_free(state->orig_buf);
    state->buf_start = start;
    state->buf_len = acb->end + s->readahead_size;
    end = MIN(start + state->buf_len, s->len) - 1;
-    state->orig_buf = g_malloc(state->buf_len);
+    state->orig_buf = qemu_malloc(state->buf_len);
    state->acb[0] = acb;

    snprintf(state->range, 127, "%zd-%zd", start, end);
    DPRINTF("CURL (AIO): Reading %d at %zd (%s)\n",
-            (acb->nb_sectors * SECTOR_SIZE), start, state->range);
+            (nb_sectors * SECTOR_SIZE), start, state->range);
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
    curl_multi_do(s);

-}
-
-static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    CURLAIOCB *acb;
-
-    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
-
-    if (!acb) {
-        return NULL;
-    }
-
-    acb->qiov = qiov;
-    acb->sector_num = sector_num;
-    acb->nb_sectors = nb_sectors;
-
-    acb->bh = qemu_bh_new(curl_readv_bh_cb, acb);
-
-    if (!acb->bh) {
-        DPRINTF("CURL: qemu_bh_new failed\n");
-        return NULL;
-    }
-
-    qemu_bh_schedule(acb->bh);
    return &acb->common;
 }

@@ -542,7 +476,7 @@ static void curl_close(BlockDriverState *bs)
            s->states[i].curl = NULL;
        }
        if (s->states[i].orig_buf) {
-            g_free(s->states[i].orig_buf);
+            qemu_free(s->states[i].orig_buf);
            s->states[i].orig_buf = NULL;
        }
    }
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -28,7 +28,6 @@
 #include <zlib.h>

 typedef struct BDRVDMGState {
-    CoMutex lock;
    /* each chunk contains a certain number of sectors,
     * offsets[i] is the offset in the .dmg file,
     * lengths[i] is the length of the compressed chunk,
@@ -128,11 +127,11 @@ static int dmg_open(BlockDriverState *bs, int flags)

 	    chunk_count = (count-204)/40;
 	    new_size = sizeof(uint64_t) * (s->n_chunks + chunk_count);
-	    s->types = g_realloc(s->types, new_size/2);
-	    s->offsets = g_realloc(s->offsets, new_size);
-	    s->lengths = g_realloc(s->lengths, new_size);
-	    s->sectors = g_realloc(s->sectors, new_size);
-	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);
+	    s->types = qemu_realloc(s->types, new_size/2);
+	    s->offsets = qemu_realloc(s->offsets, new_size);
+	    s->lengths = qemu_realloc(s->lengths, new_size);
+	    s->sectors = qemu_realloc(s->sectors, new_size);
+	    s->sectorcounts = qemu_realloc(s->sectorcounts, new_size);

 	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
 		s->types[i] = read_uint32(bs, offset);
@@ -171,14 +170,13 @@ static int dmg_open(BlockDriverState *bs, int flags)
    }

    /* initialize zlib engine */
-    s->compressed_chunk = g_malloc(max_compressed_size+1);
-    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
+    s->compressed_chunk = qemu_malloc(max_compressed_size+1);
+    s->uncompressed_chunk = qemu_malloc(512*max_sectors_per_chunk);
    if(inflateInit(&s->zstream) != Z_OK)
 	goto fail;

    s->current_chunk = s->n_chunks;

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    return -1;
@@ -282,17 +280,6 @@ static int dmg_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVDMGState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = dmg_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void dmg_close(BlockDriverState *bs)
 {
    BDRVDMGState *s = bs->opaque;
@@ -313,7 +300,7 @@ static BlockDriver bdrv_dmg = {
    .instance_size	= sizeof(BDRVDMGState),
    .bdrv_probe		= dmg_probe,
    .bdrv_open		= dmg_open,
-    .bdrv_read          = dmg_co_read,
+    .bdrv_read		= dmg_read,
    .bdrv_close		= dmg_close,
 };

--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1,591 +0,0 @@
-/*
- * QEMU Block driver for iSCSI images
- *
- * Copyright (c) 2010-2011 Ronnie Sahlberg <ronniesahlberg@gmail.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "config-host.h"
-
-#include <poll.h>
-#include "qemu-common.h"
-#include "qemu-error.h"
-#include "block_int.h"
-#include "trace.h"
-
-#include <iscsi/iscsi.h>
-#include <iscsi/scsi-lowlevel.h>
-
-
-typedef struct IscsiLun {
-    struct iscsi_context *iscsi;
-    int lun;
-    int block_size;
-    unsigned long num_blocks;
-} IscsiLun;
-
-typedef struct IscsiAIOCB {
-    BlockDriverAIOCB common;
-    QEMUIOVector *qiov;
-    QEMUBH *bh;
-    IscsiLun *iscsilun;
-    struct scsi_task *task;
-    uint8_t *buf;
-    int status;
-    int canceled;
-    size_t read_size;
-    size_t read_offset;
-} IscsiAIOCB;
-
-struct IscsiTask {
-    IscsiLun *iscsilun;
-    BlockDriverState *bs;
-    int status;
-    int complete;
-};
-
-static void
-iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
-                    void *private_data)
-{
-}
-
-static void
-iscsi_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-    IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
-    IscsiLun *iscsilun = acb->iscsilun;
-
-    acb->common.cb(acb->common.opaque, -ECANCELED);
-    acb->canceled = 1;
-
-    /* send a task mgmt call to the target to cancel the task on the target */
-    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
-                                     iscsi_abort_task_cb, NULL);
-
-    /* then also cancel the task locally in libiscsi */
-    iscsi_scsi_task_cancel(iscsilun->iscsi, acb->task);
-}
-
-static AIOPool iscsi_aio_pool = {
-    .aiocb_size         = sizeof(IscsiAIOCB),
-    .cancel             = iscsi_aio_cancel,
-};
-
-
-static void iscsi_process_read(void *arg);
-static void iscsi_process_write(void *arg);
-
-static int iscsi_process_flush(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-
-    return iscsi_queue_length(iscsilun->iscsi) > 0;
-}
-
-static void
-iscsi_set_events(IscsiLun *iscsilun)
-{
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), iscsi_process_read,
-                           (iscsi_which_events(iscsi) & POLLOUT)
-                           ? iscsi_process_write : NULL,
-                           iscsi_process_flush, NULL, iscsilun);
-}
-
-static void
-iscsi_process_read(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    iscsi_service(iscsi, POLLIN);
-    iscsi_set_events(iscsilun);
-}
-
-static void
-iscsi_process_write(void *arg)
-{
-    IscsiLun *iscsilun = arg;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    iscsi_service(iscsi, POLLOUT);
-    iscsi_set_events(iscsilun);
-}
-
-
-static int
-iscsi_schedule_bh(QEMUBHFunc *cb, IscsiAIOCB *acb)
-{
-    acb->bh = qemu_bh_new(cb, acb);
-    if (!acb->bh) {
-        error_report("oom: could not create iscsi bh");
-        return -EIO;
-    }
-
-    qemu_bh_schedule(acb->bh);
-    return 0;
-}
-
-static void
-iscsi_readv_writev_bh_cb(void *p)
-{
-    IscsiAIOCB *acb = p;
-
-    qemu_bh_delete(acb->bh);
-
-    if (acb->canceled == 0) {
-        acb->common.cb(acb->common.opaque, acb->status);
-    }
-
-    qemu_aio_release(acb);
-}
-
-
-static void
-iscsi_aio_write10_cb(struct iscsi_context *iscsi, int status,
-                     void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    trace_iscsi_aio_write10_cb(iscsi, status, acb, acb->canceled);
-
-    g_free(acb->buf);
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status < 0) {
-        error_report("Failed to write10 data to iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static int64_t sector_qemu2lun(int64_t sector, IscsiLun *iscsilun)
-{
-    return sector * BDRV_SECTOR_SIZE / iscsilun->block_size;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
-                 QEMUIOVector *qiov, int nb_sectors,
-                 BlockDriverCompletionFunc *cb,
-                 void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-    size_t size;
-    int fua = 0;
-
-    /* set FUA on writes when cache mode is write through */
-    if (!(bs->open_flags & BDRV_O_CACHE_WB)) {
-        fua = 1;
-    }
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-    trace_iscsi_aio_writev(iscsi, sector_num, nb_sectors, opaque, acb);
-
-    acb->iscsilun = iscsilun;
-    acb->qiov     = qiov;
-
-    acb->canceled   = 0;
-
-    /* XXX we should pass the iovec to write10 to avoid the extra copy */
-    /* this will allow us to get rid of 'buf' completely */
-    size = nb_sectors * BDRV_SECTOR_SIZE;
-    acb->buf = g_malloc(size);
-    qemu_iovec_to_buffer(acb->qiov, acb->buf);
-    acb->task = iscsi_write10_task(iscsi, iscsilun->lun, acb->buf, size,
-                              sector_qemu2lun(sector_num, iscsilun),
-                              fua, 0, iscsilun->block_size,
-                              iscsi_aio_write10_cb, acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send write10 command. %s",
-                     iscsi_get_error(iscsi));
-        g_free(acb->buf);
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-static void
-iscsi_aio_read10_cb(struct iscsi_context *iscsi, int status,
-                    void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    trace_iscsi_aio_read10_cb(iscsi, status, acb, acb->canceled);
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status != 0) {
-        error_report("Failed to read10 data from iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
-                QEMUIOVector *qiov, int nb_sectors,
-                BlockDriverCompletionFunc *cb,
-                void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-    size_t qemu_read_size, lun_read_size;
-    int i;
-
-    qemu_read_size = BDRV_SECTOR_SIZE * (size_t)nb_sectors;
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-    trace_iscsi_aio_readv(iscsi, sector_num, nb_sectors, opaque, acb);
-
-    acb->iscsilun = iscsilun;
-    acb->qiov     = qiov;
-
-    acb->canceled    = 0;
-    acb->read_size   = qemu_read_size;
-    acb->buf         = NULL;
-
-    /* If LUN blocksize is bigger than BDRV_BLOCK_SIZE a read from QEMU
-     * may be misaligned to the LUN, so we may need to read some extra
-     * data.
-     */
-    acb->read_offset = 0;
-    if (iscsilun->block_size > BDRV_SECTOR_SIZE) {
-        uint64_t bdrv_offset = BDRV_SECTOR_SIZE * sector_num;
-
-        acb->read_offset  = bdrv_offset % iscsilun->block_size;
-    }
-
-    lun_read_size  = (qemu_read_size + iscsilun->block_size
-                     + acb->read_offset - 1)
-                     / iscsilun->block_size * iscsilun->block_size;
-    acb->task = iscsi_read10_task(iscsi, iscsilun->lun,
-                             sector_qemu2lun(sector_num, iscsilun),
-                             lun_read_size, iscsilun->block_size,
-                             iscsi_aio_read10_cb, acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send read10 command. %s",
-                     iscsi_get_error(iscsi));
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    for (i = 0; i < acb->qiov->niov; i++) {
-        scsi_task_add_data_in_buffer(acb->task,
-                acb->qiov->iov[i].iov_len,
-                acb->qiov->iov[i].iov_base);
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-
-static void
-iscsi_synccache10_cb(struct iscsi_context *iscsi, int status,
-                     void *command_data, void *opaque)
-{
-    IscsiAIOCB *acb = opaque;
-
-    if (acb->canceled != 0) {
-        qemu_aio_release(acb);
-        scsi_free_scsi_task(acb->task);
-        acb->task = NULL;
-        return;
-    }
-
-    acb->status = 0;
-    if (status < 0) {
-        error_report("Failed to sync10 data on iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        acb->status = -EIO;
-    }
-
-    iscsi_schedule_bh(iscsi_readv_writev_bh_cb, acb);
-    scsi_free_scsi_task(acb->task);
-    acb->task = NULL;
-}
-
-static BlockDriverAIOCB *
-iscsi_aio_flush(BlockDriverState *bs,
-                BlockDriverCompletionFunc *cb, void *opaque)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-    IscsiAIOCB *acb;
-
-    acb = qemu_aio_get(&iscsi_aio_pool, bs, cb, opaque);
-
-    acb->iscsilun = iscsilun;
-    acb->canceled   = 0;
-
-    acb->task = iscsi_synchronizecache10_task(iscsi, iscsilun->lun,
-                                         0, 0, 0, 0,
-                                         iscsi_synccache10_cb,
-                                         acb);
-    if (acb->task == NULL) {
-        error_report("iSCSI: Failed to send synchronizecache10 command. %s",
-                     iscsi_get_error(iscsi));
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
-    iscsi_set_events(iscsilun);
-
-    return &acb->common;
-}
-
-static int64_t
-iscsi_getlength(BlockDriverState *bs)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    int64_t len;
-
-    len  = iscsilun->num_blocks;
-    len *= iscsilun->block_size;
-
-    return len;
-}
-
-static void
-iscsi_readcapacity10_cb(struct iscsi_context *iscsi, int status,
-                        void *command_data, void *opaque)
-{
-    struct IscsiTask *itask = opaque;
-    struct scsi_readcapacity10 *rc10;
-    struct scsi_task *task = command_data;
-
-    if (status != 0) {
-        error_report("iSCSI: Failed to read capacity of iSCSI lun. %s",
-                     iscsi_get_error(iscsi));
-        itask->status   = 1;
-        itask->complete = 1;
-        scsi_free_scsi_task(task);
-        return;
-    }
-
-    rc10 = scsi_datain_unmarshall(task);
-    if (rc10 == NULL) {
-        error_report("iSCSI: Failed to unmarshall readcapacity10 data.");
-        itask->status   = 1;
-        itask->complete = 1;
-        scsi_free_scsi_task(task);
-        return;
-    }
-
-    itask->iscsilun->block_size = rc10->block_size;
-    itask->iscsilun->num_blocks = rc10->lba;
-    itask->bs->total_sectors = (uint64_t)rc10->lba *
-                               rc10->block_size / BDRV_SECTOR_SIZE ;
-
-    itask->status   = 0;
-    itask->complete = 1;
-    scsi_free_scsi_task(task);
-}
-
-
-static void
-iscsi_connect_cb(struct iscsi_context *iscsi, int status, void *command_data,
-                 void *opaque)
-{
-    struct IscsiTask *itask = opaque;
-    struct scsi_task *task;
-
-    if (status != 0) {
-        itask->status   = 1;
-        itask->complete = 1;
-        return;
-    }
-
-    task = iscsi_readcapacity10_task(iscsi, itask->iscsilun->lun, 0, 0,
-                                   iscsi_readcapacity10_cb, opaque);
-    if (task == NULL) {
-        error_report("iSCSI: failed to send readcapacity command.");
-        itask->status   = 1;
-        itask->complete = 1;
-        return;
-    }
-}
-
-/*
- * We support iscsi url's on the form
- * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
- */
-static int iscsi_open(BlockDriverState *bs, const char *filename, int flags)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = NULL;
-    struct iscsi_url *iscsi_url = NULL;
-    struct IscsiTask task;
-    int ret;
-
-    if ((BDRV_SECTOR_SIZE % 512) != 0) {
-        error_report("iSCSI: Invalid BDRV_SECTOR_SIZE. "
-                     "BDRV_SECTOR_SIZE(%lld) is not a multiple "
-                     "of 512", BDRV_SECTOR_SIZE);
-        return -EINVAL;
-    }
-
-    memset(iscsilun, 0, sizeof(IscsiLun));
-
-    /* Should really append the KVM name after the ':' here */
-    iscsi = iscsi_create_context("iqn.2008-11.org.linux-kvm:");
-    if (iscsi == NULL) {
-        error_report("iSCSI: Failed to create iSCSI context.");
-        ret = -ENOMEM;
-        goto failed;
-    }
-
-    iscsi_url = iscsi_parse_full_url(iscsi, filename);
-    if (iscsi_url == NULL) {
-        error_report("Failed to parse URL : %s %s", filename,
-                     iscsi_get_error(iscsi));
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_set_targetname(iscsi, iscsi_url->target)) {
-        error_report("iSCSI: Failed to set target name.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_url->user != NULL) {
-        ret = iscsi_set_initiator_username_pwd(iscsi, iscsi_url->user,
-                                              iscsi_url->passwd);
-        if (ret != 0) {
-            error_report("Failed to set initiator username and password");
-            ret = -EINVAL;
-            goto failed;
-        }
-    }
-    if (iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL) != 0) {
-        error_report("iSCSI: Failed to set session type to normal.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C);
-
-    task.iscsilun = iscsilun;
-    task.status = 0;
-    task.complete = 0;
-    task.bs = bs;
-
-    iscsilun->iscsi = iscsi;
-    iscsilun->lun   = iscsi_url->lun;
-
-    if (iscsi_full_connect_async(iscsi, iscsi_url->portal, iscsi_url->lun,
-                                 iscsi_connect_cb, &task)
-        != 0) {
-        error_report("iSCSI: Failed to start async connect.");
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    while (!task.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_aio_wait();
-    }
-    if (task.status != 0) {
-        error_report("iSCSI: Failed to connect to LUN : %s",
-                     iscsi_get_error(iscsi));
-        ret = -EINVAL;
-        goto failed;
-    }
-
-    if (iscsi_url != NULL) {
-        iscsi_destroy_url(iscsi_url);
-    }
-    return 0;
-
-failed:
-    if (iscsi_url != NULL) {
-        iscsi_destroy_url(iscsi_url);
-    }
-    if (iscsi != NULL) {
-        iscsi_destroy_context(iscsi);
-    }
-    memset(iscsilun, 0, sizeof(IscsiLun));
-    return ret;
-}
-
-static void iscsi_close(BlockDriverState *bs)
-{
-    IscsiLun *iscsilun = bs->opaque;
-    struct iscsi_context *iscsi = iscsilun->iscsi;
-
-    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), NULL, NULL, NULL, NULL, NULL);
-    iscsi_destroy_context(iscsi);
-    memset(iscsilun, 0, sizeof(IscsiLun));
-}
-
-static BlockDriver bdrv_iscsi = {
-    .format_name     = "iscsi",
-    .protocol_name   = "iscsi",
-
-    .instance_size   = sizeof(IscsiLun),
-    .bdrv_file_open  = iscsi_open,
-    .bdrv_close      = iscsi_close,
-
-    .bdrv_getlength  = iscsi_getlength,
-
-    .bdrv_aio_readv  = iscsi_aio_readv,
-    .bdrv_aio_writev = iscsi_aio_writev,
-    .bdrv_aio_flush  = iscsi_aio_flush,
-};
-
-static void iscsi_block_init(void)
-{
-    bdrv_register(&bdrv_iscsi);
-}
-
-block_init(iscsi_block_init);
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -28,156 +28,97 @@

 #include "qemu-common.h"
 #include "nbd.h"
-#include "block_int.h"
 #include "module.h"
-#include "qemu_socket.h"

 #include <sys/types.h>
 #include <unistd.h>

 #define EN_OPTSTR ":exportname="

-/* #define DEBUG_NBD */
-
-#if defined(DEBUG_NBD)
-#define logout(fmt, ...) \
-                fprintf(stderr, "nbd\t%-24s" fmt, __func__, ##__VA_ARGS__)
-#else
-#define logout(fmt, ...) ((void)0)
-#endif
-
 typedef struct BDRVNBDState {
-    CoMutex lock;
    int sock;
-    uint32_t nbdflags;
    off_t size;
    size_t blocksize;
-    char *export_name; /* An NBD server may export several devices */
-
-    /* If it begins with  '/', this is a UNIX domain socket. Otherwise,
-     * it's a string of the form <hostname|ip4|\[ip6\]>:port
-     */
-    char *host_spec;
 } BDRVNBDState;

-static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
-{
-    char *file;
-    char *export_name;
-    const char *host_spec;
-    const char *unixpath;
-    int err = -EINVAL;
-
-    file = g_strdup(filename);
-
-    export_name = strstr(file, EN_OPTSTR);
-    if (export_name) {
-        if (export_name[strlen(EN_OPTSTR)] == 0) {
-            goto out;
-        }
-        export_name[0] = 0; /* truncate 'file' */
-        export_name += strlen(EN_OPTSTR);
-        s->export_name = g_strdup(export_name);
-    }
-
-    /* extract the host_spec - fail if it's not nbd:... */
-    if (!strstart(file, "nbd:", &host_spec)) {
-        goto out;
-    }
-
-    /* are we a UNIX or TCP socket? */
-    if (strstart(host_spec, "unix:", &unixpath)) {
-        if (unixpath[0] != '/') { /* We demand  an absolute path*/
-            goto out;
-        }
-        s->host_spec = g_strdup(unixpath);
-    } else {
-        s->host_spec = g_strdup(host_spec);
-    }
-
-    err = 0;
-
-out:
-    g_free(file);
-    if (err != 0) {
-        g_free(s->export_name);
-        g_free(s->host_spec);
-    }
-    return err;
-}
-
-static int nbd_establish_connection(BlockDriverState *bs)
-{
-    BDRVNBDState *s = bs->opaque;
-    int sock;
-    int ret;
-    off_t size;
-    size_t blocksize;
-
-    if (s->host_spec[0] == '/') {
-        sock = unix_socket_outgoing(s->host_spec);
-    } else {
-        sock = tcp_socket_outgoing_spec(s->host_spec);
-    }
-
-    /* Failed to establish connection */
-    if (sock == -1) {
-        logout("Failed to establish connection to NBD server\n");
-        return -errno;
-    }
-
-    /* NBD handshake */
-    ret = nbd_receive_negotiate(sock, s->export_name, &s->nbdflags, &size,
-                                &blocksize);
-    if (ret == -1) {
-        logout("Failed to negotiate with the NBD server\n");
-        closesocket(sock);
-        return -errno;
-    }
-
-    /* Now that we're connected, set the socket to be non-blocking */
-    socket_set_nonblock(sock);
-
-    s->sock = sock;
-    s->size = size;
-    s->blocksize = blocksize;
-
-    logout("Established connection with NBD server\n");
-    return 0;
-}
-
-static void nbd_teardown_connection(BlockDriverState *bs)
-{
-    BDRVNBDState *s = bs->opaque;
-    struct nbd_request request;
-
-    request.type = NBD_CMD_DISC;
-    request.handle = (uint64_t)(intptr_t)bs;
-    request.from = 0;
-    request.len = 0;
-    nbd_send_request(s->sock, &request);
-
-    closesocket(s->sock);
-}
-
 static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
 {
    BDRVNBDState *s = bs->opaque;
-    int result;
+    uint32_t nbdflags;

-    /* Pop the config into our state object. Exit if invalid. */
-    result = nbd_config(s, filename, flags);
-    if (result != 0) {
-        return result;
+    char *file;
+    char *name;
+    const char *host;
+    const char *unixpath;
+    int sock;
+    off_t size;
+    size_t blocksize;
+    int ret;
+    int err = -EINVAL;
+
+    file = qemu_strdup(filename);
+
+    name = strstr(file, EN_OPTSTR);
+    if (name) {
+        if (name[strlen(EN_OPTSTR)] == 0) {
+            goto out;
+        }
+        name[0] = 0;
+        name += strlen(EN_OPTSTR);
    }

-    /* establish TCP connection, return error if it fails
-     * TODO: Configurable retry-until-timeout behaviour.
-     */
-    result = nbd_establish_connection(bs);
+    if (!strstart(file, "nbd:", &host)) {
+        goto out;
+    }

-    qemu_co_mutex_init(&s->lock);
-    return result;
+    if (strstart(host, "unix:", &unixpath)) {
+
+        if (unixpath[0] != '/') {
+            goto out;
+        }
+
+        sock = unix_socket_outgoing(unixpath);
+
+    } else {
+        uint16_t port = NBD_DEFAULT_PORT;
+        char *p, *r;
+        char hostname[128];
+
+        pstrcpy(hostname, 128, host);
+
+        p = strchr(hostname, ':');
+        if (p != NULL) {
+            *p = '\0';
+            p++;
+
+            port = strtol(p, &r, 0);
+            if (r == p) {
+                goto out;
+            }
+        }
+
+        sock = tcp_socket_outgoing(hostname, port);
+    }
+
+    if (sock == -1) {
+        err = -errno;
+        goto out;
+    }
+
+    ret = nbd_receive_negotiate(sock, name, &nbdflags, &size, &blocksize);
+    if (ret == -1) {
+        err = -errno;
+        goto out;
+    }
+
+    s->sock = sock;
+    s->size = size;
+    s->blocksize = blocksize;
+    err = 0;
+
+out:
+    qemu_free(file);
+    return err;
 }

 static int nbd_read(BlockDriverState *bs, int64_t sector_num,
@@ -240,35 +181,18 @@ static int nbd_write(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int nbd_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVNBDState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = nbd_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
-static coroutine_fn int nbd_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVNBDState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = nbd_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void nbd_close(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;
-    g_free(s->export_name);
-    g_free(s->host_spec);
+    struct nbd_request request;

-    nbd_teardown_connection(bs);
+    request.type = NBD_CMD_DISC;
+    request.handle = (uint64_t)(intptr_t)bs;
+    request.from = 0;
+    request.len = 0;
+    nbd_send_request(s->sock, &request);
+
+    close(s->sock);
 }

 static int64_t nbd_getlength(BlockDriverState *bs)
@@ -282,8 +206,8 @@ static BlockDriver bdrv_nbd = {
    .format_name	= "nbd",
    .instance_size	= sizeof(BDRVNBDState),
    .bdrv_file_open	= nbd_open,
-    .bdrv_read          = nbd_co_read,
-    .bdrv_write         = nbd_co_write,
+    .bdrv_read		= nbd_read,
+    .bdrv_write		= nbd_write,
    .bdrv_close		= nbd_close,
    .bdrv_getlength	= nbd_getlength,
    .protocol_name	= "nbd",
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -43,10 +43,9 @@ struct parallels_header {
    uint32_t catalog_entries;
    uint32_t nb_sectors;
    char padding[24];
-} QEMU_PACKED;
+} __attribute__((packed));

 typedef struct BDRVParallelsState {
-    CoMutex lock;

    uint32_t *catalog_bitmap;
    int catalog_size;
@@ -89,18 +88,17 @@ static int parallels_open(BlockDriverState *bs, int flags)
    s->tracks = le32_to_cpu(ph.tracks);

    s->catalog_size = le32_to_cpu(ph.catalog_entries);
-    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
+    s->catalog_bitmap = qemu_malloc(s->catalog_size * 4);
    if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
 	s->catalog_size * 4)
 	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

-    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
    if (s->catalog_bitmap)
-	g_free(s->catalog_bitmap);
+	qemu_free(s->catalog_bitmap);
    return -1;
 }

@@ -136,21 +134,10 @@ static int parallels_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int parallels_co_read(BlockDriverState *bs, int64_t sector_num,
-                                          uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVParallelsState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = parallels_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static void parallels_close(BlockDriverState *bs)
 {
    BDRVParallelsState *s = bs->opaque;
-    g_free(s->catalog_bitmap);
+    qemu_free(s->catalog_bitmap);
 }

 static BlockDriver bdrv_parallels = {
@@ -158,7 +145,7 @@ static BlockDriver bdrv_parallels = {
    .instance_size	= sizeof(BDRVParallelsState),
    .bdrv_probe		= parallels_probe,
    .bdrv_open		= parallels_open,
-    .bdrv_read          = parallels_co_read,
+    .bdrv_read		= parallels_read,
    .bdrv_close		= parallels_close,
 };

--- a/block/qcow.c
+++ b/block/qcow.c
@@ -26,7 +26,6 @@
 #include "module.h"
 #include <zlib.h>
 #include "aes.h"
-#include "migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -74,8 +73,6 @@ typedef struct BDRVQcowState {
    uint32_t crypt_method_header;
    AES_KEY aes_encrypt_key;
    AES_KEY aes_decrypt_key;
-    CoMutex lock;
-    Error *migration_blocker;
 } BDRVQcowState;

 static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
@@ -131,7 +128,7 @@ static int qcow_open(BlockDriverState *bs, int flags)
    s->l1_size = (header.size + (1LL << shift) - 1) >> shift;

    s->l1_table_offset = header.l1_table_offset;
-    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    s->l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
    if (!s->l1_table)
        goto fail;
    if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
@@ -141,13 +138,13 @@ static int qcow_open(BlockDriverState *bs, int flags)
        be64_to_cpus(&s->l1_table[i]);
    }
    /* alloc L2 cache */
-    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    s->l2_cache = qemu_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
    if (!s->l2_cache)
        goto fail;
-    s->cluster_cache = g_malloc(s->cluster_size);
+    s->cluster_cache = qemu_malloc(s->cluster_size);
    if (!s->cluster_cache)
        goto fail;
-    s->cluster_data = g_malloc(s->cluster_size);
+    s->cluster_data = qemu_malloc(s->cluster_size);
    if (!s->cluster_data)
        goto fail;
    s->cluster_cache_offset = -1;
@@ -161,21 +158,13 @@ static int qcow_open(BlockDriverState *bs, int flags)
            goto fail;
        bs->backing_file[len] = '\0';
    }
-
-    /* Disable migration when qcow images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "qcow", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
-    qemu_co_mutex_init(&s->lock);
    return 0;

 fail:
-    g_free(s->l1_table);
-    g_free(s->l2_cache);
-    g_free(s->cluster_cache);
-    g_free(s->cluster_data);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    return -1;
 }

@@ -200,6 +189,24 @@ static int qcow_set_key(BlockDriverState *bs, const char *key)
        return -1;
    if (AES_set_decrypt_key(keybuf, 128, &s->aes_decrypt_key) != 0)
        return -1;
+#if 0
+    /* test */
+    {
+        uint8_t in[16];
+        uint8_t out[16];
+        uint8_t tmp[16];
+        for(i=0;i<16;i++)
+            in[i] = i;
+        AES_encrypt(in, tmp, &s->aes_encrypt_key);
+        AES_decrypt(tmp, out, &s->aes_decrypt_key);
+        for(i = 0; i < 16; i++)
+            printf(" %02x", tmp[i]);
+        printf("\n");
+        for(i = 0; i < 16; i++)
+            printf(" %02x", out[i]);
+        printf("\n");
+    }
+#endif
    return 0;
 }

@@ -433,193 +440,302 @@ static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
    return 0;
 }

-static int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
-                         int nb_sectors, QEMUIOVector *qiov)
+#if 0
+
+static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+                     uint8_t *buf, int nb_sectors)
 {
    BDRVQcowState *s = bs->opaque;
-    int index_in_cluster;
-    int ret = 0, n;
+    int ret, index_in_cluster, n;
    uint64_t cluster_offset;
-    struct iovec hd_iov;
-    QEMUIOVector hd_qiov;
-    uint8_t *buf;
-    void *orig_buf;

-    if (qiov->niov > 1) {
-        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-    } else {
-        orig_buf = NULL;
-        buf = (uint8_t *)qiov->iov->iov_base;
-    }
-
-    qemu_co_mutex_lock(&s->lock);
-
-    while (nb_sectors != 0) {
-        /* prepare next request */
-        cluster_offset = get_cluster_offset(bs, sector_num << 9,
-                                                 0, 0, 0, 0);
+    while (nb_sectors > 0) {
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
        n = s->cluster_sectors - index_in_cluster;
-        if (n > nb_sectors) {
+        if (n > nb_sectors)
            n = nb_sectors;
-        }
-
        if (!cluster_offset) {
            if (bs->backing_hd) {
                /* read from the base image */
-                hd_iov.iov_base = (void *)buf;
-                hd_iov.iov_len = n * 512;
-                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-                qemu_co_mutex_unlock(&s->lock);
-                ret = bdrv_co_readv(bs->backing_hd, sector_num,
-                                    n, &hd_qiov);
-                qemu_co_mutex_lock(&s->lock);
-                if (ret < 0) {
-                    goto fail;
-                }
+                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
+                if (ret < 0)
+                    return -1;
            } else {
-                /* Note: in this case, no need to wait */
                memset(buf, 0, 512 * n);
            }
        } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
-            /* add AIO support for compressed blocks ? */
-            if (decompress_cluster(bs, cluster_offset) < 0) {
-                goto fail;
-            }
-            memcpy(buf,
-                   s->cluster_cache + index_in_cluster * 512, 512 * n);
+            if (decompress_cluster(bs, cluster_offset) < 0)
+                return -1;
+            memcpy(buf, s->cluster_cache + index_in_cluster * 512, 512 * n);
        } else {
-            if ((cluster_offset & 511) != 0) {
-                goto fail;
-            }
-            hd_iov.iov_base = (void *)buf;
-            hd_iov.iov_len = n * 512;
-            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-            qemu_co_mutex_unlock(&s->lock);
-            ret = bdrv_co_readv(bs->file,
-                                (cluster_offset >> 9) + index_in_cluster,
-                                n, &hd_qiov);
-            qemu_co_mutex_lock(&s->lock);
-            if (ret < 0) {
-                break;
-            }
+            ret = bdrv_pread(bs->file, cluster_offset + index_in_cluster * 512, buf, n * 512);
+            if (ret != n * 512)
+                return -1;
            if (s->crypt_method) {
-                encrypt_sectors(s, sector_num, buf, buf,
-                                n, 0,
+                encrypt_sectors(s, sector_num, buf, buf, n, 0,
                                &s->aes_decrypt_key);
            }
        }
-        ret = 0;
-
        nb_sectors -= n;
        sector_num += n;
        buf += n * 512;
    }
+    return 0;
+}
+#endif

-done:
-    qemu_co_mutex_unlock(&s->lock);
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    QEMUIOVector *qiov;
+    uint8_t *buf;
+    void *orig_buf;
+    int nb_sectors;
+    int n;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    struct iovec hd_iov;
+    QEMUIOVector hd_qiov;
+    BlockDriverAIOCB *hd_aiocb;
+} QCowAIOCB;

-    if (qiov->niov > 1) {
-        qemu_iovec_from_buffer(qiov, orig_buf, qiov->size);
-        qemu_vfree(orig_buf);
-    }
-
-    return ret;
-
-fail:
-    ret = -EIO;
-    goto done;
+static void qcow_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = container_of(blockacb, QCowAIOCB, common);
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
 }

-static int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
-                          int nb_sectors, QEMUIOVector *qiov)
+static AIOPool qcow_aio_pool = {
+    .aiocb_size         = sizeof(QCowAIOCB),
+    .cancel             = qcow_aio_cancel,
+};
+
+static QCowAIOCB *qcow_aio_setup(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque, int is_write)
 {
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(&qcow_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->qiov = qiov;
+    if (qiov->niov > 1) {
+        acb->buf = acb->orig_buf = qemu_blockalign(bs, qiov->size);
+        if (is_write)
+            qemu_iovec_to_buffer(qiov, acb->buf);
+    } else {
+        acb->buf = (uint8_t *)qiov->iov->iov_base;
+    }
+    acb->nb_sectors = nb_sectors;
+    acb->n = 0;
+    acb->cluster_offset = 0;
+    return acb;
+}
+
+static void qcow_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0)
+        goto done;
+
+ redo:
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            encrypt_sectors(s, acb->sector_num, acb->buf, acb->buf,
+                            acb->n, 0,
+                            &s->aes_decrypt_key);
+        }
+    }
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    /* prepare next AIO request */
+    acb->cluster_offset = get_cluster_offset(bs, acb->sector_num << 9,
+                                             0, 0, 0, 0);
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+
+    if (!acb->cluster_offset) {
+        if (bs->backing_hd) {
+            /* read from the base image */
+            acb->hd_iov.iov_base = (void *)acb->buf;
+            acb->hd_iov.iov_len = acb->n * 512;
+            qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+            acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num,
+                &acb->hd_qiov, acb->n, qcow_aio_read_cb, acb);
+            if (acb->hd_aiocb == NULL)
+                goto done;
+        } else {
+            /* Note: in this case, no need to wait */
+            memset(acb->buf, 0, 512 * acb->n);
+            goto redo;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        if (decompress_cluster(bs, acb->cluster_offset) < 0)
+            goto done;
+        memcpy(acb->buf,
+               s->cluster_cache + index_in_cluster * 512, 512 * acb->n);
+        goto redo;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto done;
+        }
+        acb->hd_iov.iov_base = (void *)acb->buf;
+        acb->hd_iov.iov_len = acb->n * 512;
+        qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+        acb->hd_aiocb = bdrv_aio_readv(bs->file,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            &acb->hd_qiov, acb->n, qcow_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL)
+            goto done;
+    }
+
+    return;
+
+done:
+    if (acb->qiov->niov > 1) {
+        qemu_iovec_from_buffer(acb->qiov, acb->orig_buf, acb->qiov->size);
+        qemu_vfree(acb->orig_buf);
+    }
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow_aio_readv(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    QCowAIOCB *acb;
+
+    acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    if (!acb)
+        return NULL;
+
+    qcow_aio_read_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow_aio_write_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster;
    uint64_t cluster_offset;
    const uint8_t *src_buf;
-    int ret = 0, n;
-    uint8_t *cluster_data = NULL;
-    struct iovec hd_iov;
-    QEMUIOVector hd_qiov;
-    uint8_t *buf;
-    void *orig_buf;
+
+    acb->hd_aiocb = NULL;
+
+    if (ret < 0)
+        goto done;
+
+    acb->nb_sectors -= acb->n;
+    acb->sector_num += acb->n;
+    acb->buf += acb->n * 512;
+
+    if (acb->nb_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    acb->n = s->cluster_sectors - index_in_cluster;
+    if (acb->n > acb->nb_sectors)
+        acb->n = acb->nb_sectors;
+    cluster_offset = get_cluster_offset(bs, acb->sector_num << 9, 1, 0,
+                                        index_in_cluster,
+                                        index_in_cluster + acb->n);
+    if (!cluster_offset || (cluster_offset & 511) != 0) {
+        ret = -EIO;
+        goto done;
+    }
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(s->cluster_size);
+            if (!acb->cluster_data) {
+                ret = -ENOMEM;
+                goto done;
+            }
+        }
+        encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->buf,
+                        acb->n, 1, &s->aes_encrypt_key);
+        src_buf = acb->cluster_data;
+    } else {
+        src_buf = acb->buf;
+    }
+
+    acb->hd_iov.iov_base = (void *)src_buf;
+    acb->hd_iov.iov_len = acb->n * 512;
+    qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
+    acb->hd_aiocb = bdrv_aio_writev(bs->file,
+                                    (cluster_offset >> 9) + index_in_cluster,
+                                    &acb->hd_qiov, acb->n,
+                                    qcow_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL)
+        goto done;
+    return;
+
+done:
+    if (acb->qiov->niov > 1)
+        qemu_vfree(acb->orig_buf);
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow_aio_writev(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;

    s->cluster_cache_offset = -1; /* disable compressed cache */

-    if (qiov->niov > 1) {
-        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-        qemu_iovec_to_buffer(qiov, buf);
-    } else {
-        orig_buf = NULL;
-        buf = (uint8_t *)qiov->iov->iov_base;
-    }
+    acb = qcow_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
+    if (!acb)
+        return NULL;

