Version 1.0.1

Signed-off-by: Justin M. Forbes <jforbes@redhat.com>
Merge branch 's390-1.0' of git://repo.or.cz/qemu/agraf
2012-02-02 16:44:08 -06:00 · 2012-02-01 11:25:23 -06:00 · 2012-02-01 11:24:47 -06:00 · 2012-01-23 15:07:00 -06:00 · 2012-01-12 18:41:08 +01:00 · 2012-01-12 18:41:08 +01:00
2719 changed files with 118677 additions and 450950 deletions
--- a/.exrc
+++ b/.exrc
@@ -1,7 +0,0 @@
-"VIM settings to match QEMU coding style.  They are activated by adding the
-"following settings (without the " symbol) as last two lines in $HOME/.vimrc:
-"set secure
-"set exrc
-set expandtab
-set shiftwidth=4
-set smarttab
--- a/.gitignore
+++ b/.gitignore
@@ -1,19 +1,19 @@
 config-devices.*
 config-all-devices.*
-config-all-disas.*
 config-host.*
 config-target.*
-trace/generated-tracers.h
-trace/generated-tracers.c
-trace/generated-tracers-dtrace.h
-trace/generated-tracers-dtrace.dtrace
-libcacard/trace/generated-tracers.c
+trace.h
+trace.c
+trace-dtrace.h
+trace-dtrace.dtrace
 *-timestamp
 *-softmmu
 *-darwin-user
 *-linux-user
 *-bsd-user
 libdis*
+libhw32
+libhw64
 libuser
 linux-headers/asm
 qapi-generated
@@ -39,19 +39,9 @@ qemu-img-cmds.texi
 qemu-img-cmds.h
 qemu-io
 qemu-ga
-qemu-bridge-helper
 qemu-monitor.texi
-vscclient
 QMP/qmp-commands.txt
 test-coroutine
-test-qmp-input-visitor
-test-qmp-output-visitor
-test-string-input-visitor
-test-string-output-visitor
-test-visitor-serialization
-fsdev/virtfs-proxy-helper
-fsdev/virtfs-proxy-helper.1
-fsdev/virtfs-proxy-helper.pod
 .gdbinit
 *.a
 *.aux
@@ -71,12 +61,7 @@ fsdev/virtfs-proxy-helper.pod
 *.tp
 *.vr
 *.d
-!scripts/qemu-guest-agent/fsfreeze-hook.d
 *.o
-*.lo
-*.la
-*.pc
-.libs
 *.swp
 *.orig
 .pc
@@ -84,14 +69,8 @@ patches
 pc-bios/bios-pq/status
 pc-bios/vgabios-pq/status
 pc-bios/optionrom/linuxboot.bin
-pc-bios/optionrom/linuxboot.raw
-pc-bios/optionrom/linuxboot.img
 pc-bios/optionrom/multiboot.bin
 pc-bios/optionrom/multiboot.raw
-pc-bios/optionrom/multiboot.img
-pc-bios/optionrom/kvmvapic.bin
-pc-bios/optionrom/kvmvapic.raw
-pc-bios/optionrom/kvmvapic.img
 .stgit-*
 cscope.*
 tags
--- a/.gitmodules
+++ b/.gitmodules
@@ -19,6 +19,3 @@
 [submodule "roms/sgabios"]
 	path = roms/sgabios
 	url = git://git.qemu.org/sgabios.git
-[submodule "pixman"]
-	path = pixman
-	url = git://anongit.freedesktop.org/pixman
--- a/.mailmap
+++ b/.mailmap
@@ -1,16 +0,0 @@
-# This mailmap just translates the weird addresses from the original import into git
-# into proper addresses so that they are counted properly in git shortlog output.
-#
-Andrzej Zaborowski <balrogg@gmail.com> balrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>
-Anthony Liguori <aliguori@us.ibm.com> aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
-Aurelien Jarno <aurelien@aurel32.net> aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162>
-Blue Swirl <blauwirbel@gmail.com> blueswir1 <blueswir1@c046a42c-6fe2-441c-8c8c-71466251a162>
-Edgar E. Iglesias <edgar.iglesias@gmail.com> edgar_igl <edgar_igl@c046a42c-6fe2-441c-8c8c-71466251a162>
-Fabrice Bellard <fabrice@bellard.org> bellard <bellard@c046a42c-6fe2-441c-8c8c-71466251a162>
-Jocelyn Mayer <l_indien@magic.fr> j_mayer <j_mayer@c046a42c-6fe2-441c-8c8c-71466251a162>
-Paul Brook <paul@codesourcery.com> pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
-Thiemo Seufer <ths@networkno.de> ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162>
-malc <av1474@comtv.ru> malc <malc@c046a42c-6fe2-441c-8c8c-71466251a162>
-# There is also a:
-#    (no author) <(no author)@c046a42c-6fe2-441c-8c8c-71466251a162>
-# for the cvs2svn initialization commit e63c3dc74bf.
--- a/5
+++ b/5
@@ -1,4 +1,4 @@
-QEMU Coding Style
+Qemu Coding Style
 =================

 Please use the script checkpatch.pl in the scripts directory to check
@@ -44,8 +44,7 @@ Rationale:
 3. Naming

 Variables are lower_case_with_underscores; easy to type and read.  Structured
-type names are in CamelCase; harder to type but standing out.  Enum type
-names and function type names should also be in CamelCase.  Scalar type
+type names are in CamelCase; harder to type but standing out.  Scalar type
 names are lower_case_with_underscores_ending_with_a_t, like the POSIX
 uint64_t and family.  Note that this last convention contradicts POSIX
 and is therefore likely to be changed.
--- a/6
+++ b/6
@@ -78,7 +78,7 @@ version 0.10.2:

  - fix savevm/loadvm (Anthony Liguori)
  - live migration: fix dirty tracking windows (Glauber Costa)
-  - live migration: improve error propagation (Glauber Costa)
+  - live migration: improve error propogation (Glauber Costa)
  - qcow2: fix image creation for > ~2TB images (Chris Wright)
  - hotplug: fix error handling for if= parameter (Eduardo Habkost)
  - qcow2: fix data corruption (Nolan Leake)
@@ -386,7 +386,7 @@ version 0.5.3:
  - support of CD-ROM change
  - multiple network interface support
  - initial x86-64 host support (Gwenole Beauchesne)
-  - lret to outer privilege fix (OS/2 install fix)
+  - lret to outer priviledge fix (OS/2 install fix)
  - task switch fixes (SkyOS boot)
  - VM save/restore commands
  - new timer API
@@ -447,7 +447,7 @@ version 0.5.0:
  - multi-target build
  - fixed: no error code in hardware interrupts
  - fixed: pop ss, mov ss, x and sti disable hardware irqs for the next insn
-  - correct single stepping through string operations
+  - correct single stepping thru string operations
  - preliminary SPARC target support (Thomas M. Ogrisegg)
  - tun-fd option (Rusty Russell)
  - automatic IDE geometry detection
--- a/41
+++ b/41
@@ -32,7 +32,7 @@ mandatory for VMState fields.

 Don't use Linux kernel internal types like u32, __u32 or __le32.

-Use hwaddr for guest physical addresses except pcibus_t
+Use target_phys_addr_t for guest physical addresses except pcibus_t
 for PCI addresses.  In addition, ram_addr_t is a QEMU internal address
 space that maps guest RAM physical addresses into an intermediate
 address space that can map to host virtual address spaces.  Generally
@@ -77,13 +77,11 @@ avoided.

 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
-use the GLib memory allocation routines g_malloc/g_malloc0/g_new/
-g_new0/g_realloc/g_free or QEMU's qemu_vmalloc/qemu_memalign/qemu_vfree
-APIs.
+use the replacement g_malloc/g_malloc0/g_realloc/g_free or
+qemu_vmalloc/qemu_memalign/qemu_vfree APIs.

-Please note that g_malloc will exit on allocation failure, so there
-is no need to test for failure (as you would have to with malloc).
-Calling g_malloc with a zero size is valid and will return NULL.
+Please note that NULL check for the g_malloc result is redundant and
+that g_malloc() call with zero size is not allowed.

 Memory allocated by qemu_vmalloc or qemu_memalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32 and user
@@ -91,11 +89,10 @@ emulators.

 4. String manipulation

-Do not use the strncpy function.  As mentioned in the man page, it does *not*
-guarantee a NULL-terminated buffer, which makes it extremely dangerous to use.
-It also zeros trailing destination bytes out to the specified length.  Instead,
-use this similar function when possible, but note its different signature:
-void pstrcpy(char *dest, int dest_buf_size, const char *src)
+Do not use the strncpy function.  According to the man page, it does
+*not* guarantee a NULL-terminated buffer, which makes it extremely dangerous
+to use.  Instead, use functionally equivalent function:
+void pstrcpy(char *buf, int buf_size, const char *str)

 Don't use strcat because it can't check for buffer overflows, but:
 char *pstrcat(char *buf, int buf_size, const char *s)
@@ -123,23 +120,3 @@ gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
-
-6. C standard, implementation defined and undefined behaviors
-
-C code in QEMU should be written to the C99 language specification. A copy
-of the final version of the C99 standard with corrigenda TC1, TC2, and TC3
-included, formatted as a draft, can be downloaded from:
- http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf
-
-The C language specification defines regions of undefined behavior and
-implementation defined behavior (to give compiler authors enough leeway to
-produce better code).  In general, code in QEMU should follow the language
-specification and avoid both undefined and implementation defined
-constructs. ("It works fine on the gcc I tested it with" is not a valid
-argument...) However there are a few areas where we allow ourselves to
-assume certain behaviors because in practice all the platforms we care about
-behave in the same way and writing strictly conformant code would be
-painful. These are:
- * you may assume that integers are 2s complement representation
- * you may assume that right shift of a signed integer duplicates
-   the sign bit (ie it is an arithmetic shift, not a logical shift)
--- a/4
+++ b/4
@@ -6,7 +6,9 @@ The following points clarify the QEMU license:
 GNU General Public License. Hence each source file contains its own
 licensing information.

-Many hardware device emulation sources are released under the BSD license.
+In particular, the QEMU virtual CPU core library (libqemu.a) is
+released under the GNU Lesser General Public License. Many hardware
+device emulation sources are released under the BSD license.

 3) The Tiny Code Generator (TCG) is released under the BSD license
   (see license headers in files).
--- a/257
+++ b/257
@@ -20,7 +20,7 @@ Descriptions of section entries:
 	   Supported:	Someone is actually paid to look after this.
 	   Maintained:	Someone actually looks after it.
 	   Odd Fixes:	It has a maintainer but they don't have time to do
-			much other than throw the odd patch in. See below.
+			much other than throw the odd patch in. See below..
 	   Orphan:	No current maintainer [but maybe you could take the
 			role as you write your new code].
 	   Obsolete:	Old code. Something tagged obsolete generally means
@@ -78,7 +78,7 @@ F: target-lm32/

 M68K
 M: Paul Brook <paul@codesourcery.com>
-S: Odd Fixes
+S: Maintained
 F: target-m68k/

 MicroBlaze
@@ -88,24 +88,22 @@ F: target-microblaze/

 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
-S: Odd Fixes
+S: Maintained
 F: target-mips/

 PowerPC
 M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
 S: Maintained
 F: target-ppc/

 S390
-M: Richard Henderson <rth@twiddle.net>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: target-s390x/

 SH4
 M: Aurelien Jarno <aurelien@aurel32.net>
-S: Odd Fixes
+S: Maintained
 F: target-sh4/

 SPARC
@@ -113,11 +111,6 @@ M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: target-sparc/

-UniCore32
-M: Guan Xuetao <gxt@mprc.pku.edu.cn>
-S: Maintained
-F: target-unicore32/
-
 X86
 M: qemu-devel@nongnu.org
 S: Odd Fixes
@@ -133,7 +126,7 @@ Guest CPU Cores (KVM):
 ----------------------

 Overall
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
@@ -151,7 +144,7 @@ S: Maintained
 F: target-s390x/kvm.c

 X86
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
@@ -167,53 +160,13 @@ S: Supported
 F: xen-*
 F: */xen*

-Hosts:
------
-
-LINUX
-L: qemu-devel@nongnu.org
-S: Maintained
-F: linux-*
-F: linux-headers/
-
-POSIX
-L: qemu-devel@nongnu.org
-S: Maintained
-F: *posix*
-
-W32, W64
-L: qemu-devel@nongnu.org
-M: Stefan Weil <sw@weilnetz.de>
-S: Maintained
-F: *win32*
-
 ARM Machines
 ------------
-Exynos
-M: Evgeny Voevodin <e.voevodin@samsung.com>
-M: Maksim Kozlov <m.kozlov@samsung.com>
-M: Igor Mitsyanko <i.mitsyanko@samsung.com>
-M: Dmitry Solodkiy <d.solodkiy@samsung.com>
-S: Maintained
-F: hw/exynos*
-
-Calxeda Highbank
-M: Mark Langsdorf <mark.langsdorf@calxeda.com>
-S: Supported
-F: hw/highbank.c
-F: hw/xgmac.c
-
 Gumstix
 M: qemu-devel@nongnu.org
 S: Orphan
 F: hw/gumstix.c

-i.MX31
-M: Peter Chubb <peter.chubb@nicta.com.au>
-S: Odd fixes
-F: hw/imx*
-F: hw/kzm.c
-
 Integrator CP
 M: Paul Brook <paul@codesourcery.com>
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -263,14 +216,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/versatilepb.c

-Xilinx Zynq
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-S: Maintained
-F: hw/xilinx_zynq.c
-F: hw/zynq_slcr.c
-F: hw/cadence_*
-F: hw/xilinx_spips.c
-
 CRIS Machines
 -------------
 Axis Dev88
@@ -319,11 +264,6 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: hw/petalogix_s3adsp1800.c

-petalogix_ml605
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-S: Maintained
-F: hw/petalogix_ml605_mmu.c
-
 MIPS Machines
 -------------
 Jazz
@@ -350,67 +290,23 @@ PowerPC Machines
 ----------------
 405
 M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
+S: Maintained
 F: hw/ppc405_boards.c

-Bamboo
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/ppc440_bamboo.c
-
-e500
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppc/e500.[hc]
-F: hw/ppc/e500plat.c
-
-mpc8544ds
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppc/mpc8544ds.c
-F: hw/mpc8544_guts.c
-
 New World
 M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_newworld.c
-F: hw/unin_pci.c
-F: hw/dec_pci.[hc]
+F: hw/ppc_newworld.c

 Old World
 M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_oldworld.c
-F: hw/grackle_pci.c
+F: hw/ppc_oldworld.c

 PReP
 M: Andreas Färber <andreas.faerber@web.de>
-L: qemu-ppc@nongnu.org
 S: Odd Fixes
-F: hw/ppc/prep.c
-F: hw/prep_pci.[hc]
-F: hw/pc87312.[hc]
-
-sPAPR
-M: David Gibson <david@gibson.dropbear.id.au>
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/spapr*
-
-virtex_ml507
-M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/virtex_ml507.c
+F: hw/ppc_prep.c

 SH4 Machines
 ------------
@@ -436,12 +332,6 @@ M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: hw/sun4u.c

-Leon3
-M: Fabien Chouteau <chouteau@adacore.com>
-S: Maintained
-F: hw/leon3.c
-F: hw/grlib*
-
 S390 Machines
 -------------
 S390 Virtio
@@ -449,21 +339,12 @@ M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: hw/s390-*.c

-UniCore32 Machines
-------------
-PKUnity-3 SoC initramfs-with-busybox
-M: Guan Xuetao <gxt@mprc.pku.edu.cn>
-S: Maintained
-F: hw/puv3*
-F: hw/unicore32/
-
 X86 Machines
 ------------
 PC
 M: Anthony Liguori <aliguori@us.ibm.com>
 S: Supported
-F: hw/pc.[ch]
-F: hw/pc_piix.c
+F: hw/pc.[ch] hw/pc_piix.c

 Xtensa Machines
 ---------------
@@ -492,51 +373,21 @@ F: hw/omap*
 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
-F: hw/pci/*
 F: hw/pci*
 F: hw/piix*

-ppc4xx
-M: Alexander Graf <agraf@suse.de>
-L: qemu-ppc@nongnu.org
-S: Odd Fixes
-F: hw/ppc4xx*.[hc]
-
-ppce500
-M: Alexander Graf <agraf@suse.de>
-M: Scott Wood <scottwood@freescale.com>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/ppce500_*
-
 SCSI
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Supported
-F: hw/virtio-scsi.*
-F: hw/scsi*
-T: git git://github.com/bonzini/qemu.git scsi-next
-
-LSI53C895A
 M: Paul Brook <paul@codesourcery.com>
+M: Kevin Wolf <kwolf@redhat.com>
 S: Odd Fixes
 F: hw/lsi53c895a.c
-
-SSI
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-S: Maintained
-F: hw/ssi.*
-F: hw/m25p80.c
+F: hw/scsi*

 USB
 M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: hw/usb*

-VFIO
-M: Alex Williamson <alex.williamson@redhat.com>
-S: Supported
-F: hw/vfio*
-
 vhost
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
@@ -548,15 +399,12 @@ S: Supported
 F: hw/virtio*

 virtio-9p
-M: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+M: Venkateswararao Jujjuri (JV) <jvrao@linux.vnet.ibm.com>
 S: Supported
-F: hw/9pfs/
-F: fsdev/
-T: git git://github.com/kvaneesh/QEMU.git
+F: hw/virtio-9p*

 virtio-blk
 M: Kevin Wolf <kwolf@redhat.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Supported
 F: hw/virtio-blk*

@@ -566,18 +414,6 @@ S: Supported
 F: hw/virtio-serial*
 F: hw/virtio-console*

-Xilinx EDK
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
-S: Maintained
-F: hw/xilinx_axi*
-F: hw/xilinx_uartlite.c
-F: hw/xilinx_intc.c
-F: hw/xilinx_ethlite.c
-F: hw/xilinx_timer.c
-F: hw/xilinx.h
-F: hw/xilinx_spi.c
-
 Subsystems
 ----------
 Audio
@@ -587,7 +423,6 @@ F: audio/

 Block
 M: Kevin Wolf <kwolf@redhat.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Supported
 F: block*
 F: block/
@@ -597,19 +432,6 @@ M: Anthony Liguori <aliguori@us.ibm.com>
 S: Maintained
 F: qemu-char.c

-CPU
-M: Andreas Färber <afaerber@suse.de>
-S: Supported
-F: qom/cpu.c
-F: include/qemu/cpu.h
-F: target-i386/cpu.c
-
-Device Tree
-M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
-M: Alexander Graf <agraf@suse.de>
-S: Maintained
-F: device-tree.[ch]
-
 GDB stub
 M: qemu-devel@nongnu.org
 S: Odd Fixes
@@ -647,33 +469,21 @@ F: monitor.c

 Network device layer
 M: Anthony Liguori <aliguori@us.ibm.com>
-M: Stefan Hajnoczi <stefanha@redhat.com>
+M: Mark McLoughlin <markmc@redhat.com>
 S: Maintained
 F: net/
-T: git git://github.com/stefanha/qemu.git net
-
-Network Block Device (NBD)
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Odd Fixes
-F: block/nbd.c
-F: nbd.*
-F: qemu-nbd.c
-T: git git://github.com/bonzini/qemu.git nbd-next

 SLIRP
 M: Jan Kiszka <jan.kiszka@siemens.com>
 S: Maintained
 F: slirp/
-T: git git://git.kiszka.org/qemu.git queues/slirp
+T: git://git.kiszka.org/qemu.git queues/slirp

 Tracing
-M: Stefan Hajnoczi <stefanha@redhat.com>
+M: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
 S: Maintained
 F: trace/
-F: scripts/tracetool.py
-F: scripts/tracetool/
-F: docs/tracing.txt
-T: git git://github.com/stefanha/qemu.git tracing
+T: git://repo.or.cz/qemu/stefanha.git tracing

 Checkpatch
 M: Blue Swirl <blauwirbel@gmail.com>
@@ -687,6 +497,11 @@ M: Blue Swirl <blauwirbel@gmail.com>
 S: Maintained
 F: bsd-user/

+Darwin user
+M: qemu-devel@nongnu.org
+S: Orphan
+F: darwin-user/
+
 Linux user
 M: Riku Voipio <riku.voipio@iki.fi>
 S: Maintained
@@ -748,26 +563,4 @@ F: tcg/sparc/
 TCI target
 M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
-F: tcg/tci/
-
-Stable branches
---------------
-Stable 1.0
-L: qemu-stable@nongnu.org
-T: git git://git.qemu.org/qemu-stable-1.0.git
-S: Orphan
-
-Stable 0.15
-L: qemu-stable@nongnu.org
-T: git git://git.qemu.org/qemu-stable-0.15.git
-S: Orphan
-
-Stable 0.14
-L: qemu-stable@nongnu.org
-T: git git://git.qemu.org/qemu-stable-0.14.git
-S: Orphan
-
-Stable 0.10
-L: qemu-stable@nongnu.org
-T: git git://git.qemu.org/qemu-stable-0.10.git
-S: Orphan
+F: tcg/tci
--- a/309
+++ b/309
@@ -3,43 +3,26 @@
 # Always point to the root of the build tree (needs GNU make).
 BUILD_DIR=$(CURDIR)

-# All following code might depend on configuration variables
+GENERATED_HEADERS = config-host.h trace.h qemu-options.def
+ifeq ($(TRACE_BACKEND),dtrace)
+GENERATED_HEADERS += trace-dtrace.h
+endif
+GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
+GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c
+
 ifneq ($(wildcard config-host.mak),)
 # Put the all: rule here so that config-host.mak can contain dependencies.
-all:
+all: build-all
 include config-host.mak
-
-# Check that we're not trying to do an out-of-tree build from
-# a tree that's been used for an in-tree build.
-ifneq ($(realpath $(SRC_PATH)),$(realpath .))
-ifneq ($(wildcard $(SRC_PATH)/config-host.mak),)
-$(error This is an out of tree build but your source tree ($(SRC_PATH)) \
-seems to have been used for an in-tree build. You can fix this by running \
-"make distclean && rm -rf *-linux-user *-softmmu" in your source tree)
-endif
-endif
-
 include $(SRC_PATH)/rules.mak
 config-host.mak: $(SRC_PATH)/configure
 	@echo $@ is out-of-date, running configure
 	@sed -n "/.*Configured with/s/[^:]*: //p" $@ | sh
 else
 config-host.mak:
-ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
 	@echo "Please call configure before running make!"
 	@exit 1
 endif
-endif
-
-GENERATED_HEADERS = config-host.h qemu-options.def
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c
-
-GENERATED_HEADERS += trace/generated-tracers.h
-ifeq ($(TRACE_BACKEND),dtrace)
-GENERATED_HEADERS += trace/generated-tracers-dtrace.h
-endif
-GENERATED_SOURCES += trace/generated-tracers.c

 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
@@ -47,19 +30,14 @@ Makefile: ;
 configure: ;

 .PHONY: all clean cscope distclean dvi html info install install-doc \
-	pdf recurse-all speed test dist
+	pdf recurse-all speed tar tarbin test build-all

-$(call set-vpath, $(SRC_PATH))
+$(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)

 LIBS+=-lz $(LIBS_TOOLS)

-HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF)
-
 ifdef BUILD_DOCS
 DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8 QMP/qmp-commands.txt
-ifdef CONFIG_VIRTFS
-DOCS+=fsdev/virtfs-proxy-helper.1
-endif
 else
 DOCS=
 endif
@@ -68,13 +46,8 @@ SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
 SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
 SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %/config-devices.mak.d, $(TARGET_DIRS))

-ifeq ($(SUBDIR_DEVICES_MAK),)
-config-all-devices.mak:
-	$(call quiet-command,echo '# no devices' > $@,"  GEN   $@")
-else
 config-all-devices.mak: $(SUBDIR_DEVICES_MAK)
 	$(call quiet-command,cat $(SUBDIR_DEVICES_MAK) | grep =y | sort -u > $@,"  GEN   $@")
-endif

 -include $(SUBDIR_DEVICES_MAK_DEP)

@@ -102,20 +75,8 @@ defconfig:
 	rm -f config-all-devices.mak $(SUBDIR_DEVICES_MAK)

 -include config-all-devices.mak
-include config-all-disas.mak
-CONFIG_SOFTMMU := $(if $(filter %-softmmu,$(TARGET_DIRS)),y)
-CONFIG_USER_ONLY := $(if $(filter %-user,$(TARGET_DIRS)),y)
-CONFIG_ALL=y

-ifneq ($(wildcard config-host.mak),)
-include $(SRC_PATH)/Makefile.objs
-include $(SRC_PATH)/tests/Makefile
-endif
-ifeq ($(CONFIG_SMARTCARD_NSS),y)
-include $(SRC_PATH)/libcacard/Makefile
-endif
-
-all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all
+build-all: $(DOCS) $(TOOLS) $(CHECKS) recurse-all

 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
@@ -124,19 +85,19 @@ qemu-options.def: $(SRC_PATH)/qemu-options.hx

 SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))

-subdir-%:
+subdir-%: $(GENERATED_HEADERS)
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C $* V="$(V)" TARGET_DIR="$*/" all,)

-subdir-pixman: pixman/Makefile
-	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C pixman V="$(V)" all,)
+ifneq ($(wildcard config-host.mak),)
+include $(SRC_PATH)/Makefile.objs
+endif

-pixman/Makefile: $(SRC_PATH)/pixman/configure
-	(cd pixman; CFLAGS="$(CFLAGS) -fPIC $(extra_cflags) $(extra_ldflags)" $(SRC_PATH)/pixman/configure $(AUTOCONF_HOST) --disable-gtk --disable-shared --enable-static)
+$(common-obj-y): $(GENERATED_HEADERS)
+subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-timer-common.o

-$(SRC_PATH)/pixman/configure:
-	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
+$(filter %-softmmu,$(SUBDIR_RULES)): $(trace-obj-y) $(common-obj-y) subdir-libdis

-$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y)
+$(filter %-user,$(SUBDIR_RULES)): $(GENERATED_HEADERS) $(trace-obj-y) subdir-libdis-user subdir-libuser

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 romsubdir-%:
@@ -146,129 +107,163 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))

 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)

+audio/audio.o audio/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
+
+QEMU_CFLAGS+=$(CURL_CFLAGS)
+
+QEMU_CFLAGS+=$(GLIB_CFLAGS)
+
+ui/cocoa.o: ui/cocoa.m
+
+ui/sdl.o audio/sdlaudio.o ui/sdl_zoom.o baum.o: QEMU_CFLAGS += $(SDL_CFLAGS)
+
+ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+
 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)

 version.o: $(SRC_PATH)/version.rc config-host.h
 	$(call quiet-command,$(WINDRES) -I. -o $@ $<,"  RC    $(TARGET_DIR)$@")

 version-obj-$(CONFIG_WIN32) += version.o
-Makefile: $(version-obj-y)
-
 ######################################################################
-# Build libraries
+# Support building shared library libcacard

-libqemustub.a: $(stub-obj-y)
-libqemuutil.a: $(util-obj-y)
+.PHONY: libcacard.la install-libcacard
+ifeq ($(LIBTOOL),)
+libcacard.la:
+	@echo "libtool is missing, please install and rerun configure"; exit 1

+install-libcacard:
+	@echo "libtool is missing, please install and rerun configure"; exit 1
+else
+libcacard.la: $(GENERATED_HEADERS) $(oslib-obj-y) qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" libcacard.la,)
+
+install-libcacard: libcacard.la
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" install-libcacard,)
+endif
 ######################################################################

 qemu-img.o: qemu-img-cmds.h
+qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o qemu-ga.o: $(GENERATED_HEADERS)

-qemu-img$(EXESUF): qemu-img.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-io$(EXESUF): qemu-io.o cmd.o $(block-obj-y) libqemuutil.a libqemustub.a
+tools-obj-y = qemu-tool.o $(oslib-obj-y) $(trace-obj-y) \
+	qemu-timer-common.o cutils.o

-qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o
-
-fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o libqemuutil.a libqemustub.a
-fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap
+qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y)
+qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y)
+qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y)

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

+check-qint.o check-qstring.o check-qdict.o check-qlist.o check-qfloat.o check-qjson.o test-coroutine.o: $(GENERATED_HEADERS)
+
+check-qint: check-qint.o qint.o $(tools-obj-y)
+check-qstring: check-qstring.o qstring.o $(tools-obj-y)
+check-qdict: check-qdict.o qdict.o qfloat.o qint.o qstring.o qbool.o qlist.o $(tools-obj-y)
+check-qlist: check-qlist.o qlist.o qint.o $(tools-obj-y)
+check-qfloat: check-qfloat.o qfloat.o $(tools-obj-y)
+check-qjson: check-qjson.o $(qobject-obj-y) $(tools-obj-y)
+test-coroutine: test-coroutine.o qemu-timer-common.o async.o $(coroutine-obj-y) $(tools-obj-y)
+
+$(qapi-obj-y): $(GENERATED_HEADERS)
+qapi-dir := $(BUILD_DIR)/qapi-generated
+test-visitor.o test-qmp-commands.o qemu-ga$(EXESUF): QEMU_CFLAGS += -I $(qapi-dir)
 qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)
-qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated

-gen-out-type = $(subst .,-,$(suffix $@))
+$(qapi-dir)/test-qapi-types.c $(qapi-dir)/test-qapi-types.h :\
+$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-types.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
+$(qapi-dir)/test-qapi-visit.c $(qapi-dir)/test-qapi-visit.h :\
+$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-visit.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")
+$(qapi-dir)/test-qmp-commands.h $(qapi-dir)/test-qmp-marshal.c :\
+$(SRC_PATH)/qapi-schema-test.json $(SRC_PATH)/scripts/qapi-commands.py
+	    $(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "test-" < $<, "  GEN   $@")

-qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py
-
-qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
-qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
-qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qapi-types.c $(qapi-dir)/qga-qapi-types.h :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qapi-visit.c $(qapi-dir)/qga-qapi-visit.h :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")
+$(qapi-dir)/qga-qmp-commands.h $(qapi-dir)/qga-qmp-marshal.c :\
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -o "$(qapi-dir)" -p "qga-" < $<, "  GEN   $@")

 qapi-types.c qapi-types.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o "." < $<, "  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py -o "." < $<, "  GEN   $@")
 qapi-visit.c qapi-visit.h :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o "."  < $<, "  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py -o "."  < $<, "  GEN   $@")
 qmp-commands.h qmp-marshal.c :\
-$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -m -o "." < $<, "  GEN   $@")
+$(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py -m -o "." < $<, "  GEN   $@")

-QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
-$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
+test-visitor.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h) $(qapi-obj-y)
+test-visitor: test-visitor.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o

-qemu-ga$(EXESUF): $(qga-obj-y) libqemuutil.a libqemustub.a
-	$(call LINK, $^)
+test-qmp-commands.o: $(addprefix $(qapi-dir)/, test-qapi-types.c test-qapi-types.h test-qapi-visit.c test-qapi-visit.h test-qmp-marshal.c test-qmp-commands.h) $(qapi-obj-y)
+test-qmp-commands: test-qmp-commands.o $(qobject-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qapi-dir)/test-qapi-visit.o $(qapi-dir)/test-qapi-types.o $(qapi-dir)/test-qmp-marshal.o module.o
+
+QGALIB_OBJ=$(addprefix $(qapi-dir)/, qga-qapi-types.o qga-qapi-visit.o qga-qmp-marshal.o)
+QGALIB_GEN=$(addprefix $(qapi-dir)/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
+$(QGALIB_OBJ): $(QGALIB_GEN) $(GENERATED_HEADERS)
+$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN) $(GENERATED_HEADERS)
+
+qemu-ga$(EXESUF): qemu-ga.o $(qga-obj-y) $(qapi-obj-y) $(tools-obj-y) $(qobject-obj-y) $(version-obj-y) $(QGALIB_OBJ)
+
+QEMULIBS=libhw32 libhw64 libuser libdis libdis-user

 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
-	find . -name '*.[oda]' -type f -exec rm -f {} +
-	find . -name '*.l[oa]' -type f -exec rm -f {} +
-	rm -f $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
+	rm -f *.o *.d *.a *.lo $(TOOLS) $(CHECKS) qemu-ga TAGS cscope.* *.pod *~ */*~
 	rm -Rf .libs
+	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d qapi/*.o qapi/*.d qga/*.o qga/*.d
 	rm -f qemu-img-cmds.h
-	@# May not be present in GENERATED_HEADERS
-	rm -f trace/generated-tracers-dtrace.dtrace*
-	rm -f trace/generated-tracers-dtrace.h*
-	rm -f $(foreach f,$(GENERATED_HEADERS),$(f) $(f)-timestamp)
-	rm -f $(foreach f,$(GENERATED_SOURCES),$(f) $(f)-timestamp)
-	rm -rf qapi-generated
-	rm -rf qga/qapi-generated
-	$(MAKE) -C tests/tcg clean
-	for d in $(ALL_SUBDIRS); do \
+	rm -f trace/*.o trace/*.d
+	rm -f trace.c trace.h trace.c-timestamp trace.h-timestamp
+	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
+	rm -f trace-dtrace.h trace-dtrace.h-timestamp
+	rm -f $(GENERATED_SOURCES)
+	rm -rf $(qapi-dir)
+	$(MAKE) -C tests clean
+	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
 	if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
 	rm -f $$d/qemu-options.def; \
        done

-VERSION ?= $(shell cat VERSION)
-
-dist: qemu-$(VERSION).tar.bz2
-
-qemu-%.tar.bz2:
-	$(SRC_PATH)/scripts/make-release "$(SRC_PATH)" "$(patsubst qemu-%.tar.bz2,%,$@)"
-
 distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi
-	rm -f config-all-devices.mak config-all-disas.mak
+	rm -f config-all-devices.mak
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
 	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps qemu-doc.dvi
 	rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys
 	rm -f qemu-doc.log qemu-doc.pdf qemu-doc.pg qemu-doc.toc qemu-doc.tp
 	rm -f qemu-doc.vr
 	rm -f config.log
-	rm -f linux-headers/asm
 	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
-	for d in $(TARGET_DIRS); do \
+	for d in $(TARGET_DIRS) $(QEMULIBS); do \
 	rm -rf $$d || exit 1 ; \
        done
-	if test -f pixman/config.log; then make -C pixman distclean; fi

 KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
-common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr \
-bepo
+common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr

 ifdef INSTALL_BLOBS
 BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
-acpi-dsdt.aml q35-acpi-dsdt.aml \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
-qemu-icon.bmp \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
-multiboot.bin linuxboot.bin kvmvapic.bin \
+mpc8544ds.dtb \
+multiboot.bin linuxboot.bin \
 s390-zipl.rom \
 spapr-rtas.bin slof.bin \
 palcode-clipper
@@ -277,46 +272,33 @@ BLOBS=
 endif

 install-doc: $(DOCS)
-	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) QMP/qmp-commands.txt "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DIR) "$(DESTDIR)$(docdir)"
+	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
 ifdef CONFIG_POSIX
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DATA) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 endif
-ifdef CONFIG_VIRTFS
-	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
-	$(INSTALL_DATA) fsdev/virtfs-proxy-helper.1 "$(DESTDIR)$(mandir)/man1"
-endif

-install-datadir:
-	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)"
+install-sysconfig:
+	$(INSTALL_DIR) "$(DESTDIR)$(sysconfdir)/qemu"
+	$(INSTALL_DATA) $(SRC_PATH)/sysconfigs/target/target-x86_64.conf "$(DESTDIR)$(sysconfdir)/qemu"

-install-confdir:
-	$(INSTALL_DIR) "$(DESTDIR)$(qemu_confdir)"
-
-install-sysconfig: install-datadir install-confdir
-	$(INSTALL_DATA) $(SRC_PATH)/sysconfigs/target/target-x86_64.conf "$(DESTDIR)$(qemu_confdir)"
-
-install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig install-datadir
+install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig
 	$(INSTALL_DIR) "$(DESTDIR)$(bindir)"
 ifneq ($(TOOLS),)
 	$(INSTALL_PROG) $(STRIP_OPT) $(TOOLS) "$(DESTDIR)$(bindir)"
 endif
-ifneq ($(HELPERS-y),)
-	$(INSTALL_DIR) "$(DESTDIR)$(libexecdir)"
-	$(INSTALL_PROG) $(STRIP_OPT) $(HELPERS-y) "$(DESTDIR)$(libexecdir)"
-endif
 ifneq ($(BLOBS),)
+	$(INSTALL_DIR) "$(DESTDIR)$(datadir)"
 	set -e; for x in $(BLOBS); do \
-		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(qemu_datadir)"; \
+		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(datadir)"; \
 	done
 endif
-	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/keymaps"
+	$(INSTALL_DIR) "$(DESTDIR)$(datadir)/keymaps"
 	set -e; for x in $(KEYMAPS); do \
-		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/keymaps/$$x "$(DESTDIR)$(qemu_datadir)/keymaps"; \
+		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/keymaps/$$x "$(DESTDIR)$(datadir)/keymaps"; \
 	done
 	for d in $(TARGET_DIRS); do \
 	$(MAKE) -C $$d $@ || exit 1 ; \
@@ -324,7 +306,13 @@ endif

 # various test targets
 test speed: all
-	$(MAKE) -C tests/tcg $@
+	$(MAKE) -C tests $@
+
+.PHONY: check
+check: $(patsubst %,run-check-%,$(CHECKS))
+
+run-check-%: %
+	./$<

 .PHONY: TAGS
 TAGS:
@@ -343,7 +331,7 @@ TEXIFLAG=$(if $(V),,--quiet)
 	$(call quiet-command,texi2dvi $(TEXIFLAG) -I . $<,"  GEN   $@")

 %.html: %.texi
-	$(call quiet-command,LC_ALL=C $(MAKEINFO) $(MAKEINFOFLAGS) --html $< -o $@, \
+	$(call quiet-command,$(MAKEINFO) $(MAKEINFOFLAGS) --html $< -o $@, \
 	"  GEN   $@")

 %.info: %.texi
@@ -367,25 +355,19 @@ qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx
 qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu.pod && \
-	  $(POD2MAN) --section=1 --center=" " --release=" " qemu.pod > $@, \
+	  pod2man --section=1 --center=" " --release=" " qemu.pod > $@, \
 	  "  GEN   $@")

 qemu-img.1: qemu-img.texi qemu-img-cmds.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-img.pod && \
-	  $(POD2MAN) --section=1 --center=" " --release=" " qemu-img.pod > $@, \
-	  "  GEN   $@")
-
-fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
-	$(call quiet-command, \
-	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< fsdev/virtfs-proxy-helper.pod && \
-	  $(POD2MAN) --section=1 --center=" " --release=" " fsdev/virtfs-proxy-helper.pod > $@, \
+	  pod2man --section=1 --center=" " --release=" " qemu-img.pod > $@, \
 	  "  GEN   $@")

 qemu-nbd.8: qemu-nbd.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-nbd.pod && \
-	  $(POD2MAN) --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
+	  pod2man --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
 	  "  GEN   $@")

 dvi: qemu-doc.dvi qemu-tech.dvi
@@ -397,12 +379,15 @@ qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-monitor.texi qemu-img-cmds.texi

-# Add a dependency on the generated files, so that they are always
-# rebuilt before other object files
-ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
-Makefile: $(GENERATED_HEADERS)
-endif
+VERSION ?= $(shell cat VERSION)
+FILE = qemu-$(VERSION)
+
+# tar release (use 'make -k tar' on a checkouted tree)
+tar:
+	rm -rf /tmp/$(FILE)
+	cp -r . /tmp/$(FILE)
+	cd /tmp && tar zcvf ~/$(FILE).tar.gz $(FILE) --exclude CVS --exclude .git --exclude .svn
+	rm -rf /tmp/$(FILE)

 # Include automatically generated dependency files
-# Dependencies in Makefile.objs files come from our recursive subdir rules
-include $(wildcard *.d tests/*.d)
+-include $(wildcard *.d audio/*.d slirp/*.d block/*.d net/*.d ui/*.d qapi/*.d qga/*.d)
--- a/Makefile.dis
+++ b/Makefile.dis
@@ -0,0 +1,23 @@
+# Makefile for disassemblers.
+
+include ../config-host.mak
+include config.mak
+include $(SRC_PATH)/rules.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(libdis-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	rm -f *.o *.d *.a *~
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -0,0 +1,25 @@
+# Makefile for qemu target independent devices.
+
+include ../config-host.mak
+include ../config-all-devices.mak
+include config.mak
+include $(SRC_PATH)/rules.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw)
+
+QEMU_CFLAGS+=-I..
+QEMU_CFLAGS += $(GLIB_CFLAGS)
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(hw-obj-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	rm -f *.o */*.o *.d */*.d *.a */*.a *~ */*~
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,100 +1,425 @@
 #######################################################################
-# Common libraries for tools and emulators
-stub-obj-y = stubs/
-util-obj-y = util/ qobject/ qapi/ trace/
+# QObject
+qobject-obj-y = qint.o qstring.o qdict.o qlist.o qfloat.o qbool.o
+qobject-obj-y += qjson.o json-lexer.o json-streamer.o json-parser.o
+qobject-obj-y += qerror.o error.o qemu-error.o
+
+#######################################################################
+# oslib-obj-y is code depending on the OS (win32 vs posix)
+oslib-obj-y = osdep.o
+oslib-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o
+oslib-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o
+
+#######################################################################
+# coroutines
+coroutine-obj-y = qemu-coroutine.o qemu-coroutine-lock.o
+ifeq ($(CONFIG_UCONTEXT_COROUTINE),y)
+coroutine-obj-$(CONFIG_POSIX) += coroutine-ucontext.o
+else
+coroutine-obj-$(CONFIG_POSIX) += coroutine-gthread.o
+endif
+coroutine-obj-$(CONFIG_WIN32) += coroutine-win32.o

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = async.o thread-pool.o
-block-obj-y += nbd.o block.o blockjob.o
-block-obj-y += main-loop.o iohandler.o qemu-timer.o
-block-obj-$(CONFIG_POSIX) += aio-posix.o
-block-obj-$(CONFIG_WIN32) += aio-win32.o
-block-obj-y += block/
-block-obj-y += qapi-types.o qapi-visit.o
+block-obj-y = cutils.o cache-utils.o qemu-option.o module.o async.o
+block-obj-y += nbd.o block.o aio.o aes.o qemu-config.o qemu-progress.o qemu-sockets.o
+block-obj-y += $(coroutine-obj-y) $(qobject-obj-y) $(version-obj-y)
+block-obj-$(CONFIG_POSIX) += posix-aio-compat.o
+block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o

-block-obj-y += qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
-block-obj-y += qemu-coroutine-sleep.o
-block-obj-y += coroutine-$(CONFIG_COROUTINE_BACKEND).o
+block-nested-y += raw.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o vvfat.o
+block-nested-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
+block-nested-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
+block-nested-y += qed-check.o
+block-nested-y += parallels.o nbd.o blkdebug.o sheepdog.o blkverify.o
+block-nested-$(CONFIG_WIN32) += raw-win32.o
+block-nested-$(CONFIG_POSIX) += raw-posix.o
+block-nested-$(CONFIG_LIBISCSI) += iscsi.o
+block-nested-$(CONFIG_CURL) += curl.o
+block-nested-$(CONFIG_RBD) += rbd.o
+
+block-obj-y +=  $(addprefix block/, $(block-nested-y))
+
+net-obj-y = net.o
+net-nested-y = queue.o checksum.o util.o
+net-nested-y += socket.o
+net-nested-y += dump.o
+net-nested-$(CONFIG_POSIX) += tap.o
+net-nested-$(CONFIG_LINUX) += tap-linux.o
+net-nested-$(CONFIG_WIN32) += tap-win32.o
+net-nested-$(CONFIG_BSD) += tap-bsd.o
+net-nested-$(CONFIG_SOLARIS) += tap-solaris.o
+net-nested-$(CONFIG_AIX) += tap-aix.o
+net-nested-$(CONFIG_HAIKU) += tap-haiku.o
+net-nested-$(CONFIG_SLIRP) += slirp.o
+net-nested-$(CONFIG_VDE) += vde.o
+net-obj-y += $(addprefix net/, $(net-nested-y))

 ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS)$(CONFIG_PCI),yyy)
 # Lots of the fsdev/9pcode is pulled in by vl.c via qemu_fsdev_add.
 # only pull in the actual virtio-9p device if we also enabled virtio.
 CONFIG_REALLY_VIRTFS=y
+fsdev-nested-y = qemu-fsdev.o
+else
+fsdev-nested-y = qemu-fsdev-dummy.o
 endif
+fsdev-obj-$(CONFIG_VIRTFS) += $(addprefix fsdev/, $(fsdev-nested-y))
+
+######################################################################
+# libqemu_common.a: Target independent part of system emulation. The
+# long term path is to suppress *all* target specific code in case of
+# system emulation, i.e. a single QEMU executable should support all
+# CPUs and machines.
+
+common-obj-y = $(block-obj-y) blockdev.o
+common-obj-y += $(net-obj-y)
+common-obj-y += $(qobject-obj-y)
+common-obj-$(CONFIG_LINUX) += $(fsdev-obj-$(CONFIG_LINUX))
+common-obj-y += readline.o console.o cursor.o
+common-obj-y += $(oslib-obj-y)
+common-obj-$(CONFIG_WIN32) += os-win32.o
+common-obj-$(CONFIG_POSIX) += os-posix.o
+
+common-obj-y += tcg-runtime.o host-utils.o main-loop.o
+common-obj-y += irq.o input.o
+common-obj-$(CONFIG_PTIMER) += ptimer.o
+common-obj-$(CONFIG_MAX7310) += max7310.o
+common-obj-$(CONFIG_WM8750) += wm8750.o
+common-obj-$(CONFIG_TWL92230) += twl92230.o
+common-obj-$(CONFIG_TSC2005) += tsc2005.o
+common-obj-$(CONFIG_LM832X) += lm832x.o
+common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_STELLARIS_INPUT) += stellaris_input.o
+common-obj-$(CONFIG_SSD0303) += ssd0303.o
+common-obj-$(CONFIG_SSD0323) += ssd0323.o
+common-obj-$(CONFIG_ADS7846) += ads7846.o
+common-obj-$(CONFIG_MAX111X) += max111x.o
+common-obj-$(CONFIG_DS1338) += ds1338.o
+common-obj-y += i2c.o smbus.o smbus_eeprom.o
+common-obj-y += eeprom93xx.o
+common-obj-y += scsi-disk.o cdrom.o
+common-obj-y += scsi-generic.o scsi-bus.o
+common-obj-y += hid.o
+common-obj-y += usb.o usb-hub.o usb-$(HOST_USB).o usb-hid.o usb-msd.o usb-wacom.o
+common-obj-y += usb-serial.o usb-net.o usb-bus.o usb-desc.o
+common-obj-$(CONFIG_SSI) += ssi.o
+common-obj-$(CONFIG_SSI_SD) += ssi-sd.o
+common-obj-$(CONFIG_SD) += sd.o
+common-obj-y += bt.o bt-host.o bt-vhci.o bt-l2cap.o bt-sdp.o bt-hci.o bt-hid.o usb-bt.o
+common-obj-y += bt-hci-csr.o
+common-obj-y += buffered_file.o migration.o migration-tcp.o
+common-obj-y += qemu-char.o savevm.o #aio.o
+common-obj-y += msmouse.o ps2.o
+common-obj-y += qdev.o qdev-properties.o
+common-obj-y += block-migration.o iohandler.o
+common-obj-y += pflib.o
+common-obj-y += bitmap.o bitops.o
+
+common-obj-$(CONFIG_BRLAPI) += baum.o
+common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
+common-obj-$(CONFIG_WIN32) += version.o
+
+common-obj-$(CONFIG_SPICE) += ui/spice-core.o ui/spice-input.o ui/spice-display.o spice-qemu-char.o
+
+audio-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
+audio-obj-$(CONFIG_SDL) += sdlaudio.o
+audio-obj-$(CONFIG_OSS) += ossaudio.o
+audio-obj-$(CONFIG_SPICE) += spiceaudio.o
+audio-obj-$(CONFIG_COREAUDIO) += coreaudio.o
+audio-obj-$(CONFIG_ALSA) += alsaaudio.o
+audio-obj-$(CONFIG_DSOUND) += dsoundaudio.o
+audio-obj-$(CONFIG_FMOD) += fmodaudio.o
+audio-obj-$(CONFIG_ESD) += esdaudio.o
+audio-obj-$(CONFIG_PA) += paaudio.o
+audio-obj-$(CONFIG_WINWAVE) += winwaveaudio.o
+audio-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
+audio-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
+audio-obj-y += wavcapture.o
+common-obj-y += $(addprefix audio/, $(audio-obj-y))
+
+ui-obj-y += keymaps.o
+ui-obj-$(CONFIG_SDL) += sdl.o sdl_zoom.o x_keymap.o
+ui-obj-$(CONFIG_COCOA) += cocoa.o
+ui-obj-$(CONFIG_CURSES) += curses.o
+vnc-obj-y += vnc.o d3des.o
+vnc-obj-y += vnc-enc-zlib.o vnc-enc-hextile.o
+vnc-obj-y += vnc-enc-tight.o vnc-palette.o
+vnc-obj-y += vnc-enc-zrle.o
+vnc-obj-$(CONFIG_VNC_TLS) += vnc-tls.o vnc-auth-vencrypt.o
+vnc-obj-$(CONFIG_VNC_SASL) += vnc-auth-sasl.o
+ifdef CONFIG_VNC_THREAD
+vnc-obj-y += vnc-jobs-async.o
+else
+vnc-obj-y += vnc-jobs-sync.o
+endif
+common-obj-y += $(addprefix ui/, $(ui-obj-y))
+common-obj-$(CONFIG_VNC) += $(addprefix ui/, $(vnc-obj-y))
+
+common-obj-y += iov.o acl.o
+common-obj-$(CONFIG_POSIX) += compatfd.o
+common-obj-y += notify.o event_notifier.o
+common-obj-y += qemu-timer.o qemu-timer-common.o
+
+slirp-obj-y = cksum.o if.o ip_icmp.o ip_input.o ip_output.o
+slirp-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
+slirp-obj-y += tcp_subr.o tcp_timer.o udp.o bootp.o tftp.o arp_table.o
+common-obj-$(CONFIG_SLIRP) += $(addprefix slirp/, $(slirp-obj-y))
+
+# xen backend driver support
+common-obj-$(CONFIG_XEN_BACKEND) += xen_backend.o xen_devconfig.o
+common-obj-$(CONFIG_XEN_BACKEND) += xen_console.o xenfb.o xen_disk.o xen_nic.o
+
+######################################################################
+# libuser
+
+user-obj-y =
+user-obj-y += envlist.o path.o
+user-obj-y += tcg-runtime.o host-utils.o
+user-obj-y += cutils.o cache-utils.o
+user-obj-y += $(trace-obj-y)
+
+######################################################################
+# libhw
+
+hw-obj-y =
+hw-obj-y += vl.o loader.o
+hw-obj-$(CONFIG_VIRTIO) += virtio-console.o
+hw-obj-y += usb-libhw.o
+hw-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
+hw-obj-y += fw_cfg.o
+hw-obj-$(CONFIG_PCI) += pci.o pci_bridge.o
+hw-obj-$(CONFIG_PCI) += msix.o msi.o
+hw-obj-$(CONFIG_PCI) += pci_host.o pcie_host.o
+hw-obj-$(CONFIG_PCI) += ioh3420.o xio3130_upstream.o xio3130_downstream.o
+hw-obj-y += watchdog.o
+hw-obj-$(CONFIG_ISA_MMIO) += isa_mmio.o
+hw-obj-$(CONFIG_ECC) += ecc.o
+hw-obj-$(CONFIG_NAND) += nand.o
+hw-obj-$(CONFIG_PFLASH_CFI01) += pflash_cfi01.o
+hw-obj-$(CONFIG_PFLASH_CFI02) += pflash_cfi02.o
+
+hw-obj-$(CONFIG_M48T59) += m48t59.o
+hw-obj-$(CONFIG_ESCC) += escc.o
+hw-obj-$(CONFIG_EMPTY_SLOT) += empty_slot.o
+
+hw-obj-$(CONFIG_SERIAL) += serial.o
+hw-obj-$(CONFIG_PARALLEL) += parallel.o
+hw-obj-$(CONFIG_I8254) += i8254.o
+hw-obj-$(CONFIG_PCSPK) += pcspk.o
+hw-obj-$(CONFIG_PCKBD) += pckbd.o
+hw-obj-$(CONFIG_USB_UHCI) += usb-uhci.o
+hw-obj-$(CONFIG_USB_OHCI) += usb-ohci.o
+hw-obj-$(CONFIG_USB_EHCI) += usb-ehci.o
+hw-obj-$(CONFIG_FDC) += fdc.o
+hw-obj-$(CONFIG_ACPI) += acpi.o acpi_piix4.o
+hw-obj-$(CONFIG_APM) += pm_smbus.o apm.o
+hw-obj-$(CONFIG_DMA) += dma.o
+hw-obj-$(CONFIG_HPET) += hpet.o
+hw-obj-$(CONFIG_APPLESMC) += applesmc.o
+hw-obj-$(CONFIG_SMARTCARD) += usb-ccid.o ccid-card-passthru.o
+hw-obj-$(CONFIG_SMARTCARD_NSS) += ccid-card-emulated.o
+hw-obj-$(CONFIG_USB_REDIR) += usb-redir.o
+hw-obj-$(CONFIG_I8259) += i8259.o
+
+# PPC devices
+hw-obj-$(CONFIG_PREP_PCI) += prep_pci.o
+# Mac shared devices
+hw-obj-$(CONFIG_MACIO) += macio.o
+hw-obj-$(CONFIG_CUDA) += cuda.o
+hw-obj-$(CONFIG_ADB) += adb.o
+hw-obj-$(CONFIG_MAC_NVRAM) += mac_nvram.o
+hw-obj-$(CONFIG_MAC_DBDMA) += mac_dbdma.o
+# OldWorld PowerMac
+hw-obj-$(CONFIG_HEATHROW_PIC) += heathrow_pic.o
+hw-obj-$(CONFIG_GRACKLE_PCI) += grackle_pci.o
+# NewWorld PowerMac
+hw-obj-$(CONFIG_UNIN_PCI) += unin_pci.o
+hw-obj-$(CONFIG_DEC_PCI) += dec_pci.o
+# PowerPC E500 boards
+hw-obj-$(CONFIG_PPCE500_PCI) += ppce500_pci.o
+
+# MIPS devices
+hw-obj-$(CONFIG_PIIX4) += piix4.o
+hw-obj-$(CONFIG_G364FB) += g364fb.o
+
+# PCI watchdog devices
+hw-obj-$(CONFIG_PCI) += wdt_i6300esb.o
+
+hw-obj-$(CONFIG_PCI) += pcie.o pcie_aer.o pcie_port.o
+
+# PCI network cards
+hw-obj-$(CONFIG_NE2000_PCI) += ne2000.o
+hw-obj-$(CONFIG_EEPRO100_PCI) += eepro100.o
+hw-obj-$(CONFIG_PCNET_PCI) += pcnet-pci.o
+hw-obj-$(CONFIG_PCNET_COMMON) += pcnet.o
+hw-obj-$(CONFIG_E1000_PCI) += e1000.o
+hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
+
+hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
+hw-obj-$(CONFIG_LAN9118) += lan9118.o
+hw-obj-$(CONFIG_NE2000_ISA) += ne2000-isa.o
+hw-obj-$(CONFIG_OPENCORES_ETH) += opencores_eth.o
+
+# IDE
+hw-obj-$(CONFIG_IDE_CORE) += ide/core.o ide/atapi.o
+hw-obj-$(CONFIG_IDE_QDEV) += ide/qdev.o
+hw-obj-$(CONFIG_IDE_PCI) += ide/pci.o
+hw-obj-$(CONFIG_IDE_ISA) += ide/isa.o
+hw-obj-$(CONFIG_IDE_PIIX) += ide/piix.o
+hw-obj-$(CONFIG_IDE_CMD646) += ide/cmd646.o
+hw-obj-$(CONFIG_IDE_MACIO) += ide/macio.o
+hw-obj-$(CONFIG_IDE_VIA) += ide/via.o
+hw-obj-$(CONFIG_AHCI) += ide/ahci.o
+hw-obj-$(CONFIG_AHCI) += ide/ich.o
+
+# SCSI layer
+hw-obj-$(CONFIG_LSI_SCSI_PCI) += lsi53c895a.o
+hw-obj-$(CONFIG_ESP) += esp.o
+
+hw-obj-y += dma-helpers.o sysbus.o isa-bus.o
+hw-obj-y += qdev-addr.o
+
+# VGA
+hw-obj-$(CONFIG_VGA_PCI) += vga-pci.o
+hw-obj-$(CONFIG_VGA_ISA) += vga-isa.o
+hw-obj-$(CONFIG_VGA_ISA_MM) += vga-isa-mm.o
+hw-obj-$(CONFIG_VMWARE_VGA) += vmware_vga.o
+hw-obj-$(CONFIG_VMMOUSE) += vmmouse.o
+
+hw-obj-$(CONFIG_RC4030) += rc4030.o
+hw-obj-$(CONFIG_DP8393X) += dp8393x.o
+hw-obj-$(CONFIG_DS1225Y) += ds1225y.o
+hw-obj-$(CONFIG_MIPSNET) += mipsnet.o
+
+# Sound
+sound-obj-y =
+sound-obj-$(CONFIG_SB16) += sb16.o
+sound-obj-$(CONFIG_ES1370) += es1370.o
+sound-obj-$(CONFIG_AC97) += ac97.o
+sound-obj-$(CONFIG_ADLIB) += fmopl.o adlib.o
+sound-obj-$(CONFIG_GUS) += gus.o gusemu_hal.o gusemu_mixer.o
+sound-obj-$(CONFIG_CS4231A) += cs4231a.o
+sound-obj-$(CONFIG_HDA) += intel-hda.o hda-audio.o
+
+adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
+hw-obj-$(CONFIG_SOUND) += $(sound-obj-y)
+
+9pfs-nested-$(CONFIG_VIRTFS)  = virtio-9p.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o
+9pfs-nested-$(CONFIG_VIRTFS) += virtio-9p-coth.o cofs.o codir.o cofile.o
+9pfs-nested-$(CONFIG_VIRTFS) += coxattr.o virtio-9p-synth.o
+9pfs-nested-$(CONFIG_OPEN_BY_HANDLE) +=  virtio-9p-handle.o
+
+hw-obj-$(CONFIG_REALLY_VIRTFS) += $(addprefix 9pfs/, $(9pfs-nested-y))
+$(addprefix 9pfs/, $(9pfs-nested-y)): QEMU_CFLAGS+=$(GLIB_CFLAGS)
+
+
+######################################################################
+# libdis
+# NOTE: the disassembler code is only needed for debugging
+
+libdis-y =
+libdis-$(CONFIG_ALPHA_DIS) += alpha-dis.o
+libdis-$(CONFIG_ARM_DIS) += arm-dis.o
+libdis-$(CONFIG_CRIS_DIS) += cris-dis.o
+libdis-$(CONFIG_HPPA_DIS) += hppa-dis.o
+libdis-$(CONFIG_I386_DIS) += i386-dis.o
+libdis-$(CONFIG_IA64_DIS) += ia64-dis.o
+libdis-$(CONFIG_M68K_DIS) += m68k-dis.o
+libdis-$(CONFIG_MICROBLAZE_DIS) += microblaze-dis.o
+libdis-$(CONFIG_MIPS_DIS) += mips-dis.o
+libdis-$(CONFIG_PPC_DIS) += ppc-dis.o
+libdis-$(CONFIG_S390_DIS) += s390-dis.o
+libdis-$(CONFIG_SH4_DIS) += sh4-dis.o
+libdis-$(CONFIG_SPARC_DIS) += sparc-dis.o
+
+######################################################################
+# trace
+
+ifeq ($(TRACE_BACKEND),dtrace)
+trace.h: trace.h-timestamp trace-dtrace.h
+else
+trace.h: trace.h-timestamp
+endif
+trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -h < $< > $@,"  GEN   trace.h")
+	@cmp -s $@ trace.h || cp $@ trace.h
+
+trace.c: trace.c-timestamp
+trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -c < $< > $@,"  GEN   trace.c")
+	@cmp -s $@ trace.c || cp $@ trace.c
+
+trace.o: trace.c $(GENERATED_HEADERS)
+
+trace-dtrace.h: trace-dtrace.dtrace
+	$(call quiet-command,dtrace -o $@ -h -s $<, "  GEN   trace-dtrace.h")
+
+# Normal practice is to name DTrace probe file with a '.d' extension
+# but that gets picked up by QEMU's Makefile as an external dependency
+# rule file. So we use '.dtrace' instead
+trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool --$(TRACE_BACKEND) -d < $< > $@,"  GEN   trace-dtrace.dtrace")
+	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
+
+trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
+	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN trace-dtrace.o")
+
+ifeq ($(LIBTOOL),)
+trace-dtrace.lo: trace-dtrace.dtrace
+	@echo "missing libtool. please install and rerun configure."; exit 1
+else
+trace-dtrace.lo: trace-dtrace.dtrace
+	$(call quiet-command,$(LIBTOOL) --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
+endif
+
+trace/simple.o: trace/simple.c $(GENERATED_HEADERS)
+
+trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace.o
+ifneq ($(TRACE_BACKEND),dtrace)
+trace-obj-y = trace.o
+endif
+
+trace-nested-$(CONFIG_TRACE_DEFAULT) += default.o
+
+trace-nested-$(CONFIG_TRACE_SIMPLE) += simple.o
+trace-obj-$(CONFIG_TRACE_SIMPLE) += qemu-timer-common.o
+
+trace-nested-$(CONFIG_TRACE_STDERR) += stderr.o
+
+trace-nested-y += control.o
+
+trace-obj-y += $(addprefix trace/, $(trace-nested-y))
+
+$(trace-obj-y): $(GENERATED_HEADERS)