-    qemu_co_mutex_lock(&s->lock);

-    while (nb_sectors != 0) {
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-        n = s->cluster_sectors - index_in_cluster;
-        if (n > nb_sectors) {
-            n = nb_sectors;
-        }
-        cluster_offset = get_cluster_offset(bs, sector_num << 9, 1, 0,
-                                            index_in_cluster,
-                                            index_in_cluster + n);
-        if (!cluster_offset || (cluster_offset & 511) != 0) {
-            ret = -EIO;
-            break;
-        }
-        if (s->crypt_method) {
-            if (!cluster_data) {
-                cluster_data = g_malloc0(s->cluster_size);
-            }
-            encrypt_sectors(s, sector_num, cluster_data, buf,
-                            n, 1, &s->aes_encrypt_key);
-            src_buf = cluster_data;
-        } else {
-            src_buf = buf;
-        }
-
-        hd_iov.iov_base = (void *)src_buf;
-        hd_iov.iov_len = n * 512;
-        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-        qemu_co_mutex_unlock(&s->lock);
-        ret = bdrv_co_writev(bs->file,
-                             (cluster_offset >> 9) + index_in_cluster,
-                             n, &hd_qiov);
-        qemu_co_mutex_lock(&s->lock);
-        if (ret < 0) {
-            break;
-        }
-        ret = 0;
-
-        nb_sectors -= n;
-        sector_num += n;
-        buf += n * 512;
-    }
-    qemu_co_mutex_unlock(&s->lock);
-
-    if (qiov->niov > 1) {
-        qemu_vfree(orig_buf);
-    }
-    g_free(cluster_data);
-
-    return ret;
+    qcow_aio_write_cb(acb, 0);
+    return &acb->common;
 }

 static void qcow_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-
-    g_free(s->l1_table);
-    g_free(s->l2_cache);
-    g_free(s->cluster_cache);
-    g_free(s->cluster_data);
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
+    qemu_free(s->l1_table);
+    qemu_free(s->l2_cache);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
 }

 static int qcow_create(const char *filename, QEMUOptionParameter *options)
@@ -747,7 +863,9 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
    if (nb_sectors != s->cluster_sectors)
        return -EINVAL;

-    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    if (!out_buf)
+        return -1;

    /* best compression, small window, no zlib header */
    memset(&strm, 0, sizeof(strm));
@@ -755,8 +873,8 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
                       Z_DEFLATED, -12,
                       9, Z_DEFAULT_STRATEGY);
    if (ret != 0) {
-        ret = -EINVAL;
-        goto fail;
+        qemu_free(out_buf);
+        return -1;
    }

    strm.avail_in = s->cluster_size;
@@ -766,9 +884,9 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,

    ret = deflate(&strm, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
+        qemu_free(out_buf);
        deflateEnd(&strm);
-        ret = -EINVAL;
-        goto fail;
+        return -1;
    }
    out_len = strm.next_out - out_buf;

@@ -776,34 +894,30 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = bdrv_write(bs, sector_num, buf, s->cluster_sectors);
-        if (ret < 0) {
-            goto fail;
-        }
+        bdrv_write(bs, sector_num, buf, s->cluster_sectors);
    } else {
        cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
                                            out_len, 0, 0);
-        if (cluster_offset == 0) {
-            ret = -EIO;
-            goto fail;
-        }
-
        cluster_offset &= s->cluster_offset_mask;
-        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
-        if (ret < 0) {
-            goto fail;
+        if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
+            qemu_free(out_buf);
+            return -1;
        }
    }

-    ret = 0;
-fail:
-    g_free(out_buf);
-    return ret;
+    qemu_free(out_buf);
+    return 0;
 }

-static coroutine_fn int qcow_co_flush(BlockDriverState *bs)
+static int qcow_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
+}
+
+static BlockDriverAIOCB *qcow_aio_flush(BlockDriverState *bs,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
@@ -840,16 +954,15 @@ static BlockDriver bdrv_qcow = {
    .bdrv_open		= qcow_open,
    .bdrv_close		= qcow_close,
    .bdrv_create	= qcow_create,
-
-    .bdrv_co_readv          = qcow_co_readv,
-    .bdrv_co_writev         = qcow_co_writev,
-    .bdrv_co_flush_to_disk  = qcow_co_flush,
-    .bdrv_is_allocated      = qcow_is_allocated,
-
-    .bdrv_set_key           = qcow_set_key,
-    .bdrv_make_empty        = qcow_make_empty,
-    .bdrv_write_compressed  = qcow_write_compressed,
-    .bdrv_get_info          = qcow_get_info,
+    .bdrv_flush		= qcow_flush,
+    .bdrv_is_allocated	= qcow_is_allocated,
+    .bdrv_set_key	= qcow_set_key,
+    .bdrv_make_empty	= qcow_make_empty,
+    .bdrv_aio_readv	= qcow_aio_readv,
+    .bdrv_aio_writev	= qcow_aio_writev,
+    .bdrv_aio_flush	= qcow_aio_flush,
+    .bdrv_write_compressed = qcow_write_compressed,
+    .bdrv_get_info	= qcow_get_info,

    .create_options = qcow_create_options,
 };
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -49,9 +49,9 @@ Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
    Qcow2Cache *c;
    int i;

-    c = g_malloc0(sizeof(*c));
+    c = qemu_mallocz(sizeof(*c));
    c->size = num_tables;
-    c->entries = g_malloc0(sizeof(*c->entries) * num_tables);
+    c->entries = qemu_mallocz(sizeof(*c->entries) * num_tables);
    c->writethrough = writethrough;

    for (i = 0; i < c->size; i++) {
@@ -70,8 +70,8 @@ int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c)
        qemu_vfree(c->entries[i].table);
    }

-    g_free(c->entries);
-    g_free(c);
+    qemu_free(c->entries);
+    qemu_free(c);

    return 0;
 }
@@ -312,15 +312,3 @@ found:
    c->entries[i].dirty = true;
 }

-bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
-    bool enable)
-{
-    bool old = c->writethrough;
-
-    if (!old && enable) {
-        qcow2_cache_flush(bs, c);
-    }
-
-    c->writethrough = enable;
-    return old;
-}
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -53,24 +53,24 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
    }

 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
+    printf("grow l1_table from %d to %d\n", s->l1_size, new_l1_size);
 #endif

    new_l1_size2 = sizeof(uint64_t) * new_l1_size;
-    new_l1_table = g_malloc0(align_offset(new_l1_size2, 512));
+    new_l1_table = qemu_mallocz(align_offset(new_l1_size2, 512));
    memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));

    /* write new table (align to cluster) */
    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
    new_l1_table_offset = qcow2_alloc_clusters(bs, new_l1_size2);
    if (new_l1_table_offset < 0) {
-        g_free(new_l1_table);
+        qemu_free(new_l1_table);
        return new_l1_table_offset;
    }

    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
    if (ret < 0) {
-        goto fail;
+        return ret;
    }

    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_WRITE_TABLE);
@@ -90,14 +90,14 @@ int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size)
    if (ret < 0) {
        goto fail;
    }
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);
    qcow2_free_clusters(bs, s->l1_table_offset, s->l1_size * sizeof(uint64_t));
    s->l1_table_offset = new_l1_table_offset;
    s->l1_table = new_l1_table;
    s->l1_size = new_l1_size;
    return 0;
 fail:
-    g_free(new_l1_table);
+    qemu_free(new_l1_table);
    qcow2_free_clusters(bs, new_l1_table_offset, new_l1_size2);
    return ret;
 }
@@ -381,10 +381,10 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
 * For a given offset of the disk image, find the cluster offset in
 * qcow2 file. The offset is stored in *cluster_offset.
 *
- * on entry, *num is the number of contiguous sectors we'd like to
+ * on entry, *num is the number of contiguous clusters we'd like to
 * access following offset.
 *
- * on exit, *num is the number of contiguous sectors we can read.
+ * on exit, *num is the number of contiguous clusters we can read.
 *
 * Return 0, if the offset is found
 * Return -errno, otherwise.
@@ -515,16 +515,13 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
            return ret;
        }
    } else {
-        /* First allocate a new L2 table (and do COW if needed) */
+        /* FIXME Order */
+        if (l2_offset)
+            qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
        ret = l2_allocate(bs, l1_index, &l2_table);
        if (ret < 0) {
            return ret;
        }
-
-        /* Then decrease the refcount of the old table */
-        if (l2_offset) {
-            qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t));
-        }
        l2_offset = s->l1_table[l1_index] & ~QCOW_OFLAG_COPIED;
    }

@@ -568,10 +565,8 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    }

    cluster_offset = be64_to_cpu(l2_table[l2_index]);
-    if (cluster_offset & QCOW_OFLAG_COPIED) {
-        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-        return 0;
-    }
+    if (cluster_offset & QCOW_OFLAG_COPIED)
+        return cluster_offset & ~QCOW_OFLAG_COPIED;

    if (cluster_offset)
        qcow2_free_any_clusters(bs, cluster_offset, 1);
@@ -614,7 +609,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
    if (m->nb_clusters == 0)
        return 0;

-    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));
+    old_cluster = qemu_malloc(m->nb_clusters * sizeof(uint64_t));

    /* copy content of unmodified sectors */
    start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
@@ -685,7 +680,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)

    ret = 0;
 err:
-    g_free(old_cluster);
+    qemu_free(old_cluster);
    return ret;
 }

@@ -696,15 +691,15 @@ err:
 * If the offset is not found, allocate a new cluster.
 *
 * If the cluster was already allocated, m->nb_clusters is set to 0,
- * other fields in m are meaningless.
+ * m->depends_on is set to NULL and the other fields in m are meaningless.
 *
 * If the cluster is newly allocated, m->nb_clusters is set to the number of
- * contiguous clusters that have been allocated. In this case, the other
- * fields of m are valid and contain information about the first allocated
- * cluster.
+ * contiguous clusters that have been allocated. This may be 0 if the request
+ * conflict with another write request in flight; in this case, m->depends_on
+ * is set and the remaining fields of m are meaningless.
 *
- * If the request conflicts with another write request in flight, the coroutine
- * is queued and will be reentered when the dependency has completed.
+ * If m->nb_clusters is non-zero, the other fields of m are valid and contain
+ * information about the first allocated cluster.
 *
 * Return 0 on success and -errno in error cases
 */
@@ -723,7 +718,6 @@ int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
        return ret;
    }

-again:
    nb_clusters = size_to_clusters(s, n_end << 9);

    nb_clusters = MIN(nb_clusters, s->l2_size - l2_index);
@@ -738,6 +732,7 @@ again:

        cluster_offset &= ~QCOW_OFLAG_COPIED;
        m->nb_clusters = 0;
+        m->depends_on = NULL;

        goto out;
    }
@@ -778,28 +773,28 @@ again:
     */
    QLIST_FOREACH(old_alloc, &s->cluster_allocs, next_in_flight) {

-        uint64_t start = offset >> s->cluster_bits;
-        uint64_t end = start + nb_clusters;
-        uint64_t old_start = old_alloc->offset >> s->cluster_bits;
-        uint64_t old_end = old_start + old_alloc->nb_clusters;
+        uint64_t end_offset = offset + nb_clusters * s->cluster_size;
+        uint64_t old_offset = old_alloc->offset;
+        uint64_t old_end_offset = old_alloc->offset +
+            old_alloc->nb_clusters * s->cluster_size;

-        if (end < old_start || start > old_end) {
+        if (end_offset < old_offset || offset > old_end_offset) {
            /* No intersection */
        } else {
-            if (start < old_start) {
+            if (offset < old_offset) {
                /* Stop at the start of a running allocation */
-                nb_clusters = old_start - start;
+                nb_clusters = (old_offset - offset) >> s->cluster_bits;
            } else {
                nb_clusters = 0;
            }

            if (nb_clusters == 0) {
-                /* Wait for the dependency to complete. We need to recheck
-                 * the free/allocated clusters when we continue. */
-                qemu_co_mutex_unlock(&s->lock);
-                qemu_co_queue_wait(&old_alloc->dependent_requests);
-                qemu_co_mutex_lock(&s->lock);
-                goto again;
+                /* Set dependency and wait for a callback */
+                m->depends_on = old_alloc;
+                m->nb_clusters = 0;
+                *num = 0;
+                ret = 0;
+                goto fail;
            }
        }
    }
@@ -808,25 +803,26 @@ again:
        abort();
    }

-    /* save info needed for meta data update */
-    m->offset = offset;
-    m->n_start = n_start;
-    m->nb_clusters = nb_clusters;
-
    QLIST_INSERT_HEAD(&s->cluster_allocs, m, next_in_flight);

    /* allocate a new cluster */

    cluster_offset = qcow2_alloc_clusters(bs, nb_clusters * s->cluster_size);
    if (cluster_offset < 0) {
+        QLIST_REMOVE(m, next_in_flight);
        ret = cluster_offset;
        goto fail;
    }

+    /* save info needed for meta data update */
+    m->offset = offset;
+    m->n_start = n_start;
+    m->nb_clusters = nb_clusters;
+
 out:
    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
    if (ret < 0) {
-        goto fail_put;
+        return ret;
    }

    m->nb_available = MIN(nb_clusters << (s->cluster_bits - 9), n_end);
@@ -838,8 +834,6 @@ out:

 fail:
    qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-fail_put:
-    QLIST_REMOVE(m, next_in_flight);
    return ret;
 }

@@ -884,11 +878,11 @@ int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
        BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
        ret = bdrv_read(bs->file, coffset >> 9, s->cluster_data, nb_csectors);
        if (ret < 0) {
-            return ret;
+            return -1;
        }
        if (decompress_buffer(s->cluster_cache, s->cluster_size,
                              s->cluster_data + sector_offset, csize) < 0) {
-            return -EIO;
+            return -1;
        }
        s->cluster_cache_offset = coffset;
    }
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -41,7 +41,7 @@ int qcow2_refcount_init(BlockDriverState *bs)
    int ret, refcount_table_size2, i;

    refcount_table_size2 = s->refcount_table_size * sizeof(uint64_t);
-    s->refcount_table = g_malloc(refcount_table_size2);
+    s->refcount_table = qemu_malloc(refcount_table_size2);
    if (s->refcount_table_size > 0) {
        BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_LOAD);
        ret = bdrv_pread(bs->file, s->refcount_table_offset,
@@ -59,7 +59,7 @@ int qcow2_refcount_init(BlockDriverState *bs)
 void qcow2_refcount_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-    g_free(s->refcount_table);
+    qemu_free(s->refcount_table);
 }


@@ -323,8 +323,8 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t meta_offset = (blocks_used * refcount_block_clusters) *
        s->cluster_size;
    uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
-    uint16_t *new_blocks = g_malloc0(blocks_clusters * s->cluster_size);
-    uint64_t *new_table = g_malloc0(table_size * sizeof(uint64_t));
+    uint16_t *new_blocks = qemu_mallocz(blocks_clusters * s->cluster_size);
+    uint64_t *new_table = qemu_mallocz(table_size * sizeof(uint64_t));

    assert(meta_offset >= (s->free_cluster_index * s->cluster_size));

@@ -349,7 +349,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
    ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
        blocks_clusters * s->cluster_size);
-    g_free(new_blocks);
+    qemu_free(new_blocks);
    if (ret < 0) {
        goto fail_table;
    }
@@ -385,7 +385,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t old_table_offset = s->refcount_table_offset;
    uint64_t old_table_size = s->refcount_table_size;

-    g_free(s->refcount_table);
+    qemu_free(s->refcount_table);
    s->refcount_table = new_table;
    s->refcount_table_size = table_size;
    s->refcount_table_offset = table_offset;
@@ -403,7 +403,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    return new_block;

 fail_table:
-    g_free(new_table);
+    qemu_free(new_table);
 fail_block:
    if (*refcount_block != NULL) {
        qcow2_cache_put(bs, s->refcount_block_cache, (void**) refcount_block);
@@ -422,7 +422,7 @@ static int QEMU_WARN_UNUSED_RESULT update_refcount(BlockDriverState *bs,
    int ret;

 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "update_refcount: offset=%" PRId64 " size=%" PRId64 " addend=%d\n",
+    printf("update_refcount: offset=%" PRId64 " size=%" PRId64 " addend=%d\n",
           offset, length, addend);
 #endif
    if (length < 0) {
@@ -556,7 +556,7 @@ retry:
        }
    }
 #ifdef DEBUG_ALLOC2
-    fprintf(stderr, "alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
+    printf("alloc_clusters: size=%" PRId64 " -> %" PRId64 "\n",
            size,
            (s->free_cluster_index - nb_clusters) << s->cluster_bits);
 #endif
@@ -680,6 +680,24 @@ void qcow2_free_any_clusters(BlockDriverState *bs,



+void qcow2_create_refcount_update(QCowCreateState *s, int64_t offset,
+    int64_t size)
+{
+    int refcount;
+    int64_t start, last, cluster_offset;
+    uint16_t *p;
+
+    start = offset & ~(s->cluster_size - 1);
+    last = (offset + size - 1)  & ~(s->cluster_size - 1);
+    for(cluster_offset = start; cluster_offset <= last;
+        cluster_offset += s->cluster_size) {
+        p = &s->refcount_block[cluster_offset >> s->cluster_bits];
+        refcount = be16_to_cpu(*p);
+        refcount++;
+        *p = cpu_to_be16(refcount);
+    }
+}
+
 /* update the refcounts of snapshots and the copied flag */
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend)
@@ -687,33 +705,22 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    BDRVQcowState *s = bs->opaque;
    uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, l1_allocated;
    int64_t old_offset, old_l2_offset;
-    int i, j, l1_modified = 0, nb_csectors, refcount;
+    int i, j, l1_modified, nb_csectors, refcount;
    int ret;
-    bool old_l2_writethrough, old_refcount_writethrough;
-
-    /* Switch caches to writeback mode during update */
-    old_l2_writethrough =
-        qcow2_cache_set_writethrough(bs, s->l2_table_cache, false);
-    old_refcount_writethrough =
-        qcow2_cache_set_writethrough(bs, s->refcount_block_cache, false);

    l2_table = NULL;
    l1_table = NULL;
    l1_size2 = l1_size * sizeof(uint64_t);
    if (l1_table_offset != s->l1_table_offset) {
        if (l1_size2 != 0) {
-            l1_table = g_malloc0(align_offset(l1_size2, 512));
+            l1_table = qemu_mallocz(align_offset(l1_size2, 512));
        } else {
            l1_table = NULL;
        }
        l1_allocated = 1;
        if (bdrv_pread(bs->file, l1_table_offset,
                       l1_table, l1_size2) != l1_size2)
-        {
-            ret = -EIO;
            goto fail;
-        }
-
        for(i = 0;i < l1_size; i++)
            be64_to_cpus(&l1_table[i]);
    } else {
@@ -722,6 +729,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
        l1_allocated = 0;
    }

+    l1_modified = 0;
    for(i = 0; i < l1_size; i++) {
        l2_offset = l1_table[i];
        if (l2_offset) {
@@ -765,7 +773,6 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                        }

                        if (refcount < 0) {
-                            ret = -EIO;
                            goto fail;
                        }
                    }
@@ -796,7 +803,6 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                refcount = get_refcount(bs, l2_offset >> s->cluster_bits);
            }
            if (refcount < 0) {
-                ret = -EIO;
                goto fail;
            } else if (refcount == 1) {
                l2_offset |= QCOW_OFLAG_COPIED;
@@ -807,18 +813,6 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
            }
        }
    }
-
-    ret = 0;
-fail:
-    if (l2_table) {
-        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-    }
-
-    /* Enable writethrough cache mode again */
-    qcow2_cache_set_writethrough(bs, s->l2_table_cache, old_l2_writethrough);
-    qcow2_cache_set_writethrough(bs, s->refcount_block_cache,
-        old_refcount_writethrough);
-
    if (l1_modified) {
        for(i = 0; i < l1_size; i++)
            cpu_to_be64s(&l1_table[i]);
@@ -829,8 +823,16 @@ fail:
            be64_to_cpus(&l1_table[i]);
    }
    if (l1_allocated)
-        g_free(l1_table);
-    return ret;
+        qemu_free(l1_table);
+    return 0;
+ fail:
+    if (l2_table) {
+        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
+    }
+
+    if (l1_allocated)
+        qemu_free(l1_table);
+    return -EIO;
 }


@@ -903,7 +905,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,

    /* Read L2 table from disk */
    l2_size = s->l2_size * sizeof(uint64_t);
-    l2_table = g_malloc(l2_size);
+    l2_table = qemu_malloc(l2_size);

    if (bdrv_pread(bs->file, l2_offset, l2_table, l2_size) != l2_size)
        goto fail;
@@ -961,12 +963,12 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
        }
    }

-    g_free(l2_table);
+    qemu_free(l2_table);
    return 0;

 fail:
    fprintf(stderr, "ERROR: I/O error in check_refcounts_l2\n");
-    g_free(l2_table);
+    qemu_free(l2_table);
    return -EIO;
 }

@@ -999,7 +1001,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
    if (l1_size2 == 0) {
        l1_table = NULL;
    } else {
-        l1_table = g_malloc(l1_size2);
+        l1_table = qemu_malloc(l1_size2);
        if (bdrv_pread(bs->file, l1_table_offset,
                       l1_table, l1_size2) != l1_size2)
            goto fail;
@@ -1047,13 +1049,13 @@ static int check_refcounts_l1(BlockDriverState *bs,
            }
        }
    }
-    g_free(l1_table);
+    qemu_free(l1_table);
    return 0;

 fail:
    fprintf(stderr, "ERROR: I/O error in check_refcounts_l1\n");
    res->check_errors++;
-    g_free(l1_table);
+    qemu_free(l1_table);
    return -EIO;
 }

@@ -1061,7 +1063,7 @@ fail:
 * Checks an image for refcount consistency.
 *
 * Returns 0 if no errors are found, the number of errors in case the image is
- * detected as corrupted, and -errno when an internal error occurred.
+ * detected as corrupted, and -errno when an internal error occured.
 */
 int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
 {
@@ -1074,7 +1076,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)

    size = bdrv_getlength(bs->file);
    nb_clusters = size_to_clusters(s, size);
-    refcount_table = g_malloc0(nb_clusters * sizeof(uint16_t));
+    refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t));

    /* header */
    inc_refcounts(bs, res, refcount_table, nb_clusters,
@@ -1084,7 +1086,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
    ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
                       s->l1_table_offset, s->l1_size, 1);
    if (ret < 0) {
-        goto fail;
+        return ret;
    }

    /* snapshots */
@@ -1093,7 +1095,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
        ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters,
            sn->l1_table_offset, sn->l1_size, 0);
        if (ret < 0) {
-            goto fail;
+            return ret;
        }
    }
    inc_refcounts(bs, res, refcount_table, nb_clusters,
@@ -1157,11 +1159,8 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
        }
    }

-    ret = 0;
+    qemu_free(refcount_table);

-fail:
-    g_free(refcount_table);
-
-    return ret;
+    return 0;
 }

--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -26,7 +26,7 @@
 #include "block_int.h"
 #include "block/qcow2.h"

-typedef struct QEMU_PACKED QCowSnapshotHeader {
+typedef struct __attribute__((packed)) QCowSnapshotHeader {
    /* header is 8 byte aligned */
    uint64_t l1_table_offset;

@@ -52,10 +52,10 @@ void qcow2_free_snapshots(BlockDriverState *bs)
    int i;

    for(i = 0; i < s->nb_snapshots; i++) {
-        g_free(s->snapshots[i].name);
-        g_free(s->snapshots[i].id_str);
+        qemu_free(s->snapshots[i].name);
+        qemu_free(s->snapshots[i].id_str);
    }
-    g_free(s->snapshots);
+    qemu_free(s->snapshots);
    s->snapshots = NULL;
    s->nb_snapshots = 0;
 }
@@ -76,7 +76,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
    }

    offset = s->snapshots_offset;
-    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
+    s->snapshots = qemu_mallocz(s->nb_snapshots * sizeof(QCowSnapshot));
    for(i = 0; i < s->nb_snapshots; i++) {
        offset = align_offset(offset, 8);
        if (bdrv_pread(bs->file, offset, &h, sizeof(h)) != sizeof(h))
@@ -96,13 +96,13 @@ int qcow2_read_snapshots(BlockDriverState *bs)

        offset += extra_data_size;

-        sn->id_str = g_malloc(id_str_size + 1);
+        sn->id_str = qemu_malloc(id_str_size + 1);
        if (bdrv_pread(bs->file, offset, sn->id_str, id_str_size) != id_str_size)
            goto fail;
        offset += id_str_size;
        sn->id_str[id_str_size] = '\0';

-        sn->name = g_malloc(name_size + 1);
+        sn->name = qemu_malloc(name_size + 1);
        if (bdrv_pread(bs->file, offset, sn->name, name_size) != name_size)
            goto fail;
        offset += name_size;
@@ -252,10 +252,10 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
        return -ENOENT;

-    sn->id_str = g_strdup(sn_info->id_str);
+    sn->id_str = qemu_strdup(sn_info->id_str);
    if (!sn->id_str)
        goto fail;
-    sn->name = g_strdup(sn_info->name);
+    sn->name = qemu_strdup(sn_info->name);
    if (!sn->name)
        goto fail;
    sn->vm_state_size = sn_info->vm_state_size;
@@ -278,7 +278,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    sn->l1_size = s->l1_size;

    if (s->l1_size != 0) {
-        l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+        l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t));
    } else {
        l1_table = NULL;
    }
@@ -289,13 +289,13 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (bdrv_pwrite_sync(bs->file, sn->l1_table_offset,
                    l1_table, s->l1_size * sizeof(uint64_t)) < 0)
        goto fail;
-    g_free(l1_table);
+    qemu_free(l1_table);
    l1_table = NULL;

-    snapshots1 = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
    if (s->snapshots) {
        memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
-        g_free(s->snapshots);
+        qemu_free(s->snapshots);
    }
    s->snapshots = snapshots1;
    s->snapshots[s->nb_snapshots++] = *sn;
@@ -303,15 +303,12 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    if (qcow2_write_snapshots(bs) < 0)
        goto fail;
 #ifdef DEBUG_ALLOC
-    {
-      BdrvCheckResult result = {0};
-      qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 fail:
-    g_free(sn->name);
-    g_free(l1_table);
+    qemu_free(sn->name);
+    qemu_free(l1_table);
    return -1;
 }

@@ -320,8 +317,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
 {
    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
-    int i, snapshot_index;
-    int cur_l1_bytes, sn_l1_bytes;
+    int i, snapshot_index, l1_size2;

    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
    if (snapshot_index < 0)
@@ -334,19 +330,14 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    if (qcow2_grow_l1_table(bs, sn->l1_size, true) < 0)
        goto fail;

-    cur_l1_bytes = s->l1_size * sizeof(uint64_t);
-    sn_l1_bytes = sn->l1_size * sizeof(uint64_t);
-
-    if (cur_l1_bytes > sn_l1_bytes) {
-        memset(s->l1_table + sn->l1_size, 0, cur_l1_bytes - sn_l1_bytes);
-    }
-
+    s->l1_size = sn->l1_size;
+    l1_size2 = s->l1_size * sizeof(uint64_t);
    /* copy the snapshot l1 table to the current l1 table */
    if (bdrv_pread(bs->file, sn->l1_table_offset,
-                   s->l1_table, sn_l1_bytes) < 0)
+                   s->l1_table, l1_size2) != l1_size2)
        goto fail;
    if (bdrv_pwrite_sync(bs->file, s->l1_table_offset,
-                    s->l1_table, cur_l1_bytes) < 0)
+                    s->l1_table, l1_size2) < 0)
        goto fail;
    for(i = 0;i < s->l1_size; i++) {
        be64_to_cpus(&s->l1_table[i]);
@@ -356,10 +347,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
        goto fail;

 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 fail:
@@ -386,8 +374,8 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
        return ret;
    qcow2_free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));

-    g_free(sn->id_str);
-    g_free(sn->name);
+    qemu_free(sn->id_str);
+    qemu_free(sn->name);
    memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
    s->nb_snapshots--;
    ret = qcow2_write_snapshots(bs);
@@ -396,10 +384,7 @@ int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
        return ret;
    }
 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return 0;
 }
@@ -416,7 +401,7 @@ int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        return s->nb_snapshots;
    }

-    sn_tab = g_malloc0(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
+    sn_tab = qemu_mallocz(s->nb_snapshots * sizeof(QEMUSnapshotInfo));
    for(i = 0; i < s->nb_snapshots; i++) {
        sn_info = sn_tab + i;
        sn = s->snapshots + i;
@@ -448,11 +433,11 @@ int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name)
    s->l1_size = sn->l1_size;
    l1_size2 = s->l1_size * sizeof(uint64_t);
    if (s->l1_table != NULL) {
-        g_free(s->l1_table);
+        qemu_free(s->l1_table);
    }

    s->l1_table_offset = sn->l1_table_offset;
-    s->l1_table = g_malloc0(align_offset(l1_size2, 512));
+    s->l1_table = qemu_mallocz(align_offset(l1_size2, 512));

    if (bdrv_pread(bs->file, sn->l1_table_offset,
                   s->l1_table, l1_size2) != l1_size2) {
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -28,7 +28,6 @@
 #include "aes.h"
 #include "block/qcow2.h"
 #include "qemu-error.h"
-#include "qerror.h"

 /*
  Differences with QCOW:
@@ -60,7 +59,7 @@ static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)

    if (buf_size >= sizeof(QCowHeader) &&
        be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
-        be32_to_cpu(cow_header->version) >= QCOW_VERSION)
+        be32_to_cpu(cow_header->version) == QCOW_VERSION)
        return 100;
    else
        return 0;
@@ -87,7 +86,6 @@ static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
    while (offset < end_offset) {

 #ifdef DEBUG_EXT
-        BDRVQcowState *s = bs->opaque;
        /* Sanity check */
        if (offset > s->cluster_size)
            printf("qcow2_read_extension: suspicious offset %lu\n", offset);
@@ -165,18 +163,10 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    be64_to_cpus(&header.snapshots_offset);
    be32_to_cpus(&header.nb_snapshots);

-    if (header.magic != QCOW_MAGIC) {
+    if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION) {
        ret = -EINVAL;
        goto fail;
    }
-    if (header.version != QCOW_VERSION) {
-        char version[64];
-        snprintf(version, sizeof(version), "QCOW version %d", header.version);
-        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
-            bs->device_name, "qcow2", version);
-        ret = -ENOTSUP;
-        goto fail;
-    }
    if (header.cluster_bits < MIN_CLUSTER_BITS ||
        header.cluster_bits > MAX_CLUSTER_BITS) {
        ret = -EINVAL;
@@ -217,7 +207,7 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    }
    s->l1_table_offset = header.l1_table_offset;
    if (s->l1_size > 0) {
-        s->l1_table = g_malloc0(
+        s->l1_table = qemu_mallocz(
            align_offset(s->l1_size * sizeof(uint64_t), 512));
        ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
                         s->l1_size * sizeof(uint64_t));
@@ -230,17 +220,16 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    }

    /* alloc L2 table/refcount block cache */
-    writethrough = ((flags & BDRV_O_CACHE_WB) == 0);
+    writethrough = ((flags & BDRV_O_CACHE_MASK) == 0);
    s->l2_table_cache = qcow2_cache_create(bs, L2_CACHE_SIZE, writethrough);
    s->refcount_block_cache = qcow2_cache_create(bs, REFCOUNT_CACHE_SIZE,
        writethrough);

-    s->cluster_cache = g_malloc(s->cluster_size);
+    s->cluster_cache = qemu_malloc(s->cluster_size);
    /* one more sector for decompressed data alignment */
-    s->cluster_data = qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
+    s->cluster_data = qemu_malloc(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
                                  + 512);
    s->cluster_cache_offset = -1;
-    s->flags = flags;

    ret = qcow2_refcount_init(bs);
    if (ret != 0) {
@@ -278,26 +267,20 @@ static int qcow2_open(BlockDriverState *bs, int flags)
        goto fail;
    }

-    /* Initialise locks */
-    qemu_co_mutex_init(&s->lock);
-
 #ifdef DEBUG_ALLOC
-    {
-        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result);
-    }
+    qcow2_check_refcounts(bs);
 #endif
    return ret;

 fail:
    qcow2_free_snapshots(bs);
    qcow2_refcount_close(bs);
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);
    if (s->l2_table_cache) {
        qcow2_cache_destroy(bs, s->l2_table_cache);
    }
-    g_free(s->cluster_cache);
-    qemu_vfree(s->cluster_data);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    return ret;
 }

@@ -372,255 +355,378 @@ int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
    else
        n1 = bs->total_sectors - sector_num;

-    qemu_iovec_memset_skip(qiov, 0, 512 * (nb_sectors - n1), 512 * n1);
+    qemu_iovec_memset(qiov, 0, 512 * (nb_sectors - n1));

    return n1;
 }

-static int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
-                          int remaining_sectors, QEMUIOVector *qiov)
-{
-    BDRVQcowState *s = bs->opaque;
-    int index_in_cluster, n1;
-    int ret;
-    int cur_nr_sectors; /* number of sectors in current iteration */
-    uint64_t cluster_offset = 0;
-    uint64_t bytes_done = 0;
+typedef struct QCowAIOCB {
+    BlockDriverAIOCB common;
+    int64_t sector_num;
+    QEMUIOVector *qiov;
+    int remaining_sectors;
+    int cur_nr_sectors;	/* number of sectors in current iteration */
+    uint64_t bytes_done;
+    uint64_t cluster_offset;
+    uint8_t *cluster_data;
+    BlockDriverAIOCB *hd_aiocb;
    QEMUIOVector hd_qiov;
-    uint8_t *cluster_data = NULL;
+    QEMUBH *bh;
+    QCowL2Meta l2meta;
+    QLIST_ENTRY(QCowAIOCB) next_depend;
+} QCowAIOCB;

-    qemu_iovec_init(&hd_qiov, qiov->niov);
-
-    qemu_co_mutex_lock(&s->lock);
-
-    while (remaining_sectors != 0) {
-
-        /* prepare next request */
-        cur_nr_sectors = remaining_sectors;
-        if (s->crypt_method) {
-            cur_nr_sectors = MIN(cur_nr_sectors,
-                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
-        }
-
-        ret = qcow2_get_cluster_offset(bs, sector_num << 9,
-            &cur_nr_sectors, &cluster_offset);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-
-        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-            cur_nr_sectors * 512);
-
-        if (!cluster_offset) {
-
-            if (bs->backing_hd) {
-                /* read from the base image */
-                n1 = qcow2_backing_read1(bs->backing_hd, &hd_qiov,
-                    sector_num, cur_nr_sectors);
-                if (n1 > 0) {
-                    BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
-                    qemu_co_mutex_unlock(&s->lock);
-                    ret = bdrv_co_readv(bs->backing_hd, sector_num,
-                                        n1, &hd_qiov);
-                    qemu_co_mutex_lock(&s->lock);
-                    if (ret < 0) {
-                        goto fail;
-                    }
-                }
-            } else {
-                /* Note: in this case, no need to wait */
-                qemu_iovec_memset(&hd_qiov, 0, 512 * cur_nr_sectors);
-            }
-        } else if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
-            /* add AIO support for compressed blocks ? */
-            ret = qcow2_decompress_cluster(bs, cluster_offset);
-            if (ret < 0) {
-                goto fail;
-            }
-
-            qemu_iovec_from_buffer(&hd_qiov,
-                s->cluster_cache + index_in_cluster * 512,
-                512 * cur_nr_sectors);
-        } else {
-            if ((cluster_offset & 511) != 0) {
-                ret = -EIO;
-                goto fail;
-            }
-
-            if (s->crypt_method) {
-                /*
-                 * For encrypted images, read everything into a temporary
-                 * contiguous buffer on which the AES functions can work.
-                 */
-                if (!cluster_data) {
-                    cluster_data =
-                        qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-                }
-
-                assert(cur_nr_sectors <=
-                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
-                qemu_iovec_reset(&hd_qiov);
-                qemu_iovec_add(&hd_qiov, cluster_data,
-                    512 * cur_nr_sectors);
-            }
-
-            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-            qemu_co_mutex_unlock(&s->lock);
-            ret = bdrv_co_readv(bs->file,
-                                (cluster_offset >> 9) + index_in_cluster,
-                                cur_nr_sectors, &hd_qiov);
-            qemu_co_mutex_lock(&s->lock);
-            if (ret < 0) {
-                goto fail;
-            }
-            if (s->crypt_method) {
-                qcow2_encrypt_sectors(s, sector_num,  cluster_data,
-                    cluster_data, cur_nr_sectors, 0, &s->aes_decrypt_key);
-                qemu_iovec_reset(&hd_qiov);
-                qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-                    cur_nr_sectors * 512);
-                qemu_iovec_from_buffer(&hd_qiov, cluster_data,
-                    512 * cur_nr_sectors);
-            }
-        }
-
-        remaining_sectors -= cur_nr_sectors;
-        sector_num += cur_nr_sectors;
-        bytes_done += cur_nr_sectors * 512;
-    }
-    ret = 0;
-
-fail:
-    qemu_co_mutex_unlock(&s->lock);
-
-    qemu_iovec_destroy(&hd_qiov);
-    qemu_vfree(cluster_data);
-
-    return ret;
+static void qcow2_aio_cancel(BlockDriverAIOCB *blockacb)
+{
+    QCowAIOCB *acb = container_of(blockacb, QCowAIOCB, common);
+    if (acb->hd_aiocb)
+        bdrv_aio_cancel(acb->hd_aiocb);
+    qemu_aio_release(acb);
 }

-static void run_dependent_requests(BDRVQcowState *s, QCowL2Meta *m)
+static AIOPool qcow2_aio_pool = {
+    .aiocb_size         = sizeof(QCowAIOCB),
+    .cancel             = qcow2_aio_cancel,
+};
+
+static void qcow2_aio_read_cb(void *opaque, int ret);
+static void qcow2_aio_read_bh(void *opaque)
 {
+    QCowAIOCB *acb = opaque;
+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+    qcow2_aio_read_cb(opaque, 0);
+}
+
+static int qcow2_schedule_bh(QEMUBHFunc *cb, QCowAIOCB *acb)
+{
+    if (acb->bh)
+        return -EIO;
+
+    acb->bh = qemu_bh_new(cb, acb);
+    if (!acb->bh)
+        return -EIO;
+
+    qemu_bh_schedule(acb->bh);
+
+    return 0;
+}
+
+static void qcow2_aio_read_cb(void *opaque, int ret)
+{
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+    BDRVQcowState *s = bs->opaque;
+    int index_in_cluster, n1;
+
+    acb->hd_aiocb = NULL;
+    if (ret < 0)
+        goto done;
+
+    /* post process the read buffer */
+    if (!acb->cluster_offset) {
+        /* nothing to do */
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* nothing to do */
+    } else {
+        if (s->crypt_method) {
+            qcow2_encrypt_sectors(s, acb->sector_num,  acb->cluster_data,
+                acb->cluster_data, acb->cur_nr_sectors, 0, &s->aes_decrypt_key);
+            qemu_iovec_reset(&acb->hd_qiov);
+            qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+                acb->cur_nr_sectors * 512);
+            qemu_iovec_from_buffer(&acb->hd_qiov, acb->cluster_data,
+                512 * acb->cur_nr_sectors);
+        }
+    }
+
+    acb->remaining_sectors -= acb->cur_nr_sectors;
+    acb->sector_num += acb->cur_nr_sectors;
+    acb->bytes_done += acb->cur_nr_sectors * 512;
+
+    if (acb->remaining_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    /* prepare next AIO request */
+    acb->cur_nr_sectors = acb->remaining_sectors;
+    if (s->crypt_method) {
+        acb->cur_nr_sectors = MIN(acb->cur_nr_sectors,
+            QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
+    }
+
+    ret = qcow2_get_cluster_offset(bs, acb->sector_num << 9,
+        &acb->cur_nr_sectors, &acb->cluster_offset);
+    if (ret < 0) {
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+
+    qemu_iovec_reset(&acb->hd_qiov);
+    qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+        acb->cur_nr_sectors * 512);
+
+    if (!acb->cluster_offset) {
+
+        if (bs->backing_hd) {
+            /* read from the base image */
+            n1 = qcow2_backing_read1(bs->backing_hd, &acb->hd_qiov,
+                acb->sector_num, acb->cur_nr_sectors);
+            if (n1 > 0) {
+                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
+                acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num,
+                                    &acb->hd_qiov, acb->cur_nr_sectors,
+				    qcow2_aio_read_cb, acb);
+                if (acb->hd_aiocb == NULL)
+                    goto done;
+            } else {
+                ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb);
+                if (ret < 0)
+                    goto done;
+            }
+        } else {
+            /* Note: in this case, no need to wait */
+            qemu_iovec_memset(&acb->hd_qiov, 0, 512 * acb->cur_nr_sectors);
+            ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb);
+            if (ret < 0)
+                goto done;
+        }
+    } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        /* add AIO support for compressed blocks ? */
+        if (qcow2_decompress_cluster(bs, acb->cluster_offset) < 0)
+            goto done;
+
+        qemu_iovec_from_buffer(&acb->hd_qiov,
+            s->cluster_cache + index_in_cluster * 512,
+            512 * acb->cur_nr_sectors);
+
+        ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb);
+        if (ret < 0)
+            goto done;
+    } else {
+        if ((acb->cluster_offset & 511) != 0) {
+            ret = -EIO;
+            goto done;
+        }
+
+        if (s->crypt_method) {
+            /*
+             * For encrypted images, read everything into a temporary
+             * contiguous buffer on which the AES functions can work.
+             */
+            if (!acb->cluster_data) {
+                acb->cluster_data =
+                    qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
+            }
+
+            assert(acb->cur_nr_sectors <=
+                QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors);
+            qemu_iovec_reset(&acb->hd_qiov);
+            qemu_iovec_add(&acb->hd_qiov, acb->cluster_data,
+                512 * acb->cur_nr_sectors);
+        }
+
+        BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
+        acb->hd_aiocb = bdrv_aio_readv(bs->file,
+                            (acb->cluster_offset >> 9) + index_in_cluster,
+                            &acb->hd_qiov, acb->cur_nr_sectors,
+                            qcow2_aio_read_cb, acb);
+        if (acb->hd_aiocb == NULL) {
+            ret = -EIO;
+            goto done;
+        }
+    }
+
+    return;
+done:
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_iovec_destroy(&acb->hd_qiov);
+    qemu_aio_release(acb);
+}
+
+static QCowAIOCB *qcow2_aio_setup(BlockDriverState *bs, int64_t sector_num,
+                                  QEMUIOVector *qiov, int nb_sectors,
+                                  BlockDriverCompletionFunc *cb,
+                                  void *opaque, int is_write)
+{
+    QCowAIOCB *acb;
+
+    acb = qemu_aio_get(&qcow2_aio_pool, bs, cb, opaque);
+    if (!acb)
+        return NULL;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->qiov = qiov;
+
+    qemu_iovec_init(&acb->hd_qiov, qiov->niov);
+
+    acb->bytes_done = 0;
+    acb->remaining_sectors = nb_sectors;
+    acb->cur_nr_sectors = 0;
+    acb->cluster_offset = 0;
+    acb->l2meta.nb_clusters = 0;
+    QLIST_INIT(&acb->l2meta.dependent_requests);
+    return acb;
+}
+
+static BlockDriverAIOCB *qcow2_aio_readv(BlockDriverState *bs,
+                                         int64_t sector_num,
+                                         QEMUIOVector *qiov, int nb_sectors,
+                                         BlockDriverCompletionFunc *cb,
+                                         void *opaque)
+{
+    QCowAIOCB *acb;
+
+    acb = qcow2_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    if (!acb)
+        return NULL;
+
+    qcow2_aio_read_cb(acb, 0);
+    return &acb->common;
+}
+
+static void qcow2_aio_write_cb(void *opaque, int ret);
+
+static void run_dependent_requests(QCowL2Meta *m)
+{
+    QCowAIOCB *req;
+    QCowAIOCB *next;
+
    /* Take the request off the list of running requests */
    if (m->nb_clusters != 0) {
        QLIST_REMOVE(m, next_in_flight);
    }

    /* Restart all dependent requests */
-    if (!qemu_co_queue_empty(&m->dependent_requests)) {
-        qemu_co_mutex_unlock(&s->lock);
-        while(qemu_co_queue_next(&m->dependent_requests));
-        qemu_co_mutex_lock(&s->lock);
+    QLIST_FOREACH_SAFE(req, &m->dependent_requests, next_depend, next) {
+        qcow2_aio_write_cb(req, 0);
    }
+
+    /* Empty the list for the next part of the request */
+    QLIST_INIT(&m->dependent_requests);
 }

-static int qcow2_co_writev(BlockDriverState *bs,
-                           int64_t sector_num,
-                           int remaining_sectors,
-                           QEMUIOVector *qiov)
+static void qcow2_aio_write_cb(void *opaque, int ret)
 {
+    QCowAIOCB *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster;
    int n_end;
-    int ret;
-    int cur_nr_sectors; /* number of sectors in current iteration */
-    uint64_t cluster_offset;
-    QEMUIOVector hd_qiov;
-    uint64_t bytes_done = 0;
-    uint8_t *cluster_data = NULL;
-    QCowL2Meta l2meta = {
-        .nb_clusters = 0,
-    };

-    qemu_co_queue_init(&l2meta.dependent_requests);
+    acb->hd_aiocb = NULL;

-    qemu_iovec_init(&hd_qiov, qiov->niov);
+    if (ret >= 0) {
+        ret = qcow2_alloc_cluster_link_l2(bs, &acb->l2meta);
+    }
+
+    run_dependent_requests(&acb->l2meta);
+
+    if (ret < 0)
+        goto done;
+
+    acb->remaining_sectors -= acb->cur_nr_sectors;
+    acb->sector_num += acb->cur_nr_sectors;
+    acb->bytes_done += acb->cur_nr_sectors * 512;
+
+    if (acb->remaining_sectors == 0) {
+        /* request completed */
+        ret = 0;
+        goto done;
+    }
+
+    index_in_cluster = acb->sector_num & (s->cluster_sectors - 1);
+    n_end = index_in_cluster + acb->remaining_sectors;
+    if (s->crypt_method &&
+        n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
+        n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
+
+    ret = qcow2_alloc_cluster_offset(bs, acb->sector_num << 9,
+        index_in_cluster, n_end, &acb->cur_nr_sectors, &acb->l2meta);
+    if (ret < 0) {
+        goto done;
+    }
+
+    acb->cluster_offset = acb->l2meta.cluster_offset;
+
+    /* Need to wait for another request? If so, we are done for now. */
+    if (acb->l2meta.nb_clusters == 0 && acb->l2meta.depends_on != NULL) {
+        QLIST_INSERT_HEAD(&acb->l2meta.depends_on->dependent_requests,
+            acb, next_depend);
+        return;
+    }
+
+    assert((acb->cluster_offset & 511) == 0);
+
+    qemu_iovec_reset(&acb->hd_qiov);
+    qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done,
+        acb->cur_nr_sectors * 512);
+
+    if (s->crypt_method) {
+        if (!acb->cluster_data) {
+            acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS *
+                                             s->cluster_size);
+        }
+
+        assert(acb->hd_qiov.size <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
+        qemu_iovec_to_buffer(&acb->hd_qiov, acb->cluster_data);
+
+        qcow2_encrypt_sectors(s, acb->sector_num, acb->cluster_data,
+            acb->cluster_data, acb->cur_nr_sectors, 1, &s->aes_encrypt_key);
+
+        qemu_iovec_reset(&acb->hd_qiov);
+        qemu_iovec_add(&acb->hd_qiov, acb->cluster_data,
+            acb->cur_nr_sectors * 512);
+    }
+
+    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+    acb->hd_aiocb = bdrv_aio_writev(bs->file,
+                                    (acb->cluster_offset >> 9) + index_in_cluster,
+                                    &acb->hd_qiov, acb->cur_nr_sectors,
+                                    qcow2_aio_write_cb, acb);
+    if (acb->hd_aiocb == NULL) {
+        ret = -EIO;
+        goto fail;
+    }
+
+    return;
+
+fail:
+    if (acb->l2meta.nb_clusters != 0) {
+        QLIST_REMOVE(&acb->l2meta, next_in_flight);
+    }
+done:
+    acb->common.cb(acb->common.opaque, ret);
+    qemu_iovec_destroy(&acb->hd_qiov);
+    qemu_aio_release(acb);
+}
+
+static BlockDriverAIOCB *qcow2_aio_writev(BlockDriverState *bs,
+                                          int64_t sector_num,
+                                          QEMUIOVector *qiov, int nb_sectors,
+                                          BlockDriverCompletionFunc *cb,
+                                          void *opaque)
+{
+    BDRVQcowState *s = bs->opaque;
+    QCowAIOCB *acb;

    s->cluster_cache_offset = -1; /* disable compressed cache */

-    qemu_co_mutex_lock(&s->lock);
+    acb = qcow2_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
+    if (!acb)
+        return NULL;

-    while (remaining_sectors != 0) {
-
-        index_in_cluster = sector_num & (s->cluster_sectors - 1);
-        n_end = index_in_cluster + remaining_sectors;
-        if (s->crypt_method &&
-            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors) {
-            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
-        }
-
-        ret = qcow2_alloc_cluster_offset(bs, sector_num << 9,
-            index_in_cluster, n_end, &cur_nr_sectors, &l2meta);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        cluster_offset = l2meta.cluster_offset;
-        assert((cluster_offset & 511) == 0);
-
-        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_copy(&hd_qiov, qiov, bytes_done,
-            cur_nr_sectors * 512);
-
-        if (s->crypt_method) {
-            if (!cluster_data) {
-                cluster_data = qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS *
-                                                 s->cluster_size);
-            }
-
-            assert(hd_qiov.size <=
-                   QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
-            qemu_iovec_to_buffer(&hd_qiov, cluster_data);
-
-            qcow2_encrypt_sectors(s, sector_num, cluster_data,
-                cluster_data, cur_nr_sectors, 1, &s->aes_encrypt_key);
-
-            qemu_iovec_reset(&hd_qiov);
-            qemu_iovec_add(&hd_qiov, cluster_data,
-                cur_nr_sectors * 512);
-        }
-
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-        qemu_co_mutex_unlock(&s->lock);
-        ret = bdrv_co_writev(bs->file,
-                             (cluster_offset >> 9) + index_in_cluster,
-                             cur_nr_sectors, &hd_qiov);
-        qemu_co_mutex_lock(&s->lock);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        ret = qcow2_alloc_cluster_link_l2(bs, &l2meta);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        run_dependent_requests(s, &l2meta);
-
-        remaining_sectors -= cur_nr_sectors;
-        sector_num += cur_nr_sectors;
-        bytes_done += cur_nr_sectors * 512;
-    }
-    ret = 0;
-
-fail:
-    run_dependent_requests(s, &l2meta);
-
-    qemu_co_mutex_unlock(&s->lock);
-
-    qemu_iovec_destroy(&hd_qiov);
-    qemu_vfree(cluster_data);
-
-    return ret;
+    qcow2_aio_write_cb(acb, 0);
+    return &acb->common;
 }

 static void qcow2_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
-    g_free(s->l1_table);
+    qemu_free(s->l1_table);

    qcow2_cache_flush(bs, s->l2_table_cache);
    qcow2_cache_flush(bs, s->refcount_block_cache);
@@ -628,42 +734,11 @@ static void qcow2_close(BlockDriverState *bs)
    qcow2_cache_destroy(bs, s->l2_table_cache);
    qcow2_cache_destroy(bs, s->refcount_block_cache);

-    g_free(s->cluster_cache);
-    qemu_vfree(s->cluster_data);
+    qemu_free(s->cluster_cache);
+    qemu_free(s->cluster_data);
    qcow2_refcount_close(bs);
 }

-static void qcow2_invalidate_cache(BlockDriverState *bs)
-{
-    BDRVQcowState *s = bs->opaque;
-    int flags = s->flags;
-    AES_KEY aes_encrypt_key;
-    AES_KEY aes_decrypt_key;
-    uint32_t crypt_method = 0;
-
-    /*
-     * Backing files are read-only which makes all of their metadata immutable,
-     * that means we don't have to worry about reopening them here.
-     */
-
-    if (s->crypt_method) {
-        crypt_method = s->crypt_method;
-        memcpy(&aes_encrypt_key, &s->aes_encrypt_key, sizeof(aes_encrypt_key));
-        memcpy(&aes_decrypt_key, &s->aes_decrypt_key, sizeof(aes_decrypt_key));
-    }
-
-    qcow2_close(bs);
-
-    memset(s, 0, sizeof(BDRVQcowState));
-    qcow2_open(bs, flags);
-
-    if (crypt_method) {
-        s->crypt_method = crypt_method;
-        memcpy(&s->aes_encrypt_key, &aes_encrypt_key, sizeof(aes_encrypt_key));
-        memcpy(&s->aes_decrypt_key, &aes_decrypt_key, sizeof(aes_decrypt_key));
-    }
-}
-
 /*
 * Updates the variable length parts of the qcow2 header, i.e. the backing file
 * name and all extensions. qcow2 was not designed to allow such changes, so if
@@ -773,7 +848,7 @@ static int preallocate(BlockDriverState *bs)

    nb_sectors = bdrv_getlength(bs) >> 9;
    offset = 0;
-    qemu_co_queue_init(&meta.dependent_requests);
+    QLIST_INIT(&meta.dependent_requests);
    meta.cluster_offset = 0;

    while (nb_sectors) {
@@ -791,7 +866,7 @@ static int preallocate(BlockDriverState *bs)

        /* There are no dependent requests, but we need to remove our request
         * from the list of in-flight requests */
-        run_dependent_requests(bs->opaque, &meta);
+        run_dependent_requests(&meta);

        /* TODO Preallocate data if requested */

@@ -828,7 +903,7 @@ static int qcow2_create2(const char *filename, int64_t total_size,
        (1 << cluster_bits) != cluster_size)
    {
        error_report(
-            "Cluster size must be a power of two between %d and %dk",
+            "Cluster size must be a power of two between %d and %dk\n",
            1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
        return -EINVAL;
    }
@@ -883,9 +958,9 @@ static int qcow2_create2(const char *filename, int64_t total_size,
    }

    /* Write an empty refcount table */
-    refcount_table = g_malloc0(cluster_size);
+    refcount_table = qemu_mallocz(cluster_size);
    ret = bdrv_pwrite(bs, cluster_size, refcount_table, cluster_size);
-    g_free(refcount_table);
+    qemu_free(refcount_table);

    if (ret < 0) {
        goto out;
@@ -949,7 +1024,7 @@ static int qcow2_create(const char *filename, QEMUOptionParameter *options)
    const char *backing_fmt = NULL;
    uint64_t sectors = 0;
    int flags = 0;
-    size_t cluster_size = DEFAULT_CLUSTER_SIZE;
+    size_t cluster_size = 65536;
    int prealloc = 0;

    /* Read out options */
@@ -1010,17 +1085,11 @@ static int qcow2_make_empty(BlockDriverState *bs)
    return 0;
 }

-static coroutine_fn int qcow2_co_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors)
+static int qcow2_discard(BlockDriverState *bs, int64_t sector_num,
+    int nb_sectors)
 {
-    int ret;
-    BDRVQcowState *s = bs->opaque;
-
-    qemu_co_mutex_lock(&s->lock);
-    ret = qcow2_discard_clusters(bs, sector_num << BDRV_SECTOR_BITS,
+    return qcow2_discard_clusters(bs, sector_num << BDRV_SECTOR_BITS,
        nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
 }

 static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
@@ -1083,7 +1152,7 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
    if (nb_sectors != s->cluster_sectors)
        return -EINVAL;

-    out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
+    out_buf = qemu_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);

    /* best compression, small window, no zlib header */
    memset(&strm, 0, sizeof(strm));
@@ -1091,8 +1160,8 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
                       Z_DEFLATED, -12,
                       9, Z_DEFAULT_STRATEGY);
    if (ret != 0) {
-        ret = -EINVAL;
-        goto fail;
+        qemu_free(out_buf);
+        return -1;
    }

    strm.avail_in = s->cluster_size;
@@ -1102,9 +1171,9 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,

    ret = deflate(&strm, Z_FINISH);
    if (ret != Z_STREAM_END && ret != Z_OK) {
+        qemu_free(out_buf);
        deflateEnd(&strm);
-        ret = -EINVAL;
-        goto fail;
+        return -1;
    }
    out_len = strm.next_out - out_buf;

@@ -1112,56 +1181,60 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = bdrv_write(bs, sector_num, buf, s->cluster_sectors);
-        if (ret < 0) {
-            goto fail;
-        }
+        bdrv_write(bs, sector_num, buf, s->cluster_sectors);
    } else {
        cluster_offset = qcow2_alloc_compressed_cluster_offset(bs,
            sector_num << 9, out_len);
-        if (!cluster_offset) {
-            ret = -EIO;
-            goto fail;
-        }
+        if (!cluster_offset)
+            return -1;
        cluster_offset &= s->cluster_offset_mask;
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
-        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
-        if (ret < 0) {
-            goto fail;
+        if (bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len) != out_len) {
+            qemu_free(out_buf);
+            return -1;
        }
    }

-    ret = 0;
-fail:
-    g_free(out_buf);
-    return ret;
+    qemu_free(out_buf);
+    return 0;
 }

-static int qcow2_co_flush_to_os(BlockDriverState *bs)
+static int qcow2_flush(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
    int ret;

-    qemu_co_mutex_lock(&s->lock);
    ret = qcow2_cache_flush(bs, s->l2_table_cache);
    if (ret < 0) {
-        qemu_co_mutex_unlock(&s->lock);
        return ret;
    }

    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
    if (ret < 0) {
-        qemu_co_mutex_unlock(&s->lock);
        return ret;
    }
-    qemu_co_mutex_unlock(&s->lock);

-    return 0;
+    return bdrv_flush(bs->file);
 }

-static int qcow2_co_flush_to_disk(BlockDriverState *bs)
+static BlockDriverAIOCB *qcow2_aio_flush(BlockDriverState *bs,
+                                         BlockDriverCompletionFunc *cb,
+                                         void *opaque)
 {
-    return bdrv_co_flush(bs->file);
+    BDRVQcowState *s = bs->opaque;
+    int ret;
+
+    ret = qcow2_cache_flush(bs, s->l2_table_cache);
+    if (ret < 0) {
+        return NULL;
+    }
+
+    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
+    if (ret < 0) {
+        return NULL;
+    }
+
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int64_t qcow2_vm_state_offset(BDRVQcowState *s)
@@ -1258,8 +1331,7 @@ static QEMUOptionParameter qcow2_create_options[] = {
    {
        .name = BLOCK_OPT_CLUSTER_SIZE,
        .type = OPT_SIZE,
-        .help = "qcow2 cluster size",
-        .value = { .n = DEFAULT_CLUSTER_SIZE },
+        .help = "qcow2 cluster size"
    },
    {
        .name = BLOCK_OPT_PREALLOC,
@@ -1276,16 +1348,16 @@ static BlockDriver bdrv_qcow2 = {
    .bdrv_open          = qcow2_open,
    .bdrv_close         = qcow2_close,
    .bdrv_create        = qcow2_create,
+    .bdrv_flush         = qcow2_flush,
    .bdrv_is_allocated  = qcow2_is_allocated,
    .bdrv_set_key       = qcow2_set_key,
    .bdrv_make_empty    = qcow2_make_empty,

-    .bdrv_co_readv          = qcow2_co_readv,
-    .bdrv_co_writev         = qcow2_co_writev,
-    .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
-    .bdrv_co_flush_to_disk  = qcow2_co_flush_to_disk,
+    .bdrv_aio_readv     = qcow2_aio_readv,
+    .bdrv_aio_writev    = qcow2_aio_writev,
+    .bdrv_aio_flush     = qcow2_aio_flush,

-    .bdrv_co_discard        = qcow2_co_discard,
+    .bdrv_discard           = qcow2_discard,
    .bdrv_truncate          = qcow2_truncate,
    .bdrv_write_compressed  = qcow2_write_compressed,

@@ -1301,8 +1373,6 @@ static BlockDriver bdrv_qcow2 = {

    .bdrv_change_backing_file   = qcow2_change_backing_file,

-    .bdrv_invalidate_cache      = qcow2_invalidate_cache,
-
    .create_options = qcow2_create_options,
    .bdrv_check = qcow2_check,
 };
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -26,7 +26,6 @@
 #define BLOCK_QCOW2_H

 #include "aes.h"
-#include "qemu-coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -55,8 +54,6 @@
 /* Must be at least 4 to cover all cases of refcount table growth */
 #define REFCOUNT_CACHE_SIZE 4

-#define DEFAULT_CLUSTER_SIZE 65536
-
 typedef struct QCowHeader {
    uint32_t magic;
    uint32_t version;
@@ -115,8 +112,6 @@ typedef struct BDRVQcowState {
    int64_t free_cluster_index;
    int64_t free_byte_offset;

-    CoMutex lock;
-
    uint32_t crypt_method; /* current crypt method, 0 if no key yet */
    uint32_t crypt_method_header;
    AES_KEY aes_encrypt_key;
@@ -125,8 +120,6 @@ typedef struct BDRVQcowState {
    int snapshots_size;
    int nb_snapshots;
    QCowSnapshot *snapshots;
-
-    int flags;
 } BDRVQcowState;

 /* XXX: use std qcow open function ? */
@@ -150,7 +143,8 @@ typedef struct QCowL2Meta
    int n_start;
    int nb_available;
    int nb_clusters;
-    CoQueue dependent_requests;
+    struct QCowL2Meta *depends_on;
+    QLIST_HEAD(QCowAioDependencies, QCowAIOCB) dependent_requests;

    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;
@@ -190,6 +184,8 @@ void qcow2_free_clusters(BlockDriverState *bs,
 void qcow2_free_any_clusters(BlockDriverState *bs,
    uint64_t cluster_offset, int nb_clusters);

+void qcow2_create_refcount_update(QCowCreateState *s, int64_t offset,
+    int64_t size);
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend);

@@ -230,8 +226,6 @@ int qcow2_read_snapshots(BlockDriverState *bs);
 Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
    bool writethrough);
 int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c);
-bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
-    bool enable);

 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table);
 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c);
--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -18,7 +18,7 @@ typedef struct {
    BdrvCheckResult *result;
    bool fix;                           /* whether to fix invalid offsets */

-    uint64_t nclusters;
+    size_t nclusters;
    uint32_t *used_clusters;            /* referenced cluster bitmap */

    QEDRequest request;
@@ -72,8 +72,7 @@ static unsigned int qed_check_l2_table(QEDCheck *check, QEDTable *table)
    for (i = 0; i < s->table_nelems; i++) {
        uint64_t offset = table->offsets[i];

-        if (qed_offset_is_unalloc_cluster(offset) ||
-            qed_offset_is_zero_cluster(offset)) {
+        if (!offset) {
            continue;
        }

@@ -112,7 +111,7 @@ static int qed_check_l1_table(QEDCheck *check, QEDTable *table)
        unsigned int num_invalid_l2;
        uint64_t offset = table->offsets[i];

-        if (qed_offset_is_unalloc_cluster(offset)) {
+        if (!offset) {
            continue;
        }

@@ -177,7 +176,7 @@ static int qed_check_l1_table(QEDCheck *check, QEDTable *table)
 static void qed_check_for_leaks(QEDCheck *check)
 {
    BDRVQEDState *s = check->s;
-    uint64_t i;
+    size_t i;

    for (i = s->header.header_size; i < check->nclusters; i++) {
        if (!qed_test_bit(check->used_clusters, i)) {
@@ -197,7 +196,7 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
    };
    int ret;

-    check.used_clusters = g_malloc0(((check.nclusters + 31) / 32) *
+    check.used_clusters = qemu_mallocz(((check.nclusters + 31) / 32) *
                                       sizeof(check.used_clusters[0]));

    ret = qed_check_l1_table(&check, s->l1_table);
@@ -206,6 +205,6 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
        qed_check_for_leaks(&check);
    }

-    g_free(check.used_clusters);
+    qemu_free(check.used_clusters);
    return ret;
 }
--- a/block/qed-cluster.c
+++ b/block/qed-cluster.c
@@ -23,8 +23,7 @@
 * @n:              Maximum number of clusters
 * @offset:         Set to first cluster offset
 *
- * This function scans tables for contiguous clusters.  A contiguous run of
- * clusters may be allocated, unallocated, or zero.
+ * This function scans tables for contiguous allocated or free clusters.
 */
 static unsigned int qed_count_contiguous_clusters(BDRVQEDState *s,
                                                  QEDTable *table,
@@ -39,14 +38,9 @@ static unsigned int qed_count_contiguous_clusters(BDRVQEDState *s,
    *offset = last;

    for (i = index + 1; i < end; i++) {
-        if (qed_offset_is_unalloc_cluster(last)) {
-            /* Counting unallocated clusters */
-            if (!qed_offset_is_unalloc_cluster(table->offsets[i])) {
-                break;
-            }
-        } else if (qed_offset_is_zero_cluster(last)) {
-            /* Counting zero clusters */
-            if (!qed_offset_is_zero_cluster(table->offsets[i])) {
+        if (last == 0) {
+            /* Counting free clusters */
+            if (table->offsets[i] != 0) {
                break;
            }
        } else {
@@ -93,22 +87,17 @@ static void qed_find_cluster_cb(void *opaque, int ret)
    n = qed_count_contiguous_clusters(s, request->l2_table->table,
                                      index, n, &offset);

-    if (qed_offset_is_unalloc_cluster(offset)) {
-        ret = QED_CLUSTER_L2;
-    } else if (qed_offset_is_zero_cluster(offset)) {
-        ret = QED_CLUSTER_ZERO;
-    } else if (qed_check_cluster_offset(s, offset)) {
-        ret = QED_CLUSTER_FOUND;
-    } else {
-        ret = -EINVAL;
-    }
-
+    ret = offset ? QED_CLUSTER_FOUND : QED_CLUSTER_L2;
    len = MIN(find_cluster_cb->len, n * s->header.cluster_size -
              qed_offset_into_cluster(s, find_cluster_cb->pos));

+    if (offset && !qed_check_cluster_offset(s, offset)) {
+        ret = -EINVAL;
+    }
+
 out:
    find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
-    g_free(find_cluster_cb);
+    qemu_free(find_cluster_cb);
 }

 /**
@@ -143,7 +132,7 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
    len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos);

    l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)];
-    if (qed_offset_is_unalloc_cluster(l2_offset)) {
+    if (!l2_offset) {
        cb(opaque, QED_CLUSTER_L1, 0, len);
        return;
    }
@@ -152,7 +141,7 @@ void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
        return;
    }

-    find_cluster_cb = g_malloc(sizeof(*find_cluster_cb));
+    find_cluster_cb = qemu_malloc(sizeof(*find_cluster_cb));
    find_cluster_cb->s = s;
    find_cluster_cb->pos = pos;
    find_cluster_cb->len = len;
--- a/block/qed-gencb.c
+++ b/block/qed-gencb.c
@@ -15,7 +15,7 @@

 void *gencb_alloc(size_t len, BlockDriverCompletionFunc *cb, void *opaque)
 {
-    GenericCB *gencb = g_malloc(len);
+    GenericCB *gencb = qemu_malloc(len);
    gencb->cb = cb;
    gencb->opaque = opaque;
    return gencb;
@@ -27,6 +27,6 @@ void gencb_complete(void *opaque, int ret)
    BlockDriverCompletionFunc *cb = gencb->cb;
    void *user_opaque = gencb->opaque;

-    g_free(gencb);
+    qemu_free(gencb);
    cb(user_opaque, ret);
 }
--- a/block/qed-l2-cache.c
+++ b/block/qed-l2-cache.c
@@ -74,7 +74,7 @@ void qed_free_l2_cache(L2TableCache *l2_cache)

    QTAILQ_FOREACH_SAFE(entry, &l2_cache->entries, node, next_entry) {
        qemu_vfree(entry->table);
-        g_free(entry);
+        qemu_free(entry);
    }
 }

@@ -89,7 +89,7 @@ CachedL2Table *qed_alloc_l2_cache_entry(L2TableCache *l2_cache)
 {
    CachedL2Table *entry;

-    entry = g_malloc0(sizeof(*entry));
+    entry = qemu_mallocz(sizeof(*entry));
    entry->ref++;

    trace_qed_alloc_l2_cache_entry(l2_cache, entry);
@@ -111,7 +111,7 @@ void qed_unref_l2_cache_entry(CachedL2Table *entry)
    trace_qed_unref_l2_cache_entry(entry, entry->ref);
    if (entry->ref == 0) {
        qemu_vfree(entry->table);
-        g_free(entry);
+        qemu_free(entry);
    }
 }

--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -179,12 +179,16 @@ int qed_read_l1_table_sync(BDRVQEDState *s)
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_read_table(s, s->header.l1_table_offset,
                   s->l1_table, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    return ret;
 }

@@ -201,11 +205,15 @@ int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_write_l1_table(s, index, n, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    return ret;
 }

@@ -222,21 +230,21 @@ static void qed_read_l2_table_cb(void *opaque, int ret)
    QEDRequest *request = read_l2_table_cb->request;
    BDRVQEDState *s = read_l2_table_cb->s;
    CachedL2Table *l2_table = request->l2_table;
-    uint64_t l2_offset = read_l2_table_cb->l2_offset;

    if (ret) {
        /* can't trust loaded L2 table anymore */
        qed_unref_l2_cache_entry(l2_table);
        request->l2_table = NULL;
    } else {
-        l2_table->offset = l2_offset;
+        l2_table->offset = read_l2_table_cb->l2_offset;

        qed_commit_l2_cache_entry(&s->l2_cache, l2_table);

        /* This is guaranteed to succeed because we just committed the entry
         * to the cache.
         */
-        request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
+        request->l2_table = qed_find_l2_cache_entry(&s->l2_cache,
+                                                    l2_table->offset);
        assert(request->l2_table != NULL);
    }

@@ -274,11 +282,14 @@ int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request, uint64_t offset
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_read_l2_table(s, request, offset, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
    return ret;
 }

@@ -296,10 +307,13 @@ int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
 {
    int ret = -EINPROGRESS;

+    async_context_push();
+
    qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);
    while (ret == -EINPROGRESS) {
        qemu_aio_wait();
    }

+    async_context_pop();
    return ret;
 }
--- a/block/qed.c
+++ b/block/qed.c
@@ -12,11 +12,8 @@
 *
 */

-#include "qemu-timer.h"
 #include "trace.h"
 #include "qed.h"
-#include "qerror.h"
-#include "migration.h"

 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -293,88 +290,6 @@ static CachedL2Table *qed_new_l2_table(BDRVQEDState *s)

 static void qed_aio_next_io(void *opaque, int ret);

-static void qed_plug_allocating_write_reqs(BDRVQEDState *s)
-{
-    assert(!s->allocating_write_reqs_plugged);
-
-    s->allocating_write_reqs_plugged = true;
-}
-
-static void qed_unplug_allocating_write_reqs(BDRVQEDState *s)
-{
-    QEDAIOCB *acb;
-
-    assert(s->allocating_write_reqs_plugged);
-
-    s->allocating_write_reqs_plugged = false;
-
-    acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
-    if (acb) {
-        qed_aio_next_io(acb, 0);
-    }
-}
-
-static void qed_finish_clear_need_check(void *opaque, int ret)
-{
-    /* Do nothing */
-}
-
-static void qed_flush_after_clear_need_check(void *opaque, int ret)
-{
-    BDRVQEDState *s = opaque;
-
-    bdrv_aio_flush(s->bs, qed_finish_clear_need_check, s);
-
-    /* No need to wait until flush completes */
-    qed_unplug_allocating_write_reqs(s);
-}
-
-static void qed_clear_need_check(void *opaque, int ret)
-{
-    BDRVQEDState *s = opaque;
-
-    if (ret) {
-        qed_unplug_allocating_write_reqs(s);
-        return;
-    }
-
-    s->header.features &= ~QED_F_NEED_CHECK;
-    qed_write_header(s, qed_flush_after_clear_need_check, s);
-}
-
-static void qed_need_check_timer_cb(void *opaque)
-{
-    BDRVQEDState *s = opaque;
-
-    /* The timer should only fire when allocating writes have drained */
-    assert(!QSIMPLEQ_FIRST(&s->allocating_write_reqs));
-
-    trace_qed_need_check_timer_cb(s);
-
-    qed_plug_allocating_write_reqs(s);
-
-    /* Ensure writes are on disk before clearing flag */
-    bdrv_aio_flush(s->bs, qed_clear_need_check, s);
-}
-
-static void qed_start_need_check_timer(BDRVQEDState *s)
-{
-    trace_qed_start_need_check_timer(s);
-
-    /* Use vm_clock so we don't alter the image file while suspended for
-     * migration.
-     */
-    qemu_mod_timer(s->need_check_timer, qemu_get_clock_ns(vm_clock) +
-                   get_ticks_per_sec() * QED_NEED_CHECK_TIMEOUT);
-}
-
-/* It's okay to call this multiple times or when no timer is started */
-static void qed_cancel_need_check_timer(BDRVQEDState *s)
-{
-    trace_qed_cancel_need_check_timer(s);
-    qemu_del_timer(s->need_check_timer);
-}
-
 static int bdrv_qed_open(BlockDriverState *bs, int flags)
 {
    BDRVQEDState *s = bs->opaque;
@@ -389,19 +304,14 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    if (ret < 0) {
        return ret;
    }
+    ret = 0; /* ret should always be 0 or -errno */
    qed_header_le_to_cpu(&le_header, &s->header);

    if (s->header.magic != QED_MAGIC) {
        return -EINVAL;
    }
    if (s->header.features & ~QED_FEATURE_MASK) {
-        /* image uses unsupported feature bits */
-        char buf[64];
-        snprintf(buf, sizeof(buf), "%" PRIx64,
-            s->header.features & ~QED_FEATURE_MASK);
-        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
-            bs->device_name, "QED", buf);
-        return -ENOTSUP;
+        return -ENOTSUP; /* image uses unsupported feature bits */
    }
    if (!qed_is_cluster_size_valid(s->header.cluster_size)) {
        return -EINVAL;
@@ -489,10 +399,7 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
            BdrvCheckResult result = {0};

            ret = qed_check(s, &result, true);
-            if (ret) {
-                goto out;
-            }
-            if (!result.corruptions && !result.check_errors) {
+            if (!ret && !result.corruptions && !result.check_errors) {
                /* Ensure fixes reach storage before clearing check bit */
                bdrv_flush(s->bs);

@@ -502,15 +409,6 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
        }
    }