 ######################################################################
 # smartcard

-libcacard-y += libcacard/cac.o libcacard/event.o
-libcacard-y += libcacard/vcard.o libcacard/vreader.o
-libcacard-y += libcacard/vcard_emul_nss.o
-libcacard-y += libcacard/vcard_emul_type.o
-libcacard-y += libcacard/card_7816.o
-
-######################################################################
-# Target independent part of system emulation. The long term path is to
-# suppress *all* target specific code in case of system emulation, i.e. a
-# single QEMU executable should support all CPUs and machines.
-
-ifeq ($(CONFIG_SOFTMMU),y)
-common-obj-y = $(block-obj-y) blockdev.o blockdev-nbd.o block/
-common-obj-y += net/
-common-obj-y += readline.o
-common-obj-$(CONFIG_WIN32) += os-win32.o
-common-obj-$(CONFIG_POSIX) += os-posix.o
-
-common-obj-$(CONFIG_LINUX) += fsdev/
-
-common-obj-y += migration.o migration-tcp.o
-common-obj-y += qemu-char.o #aio.o
-common-obj-y += block-migration.o
-common-obj-y += page_cache.o xbzrle.o
-
-common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
-
-common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
-
-common-obj-y += audio/
-common-obj-y += hw/
-
-common-obj-y += ui/
-common-obj-y += bt-host.o bt-vhci.o
-
-common-obj-y += dma-helpers.o
-common-obj-y += qtest.o
-common-obj-y += vl.o
-
-common-obj-$(CONFIG_SLIRP) += slirp/
-
-common-obj-y += backends/
-
-common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
-
-common-obj-$(CONFIG_SMARTCARD_NSS) += $(libcacard-y)
+libcacard-y = cac.o event.o vcard.o vreader.o vcard_emul_nss.o vcard_emul_type.o card_7816.o

 ######################################################################
 # qapi

-common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o
-common-obj-y += qmp.o hmp.o
-endif
+qapi-nested-y = qapi-visit-core.o qmp-input-visitor.o qmp-output-visitor.o qapi-dealloc-visitor.o
+qapi-nested-y += qmp-registry.o qmp-dispatch.o
+qapi-obj-y = $(addprefix qapi/, $(qapi-nested-y))

-#######################################################################
-# Target-independent parts used in system and user emulation
-common-obj-y += qemu-log.o
-common-obj-y += tcg-runtime.o
-common-obj-y += hw/
-common-obj-y += qom/
-common-obj-y += disas/
+common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o $(qapi-obj-y)
+common-obj-y += qmp.o hmp.o

 ######################################################################
 # guest agent

-# FIXME: a few definitions from qapi-types.o/qapi-visit.o are needed
-# by libqemuutil.a.  These should be moved to a separate .json schema.
-qga-obj-y = qga/ qapi-types.o qapi-visit.o
+qga-nested-y = guest-agent-commands.o guest-agent-command-state.o
+qga-obj-y = $(addprefix qga/, $(qga-nested-y))
+qga-obj-y += qemu-ga.o qemu-sockets.o module.o qemu-option.o
+qga-obj-$(CONFIG_WIN32) += oslib-win32.o
+qga-obj-$(CONFIG_POSIX) += oslib-posix.o

 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

@@ -102,10 +427,3 @@ vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)

 QEMU_CFLAGS+=$(GLIB_CFLAGS)

-nested-vars += \
-	stub-obj-y \
-	util-obj-y \
-	qga-obj-y \
-	block-obj-y \
-	common-obj-y
-dummy := $(call unnest-vars)
--- a/Makefile.target
+++ b/Makefile.target
@@ -1,34 +1,36 @@
 # -*- Mode: makefile -*-

+GENERATED_HEADERS = config-target.h
+CONFIG_NO_PCI = $(if $(subst n,,$(CONFIG_PCI)),n,y)
+CONFIG_NO_KVM = $(if $(subst n,,$(CONFIG_KVM)),n,y)
+CONFIG_NO_XEN = $(if $(subst n,,$(CONFIG_XEN)),n,y)
+
 include ../config-host.mak
 include config-devices.mak
 include config-target.mak
 include $(SRC_PATH)/rules.mak
+ifneq ($(HWDIR),)
+include $(HWDIR)/config.mak
+endif

-$(call set-vpath, $(SRC_PATH))
+TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
+$(call set-vpath, $(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw)
 ifdef CONFIG_LINUX
 QEMU_CFLAGS += -I../linux-headers
 endif
-QEMU_CFLAGS += -I.. -I$(SRC_PATH)/target-$(TARGET_BASE_ARCH) -DNEED_CPU_H
+QEMU_CFLAGS += -I.. -I$(TARGET_PATH) -DNEED_CPU_H

-QEMU_CFLAGS+=-I$(SRC_PATH)/include
+include $(SRC_PATH)/Makefile.objs

 ifdef CONFIG_USER_ONLY
 # user emulator name
 QEMU_PROG=qemu-$(TARGET_ARCH2)
 else
 # system emulator name
-ifneq (,$(findstring -mwindows,$(LIBS)))
-# Terminate program name with a 'w' because the linker builds a windows executable.
-QEMU_PROGW=qemu-system-$(TARGET_ARCH2)w$(EXESUF)
-endif # windows executable
 QEMU_PROG=qemu-system-$(TARGET_ARCH2)$(EXESUF)
 endif

 PROGS=$(QEMU_PROG)
-ifdef QEMU_PROGW
-PROGS+=$(QEMU_PROGW)
-endif
 STPFILES=

 ifndef CONFIG_HAIKU
@@ -47,14 +49,13 @@ else
 TARGET_TYPE=system
 endif

-$(QEMU_PROG).stp: $(SRC_PATH)/trace-events
-	$(call quiet-command,$(TRACETOOL) \
-		--format=stap \
-		--backend=$(TRACE_BACKEND) \
-		--binary=$(bindir)/$(QEMU_PROG) \
-		--target-arch=$(TARGET_ARCH) \
-		--target-type=$(TARGET_TYPE) \
-		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG).stp")
+$(QEMU_PROG).stp:
+	$(call quiet-command,sh $(SRC_PATH)/scripts/tracetool \
+		--$(TRACE_BACKEND) \
+		--binary $(bindir)/$(QEMU_PROG) \
+		--target-arch $(TARGET_ARCH) \
+		--target-type $(TARGET_TYPE) \
+		--stap < $(SRC_PATH)/trace-events > $(QEMU_PROG).stp,"  GEN   $(QEMU_PROG).stp")
 else
 stap:
 endif
@@ -66,97 +67,355 @@ all: $(PROGS) stap

 #########################################################
 # cpu emulator library
-obj-y = exec.o translate-all.o cpu-exec.o
-obj-y += tcg/tcg.o tcg/optimize.o
-obj-$(CONFIG_TCG_INTERPRETER) += tci.o
-obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
-obj-y += fpu/softfloat.o
-obj-y += target-$(TARGET_BASE_ARCH)/
-obj-y += disas.o
-obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o
+libobj-y = exec.o translate-all.o cpu-exec.o translate.o
+libobj-y += tcg/tcg.o tcg/optimize.o
+libobj-$(CONFIG_TCG_INTERPRETER) += tci.o
+libobj-y += fpu/softfloat.o
+libobj-y += op_helper.o helper.o
+ifeq ($(TARGET_BASE_ARCH), i386)
+libobj-y += cpuid.o
+endif
+libobj-$(TARGET_SPARC64) += vis_helper.o
+libobj-$(CONFIG_NEED_MMU) += mmu.o
+libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
+ifeq ($(TARGET_BASE_ARCH), sparc)
+libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
+libobj-y += cpu_init.o
+endif
+libobj-$(TARGET_SPARC) += int32_helper.o
+libobj-$(TARGET_SPARC64) += int64_helper.o
+
+libobj-y += disas.o
+libobj-$(CONFIG_TCI_DIS) += tci-dis.o
+
+tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci
+
+$(libobj-y): $(GENERATED_HEADERS)
+
+# libqemu
+
+translate.o: translate.c cpu.h
+
+translate-all.o: translate-all.c cpu.h
+
+tcg/tcg.o: cpu.h
+
+# HELPER_CFLAGS is used for all the code compiled with static register
+# variables
+op_helper.o ldst_helper.o user-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
+
+# Note: this is a workaround. The real fix is to avoid compiling
+# cpu_signal_handler() in user-exec.c.
+signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)

 #########################################################
 # Linux user emulator target

 ifdef CONFIG_LINUX_USER

-QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
+$(call set-vpath, $(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR))

-obj-y += linux-user/
-obj-y += gdbstub.o thunk.o user-exec.o
+QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user
+obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
+      elfload.o linuxload.o uaccess.o gdbstub.o cpu-uname.o \
+      user-exec.o $(oslib-obj-y)
+
+obj-$(TARGET_HAS_BFLT) += flatload.o
+
+obj-$(TARGET_I386) += vm86.o
+
+obj-i386-y += ioport-user.o
+
+nwfpe-obj-y = fpa11.o fpa11_cpdo.o fpa11_cpdt.o fpa11_cprt.o fpopcode.o
+nwfpe-obj-y += single_cpdo.o double_cpdo.o extended_cpdo.o
+obj-arm-y +=  $(addprefix nwfpe/, $(nwfpe-obj-y))
+obj-arm-y += arm-semi.o
+
+obj-m68k-y += m68k-sim.o m68k-semi.o
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../libuser/, $(user-obj-y))
+obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+obj-y += $(libobj-y)

 endif #CONFIG_LINUX_USER

+#########################################################
+# Darwin user emulator target
+
+ifdef CONFIG_DARWIN_USER
+
+$(call set-vpath, $(SRC_PATH)/darwin-user)
+
+QEMU_CFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
+
+# Leave some space for the regular program loading zone
+LDFLAGS+=-Wl,-segaddr,__STD_PROG_ZONE,0x1000 -image_base 0x0e000000
+
+LIBS+=-lmx
+
+obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
+        gdbstub.o user-exec.o
+
+obj-i386-y += ioport-user.o
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../libuser/, $(user-obj-y))
+obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+obj-y += $(libobj-y)
+
+endif #CONFIG_DARWIN_USER
+
 #########################################################
 # BSD user emulator target

 ifdef CONFIG_BSD_USER

+$(call set-vpath, $(SRC_PATH)/bsd-user)
+
 QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)

-obj-y += bsd-user/
-obj-y += gdbstub.o user-exec.o
+obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
+        gdbstub.o uaccess.o user-exec.o
+
+obj-i386-y += ioport-user.o
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../libuser/, $(user-obj-y))
+obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+obj-y += $(libobj-y)

 endif #CONFIG_BSD_USER

 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
-CONFIG_NO_PCI = $(if $(subst n,,$(CONFIG_PCI)),n,y)
-CONFIG_NO_KVM = $(if $(subst n,,$(CONFIG_KVM)),n,y)
-CONFIG_NO_XEN = $(if $(subst n,,$(CONFIG_XEN)),n,y)
-CONFIG_NO_GET_MEMORY_MAPPING = $(if $(subst n,,$(CONFIG_HAVE_GET_MEMORY_MAPPING)),n,y)
-CONFIG_NO_CORE_DUMP = $(if $(subst n,,$(CONFIG_HAVE_CORE_DUMP)),n,y)

-obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o
-obj-y += hw/
-obj-$(CONFIG_KVM) += kvm-all.o
+obj-y = arch_init.o cpus.o monitor.o machine.o gdbstub.o balloon.o ioport.o
+# virtio has to be here due to weird dependency between PCI and virtio-net.
+# need to fix this properly
+obj-$(CONFIG_NO_PCI) += pci-stub.o
+obj-$(CONFIG_VIRTIO) += virtio.o virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial-bus.o
+obj-y += vhost_net.o
+obj-$(CONFIG_VHOST_NET) += vhost.o
+obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p-device.o
+obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
-obj-y += memory.o savevm.o cputlb.o
-obj-$(CONFIG_HAVE_GET_MEMORY_MAPPING) += memory_mapping.o
-obj-$(CONFIG_HAVE_CORE_DUMP) += dump.o
-obj-$(CONFIG_NO_GET_MEMORY_MAPPING) += memory_mapping-stub.o
-obj-$(CONFIG_NO_CORE_DUMP) += dump-stub.o
+obj-y += memory.o
 LIBS+=-lz

+QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
+QEMU_CFLAGS += $(VNC_JPEG_CFLAGS)
+QEMU_CFLAGS += $(VNC_PNG_CFLAGS)
+QEMU_CFLAGS += $(GLIB_CFLAGS)
+
 # xen support
-obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
+obj-$(CONFIG_XEN) += xen-all.o xen_machine_pv.o xen_domainbuild.o xen-mapcache.o
 obj-$(CONFIG_NO_XEN) += xen-stub.o

-# Hardware support
-ifeq ($(TARGET_ARCH), sparc64)
-obj-y += hw/sparc64/
-else
-obj-y += hw/$(TARGET_BASE_ARCH)/
+obj-i386-$(CONFIG_XEN) += xen_platform.o
+
+# Inter-VM PCI shared memory
+CONFIG_IVSHMEM =
+ifeq ($(CONFIG_KVM), y)
+  ifeq ($(CONFIG_PCI), y)
+    CONFIG_IVSHMEM = y
+  endif
 endif
+obj-$(CONFIG_IVSHMEM) += ivshmem.o
+
+# Hardware support
+obj-i386-y += vga.o
+obj-i386-y += mc146818rtc.o pc.o
+obj-i386-y += cirrus_vga.o sga.o apic.o ioapic.o piix_pci.o
+obj-i386-y += vmport.o
+obj-i386-y += device-hotplug.o pci-hotplug.o smbios.o wdt_ib700.o
+obj-i386-y += debugcon.o multiboot.o
+obj-i386-y += pc_piix.o
+obj-i386-$(CONFIG_KVM) += kvmclock.o
+obj-i386-$(CONFIG_SPICE) += qxl.o qxl-logger.o qxl-render.o
+
+# shared objects
+obj-ppc-y = ppc.o ppc_booke.o
+obj-ppc-y += vga.o
+# PREP target
+obj-ppc-y += mc146818rtc.o
+obj-ppc-y += ppc_prep.o
+# OldWorld PowerMac
+obj-ppc-y += ppc_oldworld.o
+# NewWorld PowerMac
+obj-ppc-y += ppc_newworld.o
+# IBM pSeries (sPAPR)
+obj-ppc-$(CONFIG_PSERIES) += spapr.o spapr_hcall.o spapr_rtas.o spapr_vio.o
+obj-ppc-$(CONFIG_PSERIES) += xics.o spapr_vty.o spapr_llan.o spapr_vscsi.o
+obj-ppc-$(CONFIG_PSERIES) += spapr_pci.o device-hotplug.o pci-hotplug.o
+# PowerPC 4xx boards
+obj-ppc-y += ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
+obj-ppc-y += ppc440.o ppc440_bamboo.o
+# PowerPC E500 boards
+obj-ppc-y += ppce500_mpc8544ds.o mpc8544_guts.o ppce500_spin.o
+# PowerPC 440 Xilinx ML507 reference board.
+obj-ppc-y += virtex_ml507.o
+obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
+obj-ppc-$(CONFIG_FDT) += device_tree.o
+# PowerPC OpenPIC
+obj-ppc-y += openpic.o
+
+# Xilinx PPC peripherals
+obj-ppc-y += xilinx_intc.o
+obj-ppc-y += xilinx_timer.o
+obj-ppc-y += xilinx_uartlite.o
+obj-ppc-y += xilinx_ethlite.o
+
+# LM32 boards
+obj-lm32-y += lm32_boards.o
+obj-lm32-y += milkymist.o
+
+# LM32 peripherals
+obj-lm32-y += lm32_pic.o
+obj-lm32-y += lm32_juart.o
+obj-lm32-y += lm32_timer.o
+obj-lm32-y += lm32_uart.o
+obj-lm32-y += lm32_sys.o
+obj-lm32-y += milkymist-ac97.o
+obj-lm32-y += milkymist-hpdmc.o
+obj-lm32-y += milkymist-memcard.o
+obj-lm32-y += milkymist-minimac2.o
+obj-lm32-y += milkymist-pfpu.o
+obj-lm32-y += milkymist-softusb.o
+obj-lm32-y += milkymist-sysctl.o
+obj-lm32-$(CONFIG_OPENGL) += milkymist-tmu2.o
+obj-lm32-y += milkymist-uart.o
+obj-lm32-y += milkymist-vgafb.o
+obj-lm32-y += framebuffer.o
+
+obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
+obj-mips-y += mips_addr.o mips_timer.o mips_int.o
+obj-mips-y += vga.o
+obj-mips-y += jazz_led.o
+obj-mips-y += gt64xxx.o mc146818rtc.o
+obj-mips-y += cirrus_vga.o
+obj-mips-$(CONFIG_FULONG) += bonito.o vt82c686.o mips_fulong2e.o
+
+obj-microblaze-y = petalogix_s3adsp1800_mmu.o
+obj-microblaze-y += petalogix_ml605_mmu.o
+
+obj-microblaze-y += microblaze_pic_cpu.o
+obj-microblaze-y += xilinx_intc.o
+obj-microblaze-y += xilinx_timer.o
+obj-microblaze-y += xilinx_uartlite.o
+obj-microblaze-y += xilinx_ethlite.o
+obj-microblaze-y += xilinx_axidma.o
+obj-microblaze-y += xilinx_axienet.o
+
+obj-microblaze-$(CONFIG_FDT) += device_tree.o
+
+# Boards
+obj-cris-y = cris_pic_cpu.o
+obj-cris-y += cris-boot.o
+obj-cris-y += axis_dev88.o
+
+# IO blocks
+obj-cris-y += etraxfs_dma.o
+obj-cris-y += etraxfs_pic.o
+obj-cris-y += etraxfs_eth.o
+obj-cris-y += etraxfs_timer.o
+obj-cris-y += etraxfs_ser.o
+
+ifeq ($(TARGET_ARCH), sparc64)
+obj-sparc-y = sun4u.o apb_pci.o
+obj-sparc-y += vga.o
+obj-sparc-y += mc146818rtc.o
+obj-sparc-y += cirrus_vga.o
+else
+obj-sparc-y = sun4m.o lance.o tcx.o sun4m_iommu.o slavio_intctl.o
+obj-sparc-y += slavio_timer.o slavio_misc.o sparc32_dma.o
+obj-sparc-y += cs4231.o eccmemctl.o sbi.o sun4c_intctl.o leon3.o
+
+# GRLIB
+obj-sparc-y += grlib_gptimer.o grlib_irqmp.o grlib_apbuart.o
+endif
+
+obj-arm-y = integratorcp.o versatilepb.o arm_pic.o arm_timer.o
+obj-arm-y += arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
+obj-arm-y += versatile_pci.o
+obj-arm-y += realview_gic.o realview.o arm_sysctl.o arm11mpcore.o a9mpcore.o
+obj-arm-y += armv7m.o armv7m_nvic.o stellaris.o pl022.o stellaris_enet.o
+obj-arm-y += pl061.o
+obj-arm-y += arm-semi.o
+obj-arm-y += pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
+obj-arm-y += pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o pxa2xx_keypad.o
+obj-arm-y += gumstix.o
+obj-arm-y += zaurus.o ide/microdrive.o spitz.o tosa.o tc6393xb.o
+obj-arm-y += omap1.o omap_lcdc.o omap_dma.o omap_clk.o omap_mmc.o omap_i2c.o \
+		omap_gpio.o omap_intc.o omap_uart.o
+obj-arm-y += omap2.o omap_dss.o soc_dma.o omap_gptimer.o omap_synctimer.o \
+		omap_gpmc.o omap_sdrc.o omap_spi.o omap_tap.o omap_l4.o
+obj-arm-y += omap_sx1.o palm.o tsc210x.o
+obj-arm-y += nseries.o blizzard.o onenand.o vga.o cbus.o tusb6010.o usb-musb.o
+obj-arm-y += mst_fpga.o mainstone.o
+obj-arm-y += z2.o
+obj-arm-y += musicpal.o bitbang_i2c.o marvell_88w8618_audio.o
+obj-arm-y += framebuffer.o
+obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
+obj-arm-y += syborg_serial.o syborg_timer.o syborg_pointer.o syborg_rtc.o
+obj-arm-y += syborg_virtio.o
+obj-arm-y += vexpress.o
+obj-arm-y += strongarm.o
+obj-arm-y += collie.o
+obj-arm-y += pl041.o lm4549.o
+
+obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
+obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o
+obj-sh4-y += ide/mmio.o
+
+obj-m68k-y = an5206.o mcf5206.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
+obj-m68k-y += m68k-semi.o dummy_m68k.o
+
+obj-s390x-y = s390-virtio-bus.o s390-virtio.o
+
+obj-alpha-y = mc146818rtc.o
+obj-alpha-y += vga.o cirrus_vga.o
+obj-alpha-y += alpha_pci.o alpha_dp264.o alpha_typhoon.o
+
+obj-xtensa-y += xtensa_pic.o
+obj-xtensa-y += xtensa_sim.o
+obj-xtensa-y += xtensa_lx60.o
+obj-xtensa-y += xtensa-semi.o
+obj-xtensa-y += core-dc232b.o
+obj-xtensa-y += core-fsf.o

 main.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

-GENERATED_HEADERS += hmp-commands.h qmp-commands-old.h
+monitor.o: hmp-commands.h qmp-commands-old.h
+
+$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
+
+obj-y += $(addprefix ../, $(common-obj-y))
+obj-y += $(addprefix ../libdis/, $(libdis-y))
+obj-y += $(libobj-y)
+obj-y += $(addprefix $(HWDIR)/, $(hw-obj-y))
+obj-y += $(addprefix ../, $(trace-obj-y))

 endif # CONFIG_SOFTMMU

-# Workaround for http://gcc.gnu.org/PR55489, see configure.
-%/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
+ifndef CONFIG_LINUX_USER
+ifndef CONFIG_BSD_USER
+# libcacard needs qemu-thread support, and besides is only needed by devices
+# so not requires with linux-user / bsd-user targets
+obj-$(CONFIG_SMARTCARD_NSS) += $(addprefix ../libcacard/, $(libcacard-y))
+endif # CONFIG_BSD_USER
+endif # CONFIG_LINUX_USER

-nested-vars += obj-y
+obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o

-# This resolves all nested paths, so it must come last
-include $(SRC_PATH)/Makefile.objs
-
-all-obj-y = $(obj-y)
-all-obj-y += $(addprefix ../, $(common-obj-y))
-
-ifdef QEMU_PROGW
-# The linker builds a windows executable. Make also a console executable.
-$(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+$(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y)
 	$(call LINK,$^)
-$(QEMU_PROG): $(QEMU_PROGW)
-	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
-else
-$(QEMU_PROG): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
-	$(call LINK,$^)
-endif
+

 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")
@@ -168,8 +427,8 @@ qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

 clean:
-	rm -f *.a *~ $(PROGS)
-	rm -f $(shell find . -name '*.[od]')
+	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
+	rm -f *.d */*.d tcg/*.o ide/*.o 9pfs/*.o
 	rm -f hmp-commands.h qmp-commands-old.h gdbstub-xml.c
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
@@ -183,9 +442,9 @@ ifneq ($(STRIP),)
 endif
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
-	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
-	$(INSTALL_DATA) $(QEMU_PROG).stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
+	$(INSTALL_DIR) "$(DESTDIR)$(datadir)/../systemtap/tapset"
+	$(INSTALL_DATA) $(QEMU_PROG).stp "$(DESTDIR)$(datadir)/../systemtap/tapset"
 endif

-GENERATED_HEADERS += config-target.h
-Makefile: $(GENERATED_HEADERS)
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/Makefile.user
+++ b/Makefile.user
@@ -0,0 +1,25 @@
+# Makefile for qemu target independent user files.
+
+include ../config-host.mak
+include $(SRC_PATH)/rules.mak
+-include config.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(user-obj-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	for d in . trace; do \
+	rm -f $$d/*.o $$d/*.d $$d/*.a $$d/*~; \
+	done
+
+# Include automatically generated dependency files
+-include $(wildcard *.d */*.d)
--- a/QMP/qemu-ga-client
+++ b/QMP/qemu-ga-client
@@ -1,299 +0,0 @@
-#!/usr/bin/python
-
-# QEMU Guest Agent Client
-#
-# Copyright (C) 2012 Ryota Ozaki <ozaki.ryota@gmail.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2.  See
-# the COPYING file in the top-level directory.
-#
-# Usage:
-#
-# Start QEMU with:
-#
-# # qemu [...] -chardev socket,path=/tmp/qga.sock,server,nowait,id=qga0 \
-#   -device virtio-serial -device virtserialport,chardev=qga0,name=org.qemu.guest_agent.0
-#
-# Run the script:
-#
-# $ qemu-ga-client --address=/tmp/qga.sock <command> [args...]
-#
-# or
-#
-# $ export QGA_CLIENT_ADDRESS=/tmp/qga.sock
-# $ qemu-ga-client <command> [args...]
-#
-# For example:
-#
-# $ qemu-ga-client cat /etc/resolv.conf
-# # Generated by NetworkManager
-# nameserver 10.0.2.3
-# $ qemu-ga-client fsfreeze status
-# thawed
-# $ qemu-ga-client fsfreeze freeze
-# 2 filesystems frozen
-#
-# See also: http://wiki.qemu.org/Features/QAPI/GuestAgent
-#
-
-import base64
-import random
-
-import qmp
-
-
-class QemuGuestAgent(qmp.QEMUMonitorProtocol):
-    def __getattr__(self, name):
-        def wrapper(**kwds):
-            return self.command('guest-' + name.replace('_', '-'), **kwds)
-        return wrapper
-
-
-class QemuGuestAgentClient:
-    error = QemuGuestAgent.error
-
-    def __init__(self, address):
-        self.qga = QemuGuestAgent(address)
-        self.qga.connect(negotiate=False)
-
-    def sync(self, timeout=3):
-        # Avoid being blocked forever
-        if not self.ping(timeout):
-            raise EnvironmentError('Agent seems not alive')
-        uid = random.randint(0, (1 << 32) - 1)
-        while True:
-            ret = self.qga.sync(id=uid)
-            if isinstance(ret, int) and int(ret) == uid:
-                break
-
-    def __file_read_all(self, handle):
-        eof = False
-        data = ''
-        while not eof:
-            ret = self.qga.file_read(handle=handle, count=1024)
-            _data = base64.b64decode(ret['buf-b64'])
-            data += _data
-            eof = ret['eof']
-        return data
-
-    def read(self, path):
-        handle = self.qga.file_open(path=path)
-        try:
-            data = self.__file_read_all(handle)
-        finally:
-            self.qga.file_close(handle=handle)
-        return data
-
-    def info(self):
-        info = self.qga.info()
-
-        msgs = []
-        msgs.append('version: ' + info['version'])
-        msgs.append('supported_commands:')
-        enabled = [c['name'] for c in info['supported_commands'] if c['enabled']]
-        msgs.append('\tenabled: ' + ', '.join(enabled))
-        disabled = [c['name'] for c in info['supported_commands'] if not c['enabled']]
-        msgs.append('\tdisabled: ' + ', '.join(disabled))
-
-        return '\n'.join(msgs)
-
-    def __gen_ipv4_netmask(self, prefixlen):
-        mask = int('1' * prefixlen + '0' * (32 - prefixlen), 2)
-        return '.'.join([str(mask >> 24),
-                         str((mask >> 16) & 0xff),
-                         str((mask >> 8) & 0xff),
-                         str(mask & 0xff)])
-
-    def ifconfig(self):
-        nifs = self.qga.network_get_interfaces()
-
-        msgs = []
-        for nif in nifs:
-            msgs.append(nif['name'] + ':')
-            if 'ip-addresses' in nif:
-                for ipaddr in nif['ip-addresses']:
-                    if ipaddr['ip-address-type'] == 'ipv4':
-                        addr = ipaddr['ip-address']
-                        mask = self.__gen_ipv4_netmask(int(ipaddr['prefix']))
-                        msgs.append("\tinet %s  netmask %s" % (addr, mask))
-                    elif ipaddr['ip-address-type'] == 'ipv6':
-                        addr = ipaddr['ip-address']
-                        prefix = ipaddr['prefix']
-                        msgs.append("\tinet6 %s  prefixlen %s" % (addr, prefix))
-            if nif['hardware-address'] != '00:00:00:00:00:00':
-                msgs.append("\tether " + nif['hardware-address'])
-
-        return '\n'.join(msgs)
-
-    def ping(self, timeout):
-        self.qga.settimeout(timeout)
-        try:
-            self.qga.ping()
-        except self.qga.timeout:
-            return False
-        return True
-
-    def fsfreeze(self, cmd):
-        if cmd not in ['status', 'freeze', 'thaw']:
-            raise StandardError('Invalid command: ' + cmd)
-
-        return getattr(self.qga, 'fsfreeze' + '_' + cmd)()
-
-    def fstrim(self, minimum=0):
-        return getattr(self.qga, 'fstrim')(minimum=minimum)
-
-    def suspend(self, mode):
-        if mode not in ['disk', 'ram', 'hybrid']:
-            raise StandardError('Invalid mode: ' + mode)
-
-        try:
-            getattr(self.qga, 'suspend' + '_' + mode)()
-            # On error exception will raise
-        except self.qga.timeout:
-            # On success command will timed out
-            return
-
-    def shutdown(self, mode='powerdown'):
-        if mode not in ['powerdown', 'halt', 'reboot']:
-            raise StandardError('Invalid mode: ' + mode)
-
-        try:
-            self.qga.shutdown(mode=mode)
-        except self.qga.timeout:
-            return
-
-
-def _cmd_cat(client, args):
-    if len(args) != 1:
-        print('Invalid argument')
-        print('Usage: cat <file>')
-        sys.exit(1)
-    print(client.read(args[0]))
-
-
-def _cmd_fsfreeze(client, args):
-    usage = 'Usage: fsfreeze status|freeze|thaw'
-    if len(args) != 1:
-        print('Invalid argument')
-        print(usage)
-        sys.exit(1)
-    if args[0] not in ['status', 'freeze', 'thaw']:
-        print('Invalid command: ' + args[0])
-        print(usage)
-        sys.exit(1)
-    cmd = args[0]
-    ret = client.fsfreeze(cmd)
-    if cmd == 'status':
-        print(ret)
-    elif cmd == 'freeze':
-        print("%d filesystems frozen" % ret)
-    else:
-        print("%d filesystems thawed" % ret)
-
-
-def _cmd_fstrim(client, args):
-    if len(args) == 0:
-        minimum = 0
-    else:
-        minimum = int(args[0])
-    print(client.fstrim(minimum))
-
-
-def _cmd_ifconfig(client, args):
-    print(client.ifconfig())
-
-
-def _cmd_info(client, args):
-    print(client.info())
-
-
-def _cmd_ping(client, args):
-    if len(args) == 0:
-        timeout = 3
-    else:
-        timeout = float(args[0])
-    alive = client.ping(timeout)
-    if not alive:
-        print("Not responded in %s sec" % args[0])
-        sys.exit(1)
-
-
-def _cmd_suspend(client, args):
-    usage = 'Usage: suspend disk|ram|hybrid'
-    if len(args) != 1:
-        print('Less argument')
-        print(usage)
-        sys.exit(1)
-    if args[0] not in ['disk', 'ram', 'hybrid']:
-        print('Invalid command: ' + args[0])
-        print(usage)
-        sys.exit(1)
-    client.suspend(args[0])
-
-
-def _cmd_shutdown(client, args):
-    client.shutdown()
-_cmd_powerdown = _cmd_shutdown
-
-
-def _cmd_halt(client, args):
-    client.shutdown('halt')
-
-
-def _cmd_reboot(client, args):
-    client.shutdown('reboot')
-
-
-commands = [m.replace('_cmd_', '') for m in dir() if '_cmd_' in m]
-
-
-def main(address, cmd, args):
-    if not os.path.exists(address):
-        print('%s not found' % address)
-        sys.exit(1)
-
-    if cmd not in commands:
-        print('Invalid command: ' + cmd)
-        print('Available commands: ' + ', '.join(commands))
-        sys.exit(1)
-
-    try:
-        client = QemuGuestAgentClient(address)
-    except QemuGuestAgent.error, e:
-        import errno
-
-        print(e)
-        if e.errno == errno.ECONNREFUSED:
-            print('Hint: qemu is not running?')
-        sys.exit(1)
-
-    if cmd != 'ping':
-        client.sync()
-
-    globals()['_cmd_' + cmd](client, args)
-
-
-if __name__ == '__main__':
-    import sys
-    import os
-    import optparse
-
-    address = os.environ['QGA_CLIENT_ADDRESS'] if 'QGA_CLIENT_ADDRESS' in os.environ else None
-
-    usage = "%prog [--address=<unix_path>|<ipv4_address>] <command> [args...]\n"
-    usage += '<command>: ' + ', '.join(commands)
-    parser = optparse.OptionParser(usage=usage)
-    parser.add_option('--address', action='store', type='string',
-                      default=address, help='Specify a ip:port pair or a unix socket path')
-    options, args = parser.parse_args()
-
-    address = options.address
-    if address is None:
-        parser.error('address is not specified')
-        sys.exit(1)
-
-    if len(args) == 0:
-        parser.error('Less argument')
-        sys.exit(1)
-
-    main(address, args[0], args[1:])
--- a/QMP/qmp
+++ b/QMP/qmp
@@ -1,126 +0,0 @@
-#!/usr/bin/python
-#
-# QMP command line tool
-#
-# Copyright IBM, Corp. 2011
-#
-# Authors:
-#  Anthony Liguori <aliguori@us.ibm.com>
-#
-# This work is licensed under the terms of the GNU GPLv2 or later.
-# See the COPYING file in the top-level directory.
-
-import sys, os
-from qmp import QEMUMonitorProtocol
-
-def print_response(rsp, prefix=[]):
-    if type(rsp) == list:
-        i = 0
-        for item in rsp:
-            if prefix == []:
-                prefix = ['item']
-            print_response(item, prefix[:-1] + ['%s[%d]' % (prefix[-1], i)])
-            i += 1
-    elif type(rsp) == dict:
-        for key in rsp.keys():
-            print_response(rsp[key], prefix + [key])
-    else:
-        if len(prefix):
-            print '%s: %s' % ('.'.join(prefix), rsp)
-        else:
-            print '%s' % (rsp)
-
-def main(args):
-    path = None
-
-    # Use QMP_PATH if it's set
-    if os.environ.has_key('QMP_PATH'):
-        path = os.environ['QMP_PATH']
-
-    while len(args):
-        arg = args[0]
-
-        if arg.startswith('--'):
-            arg = arg[2:]
-            if arg.find('=') == -1:
-                value = True
-            else:
-                arg, value = arg.split('=', 1)
-
-            if arg in ['path']:
-                if type(value) == str:
-                    path = value
-            elif arg in ['help']:
-                os.execlp('man', 'man', 'qmp')
-            else:
-                print 'Unknown argument "%s"' % arg
-
-            args = args[1:]
-        else:
-            break
-
-    if not path:
-        print "QMP path isn't set, use --path=qmp-monitor-address or set QMP_PATH"
-        return 1
-
-    if len(args):
-        command, args = args[0], args[1:]
-    else:
-        print 'No command found'
-        print 'Usage: "qmp [--path=qmp-monitor-address] qmp-cmd arguments"'
-        return 1
-
-    if command in ['help']:
-        os.execlp('man', 'man', 'qmp')
-
-    srv = QEMUMonitorProtocol(path)
-    srv.connect()
-
-    def do_command(srv, cmd, **kwds):
-        rsp = srv.cmd(cmd, kwds)
-        if rsp.has_key('error'):
-            raise Exception(rsp['error']['desc'])
-        return rsp['return']
-
-    commands = map(lambda x: x['name'], do_command(srv, 'query-commands'))
-
-    srv.close()
-
-    if command not in commands:
-        fullcmd = 'qmp-%s' % command
-        try:
-            os.environ['QMP_PATH'] = path
-            os.execvp(fullcmd, [fullcmd] + args)
-        except OSError, (errno, msg):
-            if errno == 2:
-                print 'Command "%s" not found.' % (fullcmd)
-                return 1
-            raise
-        return 0
-
-    srv = QEMUMonitorProtocol(path)
-    srv.connect()
-
-    arguments = {}
-    for arg in args:
-        if not arg.startswith('--'):
-            print 'Unknown argument "%s"' % arg
-            return 1
-
-        arg = arg[2:]
-        if arg.find('=') == -1:
-            value = True
-        else:
-            arg, value = arg.split('=', 1)
-
-        if arg in ['help']:
-            os.execlp('man', 'man', 'qmp-%s' % command)
-            return 1
-
-        arguments[arg] = value
-
-    rsp = do_command(srv, command, **arguments)
-    print_response(rsp)
-
-if __name__ == '__main__':
-    sys.exit(main(sys.argv[1:]))
--- a/QMP/qmp-events.txt
+++ b/QMP/qmp-events.txt
@@ -1,23 +1,6 @@
                   QEMU Monitor Protocol Events
                   ============================

-BALLOON_CHANGE
--------------
-
-Emitted when the guest changes the actual BALLOON level. This
-value is equivalent to the 'actual' field return by the
-'query-balloon' command
-
-Data:
-
- "actual": actual level of the guest memory balloon in bytes (json-number)
-
-Example:
-
-{ "event": "BALLOON_CHANGE",
-    "data": { "actual": 944766976 },
-    "timestamp": { "seconds": 1267020223, "microseconds": 435656 } }
-
 BLOCK_IO_ERROR
 --------------

@@ -43,117 +26,6 @@ Example:
 Note: If action is "stop", a STOP event will eventually follow the
 BLOCK_IO_ERROR event.

-BLOCK_JOB_CANCELLED
-------------------
-
-Emitted when a block job has been cancelled.
-
-Data:
-
- "type":     Job type (json-string; "stream" for image streaming
-                                     "commit" for block commit)
- "device":   Device name (json-string)
- "len":      Maximum progress value (json-int)
- "offset":   Current progress value (json-int)
-              On success this is equal to len.
-              On failure this is less than len.
- "speed":    Rate limit, bytes per second (json-int)
-
-Example:
-
-{ "event": "BLOCK_JOB_CANCELLED",
-     "data": { "type": "stream", "device": "virtio-disk0",
-               "len": 10737418240, "offset": 134217728,
-               "speed": 0 },
-     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
-
-BLOCK_JOB_COMPLETED
-------------------
-
-Emitted when a block job has completed.
-
-Data:
-
- "type":     Job type (json-string; "stream" for image streaming
-                                     "commit" for block commit)
- "device":   Device name (json-string)
- "len":      Maximum progress value (json-int)
- "offset":   Current progress value (json-int)
-              On success this is equal to len.
-              On failure this is less than len.
- "speed":    Rate limit, bytes per second (json-int)
- "error":    Error message (json-string, optional)
-              Only present on failure.  This field contains a human-readable
-              error message.  There are no semantics other than that streaming
-              has failed and clients should not try to interpret the error
-              string.
-
-Example:
-
-{ "event": "BLOCK_JOB_COMPLETED",
-     "data": { "type": "stream", "device": "virtio-disk0",
-               "len": 10737418240, "offset": 10737418240,
-               "speed": 0 },
-     "timestamp": { "seconds": 1267061043, "microseconds": 959568 } }
-
-BLOCK_JOB_ERROR
---------------
-
-Emitted when a block job encounters an error.
-
-Data:
-
- "device": device name (json-string)
- "operation": I/O operation (json-string, "read" or "write")
- "action": action that has been taken, it's one of the following (json-string):
-    "ignore": error has been ignored, the job may fail later
-    "report": error will be reported and the job canceled
-    "stop": error caused job to be paused
-
-Example:
-
-{ "event": "BLOCK_JOB_ERROR",
-    "data": { "device": "ide0-hd1",
-              "operation": "write",
-              "action": "stop" },
-    "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
-BLOCK_JOB_READY
---------------
-
-Emitted when a block job is ready to complete.
-
-Data:
-
- "device": device name (json-string)
-
-Example:
-
-{ "event": "BLOCK_JOB_READY",
-    "data": { "device": "ide0-hd1" },
-    "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
-Note: The "ready to complete" status is always reset by a BLOCK_JOB_ERROR
-event.
-
-DEVICE_TRAY_MOVED
-----------------
-
-It's emitted whenever the tray of a removable device is moved by the guest
-or by HMP/QMP commands.
-
-Data:
-
- "device": device name (json-string)
- "tray-open": true if the tray has been opened or false if it has been closed
-               (json-bool)
-
-{ "event": "DEVICE_TRAY_MOVED",
-  "data": { "device": "ide1-cd0",
-            "tray-open": true
-  },
-  "timestamp": { "seconds": 1265044230, "microseconds": 450486 } }
-
 RESET
 -----

@@ -208,68 +80,6 @@ Example:
 Note: If the command-line option "-no-shutdown" has been specified, a STOP
 event will eventually follow the SHUTDOWN event.

-SPICE_CONNECTED, SPICE_DISCONNECTED
-----------------------------------
-
-Emitted when a SPICE client connects or disconnects.
-
-Data:
-
- "server": Server information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
- "client": Client information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-
-Example:
-
-{ "timestamp": {"seconds": 1290688046, "microseconds": 388707},
-  "event": "SPICE_CONNECTED",
-  "data": {
-    "server": { "port": "5920", "family": "ipv4", "host": "127.0.0.1"},
-    "client": {"port": "52873", "family": "ipv4", "host": "127.0.0.1"}
-}}
-
-SPICE_INITIALIZED
-----------------
-
-Emitted after initial handshake and authentication takes place (if any)
-and the SPICE channel is up'n'running
-
-Data:
-
- "server": Server information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-  - "auth": authentication method (json-string, optional)
- "client": Client information (json-object)
-  - "host": IP address (json-string)
-  - "port": port number (json-string)
-  - "family": address family (json-string, "ipv4" or "ipv6")
-  - "connection-id": spice connection id.  All channels with the same id
-                     belong to the same spice session (json-int)
-  - "channel-type": channel type.  "1" is the main control channel, filter for
-                    this one if you want track spice sessions only (json-int)
-  - "channel-id": channel id.  Usually "0", might be different needed when
-                  multiple channels of the same type exist, such as multiple
-                  display channels in a multihead setup (json-int)
-  - "tls": whevener the channel is encrypted (json-bool)
-
-Example:
-
-{ "timestamp": {"seconds": 1290688046, "microseconds": 417172},
-  "event": "SPICE_INITIALIZED",
-  "data": {"server": {"auth": "spice", "port": "5921",
-                      "family": "ipv4", "host": "127.0.0.1"},
-           "client": {"port": "49004", "family": "ipv4", "channel-type": 3,
-                      "connection-id": 1804289383, "host": "127.0.0.1",
-                      "channel-id": 0, "tls": true}
-}}
-
 STOP
 ----

@@ -282,32 +92,6 @@ Example:
 { "event": "STOP",
    "timestamp": { "seconds": 1267041730, "microseconds": 281295 } }

-SUSPEND
-------
-
-Emitted when guest enters S3 state.
-
-Data: None.
-
-Example:
-
-{ "event": "SUSPEND",
-     "timestamp": { "seconds": 1344456160, "microseconds": 309119 } }
-
-SUSPEND_DISK
------------
-
-Emitted when the guest makes a request to enter S4 state.
-
-Data: None.
-
-Example:
-
-{ "event": "SUSPEND_DISK",
-     "timestamp": { "seconds": 1344456160, "microseconds": 309119 } }
-
-Note: QEMU shuts down when entering S4 state.
-
 VNC_CONNECTED
 -------------

@@ -342,7 +126,7 @@ the authentication ID is not provided.
 VNC_DISCONNECTED
 ----------------

-Emitted when the connection is closed.
+Emitted when the conection is closed.

 Data:

@@ -398,17 +182,69 @@ Example:
                    "host": "127.0.0.1", "sasl_username": "luiz" } },
        "timestamp": { "seconds": 1263475302, "microseconds": 150772 } }

-WAKEUP
------
+SPICE_CONNECTED, SPICE_DISCONNECTED
+-----------------------------------

-Emitted when the guest has woken up from S3 and is running.
+Emitted when a SPICE client connects or disconnects.

-Data: None.
+Data:
+
+- "server": Server information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+- "client": Client information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")

 Example:

-{ "event": "WATCHDOG",
-     "timestamp": { "seconds": 1344522075, "microseconds": 745528 } }
+{ "timestamp": {"seconds": 1290688046, "microseconds": 388707},
+  "event": "SPICE_CONNECTED",
+  "data": {
+    "server": { "port": "5920", "family": "ipv4", "host": "127.0.0.1"},
+    "client": {"port": "52873", "family": "ipv4", "host": "127.0.0.1"}
+}}
+
+
+SPICE_INITIALIZED
+-----------------
+
+Emitted after initial handshake and authentication takes place (if any)
+and the SPICE channel is up'n'running
+
+Data:
+
+- "server": Server information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+  - "auth": authentication method (json-string, optional)
+- "client": Client information (json-object)
+  - "host": IP address (json-string)
+  - "port": port number (json-string)
+  - "family": address family (json-string, "ipv4" or "ipv6")
+  - "connection-id": spice connection id.  All channels with the same id
+                     belong to the same spice session (json-int)
+  - "channel-type": channel type.  "1" is the main control channel, filter for
+                    this one if you want track spice sessions only (json-int)
+  - "channel-id": channel id.  Usually "0", might be different needed when
+                  multiple channels of the same type exist, such as multiple
+                  display channels in a multihead setup (json-int)
+  - "tls": whevener the channel is encrypted (json-bool)
+
+Example:
+
+{ "timestamp": {"seconds": 1290688046, "microseconds": 417172},
+  "event": "SPICE_INITIALIZED",
+  "data": {"server": {"auth": "spice", "port": "5921",
+                      "family": "ipv4", "host": "127.0.0.1"},
+           "client": {"port": "49004", "family": "ipv4", "channel-type": 3,
+                      "connection-id": 1804289383, "host": "127.0.0.1",
+                      "channel-id": 0, "tls": true}
+}}
+

 WATCHDOG
 --------
--- a/QMP/qmp-shell
+++ b/QMP/qmp-shell
@@ -33,7 +33,6 @@
 import qmp
 import readline
 import sys
-import pprint

 class QMPCompleter(list):
    def complete(self, text, state):
@@ -53,11 +52,10 @@ class QMPShellBadPort(QMPShellError):
 # TODO: QMPShell's interface is a bit ugly (eg. _fill_completion() and
 #       _execute_cmd()). Let's design a better one.
 class QMPShell(qmp.QEMUMonitorProtocol):
-    def __init__(self, address, pp=None):
+    def __init__(self, address):
        qmp.QEMUMonitorProtocol.__init__(self, self.__get_address(address))
        self._greeting = None
        self._completer = None
-        self._pp = pp

    def __get_address(self, arg):
        """
@@ -116,11 +114,7 @@ class QMPShell(qmp.QEMUMonitorProtocol):
        if resp is None:
            print 'Disconnected'
            return False
-
-        if self._pp is not None:
-            self._pp.pprint(resp)
-        else:
-            print resp
+        print resp
        return True

    def connect(self):
@@ -228,36 +222,22 @@ def die(msg):
 def fail_cmdline(option=None):
    if option:
        sys.stderr.write('ERROR: bad command-line option \'%s\'\n' % option)
-    sys.stderr.write('qemu-shell [ -p ] [ -H ] < UNIX socket path> | < TCP address:port >\n')
+    sys.stderr.write('qemu-shell [ -H ] < UNIX socket path> | < TCP address:port >\n')
    sys.exit(1)

 def main():
    addr = ''
-    qemu = None
-    hmp = False
-    pp = None
-
    try:
-        for arg in sys.argv[1:]:
-            if arg == "-H":
-                if qemu is not None:
-                    fail_cmdline(arg)
-                hmp = True
-            elif arg == "-p":
-                if pp is not None:
-                    fail_cmdline(arg)
-                pp = pprint.PrettyPrinter(indent=4)
-            else:
-                if qemu is not None:
-                    fail_cmdline(arg)
-                if hmp:
-                    qemu = HMPShell(arg)
-                else:
-                    qemu = QMPShell(arg, pp)
-                addr = arg
-
-        if qemu is None:
-            fail_cmdline()
+        if len(sys.argv) == 2:
+            qemu = QMPShell(sys.argv[1])
+            addr = sys.argv[1]
+        elif len(sys.argv) == 3:
+            if sys.argv[1] != '-H':
+                fail_cmdline(sys.argv[1])
+            qemu = HMPShell(sys.argv[2])
+            addr = sys.argv[2]
+        else:
+                fail_cmdline()
    except QMPShellBadPort:
        die('bad port number in command-line')

--- a/QMP/qmp-spec.txt
+++ b/QMP/qmp-spec.txt
@@ -106,11 +106,14 @@ completed because of an error condition.

 The format is:

-{ "error": { "class": json-string, "desc": json-string }, "id": json-value }
+{ "error": { "class": json-string, "data": json-object, "desc": json-string },
+  "id": json-value }

 Where,

- The "class" member contains the error class name (eg. "GenericError")
+- The "class" member contains the error class name (eg. "ServiceUnavailable")
+- The "data" member contains specific error data and is defined in a
+  per-command basis, it will be an empty json-object if the error has no data
 - The "desc" member is a human-readable error message. Clients should
  not attempt to parse this message.
 - The "id" member contains the transaction identification associated with
@@ -170,7 +173,8 @@ S: {"return": {"enabled": true, "present": true}, "id": "example"}
 ------------------

 C: { "execute": }
-S: {"error": {"class": "GenericError", "desc": "Invalid JSON syntax" } }
+S: {"error": {"class": "JSONParsing", "desc": "Invalid JSON syntax", "data":
+{}}}

 3.5 Powerdown event
 -------------------
@@ -205,27 +209,13 @@ incompatible way are disabled by default and will be advertised by the
 capabilities array (section '2.2 Server Greeting'). Thus, Clients can check
 that array and enable the capabilities they support.

-The QMP Server performs a type check on the arguments to a command.  It
-generates an error if a value does not have the expected type for its
-key, or if it does not understand a key that the Client included.  The
-strictness of the Server catches wrong assumptions of Clients about
-the Server's schema.  Clients can assume that, when such validation
-errors occur, they will be reported before the command generated any
-side effect.
+Additionally, Clients must not assume any particular:

-However, Clients must not assume any particular:
-
- Length of json-arrays
- Size of json-objects; in particular, future versions of QEMU may add
-  new keys and Clients should be able to ignore them.
+- Size of json-objects or length of json-arrays
 - Order of json-object members or json-array elements
 - Amount of errors generated by a command, that is, new errors can be added
  to any existing command in newer versions of the Server

-Of course, the Server does guarantee to send valid JSON.  But apart from
-this, a Client should be "conservative in what they send, and liberal in
-what they accept".
-
 6. Downstream extension of QMP
 ------------------------------

--- a/QMP/qmp.py
+++ b/QMP/qmp.py
@@ -49,6 +49,7 @@ class QEMUMonitorProtocol:
        return socket.socket(family, socket.SOCK_STREAM)

    def __negotiate_capabilities(self):
+        self.__sockfile = self.__sock.makefile()
        greeting = self.__json_read()
        if greeting is None or not greeting.has_key('QMP'):
            raise QMPConnectError
@@ -72,7 +73,7 @@ class QEMUMonitorProtocol:

    error = socket.error

-    def connect(self, negotiate=True):
+    def connect(self):
        """
        Connect to the QMP Monitor and perform capabilities negotiation.