-    s->need_check_timer = qemu_new_timer_ns(vm_clock,
-                                            qed_need_check_timer_cb, s);
-
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "qed", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
-
 out:
    if (ret) {
        qed_free_l2_cache(&s->l2_cache);
@@ -523,12 +421,6 @@ static void bdrv_qed_close(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;

-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
-
-    qed_cancel_need_check_timer(s);
-    qemu_free_timer(s->need_check_timer);
-
    /* Ensure writes reach stable storage */
    bdrv_flush(bs->file);

@@ -542,6 +434,11 @@ static void bdrv_qed_close(BlockDriverState *bs)
    qemu_vfree(s->l1_table);
 }

+static int bdrv_qed_flush(BlockDriverState *bs)
+{
+    return bdrv_flush(bs->file);
+}
+
 static int qed_create(const char *filename, uint32_t cluster_size,
                      uint64_t image_size, uint32_t table_size,
                      const char *backing_file, const char *backing_fmt)
@@ -599,7 +496,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,
        goto out;
    }

-    l1_table = g_malloc0(l1_size);
+    l1_table = qemu_mallocz(l1_size);
    ret = bdrv_pwrite(bs, header.l1_table_offset, l1_table, l1_size);
    if (ret < 0) {
        goto out;
@@ -607,7 +504,7 @@ static int qed_create(const char *filename, uint32_t cluster_size,

    ret = 0; /* success */
 out:
-    g_free(l1_table);
+    qemu_free(l1_table);
    bdrv_delete(bs);
    return ret;
 }
@@ -669,7 +566,7 @@ static void qed_is_allocated_cb(void *opaque, int ret, uint64_t offset, size_t l
 {
    QEDIsAllocatedCB *cb = opaque;
    *cb->pnum = len / BDRV_SECTOR_SIZE;
-    cb->is_allocated = (ret == QED_CLUSTER_FOUND || ret == QED_CLUSTER_ZERO);
+    cb->is_allocated = ret == QED_CLUSTER_FOUND;
 }

 static int bdrv_qed_is_allocated(BlockDriverState *bs, int64_t sector_num,
@@ -684,12 +581,16 @@ static int bdrv_qed_is_allocated(BlockDriverState *bs, int64_t sector_num,
    };
    QEDRequest request = { .l2_table = NULL };

+    async_context_push();
+
    qed_find_cluster(s, &request, pos, len, qed_is_allocated_cb, &cb);

    while (cb.is_allocated == -1) {
        qemu_aio_wait();
    }

+    async_context_pop();
+
    qed_unref_l2_cache_entry(request.l2_table);

    return cb.is_allocated;
@@ -837,10 +738,7 @@ static void qed_copy_from_backing_file(BDRVQEDState *s, uint64_t pos,
 * @table:          L2 table
 * @index:          First cluster index
 * @n:              Number of contiguous clusters
- * @cluster:        First cluster offset
- *
- * The cluster offset may be an allocated byte offset in the image file, the
- * zero cluster marker, or the unallocated cluster marker.
+ * @cluster:        First cluster byte offset in image file
 */
 static void qed_update_l2_table(BDRVQEDState *s, QEDTable *table, int index,
                                unsigned int n, uint64_t cluster)
@@ -848,10 +746,7 @@ static void qed_update_l2_table(BDRVQEDState *s, QEDTable *table, int index,
    int i;
    for (i = index; i < index + n; i++) {
        table->offsets[i] = cluster;
-        if (!qed_offset_is_unalloc_cluster(cluster) &&
-            !qed_offset_is_zero_cluster(cluster)) {
-            cluster += s->header.cluster_size;
-        }
+        cluster += s->header.cluster_size;
    }
 }

@@ -901,8 +796,6 @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)
        acb = QSIMPLEQ_FIRST(&s->allocating_write_reqs);
        if (acb) {
            qed_aio_next_io(acb, 0);
-        } else if (s->header.features & QED_F_NEED_CHECK) {
-            qed_start_need_check_timer(s);
        }
    }
 }
@@ -915,14 +808,14 @@ static void qed_commit_l2_update(void *opaque, int ret)
    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);
    CachedL2Table *l2_table = acb->request.l2_table;
-    uint64_t l2_offset = l2_table->offset;

    qed_commit_l2_cache_entry(&s->l2_cache, l2_table);

    /* This is guaranteed to succeed because we just committed the entry to the
     * cache.
     */
-    acb->request.l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
+    acb->request.l2_table = qed_find_l2_cache_entry(&s->l2_cache,
+                                                    l2_table->offset);
    assert(acb->request.l2_table != NULL);

    qed_aio_next_io(opaque, ret);
@@ -1108,17 +1001,11 @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
 {
    BDRVQEDState *s = acb_to_s(acb);

-    /* Cancel timer when the first allocating request comes in */
-    if (QSIMPLEQ_EMPTY(&s->allocating_write_reqs)) {
-        qed_cancel_need_check_timer(s);
-    }
-
    /* Freeze this request if another allocating write is in progress */
    if (acb != QSIMPLEQ_FIRST(&s->allocating_write_reqs)) {
        QSIMPLEQ_INSERT_TAIL(&s->allocating_write_reqs, acb, next);
    }
-    if (acb != QSIMPLEQ_FIRST(&s->allocating_write_reqs) ||
-        s->allocating_write_reqs_plugged) {
+    if (acb != QSIMPLEQ_FIRST(&s->allocating_write_reqs)) {
        return; /* wait for existing request to finish */
    }

@@ -1181,7 +1068,6 @@ static void qed_aio_write_data(void *opaque, int ret,

    case QED_CLUSTER_L2:
    case QED_CLUSTER_L1:
-    case QED_CLUSTER_ZERO:
        qed_aio_write_alloc(acb, len);
        break;

@@ -1221,12 +1107,8 @@ static void qed_aio_read_data(void *opaque, int ret,

    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

-    /* Handle zero cluster and backing file reads */
-    if (ret == QED_CLUSTER_ZERO) {
-        qemu_iovec_memset(&acb->cur_qiov, 0, acb->cur_qiov.size);
-        qed_aio_next_io(acb, 0);
-        return;
-    } else if (ret != QED_CLUSTER_FOUND) {
+    /* Handle backing file and unallocated sparse hole reads */
+    if (ret != QED_CLUSTER_FOUND) {
        qed_read_backing_file(s, acb->cur_pos, &acb->cur_qiov,
                              qed_aio_next_io, acb);
        return;
@@ -1333,27 +1215,7 @@ static BlockDriverAIOCB *bdrv_qed_aio_flush(BlockDriverState *bs,

 static int bdrv_qed_truncate(BlockDriverState *bs, int64_t offset)
 {
-    BDRVQEDState *s = bs->opaque;
-    uint64_t old_image_size;
-    int ret;
-
-    if (!qed_is_image_size_valid(offset, s->header.cluster_size,
-                                 s->header.table_size)) {
-        return -EINVAL;
-    }
-
-    /* Shrinking is currently not supported */
-    if ((uint64_t)offset < s->header.image_size) {
-        return -ENOTSUP;
-    }
-
-    old_image_size = s->header.image_size;
-    s->header.image_size = offset;
-    ret = qed_write_header_sync(s);
-    if (ret < 0) {
-        s->header.image_size = old_image_size;
-    }
-    return ret;
+    return -ENOTSUP;
 }

 static int64_t bdrv_qed_getlength(BlockDriverState *bs)
@@ -1423,20 +1285,18 @@ static int bdrv_qed_change_backing_file(BlockDriverState *bs,
    }

    /* Prepare new header */
-    buffer = g_malloc(buffer_len);
+    buffer = qemu_malloc(buffer_len);

    qed_header_cpu_to_le(&new_header, &le_header);
    memcpy(buffer, &le_header, sizeof(le_header));
    buffer_len = sizeof(le_header);

-    if (backing_file) {
-        memcpy(buffer + buffer_len, backing_file, backing_file_len);
-        buffer_len += backing_file_len;
-    }
+    memcpy(buffer + buffer_len, backing_file, backing_file_len);
+    buffer_len += backing_file_len;

    /* Write new header */
    ret = bdrv_pwrite_sync(bs->file, 0, buffer, buffer_len);
-    g_free(buffer);
+    qemu_free(buffer);
    if (ret == 0) {
        memcpy(&s->header, &new_header, sizeof(new_header));
    }
@@ -1466,8 +1326,7 @@ static QEMUOptionParameter qed_create_options[] = {
    }, {
        .name = BLOCK_OPT_CLUSTER_SIZE,
        .type = OPT_SIZE,
-        .help = "Cluster size (in bytes)",
-        .value = { .n = QED_DEFAULT_CLUSTER_SIZE },
+        .help = "Cluster size (in bytes)"
    }, {
        .name = BLOCK_OPT_TABLE_SIZE,
        .type = OPT_SIZE,
@@ -1485,6 +1344,7 @@ static BlockDriver bdrv_qed = {
    .bdrv_open                = bdrv_qed_open,
    .bdrv_close               = bdrv_qed_close,
    .bdrv_create              = bdrv_qed_create,
+    .bdrv_flush               = bdrv_qed_flush,
    .bdrv_is_allocated        = bdrv_qed_is_allocated,
    .bdrv_make_empty          = bdrv_qed_make_empty,
    .bdrv_aio_readv           = bdrv_qed_aio_readv,
--- a/block/qed.h
+++ b/block/qed.h
@@ -78,9 +78,6 @@ enum {
    QED_MIN_TABLE_SIZE = 1,        /* in clusters */
    QED_MAX_TABLE_SIZE = 16,
    QED_DEFAULT_TABLE_SIZE = 4,
-
-    /* Delay to flush and clean image after last allocating write completes */
-    QED_NEED_CHECK_TIMEOUT = 5,    /* in seconds */
 };

 typedef struct {
@@ -160,17 +157,10 @@ typedef struct {

    /* Allocating write request queue */
    QSIMPLEQ_HEAD(, QEDAIOCB) allocating_write_reqs;
-    bool allocating_write_reqs_plugged;
-
-    /* Periodic flush and clear need check flag */
-    QEMUTimer *need_check_timer;
-
-    Error *migration_blocker;
 } BDRVQEDState;

 enum {
    QED_CLUSTER_FOUND,         /* cluster found */
-    QED_CLUSTER_ZERO,          /* zero cluster found */
    QED_CLUSTER_L2,            /* cluster missing in L2 */
    QED_CLUSTER_L1,            /* cluster missing in L1 */
 };
@@ -261,7 +251,7 @@ static inline uint64_t qed_offset_into_cluster(BDRVQEDState *s, uint64_t offset)
    return offset & (s->header.cluster_size - 1);
 }

-static inline uint64_t qed_bytes_to_clusters(BDRVQEDState *s, uint64_t bytes)
+static inline unsigned int qed_bytes_to_clusters(BDRVQEDState *s, size_t bytes)
 {
    return qed_start_of_cluster(s, bytes + (s->header.cluster_size - 1)) /
           (s->header.cluster_size - 1);
@@ -308,29 +298,4 @@ static inline bool qed_check_table_offset(BDRVQEDState *s, uint64_t offset)
           qed_check_cluster_offset(s, end_offset);
 }

-static inline bool qed_offset_is_cluster_aligned(BDRVQEDState *s,
-                                                 uint64_t offset)
-{
-    if (qed_offset_into_cluster(s, offset)) {
-        return false;
-    }
-    return true;
-}
-
-static inline bool qed_offset_is_unalloc_cluster(uint64_t offset)
-{
-    if (offset == 0) {
-        return true;
-    }
-    return false;
-}
-
-static inline bool qed_offset_is_zero_cluster(uint64_t offset)
-{
-    if (offset == 1) {
-        return true;
-    }
-    return false;
-}
-
 #endif /* BLOCK_QED_H */
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -43,17 +43,17 @@

 #ifdef __sun__
 #define _POSIX_PTHREAD_SEMANTICS 1
+#include <signal.h>
 #include <sys/dkio.h>
 #endif
 #ifdef __linux__
-#include <sys/types.h>
-#include <sys/stat.h>
 #include <sys/ioctl.h>
 #include <sys/param.h>
 #include <linux/cdrom.h>
 #include <linux/fd.h>
 #endif
 #if defined (__FreeBSD__) || defined(__FreeBSD_kernel__)
+#include <signal.h>
 #include <sys/disk.h>
 #include <sys/cdio.h>
 #endif
@@ -64,13 +64,6 @@
 #include <sys/dkio.h>
 #endif

-#ifdef __NetBSD__
-#include <sys/ioctl.h>
-#include <sys/disklabel.h>
-#include <sys/dkio.h>
-#include <sys/disk.h>
-#endif
-
 #ifdef __DragonFly__
 #include <sys/ioctl.h>
 #include <sys/diskslice.h>
@@ -143,55 +136,12 @@ static int64_t raw_getlength(BlockDriverState *bs);
 static int cdrom_reopen(BlockDriverState *bs);
 #endif

-#if defined(__NetBSD__)
-static int raw_normalize_devicepath(const char **filename)
-{
-    static char namebuf[PATH_MAX];
-    const char *dp, *fname;
-    struct stat sb;
-
-    fname = *filename;
-    dp = strrchr(fname, '/');
-    if (lstat(fname, &sb) < 0) {
-        fprintf(stderr, "%s: stat failed: %s\n",
-            fname, strerror(errno));
-        return -errno;
-    }
-
-    if (!S_ISBLK(sb.st_mode)) {
-        return 0;
-    }
-
-    if (dp == NULL) {
-        snprintf(namebuf, PATH_MAX, "r%s", fname);
-    } else {
-        snprintf(namebuf, PATH_MAX, "%.*s/r%s",
-            (int)(dp - fname), fname, dp + 1);
-    }
-    fprintf(stderr, "%s is a block device", fname);
-    *filename = namebuf;
-    fprintf(stderr, ", using %s\n", *filename);
-
-    return 0;
-}
-#else
-static int raw_normalize_devicepath(const char **filename)
-{
-    return 0;
-}
-#endif
-
 static int raw_open_common(BlockDriverState *bs, const char *filename,
                           int bdrv_flags, int open_flags)
 {
    BDRVRawState *s = bs->opaque;
    int fd, ret;

-    ret = raw_normalize_devicepath(&filename);
-    if (ret != 0) {
-        return ret;
-    }
-
    s->open_flags = open_flags | O_BINARY;
    s->open_flags &= ~O_ACCMODE;
    if (bdrv_flags & BDRV_O_RDWR) {
@@ -204,7 +154,7 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
     * and O_DIRECT for no caching. */
    if ((bdrv_flags & BDRV_O_NOCACHE))
        s->open_flags |= O_DIRECT;
-    if (!(bdrv_flags & BDRV_O_CACHE_WB))
+    else if (!(bdrv_flags & BDRV_O_CACHE_WB))
        s->open_flags |= O_DSYNC;

    s->fd = -1;
@@ -230,19 +180,13 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
        }
    }

-    /* We're falling back to POSIX AIO in some cases so init always */
-    if (paio_init() < 0) {
-        goto out_free_buf;
-    }
-
 #ifdef CONFIG_LINUX_AIO
-    /*
-     * Currently Linux do AIO only for files opened with O_DIRECT
-     * specified so check NOCACHE flag too
-     */
    if ((bdrv_flags & (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO)) ==
                      (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO)) {

+        /* We're falling back to POSIX AIO in some cases */
+        paio_init();
+
        s->aio_ctx = laio_init();
        if (!s->aio_ctx) {
            goto out_free_buf;
@@ -251,6 +195,9 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
    } else
 #endif
    {
+        if (paio_init() < 0) {
+            goto out_free_buf;
+        }
 #ifdef CONFIG_LINUX_AIO
        s->use_aio = 0;
 #endif
@@ -296,6 +243,273 @@ static int raw_open(BlockDriverState *bs, const char *filename, int flags)
 #endif
 */

+/*
+ * offset and count are in bytes, but must be multiples of 512 for files
+ * opened with O_DIRECT. buf must be aligned to 512 bytes then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pread_aligned(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return ret;
+
+    ret = pread(s->fd, buf, count, offset);
+    if (ret == count)
+        return ret;
+
+    /* Allow reads beyond the end (needed for pwrite) */
+    if ((ret == 0) && bs->growable) {
+        int64_t size = raw_getlength(bs);
+        if (offset >= size) {
+            memset(buf, 0, count);
+            return count;
+        }
+    }
+
+    DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] read failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+    /* Try harder for CDrom. */
+    if (s->type != FTYPE_FILE) {
+        ret = pread(s->fd, buf, count, offset);
+        if (ret == count)
+            return ret;
+        ret = pread(s->fd, buf, count, offset);
+        if (ret == count)
+            return ret;
+
+        DEBUG_BLOCK_PRINT("raw_pread(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                          "] retry read failed %d : %d = %s\n",
+                          s->fd, bs->filename, offset, buf, count,
+                          bs->total_sectors, ret, errno, strerror(errno));
+    }
+
+    return  (ret < 0) ? -errno : ret;
+}
+
+/*
+ * offset and count are in bytes, but must be multiples of the sector size
+ * for files opened with O_DIRECT. buf must be aligned to sector size bytes
+ * then.
+ *
+ * This function may be called without alignment if the caller ensures
+ * that O_DIRECT is not in effect.
+ */
+static int raw_pwrite_aligned(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    int ret;
+
+    ret = fd_open(bs);
+    if (ret < 0)
+        return -errno;
+
+    ret = pwrite(s->fd, buf, count, offset);
+    if (ret == count)
+        return ret;
+
+    DEBUG_BLOCK_PRINT("raw_pwrite(%d:%s, %" PRId64 ", %p, %d) [%" PRId64
+                      "] write failed %d : %d = %s\n",
+                      s->fd, bs->filename, offset, buf, count,
+                      bs->total_sectors, ret, errno, strerror(errno));
+
+    return  (ret < 0) ? -errno : ret;
+}
+
+
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pread_aligned to do the actual read.
+ */
+static int raw_pread(BlockDriverState *bs, int64_t offset,
+                     uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    unsigned sector_mask = bs->buffer_alignment - 1;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL)  {
+
+        if (offset & sector_mask) {
+            /* align offset on a sector size bytes boundary */
+
+            shift = offset & sector_mask;
+            size = (shift + count + sector_mask) & ~sector_mask;
+            if (size > s->aligned_buf_size)
+                size = s->aligned_buf_size;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf, size);
+            if (ret < 0)
+                return ret;
+
+            size = bs->buffer_alignment - shift;
+            if (size > count)
+                size = count;
+            memcpy(buf, s->aligned_buf + shift, size);
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & sector_mask || (uintptr_t) buf & sector_mask) {
+
+            /* read on aligned buffer */
+
+            while (count) {
+
+                size = (count + sector_mask) & ~sector_mask;
+                if (size > s->aligned_buf_size)
+                    size = s->aligned_buf_size;
+
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0) {
+                    return ret;
+                } else if (ret == 0) {
+                    fprintf(stderr, "raw_pread: read beyond end of file\n");
+                    abort();
+                }
+
+                size = ret;
+                if (size > count)
+                    size = count;
+
+                memcpy(buf, s->aligned_buf, size);
+
+                buf += size;
+                offset += size;
+                count -= size;
+                sum += size;
+            }
+
+            return sum;
+        }
+    }
+
+    return raw_pread_aligned(bs, offset, buf, count) + sum;
+}
+
+static int raw_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
+{
+    int ret;
+
+    ret = raw_pread(bs, sector_num * BDRV_SECTOR_SIZE, buf,
+                    nb_sectors * BDRV_SECTOR_SIZE);
+    if (ret == (nb_sectors * BDRV_SECTOR_SIZE))
+        ret = 0;
+    return ret;
+}
+
+/*
+ * offset and count are in bytes and possibly not aligned. For files opened
+ * with O_DIRECT, necessary alignments are ensured before calling
+ * raw_pwrite_aligned to do the actual write.
+ */
+static int raw_pwrite(BlockDriverState *bs, int64_t offset,
+                      const uint8_t *buf, int count)
+{
+    BDRVRawState *s = bs->opaque;
+    unsigned sector_mask = bs->buffer_alignment - 1;
+    int size, ret, shift, sum;
+
+    sum = 0;
+
+    if (s->aligned_buf != NULL) {
+
+        if (offset & sector_mask) {
+            /* align offset on a sector size bytes boundary */
+            shift = offset & sector_mask;
+            ret = raw_pread_aligned(bs, offset - shift, s->aligned_buf,
+                                    bs->buffer_alignment);
+            if (ret < 0)
+                return ret;
+
+            size = bs->buffer_alignment - shift;
+            if (size > count)
+                size = count;
+            memcpy(s->aligned_buf + shift, buf, size);
+
+            ret = raw_pwrite_aligned(bs, offset - shift, s->aligned_buf,
+                                     bs->buffer_alignment);
+            if (ret < 0)
+                return ret;
+
+            buf += size;
+            offset += size;
+            count -= size;
+            sum += size;
+
+            if (count == 0)
+                return sum;
+        }
+        if (count & sector_mask || (uintptr_t) buf & sector_mask) {
+
+            while ((size = (count & ~sector_mask)) != 0) {
+
+                if (size > s->aligned_buf_size)
+                    size = s->aligned_buf_size;
+
+                memcpy(s->aligned_buf, buf, size);
+
+                ret = raw_pwrite_aligned(bs, offset, s->aligned_buf, size);
+                if (ret < 0)
+                    return ret;
+
+                buf += ret;
+                offset += ret;
+                count -= ret;
+                sum += ret;
+            }
+            /* here, count < sector_size because (count & ~sector_mask) == 0 */
+            if (count) {
+                ret = raw_pread_aligned(bs, offset, s->aligned_buf,
+                                     bs->buffer_alignment);
+                if (ret < 0)
+                    return ret;
+                 memcpy(s->aligned_buf, buf, count);
+
+                 ret = raw_pwrite_aligned(bs, offset, s->aligned_buf,
+                                     bs->buffer_alignment);
+                 if (ret < 0)
+                     return ret;
+                 if (count < ret)
+                     ret = count;
+
+                 sum += ret;
+            }
+            return sum;
+        }
+    }
+    return raw_pwrite_aligned(bs, offset, buf, count) + sum;
+}
+
+static int raw_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    int ret;
+    ret = raw_pwrite(bs, sector_num * BDRV_SECTOR_SIZE, buf,
+                     nb_sectors * BDRV_SECTOR_SIZE);
+    if (ret == (nb_sectors * BDRV_SECTOR_SIZE))
+        ret = 0;
+    return ret;
+}
+
 /*
 * Check if all memory in this vector is sector aligned.
 */
@@ -323,7 +537,7 @@ static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,

    /*
     * If O_DIRECT is used the buffer needs to be aligned on a sector
-     * boundary.  Check if this is the case or tell the low-level
+     * boundary.  Check if this is the case or telll the low-level
     * driver that it needs to copy the buffer.
     */
    if (s->aligned_buf) {
@@ -382,24 +596,10 @@ static void raw_close(BlockDriverState *bs)
 static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
-    struct stat st;
-
-    if (fstat(s->fd, &st)) {
-        return -errno;
-    }
-
-    if (S_ISREG(st.st_mode)) {
-        if (ftruncate(s->fd, offset) < 0) {
-            return -errno;
-        }
-    } else if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
-       if (offset > raw_getlength(bs)) {
-           return -EINVAL;
-       }
-    } else {
+    if (s->type != FTYPE_FILE)
        return -ENOTSUP;
-    }
-
+    if (ftruncate(s->fd, offset) < 0)
+        return -errno;
    return 0;
 }

@@ -422,31 +622,6 @@ static int64_t raw_getlength(BlockDriverState *bs)
    } else
        return st.st_size;
 }
-#elif defined(__NetBSD__)
-static int64_t raw_getlength(BlockDriverState *bs)
-{
-    BDRVRawState *s = bs->opaque;
-    int fd = s->fd;
-    struct stat st;
-
-    if (fstat(fd, &st))
-        return -1;
-    if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
-        struct dkwedge_info dkw;
-
-        if (ioctl(fd, DIOCGWEDGEINFO, &dkw) != -1) {
-            return dkw.dkw_size * 512;
-        } else {
-            struct disklabel dl;
-
-            if (ioctl(fd, DIOCGDINFO, &dl))
-                return -1;
-            return (uint64_t)dl.d_secsize *
-                dl.d_partitions[DISKPART(st.st_rdev)].p_size;
-        }
-    } else
-        return st.st_size;
-}
 #elif defined(__sun__)
 static int64_t raw_getlength(BlockDriverState *bs)
 {
@@ -543,17 +718,6 @@ static int64_t raw_getlength(BlockDriverState *bs)
 }
 #endif

-static int64_t raw_get_allocated_file_size(BlockDriverState *bs)
-{
-    struct stat st;
-    BDRVRawState *s = bs->opaque;
-
-    if (fstat(s->fd, &st) < 0) {
-        return -errno;
-    }
-    return (int64_t)st.st_blocks * 512;
-}
-
 static int raw_create(const char *filename, QEMUOptionParameter *options)
 {
    int fd;
@@ -583,6 +747,12 @@ static int raw_create(const char *filename, QEMUOptionParameter *options)
    return result;
 }

+static int raw_flush(BlockDriverState *bs)
+{
+    BDRVRawState *s = bs->opaque;
+    return qemu_fdatasync(s->fd);
+}
+
 #ifdef CONFIG_XFS
 static int xfs_discard(BDRVRawState *s, int64_t sector_num, int nb_sectors)
 {
@@ -602,8 +772,7 @@ static int xfs_discard(BDRVRawState *s, int64_t sector_num, int nb_sectors)
 }
 #endif

-static coroutine_fn int raw_co_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors)
+static int raw_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
 {
 #ifdef CONFIG_XFS
    BDRVRawState *s = bs->opaque;
@@ -631,9 +800,12 @@ static BlockDriver bdrv_file = {
    .instance_size = sizeof(BDRVRawState),
    .bdrv_probe = NULL, /* no probe for protocols */
    .bdrv_file_open = raw_open,
+    .bdrv_read = raw_read,
+    .bdrv_write = raw_write,
    .bdrv_close = raw_close,
    .bdrv_create = raw_create,
-    .bdrv_co_discard = raw_co_discard,
+    .bdrv_flush = raw_flush,
+    .bdrv_discard = raw_discard,

    .bdrv_aio_readv = raw_aio_readv,
    .bdrv_aio_writev = raw_aio_writev,
@@ -641,8 +813,6 @@ static BlockDriver bdrv_file = {

    .bdrv_truncate = raw_truncate,
    .bdrv_getlength = raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    .create_options = raw_create_options,
 };
@@ -902,15 +1072,15 @@ static BlockDriver bdrv_host_device = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv	= raw_aio_readv,
    .bdrv_aio_writev	= raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength	= raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    /* generic scsi device */
 #ifdef __linux__
@@ -945,7 +1115,6 @@ static int floppy_probe_device(const char *filename)
    int fd, ret;
    int prio = 0;
    struct floppy_struct fdparam;
-    struct stat st;

    if (strstart(filename, "/dev/fd", NULL))
        prio = 50;
@@ -954,17 +1123,12 @@ static int floppy_probe_device(const char *filename)
    if (fd < 0) {
        goto out;
    }
-    ret = fstat(fd, &st);
-    if (ret == -1 || !S_ISBLK(st.st_mode)) {
-        goto outc;
-    }

    /* Attempt to detect via a floppy specific ioctl */
    ret = ioctl(fd, FDGETPRM, &fdparam);
    if (ret >= 0)
        prio = 100;

-outc:
    close(fd);
 out:
    return prio;
@@ -994,7 +1158,7 @@ static int floppy_media_changed(BlockDriverState *bs)
    return ret;
 }

-static void floppy_eject(BlockDriverState *bs, int eject_flag)
+static int floppy_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;
    int fd;
@@ -1009,6 +1173,8 @@ static void floppy_eject(BlockDriverState *bs, int eject_flag)
            perror("FDEJECT");
        close(fd);
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_floppy = {
@@ -1021,15 +1187,15 @@ static BlockDriver bdrv_host_floppy = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength	= raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    /* removable device support */
    .bdrv_is_inserted   = floppy_is_inserted,
@@ -1051,23 +1217,17 @@ static int cdrom_probe_device(const char *filename)
 {
    int fd, ret;
    int prio = 0;
-    struct stat st;

    fd = open(filename, O_RDONLY | O_NONBLOCK);
    if (fd < 0) {
        goto out;
    }
-    ret = fstat(fd, &st);
-    if (ret == -1 || !S_ISBLK(st.st_mode)) {
-        goto outc;
-    }

    /* Attempt to detect via a CDROM specific ioctl */
    ret = ioctl(fd, CDROM_DRIVE_STATUS, CDSL_CURRENT);
    if (ret >= 0)
        prio = 100;

-outc:
    close(fd);
 out:
    return prio;
@@ -1084,7 +1244,7 @@ static int cdrom_is_inserted(BlockDriverState *bs)
    return 0;
 }

-static void cdrom_eject(BlockDriverState *bs, int eject_flag)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;

@@ -1095,9 +1255,11 @@ static void cdrom_eject(BlockDriverState *bs, int eject_flag)
        if (ioctl(s->fd, CDROMCLOSETRAY, NULL) < 0)
            perror("CDROMEJECT");
    }
+
+    return 0;
 }

-static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
 {
    BDRVRawState *s = bs->opaque;

@@ -1108,6 +1270,8 @@ static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
         */
        /* perror("CDROM_LOCKDOOR"); */
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_cdrom = {
@@ -1120,20 +1284,20 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength     = raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
-    .bdrv_lock_medium   = cdrom_lock_medium,
+    .bdrv_set_locked    = cdrom_set_locked,

    /* generic scsi device */
    .bdrv_ioctl         = hdev_ioctl,
@@ -1194,12 +1358,12 @@ static int cdrom_is_inserted(BlockDriverState *bs)
    return raw_getlength(bs) > 0;
 }

-static void cdrom_eject(BlockDriverState *bs, int eject_flag)
+static int cdrom_eject(BlockDriverState *bs, int eject_flag)
 {
    BDRVRawState *s = bs->opaque;

    if (s->fd < 0)
-        return;
+        return -ENOTSUP;

    (void) ioctl(s->fd, CDIOCALLOW);

@@ -1211,15 +1375,17 @@ static void cdrom_eject(BlockDriverState *bs, int eject_flag)
            perror("CDIOCCLOSE");
    }

-    cdrom_reopen(bs);
+    if (cdrom_reopen(bs) < 0)
+        return -ENOTSUP;
+    return 0;
 }

-static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
+static int cdrom_set_locked(BlockDriverState *bs, int locked)
 {
    BDRVRawState *s = bs->opaque;

    if (s->fd < 0)
-        return;
+        return -ENOTSUP;
    if (ioctl(s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
        /*
         * Note: an error can happen if the distribution automatically
@@ -1227,6 +1393,8 @@ static void cdrom_lock_medium(BlockDriverState *bs, bool locked)
         */
        /* perror("CDROM_LOCKDOOR"); */
    }
+
+    return 0;
 }

 static BlockDriver bdrv_host_cdrom = {
@@ -1239,20 +1407,20 @@ static BlockDriver bdrv_host_cdrom = {
    .bdrv_create        = hdev_create,
    .create_options     = raw_create_options,
    .bdrv_has_zero_init = hdev_has_zero_init,
+    .bdrv_flush         = raw_flush,

    .bdrv_aio_readv     = raw_aio_readv,
    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,

-    .bdrv_truncate      = raw_truncate,
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
    .bdrv_getlength     = raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    /* removable device support */
    .bdrv_is_inserted   = cdrom_is_inserted,
    .bdrv_eject         = cdrom_eject,
-    .bdrv_lock_medium   = cdrom_lock_medium,
+    .bdrv_set_locked    = cdrom_set_locked,
 };
 #endif /* __FreeBSD__ */

--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -41,7 +41,6 @@ typedef struct BDRVRawState {
 int qemu_ftruncate64(int fd, int64_t length)
 {
    LARGE_INTEGER li;
-    DWORD dw;
    LONG high;
    HANDLE h;
    BOOL res;
@@ -54,15 +53,12 @@ int qemu_ftruncate64(int fd, int64_t length)
    /* get current position, ftruncate do not change position */
    li.HighPart = 0;
    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
-    if (li.LowPart == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
+    if (li.LowPart == 0xffffffffUL && GetLastError() != NO_ERROR)
 	return -1;
-    }

    high = length >> 32;
-    dw = SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN);
-    if (dw == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
+    if (!SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN))
 	return -1;
-    }
    res = SetEndOfFile(h);

    /* back to old position */
@@ -92,9 +88,9 @@ static int raw_open(BlockDriverState *bs, const char *filename, int flags)
    }

    overlapped = FILE_ATTRIBUTE_NORMAL;
-    if (flags & BDRV_O_NOCACHE)
-        overlapped |= FILE_FLAG_NO_BUFFERING;
-    if (!(flags & BDRV_O_CACHE_WB))
+    if ((flags & BDRV_O_NOCACHE))
+        overlapped |= FILE_FLAG_NO_BUFFERING | FILE_FLAG_WRITE_THROUGH;
+    else if (!(flags & BDRV_O_CACHE_WB))
        overlapped |= FILE_FLAG_WRITE_THROUGH;
    s->hfile = CreateFile(filename, access_flags,
                          FILE_SHARE_READ, NULL,
@@ -217,31 +213,6 @@ static int64_t raw_getlength(BlockDriverState *bs)
    return l.QuadPart;
 }

-static int64_t raw_get_allocated_file_size(BlockDriverState *bs)
-{
-    typedef DWORD (WINAPI * get_compressed_t)(const char *filename,
-                                              DWORD * high);
-    get_compressed_t get_compressed;
-    struct _stati64 st;
-    const char *filename = bs->filename;
-    /* WinNT support GetCompressedFileSize to determine allocate size */
-    get_compressed =
-        (get_compressed_t) GetProcAddress(GetModuleHandle("kernel32"),
-                                            "GetCompressedFileSizeA");
-    if (get_compressed) {
-        DWORD high, low;
-        low = get_compressed(filename, &high);
-        if (low != 0xFFFFFFFFlu || GetLastError() == NO_ERROR) {
-            return (((int64_t) high) << 32) + low;
-        }
-    }
-
-    if (_stati64(filename, &st) < 0) {
-        return -1;
-    }
-    return st.st_size;
-}
-
 static int raw_create(const char *filename, QEMUOptionParameter *options)
 {
    int fd;
@@ -281,15 +252,11 @@ static BlockDriver bdrv_file = {
    .bdrv_file_open	= raw_open,
    .bdrv_close		= raw_close,
    .bdrv_create	= raw_create,
-
-    .bdrv_read              = raw_read,
-    .bdrv_write             = raw_write,
-    .bdrv_co_flush_to_disk  = raw_flush,
-
+    .bdrv_flush		= raw_flush,
+    .bdrv_read		= raw_read,
+    .bdrv_write		= raw_write,
    .bdrv_truncate	= raw_truncate,
    .bdrv_getlength	= raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,

    .create_options = raw_create_options,
 };
@@ -382,9 +349,9 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
    create_flags = OPEN_EXISTING;

    overlapped = FILE_ATTRIBUTE_NORMAL;
-    if (flags & BDRV_O_NOCACHE)
-        overlapped |= FILE_FLAG_NO_BUFFERING;
-    if (!(flags & BDRV_O_CACHE_WB))
+    if ((flags & BDRV_O_NOCACHE))
+        overlapped |= FILE_FLAG_NO_BUFFERING | FILE_FLAG_WRITE_THROUGH;
+    else if (!(flags & BDRV_O_CACHE_WB))
        overlapped |= FILE_FLAG_WRITE_THROUGH;
    s->hfile = CreateFile(filename, access_flags,
                          FILE_SHARE_READ, NULL,
@@ -399,6 +366,41 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
    return 0;
 }

+#if 0
+/***********************************************/
+/* removable device additional commands */
+
+static int raw_is_inserted(BlockDriverState *bs)
+{
+    return 1;
+}
+
+static int raw_media_changed(BlockDriverState *bs)
+{
+    return -ENOTSUP;
+}
+
+static int raw_eject(BlockDriverState *bs, int eject_flag)
+{
+    DWORD ret_count;
+
+    if (s->type == FTYPE_FILE)
+        return -ENOTSUP;
+    if (eject_flag) {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_EJECT_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    } else {
+        DeviceIoControl(s->hfile, IOCTL_STORAGE_LOAD_MEDIA,
+                        NULL, 0, NULL, 0, &lpBytesReturned, NULL);
+    }
+}
+
+static int raw_set_locked(BlockDriverState *bs, int locked)
+{
+    return -ENOTSUP;
+}
+#endif
+
 static int hdev_has_zero_init(BlockDriverState *bs)
 {
    return 0;
@@ -411,15 +413,12 @@ static BlockDriver bdrv_host_device = {
    .bdrv_probe_device	= hdev_probe_device,
    .bdrv_file_open	= hdev_open,
    .bdrv_close		= raw_close,
+    .bdrv_flush		= raw_flush,
    .bdrv_has_zero_init = hdev_has_zero_init,

-    .bdrv_read              = raw_read,
-    .bdrv_write             = raw_write,
-    .bdrv_co_flush_to_disk  = raw_flush,
-
+    .bdrv_read		= raw_read,
+    .bdrv_write	        = raw_write,
    .bdrv_getlength	= raw_getlength,
-    .bdrv_get_allocated_file_size
-                        = raw_get_allocated_file_size,
 };

 static void bdrv_file_init(void)
--- a/block/raw.c
+++ b/block/raw.c
@@ -9,25 +9,45 @@ static int raw_open(BlockDriverState *bs, int flags)
    return 0;
 }

-static int coroutine_fn raw_co_readv(BlockDriverState *bs, int64_t sector_num,
-                                     int nb_sectors, QEMUIOVector *qiov)
+static int raw_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
 {
-    return bdrv_co_readv(bs->file, sector_num, nb_sectors, qiov);
+    return bdrv_read(bs->file, sector_num, buf, nb_sectors);
 }