@@ -82,9 +83,7 @@ class QEMUMonitorProtocol:
        @raise QMPCapabilitiesError if fails to negotiate capabilities
        """
        self.__sock.connect(self.__address)
-        self.__sockfile = self.__sock.makefile()
-        if negotiate:
-            return self.__negotiate_capabilities()
+        return self.__negotiate_capabilities()

    def accept(self):
        """
@@ -96,7 +95,6 @@ class QEMUMonitorProtocol:
        @raise QMPCapabilitiesError if fails to negotiate capabilities
        """
        self.__sock, _ = self.__sock.accept()
-        self.__sockfile = self.__sock.makefile()
        return self.__negotiate_capabilities()

    def cmd_obj(self, qmp_cmd):
@@ -130,32 +128,6 @@ class QEMUMonitorProtocol:
            qmp_cmd['id'] = id
        return self.cmd_obj(qmp_cmd)

-    def command(self, cmd, **kwds):
-        ret = self.cmd(cmd, kwds)
-        if ret.has_key('error'):
-            raise Exception(ret['error']['desc'])
-        return ret['return']
-
-    def pull_event(self, wait=False):
-        """
-        Get and delete the first available QMP event.
-
-        @param wait: block until an event is available (bool)
-        """
-        self.__sock.setblocking(0)
-        try:
-            self.__json_read()
-        except socket.error, err:
-            if err[0] == errno.EAGAIN:
-                # No data available
-                pass
-        self.__sock.setblocking(1)
-        if not self.__events and wait:
-            self.__json_read(only_event=True)
-        event = self.__events[0]
-        del self.__events[0]
-        return event
-
    def get_events(self, wait=False):
        """
        Get a list of available QMP events.
@@ -183,8 +155,3 @@ class QEMUMonitorProtocol:
    def close(self):
        self.__sock.close()
        self.__sockfile.close()
-
-    timeout = socket.timeout
-
-    def settimeout(self, timeout):
-        self.__sock.settimeout(timeout)
--- a/QMP/qom-fuse
+++ b/QMP/qom-fuse
@@ -1,138 +0,0 @@
-#!/usr/bin/python
-##
-# QEMU Object Model test tools
-#
-# Copyright IBM, Corp. 2012
-#
-# Authors:
-#  Anthony Liguori   <aliguori@us.ibm.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or later.  See
-# the COPYING file in the top-level directory.
-##
-
-import fuse, stat
-from fuse import Fuse
-import os, posix
-from errno import *
-from qmp import QEMUMonitorProtocol
-
-fuse.fuse_python_api = (0, 2)
-
-class QOMFS(Fuse):
-    def __init__(self, qmp, *args, **kwds):
-        Fuse.__init__(self, *args, **kwds)
-        self.qmp = qmp
-        self.qmp.connect()
-        self.ino_map = {}
-        self.ino_count = 1
-
-    def get_ino(self, path):
-        if self.ino_map.has_key(path):
-            return self.ino_map[path]
-        self.ino_map[path] = self.ino_count
-        self.ino_count += 1
-        return self.ino_map[path]
-
-    def is_object(self, path):
-        try:
-            items = self.qmp.command('qom-list', path=path)
-            return True
-        except:
-            return False
-
-    def is_property(self, path):
-        try:
-            path, prop = path.rsplit('/', 1)
-            for item in self.qmp.command('qom-list', path=path):
-                if item['name'] == prop:
-                    return True
-            return False
-        except:
-            return False
-
-    def is_link(self, path):
-        try:
-            path, prop = path.rsplit('/', 1)
-            for item in self.qmp.command('qom-list', path=path):
-                if item['name'] == prop:
-                    if item['type'].startswith('link<'):
-                        return True
-                    return False
-            return False
-        except:
-            return False
-
-    def read(self, path, length, offset):
-        if not self.is_property(path):
-            return -ENOENT
-
-        path, prop = path.rsplit('/', 1)
-        try:
-            data = str(self.qmp.command('qom-get', path=path, property=prop))
-            data += '\n' # make values shell friendly
-        except:
-            return -EPERM
-
-        if offset > len(data):
-            return ''
-
-        return str(data[offset:][:length])
-
-    def readlink(self, path):
-        if not self.is_link(path):
-            return False
-        path, prop = path.rsplit('/', 1)
-        prefix = '/'.join(['..'] * (len(path.split('/')) - 1))
-        return prefix + str(self.qmp.command('qom-get', path=path,
-                                             property=prop))
-
-    def getattr(self, path):
-        if self.is_link(path):
-            value = posix.stat_result((0755 | stat.S_IFLNK,
-                                       self.get_ino(path),
-                                       0,
-                                       2,
-                                       1000,
-                                       1000,
-                                       4096,
-                                       0,
-                                       0,
-                                       0))
-        elif self.is_object(path):
-            value = posix.stat_result((0755 | stat.S_IFDIR,
-                                       self.get_ino(path),
-                                       0,
-                                       2,
-                                       1000,
-                                       1000,
-                                       4096,
-                                       0,
-                                       0,
-                                       0))
-        elif self.is_property(path):
-            value = posix.stat_result((0644 | stat.S_IFREG,
-                                       self.get_ino(path),
-                                       0,
-                                       1,
-                                       1000,
-                                       1000,
-                                       4096,
-                                       0,
-                                       0,
-                                       0))
-        else:
-            value = -ENOENT
-        return value
-
-    def readdir(self, path, offset):
-        yield fuse.Direntry('.')
-        yield fuse.Direntry('..')
-        for item in self.qmp.command('qom-list', path=path):
-            yield fuse.Direntry(str(item['name']))
-
-if __name__ == '__main__':
-    import sys, os
-
-    fs = QOMFS(QEMUMonitorProtocol(os.environ['QMP_SOCKET']))
-    fs.main(sys.argv)
--- a/QMP/qom-get
+++ b/QMP/qom-get
@@ -1,67 +0,0 @@
-#!/usr/bin/python
-##
-# QEMU Object Model test tools
-#
-# Copyright IBM, Corp. 2011
-#
-# Authors:
-#  Anthony Liguori   <aliguori@us.ibm.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or later.  See
-# the COPYING file in the top-level directory.
-##
-
-import sys
-import os
-from qmp import QEMUMonitorProtocol
-
-cmd, args = sys.argv[0], sys.argv[1:]
-socket_path = None
-path = None
-prop = None
-
-def usage():
-    return '''environment variables:
-    QMP_SOCKET=<path | addr:port>
-usage:
-    %s [-h] [-s <QMP socket path | addr:port>] <path>.<property>
-''' % cmd
-
-def usage_error(error_msg = "unspecified error"):
-    sys.stderr.write('%s\nERROR: %s\n' % (usage(), error_msg))
-    exit(1)
-
-if len(args) > 0:
-    if args[0] == "-h":
-        print usage()
-        exit(0);
-    elif args[0] == "-s":
-        try:
-            socket_path = args[1]
-        except:
-            usage_error("missing argument: QMP socket path or address");
-        args = args[2:]
-
-if not socket_path:
-    if os.environ.has_key('QMP_SOCKET'):
-        socket_path = os.environ['QMP_SOCKET']
-    else:
-        usage_error("no QMP socket path or address given");
-
-if len(args) > 0:
-    try:
-        path, prop = args[0].rsplit('.', 1)
-    except:
-        usage_error("invalid format for path/property/value")
-else:
-    usage_error("not enough arguments")
-
-srv = QEMUMonitorProtocol(socket_path)
-srv.connect()
-
-rsp = srv.command('qom-get', path=path, property=prop)
-if type(rsp) == dict:
-    for i in rsp.keys():
-        print '%s: %s' % (i, rsp[i])
-else:
-    print rsp
--- a/QMP/qom-list
+++ b/QMP/qom-list
@@ -1,64 +0,0 @@
-#!/usr/bin/python
-##
-# QEMU Object Model test tools
-#
-# Copyright IBM, Corp. 2011
-#
-# Authors:
-#  Anthony Liguori   <aliguori@us.ibm.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or later.  See
-# the COPYING file in the top-level directory.
-##
-
-import sys
-import os
-from qmp import QEMUMonitorProtocol
-
-cmd, args = sys.argv[0], sys.argv[1:]
-socket_path = None
-path = None
-prop = None
-
-def usage():
-    return '''environment variables:
-    QMP_SOCKET=<path | addr:port>
-usage:
-    %s [-h] [-s <QMP socket path | addr:port>] [<path>]
-''' % cmd
-
-def usage_error(error_msg = "unspecified error"):
-    sys.stderr.write('%s\nERROR: %s\n' % (usage(), error_msg))
-    exit(1)
-
-if len(args) > 0:
-    if args[0] == "-h":
-        print usage()
-        exit(0);
-    elif args[0] == "-s":
-        try:
-            socket_path = args[1]
-        except:
-            usage_error("missing argument: QMP socket path or address");
-        args = args[2:]
-
-if not socket_path:
-    if os.environ.has_key('QMP_SOCKET'):
-        socket_path = os.environ['QMP_SOCKET']
-    else:
-        usage_error("no QMP socket path or address given");
-
-srv = QEMUMonitorProtocol(socket_path)
-srv.connect()
-
-if len(args) == 0:
-    print '/'
-    sys.exit(0)
-
-for item in srv.command('qom-list', path=args[0]):
-    if item['type'].startswith('child<'):
-        print '%s/' % item['name']
-    elif item['type'].startswith('link<'):
-        print '@%s/' % item['name']
-    else:
-        print '%s' % item['name']
--- a/QMP/qom-set
+++ b/QMP/qom-set
@@ -1,64 +0,0 @@
-#!/usr/bin/python
-##
-# QEMU Object Model test tools
-#
-# Copyright IBM, Corp. 2011
-#
-# Authors:
-#  Anthony Liguori   <aliguori@us.ibm.com>
-#
-# This work is licensed under the terms of the GNU GPL, version 2 or later.  See
-# the COPYING file in the top-level directory.
-##
-
-import sys
-import os
-from qmp import QEMUMonitorProtocol
-
-cmd, args = sys.argv[0], sys.argv[1:]
-socket_path = None
-path = None
-prop = None
-value = None
-
-def usage():
-    return '''environment variables:
-    QMP_SOCKET=<path | addr:port>
-usage:
-    %s [-h] [-s <QMP socket path | addr:port>] <path>.<property> <value>
-''' % cmd
-
-def usage_error(error_msg = "unspecified error"):
-    sys.stderr.write('%s\nERROR: %s\n' % (usage(), error_msg))
-    exit(1)
-
-if len(args) > 0:
-    if args[0] == "-h":
-        print usage()
-        exit(0);
-    elif args[0] == "-s":
-        try:
-            socket_path = args[1]
-        except:
-            usage_error("missing argument: QMP socket path or address");
-        args = args[2:]
-
-if not socket_path:
-    if os.environ.has_key('QMP_SOCKET'):
-        socket_path = os.environ['QMP_SOCKET']
-    else:
-        usage_error("no QMP socket path or address given");
-
-if len(args) > 1:
-    try:
-        path, prop = args[0].rsplit('.', 1)
-    except:
-        usage_error("invalid format for path/property/value")
-    value = args[1]
-else:
-    usage_error("not enough arguments")
-
-srv = QEMUMonitorProtocol(socket_path)
-srv.connect()
-
-print srv.command('qom-set', path=path, property=prop, value=sys.argv[2])
--- a/4
+++ b/4
@@ -1,3 +1,3 @@
-Read the documentation in qemu-doc.html or on http://wiki.qemu.org
+Read the documentation in qemu-doc.html.

- QEMU team
+Fabrice Bellard.
--- a/2
+++ b/2
@@ -1 +1 @@
-1.4.2
+1.0,1
--- a/a.out.h
+++ b/a.out.h
@@ -0,0 +1,430 @@
+/* a.out.h
+
+   Copyright 1997, 1998, 1999, 2001 Red Hat, Inc.
+
+This file is part of Cygwin.
+
+This software is a copyrighted work licensed under the terms of the
+Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
+details. */
+
+#ifndef _A_OUT_H_
+#define _A_OUT_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+#define COFF_IMAGE_WITH_PE
+#define COFF_LONG_SECTION_NAMES
+
+/*** coff information for Intel 386/486.  */
+
+
+/********************** FILE HEADER **********************/
+
+struct external_filehdr {
+  short f_magic;	/* magic number			*/
+  short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  short f_opthdr;	/* sizeof(optional hdr)		*/
+  short f_flags;	/* flags			*/
+};
+
+/* Bits for f_flags:
+ *	F_RELFLG	relocation info stripped from file
+ *	F_EXEC		file is executable (no unresolved external references)
+ *	F_LNNO		line numbers stripped from file
+ *	F_LSYMS		local symbols stripped from file
+ *	F_AR32WR	file has byte ordering of an AR32WR machine (e.g. vax)
+ */
+
+#define F_RELFLG	(0x0001)
+#define F_EXEC		(0x0002)
+#define F_LNNO		(0x0004)
+#define F_LSYMS		(0x0008)
+
+
+
+#define	I386MAGIC	0x14c
+#define I386PTXMAGIC	0x154
+#define I386AIXMAGIC	0x175
+
+/* This is Lynx's all-platform magic number for executables. */
+
+#define LYNXCOFFMAGIC	0415
+
+#define I386BADMAG(x) (((x).f_magic != I386MAGIC) \
+		       && (x).f_magic != I386AIXMAGIC \
+		       && (x).f_magic != I386PTXMAGIC \
+		       && (x).f_magic != LYNXCOFFMAGIC)
+
+#define	FILHDR	struct external_filehdr
+#define	FILHSZ	20
+
+
+/********************** AOUT "OPTIONAL HEADER"=
+ **********************/
+
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of data used for this file=
+ */
+}
+AOUTHDR;
+
+#define AOUTSZ 28
+#define AOUTHDRSZ 28
+
+#define OMAGIC          0404    /* object files, eg as output */
+#define ZMAGIC          0413    /* demand load format, eg normal ld output */
+#define STMAGIC		0401	/* target shlib */
+#define SHMAGIC		0443	/* host   shlib */
+
+
+/* define some NT default values */
+/*  #define NT_IMAGE_BASE        0x400000 moved to internal.h */
+#define NT_SECTION_ALIGNMENT 0x1000
+#define NT_FILE_ALIGNMENT    0x200
+#define NT_DEF_RESERVE       0x100000
+#define NT_DEF_COMMIT        0x1000
+
+/********************** SECTION HEADER **********************/
+
+
+struct external_scnhdr {
+  char		s_name[8];	/* section name			*/
+  host_ulong	s_paddr;	/* physical address, offset
+				   of last addr in scn */
+  host_ulong	s_vaddr;	/* virtual address		*/
+  host_ulong	s_size;		/* section size			*/
+  host_ulong	s_scnptr;	/* file ptr to raw data for section */
+  host_ulong	s_relptr;	/* file ptr to relocation	*/
+  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
+  unsigned short s_nreloc;	/* number of relocation entries	*/
+  unsigned short s_nlnno;	/* number of line number entries*/
+  host_ulong	s_flags;	/* flags			*/
+};
+
+#define	SCNHDR	struct external_scnhdr
+#define	SCNHSZ	40
+
+/*
+ * names of "special" sections
+ */
+#define _TEXT	".text"
+#define _DATA	".data"
+#define _BSS	".bss"
+#define _COMMENT ".comment"
+#define _LIB ".lib"
+
+/********************** LINE NUMBERS **********************/
+
+/* 1 line number entry for every "breakpointable" source line in a section.
+ * Line numbers are grouped on a per function basis; first entry in a function
+ * grouping will have l_lnno = 0 and in place of physical address will be the
+ * symbol table index of the function name.
+ */
+struct external_lineno {
+  union {
+    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
+    host_ulong l_paddr;	/* (physical) address of line number	*/
+  } l_addr;
+  unsigned short l_lnno;	/* line number		*/
+};
+
+#define	LINENO	struct external_lineno
+#define	LINESZ	6
+
+/********************** SYMBOLS **********************/
+
+#define E_SYMNMLEN	8	/* # characters in a symbol name	*/
+#define E_FILNMLEN	14	/* # characters in a file name		*/
+#define E_DIMNUM	4	/* # array dimensions in auxiliary entry */
+
+struct QEMU_PACKED external_syment
+{
+  union {
+    char e_name[E_SYMNMLEN];
+    struct {
+      host_ulong e_zeroes;
+      host_ulong e_offset;
+    } e;
+  } e;
+  host_ulong e_value;
+  unsigned short e_scnum;
+  unsigned short e_type;
+  char e_sclass[1];
+  char e_numaux[1];
+};
+
+#define N_BTMASK	(0xf)
+#define N_TMASK		(0x30)
+#define N_BTSHFT	(4)
+#define N_TSHIFT	(2)
+
+union external_auxent {
+  struct {
+    host_ulong x_tagndx;	/* str, un, or enum tag indx */
+    union {
+      struct {
+	unsigned short  x_lnno; /* declaration line number */
+	unsigned short  x_size; /* str/union/array size */
+      } x_lnsz;
+      host_ulong x_fsize;	/* size of function */
+    } x_misc;
+    union {
+      struct {			/* if ISFCN, tag, or .bb */
+	host_ulong x_lnnoptr;/* ptr to fcn line # */
+	host_ulong x_endndx;	/* entry ndx past block end */
+      } x_fcn;
+      struct {			/* if ISARY, up to 4 dimen. */
+	char x_dimen[E_DIMNUM][2];
+      } x_ary;
+    } x_fcnary;
+    unsigned short x_tvndx;	/* tv index */
+  } x_sym;
+
+  union {
+    char x_fname[E_FILNMLEN];
+    struct {
+      host_ulong x_zeroes;
+      host_ulong x_offset;
+    } x_n;
+  } x_file;
+
+  struct {
+    host_ulong x_scnlen;	/* section length */
+    unsigned short x_nreloc;	/* # relocation entries */
+    unsigned short x_nlinno;	/* # line numbers */
+    host_ulong x_checksum;	/* section COMDAT checksum */
+    unsigned short x_associated;/* COMDAT associated section index */
+    char x_comdat[1];		/* COMDAT selection number */
+  } x_scn;
+
+  struct {
+    host_ulong x_tvfill;	/* tv fill value */
+    unsigned short x_tvlen;	/* length of .tv */
+    char x_tvran[2][2];		/* tv range */
+  } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
+
+};
+
+#define	SYMENT	struct external_syment
+#define	SYMESZ	18
+#define	AUXENT	union external_auxent
+#define	AUXESZ	18
+
+#define _ETEXT	"etext"
+
+/********************** RELOCATION DIRECTIVES **********************/
+
+struct external_reloc {
+  char r_vaddr[4];
+  char r_symndx[4];
+  char r_type[2];
+};
+
+#define RELOC struct external_reloc
+#define RELSZ 10
+
+/* end of coff/i386.h */
+
+/* PE COFF header information */
+
+#ifndef _PE_H
+#define _PE_H
+
+/* NT specific file attributes */
+#define IMAGE_FILE_RELOCS_STRIPPED           0x0001
+#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
+#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
+#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
+#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
+#define IMAGE_FILE_32BIT_MACHINE             0x0100
+#define IMAGE_FILE_DEBUG_STRIPPED            0x0200
+#define IMAGE_FILE_SYSTEM                    0x1000
+#define IMAGE_FILE_DLL                       0x2000
+#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
+
+/* additional flags to be set for section headers to allow the NT loader to
+   read and write to the section data (to replace the addresses of data in
+   dlls for one thing); also to execute the section in .text's case=
+ */
+#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
+#define IMAGE_SCN_MEM_EXECUTE     0x20000000
+#define IMAGE_SCN_MEM_READ        0x40000000
+#define IMAGE_SCN_MEM_WRITE       0x80000000
+
+/*
+ * Section characteristics added for ppc-nt
+ */
+
+#define IMAGE_SCN_TYPE_NO_PAD                0x00000008  /* Reserved.  */
+
+#define IMAGE_SCN_CNT_CODE                   0x00000020  /* Section contains code. */
+#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  /* Section contains initialized data. */
+#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  /* Section contains uninitialized data. */
+
+#define IMAGE_SCN_LNK_OTHER                  0x00000100  /* Reserved.  */
+#define IMAGE_SCN_LNK_INFO                   0x00000200  /* Section contains comments or some other type of information. */
+#define IMAGE_SCN_LNK_REMOVE                 0x00000800  /* Section contents will not become part of image. */
+#define IMAGE_SCN_LNK_COMDAT                 0x00001000  /* Section contents comdat. */
+
+#define IMAGE_SCN_MEM_FARDATA                0x00008000
+
+#define IMAGE_SCN_MEM_PURGEABLE              0x00020000
+#define IMAGE_SCN_MEM_16BIT                  0x00020000
+#define IMAGE_SCN_MEM_LOCKED                 0x00040000
+#define IMAGE_SCN_MEM_PRELOAD                0x00080000
+
+#define IMAGE_SCN_ALIGN_1BYTES               0x00100000
+#define IMAGE_SCN_ALIGN_2BYTES               0x00200000
+#define IMAGE_SCN_ALIGN_4BYTES               0x00300000
+#define IMAGE_SCN_ALIGN_8BYTES               0x00400000
+#define IMAGE_SCN_ALIGN_16BYTES              0x00500000  /* Default alignment if no others are specified. */
+#define IMAGE_SCN_ALIGN_32BYTES              0x00600000
+#define IMAGE_SCN_ALIGN_64BYTES              0x00700000
+
+
+#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  /* Section contains extended relocations. */
+#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  /* Section is not cachable.               */
+#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  /* Section is not pageable.               */
+#define IMAGE_SCN_MEM_SHARED                 0x10000000  /* Section is shareable.                  */
+
+/* COMDAT selection codes.  */
+
+#define IMAGE_COMDAT_SELECT_NODUPLICATES     (1) /* Warn if duplicates.  */
+#define IMAGE_COMDAT_SELECT_ANY		     (2) /* No warning.  */
+#define IMAGE_COMDAT_SELECT_SAME_SIZE	     (3) /* Warn if different size.  */
+#define IMAGE_COMDAT_SELECT_EXACT_MATCH	     (4) /* Warn if different.  */
+#define IMAGE_COMDAT_SELECT_ASSOCIATIVE	     (5) /* Base on other section.  */
+
+/* Magic values that are true for all dos/nt implementations */
+#define DOSMAGIC       0x5a4d
+#define NT_SIGNATURE   0x00004550
+
+/* NT allows long filenames, we want to accommodate this.  This may break
+     some of the bfd functions */
+#undef  FILNMLEN
+#define FILNMLEN	18	/* # characters in a file name		*/
+
+
+#ifdef COFF_IMAGE_WITH_PE
+/* The filehdr is only weired in images */
+
+#undef FILHDR
+struct external_PE_filehdr
+{
+  /* DOS header fields */
+  unsigned short e_magic;	/* Magic number, 0x5a4d */
+  unsigned short e_cblp;	/* Bytes on last page of file, 0x90 */
+  unsigned short e_cp;		/* Pages in file, 0x3 */
+  unsigned short e_crlc;	/* Relocations, 0x0 */
+  unsigned short e_cparhdr;	/* Size of header in paragraphs, 0x4 */
+  unsigned short e_minalloc;	/* Minimum extra paragraphs needed, 0x0 */
+  unsigned short e_maxalloc;	/* Maximum extra paragraphs needed, 0xFFFF */
+  unsigned short e_ss;		/* Initial (relative) SS value, 0x0 */
+  unsigned short e_sp;		/* Initial SP value, 0xb8 */
+  unsigned short e_csum;	/* Checksum, 0x0 */
+  unsigned short e_ip;		/* Initial IP value, 0x0 */
+  unsigned short e_cs;		/* Initial (relative) CS value, 0x0 */
+  unsigned short e_lfarlc;	/* File address of relocation table, 0x40 */
+  unsigned short e_ovno;	/* Overlay number, 0x0 */
+  char e_res[4][2];		/* Reserved words, all 0x0 */
+  unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
+  unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
+  char e_res2[10][2];		/* Reserved words, all 0x0 */
+  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
+  char dos_message[16][4];	/* other stuff, always follow DOS header */
+  unsigned int nt_signature;	/* required NT signature, 0x4550 */
+
+  /* From standard header */
+
+  unsigned short f_magic;	/* magic number			*/
+  unsigned short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
+  unsigned short f_flags;	/* flags			*/
+};
+
+
+#define FILHDR struct external_PE_filehdr
+#undef FILHSZ
+#define FILHSZ 152
+
+#endif
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of all data used for this file */
+
+  /* NT extra fields; see internal.h for descriptions */
+  host_ulong  ImageBase;
+  host_ulong  SectionAlignment;
+  host_ulong  FileAlignment;
+  unsigned short  MajorOperatingSystemVersion;
+  unsigned short  MinorOperatingSystemVersion;
+  unsigned short  MajorImageVersion;
+  unsigned short  MinorImageVersion;
+  unsigned short  MajorSubsystemVersion;
+  unsigned short  MinorSubsystemVersion;
+  char  Reserved1[4];
+  host_ulong  SizeOfImage;
+  host_ulong  SizeOfHeaders;
+  host_ulong  CheckSum;
+  unsigned short Subsystem;
+  unsigned short DllCharacteristics;
+  host_ulong  SizeOfStackReserve;
+  host_ulong  SizeOfStackCommit;
+  host_ulong  SizeOfHeapReserve;
+  host_ulong  SizeOfHeapCommit;
+  host_ulong  LoaderFlags;
+  host_ulong  NumberOfRvaAndSizes;
+  /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
+  char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
+
+} PEAOUTHDR;
+
+
+#undef AOUTSZ
+#define AOUTSZ (AOUTHDRSZ + 196)
+
+#undef  E_FILNMLEN
+#define E_FILNMLEN	18	/* # characters in a file name		*/
+#endif
+
+/* end of coff/pe.h */
+
+#define DT_NON		(0)	/* no derived type */
+#define DT_PTR		(1)	/* pointer */
+#define DT_FCN		(2)	/* function */
+#define DT_ARY		(3)	/* array */
+
+#define ISPTR(x)	(((x) & N_TMASK) == (DT_PTR << N_BTSHFT))
+#define ISFCN(x)	(((x) & N_TMASK) == (DT_FCN << N_BTSHFT))
+#define ISARY(x)	(((x) & N_TMASK) == (DT_ARY << N_BTSHFT))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _A_OUT_H_ */
--- a/util/acl.c
+++ b/util/acl.c
@@ -24,7 +24,7 @@


 #include "qemu-common.h"
-#include "qemu/acl.h"
+#include "acl.h"

 #ifdef CONFIG_FNMATCH
 #include <fnmatch.h>
@@ -103,8 +103,8 @@ void qemu_acl_reset(qemu_acl *acl)
    acl->defaultDeny = 1;
    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
-        g_free(entry->match);
-        g_free(entry);
+        free(entry->match);
+        free(entry);
    }
    acl->nentries = 0;
 }
@@ -168,9 +168,6 @@ int qemu_acl_remove(qemu_acl *acl,
        i++;
        if (strcmp(entry->match, match) == 0) {
            QTAILQ_REMOVE(&acl->entries, entry, next);
-            acl->nentries--;
-            g_free(entry->match);
-            g_free(entry);
            return i;
        }
    }
--- a/include/qemu/acl.h
+++ b/include/qemu/acl.h
@@ -25,7 +25,7 @@
 #ifndef __QEMU_ACL_H__
 #define __QEMU_ACL_H__

-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef struct qemu_acl_entry qemu_acl_entry;
 typedef struct qemu_acl qemu_acl;
--- a/util/aes.c
+++ b/util/aes.c
@@ -28,7 +28,7 @@
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "qemu-common.h"
-#include "block/aes.h"
+#include "aes.h"

 #ifndef NDEBUG
 #define NDEBUG
--- a/include/block/aes.h
+++ b/include/block/aes.h
--- a/aio-posix.c
+++ b/aio-posix.c
@@ -1,269 +0,0 @@
-/*
- * QEMU aio implementation
- *
- * Copyright IBM, Corp. 2008
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
-
-struct AioHandler
-{
-    GPollFD pfd;
-    IOHandler *io_read;
-    IOHandler *io_write;
-    AioFlushHandler *io_flush;
-    int deleted;
-    void *opaque;
-    QLIST_ENTRY(AioHandler) node;
-};
-
-static AioHandler *find_aio_handler(AioContext *ctx, int fd)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->pfd.fd == fd)
-            if (!node->deleted)
-                return node;
-    }
-
-    return NULL;
-}
-
-void aio_set_fd_handler(AioContext *ctx,
-                        int fd,
-                        IOHandler *io_read,
-                        IOHandler *io_write,
-                        AioFlushHandler *io_flush,
-                        void *opaque)
-{
-    AioHandler *node;
-
-    node = find_aio_handler(ctx, fd);
-
-    /* Are we deleting the fd handler? */
-    if (!io_read && !io_write) {
-        if (node) {
-            g_source_remove_poll(&ctx->source, &node->pfd);
-
-            /* If the lock is held, just mark the node as deleted */
-            if (ctx->walking_handlers) {
-                node->deleted = 1;
-                node->pfd.revents = 0;
-            } else {
-                /* Otherwise, delete it for real.  We can't just mark it as
-                 * deleted because deleted nodes are only cleaned up after
-                 * releasing the walking_handlers lock.
-                 */
-                QLIST_REMOVE(node, node);
-                g_free(node);
-            }
-        }
-    } else {
-        if (node == NULL) {
-            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
-            node->pfd.fd = fd;
-            QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
-
-            g_source_add_poll(&ctx->source, &node->pfd);
-        }
-        /* Update handler with latest information */
-        node->io_read = io_read;
-        node->io_write = io_write;
-        node->io_flush = io_flush;
-        node->opaque = opaque;
-
-        node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP : 0);
-        node->pfd.events |= (io_write ? G_IO_OUT : 0);
-    }
-
-    aio_notify(ctx);
-}
-
-void aio_set_event_notifier(AioContext *ctx,
-                            EventNotifier *notifier,
-                            EventNotifierHandler *io_read,
-                            AioFlushEventNotifierHandler *io_flush)
-{
-    aio_set_fd_handler(ctx, event_notifier_get_fd(notifier),
-                       (IOHandler *)io_read, NULL,
-                       (AioFlushHandler *)io_flush, notifier);
-}
-
-bool aio_pending(AioContext *ctx)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        int revents;
-
-        /*
-         * FIXME: right now we cannot get G_IO_HUP and G_IO_ERR because
-         * main-loop.c is still select based (due to the slirp legacy).
-         * If main-loop.c ever switches to poll, G_IO_ERR should be
-         * tested too.  Dispatching G_IO_ERR to both handlers should be
-         * okay, since handlers need to be ready for spurious wakeups.
-         */
-        revents = node->pfd.revents & node->pfd.events;
-        if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
-            return true;
-        }
-        if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-bool aio_poll(AioContext *ctx, bool blocking)
-{
-    static struct timeval tv0;
-    AioHandler *node;
-    fd_set rdfds, wrfds;
-    int max_fd = -1;
-    int ret;
-    bool busy, progress;
-
-    progress = false;
-
-    /*
-     * If there are callbacks left that have been queued, we need to call then.
-     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for qemu_aio_wait loops).
-     */
-    if (aio_bh_poll(ctx)) {
-        blocking = false;
-        progress = true;
-    }
-
-    /*
-     * Then dispatch any pending callbacks from the GSource.
-     *
-     * We have to walk very carefully in case qemu_aio_set_fd_handler is
-     * called while we're walking.
-     */
-    node = QLIST_FIRST(&ctx->aio_handlers);
-    while (node) {
-        AioHandler *tmp;
-        int revents;
-
-        ctx->walking_handlers++;
-
-        revents = node->pfd.revents & node->pfd.events;
-        node->pfd.revents = 0;
-
-        /* See comment in aio_pending.  */
-        if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
-            node->io_read(node->opaque);
-            progress = true;
-        }
-        if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
-            node->io_write(node->opaque);
-            progress = true;
-        }
-
-        tmp = node;
-        node = QLIST_NEXT(node, node);
-
-        ctx->walking_handlers--;
-
-        if (!ctx->walking_handlers && tmp->deleted) {
-            QLIST_REMOVE(tmp, node);
-            g_free(tmp);
-        }
-    }
-
-    if (progress && !blocking) {
-        return true;
-    }
-
-    ctx->walking_handlers++;
-
-    FD_ZERO(&rdfds);
-    FD_ZERO(&wrfds);
-
-    /* fill fd sets */
-    busy = false;
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        /* If there aren't pending AIO operations, don't invoke callbacks.
-         * Otherwise, if there are no AIO requests, qemu_aio_wait() would
-         * wait indefinitely.
-         */
-        if (!node->deleted && node->io_flush) {
-            if (node->io_flush(node->opaque) == 0) {
-                continue;
-            }
-            busy = true;
-        }
-        if (!node->deleted && node->io_read) {
-            FD_SET(node->pfd.fd, &rdfds);
-            max_fd = MAX(max_fd, node->pfd.fd + 1);
-        }
-        if (!node->deleted && node->io_write) {
-            FD_SET(node->pfd.fd, &wrfds);
-            max_fd = MAX(max_fd, node->pfd.fd + 1);
-        }
-    }
-
-    ctx->walking_handlers--;
-
-    /* No AIO operations?  Get us out of here */
-    if (!busy) {
-        return progress;
-    }
-
-    /* wait until next event */
-    ret = select(max_fd, &rdfds, &wrfds, NULL, blocking ? NULL : &tv0);
-
-    /* if we have any readable fds, dispatch event */
-    if (ret > 0) {
-        /* we have to walk very carefully in case
-         * qemu_aio_set_fd_handler is called while we're walking */
-        node = QLIST_FIRST(&ctx->aio_handlers);
-        while (node) {
-            AioHandler *tmp;
-
-            ctx->walking_handlers++;
-
-            if (!node->deleted &&
-                FD_ISSET(node->pfd.fd, &rdfds) &&
-                node->io_read) {
-                node->io_read(node->opaque);
-                progress = true;
-            }
-            if (!node->deleted &&
-                FD_ISSET(node->pfd.fd, &wrfds) &&
-                node->io_write) {
-                node->io_write(node->opaque);
-                progress = true;
-            }
-
-            tmp = node;
-            node = QLIST_NEXT(node, node);
-
-            ctx->walking_handlers--;
-
-            if (!ctx->walking_handlers && tmp->deleted) {
-                QLIST_REMOVE(tmp, node);
-                g_free(tmp);
-            }
-        }
-    }
-
-    assert(progress || busy);
-    return true;
-}
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -1,219 +0,0 @@
-/*
- * QEMU aio implementation
- *
- * Copyright IBM Corp., 2008
- * Copyright Red Hat Inc., 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *  Paolo Bonzini     <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
-
-struct AioHandler {
-    EventNotifier *e;
-    EventNotifierHandler *io_notify;
-    AioFlushEventNotifierHandler *io_flush;
-    GPollFD pfd;
-    int deleted;
-    QLIST_ENTRY(AioHandler) node;
-};
-
-void aio_set_event_notifier(AioContext *ctx,
-                            EventNotifier *e,
-                            EventNotifierHandler *io_notify,
-                            AioFlushEventNotifierHandler *io_flush)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->e == e && !node->deleted) {
-            break;
-        }
-    }
-
-    /* Are we deleting the fd handler? */
-    if (!io_notify) {
-        if (node) {
-            g_source_remove_poll(&ctx->source, &node->pfd);
-
-            /* If the lock is held, just mark the node as deleted */
-            if (ctx->walking_handlers) {
-                node->deleted = 1;
-                node->pfd.revents = 0;
-            } else {
-                /* Otherwise, delete it for real.  We can't just mark it as
-                 * deleted because deleted nodes are only cleaned up after
-                 * releasing the walking_handlers lock.
-                 */
-                QLIST_REMOVE(node, node);
-                g_free(node);
-            }
-        }
-    } else {
-        if (node == NULL) {
-            /* Alloc and insert if it's not already there */
-            node = g_malloc0(sizeof(AioHandler));
-            node->e = e;
-            node->pfd.fd = (uintptr_t)event_notifier_get_handle(e);
-            node->pfd.events = G_IO_IN;
-            QLIST_INSERT_HEAD(&ctx->aio_handlers, node, node);
-
-            g_source_add_poll(&ctx->source, &node->pfd);
-        }
-        /* Update handler with latest information */
-        node->io_notify = io_notify;
-        node->io_flush = io_flush;
-    }
-
-    aio_notify(ctx);
-}
-
-bool aio_pending(AioContext *ctx)
-{
-    AioHandler *node;
-
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        if (node->pfd.revents && node->io_notify) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-bool aio_poll(AioContext *ctx, bool blocking)
-{
-    AioHandler *node;
-    HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
-    bool busy, progress;
-    int count;
-
-    progress = false;
-
-    /*
-     * If there are callbacks left that have been queued, we need to call then.
-     * Do not call select in this case, because it is possible that the caller
-     * does not need a complete flush (as is the case for qemu_aio_wait loops).
-     */
-    if (aio_bh_poll(ctx)) {
-        blocking = false;
-        progress = true;
-    }
-
-    /*
-     * Then dispatch any pending callbacks from the GSource.
-     *
-     * We have to walk very carefully in case qemu_aio_set_fd_handler is
-     * called while we're walking.
-     */
-    node = QLIST_FIRST(&ctx->aio_handlers);
-    while (node) {
-        AioHandler *tmp;
-
-        ctx->walking_handlers++;
-
-        if (node->pfd.revents && node->io_notify) {
-            node->pfd.revents = 0;
-            node->io_notify(node->e);
-            progress = true;
-        }
-
-        tmp = node;
-        node = QLIST_NEXT(node, node);
-
-        ctx->walking_handlers--;
-
-        if (!ctx->walking_handlers && tmp->deleted) {
-            QLIST_REMOVE(tmp, node);
-            g_free(tmp);
-        }
-    }
-
-    if (progress && !blocking) {
-        return true;
-    }
-
-    ctx->walking_handlers++;
-
-    /* fill fd sets */
-    busy = false;
-    count = 0;
-    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-        /* If there aren't pending AIO operations, don't invoke callbacks.
-         * Otherwise, if there are no AIO requests, qemu_aio_wait() would
-         * wait indefinitely.
-         */
-        if (!node->deleted && node->io_flush) {
-            if (node->io_flush(node->e) == 0) {
-                continue;
-            }
-            busy = true;
-        }
-        if (!node->deleted && node->io_notify) {
-            events[count++] = event_notifier_get_handle(node->e);
-        }
-    }
-
-    ctx->walking_handlers--;
-
-    /* No AIO operations?  Get us out of here */
-    if (!busy) {
-        return progress;
-    }
-
-    /* wait until next event */
-    while (count > 0) {
-        int timeout = blocking ? INFINITE : 0;
-        int ret = WaitForMultipleObjects(count, events, FALSE, timeout);
-
-        /* if we have any signaled events, dispatch event */
-        if ((DWORD) (ret - WAIT_OBJECT_0) >= count) {
-            break;
-        }
-
-        blocking = false;
-
-        /* we have to walk very carefully in case
-         * qemu_aio_set_fd_handler is called while we're walking */
-        node = QLIST_FIRST(&ctx->aio_handlers);
-        while (node) {
-            AioHandler *tmp;
-
-            ctx->walking_handlers++;
-
-            if (!node->deleted &&
-                event_notifier_get_handle(node->e) == events[ret - WAIT_OBJECT_0] &&
-                node->io_notify) {
-                node->io_notify(node->e);
-                progress = true;
-            }
-
-            tmp = node;
-            node = QLIST_NEXT(node, node);
-
-            ctx->walking_handlers--;
-
-            if (!ctx->walking_handlers && tmp->deleted) {
-                QLIST_REMOVE(tmp, node);
-                g_free(tmp);
-            }
-        }
-
-        /* Try again, but only call each handler once.  */
-        events[ret - WAIT_OBJECT_0] = events[--count];
-    }
-
-    assert(progress || busy);
-    return true;
-}
--- a/aio.c
+++ b/aio.c
@@ -0,0 +1,230 @@
+/*
+ * QEMU aio implementation
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu-common.h"
+#include "block.h"
+#include "qemu-queue.h"
+#include "qemu_socket.h"
+
+typedef struct AioHandler AioHandler;
+
+/* The list of registered AIO handlers */
+static QLIST_HEAD(, AioHandler) aio_handlers;
+
+/* This is a simple lock used to protect the aio_handlers list.  Specifically,
+ * it's used to ensure that no callbacks are removed while we're walking and
+ * dispatching callbacks.
+ */
+static int walking_handlers;
+
+struct AioHandler
+{
+    int fd;
+    IOHandler *io_read;
+    IOHandler *io_write;
+    AioFlushHandler *io_flush;
+    AioProcessQueue *io_process_queue;
+    int deleted;
+    void *opaque;
+    QLIST_ENTRY(AioHandler) node;
+};
+
+static AioHandler *find_aio_handler(int fd)
+{
+    AioHandler *node;
+
+    QLIST_FOREACH(node, &aio_handlers, node) {
+        if (node->fd == fd)
+            if (!node->deleted)
+                return node;
+    }
+
+    return NULL;
+}
+
+int qemu_aio_set_fd_handler(int fd,
+                            IOHandler *io_read,
+                            IOHandler *io_write,
+                            AioFlushHandler *io_flush,
+                            AioProcessQueue *io_process_queue,
+                            void *opaque)
+{
+    AioHandler *node;
+
+    node = find_aio_handler(fd);
+
+    /* Are we deleting the fd handler? */
+    if (!io_read && !io_write) {
+        if (node) {
+            /* If the lock is held, just mark the node as deleted */
+            if (walking_handlers)
+                node->deleted = 1;
+            else {
+                /* Otherwise, delete it for real.  We can't just mark it as
+                 * deleted because deleted nodes are only cleaned up after
+                 * releasing the walking_handlers lock.
+                 */
+                QLIST_REMOVE(node, node);
+                g_free(node);
+            }
+        }
+    } else {
+        if (node == NULL) {
+            /* Alloc and insert if it's not already there */
+            node = g_malloc0(sizeof(AioHandler));
+            node->fd = fd;
+            QLIST_INSERT_HEAD(&aio_handlers, node, node);
+        }
+        /* Update handler with latest information */
+        node->io_read = io_read;
+        node->io_write = io_write;
+        node->io_flush = io_flush;
+        node->io_process_queue = io_process_queue;
+        node->opaque = opaque;
+    }
+
+    qemu_set_fd_handler2(fd, NULL, io_read, io_write, opaque);
+
+    return 0;
+}
+
+void qemu_aio_flush(void)
+{
+    AioHandler *node;
+    int ret;
+
+    do {
+        ret = 0;
+
+	/*
+	 * If there are pending emulated aio start them now so flush
+	 * will be able to return 1.
+	 */
+        qemu_aio_wait();
+
+        QLIST_FOREACH(node, &aio_handlers, node) {
+            if (node->io_flush) {
+                ret |= node->io_flush(node->opaque);
+            }
+        }
+    } while (qemu_bh_poll() || ret > 0);
+}
+
+int qemu_aio_process_queue(void)
+{
+    AioHandler *node;
+    int ret = 0;
+
+    walking_handlers = 1;
+
+    QLIST_FOREACH(node, &aio_handlers, node) {
+        if (node->io_process_queue) {
+            if (node->io_process_queue(node->opaque)) {
+                ret = 1;
+            }
+        }
+    }
+
+    walking_handlers = 0;
+
+    return ret;
+}
+
+void qemu_aio_wait(void)
+{
+    int ret;
+
+    if (qemu_bh_poll())
+        return;
+
+    /*
+     * If there are callbacks left that have been queued, we need to call then.
+     * Return afterwards to avoid waiting needlessly in select().
+     */
+    if (qemu_aio_process_queue())
+        return;
+
+    do {
+        AioHandler *node;
+        fd_set rdfds, wrfds;
+        int max_fd = -1;
+
+        walking_handlers = 1;
+
+        FD_ZERO(&rdfds);
+        FD_ZERO(&wrfds);
+
+        /* fill fd sets */
+        QLIST_FOREACH(node, &aio_handlers, node) {
+            /* If there aren't pending AIO operations, don't invoke callbacks.
+             * Otherwise, if there are no AIO requests, qemu_aio_wait() would
+             * wait indefinitely.
+             */
+            if (node->io_flush && node->io_flush(node->opaque) == 0)
+                continue;
+
+            if (!node->deleted && node->io_read) {
+                FD_SET(node->fd, &rdfds);
+                max_fd = MAX(max_fd, node->fd + 1);
+            }
+            if (!node->deleted && node->io_write) {
+                FD_SET(node->fd, &wrfds);
+                max_fd = MAX(max_fd, node->fd + 1);
+            }
+        }
+
+        walking_handlers = 0;
+
+        /* No AIO operations?  Get us out of here */
+        if (max_fd == -1)
+            break;
+
+        /* wait until next event */
+        ret = select(max_fd, &rdfds, &wrfds, NULL, NULL);
+        if (ret == -1 && errno == EINTR)
+            continue;
+
+        /* if we have any readable fds, dispatch event */
+        if (ret > 0) {
+            walking_handlers = 1;
+
+            /* we have to walk very carefully in case
+             * qemu_aio_set_fd_handler is called while we're walking */
+            node = QLIST_FIRST(&aio_handlers);
+            while (node) {
+                AioHandler *tmp;
+
+                if (!node->deleted &&
+                    FD_ISSET(node->fd, &rdfds) &&
+                    node->io_read) {
+                    node->io_read(node->opaque);
+                }
+                if (!node->deleted &&
+                    FD_ISSET(node->fd, &wrfds) &&
+                    node->io_write) {
+                    node->io_write(node->opaque);
+                }
+
+                tmp = node;
+                node = QLIST_NEXT(node, node);
+
+                if (tmp->deleted) {
+                    QLIST_REMOVE(tmp, node);
+                    g_free(tmp);
+                }
+            }
+
+            walking_handlers = 0;
+        }
+    } while (ret == 0);
+}
--- a/disas/alpha.c
+++ b/disas/alpha.c
@@ -20,7 +20,7 @@ along with this file; see the file COPYING.  If not, see
 <http://www.gnu.org/licenses/>. */

 #include <stdio.h>
-#include "disas/bfd.h"
+#include "dis-asm.h"

 /* MAX is redefined below, so remove any previous definition. */
 #undef MAX
--- a/ldscripts/alpha.ld
+++ b/ldscripts/alpha.ld
--- a/arch_init.c
+++ b/arch_init.c
--- a/include/sysemu/arch_init.h
+++ b/include/sysemu/arch_init.h
@@ -1,7 +1,7 @@
 #ifndef QEMU_ARCH_INIT_H
 #define QEMU_ARCH_INIT_H

-#include "qmp-commands.h"
+extern const char arch_config_name[];

 enum {
    QEMU_ARCH_ALL = -1,
@@ -18,8 +18,6 @@ enum {
    QEMU_ARCH_SH4 = 1024,
    QEMU_ARCH_SPARC = 2048,
    QEMU_ARCH_XTENSA = 4096,
-    QEMU_ARCH_OPENRISC = 8192,
-    QEMU_ARCH_UNICORE32 = 0x4000,
 };

 extern const uint32_t arch_type;
@@ -29,11 +27,9 @@ void do_acpitable_option(const char *optarg);
 void do_smbios_option(const char *optarg);
 void cpudef_init(void);
 int audio_available(void);
-void audio_init(ISABus *isa_bus, PCIBus *pci_bus);
+void audio_init(qemu_irq *isa_pic, PCIBus *pci_bus);
 int tcg_available(void);
 int kvm_available(void);
 int xen_available(void);

-CpuDefinitionInfoList *arch_query_cpu_definitions(Error **errp);
-
 #endif
--- a/disas/arm.c
+++ b/disas/arm.c
@@ -22,7 +22,7 @@
 /* Start of qemu specific additions.  Mostly this is stub definitions
   for things we don't care about.  */

-#include "disas/bfd.h"
+#include "dis-asm.h"
 #define ATTRIBUTE_UNUSED __attribute__((unused))
 #define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')

@@ -1624,7 +1624,7 @@ arm_decode_shift (long given, fprintf_function func, void *stream,
 }

 /* Print one coprocessor instruction on INFO->STREAM.
-   Return true if the instruction matched, false if this is not a
+   Return true if the instuction matched, false if this is not a
   recognised coprocessor instruction.  */

 static bfd_boolean
@@ -2214,7 +2214,7 @@ print_arm_address (bfd_vma pc, struct disassemble_info *info, long given)
 }

 /* Print one neon instruction on INFO->STREAM.
-   Return true if the instruction matched, false if this is not a
+   Return true if the instuction matched, false if this is not a
   recognised neon instruction.  */

 static bfd_boolean
@@ -3927,7 +3927,7 @@ print_insn_arm (bfd_vma pc, struct disassemble_info *info)
 	    n = last_mapping_sym - 1;

 	  /* No mapping symbol found at this address.  Look backwards
-	     for a preceding one.  */
+	     for a preceeding one.  */
 	  for (; n >= 0; n--)
 	    {
 	      if (get_sym_code_type (info, n, &type))
--- a/target-arm/arm-semi.c
+++ b/target-arm/arm-semi.c
@@ -33,30 +33,30 @@
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
 #include "qemu-common.h"
-#include "exec/gdbstub.h"
+#include "gdbstub.h"
 #include "hw/arm-misc.h"
 #endif

-#define TARGET_SYS_OPEN        0x01
-#define TARGET_SYS_CLOSE       0x02
-#define TARGET_SYS_WRITEC      0x03
-#define TARGET_SYS_WRITE0      0x04
-#define TARGET_SYS_WRITE       0x05
-#define TARGET_SYS_READ        0x06
-#define TARGET_SYS_READC       0x07
-#define TARGET_SYS_ISTTY       0x09
-#define TARGET_SYS_SEEK        0x0a
-#define TARGET_SYS_FLEN        0x0c
-#define TARGET_SYS_TMPNAM      0x0d
-#define TARGET_SYS_REMOVE      0x0e
-#define TARGET_SYS_RENAME      0x0f
-#define TARGET_SYS_CLOCK       0x10
-#define TARGET_SYS_TIME        0x11
-#define TARGET_SYS_SYSTEM      0x12
-#define TARGET_SYS_ERRNO       0x13
-#define TARGET_SYS_GET_CMDLINE 0x15
-#define TARGET_SYS_HEAPINFO    0x16
-#define TARGET_SYS_EXIT        0x18
+#define SYS_OPEN        0x01
+#define SYS_CLOSE       0x02
+#define SYS_WRITEC      0x03
+#define SYS_WRITE0      0x04
+#define SYS_WRITE       0x05
+#define SYS_READ        0x06
+#define SYS_READC       0x07
+#define SYS_ISTTY       0x09
+#define SYS_SEEK        0x0a
+#define SYS_FLEN        0x0c
+#define SYS_TMPNAM      0x0d
+#define SYS_REMOVE      0x0e
+#define SYS_RENAME      0x0f
+#define SYS_CLOCK       0x10
+#define SYS_TIME        0x11
+#define SYS_SYSTEM      0x12
+#define SYS_ERRNO       0x13
+#define SYS_GET_CMDLINE 0x15
+#define SYS_HEAPINFO    0x16
+#define SYS_EXIT        0x18

 #ifndef O_BINARY
 #define O_BINARY 0
@@ -108,12 +108,12 @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
    return code;
 }
 #else
-static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
+static inline uint32_t set_swi_errno(CPUState *env, uint32_t code)
 {
    return code;
 }

-#include "exec/softmmu-semi.h"
+#include "softmmu-semi.h"
 #endif

 static target_ulong arm_semi_syscall_len;
@@ -122,7 +122,7 @@ static target_ulong arm_semi_syscall_len;
 static target_ulong syscall_err;
 #endif

-static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong err)
+static void arm_semi_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
@@ -138,11 +138,11 @@ static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong err)
    } else {
        /* Fixup syscalls that use nonstardard return conventions.  */
        switch (env->regs[0]) {
-        case TARGET_SYS_WRITE:
-        case TARGET_SYS_READ:
+        case SYS_WRITE:
+        case SYS_READ:
            env->regs[0] = arm_semi_syscall_len - ret;
            break;
-        case TARGET_SYS_SEEK:
+        case SYS_SEEK:
            env->regs[0] = 0;
            break;
        default:
@@ -152,7 +152,7 @@ static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong err)
    }
 }

-static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_ulong err)
+static void arm_semi_flen_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
    /* The size is always stored in big-endian order, extract
       the value. We assume the size always fit in 32 bits.  */
@@ -166,20 +166,17 @@ static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_ulong er
 #endif
 }

-/* Read the input value from the argument block; fail the semihosting
- * call if the memory read fails.
- */
-#define GET_ARG(n) do {                                 \
-    if (get_user_ual(arg ## n, args + (n) * 4)) {       \
-        return (uint32_t)-1;                            \
-    }                                                   \
-} while (0)
-
+#define ARG(n)					\
+({						\
+    target_ulong __arg;				\
+    /* FIXME - handle get_user() failure */	\
+    get_user_ual(__arg, args + (n) * 4);	\
+    __arg;					\
+})
 #define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
-uint32_t do_arm_semihosting(CPUARMState *env)
+uint32_t do_arm_semihosting(CPUState *env)
 {
    target_ulong args;
-    target_ulong arg0, arg1, arg2, arg3;
    char * s;
    int nr;
    uint32_t ret;
@@ -187,48 +184,41 @@ uint32_t do_arm_semihosting(CPUARMState *env)
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
 #else
-    CPUARMState *ts = env;
+    CPUState *ts = env;
 #endif

    nr = env->regs[0];
    args = env->regs[1];
    switch (nr) {
-    case TARGET_SYS_OPEN:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        s = lock_user_string(arg0);
-        if (!s) {
+    case SYS_OPEN:
+        if (!(s = lock_user_string(ARG(0))))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
-        }
-        if (arg1 >= 12) {
-            unlock_user(s, arg0, 0);
+        if (ARG(1) >= 12)
            return (uint32_t)-1;
-        }
        if (strcmp(s, ":tt") == 0) {
-            int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
-            unlock_user(s, arg0, 0);
-            return result_fileno;
+            if (ARG(1) < 4)
+                return STDIN_FILENO;
+            else
+                return STDOUT_FILENO;
        }
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", arg0,
-                           (int)arg2+1, gdb_open_modeflags[arg1]);
-            ret = env->regs[0];
-        } else {
-            ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
-        }
-        unlock_user(s, arg0, 0);
-        return ret;
-    case TARGET_SYS_CLOSE:
-        GET_ARG(0);
-        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "close,%x", arg0);
+            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
+			   (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
            return env->regs[0];
        } else {
-            return set_swi_errno(ts, close(arg0));
+            ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
        }
-    case TARGET_SYS_WRITEC:
+        unlock_user(s, ARG(0), 0);
+        return ret;
+    case SYS_CLOSE:
+        if (use_gdb_syscalls()) {
+            gdb_do_syscall(arm_semi_cb, "close,%x", ARG(0));
+            return env->regs[0];
+        } else {
+            return set_swi_errno(ts, close(ARG(0)));
+        }
+    case SYS_WRITEC:
        {
          char c;

@@ -243,7 +233,7 @@ uint32_t do_arm_semihosting(CPUARMState *env)
                return write(STDERR_FILENO, &c, 1);
          }
        }
-    case TARGET_SYS_WRITE0:
+    case SYS_WRITE0:
        if (!(s = lock_user_string(args)))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
@@ -256,178 +246,150 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        }
        unlock_user(s, args, 0);
        return ret;
-    case TARGET_SYS_WRITE:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        len = arg2;
+    case SYS_WRITE:
+        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
-            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", arg0, arg1, len);
+            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
-            s = lock_user(VERIFY_READ, arg1, len, 1);
-            if (!s) {
+            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
-            ret = set_swi_errno(ts, write(arg0, s, len));
-            unlock_user(s, arg1, 0);
+            ret = set_swi_errno(ts, write(ARG(0), s, len));
+            unlock_user(s, ARG(1), 0);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
-    case TARGET_SYS_READ:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        len = arg2;
+    case SYS_READ:
+        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
-            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", arg0, arg1, len);
+            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
-            s = lock_user(VERIFY_WRITE, arg1, len, 0);
-            if (!s) {
+            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
-            do {
-                ret = set_swi_errno(ts, read(arg0, s, len));
-            } while (ret == -1 && errno == EINTR);
-            unlock_user(s, arg1, len);
+            do
+              ret = set_swi_errno(ts, read(ARG(0), s, len));
+            while (ret == -1 && errno == EINTR);
+            unlock_user(s, ARG(1), len);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
-    case TARGET_SYS_READC:
-       /* XXX: Read from debug console. Not implemented.  */
+    case SYS_READC:
+       /* XXX: Read from debug cosole. Not implemented.  */
        return 0;
-    case TARGET_SYS_ISTTY:
-        GET_ARG(0);
+    case SYS_ISTTY:
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "isatty,%x", arg0);
+            gdb_do_syscall(arm_semi_cb, "isatty,%x", ARG(0));
            return env->regs[0];
        } else {
-            return isatty(arg0);
+            return isatty(ARG(0));
        }
-    case TARGET_SYS_SEEK:
-        GET_ARG(0);
-        GET_ARG(1);
+    case SYS_SEEK:
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", arg0, arg1);
+            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", ARG(0), ARG(1));
            return env->regs[0];
        } else {
-            ret = set_swi_errno(ts, lseek(arg0, arg1, SEEK_SET));
+            ret = set_swi_errno(ts, lseek(ARG(0), ARG(1), SEEK_SET));
            if (ret == (uint32_t)-1)
              return -1;
            return 0;
        }
-    case TARGET_SYS_FLEN:
-        GET_ARG(0);
+    case SYS_FLEN:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_flen_cb, "fstat,%x,%x",
-                           arg0, env->regs[13]-64);
+			   ARG(0), env->regs[13]-64);
            return env->regs[0];
        } else {
            struct stat buf;
-            ret = set_swi_errno(ts, fstat(arg0, &buf));
+            ret = set_swi_errno(ts, fstat(ARG(0), &buf));
            if (ret == (uint32_t)-1)
                return -1;
            return buf.st_size;
        }
-    case TARGET_SYS_TMPNAM:
+    case SYS_TMPNAM:
        /* XXX: Not implemented.  */
        return -1;
-    case TARGET_SYS_REMOVE:
-        GET_ARG(0);
-        GET_ARG(1);
+    case SYS_REMOVE:
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "unlink,%s", arg0, (int)arg1+1);
+            gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
            ret = env->regs[0];
        } else {
-            s = lock_user_string(arg0);
-            if (!s) {
+            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ret =  set_swi_errno(ts, remove(s));
-            unlock_user(s, arg0, 0);
+            unlock_user(s, ARG(0), 0);
        }
        return ret;
-    case TARGET_SYS_RENAME:
-        GET_ARG(0);
-        GET_ARG(1);
-        GET_ARG(2);
-        GET_ARG(3);
+    case SYS_RENAME:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "rename,%s,%s",
-                           arg0, (int)arg1+1, arg2, (int)arg3+1);
+                           ARG(0), (int)ARG(1)+1, ARG(2), (int)ARG(3)+1);
            return env->regs[0];
        } else {
            char *s2;
-            s = lock_user_string(arg0);
-            s2 = lock_user_string(arg2);
+            s = lock_user_string(ARG(0));
+            s2 = lock_user_string(ARG(2));
            if (!s || !s2)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                ret = (uint32_t)-1;
            else
                ret = set_swi_errno(ts, rename(s, s2));
            if (s2)
-                unlock_user(s2, arg2, 0);
+                unlock_user(s2, ARG(2), 0);
            if (s)
-                unlock_user(s, arg0, 0);
+                unlock_user(s, ARG(0), 0);
            return ret;
        }
-    case TARGET_SYS_CLOCK:
+    case SYS_CLOCK:
        return clock() / (CLOCKS_PER_SEC / 100);
-    case TARGET_SYS_TIME:
+    case SYS_TIME:
        return set_swi_errno(ts, time(NULL));
-    case TARGET_SYS_SYSTEM:
-        GET_ARG(0);
-        GET_ARG(1);
+    case SYS_SYSTEM:
        if (use_gdb_syscalls()) {
-            gdb_do_syscall(arm_semi_cb, "system,%s", arg0, (int)arg1+1);
+            gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
            return env->regs[0];
        } else {
-            s = lock_user_string(arg0);
-            if (!s) {
+            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ret = set_swi_errno(ts, system(s));
-            unlock_user(s, arg0, 0);
+            unlock_user(s, ARG(0), 0);
            return ret;
        }
-    case TARGET_SYS_ERRNO:
+    case SYS_ERRNO:
 #ifdef CONFIG_USER_ONLY
        return ts->swi_errno;
 #else
        return syscall_err;
 #endif
-    case TARGET_SYS_GET_CMDLINE:
+    case SYS_GET_CMDLINE:
        {
            /* Build a command-line from the original argv.
             *
             * The inputs are:
-             *     * arg0, pointer to a buffer of at least the size
-             *               specified in arg1.
-             *     * arg1, size of the buffer pointed to by arg0 in
+             *     * ARG(0), pointer to a buffer of at least the size
+             *               specified in ARG(1).
+             *     * ARG(1), size of the buffer pointed to by ARG(0) in
             *               bytes.
             *
             * The outputs are:
-             *     * arg0, pointer to null-terminated string of the
+             *     * ARG(0), pointer to null-terminated string of the
             *               command line.
-             *     * arg1, length of the string pointed to by arg0.
+             *     * ARG(1), length of the string pointed to by ARG(0).
             */

            char *output_buffer;
-            size_t input_size;
+            size_t input_size = ARG(1);
            size_t output_size;
            int status = 0;
-            GET_ARG(0);
-            GET_ARG(1);
-            input_size = arg1;
+
            /* Compute the size of the output string.  */
 #if !defined(CONFIG_USER_ONLY)
            output_size = strlen(ts->boot_info->kernel_filename)
@@ -451,13 +413,10 @@ uint32_t do_arm_semihosting(CPUARMState *env)
            }

            /* Adjust the command-line length.  */
-            if (SET_ARG(1, output_size - 1)) {
-                /* Couldn't write back to argument block */
-                return -1;
-            }
+            SET_ARG(1, output_size - 1);

            /* Lock the buffer on the ARM side.  */
-            output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
+            output_buffer = lock_user(VERIFY_WRITE, ARG(0), output_size, 0);
            if (!output_buffer) {
                return -1;
            }
@@ -489,15 +448,14 @@ uint32_t do_arm_semihosting(CPUARMState *env)
        out:
 #endif
            /* Unlock the buffer on the ARM side.  */
-            unlock_user(output_buffer, arg0, output_size);
+            unlock_user(output_buffer, ARG(0), output_size);

            return status;
        }
-    case TARGET_SYS_HEAPINFO:
+    case SYS_HEAPINFO:
        {
            uint32_t *ptr;
            uint32_t limit;
-            GET_ARG(0);

 #ifdef CONFIG_USER_ONLY
            /* Some C libraries assume the heap immediately follows .bss, so
@@ -518,33 +476,29 @@ uint32_t do_arm_semihosting(CPUARMState *env)
                ts->heap_limit = limit;
            }

-            ptr = lock_user(VERIFY_WRITE, arg0, 16, 0);
-            if (!ptr) {
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            ptr[0] = tswap32(ts->heap_base);
            ptr[1] = tswap32(ts->heap_limit);
            ptr[2] = tswap32(ts->stack_base);
            ptr[3] = tswap32(0); /* Stack limit.  */
-            unlock_user(ptr, arg0, 16);
+            unlock_user(ptr, ARG(0), 16);
 #else
            limit = ram_size;
-            ptr = lock_user(VERIFY_WRITE, arg0, 16, 0);
-            if (!ptr) {
+            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
-            }
            /* TODO: Make this use the limit of the loaded application.  */
            ptr[0] = tswap32(limit / 2);
            ptr[1] = tswap32(limit);
            ptr[2] = tswap32(limit); /* Stack base */
            ptr[3] = tswap32(0); /* Stack limit.  */
-            unlock_user(ptr, arg0, 16);
+            unlock_user(ptr, ARG(0), 16);
 #endif
            return 0;
        }
-    case TARGET_SYS_EXIT:
+    case SYS_EXIT:
        gdb_exit(env, 0);
        exit(0);
    default:
--- a/ldscripts/arm.ld
+++ b/ldscripts/arm.ld
--- a/async.c
+++ b/async.c
@@ -23,43 +23,45 @@
 */

 #include "qemu-common.h"
-#include "block/aio.h"
-#include "qemu/main-loop.h"
+#include "qemu-aio.h"
+#include "main-loop.h"
+
+/* Anchor of the list of Bottom Halves belonging to the context */
+static struct QEMUBH *first_bh;

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */

 struct QEMUBH {
-    AioContext *ctx;
    QEMUBHFunc *cb;
    void *opaque;
+    int scheduled;
+    int idle;
+    int deleted;
    QEMUBH *next;
-    bool scheduled;
-    bool idle;
-    bool deleted;
 };

-QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
+QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
    bh = g_malloc0(sizeof(QEMUBH));
-    bh->ctx = ctx;
    bh->cb = cb;
    bh->opaque = opaque;
-    bh->next = ctx->first_bh;
-    ctx->first_bh = bh;
+    bh->next = first_bh;
+    first_bh = bh;
    return bh;
 }

-int aio_bh_poll(AioContext *ctx)
+int qemu_bh_poll(void)
 {
    QEMUBH *bh, **bhp, *next;
    int ret;
+    static int nesting = 0;

-    ctx->walking_bh++;
+    nesting++;

    ret = 0;
-    for (bh = ctx->first_bh; bh; bh = next) {
+    for (bh = first_bh; bh; bh = next) {
        next = bh->next;
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
@@ -70,11 +72,11 @@ int aio_bh_poll(AioContext *ctx)
        }
    }

-    ctx->walking_bh--;
+    nesting--;

    /* remove deleted bhs */
-    if (!ctx->walking_bh) {
-        bhp = &ctx->first_bh;
+    if (!nesting) {
+        bhp = &first_bh;
        while (*bhp) {
            bh = *bhp;
            if (bh->deleted) {
@@ -103,7 +105,8 @@ void qemu_bh_schedule(QEMUBH *bh)
        return;
    bh->scheduled = 1;
    bh->idle = 0;
-    aio_notify(bh->ctx);
+    /* stop the currently executing CPU to execute the BH ASAP */
+    qemu_notify_event();
 }

 void qemu_bh_cancel(QEMUBH *bh)
@@ -117,101 +120,23 @@ void qemu_bh_delete(QEMUBH *bh)
    bh->deleted = 1;
 }

-static gboolean
-aio_ctx_prepare(GSource *source, gint    *timeout)
+void qemu_bh_update_timeout(int *timeout)
 {
-    AioContext *ctx = (AioContext *) source;
    QEMUBH *bh;

-    for (bh = ctx->first_bh; bh; bh = bh->next) {
+    for (bh = first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
                 * every 10ms */
-                *timeout = 10;
+                *timeout = MIN(10, *timeout);
            } else {
                /* non-idle bottom halves will be executed
                 * immediately */
                *timeout = 0;
-                return true;
+                break;
            }
        }
    }
-
-    return false;
 }

-static gboolean
-aio_ctx_check(GSource *source)
-{
-    AioContext *ctx = (AioContext *) source;
-    QEMUBH *bh;
-
-    for (bh = ctx->first_bh; bh; bh = bh->next) {
-        if (!bh->deleted && bh->scheduled) {
-            return true;
-	}
-    }
-    return aio_pending(ctx);
-}
-
-static gboolean
-aio_ctx_dispatch(GSource     *source,
-                 GSourceFunc  callback,
-                 gpointer     user_data)
-{
-    AioContext *ctx = (AioContext *) source;
-
-    assert(callback == NULL);
-    aio_poll(ctx, false);
-    return true;
-}
-
-static void
-aio_ctx_finalize(GSource     *source)
-{
-    AioContext *ctx = (AioContext *) source;
-
-    aio_set_event_notifier(ctx, &ctx->notifier, NULL, NULL);
-    event_notifier_cleanup(&ctx->notifier);
-}
-
-static GSourceFuncs aio_source_funcs = {
-    aio_ctx_prepare,
-    aio_ctx_check,
-    aio_ctx_dispatch,
-    aio_ctx_finalize
-};
-
-GSource *aio_get_g_source(AioContext *ctx)
-{
-    g_source_ref(&ctx->source);
-    return &ctx->source;
-}
-
-void aio_notify(AioContext *ctx)
-{
-    event_notifier_set(&ctx->notifier);
-}
-
-AioContext *aio_context_new(void)
-{
-    AioContext *ctx;
-    ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext));
-    event_notifier_init(&ctx->notifier, false);
-    aio_set_event_notifier(ctx, &ctx->notifier, 
-                           (EventNotifierHandler *)
-                           event_notifier_test_and_clear, NULL);
-
-    return ctx;
-}
-
-void aio_context_ref(AioContext *ctx)
-{
-    g_source_ref(&ctx->source);
-}
-
-void aio_context_unref(AioContext *ctx)
-{
-    g_source_unref(&ctx->source);
-}
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,17 +0,0 @@
-common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
-common-obj-$(CONFIG_SDL) += sdlaudio.o
-common-obj-$(CONFIG_OSS) += ossaudio.o
-common-obj-$(CONFIG_SPICE) += spiceaudio.o
-common-obj-$(CONFIG_COREAUDIO) += coreaudio.o
-common-obj-$(CONFIG_ALSA) += alsaaudio.o
-common-obj-$(CONFIG_DSOUND) += dsoundaudio.o
-common-obj-$(CONFIG_FMOD) += fmodaudio.o
-common-obj-$(CONFIG_ESD) += esdaudio.o
-common-obj-$(CONFIG_PA) += paaudio.o
-common-obj-$(CONFIG_WINWAVE) += winwaveaudio.o
-common-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
-common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
-common-obj-y += wavcapture.o
-
-$(obj)/audio.o $(obj)/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
-$(obj)/sdlaudio.o: QEMU_CFLAGS += $(SDL_CFLAGS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -23,7 +23,7 @@
 */
 #include <alsa/asoundlib.h>
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
+#include "qemu-char.h"
 #include "audio.h"

 #if QEMU_GNUC_PREREQ(4, 3)
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -23,9 +23,9 @@
 */
 #include "hw/hw.h"
 #include "audio.h"
-#include "monitor/monitor.h"
-#include "qemu/timer.h"
-#include "sysemu/sysemu.h"
+#include "monitor.h"
+#include "qemu-timer.h"
+#include "sysemu.h"

 #define AUDIO_CAP "audio"
 #include "audio_int.h"
@@ -585,20 +585,17 @@ static int audio_pcm_info_eq (struct audio_pcm_info *info, struct audsettings *a
    switch (as->fmt) {
    case AUD_FMT_S8:
        sign = 1;
-        /* fall through */
    case AUD_FMT_U8:
        break;

    case AUD_FMT_S16:
        sign = 1;
-        /* fall through */
    case AUD_FMT_U16:
        bits = 16;
        break;

    case AUD_FMT_S32:
        sign = 1;
-        /* fall through */
    case AUD_FMT_U32:
        bits = 32;
        break;
@@ -818,7 +815,6 @@ static int audio_attach_capture (HWVoiceOut *hw)
        sw->active = hw->enabled;
        sw->conv = noop_conv;
        sw->ratio = ((int64_t) hw_cap->info.freq << 32) / sw->info.freq;
-        sw->vol = nominal_volume;
        sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
        if (!sw->rate) {
            dolog ("Could not start rate conversion for `%s'\n", SW_NAME (sw));
@@ -828,9 +824,8 @@ static int audio_attach_capture (HWVoiceOut *hw)
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
        QLIST_INSERT_HEAD (&hw->cap_head, sc, entries);
 #ifdef DEBUG_CAPTURE
-        sw->name = g_strdup_printf ("for %p %d,%d,%d",
-                                    hw, sw->info.freq, sw->info.bits,
-                                    sw->info.nchannels);
+        asprintf (&sw->name, "for %p %d,%d,%d",
+                  hw, sw->info.freq, sw->info.bits, sw->info.nchannels);
        dolog ("Added %s active = %d\n", sw->name, sw->active);
 #endif
        if (sw->active) {
@@ -959,9 +954,7 @@ int audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int size)
        total += isamp;
    }

-    if (!(hw->ctl_caps & VOICE_VOLUME_CAP)) {
-        mixeng_volume (sw->buf, ret, &sw->vol);
-    }
+    mixeng_volume (sw->buf, ret, &sw->vol);

    sw->clip (buf, sw->buf, ret);
    sw->total_hw_samples_acquired += total;
@@ -1045,10 +1038,7 @@ int audio_pcm_sw_write (SWVoiceOut *sw, void *buf, int size)
    swlim = audio_MIN (swlim, samples);
    if (swlim) {
        sw->conv (sw->buf, buf, swlim);
-
-        if (!(sw->hw->ctl_caps & VOICE_VOLUME_CAP)) {
-            mixeng_volume (sw->buf, swlim, &sw->vol);
-        }
+        mixeng_volume (sw->buf, swlim, &sw->vol);
    }

    while (swlim) {
@@ -1675,7 +1665,7 @@ static void audio_pp_nb_voices (const char *typ, int nb)
        printf ("Theoretically supports many %s voices\n", typ);
        break;
    default:
-        printf ("Theoretically supports up to %d %s voices\n", nb, typ);
+        printf ("Theoretically supports upto %d %s voices\n", nb, typ);
        break;
    }

@@ -1777,12 +1767,10 @@ static void audio_atexit (void)
    HWVoiceOut *hwo = NULL;
    HWVoiceIn *hwi = NULL;

-    while ((hwo = audio_pcm_hw_find_any_out (hwo))) {
+    while ((hwo = audio_pcm_hw_find_any_enabled_out (hwo))) {
        SWVoiceCap *sc;

-        if (hwo->enabled) {
-            hwo->pcm_ops->ctl_out (hwo, VOICE_DISABLE);
-        }
+        hwo->pcm_ops->ctl_out (hwo, VOICE_DISABLE);
        hwo->pcm_ops->fini_out (hwo);

        for (sc = hwo->cap_head.lh_first; sc; sc = sc->entries.le_next) {
@@ -1795,10 +1783,8 @@ static void audio_atexit (void)
        }
    }

-    while ((hwi = audio_pcm_hw_find_any_in (hwi))) {
-        if (hwi->enabled) {
-            hwi->pcm_ops->ctl_in (hwi, VOICE_DISABLE);
-        }
+    while ((hwi = audio_pcm_hw_find_any_enabled_in (hwi))) {
+        hwi->pcm_ops->ctl_in (hwi, VOICE_DISABLE);
        hwi->pcm_ops->fini_in (hwi);
    }

@@ -2064,29 +2050,17 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
 void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol)
 {
    if (sw) {
-        HWVoiceOut *hw = sw->hw;
-
        sw->vol.mute = mute;
        sw->vol.l = nominal_volume.l * lvol / 255;
        sw->vol.r = nominal_volume.r * rvol / 255;
-
-        if (hw->pcm_ops->ctl_out) {
-            hw->pcm_ops->ctl_out (hw, VOICE_VOLUME, sw);
-        }
    }
 }

 void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol)
 {
    if (sw) {
-        HWVoiceIn *hw = sw->hw;
-
        sw->vol.mute = mute;
        sw->vol.l = nominal_volume.l * lvol / 255;
        sw->vol.r = nominal_volume.r * rvol / 255;
-
-        if (hw->pcm_ops->ctl_in) {
-            hw->pcm_ops->ctl_in (hw, VOICE_VOLUME, sw);
-        }
    }
 }
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -25,7 +25,7 @@
 #define QEMU_AUDIO_H

 #include "config-host.h"
-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef void (*audio_callback_fn) (void *opaque, int avail);

--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -82,7 +82,6 @@ typedef struct HWVoiceOut {
    int samples;
    QLIST_HEAD (sw_out_listhead, SWVoiceOut) sw_head;
    QLIST_HEAD (sw_cap_listhead, SWVoiceCap) cap_head;
-    int ctl_caps;
    struct audio_pcm_ops *pcm_ops;
    QLIST_ENTRY (HWVoiceOut) entries;
 } HWVoiceOut;
@@ -102,7 +101,6 @@ typedef struct HWVoiceIn {

    int samples;
    QLIST_HEAD (sw_in_listhead, SWVoiceIn) sw_head;
-    int ctl_caps;
    struct audio_pcm_ops *pcm_ops;
    QLIST_ENTRY (HWVoiceIn) entries;
 } HWVoiceIn;
@@ -152,7 +150,6 @@ struct audio_driver {
    int max_voices_in;
    int voice_size_out;
    int voice_size_in;
-    int ctl_caps;
 };

 struct audio_pcm_ops {
@@ -234,9 +231,6 @@ void audio_run (const char *msg);

 #define VOICE_ENABLE 1
 #define VOICE_DISABLE 2
-#define VOICE_VOLUME 3
-
-#define VOICE_VOLUME_CAP (1 << VOICE_VOLUME)

 static inline int audio_ring_dist (int dst, int src, int len)
 {
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -263,8 +263,6 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
    }

    hw->pcm_ops = drv->pcm_ops;
-    hw->ctl_caps = drv->ctl_caps;
-
    QLIST_INIT (&hw->sw_head);
 #ifdef DAC
    QLIST_INIT (&hw->cap_head);
@@ -410,15 +408,15 @@ SW *glue (AUD_open_, TYPE) (
    SW *old_sw = NULL;
 #endif

+    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
+            name, as->freq, as->nchannels, as->fmt);
+
    if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
               card, name, callback_fn, as);
        goto fail;
    }

-    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
-            name, as->freq, as->nchannels, as->fmt);
-
    if (audio_bug (AUDIO_FUNC, audio_validate_settings (as))) {
        audio_print_settings (as);
        goto fail;
--- a/audio/esdaudio.c
+++ b/audio/esdaudio.c
@@ -201,7 +201,7 @@ static int qesd_init_out (HWVoiceOut *hw, struct audsettings *as)
    case AUD_FMT_S32:
    case AUD_FMT_U32:
        dolog ("Will use 16 instead of 32 bit samples\n");
-        /* fall through */
+
    case AUD_FMT_S16:
    case AUD_FMT_U16:
    deffmt:
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -33,8 +33,7 @@
 #define ENDIAN_CONVERT(v) (v)

 /* Signed 8 bit */
-#define BSIZE 8
-#define ITYPE int
+#define IN_T int8_t
 #define IN_MIN SCHAR_MIN
 #define IN_MAX SCHAR_MAX
 #define SIGNED
@@ -43,29 +42,25 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 /* Unsigned 8 bit */
-#define BSIZE 8
-#define ITYPE uint
+#define IN_T uint8_t
 #define IN_MIN 0
 #define IN_MAX UCHAR_MAX
 #define SHIFT 8
 #include "mixeng_template.h"
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 #undef ENDIAN_CONVERT
 #undef ENDIAN_CONVERSION

 /* Signed 16 bit */
-#define BSIZE 16
-#define ITYPE int
+#define IN_T int16_t
 #define IN_MIN SHRT_MIN
 #define IN_MAX SHRT_MAX
 #define SIGNED
@@ -83,13 +78,11 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 /* Unsigned 16 bit */
-#define BSIZE 16
-#define ITYPE uint
+#define IN_T uint16_t
 #define IN_MIN 0
 #define IN_MAX USHRT_MAX
 #define SHIFT 16
@@ -105,13 +98,11 @@
 #undef ENDIAN_CONVERSION
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 /* Signed 32 bit */
-#define BSIZE 32
-#define ITYPE int
+#define IN_T int32_t
 #define IN_MIN INT32_MIN
 #define IN_MAX INT32_MAX
 #define SIGNED
@@ -129,13 +120,11 @@
 #undef SIGNED
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 /* Unsigned 32 bit */
-#define BSIZE 32
-#define ITYPE uint
+#define IN_T uint32_t
 #define IN_MIN 0
 #define IN_MAX UINT32_MAX
 #define SHIFT 32
@@ -151,8 +140,7 @@
 #undef ENDIAN_CONVERSION
 #undef IN_MAX
 #undef IN_MIN
-#undef BSIZE
-#undef ITYPE
+#undef IN_T
 #undef SHIFT

 t_sample *mixeng_conv[2][2][2][3] = {
--- a/audio/mixeng_template.h
+++ b/audio/mixeng_template.h
@@ -31,8 +31,7 @@
 #define HALF (IN_MAX >> 1)
 #endif

-#define ET glue (ENDIAN_CONVERSION, glue (glue (glue (_, ITYPE), BSIZE), _t))
-#define IN_T glue (glue (ITYPE, BSIZE), _t)
+#define ET glue (ENDIAN_CONVERSION, glue (_, IN_T))

 #ifdef FLOAT_MIXENG
 static mixeng_real inline glue (conv_, ET) (IN_T v)
@@ -151,4 +150,3 @@ static void glue (glue (clip_, ET), _from_mono)

 #undef ET
 #undef HALF
-#undef IN_T
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -23,7 +23,7 @@
 */
 #include "qemu-common.h"
 #include "audio.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"

 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -31,8 +31,8 @@
 #include <sys/soundcard.h>
 #endif
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
-#include "qemu/host-utils.h"
+#include "host-utils.h"
+#include "qemu-char.h"
 #include "audio.h"

 #define AUDIO_CAP "oss"
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -2,7 +2,8 @@
 #include "qemu-common.h"
 #include "audio.h"

-#include <pulse/pulseaudio.h>
+#include <pulse/simple.h>
+#include <pulse/error.h>

 #define AUDIO_CAP "pulseaudio"
 #include "audio_int.h"
@@ -14,7 +15,7 @@ typedef struct {
    int live;
    int decr;
    int rpos;
-    pa_stream *stream;
+    pa_simple *s;
    void *pcm_buf;
    struct audio_pt pt;
 } PAVoiceOut;
@@ -25,23 +26,17 @@ typedef struct {
    int dead;
    int incr;
    int wpos;
-    pa_stream *stream;
+    pa_simple *s;
    void *pcm_buf;
    struct audio_pt pt;
-    const void *read_data;
-    size_t read_index, read_length;
 } PAVoiceIn;

-typedef struct {
+static struct {
    int samples;
    char *server;
    char *sink;
    char *source;
-    pa_threaded_mainloop *mainloop;
-    pa_context *context;
-} paaudio;
-
-static paaudio glob_paaudio = {
+} conf = {
    .samples = 4096,
 };

@@ -56,146 +51,6 @@ static void GCC_FMT_ATTR (2, 3) qpa_logerr (int err, const char *fmt, ...)
    AUD_log (AUDIO_CAP, "Reason: %s\n", pa_strerror (err));
 }

-#ifndef PA_CONTEXT_IS_GOOD
-static inline int PA_CONTEXT_IS_GOOD(pa_context_state_t x)
-{
-    return
-        x == PA_CONTEXT_CONNECTING ||
-        x == PA_CONTEXT_AUTHORIZING ||
-        x == PA_CONTEXT_SETTING_NAME ||
-        x == PA_CONTEXT_READY;
-}
-#endif
-
-#ifndef PA_STREAM_IS_GOOD
-static inline int PA_STREAM_IS_GOOD(pa_stream_state_t x)
-{
-    return
-        x == PA_STREAM_CREATING ||
-        x == PA_STREAM_READY;
-}
-#endif
-
-#define CHECK_SUCCESS_GOTO(c, rerror, expression, label)        \
-    do {                                                        \
-        if (!(expression)) {                                    \
-            if (rerror) {                                       \
-                *(rerror) = pa_context_errno ((c)->context);    \
-            }                                                   \
-            goto label;                                         \
-        }                                                       \
-    } while (0);
-
-#define CHECK_DEAD_GOTO(c, stream, rerror, label)                       \
-    do {                                                                \
-        if (!(c)->context || !PA_CONTEXT_IS_GOOD (pa_context_get_state((c)->context)) || \
-            !(stream) || !PA_STREAM_IS_GOOD (pa_stream_get_state ((stream)))) { \
-            if (((c)->context && pa_context_get_state ((c)->context) == PA_CONTEXT_FAILED) || \
-                ((stream) && pa_stream_get_state ((stream)) == PA_STREAM_FAILED)) { \
-                if (rerror) {                                           \
-                    *(rerror) = pa_context_errno ((c)->context);        \
-                }                                                       \
-            } else {                                                    \
-                if (rerror) {                                           \
-                    *(rerror) = PA_ERR_BADSTATE;                        \
-                }                                                       \
-            }                                                           \
-            goto label;                                                 \
-        }                                                               \
-    } while (0);
-
-static int qpa_simple_read (PAVoiceIn *p, void *data, size_t length, int *rerror)
-{
-    paaudio *g = &glob_paaudio;
-
-    pa_threaded_mainloop_lock (g->mainloop);
-
-    CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
-
-    while (length > 0) {
-        size_t l;
-
-        while (!p->read_data) {
-            int r;
-
-            r = pa_stream_peek (p->stream, &p->read_data, &p->read_length);
-            CHECK_SUCCESS_GOTO (g, rerror, r == 0, unlock_and_fail);
-
-            if (!p->read_data) {
-                pa_threaded_mainloop_wait (g->mainloop);
-                CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
-            } else {
-                p->read_index = 0;
-            }
-        }
-
-        l = p->read_length < length ? p->read_length : length;
-        memcpy (data, (const uint8_t *) p->read_data+p->read_index, l);
-
-        data = (uint8_t *) data + l;
-        length -= l;
-
-        p->read_index += l;
-        p->read_length -= l;
-
-        if (!p->read_length) {
-            int r;
-
-            r = pa_stream_drop (p->stream);
-            p->read_data = NULL;
-            p->read_length = 0;
-            p->read_index = 0;
-
-            CHECK_SUCCESS_GOTO (g, rerror, r == 0, unlock_and_fail);
-        }
-    }
-
-    pa_threaded_mainloop_unlock (g->mainloop);
-    return 0;
-
-unlock_and_fail:
-    pa_threaded_mainloop_unlock (g->mainloop);
-    return -1;
-}
-
-static int qpa_simple_write (PAVoiceOut *p, const void *data, size_t length, int *rerror)
-{
-    paaudio *g = &glob_paaudio;
-
-    pa_threaded_mainloop_lock (g->mainloop);
-
-    CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
-
-    while (length > 0) {
-        size_t l;
-        int r;
-
-        while (!(l = pa_stream_writable_size (p->stream))) {
-            pa_threaded_mainloop_wait (g->mainloop);
-            CHECK_DEAD_GOTO (g, p->stream, rerror, unlock_and_fail);
-        }
-
-        CHECK_SUCCESS_GOTO (g, rerror, l != (size_t) -1, unlock_and_fail);
-
-        if (l > length) {
-            l = length;
-        }
-
-        r = pa_stream_write (p->stream, data, l, NULL, 0LL, PA_SEEK_RELATIVE);
-        CHECK_SUCCESS_GOTO (g, rerror, r >= 0, unlock_and_fail);
-
-        data = (const uint8_t *) data + l;
-        length -= l;
-    }
-
-    pa_threaded_mainloop_unlock (g->mainloop);
-    return 0;
-
-unlock_and_fail:
-    pa_threaded_mainloop_unlock (g->mainloop);
-    return -1;
-}
-
 static void *qpa_thread_out (void *arg)
 {
    PAVoiceOut *pa = arg;
@@ -222,7 +77,7 @@ static void *qpa_thread_out (void *arg)
            }
        }

-        decr = to_mix = audio_MIN (pa->live, glob_paaudio.samples >> 2);
+        decr = to_mix = audio_MIN (pa->live, conf.samples >> 2);
        rpos = pa->rpos;

        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
@@ -236,8 +91,8 @@ static void *qpa_thread_out (void *arg)

            hw->clip (pa->pcm_buf, src, chunk);

-            if (qpa_simple_write (pa, pa->pcm_buf,
-                                  chunk << hw->info.shift, &error) < 0) {
+            if (pa_simple_write (pa->s, pa->pcm_buf,
+                                 chunk << hw->info.shift, &error) < 0) {
                qpa_logerr (error, "pa_simple_write failed\n");
                return NULL;
            }
@@ -314,7 +169,7 @@ static void *qpa_thread_in (void *arg)
            }
        }

-        incr = to_grab = audio_MIN (pa->dead, glob_paaudio.samples >> 2);
+        incr = to_grab = audio_MIN (pa->dead, conf.samples >> 2);
        wpos = pa->wpos;

        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
@@ -326,8 +181,8 @@ static void *qpa_thread_in (void *arg)
            int chunk = audio_MIN (to_grab, hw->samples - wpos);
            void *buf = advance (pa->pcm_buf, wpos);

-            if (qpa_simple_read (pa, buf,
-                                 chunk << hw->info.shift, &error) < 0) {
+            if (pa_simple_read (pa->s, buf,
+                                chunk << hw->info.shift, &error) < 0) {
                qpa_logerr (error, "pa_simple_read failed\n");
                return NULL;
            }
@@ -428,112 +283,6 @@ static audfmt_e pa_to_audfmt (pa_sample_format_t fmt, int *endianness)
    }
 }

-static void context_state_cb (pa_context *c, void *userdata)
-{
-    paaudio *g = &glob_paaudio;
-
-    switch (pa_context_get_state(c)) {
-    case PA_CONTEXT_READY:
-    case PA_CONTEXT_TERMINATED:
-    case PA_CONTEXT_FAILED:
-        pa_threaded_mainloop_signal (g->mainloop, 0);
-        break;
-
-    case PA_CONTEXT_UNCONNECTED:
-    case PA_CONTEXT_CONNECTING:
-    case PA_CONTEXT_AUTHORIZING:
-    case PA_CONTEXT_SETTING_NAME:
-        break;
-    }
-}
-
-static void stream_state_cb (pa_stream *s, void * userdata)
-{
-    paaudio *g = &glob_paaudio;
-
-    switch (pa_stream_get_state (s)) {
-
-    case PA_STREAM_READY:
-    case PA_STREAM_FAILED:
-    case PA_STREAM_TERMINATED:
-        pa_threaded_mainloop_signal (g->mainloop, 0);
-        break;
-
-    case PA_STREAM_UNCONNECTED:
-    case PA_STREAM_CREATING:
-        break;
-    }
-}
-
-static void stream_request_cb (pa_stream *s, size_t length, void *userdata)
-{
-    paaudio *g = &glob_paaudio;
-
-    pa_threaded_mainloop_signal (g->mainloop, 0);
-}
-
-static pa_stream *qpa_simple_new (
-        const char *server,
-        const char *name,
-        pa_stream_direction_t dir,
-        const char *dev,
-        const char *stream_name,
-        const pa_sample_spec *ss,
-        const pa_channel_map *map,
-        const pa_buffer_attr *attr,
-        int *rerror)
-{
-    paaudio *g = &glob_paaudio;
-    int r;
-    pa_stream *stream;
-
-    pa_threaded_mainloop_lock (g->mainloop);
-
-    stream = pa_stream_new (g->context, name, ss, map);
-    if (!stream) {
-        goto fail;
-    }
-
-    pa_stream_set_state_callback (stream, stream_state_cb, g);
-    pa_stream_set_read_callback (stream, stream_request_cb, g);
-    pa_stream_set_write_callback (stream, stream_request_cb, g);
-
-    if (dir == PA_STREAM_PLAYBACK) {
-        r = pa_stream_connect_playback (stream, dev, attr,
-                                        PA_STREAM_INTERPOLATE_TIMING
-#ifdef PA_STREAM_ADJUST_LATENCY
-                                        |PA_STREAM_ADJUST_LATENCY
-#endif
-                                        |PA_STREAM_AUTO_TIMING_UPDATE, NULL, NULL);
-    } else {
-        r = pa_stream_connect_record (stream, dev, attr,
-                                      PA_STREAM_INTERPOLATE_TIMING
-#ifdef PA_STREAM_ADJUST_LATENCY
-                                      |PA_STREAM_ADJUST_LATENCY
-#endif
-                                      |PA_STREAM_AUTO_TIMING_UPDATE);
-    }
-
-    if (r < 0) {
-      goto fail;
-    }
-
-    pa_threaded_mainloop_unlock (g->mainloop);
-
-    return stream;
-
-fail:
-    pa_threaded_mainloop_unlock (g->mainloop);
-
-    if (stream) {
-        pa_stream_unref (stream);
-    }
-
-    *rerror = pa_context_errno (g->context);
-
-    return NULL;
-}
-
 static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
 {
    int error;
@@ -557,24 +306,24 @@ static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)

    obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);

-    pa->stream = qpa_simple_new (
-        glob_paaudio.server,
+    pa->s = pa_simple_new (
+        conf.server,
        "qemu",
        PA_STREAM_PLAYBACK,
-        glob_paaudio.sink,
+        conf.sink,
        "pcm.playback",
        &ss,
        NULL,                   /* channel map */
        &ba,                    /* buffering attributes */
        &error
        );
-    if (!pa->stream) {
+    if (!pa->s) {
        qpa_logerr (error, "pa_simple_new for playback failed\n");
        goto fail1;
    }

    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = glob_paaudio.samples;
+    hw->samples = conf.samples;
    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->rpos = hw->rpos;
    if (!pa->pcm_buf) {
@@ -593,10 +342,8 @@ static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
    g_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
-    if (pa->stream) {
-        pa_stream_unref (pa->stream);
-        pa->stream = NULL;
-    }
+    pa_simple_free (pa->s);
+    pa->s = NULL;
 fail1:
    return -1;
 }
@@ -614,24 +361,24 @@ static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)

    obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);

-    pa->stream = qpa_simple_new (
-        glob_paaudio.server,
+    pa->s = pa_simple_new (
+        conf.server,
        "qemu",
        PA_STREAM_RECORD,
-        glob_paaudio.source,
+        conf.source,
        "pcm.capture",
        &ss,
        NULL,                   /* channel map */
        NULL,                   /* buffering attributes */
        &error
        );
-    if (!pa->stream) {
+    if (!pa->s) {
        qpa_logerr (error, "pa_simple_new for capture failed\n");
        goto fail1;
    }

    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = glob_paaudio.samples;
+    hw->samples = conf.samples;
    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->wpos = hw->wpos;
    if (!pa->pcm_buf) {
@@ -650,10 +397,8 @@ static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)
    g_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 fail2:
-    if (pa->stream) {
-        pa_stream_unref (pa->stream);
-        pa->stream = NULL;
-    }
+    pa_simple_free (pa->s);
+    pa->s = NULL;
 fail1:
    return -1;
 }
@@ -668,9 +413,9 @@ static void qpa_fini_out (HWVoiceOut *hw)
    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);

-    if (pa->stream) {
-        pa_stream_unref (pa->stream);
-        pa->stream = NULL;
+    if (pa->s) {
+        pa_simple_free (pa->s);
+        pa->s = NULL;
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
@@ -688,9 +433,9 @@ static void qpa_fini_in (HWVoiceIn *hw)
    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);

-    if (pa->stream) {
-        pa_stream_unref (pa->stream);
-        pa->stream = NULL;
+    if (pa->s) {
+        pa_simple_free (pa->s);
+        pa->s = NULL;
    }

    audio_pt_fini (&pa->pt, AUDIO_FUNC);
@@ -700,213 +445,52 @@ static void qpa_fini_in (HWVoiceIn *hw)

 static int qpa_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
-    PAVoiceOut *pa = (PAVoiceOut *) hw;
-    pa_operation *op;
-    pa_cvolume v;
-    paaudio *g = &glob_paaudio;
-
-#ifdef PA_CHECK_VERSION    /* macro is present in 0.9.16+ */
-    pa_cvolume_init (&v);  /* function is present in 0.9.13+ */
-#endif
-
-    switch (cmd) {
-    case VOICE_VOLUME:
-        {
-            SWVoiceOut *sw;
-            va_list ap;
-
-            va_start (ap, cmd);
-            sw = va_arg (ap, SWVoiceOut *);
-            va_end (ap);
-
-            v.channels = 2;
-            v.values[0] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.l) / UINT32_MAX;
-            v.values[1] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.r) / UINT32_MAX;
-
-            pa_threaded_mainloop_lock (g->mainloop);
-
-            op = pa_context_set_sink_input_volume (g->context,
-                pa_stream_get_index (pa->stream),
-                &v, NULL, NULL);
-            if (!op)
-                qpa_logerr (pa_context_errno (g->context),
-                            "set_sink_input_volume() failed\n");
-            else
-                pa_operation_unref (op);
-
-            op = pa_context_set_sink_input_mute (g->context,
-                pa_stream_get_index (pa->stream),
-               sw->vol.mute, NULL, NULL);
-            if (!op) {
-                qpa_logerr (pa_context_errno (g->context),
-                            "set_sink_input_mute() failed\n");
-            } else {
-                pa_operation_unref (op);
-            }
-
-            pa_threaded_mainloop_unlock (g->mainloop);
-        }
-    }
+    (void) hw;
+    (void) cmd;
    return 0;
 }

 static int qpa_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
-    PAVoiceIn *pa = (PAVoiceIn *) hw;
-    pa_operation *op;
-    pa_cvolume v;
-    paaudio *g = &glob_paaudio;
-
-#ifdef PA_CHECK_VERSION
-    pa_cvolume_init (&v);
-#endif
-
-    switch (cmd) {
-    case VOICE_VOLUME:
-        {
-            SWVoiceIn *sw;
-            va_list ap;
-
-            va_start (ap, cmd);
-            sw = va_arg (ap, SWVoiceIn *);
-            va_end (ap);
-
-            v.channels = 2;
-            v.values[0] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.l) / UINT32_MAX;
-            v.values[1] = ((PA_VOLUME_NORM - PA_VOLUME_MUTED) * sw->vol.r) / UINT32_MAX;
-
-            pa_threaded_mainloop_lock (g->mainloop);
-
-            /* FIXME: use the upcoming "set_source_output_{volume,mute}" */
-            op = pa_context_set_source_volume_by_index (g->context,
-                pa_stream_get_device_index (pa->stream),
-                &v, NULL, NULL);
-            if (!op) {
-                qpa_logerr (pa_context_errno (g->context),
-                            "set_source_volume() failed\n");
-            } else {
-                pa_operation_unref(op);
-            }
-
-            op = pa_context_set_source_mute_by_index (g->context,
-                pa_stream_get_index (pa->stream),
-                sw->vol.mute, NULL, NULL);
-            if (!op) {
-                qpa_logerr (pa_context_errno (g->context),
-                            "set_source_mute() failed\n");
-            } else {
-                pa_operation_unref (op);
-            }
-
-            pa_threaded_mainloop_unlock (g->mainloop);
-        }
-    }
+    (void) hw;
+    (void) cmd;
    return 0;
 }

 /* common */
 static void *qpa_audio_init (void)
 {
-    paaudio *g = &glob_paaudio;
-
-    g->mainloop = pa_threaded_mainloop_new ();
-    if (!g->mainloop) {
-        goto fail;
-    }
-
-    g->context = pa_context_new (pa_threaded_mainloop_get_api (g->mainloop), glob_paaudio.server);
-    if (!g->context) {
-        goto fail;
-    }
-
-    pa_context_set_state_callback (g->context, context_state_cb, g);
-
-    if (pa_context_connect (g->context, glob_paaudio.server, 0, NULL) < 0) {
-        qpa_logerr (pa_context_errno (g->context),
-                    "pa_context_connect() failed\n");
-        goto fail;
-    }
-
-    pa_threaded_mainloop_lock (g->mainloop);
-
-    if (pa_threaded_mainloop_start (g->mainloop) < 0) {
-        goto unlock_and_fail;
-    }
-
-    for (;;) {
-        pa_context_state_t state;
-
-        state = pa_context_get_state (g->context);
-
-        if (state == PA_CONTEXT_READY) {
-            break;
-        }
-
-        if (!PA_CONTEXT_IS_GOOD (state)) {
-            qpa_logerr (pa_context_errno (g->context),
-                        "Wrong context state\n");
-            goto unlock_and_fail;
-        }
-
-        /* Wait until the context is ready */
-        pa_threaded_mainloop_wait (g->mainloop);
-    }
-
-    pa_threaded_mainloop_unlock (g->mainloop);
-
-    return &glob_paaudio;
-
-unlock_and_fail:
-    pa_threaded_mainloop_unlock (g->mainloop);
-fail:
-    AUD_log (AUDIO_CAP, "Failed to initialize PA context");
-    return NULL;
+    return &conf;
 }

 static void qpa_audio_fini (void *opaque)
 {
-    paaudio *g = opaque;
-
-    if (g->mainloop) {
-        pa_threaded_mainloop_stop (g->mainloop);
-    }
-
-    if (g->context) {
-        pa_context_disconnect (g->context);
-        pa_context_unref (g->context);
-        g->context = NULL;
-    }
-
-    if (g->mainloop) {
-        pa_threaded_mainloop_free (g->mainloop);
-    }
-
-    g->mainloop = NULL;
+    (void) opaque;
 }

 struct audio_option qpa_options[] = {
    {
        .name  = "SAMPLES",
        .tag   = AUD_OPT_INT,
-        .valp  = &glob_paaudio.samples,
+        .valp  = &conf.samples,
        .descr = "buffer size in samples"
    },
    {
        .name  = "SERVER",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_paaudio.server,
+        .valp  = &conf.server,
        .descr = "server address"
    },
    {
        .name  = "SINK",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_paaudio.sink,
+        .valp  = &conf.sink,
        .descr = "sink device name"
    },
    {
        .name  = "SOURCE",
        .tag   = AUD_OPT_STR,
-        .valp  = &glob_paaudio.source,
+        .valp  = &conf.source,
        .descr = "source device name"
    },
    { /* End of list */ }
@@ -937,6 +521,5 @@ struct audio_driver pa_audio_driver = {
    .max_voices_out = INT_MAX,
    .max_voices_in  = INT_MAX,
    .voice_size_out = sizeof (PAVoiceOut),
-    .voice_size_in  = sizeof (PAVoiceIn),
-    .ctl_caps       = VOICE_VOLUME_CAP
+    .voice_size_in  = sizeof (PAVoiceIn)
 };
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -18,7 +18,7 @@
 */

 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "ui/qemu-spice.h"

 #define AUDIO_CAP "spice"
@@ -202,26 +202,7 @@ static int line_out_ctl (HWVoiceOut *hw, int cmd, ...)
        }
        spice_server_playback_stop (&out->sin);
        break;
-    case VOICE_VOLUME:
-        {
-#if ((SPICE_INTERFACE_PLAYBACK_MAJOR >= 1) && (SPICE_INTERFACE_PLAYBACK_MINOR >= 2))
-            SWVoiceOut *sw;
-            va_list ap;
-            uint16_t vol[2];
-
-            va_start (ap, cmd);
-            sw = va_arg (ap, SWVoiceOut *);
-            va_end (ap);
-
-            vol[0] = sw->vol.l / ((1ULL << 16) + 1);
-            vol[1] = sw->vol.r / ((1ULL << 16) + 1);
-            spice_server_playback_set_volume (&out->sin, 2, vol);
-            spice_server_playback_set_mute (&out->sin, sw->vol.mute);
-#endif
-            break;
-        }
    }
-
    return 0;
 }

@@ -323,26 +304,7 @@ static int line_in_ctl (HWVoiceIn *hw, int cmd, ...)
        in->active = 0;
        spice_server_record_stop (&in->sin);
        break;
-    case VOICE_VOLUME:
-        {
-#if ((SPICE_INTERFACE_RECORD_MAJOR >= 2) && (SPICE_INTERFACE_RECORD_MINOR >= 2))
-            SWVoiceIn *sw;
-            va_list ap;
-            uint16_t vol[2];
-
-            va_start (ap, cmd);
-            sw = va_arg (ap, SWVoiceIn *);
-            va_end (ap);
-
-            vol[0] = sw->vol.l / ((1ULL << 16) + 1);
-            vol[1] = sw->vol.r / ((1ULL << 16) + 1);
-            spice_server_record_set_volume (&in->sin, 2, vol);
-            spice_server_record_set_mute (&in->sin, sw->vol.mute);
-#endif
-            break;
-        }
    }
-
    return 0;
 }

@@ -375,9 +337,6 @@ struct audio_driver spice_audio_driver = {
    .max_voices_in  = 1,
    .voice_size_out = sizeof (SpiceVoiceOut),
    .voice_size_in  = sizeof (SpiceVoiceIn),
-#if ((SPICE_INTERFACE_PLAYBACK_MAJOR >= 1) && (SPICE_INTERFACE_PLAYBACK_MINOR >= 2))
-    .ctl_caps       = VOICE_VOLUME_CAP
-#endif
 };

 void qemu_spice_audio_init (void)
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "audio.h"

 #define AUDIO_CAP "wav"
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,5 +1,5 @@
 #include "hw/hw.h"
-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "audio.h"

 typedef struct {
--- a/audio/winwaveaudio.c
+++ b/audio/winwaveaudio.c
@@ -1,7 +1,7 @@
 /* public domain */

 #include "qemu-common.h"
-#include "sysemu/sysemu.h"
+#include "sysemu.h"
 #include "audio.h"

 #define AUDIO_CAP "winwave"
@@ -72,7 +72,7 @@ static void winwave_log_mmresult (MMRESULT mr)
        break;

    case MMSYSERR_NOMEM:
-        str = "Unable to allocate or lock memory";
+        str = "Unable to allocate or locl memory";
        break;

    case WAVERR_SYNC:
@@ -349,15 +349,21 @@ static int winwave_ctl_out (HWVoiceOut *hw, int cmd, ...)
            else {
                hw->poll_mode = 0;
            }
-            wave->paused = 0;
+            if (wave->paused) {
+                mr = waveOutRestart (wave->hwo);
+                if (mr != MMSYSERR_NOERROR) {
+                    winwave_logerr (mr, "waveOutRestart");
+                }
+                wave->paused = 0;
+            }
        }
        return 0;

    case VOICE_DISABLE:
        if (!wave->paused) {
-            mr = waveOutReset (wave->hwo);
+            mr = waveOutPause (wave->hwo);
            if (mr != MMSYSERR_NOERROR) {
-                winwave_logerr (mr, "waveOutReset");
+                winwave_logerr (mr, "waveOutPause");
            }
            else {
                wave->paused = 1;
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -1,2 +0,0 @@
-common-obj-y += rng.o rng-egd.o
-common-obj-$(CONFIG_POSIX) += rng-random.o
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -1,224 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/rng.h"
-#include "char/char.h"
-#include "qapi/qmp/qerror.h"
-#include "hw/qdev.h" /* just for DEFINE_PROP_CHR */
-
-#define TYPE_RNG_EGD "rng-egd"
-#define RNG_EGD(obj) OBJECT_CHECK(RngEgd, (obj), TYPE_RNG_EGD)
-
-typedef struct RngEgd
-{
-    RngBackend parent;
-
-    CharDriverState *chr;
-    char *chr_name;
-
-    GSList *requests;
-} RngEgd;
-
-typedef struct RngRequest
-{
-    EntropyReceiveFunc *receive_entropy;
-    uint8_t *data;
-    void *opaque;
-    size_t offset;
-    size_t size;
-} RngRequest;
-
-static void rng_egd_request_entropy(RngBackend *b, size_t size,
-                                    EntropyReceiveFunc *receive_entropy,
-                                    void *opaque)
-{
-    RngEgd *s = RNG_EGD(b);
-    RngRequest *req;
-
-    req = g_malloc(sizeof(*req));
-
-    req->offset = 0;
-    req->size = size;
-    req->receive_entropy = receive_entropy;
-    req->opaque = opaque;
-    req->data = g_malloc(req->size);
-
-    while (size > 0) {
-        uint8_t header[2];
-        uint8_t len = MIN(size, 255);
-
-        /* synchronous entropy request */
-        header[0] = 0x02;
-        header[1] = len;
-
-        qemu_chr_fe_write(s->chr, header, sizeof(header));
-
-        size -= len;
-    }
-
-    s->requests = g_slist_append(s->requests, req);
-}
-
-static void rng_egd_free_request(RngRequest *req)
-{
-    g_free(req->data);
-    g_free(req);
-}
-
-static int rng_egd_chr_can_read(void *opaque)
-{
-    RngEgd *s = RNG_EGD(opaque);
-    GSList *i;
-    int size = 0;
-
-    for (i = s->requests; i; i = i->next) {
-        RngRequest *req = i->data;
-        size += req->size - req->offset;
-    }
-
-    return size;
-}
-
-static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
-{
-    RngEgd *s = RNG_EGD(opaque);
-
-    while (size > 0 && s->requests) {
-        RngRequest *req = s->requests->data;
-        int len = MIN(size, req->size - req->offset);
-
-        memcpy(req->data + req->offset, buf, len);
-        req->offset += len;
-        size -= len;
-
-        if (req->offset == req->size) {
-            s->requests = g_slist_remove_link(s->requests, s->requests);
-
-            req->receive_entropy(req->opaque, req->data, req->size);
-
-            rng_egd_free_request(req);
-        }
-    }
-}
-
-static void rng_egd_free_requests(RngEgd *s)
-{
-    GSList *i;
-
-    for (i = s->requests; i; i = i->next) {
-        rng_egd_free_request(i->data);
-    }
-
-    g_slist_free(s->requests);
-    s->requests = NULL;
-}
-
-static void rng_egd_cancel_requests(RngBackend *b)
-{
-    RngEgd *s = RNG_EGD(b);
-
-    /* We simply delete the list of pending requests.  If there is data in the 
-     * queue waiting to be read, this is okay, because there will always be
-     * more data than we requested originally
-     */
-    rng_egd_free_requests(s);
-}
-
-static void rng_egd_opened(RngBackend *b, Error **errp)
-{
-    RngEgd *s = RNG_EGD(b);
-
-    if (s->chr_name == NULL) {
-        error_set(errp, QERR_INVALID_PARAMETER_VALUE,
-                  "chardev", "a valid character device");
-        return;
-    }
-
-    s->chr = qemu_chr_find(s->chr_name);
-    if (s->chr == NULL) {
-        error_set(errp, QERR_DEVICE_NOT_FOUND, s->chr_name);
-        return;
-    }
-
-    /* FIXME we should resubmit pending requests when the CDS reconnects. */
-    qemu_chr_add_handlers(s->chr, rng_egd_chr_can_read, rng_egd_chr_read,
-                          NULL, s);
-}
-
-static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
-{
-    RngBackend *b = RNG_BACKEND(obj);
-    RngEgd *s = RNG_EGD(b);
-
-    if (b->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-    } else {
-        g_free(s->chr_name);
-        s->chr_name = g_strdup(value);
-    }
-}
-
-static char *rng_egd_get_chardev(Object *obj, Error **errp)
-{
-    RngEgd *s = RNG_EGD(obj);
-
-    if (s->chr && s->chr->label) {
-        return g_strdup(s->chr->label);
-    }
-
-    return NULL;
-}
-
-static void rng_egd_init(Object *obj)
-{
-    object_property_add_str(obj, "chardev",
-                            rng_egd_get_chardev, rng_egd_set_chardev,
-                            NULL);
-}
-
-static void rng_egd_finalize(Object *obj)
-{
-    RngEgd *s = RNG_EGD(obj);
-
-    if (s->chr) {
-        qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL);
-    }
-
-    g_free(s->chr_name);
-
-    rng_egd_free_requests(s);
-}
-
-static void rng_egd_class_init(ObjectClass *klass, void *data)
-{
-    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
-
-    rbc->request_entropy = rng_egd_request_entropy;
-    rbc->cancel_requests = rng_egd_cancel_requests;
-    rbc->opened = rng_egd_opened;
-}
-
-static const TypeInfo rng_egd_info = {
-    .name = TYPE_RNG_EGD,
-    .parent = TYPE_RNG_BACKEND,
-    .instance_size = sizeof(RngEgd),
-    .class_init = rng_egd_class_init,
-    .instance_init = rng_egd_init,
-    .instance_finalize = rng_egd_finalize,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_egd_info);
-}
-
-type_init(register_types);
--- a/backends/rng-random.c
+++ b/backends/rng-random.c
@@ -1,164 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/rng-random.h"
-#include "qemu/rng.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/main-loop.h"
-
-struct RndRandom
-{
-    RngBackend parent;
-
-    int fd;
-    char *filename;
-
-    EntropyReceiveFunc *receive_func;
-    void *opaque;
-    size_t size;
-};
-
-/**
- * A simple and incomplete backend to request entropy from /dev/random.
- *
- * This backend exposes an additional "filename" property that can be used to
- * set the filename to use to open the backend.
- */
-
-static void entropy_available(void *opaque)
-{
-    RndRandom *s = RNG_RANDOM(opaque);
-    uint8_t buffer[s->size];
-    ssize_t len;
-
-    len = read(s->fd, buffer, s->size);
-    if (len < 0 && errno == EAGAIN) {
-        return;
-    }
-    g_assert(len != -1);
-
-    s->receive_func(s->opaque, buffer, len);
-    s->receive_func = NULL;
-
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-}
-
-static void rng_random_request_entropy(RngBackend *b, size_t size,
-                                        EntropyReceiveFunc *receive_entropy,
-                                        void *opaque)
-{
-    RndRandom *s = RNG_RANDOM(b);
-
-    if (s->receive_func) {
-        s->receive_func(s->opaque, NULL, 0);
-    }
-
-    s->receive_func = receive_entropy;
-    s->opaque = opaque;
-    s->size = size;
-
-    qemu_set_fd_handler(s->fd, entropy_available, NULL, s);
-}
-
-static void rng_random_opened(RngBackend *b, Error **errp)
-{
-    RndRandom *s = RNG_RANDOM(b);
-
-    if (s->filename == NULL) {
-        error_set(errp, QERR_INVALID_PARAMETER_VALUE,
-                  "filename", "a valid filename");
-    } else {
-        s->fd = open(s->filename, O_RDONLY | O_NONBLOCK);
-
-        if (s->fd == -1) {
-            error_set(errp, QERR_OPEN_FILE_FAILED, s->filename);
-        }
-    }
-}
-
-static char *rng_random_get_filename(Object *obj, Error **errp)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    if (s->filename) {
-        return g_strdup(s->filename);
-    }
-
-    return NULL;
-}
-
-static void rng_random_set_filename(Object *obj, const char *filename,
-                                 Error **errp)
-{
-    RngBackend *b = RNG_BACKEND(obj);
-    RndRandom *s = RNG_RANDOM(obj);
-
-    if (b->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-        return;
-    }
-
-    if (s->filename) {
-        g_free(s->filename);
-    }
-
-    s->filename = g_strdup(filename);
-}
-
-static void rng_random_init(Object *obj)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    object_property_add_str(obj, "filename",
-                            rng_random_get_filename,
-                            rng_random_set_filename,
-                            NULL);
-
-    s->filename = g_strdup("/dev/random");
-}
-
-static void rng_random_finalize(Object *obj)
-{
-    RndRandom *s = RNG_RANDOM(obj);
-
-    qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
-
-    if (s->fd != -1) {
-        close(s->fd);
-    }
-
-    g_free(s->filename);
-}
-
-static void rng_random_class_init(ObjectClass *klass, void *data)
-{
-    RngBackendClass *rbc = RNG_BACKEND_CLASS(klass);
-
-    rbc->request_entropy = rng_random_request_entropy;
-    rbc->opened = rng_random_opened;
-}
-
-static const TypeInfo rng_random_info = {
-    .name = TYPE_RNG_RANDOM,
-    .parent = TYPE_RNG_BACKEND,
-    .instance_size = sizeof(RndRandom),
-    .class_init = rng_random_class_init,
-    .instance_init = rng_random_init,
-    .instance_finalize = rng_random_finalize,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_random_info);
-}
-
-type_init(register_types);
--- a/backends/rng.c
+++ b/backends/rng.c
@@ -1,93 +0,0 @@
-/*
- * QEMU Random Number Generator Backend
- *
- * Copyright IBM, Corp. 2012
- *
- * Authors:
- *  Anthony Liguori   <aliguori@us.ibm.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/rng.h"
-#include "qapi/qmp/qerror.h"
-
-void rng_backend_request_entropy(RngBackend *s, size_t size,
-                                 EntropyReceiveFunc *receive_entropy,
-                                 void *opaque)
-{
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (k->request_entropy) {
-        k->request_entropy(s, size, receive_entropy, opaque);
-    }
-}
-
-void rng_backend_cancel_requests(RngBackend *s)
-{
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (k->cancel_requests) {
-        k->cancel_requests(s);
-    }
-}
-
-static bool rng_backend_prop_get_opened(Object *obj, Error **errp)
-{
-    RngBackend *s = RNG_BACKEND(obj);
-
-    return s->opened;
-}
-
-void rng_backend_open(RngBackend *s, Error **errp)
-{
-    object_property_set_bool(OBJECT(s), true, "opened", errp);
-}
-
-static void rng_backend_prop_set_opened(Object *obj, bool value, Error **errp)
-{
-    RngBackend *s = RNG_BACKEND(obj);
-    RngBackendClass *k = RNG_BACKEND_GET_CLASS(s);
-
-    if (value == s->opened) {
-        return;
-    }
-
-    if (!value && s->opened) {
-        error_set(errp, QERR_PERMISSION_DENIED);
-        return;
-    }
-
-    if (k->opened) {
-        k->opened(s, errp);
-    }
-
-    if (!error_is_set(errp)) {
-        s->opened = value;
-    }
-}
-
-static void rng_backend_init(Object *obj)
-{
-    object_property_add_bool(obj, "opened",
-                             rng_backend_prop_get_opened,
-                             rng_backend_prop_set_opened,
-                             NULL);
-}
-
-static const TypeInfo rng_backend_info = {
-    .name = TYPE_RNG_BACKEND,
-    .parent = TYPE_OBJECT,
-    .instance_size = sizeof(RngBackend),
-    .instance_init = rng_backend_init,
-    .class_size = sizeof(RngBackendClass),
-    .abstract = true,
-};
-
-static void register_types(void)
-{
-    type_register_static(&rng_backend_info);
-}
-
-type_init(register_types);
--- a/balloon.c
+++ b/balloon.c
@@ -24,13 +24,12 @@
 * THE SOFTWARE.
 */

-#include "monitor/monitor.h"
-#include "exec/cpu-common.h"
-#include "sysemu/kvm.h"
-#include "sysemu/balloon.h"
+#include "monitor.h"
+#include "cpu-common.h"
+#include "kvm.h"
+#include "balloon.h"
 #include "trace.h"
 #include "qmp-commands.h"
-#include "qapi/qmp/qjson.h"

 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
@@ -81,19 +80,6 @@ static int qemu_balloon_status(BalloonInfo *info)
    return 1;
 }

-void qemu_balloon_changed(int64_t actual)
-{
-    QObject *data;
-
-    data = qobject_from_jsonf("{ 'actual': %" PRId64 " }",
-                              actual);
-
-    monitor_protocol_event(QEVENT_BALLOON_CHANGE, data);
-
-    qobject_decref(data);
-}
-
-
 BalloonInfo *qmp_query_balloon(Error **errp)
 {
    BalloonInfo *info;
@@ -114,19 +100,31 @@ BalloonInfo *qmp_query_balloon(Error **errp)
    return info;
 }