-static int coroutine_fn raw_co_writev(BlockDriverState *bs, int64_t sector_num,
-                                      int nb_sectors, QEMUIOVector *qiov)
+static int raw_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
 {
-    return bdrv_co_writev(bs->file, sector_num, nb_sectors, qiov);
+    return bdrv_write(bs->file, sector_num, buf, nb_sectors);
+}
+
+static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
+    int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+}
+
+static BlockDriverAIOCB *raw_aio_writev(BlockDriverState *bs,
+    int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
 }

 static void raw_close(BlockDriverState *bs)
 {
 }

-static int coroutine_fn raw_co_flush(BlockDriverState *bs)
+static int raw_flush(BlockDriverState *bs)
 {
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
+}
+
+static BlockDriverAIOCB *raw_aio_flush(BlockDriverState *bs,
+    BlockDriverCompletionFunc *cb, void *opaque)
+{
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int64_t raw_getlength(BlockDriverState *bs)
@@ -45,10 +65,9 @@ static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)
   return 1; /* everything can be opened as raw image */
 }

-static int coroutine_fn raw_co_discard(BlockDriverState *bs,
-                                       int64_t sector_num, int nb_sectors)
+static int raw_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
 {
-    return bdrv_co_discard(bs->file, sector_num, nb_sectors);
+    return bdrv_discard(bs->file, sector_num, nb_sectors);
 }

 static int raw_is_inserted(BlockDriverState *bs)
@@ -56,19 +75,15 @@ static int raw_is_inserted(BlockDriverState *bs)
    return bdrv_is_inserted(bs->file);
 }

-static int raw_media_changed(BlockDriverState *bs)
+static int raw_eject(BlockDriverState *bs, int eject_flag)
 {
-    return bdrv_media_changed(bs->file);
+    return bdrv_eject(bs->file, eject_flag);
 }

-static void raw_eject(BlockDriverState *bs, int eject_flag)
+static int raw_set_locked(BlockDriverState *bs, int locked)
 {
-    bdrv_eject(bs->file, eject_flag);
-}
-
-static void raw_lock_medium(BlockDriverState *bs, bool locked)
-{
-    bdrv_lock_medium(bs->file, locked);
+    bdrv_set_locked(bs->file, locked);
+    return 0;
 }

 static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
@@ -105,26 +120,26 @@ static int raw_has_zero_init(BlockDriverState *bs)
 static BlockDriver bdrv_raw = {
    .format_name        = "raw",

-    /* It's really 0, but we need to make g_malloc() happy */
+    /* It's really 0, but we need to make qemu_malloc() happy */
    .instance_size      = 1,

    .bdrv_open          = raw_open,
    .bdrv_close         = raw_close,
-
-    .bdrv_co_readv          = raw_co_readv,
-    .bdrv_co_writev         = raw_co_writev,
-    .bdrv_co_flush_to_disk  = raw_co_flush,
-    .bdrv_co_discard        = raw_co_discard,
-
+    .bdrv_read          = raw_read,
+    .bdrv_write         = raw_write,
+    .bdrv_flush         = raw_flush,
    .bdrv_probe         = raw_probe,
    .bdrv_getlength     = raw_getlength,
    .bdrv_truncate      = raw_truncate,

-    .bdrv_is_inserted   = raw_is_inserted,
-    .bdrv_media_changed = raw_media_changed,
-    .bdrv_eject         = raw_eject,
-    .bdrv_lock_medium   = raw_lock_medium,
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
+    .bdrv_aio_flush     = raw_aio_flush,
+    .bdrv_discard       = raw_discard,

+    .bdrv_is_inserted   = raw_is_inserted,
+    .bdrv_eject         = raw_eject,
+    .bdrv_set_locked    = raw_set_locked,
    .bdrv_ioctl         = raw_ioctl,
    .bdrv_aio_ioctl     = raw_aio_ioctl,

--- a/block/rbd.c
+++ b/block/rbd.c
--- a/block/rbd_types.h
+++ b/block/rbd_types.h
@@ -0,0 +1,71 @@
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2004-2010 Sage Weil <sage@newdream.net>
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.LIB.
+ *
+ */
+
+#ifndef CEPH_RBD_TYPES_H
+#define CEPH_RBD_TYPES_H
+
+
+/*
+ * rbd image 'foo' consists of objects
+ *   foo.rbd      - image metadata
+ *   foo.00000000
+ *   foo.00000001
+ *   ...          - data
+ */
+
+#define RBD_SUFFIX              ".rbd"
+#define RBD_DIRECTORY           "rbd_directory"
+#define RBD_INFO                "rbd_info"
+
+#define RBD_DEFAULT_OBJ_ORDER   22   /* 4MB */
+
+#define RBD_MAX_OBJ_NAME_SIZE   96
+#define RBD_MAX_BLOCK_NAME_SIZE 24
+#define RBD_MAX_SEG_NAME_SIZE   128
+
+#define RBD_COMP_NONE           0
+#define RBD_CRYPT_NONE          0
+
+#define RBD_HEADER_TEXT         "<<< Rados Block Device Image >>>\n"
+#define RBD_HEADER_SIGNATURE    "RBD"
+#define RBD_HEADER_VERSION      "001.005"
+
+struct rbd_info {
+    uint64_t max_id;
+} __attribute__ ((packed));
+
+struct rbd_obj_snap_ondisk {
+    uint64_t id;
+    uint64_t image_size;
+} __attribute__((packed));
+
+struct rbd_obj_header_ondisk {
+    char text[40];
+    char block_name[RBD_MAX_BLOCK_NAME_SIZE];
+    char signature[4];
+    char version[8];
+    struct {
+        uint8_t order;
+        uint8_t crypt_type;
+        uint8_t comp_type;
+        uint8_t unused;
+    } __attribute__((packed)) options;
+    uint64_t image_size;
+    uint64_t snap_seq;
+    uint32_t snap_count;
+    uint32_t reserved;
+    uint64_t snap_names_len;
+    struct rbd_obj_snap_ondisk snaps[0];
+} __attribute__((packed));
+
+
+#endif
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -13,7 +13,6 @@
 #include "qemu-error.h"
 #include "qemu_socket.h"
 #include "block_int.h"
-#include "bitops.h"

 #define SD_PROTO_VER 0x01

@@ -66,7 +65,7 @@
 * 20 - 31 (12 bits): reserved data object space
 * 32 - 55 (24 bits): vdi object space
 * 56 - 59 ( 4 bits): reserved vdi object space
- * 60 - 63 ( 4 bits): object type identifier space
+ * 60 - 63 ( 4 bits): object type indentifier space
 */

 #define VDI_SPACE_SHIFT   32
@@ -196,7 +195,7 @@ static inline uint64_t fnv_64a_buf(void *buf, size_t len, uint64_t hval)
    return hval;
 }

-static inline int is_data_obj_writable(SheepdogInode *inode, unsigned int idx)
+static inline int is_data_obj_writeable(SheepdogInode *inode, unsigned int idx)
 {
    return inode->vdi_id == inode->data_vdi_id[idx];
 }
@@ -274,7 +273,7 @@ struct SheepdogAIOCB {
    int ret;
    enum AIOCBState aiocb_type;

-    Coroutine *coroutine;
+    QEMUBH *bh;
    void (*aio_done_func)(SheepdogAIOCB *);

    int canceled;
@@ -295,10 +294,6 @@ typedef struct BDRVSheepdogState {
    char *port;
    int fd;

-    CoMutex lock;
-    Coroutine *co_send;
-    Coroutine *co_recv;
-
    uint32_t aioreq_seq_num;
    QLIST_HEAD(outstanding_aio_head, AIOReq) outstanding_aio_head;
 } BDRVSheepdogState;
@@ -350,16 +345,19 @@ static const char * sd_strerror(int err)
 /*
 * Sheepdog I/O handling:
 *
- * 1. In sd_co_rw_vector, we send the I/O requests to the server and
- *    link the requests to the outstanding_list in the
- *    BDRVSheepdogState.  The function exits without waiting for
- *    receiving the response.
+ * 1. In the sd_aio_readv/writev, read/write requests are added to the
+ *    QEMU Bottom Halves.
 *
- * 2. We receive the response in aio_read_response, the fd handler to
+ * 2. In sd_readv_writev_bh_cb, the callbacks of BHs, we send the I/O
+ *    requests to the server and link the requests to the
+ *    outstanding_list in the BDRVSheepdogState.  we exits the
+ *    function without waiting for receiving the response.
+ *
+ * 3. We receive the response in aio_read_response, the fd handler to
 *    the sheepdog connection.  If metadata update is needed, we send
 *    the write request to the vdi object in sd_write_done, the write
- *    completion function.  We switch back to sd_co_readv/writev after
- *    all the requests belonging to the AIOCB are finished.
+ *    completion function.  The AIOCB callback is not called until all
+ *    the requests belonging to the AIOCB are finished.
 */

 static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
@@ -369,7 +367,7 @@ static inline AIOReq *alloc_aio_req(BDRVSheepdogState *s, SheepdogAIOCB *acb,
 {
    AIOReq *aio_req;

-    aio_req = g_malloc(sizeof(*aio_req));
+    aio_req = qemu_malloc(sizeof(*aio_req));
    aio_req->aiocb = acb;
    aio_req->iov_offset = iov_offset;
    aio_req->oid = oid;
@@ -391,15 +389,15 @@ static inline int free_aio_req(BDRVSheepdogState *s, AIOReq *aio_req)
    SheepdogAIOCB *acb = aio_req->aiocb;
    QLIST_REMOVE(aio_req, outstanding_aio_siblings);
    QLIST_REMOVE(aio_req, aioreq_siblings);
-    g_free(aio_req);
+    qemu_free(aio_req);

    return !QLIST_EMPTY(&acb->aioreq_head);
 }

-static void coroutine_fn sd_finish_aiocb(SheepdogAIOCB *acb)
+static void sd_finish_aiocb(SheepdogAIOCB *acb)
 {
    if (!acb->canceled) {
-        qemu_coroutine_enter(acb->coroutine, NULL);
+        acb->common.cb(acb->common.opaque, acb->ret);
    }
    qemu_aio_release(acb);
 }
@@ -412,8 +410,7 @@ static void sd_aio_cancel(BlockDriverAIOCB *blockacb)
     * Sheepdog cannot cancel the requests which are already sent to
     * the servers, so we just complete the request with -EIO here.
     */
-    acb->ret = -EIO;
-    qemu_coroutine_enter(acb->coroutine, NULL);
+    acb->common.cb(acb->common.opaque, -EIO);
    acb->canceled = 1;
 }

@@ -437,12 +434,30 @@ static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,

    acb->aio_done_func = NULL;
    acb->canceled = 0;
-    acb->coroutine = qemu_coroutine_self();
+    acb->bh = NULL;
    acb->ret = 0;
    QLIST_INIT(&acb->aioreq_head);
    return acb;
 }

+static int sd_schedule_bh(QEMUBHFunc *cb, SheepdogAIOCB *acb)
+{
+    if (acb->bh) {
+        error_report("bug: %d %d\n", acb->aiocb_type, acb->aiocb_type);
+        return -EIO;
+    }
+
+    acb->bh = qemu_bh_new(cb, acb);
+    if (!acb->bh) {
+        error_report("oom: %d %d\n", acb->aiocb_type, acb->aiocb_type);
+        return -EIO;
+    }
+
+    qemu_bh_schedule(acb->bh);
+
+    return 0;
+}
+
 #ifdef _WIN32

 struct msghdr {
@@ -460,7 +475,7 @@ static ssize_t sendmsg(int s, const struct msghdr *msg, int flags)
    for (i = 0; i < msg->msg_iovlen; i++) {
        size += msg->msg_iov[i].iov_len;
    }
-    buf = g_malloc(size);
+    buf = qemu_malloc(size);

    p = buf;
    for (i = 0; i < msg->msg_iovlen; i++) {
@@ -470,7 +485,7 @@ static ssize_t sendmsg(int s, const struct msghdr *msg, int flags)

    ret = send(s, buf, size, flags);

-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

@@ -484,9 +499,9 @@ static ssize_t recvmsg(int s, struct msghdr *msg, int flags)
    for (i = 0; i < msg->msg_iovlen; i++) {
        size += msg->msg_iov[i].iov_len;
    }
-    buf = g_malloc(size);
+    buf = qemu_malloc(size);

-    ret = qemu_recv(s, buf, size, flags);
+    ret = recv(s, buf, size, flags);
    if (ret < 0) {
        goto out;
    }
@@ -497,7 +512,7 @@ static ssize_t recvmsg(int s, struct msghdr *msg, int flags)
        p += msg->msg_iov[i].iov_len;
    }
 out:
-    g_free(buf);
+    qemu_free(buf);
    return ret;
 }

@@ -582,7 +597,7 @@ static int connect_to_sdog(const char *addr, const char *port)

    ret = getaddrinfo(addr, port, &hints, &res0);
    if (ret) {
-        error_report("unable to get address info %s, %s",
+        error_report("unable to get address info %s, %s\n",
                     addr, strerror(errno));
        return -1;
    }
@@ -612,7 +627,7 @@ static int connect_to_sdog(const char *addr, const char *port)
        goto success;
    }
    fd = -1;
-    error_report("failed connect to %s:%s", addr, port);
+    error_report("failed connect to %s:%s\n", addr, port);
 success:
    freeaddrinfo(res0);
    return fd;
@@ -625,16 +640,10 @@ static int do_readv_writev(int sockfd, struct iovec *iov, int len,
 again:
    ret = do_send_recv(sockfd, iov, len, iov_offset, write);
    if (ret < 0) {
-        if (errno == EINTR) {
+        if (errno == EINTR || errno == EAGAIN) {
            goto again;
        }
-        if (errno == EAGAIN) {
-            if (qemu_in_coroutine()) {
-                qemu_coroutine_yield();
-            }
-            goto again;
-        }
-        error_report("failed to recv a rsp, %s", strerror(errno));
+        error_report("failed to recv a rsp, %s\n", strerror(errno));
        return 1;
    }

@@ -693,7 +702,7 @@ static int send_req(int sockfd, SheepdogReq *hdr, void *data,

    ret = do_writev(sockfd, iov, sizeof(*hdr) + *wlen, 0);
    if (ret) {
-        error_report("failed to send a req, %s", strerror(errno));
+        error_report("failed to send a req, %s\n", strerror(errno));
        ret = -1;
    }

@@ -713,7 +722,7 @@ static int do_req(int sockfd, SheepdogReq *hdr, void *data,

    ret = do_read(sockfd, hdr, sizeof(*hdr));
    if (ret) {
-        error_report("failed to get a rsp, %s", strerror(errno));
+        error_report("failed to get a rsp, %s\n", strerror(errno));
        ret = -1;
        goto out;
    }
@@ -725,7 +734,7 @@ static int do_req(int sockfd, SheepdogReq *hdr, void *data,
    if (*rlen) {
        ret = do_read(sockfd, data, *rlen);
        if (ret) {
-            error_report("failed to get the data, %s", strerror(errno));
+            error_report("failed to get the data, %s\n", strerror(errno));
            ret = -1;
            goto out;
        }
@@ -735,7 +744,7 @@ out:
    return ret;
 }

-static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
+static int add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
                           struct iovec *iov, int niov, int create,
                           enum AIOCBState aiocb_type);

@@ -743,7 +752,7 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
 * This function searchs pending requests to the object `oid', and
 * sends them.
 */
-static void coroutine_fn send_pending_req(BDRVSheepdogState *s, uint64_t oid, uint32_t id)
+static void send_pending_req(BDRVSheepdogState *s, uint64_t oid, uint32_t id)
 {
    AIOReq *aio_req, *next;
    SheepdogAIOCB *acb;
@@ -762,7 +771,7 @@ static void coroutine_fn send_pending_req(BDRVSheepdogState *s, uint64_t oid, ui
        ret = add_aio_request(s, aio_req, acb->qiov->iov,
                              acb->qiov->niov, 0, acb->aiocb_type);
        if (ret < 0) {
-            error_report("add_aio_request is failed");
+            error_report("add_aio_request is failed\n");
            free_aio_req(s, aio_req);
            if (QLIST_EMPTY(&acb->aioreq_head)) {
                sd_finish_aiocb(acb);
@@ -777,7 +786,7 @@ static void coroutine_fn send_pending_req(BDRVSheepdogState *s, uint64_t oid, ui
 * This function is registered as a fd handler, and called from the
 * main loop when s->fd is ready for reading responses.
 */
-static void coroutine_fn aio_read_response(void *opaque)
+static void aio_read_response(void *opaque)
 {
    SheepdogObjRsp rsp;
    BDRVSheepdogState *s = opaque;
@@ -789,14 +798,14 @@ static void coroutine_fn aio_read_response(void *opaque)
    unsigned long idx;

    if (QLIST_EMPTY(&s->outstanding_aio_head)) {
-        goto out;
+        return;
    }

    /* read a header */
    ret = do_read(fd, &rsp, sizeof(rsp));
    if (ret) {
-        error_report("failed to get the header, %s", strerror(errno));
-        goto out;
+        error_report("failed to get the header, %s\n", strerror(errno));
+        return;
    }

    /* find the right aio_req from the outstanding_aio list */
@@ -806,8 +815,8 @@ static void coroutine_fn aio_read_response(void *opaque)
        }
    }
    if (!aio_req) {
-        error_report("cannot find aio_req %x", rsp.id);
-        goto out;
+        error_report("cannot find aio_req %x\n", rsp.id);
+        return;
    }

    acb = aio_req->aiocb;
@@ -842,45 +851,25 @@ static void coroutine_fn aio_read_response(void *opaque)
        ret = do_readv(fd, acb->qiov->iov, rsp.data_length,
                       aio_req->iov_offset);
        if (ret) {
-            error_report("failed to get the data, %s", strerror(errno));
-            goto out;
+            error_report("failed to get the data, %s\n", strerror(errno));
+            return;
        }
        break;
    }

    if (rsp.result != SD_RES_SUCCESS) {
        acb->ret = -EIO;
-        error_report("%s", sd_strerror(rsp.result));
+        error_report("%s\n", sd_strerror(rsp.result));
    }

    rest = free_aio_req(s, aio_req);
    if (!rest) {
        /*
         * We've finished all requests which belong to the AIOCB, so
-         * we can switch back to sd_co_readv/writev now.
+         * we can call the callback now.
         */
        acb->aio_done_func(acb);
    }
-out:
-    s->co_recv = NULL;
-}
-
-static void co_read_response(void *opaque)
-{
-    BDRVSheepdogState *s = opaque;
-
-    if (!s->co_recv) {
-        s->co_recv = qemu_coroutine_create(aio_read_response);
-    }
-
-    qemu_coroutine_enter(s->co_recv, opaque);
-}
-
-static void co_write_request(void *opaque)
-{
-    BDRVSheepdogState *s = opaque;
-
-    qemu_coroutine_enter(s->co_send, NULL);
 }

 static int aio_flush_request(void *opaque)
@@ -927,7 +916,7 @@ static int get_sheep_fd(BDRVSheepdogState *s)

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
-        error_report("%s", strerror(errno));
+        error_report("%s\n", strerror(errno));
        return -1;
    }

@@ -935,12 +924,12 @@ static int get_sheep_fd(BDRVSheepdogState *s)

    ret = set_nodelay(fd);
    if (ret) {
-        error_report("%s", strerror(errno));
+        error_report("%s\n", strerror(errno));
        closesocket(fd);
        return -1;
    }

-    qemu_aio_set_fd_handler(fd, co_read_response, NULL, aio_flush_request,
+    qemu_aio_set_fd_handler(fd, aio_read_response, NULL, aio_flush_request,
                            NULL, s);
    return fd;
 }
@@ -968,7 +957,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
    char *p, *q;
    int nr_sep;

-    p = q = g_strdup(filename);
+    p = q = qemu_strdup(filename);

    /* count the number of separators */
    nr_sep = 0;
@@ -1008,7 +997,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
    }

    if (s->addr == NULL) {
-        g_free(q);
+        qemu_free(q);
    }

    return 0;
@@ -1051,7 +1040,7 @@ static int find_vdi_name(BDRVSheepdogState *s, char *filename, uint32_t snapid,
    }

    if (rsp->result != SD_RES_SUCCESS) {
-        error_report("cannot get vdi info, %s, %s %d %s",
+        error_report("cannot get vdi info, %s, %s %d %s\n",
                     sd_strerror(rsp->result), filename, snapid, tag);
        ret = -1;
        goto out;
@@ -1064,7 +1053,7 @@ out:
    return ret;
 }

-static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
+static int add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
                           struct iovec *iov, int niov, int create,
                           enum AIOCBState aiocb_type)
 {
@@ -1079,7 +1068,7 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
    uint64_t old_oid = aio_req->base_oid;

    if (!nr_copies) {
-        error_report("bug");
+        error_report("bug\n");
    }

    memset(&hdr, 0, sizeof(hdr));
@@ -1107,33 +1096,24 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,

    hdr.id = aio_req->id;

-    qemu_co_mutex_lock(&s->lock);
-    s->co_send = qemu_coroutine_self();
-    qemu_aio_set_fd_handler(s->fd, co_read_response, co_write_request,
-                            aio_flush_request, NULL, s);
    set_cork(s->fd, 1);

    /* send a header */
    ret = do_write(s->fd, &hdr, sizeof(hdr));
    if (ret) {
-        qemu_co_mutex_unlock(&s->lock);
-        error_report("failed to send a req, %s", strerror(errno));
+        error_report("failed to send a req, %s\n", strerror(errno));
        return -EIO;
    }

    if (wlen) {
        ret = do_writev(s->fd, iov, wlen, aio_req->iov_offset);
        if (ret) {
-            qemu_co_mutex_unlock(&s->lock);
-            error_report("failed to send a data, %s", strerror(errno));
+            error_report("failed to send a data, %s\n", strerror(errno));
            return -EIO;
        }
    }

    set_cork(s->fd, 0);
-    qemu_aio_set_fd_handler(s->fd, co_read_response, NULL,
-                            aio_flush_request, NULL, s);
-    qemu_co_mutex_unlock(&s->lock);

    return 0;
 }
@@ -1170,7 +1150,7 @@ static int read_write_object(int fd, char *buf, uint64_t oid, int copies,

    ret = do_req(fd, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
    if (ret) {
-        error_report("failed to send a request to the sheep");
+        error_report("failed to send a request to the sheep\n");
        return -1;
    }

@@ -1178,7 +1158,7 @@ static int read_write_object(int fd, char *buf, uint64_t oid, int copies,
    case SD_RES_SUCCESS:
        return 0;
    default:
-        error_report("%s", sd_strerror(rsp->result));
+        error_report("%s\n", sd_strerror(rsp->result));
        return -1;
    }
 }
@@ -1231,11 +1211,11 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
-        error_report("failed to connect");
+        error_report("failed to connect\n");
        goto out;
    }

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), 0, SD_INODE_SIZE, 0);

    closesocket(fd);
@@ -1250,15 +1230,14 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)

    bs->total_sectors = s->inode.vdi_size / SECTOR_SIZE;
    strncpy(s->name, vdi, sizeof(s->name));
-    qemu_co_mutex_init(&s->lock);
-    g_free(buf);
+    qemu_free(buf);
    return 0;
 out:
    qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
    if (s->fd >= 0) {
        closesocket(s->fd);
    }
-    g_free(buf);
+    qemu_free(buf);
    return -1;
 }

@@ -1301,7 +1280,7 @@ static int do_sd_create(char *filename, int64_t vdi_size,
    }

    if (rsp->result != SD_RES_SUCCESS) {
-        error_report("%s, %s", sd_strerror(rsp->result), filename);
+        error_report("%s, %s\n", sd_strerror(rsp->result), filename);
        return -EIO;
    }

@@ -1312,49 +1291,6 @@ static int do_sd_create(char *filename, int64_t vdi_size,
    return 0;
 }

-static int sd_prealloc(const char *filename)
-{
-    BlockDriverState *bs = NULL;
-    uint32_t idx, max_idx;
-    int64_t vdi_size;
-    void *buf = g_malloc0(SD_DATA_OBJ_SIZE);
-    int ret;
-
-    ret = bdrv_file_open(&bs, filename, BDRV_O_RDWR);
-    if (ret < 0) {
-        goto out;
-    }
-
-    vdi_size = bdrv_getlength(bs);
-    if (vdi_size < 0) {
-        ret = vdi_size;
-        goto out;
-    }
-    max_idx = DIV_ROUND_UP(vdi_size, SD_DATA_OBJ_SIZE);
-
-    for (idx = 0; idx < max_idx; idx++) {
-        /*
-         * The created image can be a cloned image, so we need to read
-         * a data from the source image.
-         */
-        ret = bdrv_pread(bs, idx * SD_DATA_OBJ_SIZE, buf, SD_DATA_OBJ_SIZE);
-        if (ret < 0) {
-            goto out;
-        }
-        ret = bdrv_pwrite(bs, idx * SD_DATA_OBJ_SIZE, buf, SD_DATA_OBJ_SIZE);
-        if (ret < 0) {
-            goto out;
-        }
-    }
-out:
-    if (bs) {
-        bdrv_delete(bs);
-    }
-    g_free(buf);
-
-    return ret;
-}
-
 static int sd_create(const char *filename, QEMUOptionParameter *options)
 {
    int ret;
@@ -1364,16 +1300,14 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
    BDRVSheepdogState s;
    char vdi[SD_MAX_VDI_LEN], tag[SD_MAX_VDI_TAG_LEN];
    uint32_t snapid;
-    int prealloc = 0;
-    const char *vdiname;

-    strstart(filename, "sheepdog:", &vdiname);
+    strstart(filename, "sheepdog:", (const char **)&filename);

    memset(&s, 0, sizeof(s));
    memset(vdi, 0, sizeof(vdi));
    memset(tag, 0, sizeof(tag));
-    if (parse_vdiname(&s, vdiname, vdi, &snapid, tag) < 0) {
-        error_report("invalid filename");
+    if (parse_vdiname(&s, filename, vdi, &snapid, tag) < 0) {
+        error_report("invalid filename\n");
        return -EINVAL;
    }

@@ -1382,22 +1316,12 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
            vdi_size = options->value.n;
        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
            backing_file = options->value.s;
-        } else if (!strcmp(options->name, BLOCK_OPT_PREALLOC)) {
-            if (!options->value.s || !strcmp(options->value.s, "off")) {
-                prealloc = 0;
-            } else if (!strcmp(options->value.s, "full")) {
-                prealloc = 1;
-            } else {
-                error_report("Invalid preallocation mode: '%s'",
-                             options->value.s);
-                return -EINVAL;
-            }
        }
        options++;
    }

    if (vdi_size > SD_MAX_VDI_SIZE) {
-        error_report("too big image size");
+        error_report("too big image size\n");
        return -EINVAL;
    }

@@ -1409,7 +1333,7 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
        /* Currently, only Sheepdog backing image is supported. */
        drv = bdrv_find_protocol(backing_file);
        if (!drv || strcmp(drv->protocol_name, "sheepdog") != 0) {
-            error_report("backing_file must be a sheepdog image");
+            error_report("backing_file must be a sheepdog image\n");
            return -EINVAL;
        }

@@ -1420,7 +1344,7 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
        s = bs->opaque;

        if (!is_snapshot(&s->inode)) {
-            error_report("cannot clone from a non snapshot vdi");
+            error_report("cannot clone from a non snapshot vdi\n");
            bdrv_delete(bs);
            return -EINVAL;
        }
@@ -1429,12 +1353,7 @@ static int sd_create(const char *filename, QEMUOptionParameter *options)
        bdrv_delete(bs);
    }

-    ret = do_sd_create(vdi, vdi_size, base_vid, &vid, 0, s.addr, s.port);
-    if (!prealloc || ret) {
-        return ret;
-    }
-
-    return sd_prealloc(filename);
+    return do_sd_create((char *)vdi, vdi_size, base_vid, &vid, 0, s.addr, s.port);
 }

 static void sd_close(BlockDriverState *bs)
@@ -1465,12 +1384,12 @@ static void sd_close(BlockDriverState *bs)

    if (!ret && rsp->result != SD_RES_SUCCESS &&
        rsp->result != SD_RES_VDI_NOT_LOCKED) {
-        error_report("%s, %s", sd_strerror(rsp->result), s->name);
+        error_report("%s, %s\n", sd_strerror(rsp->result), s->name);
    }

    qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL, NULL);
    closesocket(s->fd);
-    g_free(s->addr);
+    qemu_free(s->addr);
 }

 static int64_t sd_getlength(BlockDriverState *bs)
@@ -1487,10 +1406,10 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
    unsigned int datalen;

    if (offset < s->inode.vdi_size) {
-        error_report("shrinking is not supported");
+        error_report("shrinking is not supported\n");
        return -EINVAL;
    } else if (offset > SD_MAX_VDI_SIZE) {
-        error_report("too big image size");
+        error_report("too big image size\n");
        return -EINVAL;
    }

@@ -1507,7 +1426,7 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
    close(fd);

    if (ret < 0) {
-        error_report("failed to update an inode.");
+        error_report("failed to update an inode.\n");
        return -EIO;
    }

@@ -1517,9 +1436,9 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
 /*
 * This function is called after writing data objects.  If we need to
 * update metadata, this sends a write request to the vdi object.
- * Otherwise, this switches back to sd_co_readv/writev.
+ * Otherwise, this calls the AIOCB callback.
 */
-static void coroutine_fn sd_write_done(SheepdogAIOCB *acb)
+static void sd_write_done(SheepdogAIOCB *acb)
 {
    int ret;
    BDRVSheepdogState *s = acb->common.bs->opaque;
@@ -1568,7 +1487,7 @@ static int sd_create_branch(BDRVSheepdogState *s)

    dprintf("%" PRIx32 " is snapshot.\n", s->inode.vdi_id);

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);

    ret = do_sd_create(s->name, s->inode.vdi_size, s->inode.vdi_id, &vid, 1,
                       s->addr, s->port);
@@ -1580,7 +1499,7 @@ static int sd_create_branch(BDRVSheepdogState *s)

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
-        error_report("failed to connect");
+        error_report("failed to connect\n");
        goto out;
    }

@@ -1600,7 +1519,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
    dprintf("%" PRIx32 " was newly created.\n", s->inode.vdi_id);

 out:
-    g_free(buf);
+    qemu_free(buf);

    return ret;
 }
@@ -1613,11 +1532,8 @@ out:
 * waiting the response.  The responses are received in the
 * `aio_read_response' function which is called from the main loop as
 * a fd handler.
- *
- * Returns 1 when we need to wait a response, 0 when there is no sent
- * request and -errno in error cases.
 */
-static int coroutine_fn sd_co_rw_vector(void *p)
+static void sd_readv_writev_bh_cb(void *p)
 {
    SheepdogAIOCB *acb = p;
    int ret = 0;
@@ -1629,6 +1545,9 @@ static int coroutine_fn sd_co_rw_vector(void *p)
    SheepdogInode *inode = &s->inode;
    AIOReq *aio_req;

+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+
    if (acb->aiocb_type == AIOCB_WRITE_UDATA && s->is_snapshot) {
        /*
         * In the case we open the snapshot VDI, Sheepdog creates the
@@ -1657,7 +1576,7 @@ static int coroutine_fn sd_co_rw_vector(void *p)

            create = 1;
        } else if (acb->aiocb_type == AIOCB_WRITE_UDATA
-                   && !is_data_obj_writable(inode, idx)) {
+                   && !is_data_obj_writeable(inode, idx)) {
            /* Copy-On-Write */
            create = 1;
            old_oid = oid;
@@ -1698,7 +1617,7 @@ static int coroutine_fn sd_co_rw_vector(void *p)
        ret = add_aio_request(s, aio_req, acb->qiov->iov, acb->qiov->niov,
                              create, acb->aiocb_type);
        if (ret < 0) {
-            error_report("add_aio_request is failed");
+            error_report("add_aio_request is failed\n");
            free_aio_req(s, aio_req);
            acb->ret = -EIO;
            goto out;
@@ -1710,47 +1629,42 @@ static int coroutine_fn sd_co_rw_vector(void *p)
    }
 out:
    if (QLIST_EMPTY(&acb->aioreq_head)) {
-        return acb->ret;
+        sd_finish_aiocb(acb);
    }
-    return 1;
 }

-static int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
-                        int nb_sectors, QEMUIOVector *qiov)
+static BlockDriverAIOCB *sd_aio_writev(BlockDriverState *bs, int64_t sector_num,
+                                       QEMUIOVector *qiov, int nb_sectors,
+                                       BlockDriverCompletionFunc *cb,
+                                       void *opaque)
 {
    SheepdogAIOCB *acb;
-    int ret;

    if (bs->growable && sector_num + nb_sectors > bs->total_sectors) {
        /* TODO: shouldn't block here */
        if (sd_truncate(bs, (sector_num + nb_sectors) * SECTOR_SIZE) < 0) {
-            return -EIO;
+            return NULL;
        }
        bs->total_sectors = sector_num + nb_sectors;
    }

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, cb, opaque);
    acb->aio_done_func = sd_write_done;
    acb->aiocb_type = AIOCB_WRITE_UDATA;

-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        qemu_aio_release(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
-
-    return acb->ret;
+    sd_schedule_bh(sd_readv_writev_bh_cb, acb);
+    return &acb->common;
 }

-static int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
-                       int nb_sectors, QEMUIOVector *qiov)
+static BlockDriverAIOCB *sd_aio_readv(BlockDriverState *bs, int64_t sector_num,
+                                      QEMUIOVector *qiov, int nb_sectors,
+                                      BlockDriverCompletionFunc *cb,
+                                      void *opaque)
 {
    SheepdogAIOCB *acb;
-    int i, ret;
+    int i;

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, cb, opaque);
    acb->aiocb_type = AIOCB_READ_UDATA;
    acb->aio_done_func = sd_finish_aiocb;

@@ -1762,15 +1676,8 @@ static int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
        memset(qiov->iov[i].iov_base, 0, qiov->iov[i].iov_len);
    }

-    ret = sd_co_rw_vector(acb);
-    if (ret <= 0) {
-        qemu_aio_release(acb);
-        return ret;
-    }
-
-    qemu_coroutine_yield();
-
-    return acb->ret;
+    sd_schedule_bh(sd_readv_writev_bh_cb, acb);
+    return &acb->common;
 }

 static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -1787,7 +1694,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)

    if (s->is_snapshot) {
        error_report("You can't create a snapshot of a snapshot VDI, "
-                     "%s (%" PRIu32 ").", s->name, s->inode.vdi_id);
+                     "%s (%" PRIu32 ").\n", s->name, s->inode.vdi_id);

        return -EINVAL;
    }
@@ -1810,7 +1717,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    ret = write_object(fd, (char *)&s->inode, vid_to_vdi_oid(s->inode.vdi_id),
                       s->inode.nr_copies, datalen, 0, 0);
    if (ret < 0) {
-        error_report("failed to write snapshot's inode.");
+        error_report("failed to write snapshot's inode.\n");
        ret = -EIO;
        goto cleanup;
    }
@@ -1818,19 +1725,19 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    ret = do_sd_create(s->name, s->inode.vdi_size, s->inode.vdi_id, &new_vid, 1,
                       s->addr, s->port);
    if (ret < 0) {
-        error_report("failed to create inode for snapshot. %s",
+        error_report("failed to create inode for snapshot. %s\n",
                     strerror(errno));
        ret = -EIO;
        goto cleanup;
    }

-    inode = (SheepdogInode *)g_malloc(datalen);
+    inode = (SheepdogInode *)qemu_malloc(datalen);

    ret = read_object(fd, (char *)inode, vid_to_vdi_oid(new_vid),
                      s->inode.nr_copies, datalen, 0);

    if (ret < 0) {
-        error_report("failed to read new inode info. %s", strerror(errno));
+        error_report("failed to read new inode info. %s\n", strerror(errno));
        ret = -EIO;
        goto cleanup;
    }
@@ -1854,7 +1761,7 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    uint32_t snapid = 0;
    int ret = -ENOENT, fd;

-    old_s = g_malloc(sizeof(BDRVSheepdogState));
+    old_s = qemu_malloc(sizeof(BDRVSheepdogState));

    memcpy(old_s, s, sizeof(BDRVSheepdogState));

@@ -1869,18 +1776,18 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)

    ret = find_vdi_name(s, vdi, snapid, tag, &vid, 1);
    if (ret) {
-        error_report("Failed to find_vdi_name");
+        error_report("Failed to find_vdi_name\n");
        ret = -ENOENT;
        goto out;
    }

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
-        error_report("failed to connect");
+        error_report("failed to connect\n");
        goto out;
    }

-    buf = g_malloc(SD_INODE_SIZE);
+    buf = qemu_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), s->inode.nr_copies,
                      SD_INODE_SIZE, 0);

@@ -1894,24 +1801,24 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    memcpy(&s->inode, buf, sizeof(s->inode));

    if (!s->inode.vm_state_size) {
-        error_report("Invalid snapshot");
+        error_report("Invalid snapshot\n");
        ret = -ENOENT;
        goto out;
    }

    s->is_snapshot = 1;

-    g_free(buf);
-    g_free(old_s);
+    qemu_free(buf);
+    qemu_free(old_s);

    return 0;
 out:
    /* recover bdrv_sd_state */
    memcpy(s, old_s, sizeof(BDRVSheepdogState));
-    g_free(buf);
-    g_free(old_s);
+    qemu_free(buf);
+    qemu_free(old_s);

-    error_report("failed to open. recover old bdrv_sd_state.");
+    error_report("failed to open. recover old bdrv_sd_state.\n");

    return ret;
 }
@@ -1922,6 +1829,20 @@ static int sd_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
    return 0;
 }