-void qmp_balloon(int64_t value, Error **errp)
+/**
+ * do_balloon(): Request VM to change its memory allocation
+ */
+int do_balloon(Monitor *mon, const QDict *params,
+	       MonitorCompletion cb, void *opaque)
 {
+    int64_t target;
+    int ret;
+
    if (kvm_enabled() && !kvm_has_sync_mmu()) {
-        error_set(errp, QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
-        return;
+        qerror_report(QERR_KVM_MISSING_CAP, "synchronous MMU", "balloon");
+        return -1;
    }

-    if (value <= 0) {
-        error_set(errp, QERR_INVALID_PARAMETER_VALUE, "target", "a size");
-        return;
+    target = qdict_get_int(params, "value");
+    if (target <= 0) {
+        qerror_report(QERR_INVALID_PARAMETER_VALUE, "target", "a size");
+        return -1;
    }
-    
-    if (qemu_balloon(value) == 0) {
-        error_set(errp, QERR_DEVICE_NOT_ACTIVE, "balloon");
+    ret = qemu_balloon(target);
+    if (ret == 0) {
+        qerror_report(QERR_DEVICE_NOT_ACTIVE, "balloon");
+        return -1;
    }
+
+    cb(opaque, NULL);
+    return 0;
 }
--- a/include/sysemu/balloon.h
+++ b/include/sysemu/balloon.h
@@ -14,7 +14,7 @@
 #ifndef _QEMU_BALLOON_H
 #define _QEMU_BALLOON_H

-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "qapi-types.h"

 typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
@@ -24,6 +24,7 @@ int qemu_add_balloon_handler(QEMUBalloonEvent *event_func,
 			     QEMUBalloonStatus *stat_func, void *opaque);
 void qemu_remove_balloon_handler(void *opaque);

-void qemu_balloon_changed(int64_t actual);
+int do_balloon(Monitor *mon, const QDict *params,
+               MonitorCompletion cb, void *opaque);

 #endif
--- a/util/bitmap.c
+++ b/util/bitmap.c
@@ -9,8 +9,8 @@
 * Version 2.
 */

-#include "qemu/bitops.h"
-#include "qemu/bitmap.h"
+#include "bitops.h"
+#include "bitmap.h"

 /*
 * bitmaps provide an array of bits, implemented using an an
--- a/include/qemu/bitmap.h
+++ b/include/qemu/bitmap.h
@@ -13,7 +13,7 @@
 #define BITMAP_H

 #include "qemu-common.h"
-#include "qemu/bitops.h"
+#include "bitops.h"

 /*
 * The available bitmap operations and their rough meaning in the
--- a/util/bitops.c
+++ b/util/bitops.c
@@ -11,7 +11,7 @@
 * 2 of the License, or (at your option) any later version.
 */

-#include "qemu/bitops.h"
+#include "bitops.h"

 #define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)

@@ -60,7 +60,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + bitops_ctzl(tmp);
+    return result + bitops_ffsl(tmp);
 }

 /*
@@ -109,7 +109,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + bitops_ctol(tmp);
+    return result + ffz(tmp);
 }

 unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -13,7 +13,6 @@
 #define BITOPS_H

 #include "qemu-common.h"
-#include "host-utils.h"

 #define BITS_PER_BYTE           CHAR_BIT
 #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
@@ -24,29 +23,41 @@
 #define BITS_TO_LONGS(nr)	DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))

 /**
- * bitops_ctzl - count trailing zeroes in word.
+ * bitops_ffs - find first bit in word.
 * @word: The word to search
 *
- * Returns -1 if no bit exists.  Note that compared to the C library
- * routine ffsl, this one returns one less.
+ * Undefined if no bit exists, so code should check against 0 first.
 */
-static unsigned long bitops_ctzl(unsigned long word)
+static unsigned long bitops_ffsl(unsigned long word)
 {
-#if QEMU_GNUC_PREREQ(3, 4)
-    return __builtin_ffsl(word) - 1;
-#else
-    if (!word) {
-        return -1;
-    }
+	int num = 0;

-    if (sizeof(long) == 4) {
-        return ctz32(word);
-    } else if (sizeof(long) == 8) {
-        return ctz64(word);
-    } else {
-        abort();
-    }
+#if LONG_MAX > 0x7FFFFFFF
+	if ((word & 0xffffffff) == 0) {
+		num += 32;
+		word >>= 32;
+	}
 #endif
+	if ((word & 0xffff) == 0) {
+		num += 16;
+		word >>= 16;
+	}
+	if ((word & 0xff) == 0) {
+		num += 8;
+		word >>= 8;
+	}
+	if ((word & 0xf) == 0) {
+		num += 4;
+		word >>= 4;
+	}
+	if ((word & 0x3) == 0) {
+		num += 2;
+		word >>= 2;
+	}
+	if ((word & 0x1) == 0) {
+		num += 1;
+        }
+	return num;
 }

 /**
@@ -88,14 +99,14 @@ static inline unsigned long bitops_flsl(unsigned long word)
 }

 /**
- * cto - count trailing ones in word.
+ * ffz - find first zero in word.
 * @word: The word to search
 *
- * Returns -1 if all bit are set.
+ * Undefined if no zero exists, so code should check against ~0UL first.
 */
-static inline unsigned long bitops_ctol(unsigned long word)
+static inline unsigned long ffz(unsigned long word)
 {
-    return bitops_ctzl(~word);
+    return bitops_ffsl(~word);
 }

 /**
@@ -103,10 +114,10 @@ static inline unsigned long bitops_ctol(unsigned long word)
 * @nr: the bit to set
 * @addr: the address to start counting from
 */
-static inline void set_bit(int nr, unsigned long *addr)
+static inline void set_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);

 	*p  |= mask;
 }
@@ -116,10 +127,10 @@ static inline void set_bit(int nr, unsigned long *addr)
 * @nr: Bit to clear
 * @addr: Address to start counting from
 */
-static inline void clear_bit(int nr, unsigned long *addr)
+static inline void clear_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);

 	*p &= ~mask;
 }
@@ -129,10 +140,10 @@ static inline void clear_bit(int nr, unsigned long *addr)
 * @nr: Bit to change
 * @addr: Address to start counting from
 */
-static inline void change_bit(int nr, unsigned long *addr)
+static inline void change_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);

 	*p ^= mask;
 }
@@ -142,10 +153,10 @@ static inline void change_bit(int nr, unsigned long *addr)
 * @nr: Bit to set
 * @addr: Address to count from
 */
-static inline int test_and_set_bit(int nr, unsigned long *addr)
+static inline int test_and_set_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
 	unsigned long old = *p;

 	*p = old | mask;
@@ -157,10 +168,10 @@ static inline int test_and_set_bit(int nr, unsigned long *addr)
 * @nr: Bit to clear
 * @addr: Address to count from
 */
-static inline int test_and_clear_bit(int nr, unsigned long *addr)
+static inline int test_and_clear_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
 	unsigned long old = *p;

 	*p = old & ~mask;
@@ -172,10 +183,10 @@ static inline int test_and_clear_bit(int nr, unsigned long *addr)
 * @nr: Bit to change
 * @addr: Address to count from
 */
-static inline int test_and_change_bit(int nr, unsigned long *addr)
+static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
 {
 	unsigned long mask = BIT_MASK(nr);
-        unsigned long *p = addr + BIT_WORD(nr);
+	unsigned long *p = ((unsigned long *)addr) + BIT_WORD(nr);
 	unsigned long old = *p;

 	*p = old ^ mask;
@@ -187,7 +198,7 @@ static inline int test_and_change_bit(int nr, unsigned long *addr)
 * @nr: bit number to test
 * @addr: Address to start counting from
 */
-static inline int test_bit(int nr, const unsigned long *addr)
+static inline int test_bit(int nr, const volatile unsigned long *addr)
 {
 	return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1)));
 }
@@ -258,94 +269,4 @@ static inline unsigned long hweight_long(unsigned long w)
    return count;
 }

-/**
- * extract32:
- * @value: the value to extract the bit field from
- * @start: the lowest bit in the bit field (numbered from 0)
- * @length: the length of the bit field
- *
- * Extract from the 32 bit input @value the bit field specified by the
- * @start and @length parameters, and return it. The bit field must
- * lie entirely within the 32 bit word. It is valid to request that
- * all 32 bits are returned (ie @length 32 and @start 0).
- *
- * Returns: the value of the bit field extracted from the input value.
- */
-static inline uint32_t extract32(uint32_t value, int start, int length)
-{
-    assert(start >= 0 && length > 0 && length <= 32 - start);
-    return (value >> start) & (~0U >> (32 - length));
-}
-
-/**
- * extract64:
- * @value: the value to extract the bit field from
- * @start: the lowest bit in the bit field (numbered from 0)
- * @length: the length of the bit field
- *
- * Extract from the 64 bit input @value the bit field specified by the
- * @start and @length parameters, and return it. The bit field must
- * lie entirely within the 64 bit word. It is valid to request that
- * all 64 bits are returned (ie @length 64 and @start 0).
- *
- * Returns: the value of the bit field extracted from the input value.
- */
-static inline uint64_t extract64(uint64_t value, int start, int length)
-{
-    assert(start >= 0 && length > 0 && length <= 64 - start);
-    return (value >> start) & (~0ULL >> (64 - length));
-}
-
-/**
- * deposit32:
- * @value: initial value to insert bit field into
- * @start: the lowest bit in the bit field (numbered from 0)
- * @length: the length of the bit field
- * @fieldval: the value to insert into the bit field
- *
- * Deposit @fieldval into the 32 bit @value at the bit field specified
- * by the @start and @length parameters, and return the modified
- * @value. Bits of @value outside the bit field are not modified.
- * Bits of @fieldval above the least significant @length bits are
- * ignored. The bit field must lie entirely within the 32 bit word.
- * It is valid to request that all 32 bits are modified (ie @length
- * 32 and @start 0).
- *
- * Returns: the modified @value.
- */
-static inline uint32_t deposit32(uint32_t value, int start, int length,
-                                 uint32_t fieldval)
-{
-    uint32_t mask;
-    assert(start >= 0 && length > 0 && length <= 32 - start);
-    mask = (~0U >> (32 - length)) << start;
-    return (value & ~mask) | ((fieldval << start) & mask);
-}
-
-/**
- * deposit64:
- * @value: initial value to insert bit field into
- * @start: the lowest bit in the bit field (numbered from 0)
- * @length: the length of the bit field
- * @fieldval: the value to insert into the bit field
- *
- * Deposit @fieldval into the 64 bit @value at the bit field specified
- * by the @start and @length parameters, and return the modified
- * @value. Bits of @value outside the bit field are not modified.
- * Bits of @fieldval above the least significant @length bits are
- * ignored. The bit field must lie entirely within the 64 bit word.
- * It is valid to request that all 64 bits are modified (ie @length
- * 64 and @start 0).
- *
- * Returns: the modified @value.
- */
-static inline uint64_t deposit64(uint64_t value, int start, int length,
-                                 uint64_t fieldval)
-{
-    uint64_t mask;
-    assert(start >= 0 && length > 0 && length <= 64 - start);
-    mask = (~0ULL >> (64 - length)) << start;
-    return (value & ~mask) | ((fieldval << start) & mask);
-}
-
 #endif
--- a/block-migration.c
+++ b/block-migration.c
@@ -9,22 +9,20 @@
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "hw/hw.h"
-#include "qemu/queue.h"
-#include "qemu/timer.h"
-#include "migration/block.h"
-#include "migration/migration.h"
-#include "sysemu/blockdev.h"
+#include "qemu-queue.h"
+#include "qemu-timer.h"
+#include "monitor.h"
+#include "block-migration.h"
+#include "migration.h"
+#include "blockdev.h"
 #include <assert.h>

-#define BLOCK_SIZE                       (1 << 20)
-#define BDRV_SECTORS_PER_DIRTY_CHUNK     (BLOCK_SIZE >> BDRV_SECTOR_BITS)
+#define BLOCK_SIZE (BDRV_SECTORS_PER_DIRTY_CHUNK << BDRV_SECTOR_BITS)

 #define BLK_MIG_FLAG_DEVICE_BLOCK       0x01
 #define BLK_MIG_FLAG_EOS                0x02
@@ -78,7 +76,9 @@ typedef struct BlkMigState {
    int64_t total_sector_sum;
    int prev_progress;
    int bulk_completed;
+    long double total_time;
    long double prev_time_offset;
+    int reads;
 } BlkMigState;

 static BlkMigState block_mig_state;
@@ -131,6 +131,12 @@ uint64_t blk_mig_bytes_total(void)
    return sum << BDRV_SECTOR_BITS;
 }

+static inline long double compute_read_bwidth(void)
+{
+    assert(block_mig_state.total_time != 0);
+    return (block_mig_state.reads / block_mig_state.total_time) * BLOCK_SIZE;
+}
+
 static int bmds_aio_inflight(BlkMigDevState *bmds, int64_t sector)
 {
    int64_t chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;
@@ -184,6 +190,8 @@ static void blk_mig_read_cb(void *opaque, int ret)

    blk->ret = ret;

+    block_mig_state.reads++;
+    block_mig_state.total_time += (curr_time - block_mig_state.prev_time_offset);
    block_mig_state.prev_time_offset = curr_time;

    QSIMPLEQ_INSERT_TAIL(&block_mig_state.blk_list, blk, entry);
@@ -194,7 +202,8 @@ static void blk_mig_read_cb(void *opaque, int ret)
    assert(block_mig_state.submitted >= 0);
 }

-static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
+static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
+                                BlkMigDevState *bmds)
 {
    int64_t total_sectors = bmds->total_sectors;
    int64_t cur_sector = bmds->cur_sector;
@@ -242,12 +251,22 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)

    blk->aiocb = bdrv_aio_readv(bs, cur_sector, &blk->qiov,
                                nr_sectors, blk_mig_read_cb, blk);
+    if (!blk->aiocb) {
+        goto error;
+    }
    block_mig_state.submitted++;

    bdrv_reset_dirty(bs, cur_sector, nr_sectors);
    bmds->cur_sector = cur_sector + nr_sectors;

    return (bmds->cur_sector >= total_sectors);
+
+error:
+    monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
+    qemu_file_set_error(f, -EIO);
+    g_free(blk->buf);
+    g_free(blk);
+    return 0;
 }

 static void set_dirty_tracking(int enable)
@@ -255,12 +274,13 @@ static void set_dirty_tracking(int enable)
    BlkMigDevState *bmds;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bdrv_set_dirty_tracking(bmds->bs, enable ? BLOCK_SIZE : 0);
+        bdrv_set_dirty_tracking(bmds->bs, enable);
    }
 }

 static void init_blk_migration_it(void *opaque, BlockDriverState *bs)
 {
+    Monitor *mon = opaque;
    BlkMigDevState *bmds;
    int64_t sectors;

@@ -283,17 +303,19 @@ static void init_blk_migration_it(void *opaque, BlockDriverState *bs)
        block_mig_state.total_sector_sum += sectors;

        if (bmds->shared_base) {
-            DPRINTF("Start migration for %s with shared base image\n",
-                    bs->device_name);
+            monitor_printf(mon, "Start migration for %s with shared base "
+                                "image\n",
+                           bs->device_name);
        } else {
-            DPRINTF("Start full migration for %s\n", bs->device_name);
+            monitor_printf(mon, "Start full migration for %s\n",
+                           bs->device_name);
        }

        QSIMPLEQ_INSERT_TAIL(&block_mig_state.bmds_list, bmds, entry);
    }
 }

-static void init_blk_migration(QEMUFile *f)
+static void init_blk_migration(Monitor *mon, QEMUFile *f)
 {
    block_mig_state.submitted = 0;
    block_mig_state.read_done = 0;
@@ -301,11 +323,13 @@ static void init_blk_migration(QEMUFile *f)
    block_mig_state.total_sector_sum = 0;
    block_mig_state.prev_progress = -1;
    block_mig_state.bulk_completed = 0;
+    block_mig_state.total_time = 0;
+    block_mig_state.reads = 0;

-    bdrv_iterate(init_blk_migration_it, NULL);
+    bdrv_iterate(init_blk_migration_it, mon);
 }

-static int blk_mig_save_bulked_block(QEMUFile *f)
+static int blk_mig_save_bulked_block(Monitor *mon, QEMUFile *f)
 {
    int64_t completed_sector_sum = 0;
    BlkMigDevState *bmds;
@@ -314,7 +338,7 @@ static int blk_mig_save_bulked_block(QEMUFile *f)

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
        if (bmds->bulk_completed == 0) {
-            if (mig_save_device_bulk(f, bmds) == 1) {
+            if (mig_save_device_bulk(mon, f, bmds) == 1) {
                /* completed bulk section for this device */
                bmds->bulk_completed = 1;
            }
@@ -336,7 +360,8 @@ static int blk_mig_save_bulked_block(QEMUFile *f)
        block_mig_state.prev_progress = progress;
        qemu_put_be64(f, (progress << BDRV_SECTOR_BITS)
                         | BLK_MIG_FLAG_PROGRESS);
-        DPRINTF("Completed %d %%\r", progress);
+        monitor_printf(mon, "Completed %d %%\r", progress);
+        monitor_flush(mon);
    }

    return ret;
@@ -351,8 +376,8 @@ static void blk_mig_reset_dirty_cursor(void)
    }
 }

-static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
-                                 int is_async)
+static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
+                                 BlkMigDevState *bmds, int is_async)
 {
    BlkMigBlock *blk;
    int64_t total_sectors = bmds->total_sectors;
@@ -362,7 +387,7 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,

    for (sector = bmds->cur_dirty; sector < bmds->total_sectors;) {
        if (bmds_aio_inflight(bmds, sector)) {
-            bdrv_drain_all();
+            qemu_aio_flush();
        }
        if (bdrv_get_dirty(bmds->bs, sector)) {

@@ -388,6 +413,9 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,

                blk->aiocb = bdrv_aio_readv(bmds->bs, sector, &blk->qiov,
                                            nr_sectors, blk_mig_read_cb, blk);
+                if (!blk->aiocb) {
+                    goto error;
+                }
                block_mig_state.submitted++;
                bmds_set_aio_inflight(bmds, sector, nr_sectors, 1);
            } else {
@@ -411,24 +439,21 @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
    return (bmds->cur_dirty >= bmds->total_sectors);

 error:
-    DPRINTF("Error reading sector %" PRId64 "\n", sector);
+    monitor_printf(mon, "Error reading sector %" PRId64 "\n", sector);
+    qemu_file_set_error(f, ret);
    g_free(blk->buf);
    g_free(blk);
-    return ret;
+    return 0;
 }

-/* return value:
- * 0: too much data for max_downtime
- * 1: few enough data for max_downtime
-*/
-static int blk_mig_save_dirty_block(QEMUFile *f, int is_async)
+static int blk_mig_save_dirty_block(Monitor *mon, QEMUFile *f, int is_async)
 {
    BlkMigDevState *bmds;
-    int ret = 1;
+    int ret = 0;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        ret = mig_save_device_dirty(f, bmds, is_async);
-        if (ret <= 0) {
+        if (mig_save_device_dirty(mon, f, bmds, is_async) == 0) {
+            ret = 1;
            break;
        }
    }
@@ -436,10 +461,9 @@ static int blk_mig_save_dirty_block(QEMUFile *f, int is_async)
    return ret;
 }

-static int flush_blks(QEMUFile *f)
+static void flush_blks(QEMUFile* f)
 {
    BlkMigBlock *blk;
-    int ret = 0;

    DPRINTF("%s Enter submitted %d read_done %d transferred %d\n",
            __FUNCTION__, block_mig_state.submitted, block_mig_state.read_done,
@@ -450,7 +474,7 @@ static int flush_blks(QEMUFile *f)
            break;
        }
        if (blk->ret < 0) {
-            ret = blk->ret;
+            qemu_file_set_error(f, blk->ret);
            break;
        }
        blk_send(f, blk);
@@ -467,7 +491,6 @@ static int flush_blks(QEMUFile *f)
    DPRINTF("%s Exit submitted %d read_done %d transferred %d\n", __FUNCTION__,
            block_mig_state.submitted, block_mig_state.read_done,
            block_mig_state.transferred);
-    return ret;
 }

 static int64_t get_remaining_dirty(void)
@@ -479,16 +502,40 @@ static int64_t get_remaining_dirty(void)
        dirty += bdrv_get_dirty_count(bmds->bs);
    }

-    return dirty << BDRV_SECTOR_BITS;
+    return dirty * BLOCK_SIZE;
 }

-static void blk_mig_cleanup(void)
+static int is_stage2_completed(void)
+{
+    int64_t remaining_dirty;
+    long double bwidth;
+
+    if (block_mig_state.bulk_completed == 1) {
+
+        remaining_dirty = get_remaining_dirty();
+        if (remaining_dirty == 0) {
+            return 1;
+        }
+
+        bwidth = compute_read_bwidth();
+
+        if ((remaining_dirty / bwidth) <=
+            migrate_max_downtime()) {
+            /* finish stage2 because we think that we can finish remaining work
+               below max_downtime */
+
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
+static void blk_mig_cleanup(Monitor *mon)
 {
    BlkMigDevState *bmds;
    BlkMigBlock *blk;

-    bdrv_drain_all();
-
    set_dirty_tracking(0);

    while ((bmds = QSIMPLEQ_FIRST(&block_mig_state.bmds_list)) != NULL) {
@@ -504,139 +551,95 @@ static void blk_mig_cleanup(void)
        g_free(blk->buf);
        g_free(blk);
    }
+
+    monitor_printf(mon, "\n");
 }

-static void block_migration_cancel(void *opaque)
-{
-    blk_mig_cleanup();
-}
-
-static int block_save_setup(QEMUFile *f, void *opaque)
+static int block_save_live(Monitor *mon, QEMUFile *f, int stage, void *opaque)
 {
    int ret;

-    DPRINTF("Enter save live setup submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
+    DPRINTF("Enter save live stage %d submitted %d transferred %d\n",
+            stage, block_mig_state.submitted, block_mig_state.transferred);

-    init_blk_migration(f);
+    if (stage < 0) {
+        blk_mig_cleanup(mon);
+        return 0;
+    }

-    /* start track dirty blocks */
-    set_dirty_tracking(1);
+    if (block_mig_state.blk_enable != 1) {
+        /* no need to migrate storage */
+        qemu_put_be64(f, BLK_MIG_FLAG_EOS);
+        return 1;
+    }

-    ret = flush_blks(f);
+    if (stage == 1) {
+        init_blk_migration(mon, f);
+
+        /* start track dirty blocks */
+        set_dirty_tracking(1);
+    }
+
+    flush_blks(f);
+
+    ret = qemu_file_get_error(f);
    if (ret) {
-        blk_mig_cleanup();
+        blk_mig_cleanup(mon);
        return ret;
    }

    blk_mig_reset_dirty_cursor();

-    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
-
-    return 0;
-}
-
-static int block_save_iterate(QEMUFile *f, void *opaque)
-{
-    int ret;
-    int64_t last_ftell = qemu_ftell(f);
-
-    DPRINTF("Enter save live iterate submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
-
-    ret = flush_blks(f);
-    if (ret) {
-        blk_mig_cleanup();
-        return ret;
-    }
-
-    blk_mig_reset_dirty_cursor();
-
-    /* control the rate of transfer */
-    while ((block_mig_state.submitted +
-            block_mig_state.read_done) * BLOCK_SIZE <
-           qemu_file_get_rate_limit(f)) {
-        if (block_mig_state.bulk_completed == 0) {
-            /* first finish the bulk phase */
-            if (blk_mig_save_bulked_block(f) == 0) {
-                /* finished saving bulk on all devices */
-                block_mig_state.bulk_completed = 1;
-            }
-        } else {
-            ret = blk_mig_save_dirty_block(f, 1);
-            if (ret != 0) {
-                /* no more dirty blocks */
-                break;
+    if (stage == 2) {
+        /* control the rate of transfer */
+        while ((block_mig_state.submitted +
+                block_mig_state.read_done) * BLOCK_SIZE <
+               qemu_file_get_rate_limit(f)) {
+            if (block_mig_state.bulk_completed == 0) {
+                /* first finish the bulk phase */
+                if (blk_mig_save_bulked_block(mon, f) == 0) {
+                    /* finished saving bulk on all devices */
+                    block_mig_state.bulk_completed = 1;
+                }
+            } else {
+                if (blk_mig_save_dirty_block(mon, f, 1) == 0) {
+                    /* no more dirty blocks */
+                    break;
+                }
            }
        }
-    }
-    if (ret < 0) {
-        blk_mig_cleanup();
-        return ret;
+
+        flush_blks(f);
+
+        ret = qemu_file_get_error(f);
+        if (ret) {
+            blk_mig_cleanup(mon);
+            return ret;
+        }
    }

-    ret = flush_blks(f);
-    if (ret) {
-        blk_mig_cleanup();
-        return ret;
+    if (stage == 3) {
+        /* we know for sure that save bulk is completed and
+           all async read completed */
+        assert(block_mig_state.submitted == 0);
+
+        while (blk_mig_save_dirty_block(mon, f, 0) != 0);
+        blk_mig_cleanup(mon);
+
+        /* report completion */
+        qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);
+
+        ret = qemu_file_get_error(f);
+        if (ret) {
+            return ret;
+        }
+
+        monitor_printf(mon, "Block migration completed\n");
    }

    qemu_put_be64(f, BLK_MIG_FLAG_EOS);

-    return qemu_ftell(f) - last_ftell;
-}
-
-static int block_save_complete(QEMUFile *f, void *opaque)
-{
-    int ret;
-
-    DPRINTF("Enter save live complete submitted %d transferred %d\n",
-            block_mig_state.submitted, block_mig_state.transferred);
-
-    ret = flush_blks(f);
-    if (ret) {
-        blk_mig_cleanup();
-        return ret;
-    }
-
-    blk_mig_reset_dirty_cursor();
-
-    /* we know for sure that save bulk is completed and
-       all async read completed */
-    assert(block_mig_state.submitted == 0);
-
-    do {
-        ret = blk_mig_save_dirty_block(f, 0);
-    } while (ret == 0);
-
-    blk_mig_cleanup();
-    if (ret < 0) {
-        return ret;
-    }
-    /* report completion */
-    qemu_put_be64(f, (100 << BDRV_SECTOR_BITS) | BLK_MIG_FLAG_PROGRESS);
-
-    DPRINTF("Block migration completed\n");
-
-    qemu_put_be64(f, BLK_MIG_FLAG_EOS);
-
-    return 0;
-}
-
-static uint64_t block_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)
-{
-    /* Estimate pending number of bytes to send */
-    uint64_t pending = get_remaining_dirty() +
-                       block_mig_state.submitted * BLOCK_SIZE +
-                       block_mig_state.read_done * BLOCK_SIZE;
-
-    /* Report at least one block pending during bulk phase */
-    if (pending == 0 && !block_mig_state.bulk_completed) {
-        pending = BLOCK_SIZE;
-    }
-
-    DPRINTF("Enter save live pending  %" PRIu64 "\n", pending);
-    return pending;
+    return ((stage == 2) && is_stage2_completed());
 }

 static int block_load(QEMUFile *f, void *opaque, int version_id)
@@ -704,7 +707,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                   (addr == 100) ? '\n' : '\r');
            fflush(stdout);
        } else if (!(flags & BLK_MIG_FLAG_EOS)) {
-            fprintf(stderr, "Unknown block migration flags: %#x\n", flags);
+            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
        ret = qemu_file_get_error(f);
@@ -716,36 +719,20 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
    return 0;
 }

-static void block_set_params(const MigrationParams *params, void *opaque)
+static void block_set_params(int blk_enable, int shared_base, void *opaque)
 {
-    block_mig_state.blk_enable = params->blk;
-    block_mig_state.shared_base = params->shared;
+    block_mig_state.blk_enable = blk_enable;
+    block_mig_state.shared_base = shared_base;

    /* shared base means that blk_enable = 1 */
-    block_mig_state.blk_enable |= params->shared;
+    block_mig_state.blk_enable |= shared_base;
 }

-static bool block_is_active(void *opaque)
-{
-    return block_mig_state.blk_enable == 1;
-}
-
-SaveVMHandlers savevm_block_handlers = {
-    .set_params = block_set_params,
-    .save_live_setup = block_save_setup,
-    .save_live_iterate = block_save_iterate,
-    .save_live_complete = block_save_complete,
-    .save_live_pending = block_save_pending,
-    .load_state = block_load,
-    .cancel = block_migration_cancel,
-    .is_active = block_is_active,
-};
-
 void blk_mig_init(void)
 {
    QSIMPLEQ_INIT(&block_mig_state.bmds_list);
    QSIMPLEQ_INIT(&block_mig_state.blk_list);

-    register_savevm_live(NULL, "block", 0, 1, &savevm_block_handlers,
-                         &block_mig_state);
+    register_savevm_live(NULL, "block", 0, 1, block_set_params,
+                         block_save_live, NULL, block_load, &block_mig_state);
 }
--- a/include/migration/block.h
+++ b/include/migration/block.h
--- a/block.c
+++ b/block.c
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -1,37 +1,28 @@
 #ifndef BLOCK_H
 #define BLOCK_H

-#include "block/aio.h"
+#include "qemu-aio.h"
 #include "qemu-common.h"
-#include "qemu/option.h"
-#include "block/coroutine.h"
-#include "qapi/qmp/qobject.h"
-#include "qapi-types.h"
+#include "qemu-option.h"
+#include "qemu-coroutine.h"
+#include "qobject.h"

 /* block.c */
 typedef struct BlockDriver BlockDriver;
-typedef struct BlockJob BlockJob;

 typedef struct BlockDriverInfo {
    /* in bytes, 0 if irrelevant */
    int cluster_size;
    /* offset at which the VM state can be saved (0 if not possible) */
    int64_t vm_state_offset;
-    bool is_dirty;
 } BlockDriverInfo;

-typedef struct BlockFragInfo {
-    uint64_t allocated_clusters;
-    uint64_t total_clusters;
-    uint64_t fragmented_clusters;
-} BlockFragInfo;
-
 typedef struct QEMUSnapshotInfo {
    char id_str[128]; /* unique snapshot id */
    /* the following fields are informative. They are not needed for
       the consistency of the snapshot */
-    char name[256]; /* user chosen name */
-    uint64_t vm_state_size; /* VM state info size */
+    char name[256]; /* user choosen name */
+    uint32_t vm_state_size; /* VM state info size */
    uint32_t date_sec; /* UTC date of the snapshot */
    uint32_t date_nsec;
    uint64_t vm_clock_nsec; /* VM clock relative to boot */
@@ -79,10 +70,6 @@ typedef struct BlockDevOps {
 #define BDRV_O_NATIVE_AIO  0x0080 /* use native AIO instead of the thread pool */
 #define BDRV_O_NO_BACKING  0x0100 /* don't open the backing file */
 #define BDRV_O_NO_FLUSH    0x0200 /* disable flushing on this disk */
-#define BDRV_O_COPY_ON_READ 0x0400 /* copy read backing sectors into image */
-#define BDRV_O_INCOMING    0x0800  /* consistency hint for incoming migration */
-#define BDRV_O_CHECK       0x1000  /* open solely for consistency check */
-#define BDRV_O_ALLOW_RDWR  0x2000  /* allow reopen to change from r/o to r/w */

 #define BDRV_O_CACHE_MASK  (BDRV_O_NOCACHE | BDRV_O_CACHE_WB | BDRV_O_NO_FLUSH)

@@ -91,33 +78,26 @@ typedef struct BlockDevOps {
 #define BDRV_SECTOR_MASK   ~(BDRV_SECTOR_SIZE - 1)

 typedef enum {
-    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
+    BLOCK_ERR_REPORT, BLOCK_ERR_IGNORE, BLOCK_ERR_STOP_ENOSPC,
+    BLOCK_ERR_STOP_ANY
 } BlockErrorAction;

-typedef QSIMPLEQ_HEAD(BlockReopenQueue, BlockReopenQueueEntry) BlockReopenQueue;
-
-typedef struct BDRVReopenState {
-    BlockDriverState *bs;
-    int flags;
-    void *opaque;
-} BDRVReopenState;
-
+typedef enum {
+    BDRV_ACTION_REPORT, BDRV_ACTION_IGNORE, BDRV_ACTION_STOP
+} BlockMonEventAction;

 void bdrv_iostatus_enable(BlockDriverState *bs);
 void bdrv_iostatus_reset(BlockDriverState *bs);
 void bdrv_iostatus_disable(BlockDriverState *bs);
 bool bdrv_iostatus_is_enabled(const BlockDriverState *bs);
 void bdrv_iostatus_set_err(BlockDriverState *bs, int error);
+void bdrv_mon_event(const BlockDriverState *bdrv,
+                    BlockMonEventAction action, int is_read);
 void bdrv_info_print(Monitor *mon, const QObject *data);
 void bdrv_info(Monitor *mon, QObject **ret_data);
 void bdrv_stats_print(Monitor *mon, const QObject *data);
 void bdrv_info_stats(Monitor *mon, QObject **ret_data);

-/* disk I/O throttling */
-void bdrv_io_limits_enable(BlockDriverState *bs);
-void bdrv_io_limits_disable(BlockDriverState *bs);
-bool bdrv_io_limits_enabled(BlockDriverState *bs);
-
 void bdrv_init(void);
 void bdrv_init_with_whitelist(void);
 BlockDriver *bdrv_find_protocol(const char *filename);
@@ -128,24 +108,12 @@ int bdrv_create(BlockDriver *drv, const char* filename,
 int bdrv_create_file(const char* filename, QEMUOptionParameter *options);
 BlockDriverState *bdrv_new(const char *device_name);
 void bdrv_make_anon(BlockDriverState *bs);
-void bdrv_swap(BlockDriverState *bs_new, BlockDriverState *bs_old);
-void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top);
 void bdrv_delete(BlockDriverState *bs);
 int bdrv_parse_cache_flags(const char *mode, int *flags);
 int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags);
-int bdrv_open_backing_file(BlockDriverState *bs);
 int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
              BlockDriver *drv);
-BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
-                                    BlockDriverState *bs, int flags);
-int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
-int bdrv_reopen(BlockDriverState *bs, int bdrv_flags, Error **errp);
-int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
-                        BlockReopenQueue *queue, Error **errp);
-void bdrv_reopen_commit(BDRVReopenState *reopen_state);
-void bdrv_reopen_abort(BDRVReopenState *reopen_state);
 void bdrv_close(BlockDriverState *bs);
-void bdrv_add_close_notifier(BlockDriverState *bs, Notifier *notify);
 int bdrv_attach_dev(BlockDriverState *bs, void *dev);
 void bdrv_attach_dev_nofail(BlockDriverState *bs, void *dev);
 void bdrv_detach_dev(BlockDriverState *bs, void *dev);
@@ -158,8 +126,6 @@ bool bdrv_dev_is_tray_open(BlockDriverState *bs);
 bool bdrv_dev_is_medium_locked(BlockDriverState *bs);
 int bdrv_read(BlockDriverState *bs, int64_t sector_num,
              uint8_t *buf, int nb_sectors);
-int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
-                          uint8_t *buf, int nb_sectors);
 int bdrv_write(BlockDriverState *bs, int64_t sector_num,
               const uint8_t *buf, int nb_sectors);
 int bdrv_pread(BlockDriverState *bs, int64_t offset,
@@ -170,60 +136,31 @@ int bdrv_pwrite_sync(BlockDriverState *bs, int64_t offset,
    const void *buf, int count);
 int coroutine_fn bdrv_co_readv(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors, QEMUIOVector *qiov);
-int coroutine_fn bdrv_co_copy_on_readv(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors, QEMUIOVector *qiov);
 int coroutine_fn bdrv_co_writev(BlockDriverState *bs, int64_t sector_num,
    int nb_sectors, QEMUIOVector *qiov);
-/*
- * Efficiently zero a region of the disk image.  Note that this is a regular
- * I/O request like read or write and should have a reasonable size.  This
- * function is not suitable for zeroing the entire image in a single request
- * because it may allocate memory for the entire region.
- */
-int coroutine_fn bdrv_co_write_zeroes(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors);
-int coroutine_fn bdrv_co_is_allocated(BlockDriverState *bs, int64_t sector_num,
-    int nb_sectors, int *pnum);
-int coroutine_fn bdrv_co_is_allocated_above(BlockDriverState *top,
-                                            BlockDriverState *base,
-                                            int64_t sector_num,
-                                            int nb_sectors, int *pnum);
-BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
-    const char *backing_file);
-int bdrv_get_backing_file_depth(BlockDriverState *bs);
 int bdrv_truncate(BlockDriverState *bs, int64_t offset);
 int64_t bdrv_getlength(BlockDriverState *bs);
 int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
+void bdrv_guess_geometry(BlockDriverState *bs, int *pcyls, int *pheads, int *psecs);
 int bdrv_commit(BlockDriverState *bs);
-int bdrv_commit_all(void);
+void bdrv_commit_all(void);
 int bdrv_change_backing_file(BlockDriverState *bs,
    const char *backing_file, const char *backing_fmt);
 void bdrv_register(BlockDriver *bdrv);
-int bdrv_drop_intermediate(BlockDriverState *active, BlockDriverState *top,
-                           BlockDriverState *base);
-BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
-                                    BlockDriverState *bs);
-BlockDriverState *bdrv_find_base(BlockDriverState *bs);


 typedef struct BdrvCheckResult {
    int corruptions;
    int leaks;
    int check_errors;
-    int corruptions_fixed;
-    int leaks_fixed;
-    BlockFragInfo bfi;
 } BdrvCheckResult;

-typedef enum {
-    BDRV_FIX_LEAKS    = 1,
-    BDRV_FIX_ERRORS   = 2,
-} BdrvCheckMode;
-
-int bdrv_check(BlockDriverState *bs, BdrvCheckResult *res, BdrvCheckMode fix);
+int bdrv_check(BlockDriverState *bs, BdrvCheckResult *res);

 /* async block I/O */
+typedef struct BlockDriverAIOCB BlockDriverAIOCB;
+typedef void BlockDriverCompletionFunc(void *opaque, int ret);
 typedef void BlockDriverDirtyHandler(BlockDriverState *bs, int64_t sector,
                                     int sector_num);
 BlockDriverAIOCB *bdrv_aio_readv(BlockDriverState *bs, int64_t sector_num,
@@ -264,14 +201,11 @@ BlockDriverAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
 void bdrv_invalidate_cache(BlockDriverState *bs);
 void bdrv_invalidate_cache_all(void);

-void bdrv_clear_incoming_migration_all(void);
-
 /* Ensure contents are flushed to disk.  */
 int bdrv_flush(BlockDriverState *bs);
 int coroutine_fn bdrv_co_flush(BlockDriverState *bs);
 void bdrv_flush_all(void);
 void bdrv_close_all(void);
-void bdrv_drain_all(void);

 int bdrv_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
 int bdrv_co_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors);
@@ -279,21 +213,39 @@ int bdrv_has_zero_init(BlockDriverState *bs);
 int bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
                      int *pnum);

-void bdrv_set_on_error(BlockDriverState *bs, BlockdevOnError on_read_error,
-                       BlockdevOnError on_write_error);
-BlockdevOnError bdrv_get_on_error(BlockDriverState *bs, bool is_read);
-BlockErrorAction bdrv_get_error_action(BlockDriverState *bs, bool is_read, int error);
-void bdrv_error_action(BlockDriverState *bs, BlockErrorAction action,
-                       bool is_read, int error);
+#define BIOS_ATA_TRANSLATION_AUTO   0
+#define BIOS_ATA_TRANSLATION_NONE   1
+#define BIOS_ATA_TRANSLATION_LBA    2
+#define BIOS_ATA_TRANSLATION_LARGE  3
+#define BIOS_ATA_TRANSLATION_RECHS  4
+
+void bdrv_set_geometry_hint(BlockDriverState *bs,
+                            int cyls, int heads, int secs);
+void bdrv_set_translation_hint(BlockDriverState *bs, int translation);
+void bdrv_get_geometry_hint(BlockDriverState *bs,
+                            int *pcyls, int *pheads, int *psecs);
+typedef enum FDriveType {
+    FDRIVE_DRV_144  = 0x00,   /* 1.44 MB 3"5 drive      */
+    FDRIVE_DRV_288  = 0x01,   /* 2.88 MB 3"5 drive      */
+    FDRIVE_DRV_120  = 0x02,   /* 1.2  MB 5"25 drive     */
+    FDRIVE_DRV_NONE = 0x03,   /* No drive connected     */
+} FDriveType;
+
+void bdrv_get_floppy_geometry_hint(BlockDriverState *bs, int *nb_heads,
+                                   int *max_track, int *last_sect,
+                                   FDriveType drive_in, FDriveType *drive);
+int bdrv_get_translation_hint(BlockDriverState *bs);
+void bdrv_set_on_error(BlockDriverState *bs, BlockErrorAction on_read_error,
+                       BlockErrorAction on_write_error);
+BlockErrorAction bdrv_get_on_error(BlockDriverState *bs, int is_read);
 int bdrv_is_read_only(BlockDriverState *bs);
 int bdrv_is_sg(BlockDriverState *bs);
 int bdrv_enable_write_cache(BlockDriverState *bs);
-void bdrv_set_enable_write_cache(BlockDriverState *bs, bool wce);
 int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
 void bdrv_lock_medium(BlockDriverState *bs, bool locked);
-void bdrv_eject(BlockDriverState *bs, bool eject_flag);
-const char *bdrv_get_format_name(BlockDriverState *bs);
+void bdrv_eject(BlockDriverState *bs, int eject_flag);
+void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
 BlockDriverState *bdrv_find(const char *name);
 BlockDriverState *bdrv_next(BlockDriverState *bs);
 void bdrv_iterate(void (*it)(void *opaque, BlockDriverState *bs),
@@ -305,22 +257,13 @@ int bdrv_query_missing_keys(void);
 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
                         void *opaque);
 const char *bdrv_get_device_name(BlockDriverState *bs);
-int bdrv_get_flags(BlockDriverState *bs);
 int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
-void bdrv_round_to_clusters(BlockDriverState *bs,
-                            int64_t sector_num, int nb_sectors,
-                            int64_t *cluster_sector_num,
-                            int *cluster_nb_sectors);

 const char *bdrv_get_encrypted_filename(BlockDriverState *bs);
 void bdrv_get_backing_filename(BlockDriverState *bs,
                               char *filename, int filename_size);
-void bdrv_get_full_backing_filename(BlockDriverState *bs,
-                                    char *dest, size_t sz);
-BlockInfo *bdrv_query_info(BlockDriverState *s);
-BlockStats *bdrv_query_stats(const BlockDriverState *bs);
 int bdrv_can_snapshot(BlockDriverState *bs);
 int bdrv_is_snapshot(BlockDriverState *bs);
 BlockDriverState *bdrv_snapshots(void);
@@ -347,37 +290,24 @@ int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size);

-void bdrv_img_create(const char *filename, const char *fmt,
-                     const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags, Error **errp);
+int bdrv_img_create(const char *filename, const char *fmt,
+                    const char *base_filename, const char *base_fmt,
+                    char *options, uint64_t img_size, int flags);

 void bdrv_set_buffer_alignment(BlockDriverState *bs, int align);
 void *qemu_blockalign(BlockDriverState *bs, size_t size);
-bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov);

-struct HBitmapIter;
-void bdrv_set_dirty_tracking(BlockDriverState *bs, int granularity);
+#define BDRV_SECTORS_PER_DIRTY_CHUNK 2048
+
+void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
 int bdrv_get_dirty(BlockDriverState *bs, int64_t sector);
-void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
-void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
-void bdrv_dirty_iter_init(BlockDriverState *bs, struct HBitmapIter *hbi);
+void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector,
+                      int nr_sectors);
 int64_t bdrv_get_dirty_count(BlockDriverState *bs);

-void bdrv_enable_copy_on_read(BlockDriverState *bs);
-void bdrv_disable_copy_on_read(BlockDriverState *bs);
-
 void bdrv_set_in_use(BlockDriverState *bs, int in_use);
 int bdrv_in_use(BlockDriverState *bs);

-#ifdef CONFIG_LINUX_AIO
-int raw_get_aio_fd(BlockDriverState *bs);
-#else
-static inline int raw_get_aio_fd(BlockDriverState *bs)
-{
-    return -ENOTSUP;
-}
-#endif
-
 enum BlockAcctType {
    BDRV_ACCT_READ,
    BDRV_ACCT_WRITE,
@@ -408,7 +338,9 @@ typedef enum {
    BLKDBG_L2_ALLOC_COW_READ,
    BLKDBG_L2_ALLOC_WRITE,

+    BLKDBG_READ,
    BLKDBG_READ_AIO,
+    BLKDBG_READ_BACKING,
    BLKDBG_READ_BACKING_AIO,
    BLKDBG_READ_COMPRESSED,

@@ -444,9 +376,43 @@ typedef enum {
 #define BLKDBG_EVENT(bs, evt) bdrv_debug_event(bs, evt)
 void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event);

-int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
-                           const char *tag);
-int bdrv_debug_resume(BlockDriverState *bs, const char *tag);
-bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag);
+
+/* Convenience for block device models */
+
+typedef struct BlockConf {
+    BlockDriverState *bs;
+    uint16_t physical_block_size;
+    uint16_t logical_block_size;
+    uint16_t min_io_size;
+    uint32_t opt_io_size;
+    int32_t bootindex;
+    uint32_t discard_granularity;
+} BlockConf;
+
+static inline unsigned int get_physical_block_exp(BlockConf *conf)
+{
+    unsigned int exp = 0, size;
+
+    for (size = conf->physical_block_size;
+        size > conf->logical_block_size;
+        size >>= 1) {
+        exp++;
+    }
+
+    return exp;
+}
+
+#define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
+    DEFINE_PROP_DRIVE("drive", _state, _conf.bs),                       \
+    DEFINE_PROP_UINT16("logical_block_size", _state,                    \
+                       _conf.logical_block_size, 512),                  \
+    DEFINE_PROP_UINT16("physical_block_size", _state,                   \
+                       _conf.physical_block_size, 512),                 \
+    DEFINE_PROP_UINT16("min_io_size", _state, _conf.min_io_size, 0),  \
+    DEFINE_PROP_UINT32("opt_io_size", _state, _conf.opt_io_size, 0),    \
+    DEFINE_PROP_INT32("bootindex", _state, _conf.bootindex, -1),        \
+    DEFINE_PROP_UINT32("discard_granularity", _state, \
+                       _conf.discard_granularity, 0)

 #endif
+
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -1,22 +0,0 @@
-block-obj-y += raw.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o vvfat.o
-block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
-block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
-block-obj-y += qed-check.o
-block-obj-y += parallels.o blkdebug.o blkverify.o
-block-obj-$(CONFIG_WIN32) += raw-win32.o win32-aio.o
-block-obj-$(CONFIG_POSIX) += raw-posix.o
-block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
-
-ifeq ($(CONFIG_POSIX),y)
-block-obj-y += nbd.o sheepdog.o
-block-obj-$(CONFIG_LIBISCSI) += iscsi.o
-block-obj-$(CONFIG_CURL) += curl.o
-block-obj-$(CONFIG_RBD) += rbd.o
-block-obj-$(CONFIG_GLUSTERFS) += gluster.o
-endif
-
-common-obj-y += stream.o
-common-obj-y += commit.o
-common-obj-y += mirror.o
-
-$(obj)/curl.o: QEMU_CFLAGS+=$(CURL_CFLAGS)
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -23,17 +23,27 @@
 */

 #include "qemu-common.h"
-#include "qemu/config-file.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
+
+typedef struct BlkdebugVars {
+    int state;
+
+    /* If inject_errno != 0, an error is injected for requests */
+    int inject_errno;
+
+    /* Decides if all future requests fail (false) or only the next one and
+     * after the next request inject_errno is reset to 0 (true) */
+    bool inject_once;
+
+    /* Decides if aio_readv/writev fails right away (true) or returns an error
+     * return value only in the callback (false) */
+    bool inject_immediately;
+} BlkdebugVars;

 typedef struct BDRVBlkdebugState {
-    int state;
-    int new_state;
-
-    QLIST_HEAD(, BlkdebugRule) rules[BLKDBG_EVENT_MAX];
-    QSIMPLEQ_HEAD(, BlkdebugRule) active_rules;
-    QLIST_HEAD(, BlkdebugSuspendedReq) suspended_reqs;
+    BlkdebugVars vars;
+    QLIST_HEAD(list, BlkdebugRule) rules[BLKDBG_EVENT_MAX];
 } BDRVBlkdebugState;

 typedef struct BlkdebugAIOCB {
@@ -42,15 +52,9 @@ typedef struct BlkdebugAIOCB {
    int ret;
 } BlkdebugAIOCB;

-typedef struct BlkdebugSuspendedReq {
-    Coroutine *co;
-    char *tag;
-    QLIST_ENTRY(BlkdebugSuspendedReq) next;
-} BlkdebugSuspendedReq;
-
 static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb);

-static const AIOCBInfo blkdebug_aiocb_info = {
+static AIOPool blkdebug_aio_pool = {
    .aiocb_size = sizeof(BlkdebugAIOCB),
    .cancel     = blkdebug_aio_cancel,
 };
@@ -58,7 +62,6 @@ static const AIOCBInfo blkdebug_aiocb_info = {
 enum {
    ACTION_INJECT_ERROR,
    ACTION_SET_STATE,
-    ACTION_SUSPEND,
 };

 typedef struct BlkdebugRule {
@@ -70,17 +73,12 @@ typedef struct BlkdebugRule {
            int error;
            int immediately;
            int once;
-            int64_t sector;
        } inject;
        struct {
            int new_state;
        } set_state;
-        struct {
-            char *tag;
-        } suspend;
    } options;
    QLIST_ENTRY(BlkdebugRule) next;
-    QSIMPLEQ_ENTRY(BlkdebugRule) active_next;
 } BlkdebugRule;

 static QemuOptsList inject_error_opts = {
@@ -99,10 +97,6 @@ static QemuOptsList inject_error_opts = {
            .name = "errno",
            .type = QEMU_OPT_NUMBER,
        },
-        {
-            .name = "sector",
-            .type = QEMU_OPT_NUMBER,
-        },
        {
            .name = "once",
            .type = QEMU_OPT_BOOL,
@@ -153,7 +147,9 @@ static const char *event_names[BLKDBG_EVENT_MAX] = {
    [BLKDBG_L2_ALLOC_COW_READ]              = "l2_alloc.cow_read",
    [BLKDBG_L2_ALLOC_WRITE]                 = "l2_alloc.write",

+    [BLKDBG_READ]                           = "read",
    [BLKDBG_READ_AIO]                       = "read_aio",
+    [BLKDBG_READ_BACKING]                   = "read_backing",
    [BLKDBG_READ_BACKING_AIO]               = "read_backing_aio",
    [BLKDBG_READ_COMPRESSED]                = "read_compressed",

@@ -232,18 +228,12 @@ static int add_rule(QemuOpts *opts, void *opaque)
        rule->options.inject.once  = qemu_opt_get_bool(opts, "once", 0);
        rule->options.inject.immediately =
            qemu_opt_get_bool(opts, "immediately", 0);
-        rule->options.inject.sector = qemu_opt_get_number(opts, "sector", -1);
        break;

    case ACTION_SET_STATE:
        rule->options.set_state.new_state =
            qemu_opt_get_number(opts, "new_state", 0);
        break;
-
-    case ACTION_SUSPEND:
-        rule->options.suspend.tag =
-            g_strdup(qemu_opt_get(opts, "tag"));
-        break;
    };

    /* Add the rule */
@@ -252,32 +242,12 @@ static int add_rule(QemuOpts *opts, void *opaque)
    return 0;
 }

-static void remove_rule(BlkdebugRule *rule)
-{
-    switch (rule->action) {
-    case ACTION_INJECT_ERROR:
-    case ACTION_SET_STATE:
-        break;
-    case ACTION_SUSPEND:
-        g_free(rule->options.suspend.tag);
-        break;
-    }
-
-    QLIST_REMOVE(rule, next);
-    g_free(rule);
-}
-
 static int read_config(BDRVBlkdebugState *s, const char *filename)
 {
    FILE *f;
    int ret;
    struct add_rule_data d;

-    /* Allow usage without config file */
-    if (!*filename) {
-        return 0;
-    }
-
    f = fopen(filename, "r");
    if (f == NULL) {
        return -errno;
@@ -322,17 +292,17 @@ static int blkdebug_open(BlockDriverState *bs, const char *filename, int flags)
        return -EINVAL;
    }

-    config = g_strdup(filename);
+    config = strdup(filename);
    config[c - filename] = '\0';
    ret = read_config(s, config);
-    g_free(config);
+    free(config);
    if (ret < 0) {
        return ret;
    }
    filename = c + 1;

    /* Set initial state */
-    s->state = 1;
+    s->vars.state = 1;

    /* Open the backing file */
    ret = bdrv_file_open(&bs->file, filename, flags);
@@ -358,22 +328,22 @@ static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb)
 }

 static BlockDriverAIOCB *inject_error(BlockDriverState *bs,
-    BlockDriverCompletionFunc *cb, void *opaque, BlkdebugRule *rule)
+    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    int error = rule->options.inject.error;
+    int error = s->vars.inject_errno;
    struct BlkdebugAIOCB *acb;
    QEMUBH *bh;

-    if (rule->options.inject.once) {
-        QSIMPLEQ_INIT(&s->active_rules);
+    if (s->vars.inject_once) {
+        s->vars.inject_errno = 0;
    }

-    if (rule->options.inject.immediately) {
+    if (s->vars.inject_immediately) {
        return NULL;
    }

-    acb = qemu_aio_get(&blkdebug_aiocb_info, bs, cb, opaque);
+    acb = qemu_aio_get(&blkdebug_aio_pool, bs, cb, opaque);
    acb->ret = -error;

    bh = qemu_bh_new(error_callback_bh, acb);
@@ -388,21 +358,14 @@ static BlockDriverAIOCB *blkdebug_aio_readv(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugRule *rule = NULL;

-    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
-        if (rule->options.inject.sector == -1 ||
-            (rule->options.inject.sector >= sector_num &&
-             rule->options.inject.sector < sector_num + nb_sectors)) {
-            break;
-        }
+    if (s->vars.inject_errno) {
+        return inject_error(bs, cb, opaque);
    }

-    if (rule && rule->options.inject.error) {
-        return inject_error(bs, cb, opaque, rule);
-    }
-
-    return bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    BlockDriverAIOCB *acb =
+        bdrv_aio_readv(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    return acb;
 }

 static BlockDriverAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
@@ -410,24 +373,16 @@ static BlockDriverAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
    BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugRule *rule = NULL;

-    QSIMPLEQ_FOREACH(rule, &s->active_rules, active_next) {
-        if (rule->options.inject.sector == -1 ||
-            (rule->options.inject.sector >= sector_num &&
-             rule->options.inject.sector < sector_num + nb_sectors)) {
-            break;
-        }
+    if (s->vars.inject_errno) {
+        return inject_error(bs, cb, opaque);
    }

-    if (rule && rule->options.inject.error) {
-        return inject_error(bs, cb, opaque, rule);
-    }
-
-    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    BlockDriverAIOCB *acb =
+        bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
+    return acb;
 }

-
 static void blkdebug_close(BlockDriverState *bs)
 {
    BDRVBlkdebugState *s = bs->opaque;
@@ -436,135 +391,54 @@ static void blkdebug_close(BlockDriverState *bs)

    for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
-            remove_rule(rule);
+            QLIST_REMOVE(rule, next);
+            g_free(rule);
        }
    }
 }

-static void suspend_request(BlockDriverState *bs, BlkdebugRule *rule)
+static BlockDriverAIOCB *blkdebug_aio_flush(BlockDriverState *bs,
+    BlockDriverCompletionFunc *cb, void *opaque)
 {
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq r;
-
-    r = (BlkdebugSuspendedReq) {
-        .co         = qemu_coroutine_self(),
-        .tag        = g_strdup(rule->options.suspend.tag),
-    };
-
-    remove_rule(rule);
-    QLIST_INSERT_HEAD(&s->suspended_reqs, &r, next);
-
-    printf("blkdebug: Suspended request '%s'\n", r.tag);
-    qemu_coroutine_yield();
-    printf("blkdebug: Resuming request '%s'\n", r.tag);
-
-    QLIST_REMOVE(&r, next);
-    g_free(r.tag);
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

-static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
-    bool injected)
+static void process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
+    BlkdebugVars *old_vars)
 {
    BDRVBlkdebugState *s = bs->opaque;
+    BlkdebugVars *vars = &s->vars;

    /* Only process rules for the current state */
-    if (rule->state && rule->state != s->state) {
-        return injected;
+    if (rule->state && rule->state != old_vars->state) {
+        return;
    }

    /* Take the action */
    switch (rule->action) {
    case ACTION_INJECT_ERROR:
-        if (!injected) {
-            QSIMPLEQ_INIT(&s->active_rules);
-            injected = true;
-        }
-        QSIMPLEQ_INSERT_HEAD(&s->active_rules, rule, active_next);
+        vars->inject_errno       = rule->options.inject.error;
+        vars->inject_once        = rule->options.inject.once;
+        vars->inject_immediately = rule->options.inject.immediately;
        break;

    case ACTION_SET_STATE:
-        s->new_state = rule->options.set_state.new_state;
-        break;
-
-    case ACTION_SUSPEND:
-        suspend_request(bs, rule);
+        vars->state              = rule->options.set_state.new_state;
        break;
    }
-    return injected;
 }

 static void blkdebug_debug_event(BlockDriverState *bs, BlkDebugEvent event)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule, *next;
-    bool injected;
+    struct BlkdebugRule *rule;
+    BlkdebugVars old_vars = s->vars;

    assert((int)event >= 0 && event < BLKDBG_EVENT_MAX);

-    injected = false;
-    s->new_state = s->state;
-    QLIST_FOREACH_SAFE(rule, &s->rules[event], next, next) {
-        injected = process_rule(bs, rule, injected);
+    QLIST_FOREACH(rule, &s->rules[event], next) {
+        process_rule(bs, rule, &old_vars);
    }
-    s->state = s->new_state;
-}
-
-static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
-                                     const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule;
-    BlkDebugEvent blkdebug_event;
-
-    if (get_event_by_name(event, &blkdebug_event) < 0) {
-        return -ENOENT;
-    }
-
-
-    rule = g_malloc(sizeof(*rule));
-    *rule = (struct BlkdebugRule) {
-        .event  = blkdebug_event,
-        .action = ACTION_SUSPEND,
-        .state  = 0,
-        .options.suspend.tag = g_strdup(tag),
-    };
-
-    QLIST_INSERT_HEAD(&s->rules[blkdebug_event], rule, next);
-
-    return 0;
-}
-
-static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            qemu_coroutine_enter(r->co, NULL);
-            return 0;
-        }
-    }
-    return -ENOENT;
-}
-
-
-static bool blkdebug_debug_is_suspended(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            return true;
-        }
-    }
-    return false;
-}
-
-static int64_t blkdebug_getlength(BlockDriverState *bs)
-{
-    return bdrv_getlength(bs->file);
 }

 static BlockDriver bdrv_blkdebug = {
@@ -575,15 +449,12 @@ static BlockDriver bdrv_blkdebug = {

    .bdrv_file_open     = blkdebug_open,
    .bdrv_close         = blkdebug_close,
-    .bdrv_getlength     = blkdebug_getlength,

    .bdrv_aio_readv     = blkdebug_aio_readv,
    .bdrv_aio_writev    = blkdebug_aio_writev,
+    .bdrv_aio_flush     = blkdebug_aio_flush,

-    .bdrv_debug_event           = blkdebug_debug_event,
-    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
-    .bdrv_debug_resume          = blkdebug_debug_resume,
-    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
+    .bdrv_debug_event   = blkdebug_debug_event,
 };

 static void bdrv_blkdebug_init(void)
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -8,8 +8,8 @@
 */

 #include <stdarg.h>
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
-#include "block/block_int.h"
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
+#include "block_int.h"

 typedef struct {
    BlockDriverState *test_file;
@@ -48,7 +48,7 @@ static void blkverify_aio_cancel(BlockDriverAIOCB *blockacb)
    }
 }

-static const AIOCBInfo blkverify_aiocb_info = {
+static AIOPool blkverify_aio_pool = {
    .aiocb_size         = sizeof(BlkverifyAIOCB),
    .cancel             = blkverify_aio_cancel,
 };
@@ -87,10 +87,10 @@ static int blkverify_open(BlockDriverState *bs, const char *filename, int flags)
        return -EINVAL;
    }

-    raw = g_strdup(filename);
+    raw = strdup(filename);
    raw[c - filename] = '\0';
    ret = bdrv_file_open(&bs->file, raw, flags);
-    g_free(raw);
+    free(raw);
    if (ret < 0) {
        return ret;
    }
@@ -233,7 +233,7 @@ static BlkverifyAIOCB *blkverify_aio_get(BlockDriverState *bs, bool is_write,
                                         BlockDriverCompletionFunc *cb,
                                         void *opaque)
 {
-    BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aiocb_info, bs, cb, opaque);
+    BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aio_pool, bs, cb, opaque);

    acb->bh = NULL;
    acb->is_write = is_write;
@@ -310,10 +310,14 @@ static BlockDriverAIOCB *blkverify_aio_readv(BlockDriverState *bs,
    qemu_iovec_init(&acb->raw_qiov, acb->qiov->niov);
    blkverify_iovec_clone(&acb->raw_qiov, qiov, acb->buf);

-    bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,
-                   blkverify_aio_cb, acb);
-    bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,
-                   blkverify_aio_cb, acb);
+    if (!bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,
+                        blkverify_aio_cb, acb)) {
+        blkverify_aio_cb(acb, -EIO);
+    }
+    if (!bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,
+                        blkverify_aio_cb, acb)) {
+        blkverify_aio_cb(acb, -EIO);
+    }
    return &acb->common;
 }

@@ -325,10 +329,14 @@ static BlockDriverAIOCB *blkverify_aio_writev(BlockDriverState *bs,
    BlkverifyAIOCB *acb = blkverify_aio_get(bs, true, sector_num, qiov,
                                            nb_sectors, cb, opaque);

-    bdrv_aio_writev(s->test_file, sector_num, qiov, nb_sectors,
-                    blkverify_aio_cb, acb);
-    bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors,
-                    blkverify_aio_cb, acb);
+    if (!bdrv_aio_writev(s->test_file, sector_num, qiov, nb_sectors,
+                         blkverify_aio_cb, acb)) {
+        blkverify_aio_cb(acb, -EIO);
+    }
+    if (!bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors,
+                         blkverify_aio_cb, acb)) {
+        blkverify_aio_cb(acb, -EIO);
+    }
    return &acb->common;
 }

--- a/block/bochs.c
+++ b/block/bochs.c
@@ -23,8 +23,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -114,13 +114,11 @@ static int bochs_open(BlockDriverState *bs, int flags)
    int i;
    struct bochs_header bochs;
    struct bochs_header_v1 header_v1;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 0, &bochs, sizeof(bochs)) != sizeof(bochs)) {
+        goto fail;
    }

    if (strcmp(bochs.magic, HEADER_MAGIC) ||
@@ -128,7 +126,7 @@ static int bochs_open(BlockDriverState *bs, int flags)
        strcmp(bochs.subtype, GROWING_TYPE) ||
 	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
 	(le32_to_cpu(bochs.version) != HEADER_V1))) {
-        return -EMEDIUMTYPE;
+        goto fail;
    }

    if (le32_to_cpu(bochs.version) == HEADER_V1) {
@@ -140,13 +138,9 @@ static int bochs_open(BlockDriverState *bs, int flags)

    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
-                     s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
+                   s->catalog_size * 4) != s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

@@ -159,10 +153,8 @@ static int bochs_open(BlockDriverState *bs, int flags)

    qemu_co_mutex_init(&s->lock);
    return 0;
-
-fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+ fail:
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVCloopState {
@@ -57,32 +57,27 @@ static int cloop_open(BlockDriverState *bs, int flags)
 {
    BDRVCloopState *s = bs->opaque;
    uint32_t offsets_size, max_compressed_block_size = 1, i;
-    int ret;

    bs->read_only = 1;

    /* read header */
-    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128, &s->block_size, 4) < 4) {
+        goto cloop_close;
    }
    s->block_size = be32_to_cpu(s->block_size);

-    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4) < 4) {
+        goto cloop_close;
    }
    s->n_blocks = be32_to_cpu(s->n_blocks);

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
    s->offsets = g_malloc(offsets_size);
-
-    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
-    if (ret < 0) {
-        goto fail;
+    if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
+            offsets_size) {
+        goto cloop_close;
    }
-
    for(i=0;i<s->n_blocks;i++) {
        s->offsets[i] = be64_to_cpu(s->offsets[i]);
        if (i > 0) {
@@ -97,8 +92,7 @@ static int cloop_open(BlockDriverState *bs, int flags)
    s->compressed_block = g_malloc(max_compressed_block_size + 1);
    s->uncompressed_block = g_malloc(s->block_size);
    if (inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
+        goto cloop_close;
    }
    s->current_block = s->n_blocks;

@@ -107,11 +101,8 @@ static int cloop_open(BlockDriverState *bs, int flags)
    qemu_co_mutex_init(&s->lock);
    return 0;

-fail:
-    g_free(s->offsets);
-    g_free(s->compressed_block);
-    g_free(s->uncompressed_block);
-    return ret;
+cloop_close:
+    return -1;
 }

 static inline int cloop_read_block(BlockDriverState *bs, int block_num)
--- a/block/commit.c
+++ b/block/commit.c
@@ -1,258 +0,0 @@
-/*
- * Live block commit
- *
- * Copyright Red Hat, Inc. 2012
- *
- * Authors:
- *  Jeff Cody   <jcody@redhat.com>
- *  Based on stream.c by Stefan Hajnoczi
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#include "trace.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
-#include "qemu/ratelimit.h"
-
-enum {
-    /*
-     * Size of data buffer for populating the image file.  This should be large
-     * enough to process multiple clusters in a single call, so that populating
-     * contiguous regions of the image is efficient.
-     */
-    COMMIT_BUFFER_SIZE = 512 * 1024, /* in bytes */
-};
-
-#define SLICE_TIME 100000000ULL /* ns */
-
-typedef struct CommitBlockJob {
-    BlockJob common;
-    RateLimit limit;
-    BlockDriverState *active;
-    BlockDriverState *top;
-    BlockDriverState *base;
-    BlockdevOnError on_error;
-    int base_flags;
-    int orig_overlay_flags;
-} CommitBlockJob;
-
-static int coroutine_fn commit_populate(BlockDriverState *bs,
-                                        BlockDriverState *base,
-                                        int64_t sector_num, int nb_sectors,
-                                        void *buf)
-{
-    int ret = 0;
-
-    ret = bdrv_read(bs, sector_num, buf, nb_sectors);
-    if (ret) {
-        return ret;
-    }
-
-    ret = bdrv_write(base, sector_num, buf, nb_sectors);
-    if (ret) {
-        return ret;
-    }
-
-    return 0;
-}
-
-static void coroutine_fn commit_run(void *opaque)
-{
-    CommitBlockJob *s = opaque;
-    BlockDriverState *active = s->active;
-    BlockDriverState *top = s->top;
-    BlockDriverState *base = s->base;
-    BlockDriverState *overlay_bs;
-    int64_t sector_num, end;
-    int ret = 0;
-    int n = 0;
-    void *buf;
-    int bytes_written = 0;
-    int64_t base_len;
-
-    ret = s->common.len = bdrv_getlength(top);
-
-
-    if (s->common.len < 0) {
-        goto exit_restore_reopen;
-    }
-
-    ret = base_len = bdrv_getlength(base);
-    if (base_len < 0) {
-        goto exit_restore_reopen;
-    }
-
-    if (base_len < s->common.len) {
-        ret = bdrv_truncate(base, s->common.len);
-        if (ret) {
-            goto exit_restore_reopen;
-        }
-    }
-
-    end = s->common.len >> BDRV_SECTOR_BITS;
-    buf = qemu_blockalign(top, COMMIT_BUFFER_SIZE);
-
-    for (sector_num = 0; sector_num < end; sector_num += n) {
-        uint64_t delay_ns = 0;
-        bool copy;
-
-wait:
-        /* Note that even when no rate limit is applied we need to yield
-         * with no pending I/O here so that bdrv_drain_all() returns.
-         */
-        block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-        if (block_job_is_cancelled(&s->common)) {
-            break;
-        }
-        /* Copy if allocated above the base */
-        ret = bdrv_co_is_allocated_above(top, base, sector_num,
-                                         COMMIT_BUFFER_SIZE / BDRV_SECTOR_SIZE,
-                                         &n);
-        copy = (ret == 1);
-        trace_commit_one_iteration(s, sector_num, n, ret);
-        if (copy) {
-            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, n);
-                if (delay_ns > 0) {
-                    goto wait;
-                }
-            }
-            ret = commit_populate(top, base, sector_num, n, buf);
-            bytes_written += n * BDRV_SECTOR_SIZE;
-        }
-        if (ret < 0) {
-            if (s->on_error == BLOCKDEV_ON_ERROR_STOP ||
-                s->on_error == BLOCKDEV_ON_ERROR_REPORT||
-                (s->on_error == BLOCKDEV_ON_ERROR_ENOSPC && ret == -ENOSPC)) {
-                goto exit_free_buf;
-            } else {
-                n = 0;
-                continue;
-            }
-        }
-        /* Publish progress */
-        s->common.offset += n * BDRV_SECTOR_SIZE;
-    }
-
-    ret = 0;
-
-    if (!block_job_is_cancelled(&s->common) && sector_num == end) {
-        /* success */
-        ret = bdrv_drop_intermediate(active, top, base);
-    }
-
-exit_free_buf:
-    qemu_vfree(buf);
-
-exit_restore_reopen:
-    /* restore base open flags here if appropriate (e.g., change the base back
-     * to r/o). These reopens do not need to be atomic, since we won't abort
-     * even on failure here */
-    if (s->base_flags != bdrv_get_flags(base)) {
-        bdrv_reopen(base, s->base_flags, NULL);
-    }
-    overlay_bs = bdrv_find_overlay(active, top);
-    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
-        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
-    }
-
-    block_job_completed(&s->common, ret);
-}
-
-static void commit_set_speed(BlockJob *job, int64_t speed, Error **errp)
-{
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common);
-
-    if (speed < 0) {
-        error_set(errp, QERR_INVALID_PARAMETER, "speed");
-        return;
-    }
-    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
-}
-
-static BlockJobType commit_job_type = {
-    .instance_size = sizeof(CommitBlockJob),
-    .job_type      = "commit",
-    .set_speed     = commit_set_speed,
-};
-
-void commit_start(BlockDriverState *bs, BlockDriverState *base,
-                  BlockDriverState *top, int64_t speed,
-                  BlockdevOnError on_error, BlockDriverCompletionFunc *cb,
-                  void *opaque, Error **errp)
-{
-    CommitBlockJob *s;
-    BlockReopenQueue *reopen_queue = NULL;
-    int orig_overlay_flags;
-    int orig_base_flags;
-    BlockDriverState *overlay_bs;
-    Error *local_err = NULL;
-
-    if ((on_error == BLOCKDEV_ON_ERROR_STOP ||
-         on_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER_COMBINATION);
-        return;
-    }
-
-    /* Once we support top == active layer, remove this check */
-    if (top == bs) {
-        error_setg(errp,
-                   "Top image as the active layer is currently unsupported");
-        return;
-    }
-
-    if (top == base) {
-        error_setg(errp, "Invalid files for merge: top and base are the same");
-        return;
-    }
-
-    overlay_bs = bdrv_find_overlay(bs, top);
-
-    if (overlay_bs == NULL) {
-        error_setg(errp, "Could not find overlay image for %s:", top->filename);
-        return;
-    }
-
-    orig_base_flags    = bdrv_get_flags(base);
-    orig_overlay_flags = bdrv_get_flags(overlay_bs);
-
-    /* convert base & overlay_bs to r/w, if necessary */
-    if (!(orig_base_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, base,
-                                         orig_base_flags | BDRV_O_RDWR);
-    }
-    if (!(orig_overlay_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs,
-                                         orig_overlay_flags | BDRV_O_RDWR);
-    }
-    if (reopen_queue) {
-        bdrv_reopen_multiple(reopen_queue, &local_err);
-        if (local_err != NULL) {
-            error_propagate(errp, local_err);
-            return;
-        }
-    }
-
-
-    s = block_job_create(&commit_job_type, bs, speed, cb, opaque, errp);
-    if (!s) {
-        return;
-    }
-
-    s->base   = base;
-    s->top    = top;
-    s->active = bs;
-
-    s->base_flags          = orig_base_flags;
-    s->orig_overlay_flags  = orig_overlay_flags;
-
-    s->on_error = on_error;
-    s->common.co = qemu_coroutine_create(commit_run);
-
-    trace_commit_start(bs, base, top, s, s->common.co, opaque);
-    qemu_coroutine_enter(s->common.co, s);
-}
--- a/block/cow.c
+++ b/block/cow.c
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/
 /* COW block driver using file system holes */
@@ -64,26 +64,15 @@ static int cow_open(BlockDriverState *bs, int flags)
    struct cow_header_v2 cow_header;
    int bitmap_size;
    int64_t size;
-    int ret;

    /* see if it is a cow image */
-    ret = bdrv_pread(bs->file, 0, &cow_header, sizeof(cow_header));
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, &cow_header, sizeof(cow_header)) !=
+            sizeof(cow_header)) {
        goto fail;
    }

-    if (be32_to_cpu(cow_header.magic) != COW_MAGIC) {
-        ret = -EMEDIUMTYPE;
-        goto fail;
-    }
-
-    if (be32_to_cpu(cow_header.version) != COW_VERSION) {
-        char version[64];
-        snprintf(version, sizeof(version),
-               "COW version %d", cow_header.version);
-        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
-            bs->device_name, "cow", version);
-        ret = -ENOTSUP;
+    if (be32_to_cpu(cow_header.magic) != COW_MAGIC ||
+        be32_to_cpu(cow_header.version) != COW_VERSION) {
        goto fail;
    }

@@ -99,11 +88,11 @@ static int cow_open(BlockDriverState *bs, int flags)
    qemu_co_mutex_init(&s->lock);
    return 0;
 fail:
-    return ret;
+    return -1;
 }

 /*
- * XXX(hch): right now these functions are extremely inefficient.
+ * XXX(hch): right now these functions are extremly ineffcient.
 * We should just read the whole bitmap we'll need in one go instead.
 */
 static inline int cow_set_bit(BlockDriverState *bs, int64_t bitnum)
@@ -143,8 +132,8 @@ static inline int is_bit_set(BlockDriverState *bs, int64_t bitnum)
 /* Return true if first block has been changed (ie. current version is
 * in COW file).  Set the number of continuous blocks for which that
 * is true. */
-static int coroutine_fn cow_co_is_allocated(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, int *num_same)
+static int cow_is_allocated(BlockDriverState *bs, int64_t sector_num,
+        int nb_sectors, int *num_same)
 {
    int changed;

@@ -182,30 +171,28 @@ static int cow_update_bitmap(BlockDriverState *bs, int64_t sector_num,
    return error;
 }

-static int coroutine_fn cow_read(BlockDriverState *bs, int64_t sector_num,
-                                 uint8_t *buf, int nb_sectors)
+static int cow_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
 {
    BDRVCowState *s = bs->opaque;
    int ret, n;

    while (nb_sectors > 0) {
-        if (bdrv_co_is_allocated(bs, sector_num, nb_sectors, &n)) {
+        if (cow_is_allocated(bs, sector_num, nb_sectors, &n)) {
            ret = bdrv_pread(bs->file,
                        s->cow_sectors_offset + sector_num * 512,
                        buf, n * 512);
-            if (ret < 0) {
-                return ret;
-            }
+            if (ret != n * 512)
+                return -1;
        } else {
            if (bs->backing_hd) {
                /* read from the base image */
                ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
-                if (ret < 0) {
-                    return ret;
-                }
+                if (ret < 0)
+                    return -1;
            } else {
-                memset(buf, 0, n * 512);
-            }
+            memset(buf, 0, n * 512);
+        }
        }
        nb_sectors -= n;
        sector_num += n;
@@ -233,9 +220,8 @@ static int cow_write(BlockDriverState *bs, int64_t sector_num,

    ret = bdrv_pwrite(bs->file, s->cow_sectors_offset + sector_num * 512,
                      buf, nb_sectors * 512);
-    if (ret < 0) {
-        return ret;
-    }
+    if (ret != nb_sectors * 512)
+        return -1;

    return cow_update_bitmap(bs, sector_num, nb_sectors);
 }
@@ -257,12 +243,12 @@ static void cow_close(BlockDriverState *bs)

 static int cow_create(const char *filename, QEMUOptionParameter *options)
 {
+    int fd, cow_fd;
    struct cow_header_v2 cow_header;
    struct stat st;
    int64_t image_sectors = 0;
    const char *image_filename = NULL;
    int ret;
-    BlockDriverState *cow_bs;

    /* Read out options */
    while (options && options->name) {
@@ -274,16 +260,10 @@ static int cow_create(const char *filename, QEMUOptionParameter *options)
        options++;
    }

-    ret = bdrv_create_file(filename, options);
-    if (ret < 0) {
-        return ret;
-    }
-
-    ret = bdrv_file_open(&cow_bs, filename, BDRV_O_RDWR);
-    if (ret < 0) {
-        return ret;
-    }
-
+    cow_fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+              0644);
+    if (cow_fd < 0)
+        return -errno;
    memset(&cow_header, 0, sizeof(cow_header));
    cow_header.magic = cpu_to_be32(COW_MAGIC);
    cow_header.version = cpu_to_be32(COW_VERSION);
@@ -291,9 +271,16 @@ static int cow_create(const char *filename, QEMUOptionParameter *options)
        /* Note: if no file, we put a dummy mtime */
        cow_header.mtime = cpu_to_be32(0);

-        if (stat(image_filename, &st) != 0) {
+        fd = open(image_filename, O_RDONLY | O_BINARY);
+        if (fd < 0) {
+            close(cow_fd);
            goto mtime_fail;
        }
+        if (fstat(fd, &st) != 0) {
+            close(fd);
+            goto mtime_fail;
+        }
+        close(fd);
        cow_header.mtime = cpu_to_be32(st.st_mtime);
    mtime_fail:
        pstrcpy(cow_header.backing_file, sizeof(cow_header.backing_file),
@@ -301,23 +288,29 @@ static int cow_create(const char *filename, QEMUOptionParameter *options)
    }
    cow_header.sectorsize = cpu_to_be32(512);
    cow_header.size = cpu_to_be64(image_sectors * 512);
-    ret = bdrv_pwrite(cow_bs, 0, &cow_header, sizeof(cow_header));
-    if (ret < 0) {
+    ret = qemu_write_full(cow_fd, &cow_header, sizeof(cow_header));
+    if (ret != sizeof(cow_header)) {
+        ret = -errno;
        goto exit;
    }

    /* resize to include at least all the bitmap */
-    ret = bdrv_truncate(cow_bs,
-        sizeof(cow_header) + ((image_sectors + 7) >> 3));
-    if (ret < 0) {
+    ret = ftruncate(cow_fd, sizeof(cow_header) + ((image_sectors + 7) >> 3));
+    if (ret) {
+        ret = -errno;
        goto exit;
    }

 exit:
-    bdrv_delete(cow_bs);
+    close(cow_fd);
    return ret;
 }

+static coroutine_fn int cow_co_flush(BlockDriverState *bs)
+{
+    return bdrv_co_flush(bs->file);
+}
+
 static QEMUOptionParameter cow_create_options[] = {
    {
        .name = BLOCK_OPT_SIZE,
@@ -343,7 +336,8 @@ static BlockDriver bdrv_cow = {

    .bdrv_read              = cow_co_read,
    .bdrv_write             = cow_co_write,
-    .bdrv_co_is_allocated   = cow_co_is_allocated,
+    .bdrv_co_flush_to_disk  = cow_co_flush,
+    .bdrv_is_allocated      = cow_is_allocated,

    .create_options = cow_create_options,
 };
--- a/block/curl.c
+++ b/block/curl.c
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include <curl/curl.h>

 // #define DEBUG
@@ -34,10 +34,6 @@
 #define DPRINTF(fmt, ...) do { } while (0)
 #endif

-#define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
-                   CURLPROTO_FTP | CURLPROTO_FTPS | \
-                   CURLPROTO_TFTP)
-
 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
 #define SECTOR_SIZE     512
@@ -93,17 +89,19 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, fd);
    switch (action) {
        case CURL_POLL_IN:
-            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, curl_aio_flush, s);
+            qemu_aio_set_fd_handler(fd, curl_multi_do, NULL, curl_aio_flush,
+                                    NULL, s);
            break;
        case CURL_POLL_OUT:
-            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, curl_aio_flush, s);
+            qemu_aio_set_fd_handler(fd, NULL, curl_multi_do, curl_aio_flush,
+                                    NULL, s);
            break;
        case CURL_POLL_INOUT:
            qemu_aio_set_fd_handler(fd, curl_multi_do, curl_multi_do,
-                                    curl_aio_flush, s);
+                                    curl_aio_flush, NULL, s);
            break;
        case CURL_POLL_REMOVE:
-            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL, NULL);
+            qemu_aio_set_fd_handler(fd, NULL, NULL, NULL, NULL, NULL);
            break;
    }

@@ -144,8 +142,8 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
            continue;

        if ((s->buf_off >= acb->end)) {
-            qemu_iovec_from_buf(acb->qiov, 0, s->orig_buf + acb->start,
-                                acb->end - acb->start);
+            qemu_iovec_from_buffer(acb->qiov, s->orig_buf + acb->start,
+                                   acb->end - acb->start);
            acb->common.cb(acb->common.opaque, 0);
            qemu_aio_release(acb);
            s->acb[i] = NULL;
@@ -180,7 +178,7 @@ static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
        {
            char *buf = state->orig_buf + (start - state->buf_start);

-            qemu_iovec_from_buf(acb->qiov, 0, buf, len);
+            qemu_iovec_from_buffer(acb->qiov, buf, len);
            acb->common.cb(acb->common.opaque, 0);

            return FIND_RET_OK;
@@ -284,7 +282,7 @@ static CURLState *curl_init_state(BDRVCURLState *s)
            break;
        }
        if (!state) {
-            g_usleep(100);
+            usleep(100);
            curl_multi_do(s);
        }
    } while(!state);
@@ -306,17 +304,6 @@ static CURLState *curl_init_state(BDRVCURLState *s)
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);

-    /* Restrict supported protocols to avoid security issues in the more
-     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
-     * CVE-2013-0249.
-     *
-     * Restricting protocols is only supported from 7.19.4 upwards.
-     */
-#if LIBCURL_VERSION_NUM >= 0x071304
-    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
-#endif
-
 #ifdef DEBUG_VERBOSE
    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
@@ -453,7 +440,7 @@ static void curl_aio_cancel(BlockDriverAIOCB *blockacb)
    // Do we have to implement canceling? Seems to work without...
 }

-static const AIOCBInfo curl_aiocb_info = {
+static AIOPool curl_aio_pool = {
    .aiocb_size         = sizeof(CURLAIOCB),
    .cancel             = curl_aio_cancel,
 };
@@ -520,7 +507,11 @@ static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
 {
    CURLAIOCB *acb;

-    acb = qemu_aio_get(&curl_aiocb_info, bs, cb, opaque);
+    acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
+
+    if (!acb) {
+        return NULL;
+    }

    acb->qiov = qiov;
    acb->sector_num = sector_num;
@@ -557,7 +548,8 @@ static void curl_close(BlockDriverState *bs)
    }
    if (s->multi)
        curl_multi_cleanup(s->multi);
-    g_free(s->url);
+    if (s->url)
+        free(s->url);
 }

 static int64_t curl_getlength(BlockDriverState *bs)
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -22,9 +22,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/bswap.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "bswap.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVDMGState {
@@ -57,42 +57,29 @@ static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }

-static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
+static off_t read_off(BlockDriverState *bs, int64_t offset)
 {
-    uint64_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 8);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be64_to_cpu(buffer);
-    return 0;
+	uint64_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 8) < 8)
+		return 0;
+	return be64_to_cpu(buffer);
 }

-static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
+static off_t read_uint32(BlockDriverState *bs, int64_t offset)
 {
-    uint32_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 4);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be32_to_cpu(buffer);
-    return 0;
+	uint32_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 4) < 4)
+		return 0;
+	return be32_to_cpu(buffer);
 }

 static int dmg_open(BlockDriverState *bs, int flags)
 {
    BDRVDMGState *s = bs->opaque;
-    uint64_t info_begin,info_end,last_in_offset,last_out_offset;
-    uint32_t count, tmp;
+    off_t info_begin,info_end,last_in_offset,last_out_offset;
+    uint32_t count;
    uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;
    int64_t offset;
-    int ret;

    bs->read_only = 1;
    s->n_chunks = 0;
@@ -101,32 +88,21 @@ static int dmg_open(BlockDriverState *bs, int flags)
    /* read offset of info blocks */
    offset = bdrv_getlength(bs->file);
    if (offset < 0) {
-        ret = offset;
        goto fail;
    }
    offset -= 0x1d8;

-    ret = read_uint64(bs, offset, &info_begin);
-    if (ret < 0) {
-        goto fail;
-    } else if (info_begin == 0) {
-        ret = -EINVAL;
+    info_begin = read_off(bs, offset);
+    if (info_begin == 0) {
+	goto fail;
+    }
+
+    if (read_uint32(bs, info_begin) != 0x100) {
        goto fail;
    }

-    ret = read_uint32(bs, info_begin, &tmp);
-    if (ret < 0) {
-        goto fail;
-    } else if (tmp != 0x100) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = read_uint32(bs, info_begin + 4, &count);
-    if (ret < 0) {
-        goto fail;
-    } else if (count == 0) {
-        ret = -EINVAL;
+    count = read_uint32(bs, info_begin + 4);
+    if (count == 0) {
        goto fail;
    }
    info_end = info_begin + count;
@@ -138,20 +114,12 @@ static int dmg_open(BlockDriverState *bs, int flags)
    while (offset < info_end) {
        uint32_t type;

-        ret = read_uint32(bs, offset, &count);
-        if (ret < 0) {
-            goto fail;
-        } else if (count == 0) {
-            ret = -EINVAL;
-            goto fail;
-        }
+	count = read_uint32(bs, offset);
+	if(count==0)
+	    goto fail;
        offset += 4;

-        ret = read_uint32(bs, offset, &type);
-        if (ret < 0) {
-            goto fail;
-        }
-
+	type = read_uint32(bs, offset);
 	if (type == 0x6d697368 && count >= 244) {
 	    int new_size, chunk_count;

@@ -166,11 +134,8 @@ static int dmg_open(BlockDriverState *bs, int flags)
 	    s->sectors = g_realloc(s->sectors, new_size);
 	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);

-            for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
-                ret = read_uint32(bs, offset, &s->types[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
+	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
+		s->types[i] = read_uint32(bs, offset);
 		offset += 4;
 		if(s->types[i]!=0x80000005 && s->types[i]!=1 && s->types[i]!=2) {
 		    if(s->types[i]==0xffffffff) {
@@ -184,31 +149,17 @@ static int dmg_open(BlockDriverState *bs, int flags)
 		}
 		offset += 4;

-                ret = read_uint64(bs, offset, &s->sectors[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->sectors[i] += last_out_offset;
-                offset += 8;
+		s->sectors[i] = last_out_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->sectorcounts[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->sectorcounts[i] = read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->offsets[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->offsets[i] += last_in_offset;
-                offset += 8;
+		s->offsets[i] = last_in_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->lengths[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->lengths[i] = read_off(bs, offset);
+		offset += 8;

 		if(s->lengths[i]>max_compressed_size)
 		    max_compressed_size = s->lengths[i];
@@ -222,25 +173,15 @@ static int dmg_open(BlockDriverState *bs, int flags)
    /* initialize zlib engine */
    s->compressed_chunk = g_malloc(max_compressed_size+1);
    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
-    if(inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
-    }
+    if(inflateInit(&s->zstream) != Z_OK)
+	goto fail;

    s->current_chunk = s->n_chunks;

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-    return ret;
+    return -1;
 }

 static inline int is_sector_in_chunk(BDRVDMGState* s,
@@ -355,15 +296,15 @@ static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
 static void dmg_close(BlockDriverState *bs)
 {
    BDRVDMGState *s = bs->opaque;
-
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-
+    if(s->n_chunks>0) {
+	free(s->types);
+	free(s->offsets);
+	free(s->lengths);
+	free(s->sectors);
+	free(s->sectorcounts);
+    }
+    free(s->compressed_chunk);
+    free(s->uncompressed_chunk);
    inflateEnd(&s->zstream);
 }

--- a/block/gluster.c
+++ b/block/gluster.c
@@ -1,624 +0,0 @@
-/*
- * GlusterFS backend for QEMU
- *
- * Copyright (C) 2012 Bharata B Rao <bharata@linux.vnet.ibm.com>
- *
- * Pipe handling mechanism in AIO implementation is derived from
- * block/rbd.c. Hence,
- *
- * Copyright (C) 2010-2011 Christian Brunner <chb@muc.de>,
- *                         Josh Durgin <josh.durgin@dreamhost.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-#include <glusterfs/api/glfs.h>
-#include "block/block_int.h"
-#include "qemu/sockets.h"
-#include "qemu/uri.h"
-
-typedef struct GlusterAIOCB {
-    BlockDriverAIOCB common;
-    int64_t size;
-    int ret;
-    bool *finished;
-    QEMUBH *bh;
-} GlusterAIOCB;
-
-typedef struct BDRVGlusterState {
-    struct glfs *glfs;
-    int fds[2];
-    struct glfs_fd *fd;
-    int qemu_aio_count;
-    int event_reader_pos;
-    GlusterAIOCB *event_acb;
-} BDRVGlusterState;
-
-#define GLUSTER_FD_READ  0
-#define GLUSTER_FD_WRITE 1
-
-typedef struct GlusterConf {
-    char *server;
-    int port;
-    char *volname;
-    char *image;
-    char *transport;
-} GlusterConf;
-
-static void qemu_gluster_gconf_free(GlusterConf *gconf)
-{
-    g_free(gconf->server);
-    g_free(gconf->volname);
-    g_free(gconf->image);
-    g_free(gconf->transport);
-    g_free(gconf);
-}
-
-static int parse_volume_options(GlusterConf *gconf, char *path)
-{
-    char *p, *q;
-
-    if (!path) {
-        return -EINVAL;
-    }
-
-    /* volume */
-    p = q = path + strspn(path, "/");
-    p += strcspn(p, "/");
-    if (*p == '\0') {
-        return -EINVAL;
-    }
-    gconf->volname = g_strndup(q, p - q);
-
-    /* image */
-    p += strspn(p, "/");
-    if (*p == '\0') {
-        return -EINVAL;
-    }
-    gconf->image = g_strdup(p);
-    return 0;
-}
-
-/*
- * file=gluster[+transport]://[server[:port]]/volname/image[?socket=...]
- *
- * 'gluster' is the protocol.
- *
- * 'transport' specifies the transport type used to connect to gluster
- * management daemon (glusterd). Valid transport types are
- * tcp, unix and rdma. If a transport type isn't specified, then tcp
- * type is assumed.
- *
- * 'server' specifies the server where the volume file specification for
- * the given volume resides. This can be either hostname, ipv4 address
- * or ipv6 address. ipv6 address needs to be within square brackets [ ].
- * If transport type is 'unix', then 'server' field should not be specifed.
- * The 'socket' field needs to be populated with the path to unix domain
- * socket.
- *
- * 'port' is the port number on which glusterd is listening. This is optional
- * and if not specified, QEMU will send 0 which will make gluster to use the
- * default port. If the transport type is unix, then 'port' should not be
- * specified.
- *
- * 'volname' is the name of the gluster volume which contains the VM image.
- *
- * 'image' is the path to the actual VM image that resides on gluster volume.
- *
- * Examples:
- *
- * file=gluster://1.2.3.4/testvol/a.img
- * file=gluster+tcp://1.2.3.4/testvol/a.img
- * file=gluster+tcp://1.2.3.4:24007/testvol/dir/a.img
- * file=gluster+tcp://[1:2:3:4:5:6:7:8]/testvol/dir/a.img
- * file=gluster+tcp://[1:2:3:4:5:6:7:8]:24007/testvol/dir/a.img
- * file=gluster+tcp://server.domain.com:24007/testvol/dir/a.img
- * file=gluster+unix:///testvol/dir/a.img?socket=/tmp/glusterd.socket
- * file=gluster+rdma://1.2.3.4:24007/testvol/a.img
- */
-static int qemu_gluster_parseuri(GlusterConf *gconf, const char *filename)
-{
-    URI *uri;
-    QueryParams *qp = NULL;
-    bool is_unix = false;
-    int ret = 0;
-
-    uri = uri_parse(filename);
-    if (!uri) {
-        return -EINVAL;
-    }
-
-    /* transport */
-    if (!strcmp(uri->scheme, "gluster")) {
-        gconf->transport = g_strdup("tcp");
-    } else if (!strcmp(uri->scheme, "gluster+tcp")) {
-        gconf->transport = g_strdup("tcp");
-    } else if (!strcmp(uri->scheme, "gluster+unix")) {
-        gconf->transport = g_strdup("unix");
-        is_unix = true;
-    } else if (!strcmp(uri->scheme, "gluster+rdma")) {
-        gconf->transport = g_strdup("rdma");
-    } else {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    ret = parse_volume_options(gconf, uri->path);
-    if (ret < 0) {
-        goto out;
-    }
-
-    qp = query_params_parse(uri->query);
-    if (qp->n > 1 || (is_unix && !qp->n) || (!is_unix && qp->n)) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    if (is_unix) {
-        if (uri->server || uri->port) {
-            ret = -EINVAL;
-            goto out;
-        }
-        if (strcmp(qp->p[0].name, "socket")) {
-            ret = -EINVAL;
-            goto out;
-        }
-        gconf->server = g_strdup(qp->p[0].value);
-    } else {
-        gconf->server = g_strdup(uri->server);
-        gconf->port = uri->port;
-    }
-
-out:
-    if (qp) {
-        query_params_free(qp);
-    }
-    uri_free(uri);
-    return ret;
-}
-
-static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename)
-{
-    struct glfs *glfs = NULL;
-    int ret;
-    int old_errno;
-
-    ret = qemu_gluster_parseuri(gconf, filename);
-    if (ret < 0) {
-        error_report("Usage: file=gluster[+transport]://[server[:port]]/"
-            "volname/image[?socket=...]");
-        errno = -ret;
-        goto out;
-    }
-
-    glfs = glfs_new(gconf->volname);
-    if (!glfs) {
-        goto out;
-    }
-
-    ret = glfs_set_volfile_server(glfs, gconf->transport, gconf->server,
-            gconf->port);
-    if (ret < 0) {
-        goto out;
-    }
-
-    /*
-     * TODO: Use GF_LOG_ERROR instead of hard code value of 4 here when
-     * GlusterFS makes GF_LOG_* macros available to libgfapi users.
-     */
-    ret = glfs_set_logging(glfs, "-", 4);
-    if (ret < 0) {
-        goto out;
-    }
-
-    ret = glfs_init(glfs);
-    if (ret) {
-        error_report("Gluster connection failed for server=%s port=%d "
-             "volume=%s image=%s transport=%s", gconf->server, gconf->port,
-             gconf->volname, gconf->image, gconf->transport);
-        goto out;
-    }
-    return glfs;
-
-out:
-    if (glfs) {
-        old_errno = errno;
-        glfs_fini(glfs);
-        errno = old_errno;
-    }
-    return NULL;
-}
-
-static void qemu_gluster_complete_aio(GlusterAIOCB *acb, BDRVGlusterState *s)
-{
-    int ret;
-    bool *finished = acb->finished;
-    BlockDriverCompletionFunc *cb = acb->common.cb;
-    void *opaque = acb->common.opaque;
-
-    if (!acb->ret || acb->ret == acb->size) {
-        ret = 0; /* Success */
-    } else if (acb->ret < 0) {
-        ret = acb->ret; /* Read/Write failed */
-    } else {
-        ret = -EIO; /* Partial read/write - fail it */
-    }
-
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    cb(opaque, ret);
-    if (finished) {
-        *finished = true;
-    }
-}
-
-static void qemu_gluster_aio_event_reader(void *opaque)
-{
-    BDRVGlusterState *s = opaque;
-    ssize_t ret;
-
-    do {
-        char *p = (char *)&s->event_acb;
-
-        ret = read(s->fds[GLUSTER_FD_READ], p + s->event_reader_pos,
-                   sizeof(s->event_acb) - s->event_reader_pos);
-        if (ret > 0) {
-            s->event_reader_pos += ret;
-            if (s->event_reader_pos == sizeof(s->event_acb)) {
-                s->event_reader_pos = 0;
-                qemu_gluster_complete_aio(s->event_acb, s);
-            }
-        }
-    } while (ret < 0 && errno == EINTR);
-}
-
-static int qemu_gluster_aio_flush_cb(void *opaque)
-{
-    BDRVGlusterState *s = opaque;
-
-    return (s->qemu_aio_count > 0);
-}
-
-static int qemu_gluster_open(BlockDriverState *bs, const char *filename,
-    int bdrv_flags)
-{
-    BDRVGlusterState *s = bs->opaque;
-    int open_flags = O_BINARY;
-    int ret = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
-
-    s->glfs = qemu_gluster_init(gconf, filename);
-    if (!s->glfs) {
-        ret = -errno;
-        goto out;
-    }
-
-    if (bdrv_flags & BDRV_O_RDWR) {
-        open_flags |= O_RDWR;
-    } else {
-        open_flags |= O_RDONLY;
-    }
-
-    if ((bdrv_flags & BDRV_O_NOCACHE)) {
-        open_flags |= O_DIRECT;
-    }
-
-    s->fd = glfs_open(s->glfs, gconf->image, open_flags);
-    if (!s->fd) {
-        ret = -errno;
-        goto out;
-    }
-
-    ret = qemu_pipe(s->fds);
-    if (ret < 0) {
-        ret = -errno;
-        goto out;
-    }
-    fcntl(s->fds[GLUSTER_FD_READ], F_SETFL, O_NONBLOCK);
-    qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ],
-        qemu_gluster_aio_event_reader, NULL, qemu_gluster_aio_flush_cb, s);
-
-out:
-    qemu_gluster_gconf_free(gconf);
-    if (!ret) {
-        return ret;
-    }
-    if (s->fd) {
-        glfs_close(s->fd);
-    }
-    if (s->glfs) {
-        glfs_fini(s->glfs);
-    }
-    return ret;
-}
-
-static int qemu_gluster_create(const char *filename,
-        QEMUOptionParameter *options)
-{
-    struct glfs *glfs;
-    struct glfs_fd *fd;
-    int ret = 0;
-    int64_t total_size = 0;
-    GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
-
-    glfs = qemu_gluster_init(gconf, filename);
-    if (!glfs) {
-        ret = -errno;
-        goto out;
-    }
-
-    while (options && options->name) {
-        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
-            total_size = options->value.n / BDRV_SECTOR_SIZE;
-        }
-        options++;
-    }
-
-    fd = glfs_creat(glfs, gconf->image,
-        O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
-    if (!fd) {
-        ret = -errno;
-    } else {
-        if (glfs_ftruncate(fd, total_size * BDRV_SECTOR_SIZE) != 0) {
-            ret = -errno;
-        }
-        if (glfs_close(fd) != 0) {
-            ret = -errno;
-        }
-    }
-out:
-    qemu_gluster_gconf_free(gconf);
-    if (glfs) {
-        glfs_fini(glfs);
-    }
-    return ret;
-}
-
-static void qemu_gluster_aio_cancel(BlockDriverAIOCB *blockacb)
-{
-    GlusterAIOCB *acb = (GlusterAIOCB *)blockacb;
-    bool finished = false;
-
-    acb->finished = &finished;
-    while (!finished) {
-        qemu_aio_wait();
-    }
-}
-
-static const AIOCBInfo gluster_aiocb_info = {
-    .aiocb_size = sizeof(GlusterAIOCB),
-    .cancel = qemu_gluster_aio_cancel,
-};
-
-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
-{
-    GlusterAIOCB *acb = (GlusterAIOCB *)arg;
-    BlockDriverState *bs = acb->common.bs;
-    BDRVGlusterState *s = bs->opaque;
-    int retval;
-
-    acb->ret = ret;
-    retval = qemu_write_full(s->fds[GLUSTER_FD_WRITE], &acb, sizeof(acb));
-    if (retval != sizeof(acb)) {
-        /*
-         * Gluster AIO callback thread failed to notify the waiting
-         * QEMU thread about IO completion.
-         *
-         * Complete this IO request and make the disk inaccessible for
-         * subsequent reads and writes.
-         */
-        error_report("Gluster failed to notify QEMU about IO completion");
-
-        qemu_mutex_lock_iothread(); /* We are in gluster thread context */
-        acb->common.cb(acb->common.opaque, -EIO);
-        qemu_aio_release(acb);
-        s->qemu_aio_count--;
-        close(s->fds[GLUSTER_FD_READ]);
-        close(s->fds[GLUSTER_FD_WRITE]);
-        qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ], NULL, NULL, NULL,
-            NULL);
-        bs->drv = NULL; /* Make the disk inaccessible */
-        qemu_mutex_unlock_iothread();
-    }
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_rw(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int write)
-{
-    int ret;
-    GlusterAIOCB *acb;
-    BDRVGlusterState *s = bs->opaque;
-    size_t size;
-    off_t offset;
-
-    offset = sector_num * BDRV_SECTOR_SIZE;
-    size = nb_sectors * BDRV_SECTOR_SIZE;
-    s->qemu_aio_count++;
-
-    acb = qemu_aio_get(&gluster_aiocb_info, bs, cb, opaque);
-    acb->size = size;
-    acb->ret = 0;
-    acb->finished = NULL;
-
-    if (write) {
-        ret = glfs_pwritev_async(s->fd, qiov->iov, qiov->niov, offset, 0,
-            &gluster_finish_aiocb, acb);
-    } else {
-        ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
-            &gluster_finish_aiocb, acb);
-    }
-
-    if (ret < 0) {
-        goto out;
-    }
-    return &acb->common;
-
-out:
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    return NULL;
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_readv(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    return qemu_gluster_aio_rw(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_writev(BlockDriverState *bs,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    return qemu_gluster_aio_rw(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
-}
-
-static BlockDriverAIOCB *qemu_gluster_aio_flush(BlockDriverState *bs,
-        BlockDriverCompletionFunc *cb, void *opaque)
-{
-    int ret;
-    GlusterAIOCB *acb;
-    BDRVGlusterState *s = bs->opaque;
-
-    acb = qemu_aio_get(&gluster_aiocb_info, bs, cb, opaque);
-    acb->size = 0;
-    acb->ret = 0;
-    acb->finished = NULL;
-    s->qemu_aio_count++;
-
-    ret = glfs_fsync_async(s->fd, &gluster_finish_aiocb, acb);
-    if (ret < 0) {
-        goto out;
-    }
-    return &acb->common;
-
-out:
-    s->qemu_aio_count--;
-    qemu_aio_release(acb);
-    return NULL;
-}
-
-static int64_t qemu_gluster_getlength(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-    int64_t ret;
-
-    ret = glfs_lseek(s->fd, 0, SEEK_END);
-    if (ret < 0) {
-        return -errno;
-    } else {
-        return ret;
-    }
-}
-
-static int64_t qemu_gluster_allocated_file_size(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-    struct stat st;
-    int ret;
-
-    ret = glfs_fstat(s->fd, &st);
-    if (ret < 0) {
-        return -errno;
-    } else {
-        return st.st_blocks * 512;
-    }
-}
-
-static void qemu_gluster_close(BlockDriverState *bs)
-{
-    BDRVGlusterState *s = bs->opaque;
-
-    close(s->fds[GLUSTER_FD_READ]);
-    close(s->fds[GLUSTER_FD_WRITE]);
-    qemu_aio_set_fd_handler(s->fds[GLUSTER_FD_READ], NULL, NULL, NULL, NULL);
-
-    if (s->fd) {
-        glfs_close(s->fd);
-        s->fd = NULL;
-    }
-    glfs_fini(s->glfs);
-}
-
-static QEMUOptionParameter qemu_gluster_create_options[] = {
-    {
-        .name = BLOCK_OPT_SIZE,
-        .type = OPT_SIZE,
-        .help = "Virtual disk size"
-    },
-    { NULL }
-};
-
-static BlockDriver bdrv_gluster = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_tcp = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+tcp",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_unix = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+unix",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static BlockDriver bdrv_gluster_rdma = {
-    .format_name                  = "gluster",
-    .protocol_name                = "gluster+rdma",
-    .instance_size                = sizeof(BDRVGlusterState),
-    .bdrv_file_open               = qemu_gluster_open,
-    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_create                  = qemu_gluster_create,
-    .bdrv_getlength               = qemu_gluster_getlength,
-    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_aio_readv               = qemu_gluster_aio_readv,
-    .bdrv_aio_writev              = qemu_gluster_aio_writev,
-    .bdrv_aio_flush               = qemu_gluster_aio_flush,
-    .create_options               = qemu_gluster_create_options,
-};
-
-static void bdrv_gluster_init(void)
-{
-    bdrv_register(&bdrv_gluster_rdma);
-    bdrv_register(&bdrv_gluster_unix);
-    bdrv_register(&bdrv_gluster_tcp);
-    bdrv_register(&bdrv_gluster);
-}
-
-block_init(bdrv_gluster_init);
--- a/block/iscsi.c
+++ b/block/iscsi.c
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -1,584 +0,0 @@
-/*
- * Image mirroring
- *
- * Copyright Red Hat, Inc. 2012
- *
- * Authors:
- *  Paolo Bonzini  <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU LGPL, version 2 or later.
- * See the COPYING.LIB file in the top-level directory.
- *
- */
-
-#include "trace.h"
-#include "block/blockjob.h"
-#include "block/block_int.h"
-#include "qemu/ratelimit.h"
-#include "qemu/bitmap.h"
-
-#define SLICE_TIME    100000000ULL /* ns */
-#define MAX_IN_FLIGHT 16
-
-/* The mirroring buffer is a list of granularity-sized chunks.
- * Free chunks are organized in a list.
- */
-typedef struct MirrorBuffer {
-    QSIMPLEQ_ENTRY(MirrorBuffer) next;
-} MirrorBuffer;
-
-typedef struct MirrorBlockJob {
-    BlockJob common;
-    RateLimit limit;
-    BlockDriverState *target;
-    MirrorSyncMode mode;
-    BlockdevOnError on_source_error, on_target_error;
-    bool synced;
-    bool should_complete;
-    int64_t sector_num;
-    int64_t granularity;
-    size_t buf_size;
-    unsigned long *cow_bitmap;
-    HBitmapIter hbi;
-    uint8_t *buf;
-    QSIMPLEQ_HEAD(, MirrorBuffer) buf_free;
-    int buf_free_count;
-
-    unsigned long *in_flight_bitmap;
-    int in_flight;
-    int ret;
-} MirrorBlockJob;
-
-typedef struct MirrorOp {
-    MirrorBlockJob *s;
-    QEMUIOVector qiov;
-    int64_t sector_num;
-    int nb_sectors;
-} MirrorOp;
-
-static BlockErrorAction mirror_error_action(MirrorBlockJob *s, bool read,
-                                            int error)
-{
-    s->synced = false;
-    if (read) {
-        return block_job_error_action(&s->common, s->common.bs,
-                                      s->on_source_error, true, error);
-    } else {
-        return block_job_error_action(&s->common, s->target,
-                                      s->on_target_error, false, error);
-    }
-}
-
-static void mirror_iteration_done(MirrorOp *op, int ret)
-{
-    MirrorBlockJob *s = op->s;
-    struct iovec *iov;
-    int64_t chunk_num;
-    int i, nb_chunks, sectors_per_chunk;
-
-    trace_mirror_iteration_done(s, op->sector_num, op->nb_sectors, ret);
-
-    s->in_flight--;
-    iov = op->qiov.iov;
-    for (i = 0; i < op->qiov.niov; i++) {
-        MirrorBuffer *buf = (MirrorBuffer *) iov[i].iov_base;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, buf, next);
-        s->buf_free_count++;
-    }
-
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    chunk_num = op->sector_num / sectors_per_chunk;
-    nb_chunks = op->nb_sectors / sectors_per_chunk;
-    bitmap_clear(s->in_flight_bitmap, chunk_num, nb_chunks);
-    if (s->cow_bitmap && ret >= 0) {
-        bitmap_set(s->cow_bitmap, chunk_num, nb_chunks);
-    }
-
-    g_slice_free(MirrorOp, op);
-    qemu_coroutine_enter(s->common.co, NULL);
-}
-
-static void mirror_write_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, false, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-    }
-    mirror_iteration_done(op, ret);
-}
-
-static void mirror_read_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, true, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-
-        mirror_iteration_done(op, ret);
-        return;
-    }
-    bdrv_aio_writev(s->target, op->sector_num, &op->qiov, op->nb_sectors,
-                    mirror_write_complete, op);
-}
-
-static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
-{
-    BlockDriverState *source = s->common.bs;
-    int nb_sectors, sectors_per_chunk, nb_chunks;
-    int64_t end, sector_num, next_chunk, next_sector, hbitmap_next_sector;
-    MirrorOp *op;
-
-    s->sector_num = hbitmap_iter_next(&s->hbi);
-    if (s->sector_num < 0) {
-        bdrv_dirty_iter_init(source, &s->hbi);
-        s->sector_num = hbitmap_iter_next(&s->hbi);
-        trace_mirror_restart_iter(s, bdrv_get_dirty_count(source));
-        assert(s->sector_num >= 0);
-    }
-
-    hbitmap_next_sector = s->sector_num;
-    sector_num = s->sector_num;
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    end = s->common.len >> BDRV_SECTOR_BITS;
-
-    /* Extend the QEMUIOVector to include all adjacent blocks that will
-     * be copied in this operation.
-     *
-     * We have to do this if we have no backing file yet in the destination,
-     * and the cluster size is very large.  Then we need to do COW ourselves.
-     * The first time a cluster is copied, copy it entirely.  Note that,
-     * because both the granularity and the cluster size are powers of two,
-     * the number of sectors to copy cannot exceed one cluster.
-     *
-     * We also want to extend the QEMUIOVector to include more adjacent
-     * dirty blocks if possible, to limit the number of I/O operations and
-     * run efficiently even with a small granularity.
-     */
-    nb_chunks = 0;
-    nb_sectors = 0;
-    next_sector = sector_num;
-    next_chunk = sector_num / sectors_per_chunk;
-
-    /* Wait for I/O to this cluster (from a previous iteration) to be done.  */
-    while (test_bit(next_chunk, s->in_flight_bitmap)) {
-        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
-        qemu_coroutine_yield();
-    }
-
-    do {
-        int added_sectors, added_chunks;
-
-        if (!bdrv_get_dirty(source, next_sector) ||
-            test_bit(next_chunk, s->in_flight_bitmap)) {
-            assert(nb_sectors > 0);
-            break;
-        }
-
-        added_sectors = sectors_per_chunk;
-        if (s->cow_bitmap && !test_bit(next_chunk, s->cow_bitmap)) {
-            bdrv_round_to_clusters(s->target,
-                                   next_sector, added_sectors,
-                                   &next_sector, &added_sectors);
-
-            /* On the first iteration, the rounding may make us copy
-             * sectors before the first dirty one.
-             */
-            if (next_sector < sector_num) {
-                assert(nb_sectors == 0);
-                sector_num = next_sector;
-                next_chunk = next_sector / sectors_per_chunk;
-            }
-        }
-
-        added_sectors = MIN(added_sectors, end - (sector_num + nb_sectors));
-        added_chunks = (added_sectors + sectors_per_chunk - 1) / sectors_per_chunk;
-
-        /* When doing COW, it may happen that there is not enough space for
-         * a full cluster.  Wait if that is the case.
-         */
-        while (nb_chunks == 0 && s->buf_free_count < added_chunks) {
-            trace_mirror_yield_buf_busy(s, nb_chunks, s->in_flight);
-            qemu_coroutine_yield();
-        }
-        if (s->buf_free_count < nb_chunks + added_chunks) {
-            trace_mirror_break_buf_busy(s, nb_chunks, s->in_flight);
-            break;
-        }
-
-        /* We have enough free space to copy these sectors.  */
-        bitmap_set(s->in_flight_bitmap, next_chunk, added_chunks);
-
-        nb_sectors += added_sectors;
-        nb_chunks += added_chunks;
-        next_sector += added_sectors;
-        next_chunk += added_chunks;
-    } while (next_sector < end);
-
-    /* Allocate a MirrorOp that is used as an AIO callback.  */
-    op = g_slice_new(MirrorOp);
-    op->s = s;
-    op->sector_num = sector_num;
-    op->nb_sectors = nb_sectors;
-
-    /* Now make a QEMUIOVector taking enough granularity-sized chunks
-     * from s->buf_free.
-     */
-    qemu_iovec_init(&op->qiov, nb_chunks);
-    next_sector = sector_num;
-    while (nb_chunks-- > 0) {
-        MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
-        QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
-        s->buf_free_count--;
-        qemu_iovec_add(&op->qiov, buf, s->granularity);
-
-        /* Advance the HBitmapIter in parallel, so that we do not examine
-         * the same sector twice.
-         */
-        if (next_sector > hbitmap_next_sector && bdrv_get_dirty(source, next_sector)) {
-            hbitmap_next_sector = hbitmap_iter_next(&s->hbi);
-        }
-
-        next_sector += sectors_per_chunk;
-    }
-
-    bdrv_reset_dirty(source, sector_num, nb_sectors);
-
-    /* Copy the dirty cluster.  */
-    s->in_flight++;
-    trace_mirror_one_iteration(s, sector_num, nb_sectors);
-    bdrv_aio_readv(source, sector_num, &op->qiov, nb_sectors,
-                   mirror_read_complete, op);
-}
-
-static void mirror_free_init(MirrorBlockJob *s)
-{
-    int granularity = s->granularity;
-    size_t buf_size = s->buf_size;
-    uint8_t *buf = s->buf;
-
-    assert(s->buf_free_count == 0);
-    QSIMPLEQ_INIT(&s->buf_free);
-    while (buf_size != 0) {
-        MirrorBuffer *cur = (MirrorBuffer *)buf;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, cur, next);
-        s->buf_free_count++;
-        buf_size -= granularity;
-        buf += granularity;
-    }
-}
-
-static void mirror_drain(MirrorBlockJob *s)
-{
-    while (s->in_flight > 0) {
-        qemu_coroutine_yield();
-    }
-}
-
-static void coroutine_fn mirror_run(void *opaque)
-{
-    MirrorBlockJob *s = opaque;
-    BlockDriverState *bs = s->common.bs;
-    int64_t sector_num, end, sectors_per_chunk, length;
-    uint64_t last_pause_ns;
-    BlockDriverInfo bdi;
-    char backing_filename[1024];
-    int ret = 0;
-    int n;
-
-    if (block_job_is_cancelled(&s->common)) {
-        goto immediate_exit;
-    }
-
-    s->common.len = bdrv_getlength(bs);
-    if (s->common.len <= 0) {
-        block_job_completed(&s->common, s->common.len);
-        return;
-    }
-
-    length = (bdrv_getlength(bs) + s->granularity - 1) / s->granularity;
-    s->in_flight_bitmap = bitmap_new(length);
-
-    /* If we have no backing file yet in the destination, we cannot let
-     * the destination do COW.  Instead, we copy sectors around the
-     * dirty data if needed.  We need a bitmap to do that.
-     */
-    bdrv_get_backing_filename(s->target, backing_filename,
-                              sizeof(backing_filename));
-    if (backing_filename[0] && !s->target->backing_hd) {
-        bdrv_get_info(s->target, &bdi);
-        if (s->granularity < bdi.cluster_size) {
-            s->buf_size = MAX(s->buf_size, bdi.cluster_size);
-            s->cow_bitmap = bitmap_new(length);
-        }
-    }
-
-    end = s->common.len >> BDRV_SECTOR_BITS;
-    s->buf = qemu_blockalign(bs, s->buf_size);
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    mirror_free_init(s);
-
-    if (s->mode != MIRROR_SYNC_MODE_NONE) {
-        /* First part, loop on the sectors and initialize the dirty bitmap.  */
-        BlockDriverState *base;
-        base = s->mode == MIRROR_SYNC_MODE_FULL ? NULL : bs->backing_hd;
-        for (sector_num = 0; sector_num < end; ) {
-            int64_t next = (sector_num | (sectors_per_chunk - 1)) + 1;
-            ret = bdrv_co_is_allocated_above(bs, base,
-                                             sector_num, next - sector_num, &n);
-
-            if (ret < 0) {
-                goto immediate_exit;
-            }
-
-            assert(n > 0);
-            if (ret == 1) {
-                bdrv_set_dirty(bs, sector_num, n);
-                sector_num = next;
-            } else {
-                sector_num += n;
-            }
-        }
-    }
-
-    bdrv_dirty_iter_init(bs, &s->hbi);
-    last_pause_ns = qemu_get_clock_ns(rt_clock);
-    for (;;) {
-        uint64_t delay_ns;
-        int64_t cnt;
-        bool should_complete;
-
-        if (s->ret < 0) {
-            ret = s->ret;
-            goto immediate_exit;
-        }
-
-        cnt = bdrv_get_dirty_count(bs);
-
-        /* Note that even when no rate limit is applied we need to yield
-         * periodically with no pending I/O so that qemu_aio_flush() returns.
-         * We do so every SLICE_TIME nanoseconds, or when there is an error,
-         * or when the source is clean, whichever comes first.
-         */
-        if (qemu_get_clock_ns(rt_clock) - last_pause_ns < SLICE_TIME &&
-            s->common.iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
-            if (s->in_flight == MAX_IN_FLIGHT || s->buf_free_count == 0 ||
-                (cnt == 0 && s->in_flight > 0)) {
-                trace_mirror_yield(s, s->in_flight, s->buf_free_count, cnt);
-                qemu_coroutine_yield();
-                continue;
-            } else if (cnt != 0) {
-                mirror_iteration(s);
-                continue;
-            }
-        }
-
-        should_complete = false;
-        if (s->in_flight == 0 && cnt == 0) {
-            trace_mirror_before_flush(s);
-            ret = bdrv_flush(s->target);
-            if (ret < 0) {
-                if (mirror_error_action(s, false, -ret) == BDRV_ACTION_REPORT) {
-                    goto immediate_exit;
-                }
-            } else {
-                /* We're out of the streaming phase.  From now on, if the job
-                 * is cancelled we will actually complete all pending I/O and
-                 * report completion.  This way, block-job-cancel will leave
-                 * the target in a consistent state.
-                 */
-                s->common.offset = end * BDRV_SECTOR_SIZE;
-                if (!s->synced) {
-                    block_job_ready(&s->common);
-                    s->synced = true;
-                }
-
-                should_complete = s->should_complete ||
-                    block_job_is_cancelled(&s->common);
-                cnt = bdrv_get_dirty_count(bs);
-            }
-        }
-
-        if (cnt == 0 && should_complete) {
-            /* The dirty bitmap is not updated while operations are pending.
-             * If we're about to exit, wait for pending operations before
-             * calling bdrv_get_dirty_count(bs), or we may exit while the
-             * source has dirty data to copy!
-             *
-             * Note that I/O can be submitted by the guest while
-             * mirror_populate runs.
-             */
-            trace_mirror_before_drain(s, cnt);
-            bdrv_drain_all();
-            cnt = bdrv_get_dirty_count(bs);
-        }
-
-        ret = 0;
-        trace_mirror_before_sleep(s, cnt, s->synced);
-        if (!s->synced) {
-            /* Publish progress */
-            s->common.offset = (end - cnt) * BDRV_SECTOR_SIZE;
-
-            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, sectors_per_chunk);
-            } else {
-                delay_ns = 0;
-            }
-
-            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-            if (block_job_is_cancelled(&s->common)) {
-                break;
-            }
-        } else if (!should_complete) {
-            delay_ns = (s->in_flight == 0 && cnt == 0 ? SLICE_TIME : 0);
-            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
-        } else if (cnt == 0) {
-            /* The two disks are in sync.  Exit and report successful
-             * completion.
-             */
-            assert(QLIST_EMPTY(&bs->tracked_requests));
-            s->common.cancelled = false;
-            break;
-        }
-        last_pause_ns = qemu_get_clock_ns(rt_clock);
-    }
-
-immediate_exit:
-    if (s->in_flight > 0) {
-        /* We get here only if something went wrong.  Either the job failed,
-         * or it was cancelled prematurely so that we do not guarantee that
-         * the target is a copy of the source.
-         */
-        assert(ret < 0 || (!s->synced && block_job_is_cancelled(&s->common)));
-        mirror_drain(s);
-    }
-
-    assert(s->in_flight == 0);
-    qemu_vfree(s->buf);
-    g_free(s->cow_bitmap);
-    g_free(s->in_flight_bitmap);
-    bdrv_set_dirty_tracking(bs, 0);
-    bdrv_iostatus_disable(s->target);
-    if (s->should_complete && ret == 0) {
-        if (bdrv_get_flags(s->target) != bdrv_get_flags(s->common.bs)) {
-            bdrv_reopen(s->target, bdrv_get_flags(s->common.bs), NULL);
-        }
-        bdrv_swap(s->target, s->common.bs);
-    }
-    bdrv_close(s->target);
-    bdrv_delete(s->target);
-    block_job_completed(&s->common, ret);
-}
-
-static void mirror_set_speed(BlockJob *job, int64_t speed, Error **errp)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    if (speed < 0) {
-        error_set(errp, QERR_INVALID_PARAMETER, "speed");
-        return;
-    }
-    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
-}
-
-static void mirror_iostatus_reset(BlockJob *job)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    bdrv_iostatus_reset(s->target);
-}
-
-static void mirror_complete(BlockJob *job, Error **errp)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-    int ret;
-
-    ret = bdrv_open_backing_file(s->target);
-    if (ret < 0) {
-        char backing_filename[PATH_MAX];
-        bdrv_get_full_backing_filename(s->target, backing_filename,
-                                       sizeof(backing_filename));
-        error_set(errp, QERR_OPEN_FILE_FAILED, backing_filename);
-        return;
-    }
-    if (!s->synced) {
-        error_set(errp, QERR_BLOCK_JOB_NOT_READY, job->bs->device_name);
-        return;
-    }
-
-    s->should_complete = true;
-    block_job_resume(job);
-}
-
-static BlockJobType mirror_job_type = {
-    .instance_size = sizeof(MirrorBlockJob),
-    .job_type      = "mirror",
-    .set_speed     = mirror_set_speed,
-    .iostatus_reset= mirror_iostatus_reset,
-    .complete      = mirror_complete,
-};
-
-void mirror_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed, int64_t granularity, int64_t buf_size,
-                  MirrorSyncMode mode, BlockdevOnError on_source_error,
-                  BlockdevOnError on_target_error,
-                  BlockDriverCompletionFunc *cb,
-                  void *opaque, Error **errp)
-{
-    MirrorBlockJob *s;
-
-    if (granularity == 0) {
-        /* Choose the default granularity based on the target file's cluster
-         * size, clamped between 4k and 64k.  */
-        BlockDriverInfo bdi;
-        if (bdrv_get_info(target, &bdi) >= 0 && bdi.cluster_size != 0) {
-            granularity = MAX(4096, bdi.cluster_size);
-            granularity = MIN(65536, granularity);
-        } else {
-            granularity = 65536;
-        }
-    }
-
-    assert ((granularity & (granularity - 1)) == 0);
-
-    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
-         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
-        !bdrv_iostatus_is_enabled(bs)) {
-        error_set(errp, QERR_INVALID_PARAMETER, "on-source-error");
-        return;
-    }
-
-    s = block_job_create(&mirror_job_type, bs, speed, cb, opaque, errp);
-    if (!s) {
-        return;
-    }
-
-    s->on_source_error = on_source_error;
-    s->on_target_error = on_target_error;
-    s->target = target;
-    s->mode = mode;
-    s->granularity = granularity;
-    s->buf_size = MAX(buf_size, granularity);
-
-    bdrv_set_dirty_tracking(bs, granularity);
-    bdrv_set_enable_write_cache(s->target, true);
-    bdrv_set_on_error(s->target, on_target_error, on_target_error);
-    bdrv_iostatus_enable(s->target);
-    s->common.co = qemu_coroutine_create(mirror_run);
-    trace_mirror_start(bs, s, s->common.co, opaque);
-    qemu_coroutine_enter(s->common.co, s);
-}
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -27,11 +27,10 @@
 */