+#define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
+#define BITS_PER_BYTE        8
+#define BITS_TO_LONGS(nr)    DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+#define DECLARE_BITMAP(name,bits)               \
+    unsigned long name[BITS_TO_LONGS(bits)]
+
+#define BITS_PER_LONG (BITS_PER_BYTE * sizeof(long))
+
+static inline int test_bit(unsigned int nr, const unsigned long *addr)
+{
+    return ((1UL << (nr % BITS_PER_LONG)) &
+            (((unsigned long *)addr)[nr / BITS_PER_LONG])) != 0;
+}
+
 static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 {
    BDRVSheepdogState *s = bs->opaque;
@@ -1936,7 +1857,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
    uint64_t hval;
    uint32_t vid;

-    vdi_inuse = g_malloc(max);
+    vdi_inuse = qemu_malloc(max);

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
@@ -1958,7 +1879,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        goto out;
    }

-    sn_tab = g_malloc0(nr * sizeof(*sn_tab));
+    sn_tab = qemu_mallocz(nr * sizeof(*sn_tab));

    /* calculate a vdi id with hash function */
    hval = fnv_64a_buf(s->name, strlen(s->name), FNV1A_64_INIT);
@@ -1966,7 +1887,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)

    fd = connect_to_sdog(s->addr, s->port);
    if (fd < 0) {
-        error_report("failed to connect");
+        error_report("failed to connect\n");
        goto out;
    }

@@ -2001,7 +1922,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
 out:
    *psn_tab = sn_tab;

-    g_free(vdi_inuse);
+    qemu_free(vdi_inuse);

    return found;
 }
@@ -2040,7 +1961,7 @@ static int do_load_save_vmstate(BDRVSheepdogState *s, uint8_t *data,
        }

        if (ret < 0) {
-            error_report("failed to save vmstate %s", strerror(errno));
+            error_report("failed to save vmstate %s\n", strerror(errno));
            ret = -EIO;
            goto cleanup;
        }
@@ -2082,11 +2003,6 @@ static QEMUOptionParameter sd_create_options[] = {
        .type = OPT_STRING,
        .help = "File name of a base image"
    },
-    {
-        .name = BLOCK_OPT_PREALLOC,
-        .type = OPT_STRING,
-        .help = "Preallocation mode (allowed values: off, full)"
-    },
    { NULL }
 };

@@ -2100,8 +2016,8 @@ BlockDriver bdrv_sheepdog = {
    .bdrv_getlength = sd_getlength,
    .bdrv_truncate  = sd_truncate,

-    .bdrv_co_readv  = sd_co_readv,
-    .bdrv_co_writev = sd_co_writev,
+    .bdrv_aio_readv     = sd_aio_readv,
+    .bdrv_aio_writev    = sd_aio_writev,

    .bdrv_snapshot_create   = sd_snapshot_create,
    .bdrv_snapshot_goto     = sd_snapshot_goto,
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -52,7 +52,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
@@ -88,7 +87,6 @@ void uuid_unparse(const uuid_t uu, char *out);
 #define MiB     (KiB * KiB)

 #define SECTOR_SIZE 512
-#define DEFAULT_CLUSTER_SIZE (1 * MiB)

 #if defined(CONFIG_VDI_DEBUG)
 #define logout(fmt, ...) \
@@ -115,13 +113,8 @@ void uuid_unparse(const uuid_t uu, char *out);
 */
 #define VDI_TEXT "<<< QEMU VM Virtual Disk Image >>>\n"

-/* A never-allocated block; semantically arbitrary content. */
-#define VDI_UNALLOCATED 0xffffffffU
-
-/* A discarded (no longer allocated) block; semantically zero-filled. */
-#define VDI_DISCARDED   0xfffffffeU
-
-#define VDI_IS_ALLOCATED(X) ((X) < VDI_DISCARDED)
+/* Unallocated blocks use this index (no need to convert endianess). */
+#define VDI_UNALLOCATED UINT32_MAX

 #if !defined(CONFIG_UUID)
 void uuid_generate(uuid_t out)
@@ -158,7 +151,6 @@ typedef struct {
    /* Buffer for new allocated block. */
    void *block_buffer;
    void *orig_buf;
-    bool is_write;
    int header_modified;
    BlockDriverAIOCB *hd_aiocb;
    struct iovec hd_iov;
@@ -202,10 +194,8 @@ typedef struct {
    uint32_t block_sectors;
    /* First sector of block map. */
    uint32_t bmap_sector;
-    /* VDI header (converted to host endianness). */
+    /* VDI header (converted to host endianess). */
    VdiHeader header;
-
-    Error *migration_blocker;
 } BDRVVdiState;

 /* Change UUID from little endian (IPRT = VirtualBox format) to big endian
@@ -309,16 +299,16 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res)
    uint32_t *bmap;
    logout("\n");

-    bmap = g_malloc(s->header.blocks_in_image * sizeof(uint32_t));
+    bmap = qemu_malloc(s->header.blocks_in_image * sizeof(uint32_t));
    memset(bmap, 0xff, s->header.blocks_in_image * sizeof(uint32_t));

    /* Check block map and value of blocks_allocated. */
    for (block = 0; block < s->header.blocks_in_image; block++) {
        uint32_t bmap_entry = le32_to_cpu(s->bmap[block]);
-        if (VDI_IS_ALLOCATED(bmap_entry)) {
+        if (bmap_entry != VDI_UNALLOCATED) {
            if (bmap_entry < s->header.blocks_in_image) {
                blocks_allocated++;
-                if (!VDI_IS_ALLOCATED(bmap[bmap_entry])) {
+                if (bmap[bmap_entry] == VDI_UNALLOCATED) {
                    bmap[bmap_entry] = bmap_entry;
                } else {
                    fprintf(stderr, "ERROR: block index %" PRIu32
@@ -339,7 +329,7 @@ static int vdi_check(BlockDriverState *bs, BdrvCheckResult *res)
        res->corruptions++;
    }

-    g_free(bmap);
+    qemu_free(bmap);

    return 0;
 }
@@ -451,22 +441,16 @@ static int vdi_open(BlockDriverState *bs, int flags)
    bmap_size = header.blocks_in_image * sizeof(uint32_t);
    bmap_size = (bmap_size + SECTOR_SIZE - 1) / SECTOR_SIZE;
    if (bmap_size > 0) {
-        s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
+        s->bmap = qemu_malloc(bmap_size * SECTOR_SIZE);
    }
    if (bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size) < 0) {
        goto fail_free_bmap;
    }

-    /* Disable migration when vdi images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "vdi", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
    return 0;

 fail_free_bmap:
-    g_free(s->bmap);
+    qemu_free(s->bmap);

 fail:
    return -1;
@@ -486,7 +470,7 @@ static int vdi_is_allocated(BlockDriverState *bs, int64_t sector_num,
        n_sectors = nb_sectors;
    }
    *pnum = n_sectors;
-    return VDI_IS_ALLOCATED(bmap_entry);
+    return bmap_entry != VDI_UNALLOCATED;
 }

 static void vdi_aio_cancel(BlockDriverAIOCB *blockacb)
@@ -519,8 +503,6 @@ static VdiAIOCB *vdi_aio_setup(BlockDriverState *bs, int64_t sector_num,
        acb->hd_aiocb = NULL;
        acb->sector_num = sector_num;
        acb->qiov = qiov;
-        acb->is_write = is_write;
-
        if (qiov->niov > 1) {
            acb->buf = qemu_blockalign(bs, qiov->size);
            acb->orig_buf = acb->buf;
@@ -559,20 +541,14 @@ static int vdi_schedule_bh(QEMUBHFunc *cb, VdiAIOCB *acb)
 }

 static void vdi_aio_read_cb(void *opaque, int ret);
-static void vdi_aio_write_cb(void *opaque, int ret);

-static void vdi_aio_rw_bh(void *opaque)
+static void vdi_aio_read_bh(void *opaque)
 {
    VdiAIOCB *acb = opaque;
    logout("\n");
    qemu_bh_delete(acb->bh);
    acb->bh = NULL;
-
-    if (acb->is_write) {
-        vdi_aio_write_cb(opaque, 0);
-    } else {
-        vdi_aio_read_cb(opaque, 0);
-    }
+    vdi_aio_read_cb(opaque, 0);
 }

 static void vdi_aio_read_cb(void *opaque, int ret)
@@ -617,10 +593,10 @@ static void vdi_aio_read_cb(void *opaque, int ret)
    /* prepare next AIO request */
    acb->n_sectors = n_sectors;
    bmap_entry = le32_to_cpu(s->bmap[block_index]);
-    if (!VDI_IS_ALLOCATED(bmap_entry)) {
+    if (bmap_entry == VDI_UNALLOCATED) {
        /* Block not allocated, return zeros, no need to wait. */
        memset(acb->buf, 0, n_sectors * SECTOR_SIZE);
-        ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
+        ret = vdi_schedule_bh(vdi_aio_read_bh, acb);
        if (ret < 0) {
            goto done;
        }
@@ -634,7 +610,6 @@ static void vdi_aio_read_cb(void *opaque, int ret)
        acb->hd_aiocb = bdrv_aio_readv(bs->file, offset, &acb->hd_qiov,
                                       n_sectors, vdi_aio_read_cb, acb);
        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
            goto done;
        }
    }
@@ -653,23 +628,12 @@ static BlockDriverAIOCB *vdi_aio_readv(BlockDriverState *bs,
        BlockDriverCompletionFunc *cb, void *opaque)
 {
    VdiAIOCB *acb;
-    int ret;
-
    logout("\n");
    acb = vdi_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
    if (!acb) {
        return NULL;
    }
-
-    ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
-    if (ret < 0) {
-        if (acb->qiov->niov > 1) {
-            qemu_vfree(acb->orig_buf);
-        }
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
+    vdi_aio_read_cb(acb, 0);
    return &acb->common;
 }

@@ -699,7 +663,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
        if (acb->header_modified) {
            VdiHeader *header = acb->block_buffer;
            logout("now writing modified header\n");
-            assert(VDI_IS_ALLOCATED(acb->bmap_first));
+            assert(acb->bmap_first != VDI_UNALLOCATED);
            *header = s->header;
            vdi_header_to_le(header);
            acb->header_modified = 0;
@@ -709,16 +673,15 @@ static void vdi_aio_write_cb(void *opaque, int ret)
            acb->hd_aiocb = bdrv_aio_writev(bs->file, 0, &acb->hd_qiov, 1,
                                            vdi_aio_write_cb, acb);
            if (acb->hd_aiocb == NULL) {
-                ret = -EIO;
                goto done;
            }
            return;
-        } else if (VDI_IS_ALLOCATED(acb->bmap_first)) {
+        } else if (acb->bmap_first != VDI_UNALLOCATED) {
            /* One or more new blocks were allocated. */
            uint64_t offset;
            uint32_t bmap_first;
            uint32_t bmap_last;
-            g_free(acb->block_buffer);
+            qemu_free(acb->block_buffer);
            acb->block_buffer = NULL;
            bmap_first = acb->bmap_first;
            bmap_last = acb->bmap_last;
@@ -739,7 +702,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
            acb->hd_aiocb = bdrv_aio_writev(bs->file, offset, &acb->hd_qiov,
                                            n_sectors, vdi_aio_write_cb, acb);
            if (acb->hd_aiocb == NULL) {
-                ret = -EIO;
                goto done;
            }
            return;
@@ -763,7 +725,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
    /* prepare next AIO request */
    acb->n_sectors = n_sectors;
    bmap_entry = le32_to_cpu(s->bmap[block_index]);
-    if (!VDI_IS_ALLOCATED(bmap_entry)) {
+    if (bmap_entry == VDI_UNALLOCATED) {
        /* Allocate new block and write to it. */
        uint64_t offset;
        uint8_t *block;
@@ -774,7 +736,7 @@ static void vdi_aio_write_cb(void *opaque, int ret)
                 (uint64_t)bmap_entry * s->block_sectors;
        block = acb->block_buffer;
        if (block == NULL) {
-            block = g_malloc0(s->block_size);
+            block = qemu_mallocz(s->block_size);
            acb->block_buffer = block;
            acb->bmap_first = block_index;
            assert(!acb->header_modified);
@@ -790,7 +752,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
                                        &acb->hd_qiov, s->block_sectors,
                                        vdi_aio_write_cb, acb);
        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
            goto done;
        }
    } else {
@@ -803,7 +764,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
        acb->hd_aiocb = bdrv_aio_writev(bs->file, offset, &acb->hd_qiov,
                                        n_sectors, vdi_aio_write_cb, acb);
        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
            goto done;
        }
    }
@@ -823,23 +783,12 @@ static BlockDriverAIOCB *vdi_aio_writev(BlockDriverState *bs,
        BlockDriverCompletionFunc *cb, void *opaque)
 {
    VdiAIOCB *acb;
-    int ret;
-
    logout("\n");
    acb = vdi_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
    if (!acb) {
        return NULL;
    }
-
-    ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
-    if (ret < 0) {
-        if (acb->qiov->niov > 1) {
-            qemu_vfree(acb->orig_buf);
-        }
-        qemu_aio_release(acb);
-        return NULL;
-    }
-
+    vdi_aio_write_cb(acb, 0);
    return &acb->common;
 }

@@ -849,7 +798,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
    int result = 0;
    uint64_t bytes = 0;
    uint32_t blocks;
-    size_t block_size = DEFAULT_CLUSTER_SIZE;
+    size_t block_size = 1 * MiB;
    uint32_t image_type = VDI_TYPE_DYNAMIC;
    VdiHeader header;
    size_t i;
@@ -920,7 +869,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)

    bmap = NULL;
    if (bmap_size > 0) {
-        bmap = (uint32_t *)g_malloc0(bmap_size);
+        bmap = (uint32_t *)qemu_mallocz(bmap_size);
    }
    for (i = 0; i < blocks; i++) {
        if (image_type == VDI_TYPE_STATIC) {
@@ -932,7 +881,7 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)
    if (write(fd, bmap, bmap_size) < 0) {
        result = -errno;
    }
-    g_free(bmap);
+    qemu_free(bmap);
    if (image_type == VDI_TYPE_STATIC) {
        if (ftruncate(fd, sizeof(header) + bmap_size + blocks * block_size)) {
            result = -errno;
@@ -948,18 +897,12 @@ static int vdi_create(const char *filename, QEMUOptionParameter *options)

 static void vdi_close(BlockDriverState *bs)
 {
-    BDRVVdiState *s = bs->opaque;
-
-    g_free(s->bmap);
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
 }

-static coroutine_fn int vdi_co_flush(BlockDriverState *bs)
+static int vdi_flush(BlockDriverState *bs)
 {
    logout("\n");
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }


@@ -973,8 +916,7 @@ static QEMUOptionParameter vdi_create_options[] = {
    {
        .name = BLOCK_OPT_CLUSTER_SIZE,
        .type = OPT_SIZE,
-        .help = "VDI cluster (block) size",
-        .value = { .n = DEFAULT_CLUSTER_SIZE },
+        .help = "VDI cluster (block) size"
    },
 #endif
 #if defined(CONFIG_VDI_STATIC_IMAGE)
@@ -995,7 +937,7 @@ static BlockDriver bdrv_vdi = {
    .bdrv_open = vdi_open,
    .bdrv_close = vdi_close,
    .bdrv_create = vdi_create,
-    .bdrv_co_flush_to_disk = vdi_co_flush,
+    .bdrv_flush = vdi_flush,
    .bdrv_is_allocated = vdi_is_allocated,
    .bdrv_make_empty = vdi_make_empty,

--- a/block/vmdk.c
+++ b/block/vmdk.c
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -25,7 +25,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 /**************************************************************/

@@ -111,7 +110,6 @@ struct vhd_dyndisk_header {
 };

 typedef struct BDRVVPCState {
-    CoMutex lock;
    uint8_t footer_buf[HEADER_SIZE];
    uint64_t free_data_block_offset;
    int max_table_entries;
@@ -129,8 +127,6 @@ typedef struct BDRVVPCState {

    uint64_t last_bitmap;
 #endif
-
-    Error *migration_blocker;
 } BDRVVPCState;

 static uint32_t vpc_checksum(uint8_t* buf, size_t size)
@@ -160,7 +156,6 @@ static int vpc_open(BlockDriverState *bs, int flags)
    struct vhd_dyndisk_header* dyndisk_header;
    uint8_t buf[HEADER_SIZE];
    uint32_t checksum;
-    int err = -1;

    if (bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE) != HEADER_SIZE)
        goto fail;
@@ -181,11 +176,6 @@ static int vpc_open(BlockDriverState *bs, int flags)
    bs->total_sectors = (int64_t)
        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;

-    if (bs->total_sectors >= 65535 * 16 * 255) {
-        err = -EFBIG;
-        goto fail;
-    }
-
    if (bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf, HEADER_SIZE)
            != HEADER_SIZE)
        goto fail;
@@ -200,7 +190,7 @@ static int vpc_open(BlockDriverState *bs, int flags)
    s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;

    s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
-    s->pagetable = g_malloc(s->max_table_entries * 4);
+    s->pagetable = qemu_malloc(s->max_table_entries * 4);

    s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
    if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
@@ -224,23 +214,15 @@ static int vpc_open(BlockDriverState *bs, int flags)
    s->last_bitmap_offset = (int64_t) -1;

 #ifdef CACHE
-    s->pageentry_u8 = g_malloc(512);
+    s->pageentry_u8 = qemu_malloc(512);
    s->pageentry_u32 = s->pageentry_u8;
    s->pageentry_u16 = s->pageentry_u8;
    s->last_pagetable = -1;
 #endif

-    qemu_co_mutex_init(&s->lock);
-
-    /* Disable migration when VHD images are used */
-    error_set(&s->migration_blocker,
-              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-              "vpc", bs->device_name, "live migration");
-    migrate_add_blocker(s->migration_blocker);
-
    return 0;
 fail:
-    return err;
+    return -1;
 }

 /*
@@ -362,11 +344,8 @@ static int64_t alloc_block(BlockDriverState* bs, int64_t sector_num)

    // Initialize the block's bitmap
    memset(bitmap, 0xff, s->bitmap_size);
-    ret = bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
+    bdrv_pwrite_sync(bs->file, s->free_data_block_offset, bitmap,
        s->bitmap_size);
-    if (ret < 0) {
-        return ret;
-    }

    // Write new footer (the old one will be overwritten)
    s->free_data_block_offset += s->block_size + s->bitmap_size;
@@ -422,17 +401,6 @@ static int vpc_read(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int vpc_co_read(BlockDriverState *bs, int64_t sector_num,
-                                    uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVPCState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vpc_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int vpc_write(BlockDriverState *bs, int64_t sector_num,
    const uint8_t *buf, int nb_sectors)
 {
@@ -469,20 +437,9 @@ static int vpc_write(BlockDriverState *bs, int64_t sector_num,
    return 0;
 }

-static coroutine_fn int vpc_co_write(BlockDriverState *bs, int64_t sector_num,
-                                     const uint8_t *buf, int nb_sectors)
+static int vpc_flush(BlockDriverState *bs)
 {
-    int ret;
-    BDRVVPCState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vpc_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
-static coroutine_fn int vpc_co_flush(BlockDriverState *bs)
-{
-    return bdrv_co_flush(bs->file);
+    return bdrv_flush(bs->file);
 }

 /*
@@ -548,8 +505,12 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
    int ret = -EIO;

    // Read out options
-    total_sectors = get_option_parameter(options, BLOCK_OPT_SIZE)->value.n /
-                    BDRV_SECTOR_SIZE;
+    while (options && options->name) {
+        if (!strcmp(options->name, "size")) {
+            total_sectors = options->value.n / 512;
+        }
+        options++;
+    }

    // Create the file
    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
@@ -630,11 +591,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)

    memcpy(dyndisk_header->magic, "cxsparse", 8);

-    /*
-     * Note: The spec is actually wrong here for data_offset, it says
-     * 0xFFFFFFFF, but MS tools expect all 64 bits to be set.
-     */
-    dyndisk_header->data_offset = be64_to_cpu(0xFFFFFFFFFFFFFFFFULL);
+    dyndisk_header->data_offset = be64_to_cpu(0xFFFFFFFF);
    dyndisk_header->table_offset = be64_to_cpu(3 * 512);
    dyndisk_header->version = be32_to_cpu(0x00010000);
    dyndisk_header->block_size = be32_to_cpu(block_size);
@@ -660,13 +617,10 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)
 static void vpc_close(BlockDriverState *bs)
 {
    BDRVVPCState *s = bs->opaque;
-    g_free(s->pagetable);
+    qemu_free(s->pagetable);
 #ifdef CACHE
-    g_free(s->pageentry_u8);
+    qemu_free(s->pageentry_u8);
 #endif
-
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
 }

 static QEMUOptionParameter vpc_create_options[] = {
@@ -681,16 +635,14 @@ static QEMUOptionParameter vpc_create_options[] = {
 static BlockDriver bdrv_vpc = {
    .format_name    = "vpc",
    .instance_size  = sizeof(BDRVVPCState),
-
    .bdrv_probe     = vpc_probe,
    .bdrv_open      = vpc_open,
+    .bdrv_read      = vpc_read,
+    .bdrv_write     = vpc_write,
+    .bdrv_flush     = vpc_flush,
    .bdrv_close     = vpc_close,
    .bdrv_create    = vpc_create,

-    .bdrv_read              = vpc_co_read,
-    .bdrv_write             = vpc_co_write,
-    .bdrv_co_flush_to_disk  = vpc_co_flush,
-
    .create_options = vpc_create_options,
 };

--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -27,7 +27,6 @@
 #include "qemu-common.h"
 #include "block_int.h"
 #include "module.h"
-#include "migration.h"

 #ifndef S_IWGRP
 #define S_IWGRP 0
@@ -87,7 +86,8 @@ static inline void array_init(array_t* array,unsigned int item_size)

 static inline void array_free(array_t* array)
 {
-    g_free(array->pointer);
+    if(array->pointer)
+        free(array->pointer);
    array->size=array->next=0;
 }

@@ -101,7 +101,7 @@ static inline int array_ensure_allocated(array_t* array, int index)
 {
    if((index + 1) * array->item_size > array->size) {
 	int new_size = (index + 32) * array->item_size;
-	array->pointer = g_realloc(array->pointer, new_size);
+	array->pointer = qemu_realloc(array->pointer, new_size);
 	if (!array->pointer)
 	    return -1;
 	array->size = new_size;
@@ -127,7 +127,7 @@ static inline void* array_get_next(array_t* array) {
 static inline void* array_insert(array_t* array,unsigned int index,unsigned int count) {
    if((array->next+count)*array->item_size>array->size) {
 	int increment=count*array->item_size;
-	array->pointer=g_realloc(array->pointer,array->size+increment);
+	array->pointer=qemu_realloc(array->pointer,array->size+increment);
 	if(!array->pointer)
            return NULL;
 	array->size+=increment;
@@ -159,7 +159,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun
    is=array->item_size;
    from=array->pointer+index_from*is;
    to=array->pointer+index_to*is;
-    buf=g_malloc(is*count);
+    buf=qemu_malloc(is*count);
    memcpy(buf,from,is*count);

    if(index_to<index_from)
@@ -169,7 +169,7 @@ static inline int array_roll(array_t* array,int index_to,int index_from,int coun

    memcpy(to,buf,is*count);

-    g_free(buf);
+    free(buf);

    return 0;
 }
@@ -200,7 +200,7 @@ static int array_index(array_t* array, void* pointer)
 }

 /* These structures are used to fake a disk and the VFAT filesystem.
- * For this reason we need to use QEMU_PACKED. */
+ * For this reason we need to use __attribute__((packed)). */

 typedef struct bootsector_t {
    uint8_t jump[3];
@@ -224,7 +224,7 @@ typedef struct bootsector_t {
 	    uint8_t signature;
 	    uint32_t id;
 	    uint8_t volume_label[11];
-	} QEMU_PACKED fat16;
+	} __attribute__((packed)) fat16;
 	struct {
 	    uint32_t sectors_per_fat;
 	    uint16_t flags;
@@ -233,12 +233,12 @@ typedef struct bootsector_t {
 	    uint16_t info_sector;
 	    uint16_t backup_boot_sector;
 	    uint16_t ignored;
-	} QEMU_PACKED fat32;
+	} __attribute__((packed)) fat32;
    } u;
    uint8_t fat_type[8];
    uint8_t ignored[0x1c0];
    uint8_t magic[2];
-} QEMU_PACKED bootsector_t;
+} __attribute__((packed)) bootsector_t;

 typedef struct {
    uint8_t head;
@@ -253,7 +253,7 @@ typedef struct partition_t {
    mbr_chs_t end_CHS;
    uint32_t start_sector_long;
    uint32_t length_sector_long;
-} QEMU_PACKED partition_t;
+} __attribute__((packed)) partition_t;

 typedef struct mbr_t {
    uint8_t ignored[0x1b8];
@@ -261,7 +261,7 @@ typedef struct mbr_t {
    uint8_t ignored2[2];
    partition_t partition[4];
    uint8_t magic[2];
-} QEMU_PACKED mbr_t;
+} __attribute__((packed)) mbr_t;

 typedef struct direntry_t {
    uint8_t name[8];
@@ -276,7 +276,7 @@ typedef struct direntry_t {
    uint16_t mdate;
    uint16_t begin;
    uint32_t size;
-} QEMU_PACKED direntry_t;
+} __attribute__((packed)) direntry_t;

 /* this structure are used to transparently access the files */

@@ -318,7 +318,6 @@ static void print_mapping(const struct mapping_t* mapping);
 /* here begins the real VVFAT driver */

 typedef struct BDRVVVFATState {
-    CoMutex lock;
    BlockDriverState* bs; /* pointer to parent */
    unsigned int first_sectors_number; /* 1 for a single partition, 0x40 for a disk with partition table */
    unsigned char first_sectors[0x40*0x200];
@@ -351,8 +350,6 @@ typedef struct BDRVVVFATState {
    array_t commits;
    const char* path;
    int downcase_short_names;
-
-    Error *migration_blocker;
 } BDRVVVFATState;

 /* take the sector position spos and convert it to Cylinder/Head/Sector position
@@ -731,11 +728,11 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	if(first_cluster == 0 && (is_dotdot || is_dot))
 	    continue;

-	buffer=(char*)g_malloc(length);
+	buffer=(char*)qemu_malloc(length);
 	snprintf(buffer,length,"%s/%s",dirname,entry->d_name);

 	if(stat(buffer,&st)<0) {
-            g_free(buffer);
+	    free(buffer);
            continue;
 	}

@@ -758,7 +755,7 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	    direntry->begin=0; /* do that later */
        if (st.st_size > 0x7fffffff) {
 	    fprintf(stderr, "File %s is larger than 2GB\n", buffer);
-            g_free(buffer);
+	    free(buffer);
            closedir(dir);
 	    return -2;
        }
@@ -802,7 +799,6 @@ static int read_directory(BDRVVVFATState* s, int mapping_index)
 	/* root directory */
 	int cur = s->directory.next;
 	array_ensure_allocated(&(s->directory), ROOT_ENTRIES - 1);
-	s->directory.next = ROOT_ENTRIES;
 	memset(array_get(&(s->directory), cur), 0,
 		(ROOT_ENTRIES - cur) * sizeof(direntry_t));
    }
@@ -829,6 +825,20 @@ static inline off_t cluster2sector(BDRVVVFATState* s, uint32_t cluster_num)
    return s->faked_sectors + s->sectors_per_cluster * cluster_num;
 }

+static inline uint32_t sector_offset_in_cluster(BDRVVVFATState* s,off_t sector_num)
+{
+    return (sector_num-s->first_sectors_number-2*s->sectors_per_fat)%s->sectors_per_cluster;
+}
+
+#ifdef DBG
+static direntry_t* get_direntry_for_mapping(BDRVVVFATState* s,mapping_t* mapping)
+{
+    if(mapping->mode==MODE_UNDEFINED)
+	return 0;
+    return (direntry_t*)(s->directory.pointer+sizeof(direntry_t)*mapping->dir_index);
+}
+#endif
+
 static int init_directories(BDRVVVFATState* s,
 	const char* dirname)
 {
@@ -840,7 +850,7 @@ static int init_directories(BDRVVVFATState* s,
    memset(&(s->first_sectors[0]),0,0x40*0x200);

    s->cluster_size=s->sectors_per_cluster*0x200;
-    s->cluster_buffer=g_malloc(s->cluster_size);
+    s->cluster_buffer=qemu_malloc(s->cluster_size);

    /*
     * The formula: sc = spf+1+spf*spc*(512*8/fat_type),
@@ -874,7 +884,7 @@ static int init_directories(BDRVVVFATState* s,
    mapping->dir_index = 0;
    mapping->info.dir.parent_mapping_index = -1;
    mapping->first_mapping_index = -1;
-    mapping->path = g_strdup(dirname);
+    mapping->path = qemu_strdup(dirname);
    i = strlen(mapping->path);
    if (i > 0 && mapping->path[i - 1] == '/')
 	mapping->path[i - 1] = '\0';
@@ -919,8 +929,11 @@ static int init_directories(BDRVVVFATState* s,
 	cluster = mapping->end;

 	if(cluster > s->cluster_count) {
-	    fprintf(stderr,"Directory does not fit in FAT%d (capacity %.2f MB)\n",
-		    s->fat_type, s->sector_count / 2000.0);
+	    fprintf(stderr,"Directory does not fit in FAT%d (capacity %s)\n",
+		    s->fat_type,
+		    s->fat_type == 12 ? s->sector_count == 2880 ? "1.44 MB"
+								: "2.88 MB"
+				      : "504MB");
 	    return -EINVAL;
 	}

@@ -954,7 +967,7 @@ static int init_directories(BDRVVVFATState* s,
    bootsector->number_of_fats=0x2; /* number of FATs */
    bootsector->root_entries=cpu_to_le16(s->sectors_of_root_directory*0x10);
    bootsector->total_sectors16=s->sector_count>0xffff?0:cpu_to_le16(s->sector_count);
-    bootsector->media_type=(s->first_sectors_number>1?0xf8:0xf0); /* media descriptor (f8=hd, f0=3.5 fd)*/
+    bootsector->media_type=(s->fat_type!=12?0xf8:s->sector_count==5760?0xf9:0xf8); /* media descriptor */
    s->fat.pointer[0] = bootsector->media_type;
    bootsector->sectors_per_fat=cpu_to_le16(s->sectors_per_fat);
    bootsector->sectors_per_track=cpu_to_le16(s->bs->secs);
@@ -963,7 +976,7 @@ static int init_directories(BDRVVVFATState* s,
    bootsector->total_sectors=cpu_to_le32(s->sector_count>0xffff?s->sector_count:0);

    /* LATER TODO: if FAT32, this is wrong */
-    bootsector->u.fat16.drive_number=s->first_sectors_number==1?0:0x80; /* fda=0, hda=0x80 */
+    bootsector->u.fat16.drive_number=s->fat_type==12?0:0x80; /* assume this is hda (TODO) */
    bootsector->u.fat16.current_head=0;
    bootsector->u.fat16.signature=0x29;
    bootsector->u.fat16.id=cpu_to_le32(0xfabe1afd);
@@ -985,6 +998,7 @@ static int is_consistent(BDRVVVFATState *s);
 static int vvfat_open(BlockDriverState *bs, const char* dirname, int flags)
 {
    BDRVVVFATState *s = bs->opaque;
+    int floppy = 0;
    int i;

 #ifdef DEBUG
@@ -998,8 +1012,11 @@ DLOG(if (stderr == NULL) {

    s->bs = bs;

+    s->fat_type=16;
    /* LATER TODO: if FAT32, adjust */
    s->sectors_per_cluster=0x10;
+    /* 504MB disk*/
+    bs->cyls=1024; bs->heads=16; bs->secs=63;

    s->current_cluster=0xffffffff;

@@ -1014,6 +1031,16 @@ DLOG(if (stderr == NULL) {
    if (!strstart(dirname, "fat:", NULL))
 	return -1;

+    if (strstr(dirname, ":floppy:")) {
+	floppy = 1;
+	s->fat_type = 12;
+	s->first_sectors_number = 1;
+	s->sectors_per_cluster=2;
+	bs->cyls = 80; bs->heads = 2; bs->secs = 36;
+    }
+
+    s->sector_count=bs->cyls*bs->heads*bs->secs;
+
    if (strstr(dirname, ":32:")) {
 	fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. You are welcome to do so!\n");
 	s->fat_type = 32;
@@ -1021,31 +1048,9 @@ DLOG(if (stderr == NULL) {
 	s->fat_type = 16;
    } else if (strstr(dirname, ":12:")) {
 	s->fat_type = 12;
+	s->sector_count=2880;
    }

-    if (strstr(dirname, ":floppy:")) {
-	/* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
-	if (!s->fat_type) {
-	    s->fat_type = 12;
-	    bs->secs = 36;
-	    s->sectors_per_cluster=2;
-	} else {
-	    bs->secs=(s->fat_type == 12 ? 18 : 36);
-	    s->sectors_per_cluster=1;
-	}
-	s->first_sectors_number = 1;
-	bs->cyls=80; bs->heads=2;
-    } else {
-	/* 32MB or 504MB disk*/
-	if (!s->fat_type) {
-	    s->fat_type = 16;
-	}
-	bs->cyls=(s->fat_type == 12 ? 64 : 1024);
-	bs->heads=16; bs->secs=63;
-    }
-
-    s->sector_count=bs->cyls*bs->heads*bs->secs-(s->first_sectors_number-1);
-
    if (strstr(dirname, ":rw:")) {
 	if (enable_write_target(s))
 	    return -1;
@@ -1069,22 +1074,12 @@ DLOG(if (stderr == NULL) {

    if(s->first_sectors_number==0x40)
 	init_mbr(s);
-    else {
-        /* MS-DOS does not like to know about CHS (?). */
+
+    /* for some reason or other, MS-DOS does not like to know about CHS... */
+    if (floppy)
 	bs->heads = bs->cyls = bs->secs = 0;
-    }

    //    assert(is_consistent(s));
-    qemu_co_mutex_init(&s->lock);
-
-    /* Disable migration when vvfat is used rw */
-    if (s->qcow) {
-        error_set(&s->migration_blocker,
-                  QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
-                  "vvfat (rw)", bs->device_name, "live migration");
-        migrate_add_blocker(s->migration_blocker);
-    }
-
    return 0;
 }

@@ -1143,6 +1138,25 @@ static inline mapping_t* find_mapping_for_cluster(BDRVVVFATState* s,int cluster_
    return mapping;
 }

+/*
+ * This function simply compares path == mapping->path. Since the mappings
+ * are sorted by cluster, this is expensive: O(n).
+ */
+static inline mapping_t* find_mapping_for_path(BDRVVVFATState* s,
+	const char* path)
+{
+    int i;
+
+    for (i = 0; i < s->mapping.next; i++) {
+	mapping_t* mapping = array_get(&(s->mapping), i);
+	if (mapping->first_mapping_index < 0 &&
+		!strcmp(path, mapping->path))
+	    return mapping;
+    }
+
+    return NULL;
+}
+
 static int open_file(BDRVVVFATState* s,mapping_t* mapping)
 {
    if(!mapping)
@@ -1209,6 +1223,23 @@ read_cluster_directory:
 }

 #ifdef DEBUG
+static void hexdump(const void* address, uint32_t len)
+{
+    const unsigned char* p = address;
+    int i, j;
+
+    for (i = 0; i < len; i += 16) {
+	for (j = 0; j < 16 && i + j < len; j++)
+	    fprintf(stderr, "%02x ", p[i + j]);
+	for (; j < 16; j++)
+	    fprintf(stderr, "   ");
+	fprintf(stderr, " ");
+	for (j = 0; j < 16 && i + j < len; j++)
+	    fprintf(stderr, "%c", (p[i + j] < ' ' || p[i + j] > 0x7f) ? '.' : p[i + j]);
+	fprintf(stderr, "\n");
+    }
+}
+
 static void print_direntry(const direntry_t* direntry)
 {
    int j = 0;
@@ -1262,19 +1293,19 @@ static int vvfat_read(BlockDriverState *bs, int64_t sector_num,
    int i;

    for(i=0;i<nb_sectors;i++,sector_num++) {
-	if (sector_num >= bs->total_sectors)
+	if (sector_num >= s->sector_count)
 	   return -1;
 	if (s->qcow) {
 	    int n;
-            if (bdrv_is_allocated(s->qcow, sector_num, nb_sectors-i, &n)) {
+	    if (s->qcow->drv->bdrv_is_allocated(s->qcow,
+			sector_num, nb_sectors-i, &n)) {
 DLOG(fprintf(stderr, "sectors %d+%d allocated\n", (int)sector_num, n));
-                if (bdrv_read(s->qcow, sector_num, buf + i*0x200, n)) {
-                    return -1;
-                }
-                i += n - 1;
-                sector_num += n - 1;
-                continue;
-            }
+		if (s->qcow->drv->bdrv_read(s->qcow, sector_num, buf+i*0x200, n))
+		    return -1;
+		i += n - 1;
+		sector_num += n - 1;
+		continue;
+	    }
 DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
 	}
 	if(sector_num<s->faked_sectors) {
@@ -1288,7 +1319,7 @@ DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
 	    uint32_t sector=sector_num-s->faked_sectors,
 	    sector_offset_in_cluster=(sector%s->sectors_per_cluster),
 	    cluster_num=sector/s->sectors_per_cluster;
-	    if(cluster_num > s->cluster_count || read_cluster(s, cluster_num) != 0) {
+	    if(read_cluster(s, cluster_num) != 0) {
 		/* LATER TODO: strict: return -1; */
 		memset(buf+i*0x200,0,0x200);
 		continue;
@@ -1299,17 +1330,6 @@ DLOG(fprintf(stderr, "sector %d not allocated\n", (int)sector_num));
    return 0;
 }

-static coroutine_fn int vvfat_co_read(BlockDriverState *bs, int64_t sector_num,
-                                      uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVVFATState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vvfat_read(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 /* LATER TODO: statify all functions */