 #include "qemu-common.h"
-#include "block/nbd.h"
-#include "qemu/uri.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "qemu/sockets.h"
+#include "nbd.h"
+#include "block_int.h"
+#include "module.h"
+#include "qemu_socket.h"

 #include <sys/types.h>
 #include <unistd.h>
@@ -47,93 +46,21 @@
 #define logout(fmt, ...) ((void)0)
 #endif

-#define MAX_NBD_REQUESTS	16
-#define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
-#define INDEX_TO_HANDLE(bs, index)  ((index)  ^ ((uint64_t)(intptr_t)bs))
-
 typedef struct BDRVNBDState {
+    CoMutex lock;
    int sock;
    uint32_t nbdflags;
    off_t size;
    size_t blocksize;
-
-    CoMutex send_mutex;
-    CoMutex free_sema;
-    Coroutine *send_coroutine;
-    int in_flight;
-
-    Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
-    struct nbd_reply reply;
-
-    int is_unix;
-    char *host_spec;
    char *export_name; /* An NBD server may export several devices */
+
+    /* If it begins with  '/', this is a UNIX domain socket. Otherwise,
+     * it's a string of the form <hostname|ip4|\[ip6\]>:port
+     */
+    char *host_spec;
 } BDRVNBDState;

-static int nbd_parse_uri(BDRVNBDState *s, const char *filename)
-{
-    URI *uri;
-    const char *p;
-    QueryParams *qp = NULL;
-    int ret = 0;
-
-    uri = uri_parse(filename);
-    if (!uri) {
-        return -EINVAL;
-    }
-
-    /* transport */
-    if (!strcmp(uri->scheme, "nbd")) {
-        s->is_unix = false;
-    } else if (!strcmp(uri->scheme, "nbd+tcp")) {
-        s->is_unix = false;
-    } else if (!strcmp(uri->scheme, "nbd+unix")) {
-        s->is_unix = true;
-    } else {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    p = uri->path ? uri->path : "/";
-    p += strspn(p, "/");
-    if (p[0]) {
-        s->export_name = g_strdup(p);
-    }
-
-    qp = query_params_parse(uri->query);
-    if (qp->n > 1 || (s->is_unix && !qp->n) || (!s->is_unix && qp->n)) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    if (s->is_unix) {
-        /* nbd+unix:///export?socket=path */
-        if (uri->server || uri->port || strcmp(qp->p[0].name, "socket")) {
-            ret = -EINVAL;
-            goto out;
-        }
-        s->host_spec = g_strdup(qp->p[0].value);
-    } else {
-        /* nbd[+tcp]://host:port/export */
-        if (!uri->server) {
-            ret = -EINVAL;
-            goto out;
-        }
-        if (!uri->port) {
-            uri->port = NBD_DEFAULT_PORT;
-        }
-        s->host_spec = g_strdup_printf("%s:%d", uri->server, uri->port);
-    }
-
-out:
-    if (qp) {
-        query_params_free(qp);
-    }
-    uri_free(uri);
-    return ret;
-}
-
-static int nbd_config(BDRVNBDState *s, const char *filename)
+static int nbd_config(BDRVNBDState *s, const char *filename, int flags)
 {
    char *file;
    char *export_name;
@@ -141,10 +68,6 @@ static int nbd_config(BDRVNBDState *s, const char *filename)
    const char *unixpath;
    int err = -EINVAL;

-    if (strstr(filename, "://")) {
-        return nbd_parse_uri(s, filename);
-    }
-
    file = g_strdup(filename);

    export_name = strstr(file, EN_OPTSTR);
@@ -164,10 +87,11 @@ static int nbd_config(BDRVNBDState *s, const char *filename)

    /* are we a UNIX or TCP socket? */
    if (strstart(host_spec, "unix:", &unixpath)) {
-        s->is_unix = true;
+        if (unixpath[0] != '/') { /* We demand  an absolute path*/
+            goto out;
+        }
        s->host_spec = g_strdup(unixpath);
    } else {
-        s->is_unix = false;
        s->host_spec = g_strdup(host_spec);
    }

@@ -182,143 +106,6 @@ out:
    return err;
 }

-static void nbd_coroutine_start(BDRVNBDState *s, struct nbd_request *request)
-{
-    int i;
-
-    /* Poor man semaphore.  The free_sema is locked when no other request
-     * can be accepted, and unlocked after receiving one reply.  */
-    if (s->in_flight >= MAX_NBD_REQUESTS - 1) {
-        qemu_co_mutex_lock(&s->free_sema);
-        assert(s->in_flight < MAX_NBD_REQUESTS);
-    }
-    s->in_flight++;
-
-    for (i = 0; i < MAX_NBD_REQUESTS; i++) {
-        if (s->recv_coroutine[i] == NULL) {
-            s->recv_coroutine[i] = qemu_coroutine_self();
-            break;
-        }
-    }
-
-    assert(i < MAX_NBD_REQUESTS);
-    request->handle = INDEX_TO_HANDLE(s, i);
-}
-
-static int nbd_have_request(void *opaque)
-{
-    BDRVNBDState *s = opaque;
-
-    return s->in_flight > 0;
-}
-
-static void nbd_reply_ready(void *opaque)
-{
-    BDRVNBDState *s = opaque;
-    uint64_t i;
-    int ret;
-
-    if (s->reply.handle == 0) {
-        /* No reply already in flight.  Fetch a header.  It is possible
-         * that another thread has done the same thing in parallel, so
-         * the socket is not readable anymore.
-         */
-        ret = nbd_receive_reply(s->sock, &s->reply);
-        if (ret == -EAGAIN) {
-            return;
-        }
-        if (ret < 0) {
-            s->reply.handle = 0;
-            goto fail;
-        }
-    }
-
-    /* There's no need for a mutex on the receive side, because the
-     * handler acts as a synchronization point and ensures that only
-     * one coroutine is called until the reply finishes.  */
-    i = HANDLE_TO_INDEX(s, s->reply.handle);
-    if (i >= MAX_NBD_REQUESTS) {
-        goto fail;
-    }
-
-    if (s->recv_coroutine[i]) {
-        qemu_coroutine_enter(s->recv_coroutine[i], NULL);
-        return;
-    }
-
-fail:
-    for (i = 0; i < MAX_NBD_REQUESTS; i++) {
-        if (s->recv_coroutine[i]) {
-            qemu_coroutine_enter(s->recv_coroutine[i], NULL);
-        }
-    }
-}
-
-static void nbd_restart_write(void *opaque)
-{
-    BDRVNBDState *s = opaque;
-    qemu_coroutine_enter(s->send_coroutine, NULL);
-}
-
-static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
-                               QEMUIOVector *qiov, int offset)
-{
-    int rc, ret;
-
-    qemu_co_mutex_lock(&s->send_mutex);
-    s->send_coroutine = qemu_coroutine_self();
-    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write,
-                            nbd_have_request, s);
-    rc = nbd_send_request(s->sock, request);
-    if (rc >= 0 && qiov) {
-        ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
-                            offset, request->len);
-        if (ret != request->len) {
-            rc = -EIO;
-        }
-    }
-    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
-                            nbd_have_request, s);
-    s->send_coroutine = NULL;
-    qemu_co_mutex_unlock(&s->send_mutex);
-    return rc;
-}
-
-static void nbd_co_receive_reply(BDRVNBDState *s, struct nbd_request *request,
-                                 struct nbd_reply *reply,
-                                 QEMUIOVector *qiov, int offset)
-{
-    int ret;
-
-    /* Wait until we're woken up by the read handler.  TODO: perhaps
-     * peek at the next reply and avoid yielding if it's ours?  */
-    qemu_coroutine_yield();
-    *reply = s->reply;
-    if (reply->handle != request->handle) {
-        reply->error = EIO;
-    } else {
-        if (qiov && reply->error == 0) {
-            ret = qemu_co_recvv(s->sock, qiov->iov, qiov->niov,
-                                offset, request->len);
-            if (ret != request->len) {
-                reply->error = EIO;
-            }
-        }
-
-        /* Tell the read handler to read another header.  */
-        s->reply.handle = 0;
-    }
-}
-
-static void nbd_coroutine_end(BDRVNBDState *s, struct nbd_request *request)
-{
-    int i = HANDLE_TO_INDEX(s, request->handle);
-    s->recv_coroutine[i] = NULL;
-    if (s->in_flight-- == MAX_NBD_REQUESTS) {
-        qemu_co_mutex_unlock(&s->free_sema);
-    }
-}
-
 static int nbd_establish_connection(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;
@@ -327,14 +114,14 @@ static int nbd_establish_connection(BlockDriverState *bs)
    off_t size;
    size_t blocksize;

-    if (s->is_unix) {
+    if (s->host_spec[0] == '/') {
        sock = unix_socket_outgoing(s->host_spec);
    } else {
        sock = tcp_socket_outgoing_spec(s->host_spec);
    }

    /* Failed to establish connection */
-    if (sock < 0) {
+    if (sock == -1) {
        logout("Failed to establish connection to NBD server\n");
        return -errno;
    }
@@ -342,17 +129,14 @@ static int nbd_establish_connection(BlockDriverState *bs)
    /* NBD handshake */
    ret = nbd_receive_negotiate(sock, s->export_name, &s->nbdflags, &size,
                                &blocksize);
-    if (ret < 0) {
+    if (ret == -1) {
        logout("Failed to negotiate with the NBD server\n");
        closesocket(sock);
-        return ret;
+        return -errno;
    }

-    /* Now that we're connected, set the socket to be non-blocking and
-     * kick the reply mechanism.  */
-    qemu_set_nonblock(sock);
-    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL,
-                            nbd_have_request, s);
+    /* Now that we're connected, set the socket to be non-blocking */
+    socket_set_nonblock(sock);

    s->sock = sock;
    s->size = size;
@@ -368,11 +152,11 @@ static void nbd_teardown_connection(BlockDriverState *bs)
    struct nbd_request request;

    request.type = NBD_CMD_DISC;
+    request.handle = (uint64_t)(intptr_t)bs;
    request.from = 0;
    request.len = 0;
    nbd_send_request(s->sock, &request);

-    qemu_aio_set_fd_handler(s->sock, NULL, NULL, NULL, NULL);
    closesocket(s->sock);
 }

@@ -381,11 +165,8 @@ static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
    BDRVNBDState *s = bs->opaque;
    int result;

-    qemu_co_mutex_init(&s->send_mutex);
-    qemu_co_mutex_init(&s->free_sema);
-
    /* Pop the config into our state object. Exit if invalid. */
-    result = nbd_config(s, filename);
+    result = nbd_config(s, filename, flags);
    if (result != 0) {
        return result;
    }
@@ -395,154 +176,90 @@ static int nbd_open(BlockDriverState *bs, const char* filename, int flags)
     */
    result = nbd_establish_connection(bs);

+    qemu_co_mutex_init(&s->lock);
    return result;
 }

-static int nbd_co_readv_1(BlockDriverState *bs, int64_t sector_num,
-                          int nb_sectors, QEMUIOVector *qiov,
-                          int offset)
+static int nbd_read(BlockDriverState *bs, int64_t sector_num,
+                    uint8_t *buf, int nb_sectors)
 {
    BDRVNBDState *s = bs->opaque;
    struct nbd_request request;
    struct nbd_reply reply;
-    ssize_t ret;

    request.type = NBD_CMD_READ;
-    request.from = sector_num * 512;
-    request.len = nb_sectors * 512;
-
-    nbd_coroutine_start(s, &request);
-    ret = nbd_co_send_request(s, &request, NULL, 0);
-    if (ret < 0) {
-        reply.error = -ret;
-    } else {
-        nbd_co_receive_reply(s, &request, &reply, qiov, offset);
-    }
-    nbd_coroutine_end(s, &request);
-    return -reply.error;
-
-}
-
-static int nbd_co_writev_1(BlockDriverState *bs, int64_t sector_num,
-                           int nb_sectors, QEMUIOVector *qiov,
-                           int offset)
-{
-    BDRVNBDState *s = bs->opaque;
-    struct nbd_request request;
-    struct nbd_reply reply;
-    ssize_t ret;
-
-    request.type = NBD_CMD_WRITE;
-    if (!bdrv_enable_write_cache(bs) && (s->nbdflags & NBD_FLAG_SEND_FUA)) {
-        request.type |= NBD_CMD_FLAG_FUA;
-    }
-
-    request.from = sector_num * 512;
-    request.len = nb_sectors * 512;
-
-    nbd_coroutine_start(s, &request);
-    ret = nbd_co_send_request(s, &request, qiov, offset);
-    if (ret < 0) {
-        reply.error = -ret;
-    } else {
-        nbd_co_receive_reply(s, &request, &reply, NULL, 0);
-    }
-    nbd_coroutine_end(s, &request);
-    return -reply.error;
-}
-
-/* qemu-nbd has a limit of slightly less than 1M per request.  Try to
- * remain aligned to 4K. */
-#define NBD_MAX_SECTORS 2040
-
-static int nbd_co_readv(BlockDriverState *bs, int64_t sector_num,
-                        int nb_sectors, QEMUIOVector *qiov)
-{
-    int offset = 0;
-    int ret;
-    while (nb_sectors > NBD_MAX_SECTORS) {
-        ret = nbd_co_readv_1(bs, sector_num, NBD_MAX_SECTORS, qiov, offset);
-        if (ret < 0) {
-            return ret;
-        }
-        offset += NBD_MAX_SECTORS * 512;
-        sector_num += NBD_MAX_SECTORS;
-        nb_sectors -= NBD_MAX_SECTORS;
-    }
-    return nbd_co_readv_1(bs, sector_num, nb_sectors, qiov, offset);
-}
-
-static int nbd_co_writev(BlockDriverState *bs, int64_t sector_num,
-                         int nb_sectors, QEMUIOVector *qiov)
-{
-    int offset = 0;
-    int ret;
-    while (nb_sectors > NBD_MAX_SECTORS) {
-        ret = nbd_co_writev_1(bs, sector_num, NBD_MAX_SECTORS, qiov, offset);
-        if (ret < 0) {
-            return ret;
-        }
-        offset += NBD_MAX_SECTORS * 512;
-        sector_num += NBD_MAX_SECTORS;
-        nb_sectors -= NBD_MAX_SECTORS;
-    }
-    return nbd_co_writev_1(bs, sector_num, nb_sectors, qiov, offset);
-}
-
-static int nbd_co_flush(BlockDriverState *bs)
-{
-    BDRVNBDState *s = bs->opaque;
-    struct nbd_request request;
-    struct nbd_reply reply;
-    ssize_t ret;
-
-    if (!(s->nbdflags & NBD_FLAG_SEND_FLUSH)) {
-        return 0;
-    }
-
-    request.type = NBD_CMD_FLUSH;
-    if (s->nbdflags & NBD_FLAG_SEND_FUA) {
-        request.type |= NBD_CMD_FLAG_FUA;
-    }
-
-    request.from = 0;
-    request.len = 0;
-
-    nbd_coroutine_start(s, &request);
-    ret = nbd_co_send_request(s, &request, NULL, 0);
-    if (ret < 0) {
-        reply.error = -ret;
-    } else {
-        nbd_co_receive_reply(s, &request, &reply, NULL, 0);
-    }
-    nbd_coroutine_end(s, &request);
-    return -reply.error;
-}
-
-static int nbd_co_discard(BlockDriverState *bs, int64_t sector_num,
-                          int nb_sectors)
-{
-    BDRVNBDState *s = bs->opaque;
-    struct nbd_request request;
-    struct nbd_reply reply;
-    ssize_t ret;
-
-    if (!(s->nbdflags & NBD_FLAG_SEND_TRIM)) {
-        return 0;
-    }
-    request.type = NBD_CMD_TRIM;
+    request.handle = (uint64_t)(intptr_t)bs;
    request.from = sector_num * 512;;
    request.len = nb_sectors * 512;

-    nbd_coroutine_start(s, &request);
-    ret = nbd_co_send_request(s, &request, NULL, 0);
-    if (ret < 0) {
-        reply.error = -ret;
-    } else {
-        nbd_co_receive_reply(s, &request, &reply, NULL, 0);
-    }
-    nbd_coroutine_end(s, &request);
-    return -reply.error;
+    if (nbd_send_request(s->sock, &request) == -1)
+        return -errno;
+
+    if (nbd_receive_reply(s->sock, &reply) == -1)
+        return -errno;
+
+    if (reply.error !=0)
+        return -reply.error;
+
+    if (reply.handle != request.handle)
+        return -EIO;
+
+    if (nbd_wr_sync(s->sock, buf, request.len, 1) != request.len)
+        return -EIO;
+
+    return 0;
+}
+
+static int nbd_write(BlockDriverState *bs, int64_t sector_num,
+                     const uint8_t *buf, int nb_sectors)
+{
+    BDRVNBDState *s = bs->opaque;
+    struct nbd_request request;
+    struct nbd_reply reply;
+
+    request.type = NBD_CMD_WRITE;
+    request.handle = (uint64_t)(intptr_t)bs;
+    request.from = sector_num * 512;;
+    request.len = nb_sectors * 512;
+
+    if (nbd_send_request(s->sock, &request) == -1)
+        return -errno;
+
+    if (nbd_wr_sync(s->sock, (uint8_t*)buf, request.len, 0) != request.len)
+        return -EIO;
+
+    if (nbd_receive_reply(s->sock, &reply) == -1)
+        return -errno;
+
+    if (reply.error !=0)
+        return -reply.error;
+
+    if (reply.handle != request.handle)
+        return -EIO;
+
+    return 0;
+}
+
+static coroutine_fn int nbd_co_read(BlockDriverState *bs, int64_t sector_num,
+                                    uint8_t *buf, int nb_sectors)
+{
+    int ret;
+    BDRVNBDState *s = bs->opaque;
+    qemu_co_mutex_lock(&s->lock);
+    ret = nbd_read(bs, sector_num, buf, nb_sectors);
+    qemu_co_mutex_unlock(&s->lock);
+    return ret;
+}
+
+static coroutine_fn int nbd_co_write(BlockDriverState *bs, int64_t sector_num,
+                                     const uint8_t *buf, int nb_sectors)
+{
+    int ret;
+    BDRVNBDState *s = bs->opaque;
+    qemu_co_mutex_lock(&s->lock);
+    ret = nbd_write(bs, sector_num, buf, nb_sectors);
+    qemu_co_mutex_unlock(&s->lock);
+    return ret;
 }

 static void nbd_close(BlockDriverState *bs)
@@ -562,49 +279,19 @@ static int64_t nbd_getlength(BlockDriverState *bs)
 }

 static BlockDriver bdrv_nbd = {
-    .format_name         = "nbd",
-    .protocol_name       = "nbd",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
-};
-
-static BlockDriver bdrv_nbd_tcp = {
-    .format_name         = "nbd",
-    .protocol_name       = "nbd+tcp",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
-};
-
-static BlockDriver bdrv_nbd_unix = {
-    .format_name         = "nbd",
-    .protocol_name       = "nbd+unix",
-    .instance_size       = sizeof(BDRVNBDState),
-    .bdrv_file_open      = nbd_open,
-    .bdrv_co_readv       = nbd_co_readv,
-    .bdrv_co_writev      = nbd_co_writev,
-    .bdrv_close          = nbd_close,
-    .bdrv_co_flush_to_os = nbd_co_flush,
-    .bdrv_co_discard     = nbd_co_discard,
-    .bdrv_getlength      = nbd_getlength,
+    .format_name	= "nbd",
+    .instance_size	= sizeof(BDRVNBDState),
+    .bdrv_file_open	= nbd_open,
+    .bdrv_read          = nbd_co_read,
+    .bdrv_write         = nbd_co_write,
+    .bdrv_close		= nbd_close,
+    .bdrv_getlength	= nbd_getlength,
+    .protocol_name	= "nbd",
 };

 static void bdrv_nbd_init(void)
 {
    bdrv_register(&bdrv_nbd);
-    bdrv_register(&bdrv_nbd_tcp);
-    bdrv_register(&bdrv_nbd_unix);
 }

 block_init(bdrv_nbd_init);
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -24,8 +24,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -73,18 +73,14 @@ static int parallels_open(BlockDriverState *bs, int flags)
    BDRVParallelsState *s = bs->opaque;
    int i;
    struct parallels_header ph;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, &ph, sizeof(ph)) != sizeof(ph))
        goto fail;
-    }

    if (memcmp(ph.magic, HEADER_MAGIC, 16) ||
-        (le32_to_cpu(ph.version) != HEADER_VERSION)) {
-        ret = -EMEDIUMTYPE;
+	(le32_to_cpu(ph.version) != HEADER_VERSION)) {
        goto fail;
    }

@@ -94,21 +90,18 @@ static int parallels_open(BlockDriverState *bs, int flags)

    s->catalog_size = le32_to_cpu(ph.catalog_entries);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
+	s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+    if (s->catalog_bitmap)
+	g_free(s->catalog_bitmap);
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -22,11 +22,11 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>
-#include "block/aes.h"
-#include "migration/migration.h"
+#include "aes.h"
+#include "migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -95,13 +95,11 @@ static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
 static int qcow_open(BlockDriverState *bs, int flags)
 {
    BDRVQcowState *s = bs->opaque;
-    int len, i, shift, ret;
+    int len, i, shift;
    QCowHeader header;

-    ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, &header, sizeof(header)) != sizeof(header))
        goto fail;
-    }
    be32_to_cpus(&header.magic);
    be32_to_cpus(&header.version);
    be64_to_cpus(&header.backing_file_offset);
@@ -111,31 +109,15 @@ static int qcow_open(BlockDriverState *bs, int flags)
    be32_to_cpus(&header.crypt_method);
    be64_to_cpus(&header.l1_table_offset);

-    if (header.magic != QCOW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+    if (header.magic != QCOW_MAGIC || header.version != QCOW_VERSION)
        goto fail;
-    }
-    if (header.version != QCOW_VERSION) {
-        char version[64];
-        snprintf(version, sizeof(version), "QCOW version %d", header.version);
-        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
-            bs->device_name, "qcow", version);
-        ret = -ENOTSUP;
+    if (header.size <= 1 || header.cluster_bits < 9)
        goto fail;
-    }
-
-    if (header.size <= 1 || header.cluster_bits < 9) {
-        ret = -EINVAL;
+    if (header.crypt_method > QCOW_CRYPT_AES)
        goto fail;
-    }
-    if (header.crypt_method > QCOW_CRYPT_AES) {
-        ret = -EINVAL;
-        goto fail;
-    }
    s->crypt_method_header = header.crypt_method;
-    if (s->crypt_method_header) {
+    if (s->crypt_method_header)
        bs->encrypted = 1;
-    }
    s->cluster_bits = header.cluster_bits;
    s->cluster_size = 1 << s->cluster_bits;
    s->cluster_sectors = 1 << (s->cluster_bits - 9);
@@ -150,33 +132,33 @@ static int qcow_open(BlockDriverState *bs, int flags)

    s->l1_table_offset = header.l1_table_offset;
    s->l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
-
-    ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
-               s->l1_size * sizeof(uint64_t));
-    if (ret < 0) {
+    if (!s->l1_table)
+        goto fail;
+    if (bdrv_pread(bs->file, s->l1_table_offset, s->l1_table, s->l1_size * sizeof(uint64_t)) !=
+        s->l1_size * sizeof(uint64_t))
        goto fail;
-    }
-
    for(i = 0;i < s->l1_size; i++) {
        be64_to_cpus(&s->l1_table[i]);
    }
    /* alloc L2 cache */
    s->l2_cache = g_malloc(s->l2_size * L2_CACHE_SIZE * sizeof(uint64_t));
+    if (!s->l2_cache)
+        goto fail;
    s->cluster_cache = g_malloc(s->cluster_size);
+    if (!s->cluster_cache)
+        goto fail;
    s->cluster_data = g_malloc(s->cluster_size);
+    if (!s->cluster_data)
+        goto fail;
    s->cluster_cache_offset = -1;

    /* read the backing file name */
    if (header.backing_file_offset != 0) {
        len = header.backing_file_size;
-        if (len > 1023) {
+        if (len > 1023)
            len = 1023;
-        }
-        ret = bdrv_pread(bs->file, header.backing_file_offset,
-                   bs->backing_file, len);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, header.backing_file_offset, bs->backing_file, len) != len)
            goto fail;
-        }
        bs->backing_file[len] = '\0';
    }

@@ -194,16 +176,7 @@ static int qcow_open(BlockDriverState *bs, int flags)
    g_free(s->l2_cache);
    g_free(s->cluster_cache);
    g_free(s->cluster_data);
-    return ret;
-}
-
-
-/* We have nothing to do for QCOW reopen, stubs just return
- * success */
-static int qcow_reopen_prepare(BDRVReopenState *state,
-                               BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
+    return -1;
 }

 static int qcow_set_key(BlockDriverState *bs, const char *key)
@@ -395,16 +368,14 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
    return cluster_offset;
 }

-static int coroutine_fn qcow_co_is_allocated(BlockDriverState *bs,
-        int64_t sector_num, int nb_sectors, int *pnum)
+static int qcow_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                             int nb_sectors, int *pnum)
 {
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster, n;
    uint64_t cluster_offset;

-    qemu_co_mutex_lock(&s->lock);
    cluster_offset = get_cluster_offset(bs, sector_num << 9, 0, 0, 0, 0);
-    qemu_co_mutex_unlock(&s->lock);
    index_in_cluster = sector_num & (s->cluster_sectors - 1);
    n = s->cluster_sectors - index_in_cluster;
    if (n > nb_sectors)
@@ -462,7 +433,7 @@ static int decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
    return 0;
 }

-static coroutine_fn int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
+static int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
                         int nb_sectors, QEMUIOVector *qiov)
 {
    BDRVQcowState *s = bs->opaque;
@@ -549,7 +520,7 @@ done:
    qemu_co_mutex_unlock(&s->lock);

    if (qiov->niov > 1) {
-        qemu_iovec_from_buf(qiov, 0, orig_buf, qiov->size);
+        qemu_iovec_from_buffer(qiov, orig_buf, qiov->size);
        qemu_vfree(orig_buf);
    }

@@ -560,7 +531,7 @@ fail:
    goto done;
 }

-static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
+static int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
                          int nb_sectors, QEMUIOVector *qiov)
 {
    BDRVQcowState *s = bs->opaque;
@@ -578,7 +549,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,

    if (qiov->niov > 1) {
        buf = orig_buf = qemu_blockalign(bs, qiov->size);
-        qemu_iovec_to_buf(qiov, 0, buf, qiov->size);
+        qemu_iovec_to_buffer(qiov, buf);
    } else {
        orig_buf = NULL;
        buf = (uint8_t *)qiov->iov->iov_base;
@@ -653,14 +624,13 @@ static void qcow_close(BlockDriverState *bs)

 static int qcow_create(const char *filename, QEMUOptionParameter *options)
 {
-    int header_size, backing_filename_len, l1_size, shift, i;
+    int fd, header_size, backing_filename_len, l1_size, i, shift;
    QCowHeader header;
-    uint8_t *tmp;
+    uint64_t tmp;
    int64_t total_size = 0;
    const char *backing_file = NULL;
    int flags = 0;
    int ret;
-    BlockDriverState *qcow_bs;

    /* Read out options */
    while (options && options->name) {
@@ -674,21 +644,9 @@ static int qcow_create(const char *filename, QEMUOptionParameter *options)
        options++;
    }

-    ret = bdrv_create_file(filename, options);
-    if (ret < 0) {
-        return ret;
-    }
-
-    ret = bdrv_file_open(&qcow_bs, filename, BDRV_O_RDWR);
-    if (ret < 0) {
-        return ret;
-    }
-
-    ret = bdrv_truncate(qcow_bs, 0);
-    if (ret < 0) {
-        goto exit;
-    }
-
+    fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, 0644);
+    if (fd < 0)
+        return -errno;
    memset(&header, 0, sizeof(header));
    header.magic = cpu_to_be32(QCOW_MAGIC);
    header.version = cpu_to_be32(QCOW_VERSION);
@@ -724,34 +682,33 @@ static int qcow_create(const char *filename, QEMUOptionParameter *options)
    }

    /* write all the data */
-    ret = bdrv_pwrite(qcow_bs, 0, &header, sizeof(header));
+    ret = qemu_write_full(fd, &header, sizeof(header));
    if (ret != sizeof(header)) {
+        ret = -errno;
        goto exit;
    }

    if (backing_file) {
-        ret = bdrv_pwrite(qcow_bs, sizeof(header),
-            backing_file, backing_filename_len);
+        ret = qemu_write_full(fd, backing_file, backing_filename_len);
        if (ret != backing_filename_len) {
+            ret = -errno;
+            goto exit;
+        }
+
+    }
+    lseek(fd, header_size, SEEK_SET);
+    tmp = 0;
+    for(i = 0;i < l1_size; i++) {
+        ret = qemu_write_full(fd, &tmp, sizeof(tmp));
+        if (ret != sizeof(tmp)) {
+            ret = -errno;
            goto exit;
        }
    }

-    tmp = g_malloc0(BDRV_SECTOR_SIZE);
-    for (i = 0; i < ((sizeof(uint64_t)*l1_size + BDRV_SECTOR_SIZE - 1)/
-        BDRV_SECTOR_SIZE); i++) {
-        ret = bdrv_pwrite(qcow_bs, header_size +
-            BDRV_SECTOR_SIZE*i, tmp, BDRV_SECTOR_SIZE);
-        if (ret != BDRV_SECTOR_SIZE) {
-            g_free(tmp);
-            goto exit;
-        }
-    }
-
-    g_free(tmp);
    ret = 0;
 exit:
-    bdrv_delete(qcow_bs);
+    close(fd);
    return ret;
 }

@@ -844,6 +801,11 @@ fail:
    return ret;
 }

+static coroutine_fn int qcow_co_flush(BlockDriverState *bs)
+{
+    return bdrv_co_flush(bs->file);
+}
+
 static int qcow_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
    BDRVQcowState *s = bs->opaque;
@@ -877,12 +839,12 @@ static BlockDriver bdrv_qcow = {
    .bdrv_probe		= qcow_probe,
    .bdrv_open		= qcow_open,
    .bdrv_close		= qcow_close,
-    .bdrv_reopen_prepare = qcow_reopen_prepare,
    .bdrv_create	= qcow_create,

    .bdrv_co_readv          = qcow_co_readv,
    .bdrv_co_writev         = qcow_co_writev,
-    .bdrv_co_is_allocated   = qcow_co_is_allocated,
+    .bdrv_co_flush_to_disk  = qcow_co_flush,
+    .bdrv_is_allocated      = qcow_is_allocated,

    .bdrv_set_key           = qcow_set_key,
    .bdrv_make_empty        = qcow_make_empty,
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -22,10 +22,9 @@
 * THE SOFTWARE.
 */

-#include "block/block_int.h"
+#include "block_int.h"
 #include "qemu-common.h"
 #include "qcow2.h"
-#include "trace.h"

 typedef struct Qcow2CachedTable {
    void*   table;
@@ -40,9 +39,11 @@ struct Qcow2Cache {
    struct Qcow2Cache*      depends;
    int                     size;
    bool                    depends_on_flush;
+    bool                    writethrough;
 };

-Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)
+Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
+    bool writethrough)
 {
    BDRVQcowState *s = bs->opaque;
    Qcow2Cache *c;
@@ -51,6 +52,7 @@ Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables)
    c = g_malloc0(sizeof(*c));
    c->size = num_tables;
    c->entries = g_malloc0(sizeof(*c->entries) * num_tables);
+    c->writethrough = writethrough;

    for (i = 0; i < c->size; i++) {
        c->entries[i].table = qemu_blockalign(bs, s->cluster_size);
@@ -98,9 +100,6 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)
        return 0;
    }

-    trace_qcow2_cache_entry_flush(qemu_coroutine_self(),
-                                  c == s->l2_table_cache, i);
-
    if (c->depends) {
        ret = qcow2_cache_flush_dependency(bs, c);
    } else if (c->depends_on_flush) {
@@ -133,13 +132,10 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)

 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c)
 {
-    BDRVQcowState *s = bs->opaque;
    int result = 0;
    int ret;
    int i;

-    trace_qcow2_cache_flush(qemu_coroutine_self(), c == s->l2_table_cache);
-
    for (i = 0; i < c->size; i++) {
        ret = qcow2_cache_entry_flush(bs, c, i);
        if (ret < 0 && result != -ENOSPC) {
@@ -222,9 +218,6 @@ static int qcow2_cache_do_get(BlockDriverState *bs, Qcow2Cache *c,
    int i;
    int ret;

-    trace_qcow2_cache_get(qemu_coroutine_self(), c == s->l2_table_cache,
-                          offset, read_from_disk);
-
    /* Check if the table is already cached */
    for (i = 0; i < c->size; i++) {
        if (c->entries[i].offset == offset) {
@@ -234,8 +227,6 @@ static int qcow2_cache_do_get(BlockDriverState *bs, Qcow2Cache *c,

    /* If not, write a table back and replace it */
    i = qcow2_cache_find_entry_to_replace(c);
-    trace_qcow2_cache_get_replace_entry(qemu_coroutine_self(),
-                                        c == s->l2_table_cache, i);
    if (i < 0) {
        return i;
    }
@@ -245,8 +236,6 @@ static int qcow2_cache_do_get(BlockDriverState *bs, Qcow2Cache *c,
        return ret;
    }

-    trace_qcow2_cache_get_read(qemu_coroutine_self(),
-                               c == s->l2_table_cache, i);
    c->entries[i].offset = 0;
    if (read_from_disk) {
        if (c == s->l2_table_cache) {
@@ -269,10 +258,6 @@ found:
    c->entries[i].cache_hits++;
    c->entries[i].ref++;
    *table = c->entries[i].table;
-
-    trace_qcow2_cache_get_done(qemu_coroutine_self(),
-                               c == s->l2_table_cache, i);
-
    return 0;
 }

@@ -304,7 +289,12 @@ found:
    *table = NULL;

    assert(c->entries[i].ref >= 0);
-    return 0;
+
+    if (c->writethrough) {
+        return qcow2_cache_entry_flush(bs, c, i);
+    } else {
+        return 0;
+    }
 }

 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table)
@@ -321,3 +311,16 @@ void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table)
 found:
    c->entries[i].dirty = true;
 }
+
+bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
+    bool enable)
+{
+    bool old = c->writethrough;
+
+    if (!old && enable) {
+        qcow2_cache_flush(bs, c);
+    }
+
+    c->writethrough = enable;
+    return old;
+}
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size);
@@ -167,7 +167,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    if (refcount_table_index < s->refcount_table_size) {

        uint64_t refcount_block_offset =
-            s->refcount_table[refcount_table_index] & REFT_OFFSET_MASK;
+            s->refcount_table[refcount_table_index];

        /* If it's already there, we're done */
        if (refcount_block_offset) {
@@ -201,10 +201,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    *refcount_block = NULL;

    /* We write to the refcount table, so we might depend on L2 tables */
-    ret = qcow2_cache_flush(bs, s->l2_table_cache);
-    if (ret < 0) {
-        return ret;
-    }
+    qcow2_cache_flush(bs, s->l2_table_cache);

    /* Allocate the refcount block itself and mark it as used */
    int64_t new_block = alloc_clusters_noref(bs, s->cluster_size);
@@ -240,10 +237,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
            goto fail_block;
        }

-        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
-        if (ret < 0) {
-            goto fail_block;
-        }
+        bdrv_flush(bs->file);

        /* Initialize the new refcount block only after updating its refcount,
         * update_refcount uses the refcount cache itself */
@@ -307,8 +301,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    uint64_t last_table_size;
    uint64_t blocks_clusters;
    do {
-        uint64_t table_clusters =
-            size_to_clusters(s, table_size * sizeof(uint64_t));
+        uint64_t table_clusters = size_to_clusters(s, table_size);
        blocks_clusters = 1 +
            ((table_clusters + refcount_block_clusters - 1)
            / refcount_block_clusters);
@@ -374,7 +367,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    }

    for(i = 0; i < table_size; i++) {
-        be64_to_cpus(&new_table[i]);
+        cpu_to_be64s(&new_table[i]);
    }

    /* Hook up the new refcount table in the qcow2 header */
@@ -407,7 +400,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
        return ret;
    }

-    return 0;
+    return new_block;

 fail_table:
    g_free(new_table);
@@ -589,40 +582,6 @@ int64_t qcow2_alloc_clusters(BlockDriverState *bs, int64_t size)
    return offset;
 }

-int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
-    int nb_clusters)
-{
-    BDRVQcowState *s = bs->opaque;
-    uint64_t cluster_index;
-    uint64_t old_free_cluster_index;
-    int i, refcount, ret;
-
-    /* Check how many clusters there are free */
-    cluster_index = offset >> s->cluster_bits;
-    for(i = 0; i < nb_clusters; i++) {
-        refcount = get_refcount(bs, cluster_index++);
-
-        if (refcount < 0) {
-            return refcount;
-        } else if (refcount != 0) {
-            break;
-        }
-    }
-
-    /* And then allocate them */
-    old_free_cluster_index = s->free_cluster_index;
-    s->free_cluster_index = cluster_index + i;
-
-    ret = update_refcount(bs, offset, i << s->cluster_bits, 1);
-    if (ret < 0) {
-        return ret;
-    }
-
-    s->free_cluster_index = old_free_cluster_index;
-
-    return i;
-}
-
 /* only used to allocate compressed sectors. We try to allocate
   contiguous sectors. size must be <= cluster_size */
 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
@@ -634,11 +593,10 @@ int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size)
    BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_BYTES);
    assert(size > 0 && size <= s->cluster_size);
    if (s->free_byte_offset == 0) {
-        offset = qcow2_alloc_clusters(bs, s->cluster_size);
-        if (offset < 0) {
-            return offset;
+        s->free_byte_offset = qcow2_alloc_clusters(bs, s->cluster_size);
+        if (s->free_byte_offset < 0) {
+            return s->free_byte_offset;
        }
-        s->free_byte_offset = offset;
    }
 redo:
    free_in_cluster = s->cluster_size -
@@ -687,35 +645,32 @@ void qcow2_free_clusters(BlockDriverState *bs,
 }

 /*
- * Free a cluster using its L2 entry (handles clusters of all types, e.g.
- * normal cluster, compressed cluster, etc.)
+ * free_any_clusters
+ *
+ * free clusters according to its type: compressed or not
+ *
 */
+
 void qcow2_free_any_clusters(BlockDriverState *bs,
-    uint64_t l2_entry, int nb_clusters)
+    uint64_t cluster_offset, int nb_clusters)
 {
    BDRVQcowState *s = bs->opaque;

-    switch (qcow2_get_cluster_type(l2_entry)) {
-    case QCOW2_CLUSTER_COMPRESSED:
-        {
-            int nb_csectors;
-            nb_csectors = ((l2_entry >> s->csize_shift) &
-                           s->csize_mask) + 1;
-            qcow2_free_clusters(bs,
-                (l2_entry & s->cluster_offset_mask) & ~511,
-                nb_csectors * 512);
-        }
-        break;
-    case QCOW2_CLUSTER_NORMAL:
-        qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
-                            nb_clusters << s->cluster_bits);
-        break;
-    case QCOW2_CLUSTER_UNALLOCATED:
-    case QCOW2_CLUSTER_ZERO:
-        break;
-    default:
-        abort();
+    /* free the cluster */
+
+    if (cluster_offset & QCOW_OFLAG_COMPRESSED) {
+        int nb_csectors;
+        nb_csectors = ((cluster_offset >> s->csize_shift) &
+                       s->csize_mask) + 1;
+        qcow2_free_clusters(bs,
+            (cluster_offset & s->cluster_offset_mask) & ~511,
+            nb_csectors * 512);
+        return;
    }
+
+    qcow2_free_clusters(bs, cluster_offset, nb_clusters << s->cluster_bits);
+
+    return;
 }


@@ -734,16 +689,23 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t old_offset, old_l2_offset;
    int i, j, l1_modified = 0, nb_csectors, refcount;
    int ret;
+    bool old_l2_writethrough, old_refcount_writethrough;
+
+    /* Switch caches to writeback mode during update */
+    old_l2_writethrough =
+        qcow2_cache_set_writethrough(bs, s->l2_table_cache, false);
+    old_refcount_writethrough =
+        qcow2_cache_set_writethrough(bs, s->refcount_block_cache, false);

    l2_table = NULL;
    l1_table = NULL;
    l1_size2 = l1_size * sizeof(uint64_t);
-
-    /* WARNING: qcow2_snapshot_goto relies on this function not using the
-     * l1_table_offset when it is the current s->l1_table_offset! Be careful
-     * when changing this! */
    if (l1_table_offset != s->l1_table_offset) {
-        l1_table = g_malloc0(align_offset(l1_size2, 512));
+        if (l1_size2 != 0) {
+            l1_table = g_malloc0(align_offset(l1_size2, 512));
+        } else {
+            l1_table = NULL;
+        }
        l1_allocated = 1;
        if (bdrv_pread(bs->file, l1_table_offset,
                       l1_table, l1_size2) != l1_size2)
@@ -764,7 +726,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
        l2_offset = l1_table[i];
        if (l2_offset) {
            old_l2_offset = l2_offset;
-            l2_offset &= L1E_OFFSET_MASK;
+            l2_offset &= ~QCOW_OFLAG_COPIED;

            ret = qcow2_cache_get(bs, s->l2_table_cache, l2_offset,
                (void**) &l2_table);
@@ -796,11 +758,10 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                        /* compressed clusters are never modified */
                        refcount = 2;
                    } else {
-                        uint64_t cluster_index = (offset & L2E_OFFSET_MASK) >> s->cluster_bits;
                        if (addend != 0) {
-                            refcount = update_cluster_refcount(bs, cluster_index, addend);
+                            refcount = update_cluster_refcount(bs, offset >> s->cluster_bits, addend);
                        } else {
-                            refcount = get_refcount(bs, cluster_index);
+                            refcount = get_refcount(bs, offset >> s->cluster_bits);
                        }

                        if (refcount < 0) {
@@ -853,8 +814,12 @@ fail:
        qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
    }

-    /* Update L1 only if it isn't deleted anyway (addend = -1) */
-    if (addend >= 0 && l1_modified) {
+    /* Enable writethrough cache mode again */
+    qcow2_cache_set_writethrough(bs, s->l2_table_cache, old_l2_writethrough);
+    qcow2_cache_set_writethrough(bs, s->refcount_block_cache,
+        old_refcount_writethrough);
+
+    if (l1_modified) {
        for(i = 0; i < l1_size; i++)
            cpu_to_be64s(&l1_table[i]);
        if (bdrv_pwrite_sync(bs->file, l1_table_offset, l1_table,
@@ -933,7 +898,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
    int check_copied)
 {
    BDRVQcowState *s = bs->opaque;
-    uint64_t *l2_table, l2_entry;
+    uint64_t *l2_table, offset;
    int i, l2_size, nb_csectors, refcount;

    /* Read L2 table from disk */
@@ -945,70 +910,54 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,

    /* Do the actual checks */
    for(i = 0; i < s->l2_size; i++) {
-        l2_entry = be64_to_cpu(l2_table[i]);
-
-        switch (qcow2_get_cluster_type(l2_entry)) {
-        case QCOW2_CLUSTER_COMPRESSED:
-            /* Compressed clusters don't have QCOW_OFLAG_COPIED */
-            if (l2_entry & QCOW_OFLAG_COPIED) {
-                fprintf(stderr, "ERROR: cluster %" PRId64 ": "
-                    "copied flag must never be set for compressed "
-                    "clusters\n", l2_entry >> s->cluster_bits);
-                l2_entry &= ~QCOW_OFLAG_COPIED;
-                res->corruptions++;
-            }
-
-            /* Mark cluster as used */
-            nb_csectors = ((l2_entry >> s->csize_shift) &
-                           s->csize_mask) + 1;
-            l2_entry &= s->cluster_offset_mask;
-            inc_refcounts(bs, res, refcount_table, refcount_table_size,
-                l2_entry & ~511, nb_csectors * 512);
-            break;
-
-        case QCOW2_CLUSTER_ZERO:
-            if ((l2_entry & L2E_OFFSET_MASK) == 0) {
-                break;
-            }
-            /* fall through */
-
-        case QCOW2_CLUSTER_NORMAL:
-        {
-            /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
-            uint64_t offset = l2_entry & L2E_OFFSET_MASK;
-
-            if (check_copied) {
-                refcount = get_refcount(bs, offset >> s->cluster_bits);
-                if (refcount < 0) {
-                    fprintf(stderr, "Can't get refcount for offset %"
-                        PRIx64 ": %s\n", l2_entry, strerror(-refcount));
-                    goto fail;
+        offset = be64_to_cpu(l2_table[i]);
+        if (offset != 0) {
+            if (offset & QCOW_OFLAG_COMPRESSED) {
+                /* Compressed clusters don't have QCOW_OFLAG_COPIED */
+                if (offset & QCOW_OFLAG_COPIED) {
+                    fprintf(stderr, "ERROR: cluster %" PRId64 ": "
+                        "copied flag must never be set for compressed "
+                        "clusters\n", offset >> s->cluster_bits);
+                    offset &= ~QCOW_OFLAG_COPIED;
+                    res->corruptions++;
                }
-                if ((refcount == 1) != ((l2_entry & QCOW_OFLAG_COPIED) != 0)) {
-                    fprintf(stderr, "ERROR OFLAG_COPIED: offset=%"
-                        PRIx64 " refcount=%d\n", l2_entry, refcount);
+
+                /* Mark cluster as used */
+                nb_csectors = ((offset >> s->csize_shift) &
+                               s->csize_mask) + 1;
+                offset &= s->cluster_offset_mask;
+                inc_refcounts(bs, res, refcount_table, refcount_table_size,
+                    offset & ~511, nb_csectors * 512);
+            } else {
+                /* QCOW_OFLAG_COPIED must be set iff refcount == 1 */
+                if (check_copied) {
+                    uint64_t entry = offset;
+                    offset &= ~QCOW_OFLAG_COPIED;
+                    refcount = get_refcount(bs, offset >> s->cluster_bits);
+                    if (refcount < 0) {
+                        fprintf(stderr, "Can't get refcount for offset %"
+                            PRIx64 ": %s\n", entry, strerror(-refcount));
+                        goto fail;
+                    }
+                    if ((refcount == 1) != ((entry & QCOW_OFLAG_COPIED) != 0)) {
+                        fprintf(stderr, "ERROR OFLAG_COPIED: offset=%"
+                            PRIx64 " refcount=%d\n", entry, refcount);
+                        res->corruptions++;
+                    }
+                }
+
+                /* Mark cluster as used */
+                offset &= ~QCOW_OFLAG_COPIED;
+                inc_refcounts(bs, res, refcount_table,refcount_table_size,
+                    offset, s->cluster_size);
+
+                /* Correct offsets are cluster aligned */
+                if (offset & (s->cluster_size - 1)) {
+                    fprintf(stderr, "ERROR offset=%" PRIx64 ": Cluster is not "
+                        "properly aligned; L2 entry corrupted.\n", offset);
                    res->corruptions++;
                }
            }
-
-            /* Mark cluster as used */
-            inc_refcounts(bs, res, refcount_table,refcount_table_size,
-                offset, s->cluster_size);
-
-            /* Correct offsets are cluster aligned */
-            if (offset & (s->cluster_size - 1)) {
-                fprintf(stderr, "ERROR offset=%" PRIx64 ": Cluster is not "
-                    "properly aligned; L2 entry corrupted.\n", offset);
-                res->corruptions++;
-            }
-            break;
-        }
-
-        case QCOW2_CLUSTER_UNALLOCATED:
-            break;
-
-        default:
-            abort();
        }
    }

@@ -1079,7 +1028,7 @@ static int check_refcounts_l1(BlockDriverState *bs,
            }

            /* Mark L2 table as used */
-            l2_offset &= L1E_OFFSET_MASK;
+            l2_offset &= ~QCOW_OFLAG_COPIED;
            inc_refcounts(bs, res, refcount_table, refcount_table_size,
                l2_offset, s->cluster_size);

@@ -1114,12 +1063,11 @@ fail:
 * Returns 0 if no errors are found, the number of errors in case the image is
 * detected as corrupted, and -errno when an internal error occurred.
 */
-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix)
+int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res)
 {
    BDRVQcowState *s = bs->opaque;
-    int64_t size, i;
-    int nb_clusters, refcount1, refcount2;
+    int64_t size;
+    int nb_clusters, refcount1, refcount2, i;
    QCowSnapshot *sn;
    uint16_t *refcount_table;
    int ret;
@@ -1163,15 +1111,14 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,