 /*
@@ -1355,7 +1375,7 @@ DLOG(fprintf(stderr, "clear_commits (%d commits)\n", s->commits.next));
 	assert(commit->path || commit->action == ACTION_WRITEOUT);
 	if (commit->action != ACTION_WRITEOUT) {
 	    assert(commit->path);
-            g_free(commit->path);
+	    free(commit->path);
 	} else
 	    assert(commit->path == NULL);
    }
@@ -1528,7 +1548,7 @@ static inline int cluster_was_modified(BDRVVVFATState* s, uint32_t cluster_num)
 	return 0;

    for (i = 0; !was_modified && i < s->sectors_per_cluster; i++)
-	was_modified = bdrv_is_allocated(s->qcow,
+	was_modified = s->qcow->drv->bdrv_is_allocated(s->qcow,
 		cluster2sector(s, cluster_num) + i, 1, &dummy);

    return was_modified;
@@ -1618,10 +1638,10 @@ static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,

 	    /* rename */
 	    if (strcmp(basename, basename2))
-		schedule_rename(s, cluster_num, g_strdup(path));
+		schedule_rename(s, cluster_num, qemu_strdup(path));
 	} else if (is_file(direntry))
 	    /* new file */
-	    schedule_new_file(s, g_strdup(path), cluster_num);
+	    schedule_new_file(s, qemu_strdup(path), cluster_num);
 	else {
            abort();
 	    return 0;
@@ -1677,16 +1697,16 @@ static uint32_t get_cluster_count_for_direntry(BDRVVVFATState* s,
 		int64_t offset = cluster2sector(s, cluster_num);

 		vvfat_close_current_file(s);
-                for (i = 0; i < s->sectors_per_cluster; i++) {
-                    if (!bdrv_is_allocated(s->qcow, offset + i, 1, &dummy)) {
-                        if (vvfat_read(s->bs, offset, s->cluster_buffer, 1)) {
-                            return -1;
-                        }
-                        if (bdrv_write(s->qcow, offset, s->cluster_buffer, 1)) {
-                            return -2;
-                        }
-                    }
-                }
+		for (i = 0; i < s->sectors_per_cluster; i++)
+		    if (!s->qcow->drv->bdrv_is_allocated(s->qcow,
+				offset + i, 1, &dummy)) {
+			if (vvfat_read(s->bs,
+				    offset, s->cluster_buffer, 1))
+			    return -1;
+			if (s->qcow->drv->bdrv_write(s->qcow,
+				    offset, s->cluster_buffer, 1))
+			    return -2;
+		    }
 	    }
 	}

@@ -1715,13 +1735,13 @@ static int check_directory_consistency(BDRVVVFATState *s,
 	int cluster_num, const char* path)
 {
    int ret = 0;
-    unsigned char* cluster = g_malloc(s->cluster_size);
+    unsigned char* cluster = qemu_malloc(s->cluster_size);
    direntry_t* direntries = (direntry_t*)cluster;
    mapping_t* mapping = find_mapping_for_cluster(s, cluster_num);

    long_file_name lfn;
    int path_len = strlen(path);
-    char path2[PATH_MAX + 1];
+    char path2[PATH_MAX];

    assert(path_len < PATH_MAX); /* len was tested before! */
    pstrcpy(path2, sizeof(path2), path);
@@ -1738,10 +1758,10 @@ static int check_directory_consistency(BDRVVVFATState *s,
 	mapping->mode &= ~MODE_DELETED;

 	if (strcmp(basename, basename2))
-	    schedule_rename(s, cluster_num, g_strdup(path));
+	    schedule_rename(s, cluster_num, qemu_strdup(path));
    } else
 	/* new directory */
-	schedule_mkdir(s, cluster_num, g_strdup(path));
+	schedule_mkdir(s, cluster_num, qemu_strdup(path));

    lfn_init(&lfn);
    do {
@@ -1762,14 +1782,14 @@ DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", (int)cluster_num, (int)clu
 	if (subret) {
 	    fprintf(stderr, "Error fetching direntries\n");
 	fail:
-            g_free(cluster);
+	    free(cluster);
 	    return 0;
 	}

 	for (i = 0; i < 0x10 * s->sectors_per_cluster; i++) {
 	    int cluster_count = 0;

-DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i));
+DLOG(fprintf(stderr, "check direntry %d: \n", i); print_direntry(direntries + i));
 	    if (is_volume_label(direntries + i) || is_dot(direntries + i) ||
 		    is_free(direntries + i))
 		continue;
@@ -1830,7 +1850,7 @@ DLOG(fprintf(stderr, "check direntry %d:\n", i); print_direntry(direntries + i))
 	cluster_num = modified_fat_get(s, cluster_num);
    } while(!fat_eof(s, cluster_num));

-    g_free(cluster);
+    free(cluster);
    return ret;
 }

@@ -1856,7 +1876,7 @@ DLOG(checkpoint());
     */
    if (s->fat2 == NULL) {
 	int size = 0x200 * s->sectors_per_fat;
-	s->fat2 = g_malloc(size);
+	s->fat2 = qemu_malloc(size);
 	memcpy(s->fat2, s->fat.pointer, size);
    }
    check = vvfat_read(s->bs,
@@ -1975,9 +1995,8 @@ static int remove_mapping(BDRVVVFATState* s, int mapping_index)
    mapping_t* first_mapping = array_get(&(s->mapping), 0);

    /* free mapping */
-    if (mapping->first_mapping_index < 0) {
-        g_free(mapping->path);
-    }
+    if (mapping->first_mapping_index < 0)
+	free(mapping->path);

    /* remove from s->mapping */
    array_remove(&(s->mapping), mapping_index);
@@ -2199,7 +2218,7 @@ static int commit_one_file(BDRVVVFATState* s,
    uint32_t first_cluster = c;
    mapping_t* mapping = find_mapping_for_cluster(s, c);
    uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = g_malloc(s->cluster_size);
+    char* cluster = qemu_malloc(s->cluster_size);
    uint32_t i;
    int fd = 0;

@@ -2213,15 +2232,11 @@ static int commit_one_file(BDRVVVFATState* s,
    if (fd < 0) {
 	fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
 		strerror(errno), errno);
-        g_free(cluster);
 	return fd;
    }
-    if (offset > 0) {
-        if (lseek(fd, offset, SEEK_SET) != offset) {
-            g_free(cluster);
-            return -3;
-        }
-    }
+    if (offset > 0)
+	if (lseek(fd, offset, SEEK_SET) != offset)
+	    return -3;

    while (offset < size) {
 	uint32_t c1;
@@ -2237,15 +2252,11 @@ static int commit_one_file(BDRVVVFATState* s,
 	ret = vvfat_read(s->bs, cluster2sector(s, c),
 	    (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);

-        if (ret < 0) {
-            g_free(cluster);
-            return ret;
-        }
+	if (ret < 0)
+	    return ret;

-        if (write(fd, cluster, rest_size) < 0) {
-            g_free(cluster);
-            return -2;
-        }
+	if (write(fd, cluster, rest_size) < 0)
+	    return -2;

 	offset += rest_size;
 	c = c1;
@@ -2254,11 +2265,9 @@ static int commit_one_file(BDRVVVFATState* s,
    if (ftruncate(fd, size)) {
        perror("ftruncate()");
        close(fd);
-        g_free(cluster);
        return -4;
    }
    close(fd);
-    g_free(cluster);

    return commit_mappings(s, first_cluster, dir_index);
 }
@@ -2374,7 +2383,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
 			    mapping_t* m = find_mapping_for_cluster(s,
 				    begin_of_direntry(d));
 			    int l = strlen(m->path);
-			    char* new_path = g_malloc(l + diff + 1);
+			    char* new_path = qemu_malloc(l + diff + 1);

 			    assert(!strncmp(m->path, mapping->path, l2));

@@ -2390,7 +2399,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
 		}
 	    }

-            g_free(old_path);
+	    free(old_path);
 	    array_remove(&(s->commits), i);
 	    continue;
 	} else if (commit->action == ACTION_MKDIR) {
@@ -2631,9 +2640,7 @@ static int do_commit(BDRVVVFATState* s)
 	return ret;
    }

-    if (s->qcow->drv->bdrv_make_empty) {
-        s->qcow->drv->bdrv_make_empty(s->qcow);
-    }
+    s->qcow->drv->bdrv_make_empty(s->qcow);

    memset(s->used_clusters, 0, sector2cluster(s, s->sector_count));

@@ -2728,7 +2735,7 @@ DLOG(checkpoint());
     * Use qcow backend. Commit later.
     */
 DLOG(fprintf(stderr, "Write to qcow backend: %d + %d\n", (int)sector_num, nb_sectors));
-    ret = bdrv_write(s->qcow, sector_num, buf, nb_sectors);
+    ret = s->qcow->drv->bdrv_write(s->qcow, sector_num, buf, nb_sectors);
    if (ret < 0) {
 	fprintf(stderr, "Error writing to qcow backend\n");
 	return ret;
@@ -2747,17 +2754,6 @@ DLOG(checkpoint());
    return 0;
 }

-static coroutine_fn int vvfat_co_write(BlockDriverState *bs, int64_t sector_num,
-                                       const uint8_t *buf, int nb_sectors)
-{
-    int ret;
-    BDRVVVFATState *s = bs->opaque;
-    qemu_co_mutex_lock(&s->lock);
-    ret = vvfat_write(bs, sector_num, buf, nb_sectors);
-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
-}
-
 static int vvfat_is_allocated(BlockDriverState *bs,
 	int64_t sector_num, int nb_sectors, int* n)
 {
@@ -2779,7 +2775,7 @@ static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
 static void write_target_close(BlockDriverState *bs) {
    BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
    bdrv_delete(s->qcow);
-    g_free(s->qcow_filename);
+    free(s->qcow_filename);
 }

 static BlockDriver vvfat_write_target = {
@@ -2798,7 +2794,7 @@ static int enable_write_target(BDRVVVFATState *s)

    array_init(&(s->commits), sizeof(commit_t));

-    s->qcow_filename = g_malloc(1024);
+    s->qcow_filename = qemu_malloc(1024);
    get_tmp_filename(s->qcow_filename, 1024);

    bdrv_qcow = bdrv_find_format("qcow");
@@ -2826,7 +2822,7 @@ static int enable_write_target(BDRVVVFATState *s)

    s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
    s->bs->backing_hd->drv = &vvfat_write_target;
-    s->bs->backing_hd->opaque = g_malloc(sizeof(void*));
+    s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
    *(void**)s->bs->backing_hd->opaque = s;

    return 0;
@@ -2840,20 +2836,16 @@ static void vvfat_close(BlockDriverState *bs)
    array_free(&(s->fat));
    array_free(&(s->directory));
    array_free(&(s->mapping));
-    g_free(s->cluster_buffer);
-
-    if (s->qcow) {
-        migrate_del_blocker(s->migration_blocker);
-        error_free(s->migration_blocker);
-    }
+    if(s->cluster_buffer)
+        free(s->cluster_buffer);
 }

 static BlockDriver bdrv_vvfat = {
    .format_name	= "vvfat",
    .instance_size	= sizeof(BDRVVVFATState),
    .bdrv_file_open	= vvfat_open,
-    .bdrv_read          = vvfat_co_read,
-    .bdrv_write         = vvfat_co_write,
+    .bdrv_read		= vvfat_read,
+    .bdrv_write		= vvfat_write,
    .bdrv_close		= vvfat_close,
    .bdrv_is_allocated	= vvfat_is_allocated,
    .protocol_name	= "fat",
@@ -2886,5 +2878,11 @@ static void checkpoint(void) {
    direntry = array_get(&(vvv->directory), mapping->dir_index);
    assert(!memcmp(direntry->name, "USB     H  ", 11) || direntry->name[0]==0);
 #endif
+    return;
+    /* avoid compiler warnings: */
+    hexdump(NULL, 100);
+    remove_mapping(vvv, 0);
+    print_mapping(NULL);
+    print_direntry(NULL);
 }
 #endif
--- a/block_int.h
+++ b/block_int.h
@@ -27,9 +27,6 @@
 #include "block.h"
 #include "qemu-option.h"
 #include "qemu-queue.h"
-#include "qemu-coroutine.h"
-#include "qemu-timer.h"
-#include "qapi-types.h"

 #define BLOCK_FLAG_ENCRYPT	1
 #define BLOCK_FLAG_COMPAT6	4
@@ -42,7 +39,6 @@
 #define BLOCK_OPT_CLUSTER_SIZE  "cluster_size"
 #define BLOCK_OPT_TABLE_SIZE    "table_size"
 #define BLOCK_OPT_PREALLOC      "preallocation"
-#define BLOCK_OPT_SUBFMT        "subformat"

 typedef struct AIOPool {
    void (*cancel)(BlockDriverAIOCB *acb);
@@ -63,6 +59,7 @@ struct BlockDriver {
                      const uint8_t *buf, int nb_sectors);
    void (*bdrv_close)(BlockDriverState *bs);
    int (*bdrv_create)(const char *filename, QEMUOptionParameter *options);
+    int (*bdrv_flush)(BlockDriverState *bs);
    int (*bdrv_is_allocated)(BlockDriverState *bs, int64_t sector_num,
                             int nb_sectors, int *pnum);
    int (*bdrv_set_key)(BlockDriverState *bs, const char *key);
@@ -76,34 +73,8 @@ struct BlockDriver {
        BlockDriverCompletionFunc *cb, void *opaque);
    BlockDriverAIOCB *(*bdrv_aio_flush)(BlockDriverState *bs,
        BlockDriverCompletionFunc *cb, void *opaque);
-    BlockDriverAIOCB *(*bdrv_aio_discard)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque);
-
-    int coroutine_fn (*bdrv_co_readv)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
-    int coroutine_fn (*bdrv_co_writev)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
-    int coroutine_fn (*bdrv_co_discard)(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors);
-
-    /*
-     * Invalidate any cached meta-data.
-     */
-    void (*bdrv_invalidate_cache)(BlockDriverState *bs);
-
-    /*
-     * Flushes all data that was already written to the OS all the way down to
-     * the disk (for example raw-posix calls fsync()).
-     */
-    int coroutine_fn (*bdrv_co_flush_to_disk)(BlockDriverState *bs);
-
-    /*
-     * Flushes all internal caches to the OS. The data may still sit in a
-     * writeback cache of the host OS, but it will survive a crash of the qemu
-     * process.
-     */
-    int coroutine_fn (*bdrv_co_flush_to_os)(BlockDriverState *bs);
+    int (*bdrv_discard)(BlockDriverState *bs, int64_t sector_num,
+                        int nb_sectors);

    int (*bdrv_aio_multiwrite)(BlockDriverState *bs, BlockRequest *reqs,
        int num_reqs);
@@ -114,7 +85,6 @@ struct BlockDriver {
    const char *protocol_name;
    int (*bdrv_truncate)(BlockDriverState *bs, int64_t offset);
    int64_t (*bdrv_getlength)(BlockDriverState *bs);
-    int64_t (*bdrv_get_allocated_file_size)(BlockDriverState *bs);
    int (*bdrv_write_compressed)(BlockDriverState *bs, int64_t sector_num,
                                 const uint8_t *buf, int nb_sectors);

@@ -140,8 +110,8 @@ struct BlockDriver {
    /* removable device specific */
    int (*bdrv_is_inserted)(BlockDriverState *bs);
    int (*bdrv_media_changed)(BlockDriverState *bs);
-    void (*bdrv_eject)(BlockDriverState *bs, int eject_flag);
-    void (*bdrv_lock_medium)(BlockDriverState *bs, bool locked);
+    int (*bdrv_eject)(BlockDriverState *bs, int eject_flag);
+    int (*bdrv_set_locked)(BlockDriverState *bs, int locked);

    /* to control generic scsi devices */
    int (*bdrv_ioctl)(BlockDriverState *bs, unsigned long int req, void *buf);
@@ -176,23 +146,27 @@ struct BlockDriverState {
    int read_only; /* if true, the media is read only */
    int keep_read_only; /* if true, the media was requested to stay read only */
    int open_flags; /* flags used to open the file, re-used for re-open */
+    int removable; /* if true, the media can be removed */
+    int locked;    /* if true, the media cannot temporarily be ejected */
+    int tray_open; /* if true, the virtual tray is open */
    int encrypted; /* if true, the media is encrypted */
    int valid_key; /* if true, a valid encryption key has been set */
    int sg;        /* if true, the device is a /dev/sg* */
+    /* event callback when inserting/removing */
+    void (*change_cb)(void *opaque, int reason);
+    void *change_opaque;

    BlockDriver *drv; /* NULL means no media */
    void *opaque;

-    void *dev;                  /* attached device model, if any */
-    /* TODO change to DeviceState when all users are qdevified */
-    const BlockDevOps *dev_ops;
-    void *dev_opaque;
+    DeviceState *peer;

    char filename[1024];
    char backing_file[1024]; /* if non zero, the image is a diff of
                                this file image */
    char backing_format[16]; /* if non-zero and backing_file exists */
    int is_temporary;
+    int media_changed;

    BlockDriverState *backing_hd;
    BlockDriverState *file;
@@ -202,9 +176,10 @@ struct BlockDriverState {
    void *sync_aiocb;

    /* I/O stats (display with "info blockstats"). */
-    uint64_t nr_bytes[BDRV_MAX_IOTYPE];
-    uint64_t nr_ops[BDRV_MAX_IOTYPE];
-    uint64_t total_time_ns[BDRV_MAX_IOTYPE];
+    uint64_t rd_bytes;
+    uint64_t wr_bytes;
+    uint64_t rd_ops;
+    uint64_t wr_ops;
    uint64_t wr_highest_sector;

    /* Whether the disk can expand beyond total_sectors */
@@ -219,9 +194,8 @@ struct BlockDriverState {
    /* NOTE: the following infos are only hints for real hardware
       drivers. They are not used by the block driver */
    int cyls, heads, secs, translation;
+    int type;
    BlockErrorAction on_read_error, on_write_error;
-    bool iostatus_enabled;
-    BlockDeviceIoStatus iostatus;
    char device_name[32];
    unsigned long *dirty_bitmap;
    int64_t dirty_count;
@@ -230,6 +204,9 @@ struct BlockDriverState {
    void *private;
 };

+#define CHANGE_MEDIA	0x01
+#define CHANGE_SIZE	0x02
+
 struct BlockDriverAIOCB {
    AIOPool *pool;
    BlockDriverState *bs;
@@ -244,8 +221,45 @@ void *qemu_aio_get(AIOPool *pool, BlockDriverState *bs,
                   BlockDriverCompletionFunc *cb, void *opaque);
 void qemu_aio_release(void *p);

+void *qemu_blockalign(BlockDriverState *bs, size_t size);
+
 #ifdef _WIN32
 int is_windows_drive(const char *filename);
 #endif

+typedef struct BlockConf {
+    BlockDriverState *bs;
+    uint16_t physical_block_size;
+    uint16_t logical_block_size;
+    uint16_t min_io_size;
+    uint32_t opt_io_size;
+    int32_t bootindex;
+    uint32_t discard_granularity;
+} BlockConf;
+
+static inline unsigned int get_physical_block_exp(BlockConf *conf)
+{
+    unsigned int exp = 0, size;
+
+    for (size = conf->physical_block_size;
+        size > conf->logical_block_size;
+        size >>= 1) {
+        exp++;
+    }
+
+    return exp;
+}
+
+#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
+    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
+    DEFINE_PROP_UINT16("logical_block_size", _state,                    \
+                       _conf.logical_block_size, 512),                  \
+    DEFINE_PROP_UINT16("physical_block_size", _state,                   \
+                       _conf.physical_block_size, 512),                 \
+    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
+    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
+    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
+    DEFINE_PROP_UINT32("discard_granularity", _state, \
+                       _conf.discard_granularity, 0)
+
 #endif /* BLOCK_INT_H */
--- a/blockdev.c
+++ b/blockdev.c
@@ -14,6 +14,7 @@
 #include "qemu-option.h"
 #include "qemu-config.h"
 #include "sysemu.h"
+#include "hw/qdev.h"
 #include "block_int.h"

 static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);
@@ -181,9 +182,8 @@ static void drive_uninit(DriveInfo *dinfo)
 {
    qemu_opts_del(dinfo->opts);
    bdrv_delete(dinfo->bdrv);
-    g_free(dinfo->id);
    QTAILQ_REMOVE(&drives, dinfo, next);
-    g_free(dinfo);
+    qemu_free(dinfo);
 }

 void drive_put_ref(DriveInfo *dinfo)
@@ -239,6 +239,14 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    int ret;

    translation = BIOS_ATA_TRANSLATION_AUTO;
+
+    if (default_to_scsi) {
+        type = IF_SCSI;
+        pstrcpy(devname, sizeof(devname), "scsi");
+    } else {
+        type = IF_IDE;
+        pstrcpy(devname, sizeof(devname), "ide");
+    }
    media = MEDIA_DISK;

    /* extract parameters */
@@ -264,11 +272,7 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
            error_report("unsupported bus type '%s'", buf);
            return NULL;
 	}
-    } else {
-        type = default_to_scsi ? IF_SCSI : IF_IDE;
-        pstrcpy(devname, sizeof(devname), if_name[type]);
    }
-
    max_devs = if_max_devs[type];

    if (cyls || heads || secs) {
@@ -288,7 +292,7 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)

    if ((buf = qemu_opt_get(opts, "trans")) != NULL) {
        if (!cyls) {
-            error_report("'%s' trans must be used with cyls, heads and secs",
+            error_report("'%s' trans must be used with cyls,heads and secs",
                         buf);
            return NULL;
        }
@@ -309,7 +313,7 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
 	    media = MEDIA_DISK;
 	} else if (!strcmp(buf, "cdrom")) {
            if (cyls || secs || heads) {
-                error_report("CHS can't be set with media=%s", buf);
+                error_report("'%s' invalid physical CHS format", buf);
 	        return NULL;
            }
 	    media = MEDIA_CDROM;
@@ -320,9 +324,18 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    }

    if ((buf = qemu_opt_get(opts, "cache")) != NULL) {
-        if (bdrv_parse_cache_flags(buf, &bdrv_flags) != 0) {
-            error_report("invalid cache option");
-            return NULL;
+        if (!strcmp(buf, "off") || !strcmp(buf, "none")) {
+            bdrv_flags |= BDRV_O_NOCACHE;
+        } else if (!strcmp(buf, "writeback")) {
+            bdrv_flags |= BDRV_O_CACHE_WB;
+        } else if (!strcmp(buf, "unsafe")) {
+            bdrv_flags |= BDRV_O_CACHE_WB;
+            bdrv_flags |= BDRV_O_NO_FLUSH;
+        } else if (!strcmp(buf, "writethrough")) {
+            /* this is the default */
+        } else {
+           error_report("invalid cache option");
+           return NULL;
        }
    }

@@ -432,12 +445,12 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)

    /* init */

-    dinfo = g_malloc0(sizeof(*dinfo));
+    dinfo = qemu_mallocz(sizeof(*dinfo));
    if ((buf = qemu_opts_id(opts)) != NULL) {
-        dinfo->id = g_strdup(buf);
+        dinfo->id = qemu_strdup(buf);
    } else {
        /* no id supplied -> create one */
-        dinfo->id = g_malloc0(32);
+        dinfo->id = qemu_mallocz(32);
        if (type == IF_IDE || type == IF_SCSI)
            mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
        if (max_devs)
@@ -473,19 +486,23 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
            }
 	    break;
 	case MEDIA_CDROM:
-            dinfo->media_cd = 1;
+            bdrv_set_type_hint(dinfo->bdrv, BDRV_TYPE_CDROM);
 	    break;
 	}
        break;
    case IF_SD:
+        /* FIXME: This isn't really a floppy, but it's a reasonable
+           approximation.  */
    case IF_FLOPPY:
+        bdrv_set_type_hint(dinfo->bdrv, BDRV_TYPE_FLOPPY);
+        break;
    case IF_PFLASH:
    case IF_MTD:
        break;
    case IF_VIRTIO:
        /* add virtio block device */
        opts = qemu_opts_create(qemu_find_opts("device"), NULL, 0);
-        qemu_opt_set(opts, "driver", "virtio-blk");
+        qemu_opt_set(opts, "driver", "virtio-blk-pci");
        qemu_opt_set(opts, "drive", dinfo->id);
        if (devaddr)
            qemu_opt_set(opts, "addr", devaddr);
@@ -508,7 +525,7 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    } else if (ro == 1) {
        if (type != IF_SCSI && type != IF_VIRTIO && type != IF_FLOPPY && type != IF_NONE) {
            error_report("readonly not supported by this bus type");
-            goto err;
+            return NULL;
        }
    }

@@ -518,19 +535,12 @@ DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
    if (ret < 0) {
        error_report("could not open disk image %s: %s",
                     file, strerror(-ret));
-        goto err;
+        return NULL;
    }

    if (bdrv_key_required(dinfo->bdrv))
        autostart = 0;
    return dinfo;
-
-err:
-    bdrv_delete(dinfo->bdrv);
-    g_free(dinfo->id);
-    QTAILQ_REMOVE(&drives, dinfo, next);
-    g_free(dinfo);
-    return NULL;
 }

 void do_commit(Monitor *mon, const QDict *qdict)
@@ -553,16 +563,15 @@ void do_commit(Monitor *mon, const QDict *qdict)
 int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, QObject **ret_data)
 {
    const char *device = qdict_get_str(qdict, "device");
-    const char *filename = qdict_get_try_str(qdict, "snapshot-file");
+    const char *filename = qdict_get_try_str(qdict, "snapshot_file");
    const char *format = qdict_get_try_str(qdict, "format");
    BlockDriverState *bs;
-    BlockDriver *drv, *old_drv, *proto_drv;
+    BlockDriver *drv, *proto_drv;
    int ret = 0;
    int flags;
-    char old_filename[1024];

    if (!filename) {
-        qerror_report(QERR_MISSING_PARAMETER, "snapshot-file");
+        qerror_report(QERR_MISSING_PARAMETER, "snapshot_file");
        ret = -1;
        goto out;
    }
@@ -574,11 +583,6 @@ int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, QObject **ret_data)
        goto out;
    }

-    pstrcpy(old_filename, sizeof(old_filename), bs->filename);
-
-    old_drv = bs->drv;
-    flags = bs->open_flags;
-
    if (!format) {
        format = "qcow2";
    }
@@ -598,7 +602,7 @@ int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, QObject **ret_data)
    }

    ret = bdrv_img_create(filename, format, bs->filename,
-                          bs->drv->format_name, NULL, -1, flags);
+                          bs->drv->format_name, NULL, -1, bs->open_flags);
    if (ret) {
        goto out;
    }
@@ -606,20 +610,15 @@ int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, QObject **ret_data)
    qemu_aio_flush();
    bdrv_flush(bs);

+    flags = bs->open_flags;
    bdrv_close(bs);
    ret = bdrv_open(bs, filename, flags, drv);
    /*
-     * If reopening the image file we just created fails, fall back
-     * and try to re-open the original image. If that fails too, we
-     * are in serious trouble.
+     * If reopening the image file we just created fails, we really
+     * are in trouble :(
     */
    if (ret != 0) {
-        ret = bdrv_open(bs, old_filename, flags, old_drv);
-        if (ret != 0) {
-            qerror_report(QERR_OPEN_FILE_FAILED, old_filename);
-        } else {
-            qerror_report(QERR_OPEN_FILE_FAILED, filename);
-        }
+        abort();
    }
 out:
    if (ret) {
@@ -631,13 +630,13 @@ out:

 static int eject_device(Monitor *mon, BlockDriverState *bs, int force)
 {
-    if (!bdrv_dev_has_removable_media(bs)) {
-        qerror_report(QERR_DEVICE_NOT_REMOVABLE, bdrv_get_device_name(bs));
-        return -1;
-    }
-    if (bdrv_dev_is_medium_locked(bs) && !bdrv_dev_is_tray_open(bs)) {
-        bdrv_dev_eject_request(bs, force);
-        if (!force) {
+    if (!force) {
+        if (!bdrv_is_removable(bs)) {
+            qerror_report(QERR_DEVICE_NOT_REMOVABLE,
+                           bdrv_get_device_name(bs));
+            return -1;
+        }
+        if (bdrv_is_locked(bs)) {
            qerror_report(QERR_DEVICE_LOCKED, bdrv_get_device_name(bs));
            return -1;
        }
@@ -719,6 +718,8 @@ int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data)
 {
    const char *id = qdict_get_str(qdict, "id");
    BlockDriverState *bs;
+    BlockDriverState **ptr;
+    Property *prop;

    bs = bdrv_find(id);
    if (!bs) {
@@ -735,17 +736,24 @@ int do_drive_del(Monitor *mon, const QDict *qdict, QObject **ret_data)
    bdrv_flush(bs);
    bdrv_close(bs);

-    /* if we have a device attached to this BlockDriverState
-     * then we need to make the drive anonymous until the device
-     * can be removed.  If this is a drive with no device backing
-     * then we can just get rid of the block driver state right here.
-     */
-    if (bdrv_get_attached_dev(bs)) {
-        bdrv_make_anon(bs);
-    } else {
-        drive_uninit(drive_get_by_blockdev(bs));
+    /* clean up guest state from pointing to host resource by
+     * finding and removing DeviceState "drive" property */
+    if (bs->peer) {
+        for (prop = bs->peer->info->props; prop && prop->name; prop++) {
+            if (prop->info->type == PROP_TYPE_DRIVE) {
+                ptr = qdev_get_prop_ptr(bs->peer, prop);
+                if (*ptr == bs) {
+                    bdrv_detach(bs, bs->peer);
+                    *ptr = NULL;
+                    break;
+                }
+            }
+        }
    }

+    /* clean up host side */
+    drive_uninit(drive_get_by_blockdev(bs));
+
    return 0;
 }

--- a/blockdev.h
+++ b/blockdev.h
@@ -33,7 +33,6 @@ struct DriveInfo {
    int bus;
    int unit;
    int auto_del;               /* see blockdev_mark_auto_del() */
-    int media_cd;
    QemuOpts *opts;
    char serial[BLOCK_SERIAL_STRLEN + 1];
    QTAILQ_ENTRY(DriveInfo) next;
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -29,7 +29,7 @@
 #include "qemu.h"
 #include "qemu-common.h"
 /* For tb_lock */
-#include "cpu.h"
+#include "exec-all.h"
 #include "tcg.h"
 #include "qemu-timer.h"
 #include "envlist.h"
@@ -237,7 +237,7 @@ void cpu_loop(CPUX86State *env)
            break;
 #ifndef TARGET_ABI32
        case EXCP_SYSCALL:
-            /* syscall from syscall instruction */
+            /* syscall from syscall intruction */
            if (bsd_type == target_freebsd)
                env->regs[R_EAX] = do_freebsd_syscall(env,
                                                      env->regs[R_EAX],
@@ -690,8 +690,7 @@ static void usage(void)
           "-bsd type         select emulated BSD type FreeBSD/NetBSD/OpenBSD (default)\n"
           "\n"
           "Debug options:\n"
-           "-d options   activate log (default logfile=%s)\n"
-           "-D logfile   override default logfile location\n"
+           "-d options   activate log (logfile=%s)\n"
           "-p pagesize  set the host page size to 'pagesize'\n"
           "-singlestep  always run in singlestep mode\n"
           "-strace      log system calls\n"
@@ -732,8 +731,6 @@ int main(int argc, char **argv)
 {
    const char *filename;
    const char *cpu_model;
-    const char *log_file = DEBUG_LOGFILE;
-    const char *log_mask = NULL;
    struct target_pt_regs regs1, *regs = &regs1;
    struct image_info info1, *info = &info1;
    TaskState ts1, *ts = &ts1;
@@ -748,6 +745,9 @@ int main(int argc, char **argv)
    if (argc <= 1)
        usage();

+    /* init debug */
+    cpu_set_log_filename(DEBUG_LOGFILE);
+
    if ((envlist = envlist_create()) == NULL) {
        (void) fprintf(stderr, "Unable to allocate envlist\n");
        exit(1);
@@ -775,15 +775,22 @@ int main(int argc, char **argv)
        if (!strcmp(r, "-")) {
            break;
        } else if (!strcmp(r, "d")) {
-            if (optind >= argc) {
+            int mask;
+            const CPULogItem *item;
+
+            if (optind >= argc)
                break;
+
+            r = argv[optind++];
+            mask = cpu_str_to_log_mask(r);
+            if (!mask) {
+                printf("Log items (comma separated):\n");
+                for(item = cpu_log_items; item->mask != 0; item++) {
+                    printf("%-10s %s\n", item->name, item->help);
+                }
+                exit(1);
            }
-            log_mask = argv[optind++];
-        } else if (!strcmp(r, "D")) {
-            if (optind >= argc) {
-                break;
-            }
-            log_file = argv[optind++];
+            cpu_set_log(mask);
        } else if (!strcmp(r, "E")) {
            r = argv[optind++];
            if (envlist_setenv(envlist, r) != 0)
@@ -856,27 +863,8 @@ int main(int argc, char **argv)
            usage();
        }
    }
-
-    /* init debug */
-    cpu_set_log_filename(log_file);
-    if (log_mask) {
-        int mask;
-        const CPULogItem *item;
-
-        mask = cpu_str_to_log_mask(log_mask);
-        if (!mask) {
-            printf("Log items (comma separated):\n");
-            for (item = cpu_log_items; item->mask != 0; item++) {
-                printf("%-10s %s\n", item->name, item->help);
-            }
-            exit(1);
-        }
-        cpu_set_log(mask);
-    }
-
-    if (optind >= argc) {
+    if (optind >= argc)
        usage();
-    }
    filename = argv[optind];

    /* Zero out regs */
@@ -905,8 +893,7 @@ int main(int argc, char **argv)
        cpu_model = "any";
 #endif
    }
-    tcg_exec_init(0);
-    cpu_exec_init_all();
+    cpu_exec_init_all(0);
    /* NOTE: we need to init the CPU at this stage to get
       qemu_host_page_size */
    env = cpu_init(cpu_model);
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -94,7 +94,7 @@ void *qemu_vmalloc(size_t size)
    return p;
 }

-void *g_malloc(size_t size)
+void *qemu_malloc(size_t size)
 {
    char * p;
    size += 16;
@@ -104,12 +104,12 @@ void *g_malloc(size_t size)
 }

 /* We use map, which is always zero initialized.  */
-void * g_malloc0(size_t size)
+void * qemu_mallocz(size_t size)
 {
-    return g_malloc(size);
+    return qemu_malloc(size);
 }

-void g_free(void *ptr)
+void qemu_free(void *ptr)
 {
    /* FIXME: We should unmark the reserved pages here.  However this gets
       complicated when one target page spans multiple host pages, so we
@@ -119,18 +119,18 @@ void g_free(void *ptr)
    munmap(p, *p);
 }

-void *g_realloc(void *ptr, size_t size)
+void *qemu_realloc(void *ptr, size_t size)
 {
    size_t old_size, copy;
    void *new_ptr;

    if (!ptr)
-        return g_malloc(size);
+        return qemu_malloc(size);
    old_size = *(size_t *)((char *)ptr - 16);
    copy = old_size < size ? old_size : size;
-    new_ptr = g_malloc(size);
+    new_ptr = qemu_malloc(size);
    memcpy(new_ptr, ptr, copy);
-    g_free(ptr);
+    qemu_free(ptr);
    return new_ptr;
 }

--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -323,7 +323,7 @@ abi_long copy_from_user(void *hptr, abi_ulong gaddr, size_t len);
 abi_long copy_to_user(abi_ulong gaddr, void *hptr, size_t len);

 /* Functions for accessing guest memory.  The tget and tput functions
-   read/write single values, byteswapping as necessary.  The lock_user
+   read/write single values, byteswapping as neccessary.  The lock_user
   gets a pointer to a contiguous area of guest memory, but does not perform
   and byteswapping.  lock_user may return either a pointer to the guest
   memory, or a temporary buffer.  */
--- a/bsd-user/syscall.c
+++ b/bsd-user/syscall.c
@@ -31,6 +31,7 @@
 #include <sys/syscall.h>
 #include <sys/param.h>
 #include <sys/sysctl.h>
+#include <signal.h>
 #include <utime.h>

 #include "qemu.h"
@@ -231,7 +232,7 @@ static abi_long do_freebsd_sysctl(abi_ulong namep, int32_t namelen, abi_ulong ol
    void *hnamep, *holdp, *hnewp = NULL;
    size_t holdlen;
    abi_ulong oldlen = 0;
-    int32_t *snamep = g_malloc(sizeof(int32_t) * namelen), *p, *q, i;
+    int32_t *snamep = qemu_malloc(sizeof(int32_t) * namelen), *p, *q, i;
    uint32_t kind = 0;

    if (oldlenp)
@@ -255,7 +256,7 @@ static abi_long do_freebsd_sysctl(abi_ulong namep, int32_t namelen, abi_ulong ol
    unlock_user(holdp, oldp, holdlen);
    if (hnewp)
        unlock_user(hnewp, newp, 0);
-    g_free(snamep);
+    qemu_free(snamep);
    return ret;
 }
 #endif
--- a/bswap.h
+++ b/bswap.h
@@ -4,7 +4,6 @@
 #include "config-host.h"

 #include <inttypes.h>
-#include "softfloat.h"

 #ifdef CONFIG_MACHINE_BSWAP_H
 #include <sys/endian.h>
@@ -238,476 +237,4 @@ static inline uint32_t qemu_bswap_len(uint32_t value, int len)
    return bswap32(value) >> (32 - 8 * len);
 }

-typedef union {
-    float32 f;
-    uint32_t l;
-} CPU_FloatU;
-
-typedef union {
-    float64 d;
-#if defined(HOST_WORDS_BIGENDIAN)
-    struct {
-        uint32_t upper;
-        uint32_t lower;
-    } l;
-#else
-    struct {
-        uint32_t lower;
-        uint32_t upper;
-    } l;
-#endif
-    uint64_t ll;
-} CPU_DoubleU;
-
-typedef union {
-     floatx80 d;
-     struct {
-         uint64_t lower;
-         uint16_t upper;
-     } l;
-} CPU_LDoubleU;
-
-typedef union {
-    float128 q;
-#if defined(HOST_WORDS_BIGENDIAN)
-    struct {
-        uint32_t upmost;
-        uint32_t upper;
-        uint32_t lower;
-        uint32_t lowest;
-    } l;
-    struct {
-        uint64_t upper;
-        uint64_t lower;
-    } ll;
-#else
-    struct {
-        uint32_t lowest;
-        uint32_t lower;
-        uint32_t upper;
-        uint32_t upmost;
-    } l;
-    struct {
-        uint64_t lower;
-        uint64_t upper;
-    } ll;
-#endif
-} CPU_QuadU;
-
-/* unaligned/endian-independent pointer access */
-
-/*
- * the generic syntax is:
- *
- * load: ld{type}{sign}{size}{endian}_p(ptr)
- *
- * store: st{type}{size}{endian}_p(ptr, val)
- *
- * Note there are small differences with the softmmu access API!
- *
- * type is:
- * (empty): integer access
- *   f    : float access
- *
- * sign is:
- * (empty): for floats or 32 bit size
- *   u    : unsigned
- *   s    : signed
- *
- * size is:
- *   b: 8 bits
- *   w: 16 bits
- *   l: 32 bits
- *   q: 64 bits
- *
- * endian is:
- * (empty): 8 bit access
- *   be   : big endian
- *   le   : little endian
- */
-static inline int ldub_p(const void *ptr)
-{
-    return *(uint8_t *)ptr;
-}
-
-static inline int ldsb_p(const void *ptr)
-{
-    return *(int8_t *)ptr;
-}
-
-static inline void stb_p(void *ptr, int v)
-{
-    *(uint8_t *)ptr = v;
-}
-
-/* NOTE: on arm, putting 2 in /proc/sys/debug/alignment so that the
-   kernel handles unaligned load/stores may give better results, but
-   it is a system wide setting : bad */
-#if defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
-
-/* conservative code for little endian unaligned accesses */
-static inline int lduw_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return val;
-#else
-    const uint8_t *p = ptr;
-    return p[0] | (p[1] << 8);
-#endif
-}
-
-static inline int ldsw_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return (int16_t)val;
-#else
-    const uint8_t *p = ptr;
-    return (int16_t)(p[0] | (p[1] << 8));
-#endif
-}
-
-static inline int ldl_le_p(const void *ptr)
-{
-#ifdef _ARCH_PPC
-    int val;
-    __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (ptr));
-    return val;
-#else
-    const uint8_t *p = ptr;
-    return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
-#endif
-}
-
-static inline uint64_t ldq_le_p(const void *ptr)
-{
-    const uint8_t *p = ptr;
-    uint32_t v1, v2;
-    v1 = ldl_le_p(p);
-    v2 = ldl_le_p(p + 4);
-    return v1 | ((uint64_t)v2 << 32);
-}
-
-static inline void stw_le_p(void *ptr, int v)
-{
-#ifdef _ARCH_PPC
-    __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*(uint16_t *)ptr) : "r" (v), "r" (ptr));
-#else
-    uint8_t *p = ptr;
-    p[0] = v;
-    p[1] = v >> 8;
-#endif
-}
-
-static inline void stl_le_p(void *ptr, int v)
-{
-#ifdef _ARCH_PPC
-    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
-#else
-    uint8_t *p = ptr;
-    p[0] = v;
-    p[1] = v >> 8;
-    p[2] = v >> 16;
-    p[3] = v >> 24;
-#endif
-}
-
-static inline void stq_le_p(void *ptr, uint64_t v)
-{
-    uint8_t *p = ptr;
-    stl_le_p(p, (uint32_t)v);
-    stl_le_p(p + 4, v >> 32);
-}
-
-/* float access */
-
-static inline float32 ldfl_le_p(const void *ptr)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.i = ldl_le_p(ptr);
-    return u.f;
-}
-
-static inline void stfl_le_p(void *ptr, float32 v)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.f = v;
-    stl_le_p(ptr, u.i);
-}
-
-static inline float64 ldfq_le_p(const void *ptr)
-{
-    CPU_DoubleU u;
-    u.l.lower = ldl_le_p(ptr);
-    u.l.upper = ldl_le_p(ptr + 4);
-    return u.d;
-}
-
-static inline void stfq_le_p(void *ptr, float64 v)
-{
-    CPU_DoubleU u;
-    u.d = v;
-    stl_le_p(ptr, u.l.lower);
-    stl_le_p(ptr + 4, u.l.upper);
-}
-
-#else
-
-static inline int lduw_le_p(const void *ptr)
-{
-    return *(uint16_t *)ptr;
-}
-
-static inline int ldsw_le_p(const void *ptr)
-{
-    return *(int16_t *)ptr;
-}
-
-static inline int ldl_le_p(const void *ptr)
-{
-    return *(uint32_t *)ptr;
-}
-
-static inline uint64_t ldq_le_p(const void *ptr)
-{
-    return *(uint64_t *)ptr;
-}
-
-static inline void stw_le_p(void *ptr, int v)
-{
-    *(uint16_t *)ptr = v;
-}
-
-static inline void stl_le_p(void *ptr, int v)
-{
-    *(uint32_t *)ptr = v;
-}
-
-static inline void stq_le_p(void *ptr, uint64_t v)
-{
-    *(uint64_t *)ptr = v;
-}
-
-/* float access */
-
-static inline float32 ldfl_le_p(const void *ptr)
-{
-    return *(float32 *)ptr;
-}
-
-static inline float64 ldfq_le_p(const void *ptr)
-{
-    return *(float64 *)ptr;
-}
-
-static inline void stfl_le_p(void *ptr, float32 v)
-{
-    *(float32 *)ptr = v;
-}
-
-static inline void stfq_le_p(void *ptr, float64 v)
-{
-    *(float64 *)ptr = v;
-}
-#endif
-
-#if !defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
-
-static inline int lduw_be_p(const void *ptr)
-{
-#if defined(__i386__)
-    int val;
-    asm volatile ("movzwl %1, %0\n"
-                  "xchgb %b0, %h0\n"
-                  : "=q" (val)
-                  : "m" (*(uint16_t *)ptr));
-    return val;
-#else
-    const uint8_t *b = ptr;
-    return ((b[0] << 8) | b[1]);
-#endif
-}
-
-static inline int ldsw_be_p(const void *ptr)
-{
-#if defined(__i386__)
-    int val;
-    asm volatile ("movzwl %1, %0\n"
-                  "xchgb %b0, %h0\n"
-                  : "=q" (val)
-                  : "m" (*(uint16_t *)ptr));
-    return (int16_t)val;
-#else
-    const uint8_t *b = ptr;
-    return (int16_t)((b[0] << 8) | b[1]);
-#endif
-}
-
-static inline int ldl_be_p(const void *ptr)
-{
-#if defined(__i386__) || defined(__x86_64__)
-    int val;
-    asm volatile ("movl %1, %0\n"
-                  "bswap %0\n"
-                  : "=r" (val)
-                  : "m" (*(uint32_t *)ptr));
-    return val;
-#else
-    const uint8_t *b = ptr;
-    return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
-#endif
-}
-
-static inline uint64_t ldq_be_p(const void *ptr)
-{
-    uint32_t a,b;
-    a = ldl_be_p(ptr);
-    b = ldl_be_p((uint8_t *)ptr + 4);
-    return (((uint64_t)a<<32)|b);
-}
-
-static inline void stw_be_p(void *ptr, int v)
-{
-#if defined(__i386__)
-    asm volatile ("xchgb %b0, %h0\n"
-                  "movw %w0, %1\n"
-                  : "=q" (v)
-                  : "m" (*(uint16_t *)ptr), "0" (v));
-#else
-    uint8_t *d = (uint8_t *) ptr;
-    d[0] = v >> 8;
-    d[1] = v;
-#endif
-}
-
-static inline void stl_be_p(void *ptr, int v)
-{
-#if defined(__i386__) || defined(__x86_64__)
-    asm volatile ("bswap %0\n"
-                  "movl %0, %1\n"
-                  : "=r" (v)
-                  : "m" (*(uint32_t *)ptr), "0" (v));
-#else
-    uint8_t *d = (uint8_t *) ptr;
-    d[0] = v >> 24;
-    d[1] = v >> 16;
-    d[2] = v >> 8;
-    d[3] = v;
-#endif
-}
-
-static inline void stq_be_p(void *ptr, uint64_t v)
-{
-    stl_be_p(ptr, v >> 32);
-    stl_be_p((uint8_t *)ptr + 4, v);
-}
-
-/* float access */
-
-static inline float32 ldfl_be_p(const void *ptr)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.i = ldl_be_p(ptr);
-    return u.f;
-}
-
-static inline void stfl_be_p(void *ptr, float32 v)
-{
-    union {
-        float32 f;
-        uint32_t i;
-    } u;
-    u.f = v;
-    stl_be_p(ptr, u.i);
-}
-
-static inline float64 ldfq_be_p(const void *ptr)
-{
-    CPU_DoubleU u;
-    u.l.upper = ldl_be_p(ptr);
-    u.l.lower = ldl_be_p((uint8_t *)ptr + 4);
-    return u.d;
-}
-
-static inline void stfq_be_p(void *ptr, float64 v)
-{
-    CPU_DoubleU u;
-    u.d = v;
-    stl_be_p(ptr, u.l.upper);
-    stl_be_p((uint8_t *)ptr + 4, u.l.lower);
-}
-
-#else
-
-static inline int lduw_be_p(const void *ptr)
-{
-    return *(uint16_t *)ptr;
-}
-
-static inline int ldsw_be_p(const void *ptr)
-{
-    return *(int16_t *)ptr;
-}
-
-static inline int ldl_be_p(const void *ptr)
-{
-    return *(uint32_t *)ptr;
-}
-
-static inline uint64_t ldq_be_p(const void *ptr)
-{
-    return *(uint64_t *)ptr;
-}
-
-static inline void stw_be_p(void *ptr, int v)
-{
-    *(uint16_t *)ptr = v;
-}
-
-static inline void stl_be_p(void *ptr, int v)
-{
-    *(uint32_t *)ptr = v;
-}
-
-static inline void stq_be_p(void *ptr, uint64_t v)
-{
-    *(uint64_t *)ptr = v;
-}
-
-/* float access */
-
-static inline float32 ldfl_be_p(const void *ptr)
-{
-    return *(float32 *)ptr;
-}
-
-static inline float64 ldfq_be_p(const void *ptr)
-{
-    return *(float64 *)ptr;
-}
-
-static inline void stfl_be_p(void *ptr, float32 v)
-{
-    *(float32 *)ptr = v;
-}
-
-static inline void stfq_be_p(void *ptr, float64 v)
-{
-    *(float64 *)ptr = v;
-}
-
-#endif
-
 #endif /* BSWAP_H */
--- a/bt-host.c
+++ b/bt-host.c
@@ -19,6 +19,7 @@

 #include "qemu-common.h"
 #include "qemu-char.h"
+#include "sysemu.h"
 #include "net.h"
 #include "bt-host.h"

@@ -177,7 +178,7 @@ struct HCIInfo *bt_host_hci(const char *id)
    }
 # endif

-    s = g_malloc0(sizeof(struct bt_host_hci_s));
+    s = qemu_mallocz(sizeof(struct bt_host_hci_s));
    s->fd = fd;
    s->hci.cmd_send = bt_host_cmd;
    s->hci.sco_send = bt_host_sco;
--- a/bt-vhci.c
+++ b/bt-vhci.c
@@ -19,6 +19,7 @@

 #include "qemu-common.h"
 #include "qemu-char.h"
+#include "sysemu.h"
 #include "net.h"
 #include "hw/bt.h"

@@ -156,7 +157,7 @@ void bt_vhci_init(struct HCIInfo *info)
        exit(-1);
    }

-    s = g_malloc0(sizeof(struct bt_vhci_s));
+    s = qemu_mallocz(sizeof(struct bt_vhci_s));
    s->fd = fd;
    s->info = info ?: qemu_next_hci();
    s->info->opaque = s;
--- a/buffered_file.c
+++ b/buffered_file.c
@@ -14,6 +14,7 @@
 #include "qemu-common.h"
 #include "hw/hw.h"
 #include "qemu-timer.h"
+#include "sysemu.h"
 #include "qemu-char.h"
 #include "buffered_file.h"

@@ -27,6 +28,7 @@ typedef struct QEMUFileBuffered
    BufferedCloseFunc *close;
    void *opaque;
    QEMUFile *file;
+    int has_error;
    int freeze_output;
    size_t bytes_xfer;
    size_t xfer_limit;
@@ -55,7 +57,7 @@ static void buffered_append(QEMUFileBuffered *s,

        s->buffer_capacity += size + 1024;

-        tmp = g_realloc(s->buffer, s->buffer_capacity);
+        tmp = qemu_realloc(s->buffer, s->buffer_capacity);
        if (tmp == NULL) {
            fprintf(stderr, "qemu file buffer expansion failed\n");
            exit(1);
@@ -71,11 +73,9 @@ static void buffered_append(QEMUFileBuffered *s,
 static void buffered_flush(QEMUFileBuffered *s)
 {
    size_t offset = 0;
-    int error;

-    error = qemu_file_get_error(s->file);
-    if (error != 0) {
-        DPRINTF("flush when error, bailing: %s\n", strerror(-error));
+    if (s->has_error) {
+        DPRINTF("flush when error, bailing\n");
        return;
    }

@@ -94,7 +94,7 @@ static void buffered_flush(QEMUFileBuffered *s)

        if (ret <= 0) {
            DPRINTF("error flushing data, %zd\n", ret);
-            qemu_file_set_error(s->file, ret);
+            s->has_error = 1;
            break;
        } else {
            DPRINTF("flushed %zd byte(s)\n", ret);
@@ -110,15 +110,14 @@ static void buffered_flush(QEMUFileBuffered *s)
 static int buffered_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int size)
 {
    QEMUFileBuffered *s = opaque;
-    int offset = 0, error;
+    int offset = 0;
    ssize_t ret;

    DPRINTF("putting %d bytes at %" PRId64 "\n", size, pos);

-    error = qemu_file_get_error(s->file);
-    if (error) {
-        DPRINTF("flush when error, bailing: %s\n", strerror(-error));
-        return error;
+    if (s->has_error) {
+        DPRINTF("flush when error, bailing\n");
+        return -EINVAL;
    }

    DPRINTF("unfreezing output\n");
@@ -141,7 +140,7 @@ static int buffered_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, in

        if (ret <= 0) {
            DPRINTF("error putting\n");
-            qemu_file_set_error(s->file, ret);
+            s->has_error = 1;
            offset = -EINVAL;
            break;
        }
@@ -175,37 +174,29 @@ static int buffered_close(void *opaque)

    DPRINTF("closing\n");

-    while (!qemu_file_get_error(s->file) && s->buffer_size) {
+    while (!s->has_error && s->buffer_size) {
        buffered_flush(s);
        if (s->freeze_output)
-            s->wait_for_unfreeze(s->opaque);
+            s->wait_for_unfreeze(s);
    }

    ret = s->close(s->opaque);

    qemu_del_timer(s->timer);
    qemu_free_timer(s->timer);
-    g_free(s->buffer);
-    g_free(s);
+    qemu_free(s->buffer);
+    qemu_free(s);

    return ret;
 }

-/*
- * The meaning of the return values is:
- *   0: We can continue sending
- *   1: Time to stop
- *   negative: There has been an error
- */
 static int buffered_rate_limit(void *opaque)
 {
    QEMUFileBuffered *s = opaque;
-    int ret;

-    ret = qemu_file_get_error(s->file);
-    if (ret) {
-        return ret;
-    }
+    if (s->has_error)
+        return 0;
+
    if (s->freeze_output)
        return 1;

@@ -218,9 +209,9 @@ static int buffered_rate_limit(void *opaque)
 static int64_t buffered_set_rate_limit(void *opaque, int64_t new_rate)
 {
    QEMUFileBuffered *s = opaque;
-    if (qemu_file_get_error(s->file)) {
+    if (s->has_error)
        goto out;
-    }
+
    if (new_rate > SIZE_MAX) {
        new_rate = SIZE_MAX;
    }
@@ -242,12 +233,12 @@ static void buffered_rate_tick(void *opaque)
 {
    QEMUFileBuffered *s = opaque;

-    if (qemu_file_get_error(s->file)) {
+    if (s->has_error) {
        buffered_close(s);
        return;
    }

-    qemu_mod_timer(s->timer, qemu_get_clock_ms(rt_clock) + 100);
+    qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 100);

    if (s->freeze_output)
        return;
@@ -269,7 +260,7 @@ QEMUFile *qemu_fopen_ops_buffered(void *opaque,
 {
    QEMUFileBuffered *s;

-    s = g_malloc0(sizeof(*s));
+    s = qemu_mallocz(sizeof(*s));

    s->opaque = opaque;
    s->xfer_limit = bytes_per_sec / 10;
@@ -283,9 +274,9 @@ QEMUFile *qemu_fopen_ops_buffered(void *opaque,
                             buffered_set_rate_limit,
 			     buffered_get_rate_limit);

-    s->timer = qemu_new_timer_ms(rt_clock, buffered_rate_tick, s);
+    s->timer = qemu_new_timer(rt_clock, buffered_rate_tick, s);

-    qemu_mod_timer(s->timer, qemu_get_clock_ms(rt_clock) + 100);
+    qemu_mod_timer(s->timer, qemu_get_clock(rt_clock) + 100);

    return s->file;
 }
--- a/check-qdict.c
+++ b/check-qdict.c
@@ -56,9 +56,9 @@ START_TEST(qdict_put_obj_test)

    // destroy doesn't exit yet
    QDECREF(qi);
-    g_free(ent->key);
-    g_free(ent);
-    g_free(qdict);
+    qemu_free(ent->key);
+    qemu_free(ent);
+    qemu_free(qdict);
 }
 END_TEST

@@ -267,9 +267,8 @@ static QString *read_line(FILE *file, char *key)
 {
    char value[128];

-    if (fscanf(file, "%127s%127s", key, value) == EOF) {
+    if (fscanf(file, "%s%s", key, value) == EOF)
        return NULL;
-    }
    remove_dots(key);
    return qstring_from_str(value);
 }
--- a/check-qfloat.c
+++ b/check-qfloat.c
@@ -33,7 +33,7 @@ START_TEST(qfloat_from_double_test)
    fail_unless(qobject_type(QOBJECT(qf)) == QTYPE_QFLOAT);

    // destroy doesn't exit yet
-    g_free(qf);
+    qemu_free(qf);
 }
 END_TEST

--- a/check-qint.c
+++ b/check-qint.c
@@ -32,7 +32,7 @@ START_TEST(qint_from_int_test)
    fail_unless(qobject_type(QOBJECT(qi)) == QTYPE_QINT);

    // destroy doesn't exit yet
-    g_free(qi);
+    qemu_free(qi);
 }
 END_TEST

--- a/check-qjson.c
+++ b/check-qjson.c
@@ -33,8 +33,7 @@ START_TEST(escaped_string)
        { "\"\\n\"", "\n" },
        { "\"\\r\"", "\r" },
        { "\"\\t\"", "\t" },
-        { "\"/\"", "/" },
-        { "\"\\/\"", "/", .skip = 1 },
+        { "\"\\/\"", "\\/" },
        { "\"\\\\\"", "\\" },
        { "\"\\\"\"", "\"" },
        { "\"hello world \\\"embedded string\\\"\"",
--- a/check-qlist.c
+++ b/check-qlist.c
@@ -30,7 +30,7 @@ START_TEST(qlist_new_test)
    fail_unless(qobject_type(QOBJECT(qlist)) == QTYPE_QLIST);

    // destroy doesn't exist yet
-    g_free(qlist);
+    qemu_free(qlist);
 }
 END_TEST

@@ -51,8 +51,8 @@ START_TEST(qlist_append_test)

    // destroy doesn't exist yet
    QDECREF(qi);
-    g_free(entry);
-    g_free(qlist);
+    qemu_free(entry);
+    qemu_free(qlist);
 }
 END_TEST

@@ -65,7 +65,7 @@ START_TEST(qobject_to_qlist_test)
    fail_unless(qobject_to_qlist(QOBJECT(qlist)) == qlist);

    // destroy doesn't exist yet
-    g_free(qlist);
+    qemu_free(qlist);
 }
 END_TEST

--- a/check-qstring.c
+++ b/check-qstring.c
@@ -32,8 +32,8 @@ START_TEST(qstring_from_str_test)
    fail_unless(qobject_type(QOBJECT(qstring)) == QTYPE_QSTRING);

    // destroy doesn't exit yet
-    g_free(qstring->string);
-    g_free(qstring);
+    qemu_free(qstring->string);
+    qemu_free(qstring);
 }
 END_TEST

--- a/cmd.c
+++ b/cmd.c
@@ -45,11 +45,13 @@ compare(const void *a, const void *b)
 		      ((const cmdinfo_t *)b)->name);
 }

-void add_command(const cmdinfo_t *ci)
+void
+add_command(
+	const cmdinfo_t	*ci)
 {
-    cmdtab = g_realloc((void *)cmdtab, ++ncmds * sizeof(*cmdtab));
-    cmdtab[ncmds - 1] = *ci;
-    qsort(cmdtab, ncmds, sizeof(*cmdtab), compare);
+	cmdtab = realloc((void *)cmdtab, ++ncmds * sizeof(*cmdtab));
+	cmdtab[ncmds - 1] = *ci;
+	qsort(cmdtab, ncmds, sizeof(*cmdtab), compare);
 }

 static int
@@ -120,10 +122,16 @@ find_command(
 	return NULL;
 }

-void add_user_command(char *optarg)
+void
+add_user_command(char *optarg)
 {
-    cmdline = g_realloc(cmdline, ++ncmdline * sizeof(char *));
-    cmdline[ncmdline-1] = optarg;
+	ncmdline++;
+	cmdline = realloc(cmdline, sizeof(char*) * (ncmdline));
+	if (!cmdline) {
+		perror("realloc");
+		exit(1);
+	}
+	cmdline[ncmdline-1] = optarg;
 }

 static int
@@ -152,44 +160,45 @@ static void prep_fetchline(void *opaque)

 static char *get_prompt(void);

-void command_loop(void)
+void
+command_loop(void)
 {
-    int c, i, j = 0, done = 0, fetchable = 0, prompted = 0;
-    char *input;
-    char **v;
-    const cmdinfo_t *ct;
+	int		c, i, j = 0, done = 0, fetchable = 0, prompted = 0;
+	char		*input;
+	char		**v;
+	const cmdinfo_t	*ct;

-    for (i = 0; !done && i < ncmdline; i++) {
-        input = strdup(cmdline[i]);
-        if (!input) {
-            fprintf(stderr, _("cannot strdup command '%s': %s\n"),
-                    cmdline[i], strerror(errno));
-            exit(1);
-        }
-        v = breakline(input, &c);
-        if (c) {
-            ct = find_command(v[0]);
-            if (ct) {
-                if (ct->flags & CMD_FLAG_GLOBAL) {
-                    done = command(ct, c, v);
-                } else {
-                    j = 0;
-                    while (!done && (j = args_command(j))) {
-                        done = command(ct, c, v);
-                    }
-                }
-            } else {
-                fprintf(stderr, _("command \"%s\" not found\n"), v[0]);
-            }
+	for (i = 0; !done && i < ncmdline; i++) {
+		input = strdup(cmdline[i]);
+		if (!input) {
+			fprintf(stderr,
+				_("cannot strdup command '%s': %s\n"),
+				cmdline[i], strerror(errno));
+			exit(1);
+		}
+		v = breakline(input, &c);
+		if (c) {
+			ct = find_command(v[0]);
+			if (ct) {
+				if (ct->flags & CMD_FLAG_GLOBAL)
+					done = command(ct, c, v);
+				else {
+					j = 0;
+					while (!done && (j = args_command(j)))
+						done = command(ct, c, v);
+				}
+			} else
+				fprintf(stderr, _("command \"%s\" not found\n"),
+					v[0]);
+		}
+		doneline(input, v);
+	}
+	if (cmdline) {
+		free(cmdline);
+		return;
 	}
-        doneline(input, v);
-    }
-    if (cmdline) {
-        g_free(cmdline);
-        return;
-    }

-    while (!done) {
+	while (!done) {
        if (!prompted) {
            printf("%s", get_prompt());
            fflush(stdout);
@@ -203,24 +212,22 @@ void command_loop(void)
        if (!fetchable) {
            continue;
        }
-        input = fetchline();
-        if (input == NULL) {
-            break;
-        }
-        v = breakline(input, &c);
-        if (c) {
-            ct = find_command(v[0]);
-            if (ct) {
-                done = command(ct, c, v);
-            } else {
-                fprintf(stderr, _("command \"%s\" not found\n"), v[0]);
-            }
-        }
-        doneline(input, v);
+		if ((input = fetchline()) == NULL)
+			break;
+		v = breakline(input, &c);
+		if (c) {
+			ct = find_command(v[0]);
+			if (ct)
+				done = command(ct, c, v);
+			else
+				fprintf(stderr, _("command \"%s\" not found\n"),
+					v[0]);
+		}
+		doneline(input, v);

        prompted = 0;
        fetchable = 0;
-    }
+	}
    qemu_aio_set_fd_handler(STDIN_FILENO, NULL, NULL, NULL, NULL, NULL);
 }

@@ -324,32 +331,29 @@ static char *qemu_strsep(char **input, const char *delim)
    return result;
 }

-char **breakline(char *input, int *count)
+char **
+breakline(
+	char	*input,
+	int	*count)
 {
-    int c = 0;
-    char *p;
-    char **rval = calloc(sizeof(char *), 1);
-    char **tmp;
+	int	c = 0;
+	char	*p;
+	char	**rval = calloc(sizeof(char *), 1);

-    while (rval && (p = qemu_strsep(&input, " ")) != NULL) {
-        if (!*p) {
-            continue;
-        }
-        c++;
-        tmp = realloc(rval, sizeof(*rval) * (c + 1));
-        if (!tmp) {
-            free(rval);
-            rval = NULL;
-            c = 0;
-            break;
-        } else {
-            rval = tmp;
-        }
-        rval[c - 1] = p;
-        rval[c] = NULL;
-    }
-    *count = c;
-    return rval;
+	while (rval && (p = qemu_strsep(&input, " ")) != NULL) {
+		if (!*p)
+			continue;
+		c++;
+		rval = realloc(rval, sizeof(*rval) * (c + 1));
+		if (!rval) {
+			c = 0;
+			break;
+		}
+		rval[c - 1] = p;
+		rval[c] = NULL;
+	}
+	*count = c;
+	return rval;
 }

 void
@@ -385,7 +389,7 @@ cvtnum(
 	if (sp[1] != '\0')
 		return -1LL;

-	c = qemu_tolower(*sp);
+	c = tolower(*sp);
 	switch (c) {
 	default:
 		return i;
@@ -482,7 +486,7 @@ timestr(
 			snprintf(ts, size, "%u:%02u.%02u",
 				(unsigned int) MINUTES(tv->tv_sec),
 				(unsigned int) SECONDS(tv->tv_sec),
-				(unsigned int) (usec * 100));
+				(unsigned int) usec * 100);
 			return;
 		}
 		format |= VERBOSE_FIXED_TIME;	/* fallback if hours needed */
@@ -493,9 +497,9 @@ timestr(
 			(unsigned int) HOURS(tv->tv_sec),
 			(unsigned int) MINUTES(tv->tv_sec),
 			(unsigned int) SECONDS(tv->tv_sec),
-			(unsigned int) (usec * 100));
+			(unsigned int) usec * 100);
 	} else {
-		snprintf(ts, size, "0.%04u sec", (unsigned int) (usec * 10000));
+		snprintf(ts, size, "0.%04u sec", (unsigned int) usec * 10000);
 	}
 }

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Anthony Liguori	a3dfab563e	Update version for 0.14.0-rc1 Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-02-07 13:36:28 -06:00
Marcelo Tosatti	c1f1ffff21	block: enable in_use flag Set block device in use during block migration, disallow drive_del and bdrv_truncate for in use devices. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `8591675f44`)	2011-02-07 12:55:32 +01:00
Marcelo Tosatti	44d631a001	Add flag to indicate external users to block device Certain operations such as drive_del or resize cannot be performed while external users (eg. block migration) reference the block device. Add a flag to indicate that. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `db593f2565`)	2011-02-07 12:55:29 +01:00
Marcelo Tosatti	28b0e1cd0e	block-migration: add reference to target DriveInfo So that ejection of attached device by guest does not free data in use by block migration instance. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `f48905d44f`)	2011-02-07 12:55:27 +01:00
Marcelo Tosatti	ddebe9d473	blockdev: add refcount to DriveInfo The host part of a block device can be deleted with in progress block migration. To fix this, add a reference count to DriveInfo, freeing resources on last reference. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> CC: Markus Armbruster <armbru@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `84fb392526`)	2011-02-07 12:55:26 +01:00
Marcelo Tosatti	f17f8b687c	block-migration: actually disable dirty tracking on cleanup Call to set_dirty_tracking() is misplaced. Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `8f794c557c`)	2011-02-07 12:55:25 +01:00
Alexander Graf	d27dd7e1a2	ahci: make number of ports runtime determined Different AHCI controllers have a different number of ports, so the core shouldn't care about the amount of ports available. This patch makes the number of ports available to the AHCI core runtime configurable, allowing us to have multiple different AHCI implementations with different amounts of ports. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `2c4b9d0ea4`)	2011-02-07 12:55:25 +01:00
Alexander Graf	c3a965c943	ahci: Implement HBA reset The ahci code was missing its soft reset functionality. This wasn't really an issue for Linux guests, but Windows gets confused when the controller doesn't reset when it tells it so. Using this patch I can now successfully boot Windows 7 from AHCI using AHCI enabled SeaBIOS. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `760c3e44d3`)	2011-02-07 12:55:24 +01:00
Alexander Graf	abc9997416	ahci: send init d2h fis on fis enable The drive sends a d2h init fis on initialization. Usually, the guest doesn't receive fises yet at that point though, so the delivery is deferred. Let's reflect that by sending the init fis on fis receive enablement. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `87e62065bb`)	2011-02-07 12:55:23 +01:00
Alexander Graf	ed97a4f2cf	ahci: split ICH and AHCI even more Sebastian's patch already did a pretty good job at splitting up ICH-9 AHCI code and the AHCI core. We need some more though. Copyright was missing, the lspci dump belongs to ICH-9, we don't need the AHCI core to have its own qdev device duplicate. So let's split them a bit more in this patch, making things easier to read an understand. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `7fb6577b13`)	2011-02-07 12:55:22 +01:00
Alexander Graf	8f7dfd6bda	ahci: add license header in ahci.h Due to popular request, this patch adds a license header to ahci.h Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `f83a40dcd7`)	2011-02-07 12:55:21 +01:00
Sebastian Herbszt	e81c113d28	ahci: split ICH9 from core There are multiple ahci devices out there. The currently implemented ich-9 is only one of the many. So let's split that one out into a separate file to stress the difference. Signed-off-by: Sebastian Herbszt <herbszt@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `03c7a6a8e7`)	2011-02-07 12:55:19 +01:00
Stefan Weil	d4e6590ab8	block/vdi: Fix wrong size in conditionally used memset, memcmp Error report from cppcheck: block/vdi.c:122: error: Using sizeof for array given as function argument returns the size of pointer. block/vdi.c:128: error: Using sizeof for array given as function argument returns the size of pointer. Fix both by setting the correct size. The buggy code is only used when QEMU is build without uuid support. The bug is not critical, so there is no urgent need to apply it to old versions of QEMU. Cc: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `4f3669ea5b`)	2011-02-07 12:55:18 +01:00
MORITA Kazutaka	f188c02db7	Documentation: add Sheepdog disk images Signed-off-by: MORITA Kazutaka <morita.kazutaka@lab.ntt.co.jp> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `42af9c30ea`)	2011-02-07 12:55:17 +01:00
Kevin Wolf	7edb1c3a51	qcow2: Really use cache=unsafe for image creation For cache=unsafe we also need to set BDRV_O_CACHE_WB, otherwise we have some strange unsafe writethrough mode. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> (cherry picked from commit `e1a7107f2d`)	2011-02-07 12:55:16 +01:00
Gleb Natapov	fd08f20c23	do not pass NULL to strdup. Also use qemu_strdup() instead of strdup() in bootindex code. Signed-off-by: Gleb Natapov <gleb@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `4fef930af8`)	2011-02-04 21:23:05 +01:00
Christophe Lyon	8798240196	Set the right overflow bit for neon 32 and 64 bit saturating add/sub. Signed-off-by: Christophe Lyon <christophe.lyon@st.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `72902672dc`)	2011-02-04 20:59:57 +01:00
Christophe Lyon	ffbda4e682	target-arm: Fix Neon vsra instructions. This patch fixes the errors reported by my tests in VSRA. Signed-off-by: Christophe Lyon <christophe.lyon@st.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `5371cb8140`)	2011-02-04 20:50:21 +01:00
Aurelien Jarno	81cd8f6047	target-sh4: fix negc Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `7026259f79`)	2011-02-04 20:50:16 +01:00
Jan Kiszka	1299aa0d03	ioapic: Style & magics cleanup Fix a few style issues and convert magic numbers into prober symbolic constants, also fixing the wrong but unused IOAPIC_DM_SIPI value. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `1f5e71a8e6`)	2011-02-04 06:53:52 -06:00
Jan Kiszka	8faaf42a4c	ioapic: Add support for qemu-kvm's vmstate v2 qemu-kvm carries the IOAPIC base address in its v2 vmstate. We only support the default base address so far, and saving even that in the device state was rejected. Add a padding field to be able to read qemu-kvm's old state, but increase our version to 3, indicating that we are not saving a valid address. This also gives downstream the chance to change to stop evaluating the base_address and move to v3 as well. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `5dce499948`)	2011-02-04 06:53:52 -06:00
Jan Kiszka	f05929b182	ioapic: Save/restore irr This is a guest modifiable state that must be saved/restored properly. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `35a74c5c59`)	2011-02-04 06:53:52 -06:00
Jan Kiszka	bc3aaac57b	ioapic: Implement EOI handling for level-triggered IRQs Add the missing EOI broadcast from local APIC to the IOAPICs on completion of level-triggered IRQs. This ensures that a still asserted IRQ source properly re-triggers an APIC IRQ. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `0280b571c1`)	2011-02-04 06:53:52 -06:00
Corentin Chary	602c075070	vnc: qemu can die if the client is disconnected while updating screen agraf reported that qemu_mutex_destroy(vs->output_mutex) while failing in vnc_disconnect_finish(). It's because vnc_worker_thread_loop() tries to unlock the mutex while not locked. The unlocking call doesn't fail (pthread bug ?), but the destroy call does. Signed-off-by: Corentin Chary <corentincj@iksaif.net> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `73eb4c04e9`)	2011-02-04 06:53:52 -06:00
Amit Shah	cb5281b199	virtio-serial: Make sure virtqueue is ready before discarding data This can happen if a port gets unplugged before guest has chance to initialise vqs. Reported-by: Juan Quintela <quintela@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `7185f9315b`)	2011-02-04 06:53:52 -06:00
Stefan Weil	9a121a2fbf	ui/sdl: Fix handling of caps lock and num lock keys Starting with SDL version 1.2.14, caps lock and num lock keys will send a SDL_KEYUP when SDL_DISABLE_LOCK_KEYS=1 is set in the environment. The new code sets the environment unconditionally (it won't harm old versions which do not know it). The workaround for SDL_KEYUP is only compiled with old SDL versions. A similar patch without handling of old SDL versions was already published by Benjamin Drung for Ubuntu. Cc: Anthony Liguori <aliguori@us.ibm.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Benjamin Drung <benjamin.drung@gmail.com> Signed-off-by: Stefan Weil <weil@mail.berlios.de> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `4e79bcbb96`)	2011-02-04 06:53:52 -06:00
Paolo Bonzini	366c2452b1	Unify alarm deadline computation This patch shows how using the correct formula for qemu_next_deadline_dyntick can simplify the code of host_alarm_handler and eliminate useless duplication. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `4c3d45eb69`)	2011-02-04 06:53:52 -06:00
Paolo Bonzini	bbd9827cc7	Correct alarm deadline computation When the QEMU_CLOCK_HOST clock was added, computation of its deadline was added to qemu_next_deadline, which is correct but incomplete. I noticed this by reading the very convoluted rules whereby qemu_next_deadline_dyntick is computed, which miss QEMU_CLOCK_HOST when use_icount is true. This patch inlines qemu_next_deadline into qemu_next_deadline_dyntick, and then corrects the logic to skip only QEMU_CLOCK_VIRTUAL when use_icount is true. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Cc: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `6ad0a1ed21`)	2011-02-04 06:53:51 -06:00
Paolo Bonzini	d7f88b4bbd	use nanoseconds everywhere for timeout computation Suggested by Aurelien Jarno. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `9c13246ac1`)	2011-02-04 06:53:51 -06:00
Yoshiaki Tamura	ea01a58014	savevm: fix corruption in vmstate_subsection_load(). Although it's rare to happen in live migration, when the head of a byte stream contains 0x05 which is the marker of subsection, the loader gets corrupted because vmstate_subsection_load() continues even the device doesn't require it. This patch adds a checker whether subsection is needed, and skips following routines if not needed. Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp> Acked-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `eb60260de0`)	2011-02-04 06:53:51 -06:00
Aurelien Jarno	0833073edf	Revert "Open up the 0.15 development branch" This reverts commit `0e1272f22b`.	2011-02-02 08:39:44 +01:00
Anthony Liguori	0e1272f22b	Open up the 0.15 development branch Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2011-02-01 20:15:26 -06:00
@@ -1 +1 @@
 .0,1
 .13.91