        /* Refcount blocks are cluster aligned */
        if (offset & (s->cluster_size - 1)) {
-            fprintf(stderr, "ERROR refcount block %" PRId64 " is not "
+            fprintf(stderr, "ERROR refcount block %d is not "
                "cluster aligned; refcount table entry corrupted\n", i);
            res->corruptions++;
            continue;
        }

        if (cluster >= nb_clusters) {
-            fprintf(stderr, "ERROR refcount block %" PRId64
-                    " is outside image\n", i);
+            fprintf(stderr, "ERROR refcount block %d is outside image\n", i);
            res->corruptions++;
            continue;
        }
@@ -1180,8 +1127,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
            inc_refcounts(bs, res, refcount_table, nb_clusters,
                offset, s->cluster_size);
            if (refcount_table[cluster] != 1) {
-                fprintf(stderr, "ERROR refcount block %" PRId64
-                    " refcount=%d\n",
+                fprintf(stderr, "ERROR refcount block %d refcount=%d\n",
                    i, refcount_table[cluster]);
                res->corruptions++;
            }
@@ -1192,7 +1138,7 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    for(i = 0; i < nb_clusters; i++) {
        refcount1 = get_refcount(bs, i);
        if (refcount1 < 0) {
-            fprintf(stderr, "Can't get refcount for cluster %" PRId64 ": %s\n",
+            fprintf(stderr, "Can't get refcount for cluster %d: %s\n",
                i, strerror(-refcount1));
            res->check_errors++;
            continue;
@@ -1200,31 +1146,9 @@ int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,

        refcount2 = refcount_table[i];
        if (refcount1 != refcount2) {
-
-            /* Check if we're allowed to fix the mismatch */
-            int *num_fixed = NULL;
-            if (refcount1 > refcount2 && (fix & BDRV_FIX_LEAKS)) {
-                num_fixed = &res->leaks_fixed;
-            } else if (refcount1 < refcount2 && (fix & BDRV_FIX_ERRORS)) {
-                num_fixed = &res->corruptions_fixed;
-            }
-
-            fprintf(stderr, "%s cluster %" PRId64 " refcount=%d reference=%d\n",
-                   num_fixed != NULL     ? "Repairing" :
-                   refcount1 < refcount2 ? "ERROR" :
-                                           "Leaked",
+            fprintf(stderr, "%s cluster %d refcount=%d reference=%d\n",
+                   refcount1 < refcount2 ? "ERROR" : "Leaked",
                   i, refcount1, refcount2);
-
-            if (num_fixed) {
-                ret = update_refcount(bs, i << s->cluster_bits, 1,
-                                      refcount2 - refcount1);
-                if (ret >= 0) {
-                    (*num_fixed)++;
-                    continue;
-                }
-            }
-
-            /* And if we couldn't, print an error */
            if (refcount1 < refcount2) {
                res->corruptions++;
            } else {
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 typedef struct QEMU_PACKED QCowSnapshotHeader {
@@ -46,11 +46,6 @@ typedef struct QEMU_PACKED QCowSnapshotHeader {
    /* name follows  */
 } QCowSnapshotHeader;

-typedef struct QEMU_PACKED QCowSnapshotExtraData {
-    uint64_t vm_state_size_large;
-    uint64_t disk_size;
-} QCowSnapshotExtraData;
-
 void qcow2_free_snapshots(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
@@ -69,12 +64,10 @@ int qcow2_read_snapshots(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
    QCowSnapshotHeader h;
-    QCowSnapshotExtraData extra;
    QCowSnapshot *sn;
    int i, id_str_size, name_size;
    int64_t offset;
    uint32_t extra_data_size;
-    int ret;

    if (!s->nb_snapshots) {
        s->snapshots = NULL;
@@ -84,15 +77,10 @@ int qcow2_read_snapshots(BlockDriverState *bs)

    offset = s->snapshots_offset;
    s->snapshots = g_malloc0(s->nb_snapshots * sizeof(QCowSnapshot));
-
    for(i = 0; i < s->nb_snapshots; i++) {
-        /* Read statically sized part of the snapshot header */
        offset = align_offset(offset, 8);
-        ret = bdrv_pread(bs->file, offset, &h, sizeof(h));
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, offset, &h, sizeof(h)) != sizeof(h))
            goto fail;
-        }
-
        offset += sizeof(h);
        sn = s->snapshots + i;
        sn->l1_table_offset = be64_to_cpu(h.l1_table_offset);
@@ -106,49 +94,25 @@ int qcow2_read_snapshots(BlockDriverState *bs)
        id_str_size = be16_to_cpu(h.id_str_size);
        name_size = be16_to_cpu(h.name_size);

-        /* Read extra data */
-        ret = bdrv_pread(bs->file, offset, &extra,
-                         MIN(sizeof(extra), extra_data_size));
-        if (ret < 0) {
-            goto fail;
-        }
        offset += extra_data_size;

-        if (extra_data_size >= 8) {
-            sn->vm_state_size = be64_to_cpu(extra.vm_state_size_large);
-        }
-
-        if (extra_data_size >= 16) {
-            sn->disk_size = be64_to_cpu(extra.disk_size);
-        } else {
-            sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
-        }
-
-        /* Read snapshot ID */
        sn->id_str = g_malloc(id_str_size + 1);
-        ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, offset, sn->id_str, id_str_size) != id_str_size)
            goto fail;
-        }
        offset += id_str_size;
        sn->id_str[id_str_size] = '\0';

-        /* Read snapshot name */
        sn->name = g_malloc(name_size + 1);
-        ret = bdrv_pread(bs->file, offset, sn->name, name_size);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, offset, sn->name, name_size) != name_size)
            goto fail;
-        }
        offset += name_size;
        sn->name[name_size] = '\0';
    }
-
    s->snapshots_size = offset - s->snapshots_offset;
    return 0;
-
-fail:
+ fail:
    qcow2_free_snapshots(bs);
-    return ret;
+    return -1;
 }

 /* add at the end of the file a new list of snapshots */
@@ -157,14 +121,10 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
    QCowSnapshotHeader h;
-    QCowSnapshotExtraData extra;
    int i, name_size, id_str_size, snapshots_size;
-    struct {
-        uint32_t nb_snapshots;
-        uint64_t snapshots_offset;
-    } QEMU_PACKED header_data;
+    uint64_t data64;
+    uint32_t data32;
    int64_t offset, snapshots_offset;
-    int ret;

    /* compute the size of the snapshots */
    offset = 0;
@@ -172,103 +132,61 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
        sn = s->snapshots + i;
        offset = align_offset(offset, 8);
        offset += sizeof(h);
-        offset += sizeof(extra);
        offset += strlen(sn->id_str);
        offset += strlen(sn->name);
    }
    snapshots_size = offset;

-    /* Allocate space for the new snapshot list */
    snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
+    bdrv_flush(bs->file);
    offset = snapshots_offset;
    if (offset < 0) {
        return offset;
    }
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        return ret;
-    }

-    /* Write all snapshots to the new list */
    for(i = 0; i < s->nb_snapshots; i++) {
        sn = s->snapshots + i;
        memset(&h, 0, sizeof(h));
        h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
        h.l1_size = cpu_to_be32(sn->l1_size);
-        /* If it doesn't fit in 32 bit, older implementations should treat it
-         * as a disk-only snapshot rather than truncate the VM state */
-        if (sn->vm_state_size <= 0xffffffff) {
-            h.vm_state_size = cpu_to_be32(sn->vm_state_size);
-        }
+        h.vm_state_size = cpu_to_be32(sn->vm_state_size);
        h.date_sec = cpu_to_be32(sn->date_sec);
        h.date_nsec = cpu_to_be32(sn->date_nsec);
        h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
-        h.extra_data_size = cpu_to_be32(sizeof(extra));
-
-        memset(&extra, 0, sizeof(extra));
-        extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size);
-        extra.disk_size = cpu_to_be64(sn->disk_size);

        id_str_size = strlen(sn->id_str);
        name_size = strlen(sn->name);
        h.id_str_size = cpu_to_be16(id_str_size);
        h.name_size = cpu_to_be16(name_size);
        offset = align_offset(offset, 8);
-
-        ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h));
-        if (ret < 0) {
+        if (bdrv_pwrite_sync(bs->file, offset, &h, sizeof(h)) < 0)
            goto fail;
-        }
        offset += sizeof(h);
-
-        ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
-        if (ret < 0) {
+        if (bdrv_pwrite_sync(bs->file, offset, sn->id_str, id_str_size) < 0)
            goto fail;
-        }
-        offset += sizeof(extra);
-
-        ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
-        if (ret < 0) {
-            goto fail;
-        }
        offset += id_str_size;
-
-        ret = bdrv_pwrite(bs->file, offset, sn->name, name_size);
-        if (ret < 0) {
+        if (bdrv_pwrite_sync(bs->file, offset, sn->name, name_size) < 0)
            goto fail;
-        }
        offset += name_size;
    }

-    /*
-     * Update the header to point to the new snapshot table. This requires the
-     * new table and its refcounts to be stable on disk.
-     */
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
+    /* update the various header fields */
+    data64 = cpu_to_be64(snapshots_offset);
+    if (bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, snapshots_offset),
+                    &data64, sizeof(data64)) < 0)
        goto fail;
-    }
-
-    QEMU_BUILD_BUG_ON(offsetof(QCowHeader, snapshots_offset) !=
-        offsetof(QCowHeader, nb_snapshots) + sizeof(header_data.nb_snapshots));
-
-    header_data.nb_snapshots        = cpu_to_be32(s->nb_snapshots);
-    header_data.snapshots_offset    = cpu_to_be64(snapshots_offset);
-
-    ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
-                           &header_data, sizeof(header_data));
-    if (ret < 0) {
+    data32 = cpu_to_be32(s->nb_snapshots);
+    if (bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots),
+                    &data32, sizeof(data32)) < 0)
        goto fail;
-    }

    /* free the old snapshot table */
    qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size);
    s->snapshots_offset = snapshots_offset;
    s->snapshots_size = snapshots_size;
    return 0;
-
-fail:
-    return ret;
+ fail:
+    return -1;
 }

 static void find_new_snapshot_id(BlockDriverState *bs,
@@ -318,107 +236,83 @@ static int find_snapshot_by_id_or_name(BlockDriverState *bs, const char *name)
 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 {
    BDRVQcowState *s = bs->opaque;
-    QCowSnapshot *new_snapshot_list = NULL;
-    QCowSnapshot *old_snapshot_list = NULL;
-    QCowSnapshot sn1, *sn = &sn1;
+    QCowSnapshot *snapshots1, sn1, *sn = &sn1;
    int i, ret;
    uint64_t *l1_table = NULL;
    int64_t l1_table_offset;

    memset(sn, 0, sizeof(*sn));

-    /* Generate an ID if it wasn't passed */
    if (sn_info->id_str[0] == '\0') {
+        /* compute a new id */
        find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));
    }

-    /* Check that the ID is unique */
-    if (find_snapshot_by_id(bs, sn_info->id_str) >= 0) {
-        return -EEXIST;
-    }
+    /* check that the ID is unique */
+    if (find_snapshot_by_id(bs, sn_info->id_str) >= 0)
+        return -ENOENT;

-    /* Populate sn with passed data */
    sn->id_str = g_strdup(sn_info->id_str);
+    if (!sn->id_str)
+        goto fail;
    sn->name = g_strdup(sn_info->name);
-
-    sn->disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
+    if (!sn->name)
+        goto fail;
    sn->vm_state_size = sn_info->vm_state_size;
    sn->date_sec = sn_info->date_sec;
    sn->date_nsec = sn_info->date_nsec;
    sn->vm_clock_nsec = sn_info->vm_clock_nsec;

-    /* Allocate the L1 table of the snapshot and copy the current one there. */
+    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
+    if (ret < 0)
+        goto fail;
+
+    /* create the L1 table of the snapshot */
    l1_table_offset = qcow2_alloc_clusters(bs, s->l1_size * sizeof(uint64_t));
    if (l1_table_offset < 0) {
-        ret = l1_table_offset;
        goto fail;
    }
+    bdrv_flush(bs->file);

    sn->l1_table_offset = l1_table_offset;
    sn->l1_size = s->l1_size;

-    l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    if (s->l1_size != 0) {
+        l1_table = g_malloc(s->l1_size * sizeof(uint64_t));
+    } else {
+        l1_table = NULL;
+    }
+
    for(i = 0; i < s->l1_size; i++) {
        l1_table[i] = cpu_to_be64(s->l1_table[i]);
    }
-
-    ret = bdrv_pwrite(bs->file, sn->l1_table_offset, l1_table,
-                      s->l1_size * sizeof(uint64_t));
-    if (ret < 0) {
+    if (bdrv_pwrite_sync(bs->file, sn->l1_table_offset,
+                    l1_table, s->l1_size * sizeof(uint64_t)) < 0)
        goto fail;
-    }
-
    g_free(l1_table);
    l1_table = NULL;

-    /*
-     * Increase the refcounts of all clusters and make sure everything is
-     * stable on disk before updating the snapshot table to contain a pointer
-     * to the new L1 table.
-     */
-    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    /* Append the new snapshot to the snapshot list */
-    new_snapshot_list = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
+    snapshots1 = g_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot));
    if (s->snapshots) {
-        memcpy(new_snapshot_list, s->snapshots,
-               s->nb_snapshots * sizeof(QCowSnapshot));
-        old_snapshot_list = s->snapshots;
+        memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot));
+        g_free(s->snapshots);
    }
-    s->snapshots = new_snapshot_list;
+    s->snapshots = snapshots1;
    s->snapshots[s->nb_snapshots++] = *sn;

-    ret = qcow2_write_snapshots(bs);
-    if (ret < 0) {
-        g_free(s->snapshots);
-        s->snapshots = old_snapshot_list;
+    if (qcow2_write_snapshots(bs) < 0)
        goto fail;
-    }
-
-    g_free(old_snapshot_list);
-
 #ifdef DEBUG_ALLOC
    {
      BdrvCheckResult result = {0};
-      qcow2_check_refcounts(bs, &result, 0);
+      qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
-
-fail:
-    g_free(sn->id_str);
+ fail:
    g_free(sn->name);
    g_free(l1_table);
-
-    return ret;
+    return -1;
 }

 /* copy the snapshot 'snapshot_name' into the current disk image */
@@ -428,164 +322,83 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    QCowSnapshot *sn;
    int i, snapshot_index;
    int cur_l1_bytes, sn_l1_bytes;
-    int ret;
-    uint64_t *sn_l1_table = NULL;

-    /* Search the snapshot */
    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
-    if (snapshot_index < 0) {
+    if (snapshot_index < 0)
        return -ENOENT;
-    }
    sn = &s->snapshots[snapshot_index];

-    if (sn->disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
-        error_report("qcow2: Loading snapshots with different disk "
-            "size is not implemented");
-        ret = -ENOTSUP;
+    if (qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, -1) < 0)
        goto fail;
-    }

-    /*
-     * Make sure that the current L1 table is big enough to contain the whole
-     * L1 table of the snapshot. If the snapshot L1 table is smaller, the
-     * current one must be padded with zeros.
-     */
-    ret = qcow2_grow_l1_table(bs, sn->l1_size, true);
-    if (ret < 0) {
+    if (qcow2_grow_l1_table(bs, sn->l1_size, true) < 0)
        goto fail;
-    }

    cur_l1_bytes = s->l1_size * sizeof(uint64_t);
    sn_l1_bytes = sn->l1_size * sizeof(uint64_t);

-    /*
-     * Copy the snapshot L1 table to the current L1 table.
-     *
-     * Before overwriting the old current L1 table on disk, make sure to
-     * increase all refcounts for the clusters referenced by the new one.
-     * Decrease the refcount referenced by the old one only when the L1
-     * table is overwritten.
-     */
-    sn_l1_table = g_malloc0(cur_l1_bytes);
-
-    ret = bdrv_pread(bs->file, sn->l1_table_offset, sn_l1_table, sn_l1_bytes);
-    if (ret < 0) {
-        goto fail;
+    if (cur_l1_bytes > sn_l1_bytes) {
+        memset(s->l1_table + sn->l1_size, 0, cur_l1_bytes - sn_l1_bytes);
    }

-    ret = qcow2_update_snapshot_refcount(bs, sn->l1_table_offset,
-                                         sn->l1_size, 1);
-    if (ret < 0) {
+    /* copy the snapshot l1 table to the current l1 table */
+    if (bdrv_pread(bs->file, sn->l1_table_offset,
+                   s->l1_table, sn_l1_bytes) < 0)
        goto fail;
-    }
-
-    ret = bdrv_pwrite_sync(bs->file, s->l1_table_offset, sn_l1_table,
-                           cur_l1_bytes);
-    if (ret < 0) {
+    if (bdrv_pwrite_sync(bs->file, s->l1_table_offset,
+                    s->l1_table, cur_l1_bytes) < 0)
        goto fail;
-    }
-
-    /*
-     * Decrease refcount of clusters of current L1 table.
-     *
-     * At this point, the in-memory s->l1_table points to the old L1 table,
-     * whereas on disk we already have the new one.
-     *
-     * qcow2_update_snapshot_refcount special cases the current L1 table to use
-     * the in-memory data instead of really using the offset to load a new one,
-     * which is why this works.
-     */
-    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset,
-                                         s->l1_size, -1);
-
-    /*
-     * Now update the in-memory L1 table to be in sync with the on-disk one. We
-     * need to do this even if updating refcounts failed.
-     */
    for(i = 0;i < s->l1_size; i++) {
-        s->l1_table[i] = be64_to_cpu(sn_l1_table[i]);
+        be64_to_cpus(&s->l1_table[i]);
    }

-    if (ret < 0) {
+    if (qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1) < 0)
        goto fail;
-    }
-
-    g_free(sn_l1_table);
-    sn_l1_table = NULL;
-
-    /*
-     * Update QCOW_OFLAG_COPIED in the active L1 table (it may have changed
-     * when we decreased the refcount of the old snapshot.
-     */
-    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
-    if (ret < 0) {
-        goto fail;
-    }

 #ifdef DEBUG_ALLOC
    {
        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result, 0);
+        qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
-
-fail:
-    g_free(sn_l1_table);
-    return ret;
+ fail:
+    return -EIO;
 }

 int qcow2_snapshot_delete(BlockDriverState *bs, const char *snapshot_id)
 {
    BDRVQcowState *s = bs->opaque;
-    QCowSnapshot sn;
+    QCowSnapshot *sn;
    int snapshot_index, ret;

-    /* Search the snapshot */
    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
-    if (snapshot_index < 0) {
+    if (snapshot_index < 0)
        return -ENOENT;
-    }
-    sn = s->snapshots[snapshot_index];
+    sn = &s->snapshots[snapshot_index];

-    /* Remove it from the snapshot list */
-    memmove(s->snapshots + snapshot_index,
-            s->snapshots + snapshot_index + 1,
-            (s->nb_snapshots - snapshot_index - 1) * sizeof(sn));
+    ret = qcow2_update_snapshot_refcount(bs, sn->l1_table_offset, sn->l1_size, -1);
+    if (ret < 0)
+        return ret;
+    /* must update the copied flag on the current cluster offsets */
+    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
+    if (ret < 0)
+        return ret;
+    qcow2_free_clusters(bs, sn->l1_table_offset, sn->l1_size * sizeof(uint64_t));
+
+    g_free(sn->id_str);
+    g_free(sn->name);
+    memmove(sn, sn + 1, (s->nb_snapshots - snapshot_index - 1) * sizeof(*sn));
    s->nb_snapshots--;
    ret = qcow2_write_snapshots(bs);
    if (ret < 0) {
+        /* XXX: restore snapshot if error ? */
        return ret;
    }
-
-    /*
-     * The snapshot is now unused, clean up. If we fail after this point, we
-     * won't recover but just leak clusters.
-     */
-    g_free(sn.id_str);
-    g_free(sn.name);
-
-    /*
-     * Now decrease the refcounts of clusters referenced by the snapshot and
-     * free the L1 table.
-     */
-    ret = qcow2_update_snapshot_refcount(bs, sn.l1_table_offset,
-                                         sn.l1_size, -1);
-    if (ret < 0) {
-        return ret;
-    }
-    qcow2_free_clusters(bs, sn.l1_table_offset, sn.l1_size * sizeof(uint64_t));
-
-    /* must update the copied flag on the current cluster offsets */
-    ret = qcow2_update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 0);
-    if (ret < 0) {
-        return ret;
-    }
-
 #ifdef DEBUG_ALLOC
    {
        BdrvCheckResult result = {0};
-        qcow2_check_refcounts(bs, &result, 0);
+        qcow2_check_refcounts(bs, &result);
    }
 #endif
    return 0;
@@ -622,42 +435,32 @@ int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)

 int qcow2_snapshot_load_tmp(BlockDriverState *bs, const char *snapshot_name)
 {
-    int i, snapshot_index;
+    int i, snapshot_index, l1_size2;
    BDRVQcowState *s = bs->opaque;
    QCowSnapshot *sn;
-    uint64_t *new_l1_table;
-    int new_l1_bytes;
-    int ret;

-    assert(bs->read_only);
-
-    /* Search the snapshot */
    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_name);
    if (snapshot_index < 0) {
        return -ENOENT;
    }
+
    sn = &s->snapshots[snapshot_index];
-
-    /* Allocate and read in the snapshot's L1 table */
-    new_l1_bytes = s->l1_size * sizeof(uint64_t);
-    new_l1_table = g_malloc0(align_offset(new_l1_bytes, 512));
-
-    ret = bdrv_pread(bs->file, sn->l1_table_offset, new_l1_table, new_l1_bytes);
-    if (ret < 0) {
-        g_free(new_l1_table);
-        return ret;
+    s->l1_size = sn->l1_size;
+    l1_size2 = s->l1_size * sizeof(uint64_t);
+    if (s->l1_table != NULL) {
+        g_free(s->l1_table);
    }

-    /* Switch the L1 table */
-    g_free(s->l1_table);
-
-    s->l1_size = sn->l1_size;
    s->l1_table_offset = sn->l1_table_offset;
-    s->l1_table = new_l1_table;
+    s->l1_table = g_malloc0(align_offset(l1_size2, 512));
+
+    if (bdrv_pread(bs->file, sn->l1_table_offset,
+                   s->l1_table, l1_size2) != l1_size2) {
+        return -1;
+    }

    for(i = 0;i < s->l1_size; i++) {
        be64_to_cpus(&s->l1_table[i]);
    }
-
    return 0;
 }
--- a/block/qcow2.c
+++ b/block/qcow2.c
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -25,14 +25,15 @@
 #ifndef BLOCK_QCOW2_H
 #define BLOCK_QCOW2_H

-#include "block/aes.h"
-#include "block/coroutine.h"
+#include "aes.h"
+#include "qemu-coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
 //#define DEBUG_EXT

 #define QCOW_MAGIC (('Q' << 24) | ('F' << 16) | ('I' << 8) | 0xfb)
+#define QCOW_VERSION 2

 #define QCOW_CRYPT_NONE 0
 #define QCOW_CRYPT_AES  1
@@ -43,8 +44,6 @@
 #define QCOW_OFLAG_COPIED     (1LL << 63)
 /* indicate that the cluster is compressed (they never have the copied flag) */
 #define QCOW_OFLAG_COMPRESSED (1LL << 62)
-/* The cluster reads as all zeros */
-#define QCOW_OFLAG_ZERO (1LL << 0)

 #define REFCOUNT_SHIFT 1 /* refcount size is 2 bytes */

@@ -72,14 +71,6 @@ typedef struct QCowHeader {
    uint32_t refcount_table_clusters;
    uint32_t nb_snapshots;
    uint64_t snapshots_offset;
-
-    /* The following fields are only valid for version >= 3 */
-    uint64_t incompatible_features;
-    uint64_t compatible_features;
-    uint64_t autoclear_features;
-
-    uint32_t refcount_order;
-    uint32_t header_length;
 } QCowHeader;

 typedef struct QCowSnapshot {
@@ -87,8 +78,7 @@ typedef struct QCowSnapshot {
    uint32_t l1_size;
    char *id_str;
    char *name;
-    uint64_t disk_size;
-    uint64_t vm_state_size;
+    uint32_t vm_state_size;
    uint32_t date_sec;
    uint32_t date_nsec;
    uint64_t vm_clock_nsec;
@@ -97,41 +87,6 @@ typedef struct QCowSnapshot {
 struct Qcow2Cache;
 typedef struct Qcow2Cache Qcow2Cache;

-typedef struct Qcow2UnknownHeaderExtension {
-    uint32_t magic;
-    uint32_t len;
-    QLIST_ENTRY(Qcow2UnknownHeaderExtension) next;
-    uint8_t data[];
-} Qcow2UnknownHeaderExtension;
-
-enum {
-    QCOW2_FEAT_TYPE_INCOMPATIBLE    = 0,
-    QCOW2_FEAT_TYPE_COMPATIBLE      = 1,
-    QCOW2_FEAT_TYPE_AUTOCLEAR       = 2,
-};
-
-/* Incompatible feature bits */
-enum {
-    QCOW2_INCOMPAT_DIRTY_BITNR   = 0,
-    QCOW2_INCOMPAT_DIRTY         = 1 << QCOW2_INCOMPAT_DIRTY_BITNR,
-
-    QCOW2_INCOMPAT_MASK          = QCOW2_INCOMPAT_DIRTY,
-};
-
-/* Compatible feature bits */
-enum {
-    QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR = 0,
-    QCOW2_COMPAT_LAZY_REFCOUNTS       = 1 << QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
-
-    QCOW2_COMPAT_FEAT_MASK            = QCOW2_COMPAT_LAZY_REFCOUNTS,
-};
-
-typedef struct Qcow2Feature {
-    uint8_t type;
-    uint8_t bit;
-    char    name[46];
-} QEMU_PACKED Qcow2Feature;
-
 typedef struct BDRVQcowState {
    int cluster_bits;
    int cluster_size;
@@ -172,15 +127,6 @@ typedef struct BDRVQcowState {
    QCowSnapshot *snapshots;

    int flags;
-    int qcow_version;
-
-    uint64_t incompatible_features;
-    uint64_t compatible_features;
-    uint64_t autoclear_features;
-
-    size_t unknown_header_fields_size;
-    void* unknown_header_fields;
-    QLIST_HEAD(, Qcow2UnknownHeaderExtension) unknown_header_ext;
 } BDRVQcowState;

 /* XXX: use std qcow open function ? */
@@ -196,72 +142,19 @@ typedef struct QCowCreateState {

 struct QCowAIOCB;

-typedef struct Qcow2COWRegion {
-    /**
-     * Offset of the COW region in bytes from the start of the first cluster
-     * touched by the request.
-     */
-    uint64_t    offset;
-
-    /** Number of sectors to copy */
-    int         nb_sectors;
-} Qcow2COWRegion;
-
-/**
- * Describes an in-flight (part of a) write request that writes to clusters
- * that are not referenced in their L2 table yet.
- */
+/* XXX This could be private for qcow2-cluster.c */
 typedef struct QCowL2Meta
 {
-    /** Guest offset of the first newly allocated cluster */
    uint64_t offset;
-
-    /** Host offset of the first newly allocated cluster */
-    uint64_t alloc_offset;
-
-    /**
-     * Number of sectors from the start of the first allocated cluster to
-     * the end of the (possibly shortened) request
-     */
+    uint64_t cluster_offset;
+    int n_start;
    int nb_available;
-
-    /** Number of newly allocated clusters */
    int nb_clusters;
-
-    /**
-     * Requests that overlap with this allocation and wait to be restarted
-     * when the allocating request has completed.
-     */
    CoQueue dependent_requests;

-    /**
-     * The COW Region between the start of the first allocated cluster and the
-     * area the guest actually writes to.
-     */
-    Qcow2COWRegion cow_start;
-
-    /**
-     * The COW Region between the area the guest actually writes to and the
-     * end of the last allocated cluster.
-     */
-    Qcow2COWRegion cow_end;
-
    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;

-enum {
-    QCOW2_CLUSTER_UNALLOCATED,
-    QCOW2_CLUSTER_NORMAL,
-    QCOW2_CLUSTER_COMPRESSED,
-    QCOW2_CLUSTER_ZERO
-};
-
-#define L1E_OFFSET_MASK 0x00ffffffffffff00ULL
-#define L2E_OFFSET_MASK 0x00ffffffffffff00ULL
-#define L2E_COMPRESSED_OFFSET_SIZE_MASK 0x3fffffffffffffffULL
-
-#define REFT_OFFSET_MASK 0xffffffffffffff00ULL
-
 static inline int size_to_clusters(BDRVQcowState *s, int64_t size)
 {
    return (size + (s->cluster_size - 1)) >> s->cluster_bits;
@@ -279,24 +172,6 @@ static inline int64_t align_offset(int64_t offset, int n)
    return offset;
 }

-static inline int qcow2_get_cluster_type(uint64_t l2_entry)
-{
-    if (l2_entry & QCOW_OFLAG_COMPRESSED) {
-        return QCOW2_CLUSTER_COMPRESSED;
-    } else if (l2_entry & QCOW_OFLAG_ZERO) {
-        return QCOW2_CLUSTER_ZERO;
-    } else if (!(l2_entry & L2E_OFFSET_MASK)) {
-        return QCOW2_CLUSTER_UNALLOCATED;
-    } else {
-        return QCOW2_CLUSTER_NORMAL;
-    }
-}
-
-/* Check whether refcounts are eager or lazy */
-static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
-{
-    return !(s->incompatible_features & QCOW2_INCOMPAT_DIRTY);
-}

 // FIXME Need qcow2_ prefix to global functions

@@ -304,16 +179,11 @@ static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors);

-int qcow2_mark_dirty(BlockDriverState *bs);
-int qcow2_update_header(BlockDriverState *bs);
-
 /* qcow2-refcount.c functions */
 int qcow2_refcount_init(BlockDriverState *bs);
 void qcow2_refcount_close(BlockDriverState *bs);

 int64_t qcow2_alloc_clusters(BlockDriverState *bs, int64_t size);
-int qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
-    int nb_clusters);
 int64_t qcow2_alloc_bytes(BlockDriverState *bs, int size);
 void qcow2_free_clusters(BlockDriverState *bs,
    int64_t offset, int64_t size);
@@ -323,8 +193,7 @@ void qcow2_free_any_clusters(BlockDriverState *bs,
 int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend);

-int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                          BdrvCheckMode fix);
+int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res);

 /* qcow2-cluster.c functions */
 int qcow2_grow_l1_table(BlockDriverState *bs, int min_size, bool exact_size);
@@ -338,7 +207,7 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *cluster_offset);
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
-    int n_start, int n_end, int *num, uint64_t *host_offset, QCowL2Meta **m);
+    int n_start, int n_end, int *num, QCowL2Meta *m);
 uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
                                         uint64_t offset,
                                         int compressed_size);
@@ -346,7 +215,6 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m);
 int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
    int nb_sectors);
-int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors);

 /* qcow2-snapshot.c functions */
 int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info);
@@ -359,8 +227,11 @@ void qcow2_free_snapshots(BlockDriverState *bs);
 int qcow2_read_snapshots(BlockDriverState *bs);

 /* qcow2-cache.c functions */
-Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables);
+Qcow2Cache *qcow2_cache_create(BlockDriverState *bs, int num_tables,
+    bool writethrough);
 int qcow2_cache_destroy(BlockDriverState* bs, Qcow2Cache *c);
+bool qcow2_cache_set_writethrough(BlockDriverState *bs, Qcow2Cache *c,
+    bool enable);

 void qcow2_cache_entry_mark_dirty(Qcow2Cache *c, void *table);
 int qcow2_cache_flush(BlockDriverState *bs, Qcow2Cache *c);
--- a/block/qed-check.c
+++ b/block/qed-check.c
@@ -68,7 +68,6 @@ static unsigned int qed_check_l2_table(QEDCheck *check, QEDTable *table)
 {
    BDRVQEDState *s = check->s;
    unsigned int i, num_invalid = 0;
-    uint64_t last_offset = 0;

    for (i = 0; i < s->table_nelems; i++) {
        uint64_t offset = table->offsets[i];
@@ -77,17 +76,11 @@ static unsigned int qed_check_l2_table(QEDCheck *check, QEDTable *table)
            qed_offset_is_zero_cluster(offset)) {
            continue;
        }
-        check->result->bfi.allocated_clusters++;
-        if (last_offset && (last_offset + s->header.cluster_size != offset)) {
-            check->result->bfi.fragmented_clusters++;
-        }
-        last_offset = offset;

        /* Detect invalid cluster offset */
        if (!qed_check_cluster_offset(s, offset)) {
            if (check->fix) {
                table->offsets[i] = 0;
-                check->result->corruptions_fixed++;
            } else {
                check->result->corruptions++;
            }
@@ -128,7 +121,6 @@ static int qed_check_l1_table(QEDCheck *check, QEDTable *table)
            /* Clear invalid offset */
            if (check->fix) {
                table->offsets[i] = 0;
-                check->result->corruptions_fixed++;
            } else {
                check->result->corruptions++;
            }
@@ -194,28 +186,6 @@ static void qed_check_for_leaks(QEDCheck *check)
    }
 }

-/**
- * Mark an image clean once it passes check or has been repaired
- */
-static void qed_check_mark_clean(BDRVQEDState *s, BdrvCheckResult *result)
-{
-    /* Skip if there were unfixable corruptions or I/O errors */
-    if (result->corruptions > 0 || result->check_errors > 0) {
-        return;
-    }
-
-    /* Skip if image is already marked clean */
-    if (!(s->header.features & QED_F_NEED_CHECK)) {
-        return;
-    }
-
-    /* Ensure fixes reach storage before clearing check bit */
-    bdrv_flush(s->bs);
-
-    s->header.features &= ~QED_F_NEED_CHECK;
-    qed_write_header_sync(s);
-}
-
 int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
 {
    QEDCheck check = {
@@ -230,17 +200,10 @@ int qed_check(BDRVQEDState *s, BdrvCheckResult *result, bool fix)
    check.used_clusters = g_malloc0(((check.nclusters + 31) / 32) *
                                       sizeof(check.used_clusters[0]));

-    check.result->bfi.total_clusters =
-        (s->header.image_size + s->header.cluster_size - 1) /
-            s->header.cluster_size;
    ret = qed_check_l1_table(&check, s->l1_table);
    if (ret == 0) {
        /* Only check for leaks if entire image was scanned successfully */
        qed_check_for_leaks(&check);
-
-        if (fix) {
-            qed_check_mark_clean(s, result);
-        }
    }

    g_free(check.used_clusters);
--- a/block/qed-l2-cache.c
+++ b/block/qed-l2-cache.c
@@ -161,25 +161,11 @@ void qed_commit_l2_cache_entry(L2TableCache *l2_cache, CachedL2Table *l2_table)
        return;
    }

-    /* Evict an unused cache entry so we have space.  If all entries are in use
-     * we can grow the cache temporarily and we try to shrink back down later.
-     */
    if (l2_cache->n_entries >= MAX_L2_CACHE_SIZE) {
-        CachedL2Table *next;
-        QTAILQ_FOREACH_SAFE(entry, &l2_cache->entries, node, next) {
-            if (entry->ref > 1) {
-                continue;
-            }
-
-            QTAILQ_REMOVE(&l2_cache->entries, entry, node);
-            l2_cache->n_entries--;
-            qed_unref_l2_cache_entry(entry);
-
-            /* Stop evicting when we've shrunk back to max size */
-            if (l2_cache->n_entries < MAX_L2_CACHE_SIZE) {
-                break;
-            }
-        }
+        entry = QTAILQ_FIRST(&l2_cache->entries);
+        QTAILQ_REMOVE(&l2_cache->entries, entry, node);
+        l2_cache->n_entries--;
+        qed_unref_l2_cache_entry(entry);
    }

    l2_cache->n_entries++;
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -13,7 +13,7 @@
 */

 #include "trace.h"
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
 #include "qed.h"

 typedef struct {
@@ -29,7 +29,7 @@ static void qed_read_table_cb(void *opaque, int ret)
 {
    QEDReadTableCB *read_table_cb = opaque;
    QEDTable *table = read_table_cb->table;
-    int noffsets = read_table_cb->qiov.size / sizeof(uint64_t);
+    int noffsets = read_table_cb->iov.iov_len / sizeof(uint64_t);
    int i;

    /* Handle I/O error */
@@ -54,6 +54,7 @@ static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    QEDReadTableCB *read_table_cb = gencb_alloc(sizeof(*read_table_cb),
                                                cb, opaque);
    QEMUIOVector *qiov = &read_table_cb->qiov;
+    BlockDriverAIOCB *aiocb;

    trace_qed_read_table(s, offset, table);

@@ -63,9 +64,12 @@ static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    read_table_cb->iov.iov_len = s->header.cluster_size * s->header.table_size,

    qemu_iovec_init_external(qiov, &read_table_cb->iov, 1);
-    bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
-                   qiov->size / BDRV_SECTOR_SIZE,
-                   qed_read_table_cb, read_table_cb);
+    aiocb = bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
+                           read_table_cb->iov.iov_len / BDRV_SECTOR_SIZE,
+                           qed_read_table_cb, read_table_cb);
+    if (!aiocb) {
+        qed_read_table_cb(read_table_cb, -EIO);
+    }
 }

 typedef struct {
@@ -103,6 +107,7 @@ static void qed_write_table_cb(void *opaque, int ret)
 out:
    qemu_vfree(write_table_cb->table);
    gencb_complete(&write_table_cb->gencb, ret);
+    return;
 }

 /**
@@ -122,6 +127,7 @@ static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
                            BlockDriverCompletionFunc *cb, void *opaque)
 {
    QEDWriteTableCB *write_table_cb;
+    BlockDriverAIOCB *aiocb;
    unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
    unsigned int start, end, i;
    size_t len_bytes;
@@ -152,10 +158,13 @@ static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    /* Adjust for offset into table */
    offset += start * sizeof(uint64_t);

-    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
-                    &write_table_cb->qiov,
-                    write_table_cb->qiov.size / BDRV_SECTOR_SIZE,
-                    qed_write_table_cb, write_table_cb);
+    aiocb = bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
+                            &write_table_cb->qiov,
+                            write_table_cb->iov.iov_len / BDRV_SECTOR_SIZE,
+                            qed_write_table_cb, write_table_cb);
+    if (!aiocb) {
+        qed_write_table_cb(write_table_cb, -EIO);
+    }
 }

 /**
--- a/block/qed.c
+++ b/block/qed.c
@@ -12,11 +12,11 @@
 *
 */

-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "trace.h"
 #include "qed.h"
-#include "qapi/qmp/qerror.h"
-#include "migration/migration.h"
+#include "qerror.h"
+#include "migration.h"

 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -30,7 +30,7 @@ static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
    }
 }

-static const AIOCBInfo qed_aiocb_info = {
+static AIOPool qed_aio_pool = {
    .aiocb_size         = sizeof(QEDAIOCB),
    .cancel             = qed_aio_cancel,
 };
@@ -89,7 +89,7 @@ static void qed_header_cpu_to_le(const QEDHeader *cpu, QEDHeader *le)
    le->backing_filename_size = cpu_to_le32(cpu->backing_filename_size);
 }

-int qed_write_header_sync(BDRVQEDState *s)
+static int qed_write_header_sync(BDRVQEDState *s)
 {
    QEDHeader le;
    int ret;
@@ -123,6 +123,7 @@ static void qed_write_header_read_cb(void *opaque, int ret)
 {
    QEDWriteHeaderCB *write_header_cb = opaque;
    BDRVQEDState *s = write_header_cb->s;
+    BlockDriverAIOCB *acb;

    if (ret) {
        qed_write_header_cb(write_header_cb, ret);
@@ -132,9 +133,12 @@ static void qed_write_header_read_cb(void *opaque, int ret)
    /* Update header */
    qed_header_cpu_to_le(&s->header, (QEDHeader *)write_header_cb->buf);

-    bdrv_aio_writev(s->bs->file, 0, &write_header_cb->qiov,
-                    write_header_cb->nsectors, qed_write_header_cb,
-                    write_header_cb);
+    acb = bdrv_aio_writev(s->bs->file, 0, &write_header_cb->qiov,
+                          write_header_cb->nsectors, qed_write_header_cb,
+                          write_header_cb);
+    if (!acb) {
+        qed_write_header_cb(write_header_cb, -EIO);
+    }
 }

 /**
@@ -152,6 +156,7 @@ static void qed_write_header(BDRVQEDState *s, BlockDriverCompletionFunc cb,
     * them, and write back.
     */

+    BlockDriverAIOCB *acb;
    int nsectors = (sizeof(QEDHeader) + BDRV_SECTOR_SIZE - 1) /
                   BDRV_SECTOR_SIZE;
    size_t len = nsectors * BDRV_SECTOR_SIZE;
@@ -165,8 +170,11 @@ static void qed_write_header(BDRVQEDState *s, BlockDriverCompletionFunc cb,
    write_header_cb->iov.iov_len = len;
    qemu_iovec_init_external(&write_header_cb->qiov, &write_header_cb->iov, 1);

-    bdrv_aio_readv(s->bs->file, 0, &write_header_cb->qiov, nsectors,
-                   qed_write_header_read_cb, write_header_cb);
+    acb = bdrv_aio_readv(s->bs->file, 0, &write_header_cb->qiov, nsectors,
+                         qed_write_header_read_cb, write_header_cb);
+    if (!acb) {
+        qed_write_header_cb(write_header_cb, -EIO);
+    }
 }

 static uint64_t qed_max_image_size(uint32_t cluster_size, uint32_t table_size)
@@ -367,12 +375,6 @@ static void qed_cancel_need_check_timer(BDRVQEDState *s)
    qemu_del_timer(s->need_check_timer);
 }

-static void bdrv_qed_rebind(BlockDriverState *bs)
-{
-    BDRVQEDState *s = bs->opaque;
-    s->bs = bs;
-}
-
 static int bdrv_qed_open(BlockDriverState *bs, int flags)
 {
    BDRVQEDState *s = bs->opaque;
@@ -390,7 +392,7 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    qed_header_le_to_cpu(&le_header, &s->header);

    if (s->header.magic != QED_MAGIC) {
-        return -EMEDIUMTYPE;
+        return -EINVAL;
    }
    if (s->header.features & ~QED_FEATURE_MASK) {
        /* image uses unsupported feature bits */
@@ -456,7 +458,7 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
     * feature is no longer valid.
     */
    if ((s->header.autoclear_features & ~QED_AUTOCLEAR_FEATURE_MASK) != 0 &&
-        !bdrv_is_read_only(bs->file) && !(flags & BDRV_O_INCOMING)) {
+        !bdrv_is_read_only(bs->file)) {
        s->header.autoclear_features &= QED_AUTOCLEAR_FEATURE_MASK;

        ret = qed_write_header_sync(s);
@@ -477,26 +479,38 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    }

    /* If image was not closed cleanly, check consistency */
-    if (!(flags & BDRV_O_CHECK) && (s->header.features & QED_F_NEED_CHECK)) {
+    if (s->header.features & QED_F_NEED_CHECK) {
        /* Read-only images cannot be fixed.  There is no risk of corruption
         * since write operations are not possible.  Therefore, allow
         * potentially inconsistent images to be opened read-only.  This can
         * aid data recovery from an otherwise inconsistent image.
         */
-        if (!bdrv_is_read_only(bs->file) &&
-            !(flags & BDRV_O_INCOMING)) {
+        if (!bdrv_is_read_only(bs->file)) {
            BdrvCheckResult result = {0};

            ret = qed_check(s, &result, true);
            if (ret) {
                goto out;
            }
+            if (!result.corruptions && !result.check_errors) {
+                /* Ensure fixes reach storage before clearing check bit */
+                bdrv_flush(s->bs);
+
+                s->header.features &= ~QED_F_NEED_CHECK;
+                qed_write_header_sync(s);
+            }
        }
    }

    s->need_check_timer = qemu_new_timer_ns(vm_clock,
                                            qed_need_check_timer_cb, s);

+    error_set(&s->migration_blocker,
+              QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED,
+              "qed", bs->device_name, "live migration");
+    migrate_add_blocker(s->migration_blocker);
+
+
 out:
    if (ret) {
        qed_free_l2_cache(&s->l2_cache);
@@ -505,18 +519,13 @@ out:
    return ret;
 }

-/* We have nothing to do for QED reopen, stubs just return
- * success */
-static int bdrv_qed_reopen_prepare(BDRVReopenState *state,
-                                   BlockReopenQueue *queue, Error **errp)
-{
-    return 0;
-}
-
 static void bdrv_qed_close(BlockDriverState *bs)
 {
    BDRVQEDState *s = bs->opaque;

+    migrate_del_blocker(s->migration_blocker);
+    error_free(s->migration_blocker);
+
    qed_cancel_need_check_timer(s);
    qemu_free_timer(s->need_check_timer);

@@ -652,7 +661,6 @@ static int bdrv_qed_create(const char *filename, QEMUOptionParameter *options)
 }

 typedef struct {
-    Coroutine *co;
    int is_allocated;
    int *pnum;
 } QEDIsAllocatedCB;
@@ -662,14 +670,10 @@ static void qed_is_allocated_cb(void *opaque, int ret, uint64_t offset, size_t l
    QEDIsAllocatedCB *cb = opaque;
    *cb->pnum = len / BDRV_SECTOR_SIZE;
    cb->is_allocated = (ret == QED_CLUSTER_FOUND || ret == QED_CLUSTER_ZERO);
-    if (cb->co) {
-        qemu_coroutine_enter(cb->co, NULL);
-    }
 }

-static int coroutine_fn bdrv_qed_co_is_allocated(BlockDriverState *bs,
-                                                 int64_t sector_num,
-                                                 int nb_sectors, int *pnum)
+static int bdrv_qed_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                                  int nb_sectors, int *pnum)
 {
    BDRVQEDState *s = bs->opaque;
    uint64_t pos = (uint64_t)sector_num * BDRV_SECTOR_SIZE;
@@ -682,10 +686,8 @@ static int coroutine_fn bdrv_qed_co_is_allocated(BlockDriverState *bs,

    qed_find_cluster(s, &request, pos, len, qed_is_allocated_cb, &cb);

-    /* Now sleep if the callback wasn't invoked immediately */
    while (cb.is_allocated == -1) {
-        cb.co = qemu_coroutine_self();
-        qemu_coroutine_yield();
+        qemu_aio_wait();
    }

    qed_unref_l2_cache_entry(request.l2_table);
@@ -719,6 +721,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
                                  QEMUIOVector *qiov,
                                  BlockDriverCompletionFunc *cb, void *opaque)
 {
+    BlockDriverAIOCB *aiocb;
    uint64_t backing_length = 0;
    size_t size;

@@ -737,7 +740,7 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* Zero all sectors if reading beyond the end of the backing file */
    if (pos >= backing_length ||
        pos + qiov->size > backing_length) {
-        qemu_iovec_memset(qiov, 0, 0, qiov->size);
+        qemu_iovec_memset(qiov, 0, qiov->size);
    }

    /* Complete now if there are no backing file sectors to read */
@@ -749,9 +752,12 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
    /* If the read straddles the end of the backing file, shorten it */
    size = MIN((uint64_t)backing_length - pos, qiov->size);

-    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING_AIO);
-    bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
-                   qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
+    BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING);
+    aiocb = bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
+                           qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
+    if (!aiocb) {
+        cb(opaque, -EIO);
+    }
 }

 typedef struct {
@@ -773,6 +779,7 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
 {
    CopyFromBackingFileCB *copy_cb = opaque;
    BDRVQEDState *s = copy_cb->s;
+    BlockDriverAIOCB *aiocb;

    if (ret) {
        qed_copy_from_backing_file_cb(copy_cb, ret);
@@ -780,9 +787,13 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
    }

    BLKDBG_EVENT(s->bs->file, BLKDBG_COW_WRITE);
-    bdrv_aio_writev(s->bs->file, copy_cb->offset / BDRV_SECTOR_SIZE,
-                    &copy_cb->qiov, copy_cb->qiov.size / BDRV_SECTOR_SIZE,
-                    qed_copy_from_backing_file_cb, copy_cb);
+    aiocb = bdrv_aio_writev(s->bs->file, copy_cb->offset / BDRV_SECTOR_SIZE,
+                            &copy_cb->qiov,
+                            copy_cb->qiov.size / BDRV_SECTOR_SIZE,
+                            qed_copy_from_backing_file_cb, copy_cb);
+    if (!aiocb) {
+        qed_copy_from_backing_file_cb(copy_cb, -EIO);
+    }
 }

 /**
@@ -874,12 +885,6 @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)
    qemu_iovec_destroy(&acb->cur_qiov);
    qed_unref_l2_cache_entry(acb->request.l2_table);

-    /* Free the buffer we may have allocated for zero writes */
-    if (acb->flags & QED_AIOCB_ZERO) {
-        qemu_vfree(acb->qiov->iov[0].iov_base);
-        acb->qiov->iov[0].iov_base = NULL;
-    }
-
    /* Arrange for a bh to invoke the completion function */
    acb->bh_ret = ret;
    acb->bh = qemu_bh_new(qed_aio_complete_bh, acb);
@@ -946,8 +951,9 @@ static void qed_aio_write_l1_update(void *opaque, int ret)
 /**
 * Update L2 table with new cluster offsets and write them out
 */
-static void qed_aio_write_l2_update(QEDAIOCB *acb, int ret, uint64_t offset)
+static void qed_aio_write_l2_update(void *opaque, int ret)
 {
+    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);
    bool need_alloc = acb->find_cluster_ret == QED_CLUSTER_L1;
    int index;
@@ -963,7 +969,7 @@ static void qed_aio_write_l2_update(QEDAIOCB *acb, int ret, uint64_t offset)

    index = qed_l2_index(s, acb->cur_pos);
    qed_update_l2_table(s, acb->request.l2_table->table, index, acb->cur_nclusters,
-                         offset);
+                         acb->cur_cluster);

    if (need_alloc) {
        /* Write out the whole new L2 table */
@@ -980,12 +986,6 @@ err:
    qed_aio_complete(acb, ret);
 }

-static void qed_aio_write_l2_update_cb(void *opaque, int ret)
-{
-    QEDAIOCB *acb = opaque;
-    qed_aio_write_l2_update(acb, ret, acb->cur_cluster);
-}
-
 /**
 * Flush new data clusters before updating the L2 table
 *
@@ -1000,7 +1000,7 @@ static void qed_aio_write_flush_before_l2_update(void *opaque, int ret)
    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);

-    if (!bdrv_aio_flush(s->bs->file, qed_aio_write_l2_update_cb, opaque)) {
+    if (!bdrv_aio_flush(s->bs->file, qed_aio_write_l2_update, opaque)) {
        qed_aio_complete(acb, -EIO);
    }
 }
@@ -1015,6 +1015,7 @@ static void qed_aio_write_main(void *opaque, int ret)
    uint64_t offset = acb->cur_cluster +
                      qed_offset_into_cluster(s, acb->cur_pos);
    BlockDriverCompletionFunc *next_fn;
+    BlockDriverAIOCB *file_acb;

    trace_qed_aio_write_main(s, acb, ret, offset, acb->cur_qiov.size);

@@ -1029,14 +1030,18 @@ static void qed_aio_write_main(void *opaque, int ret)
        if (s->bs->backing_hd) {
            next_fn = qed_aio_write_flush_before_l2_update;
        } else {
-            next_fn = qed_aio_write_l2_update_cb;
+            next_fn = qed_aio_write_l2_update;
        }
    }

    BLKDBG_EVENT(s->bs->file, BLKDBG_WRITE_AIO);
-    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
-                    &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
-                    next_fn, acb);
+    file_acb = bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
+                               &acb->cur_qiov,
+                               acb->cur_qiov.size / BDRV_SECTOR_SIZE,
+                               next_fn, acb);
+    if (!file_acb) {
+        qed_aio_complete(acb, -EIO);
+    }
 }

 /**
@@ -1091,18 +1096,6 @@ static bool qed_should_set_need_check(BDRVQEDState *s)
    return !(s->header.features & QED_F_NEED_CHECK);
 }

-static void qed_aio_write_zero_cluster(void *opaque, int ret)
-{
-    QEDAIOCB *acb = opaque;
-
-    if (ret) {
-        qed_aio_complete(acb, ret);
-        return;
-    }
-
-    qed_aio_write_l2_update(acb, 0, 1);
-}
-
 /**
 * Write new data cluster
 *
@@ -1114,7 +1107,6 @@ static void qed_aio_write_zero_cluster(void *opaque, int ret)
 static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
 {
    BDRVQEDState *s = acb_to_s(acb);
-    BlockDriverCompletionFunc *cb;

    /* Cancel timer when the first allocating request comes in */
    if (QSIMPLEQ_EMPTY(&s->allocating_write_reqs)) {
@@ -1132,26 +1124,14 @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)

    acb->cur_nclusters = qed_bytes_to_clusters(s,
            qed_offset_into_cluster(s, acb->cur_pos) + len);
-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
-
-    if (acb->flags & QED_AIOCB_ZERO) {
-        /* Skip ahead if the clusters are already zero */
-        if (acb->find_cluster_ret == QED_CLUSTER_ZERO) {
-            qed_aio_next_io(acb, 0);
-            return;
-        }
-
-        cb = qed_aio_write_zero_cluster;
-    } else {
-        cb = qed_aio_write_prefill;
-        acb->cur_cluster = qed_alloc_clusters(s, acb->cur_nclusters);
-    }
+    acb->cur_cluster = qed_alloc_clusters(s, acb->cur_nclusters);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    if (qed_should_set_need_check(s)) {
        s->header.features |= QED_F_NEED_CHECK;
-        qed_write_header(s, cb, acb);
+        qed_write_header(s, qed_aio_write_prefill, acb);
    } else {
-        cb(acb, 0);
+        qed_aio_write_prefill(acb, 0);
    }
 }

@@ -1166,19 +1146,9 @@ static void qed_aio_write_alloc(QEDAIOCB *acb, size_t len)
 */
 static void qed_aio_write_inplace(QEDAIOCB *acb, uint64_t offset, size_t len)
 {
-    /* Allocate buffer for zero writes */
-    if (acb->flags & QED_AIOCB_ZERO) {
-        struct iovec *iov = acb->qiov->iov;
-
-        if (!iov->iov_base) {
-            iov->iov_base = qemu_blockalign(acb->common.bs, iov->iov_len);
-            memset(iov->iov_base, 0, iov->iov_len);
-        }
-    }
-
    /* Calculate the I/O vector */
    acb->cur_cluster = offset;
-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    /* Do the actual write */
    qed_aio_write_main(acb, 0);
@@ -1238,6 +1208,7 @@ static void qed_aio_read_data(void *opaque, int ret,
    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);
    BlockDriverState *bs = acb->common.bs;
+    BlockDriverAIOCB *file_acb;

    /* Adjust offset into cluster */
    offset += qed_offset_into_cluster(s, acb->cur_pos);
@@ -1248,11 +1219,11 @@ static void qed_aio_read_data(void *opaque, int ret,
        goto err;
    }

-    qemu_iovec_concat(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);
+    qemu_iovec_copy(&acb->cur_qiov, acb->qiov, acb->qiov_offset, len);

    /* Handle zero cluster and backing file reads */
    if (ret == QED_CLUSTER_ZERO) {
-        qemu_iovec_memset(&acb->cur_qiov, 0, 0, acb->cur_qiov.size);
+        qemu_iovec_memset(&acb->cur_qiov, 0, acb->cur_qiov.size);
        qed_aio_next_io(acb, 0);
        return;
    } else if (ret != QED_CLUSTER_FOUND) {
@@ -1262,9 +1233,14 @@ static void qed_aio_read_data(void *opaque, int ret,
    }

    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-    bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
-                   &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
-                   qed_aio_next_io, acb);
+    file_acb = bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
+                              &acb->cur_qiov,
+                              acb->cur_qiov.size / BDRV_SECTOR_SIZE,
+                              qed_aio_next_io, acb);
+    if (!file_acb) {
+        ret = -EIO;
+        goto err;
+    }
    return;

 err:
@@ -1278,8 +1254,8 @@ static void qed_aio_next_io(void *opaque, int ret)
 {
    QEDAIOCB *acb = opaque;
    BDRVQEDState *s = acb_to_s(acb);
-    QEDFindClusterFunc *io_fn = (acb->flags & QED_AIOCB_WRITE) ?
-                                qed_aio_write_data : qed_aio_read_data;
+    QEDFindClusterFunc *io_fn =
+        acb->is_write ? qed_aio_write_data : qed_aio_read_data;

    trace_qed_aio_next_io(s, acb, ret, acb->cur_pos + acb->cur_qiov.size);

@@ -1309,14 +1285,14 @@ static BlockDriverAIOCB *qed_aio_setup(BlockDriverState *bs,
                                       int64_t sector_num,
                                       QEMUIOVector *qiov, int nb_sectors,
                                       BlockDriverCompletionFunc *cb,
-                                       void *opaque, int flags)
+                                       void *opaque, bool is_write)
 {
-    QEDAIOCB *acb = qemu_aio_get(&qed_aiocb_info, bs, cb, opaque);
+    QEDAIOCB *acb = qemu_aio_get(&qed_aio_pool, bs, cb, opaque);

    trace_qed_aio_setup(bs->opaque, acb, sector_num, nb_sectors,
-                        opaque, flags);
+                         opaque, is_write);

-    acb->flags = flags;
+    acb->is_write = is_write;
    acb->finished = NULL;
    acb->qiov = qiov;
    acb->qiov_offset = 0;
@@ -1336,7 +1312,7 @@ static BlockDriverAIOCB *bdrv_qed_aio_readv(BlockDriverState *bs,
                                            BlockDriverCompletionFunc *cb,
                                            void *opaque)
 {
-    return qed_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    return qed_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, false);
 }

 static BlockDriverAIOCB *bdrv_qed_aio_writev(BlockDriverState *bs,
@@ -1345,66 +1321,14 @@ static BlockDriverAIOCB *bdrv_qed_aio_writev(BlockDriverState *bs,
                                             BlockDriverCompletionFunc *cb,
                                             void *opaque)
 {
-    return qed_aio_setup(bs, sector_num, qiov, nb_sectors, cb,
-                         opaque, QED_AIOCB_WRITE);
+    return qed_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, true);
 }

-typedef struct {
-    Coroutine *co;
-    int ret;
-    bool done;
-} QEDWriteZeroesCB;
-
-static void coroutine_fn qed_co_write_zeroes_cb(void *opaque, int ret)
+static BlockDriverAIOCB *bdrv_qed_aio_flush(BlockDriverState *bs,
+                                            BlockDriverCompletionFunc *cb,
+                                            void *opaque)
 {
-    QEDWriteZeroesCB *cb = opaque;
-
-    cb->done = true;
-    cb->ret = ret;
-    if (cb->co) {
-        qemu_coroutine_enter(cb->co, NULL);
-    }
-}
-
-static int coroutine_fn bdrv_qed_co_write_zeroes(BlockDriverState *bs,
-                                                 int64_t sector_num,
-                                                 int nb_sectors)
-{
-    BlockDriverAIOCB *blockacb;
-    BDRVQEDState *s = bs->opaque;
-    QEDWriteZeroesCB cb = { .done = false };
-    QEMUIOVector qiov;
-    struct iovec iov;
-
-    /* Refuse if there are untouched backing file sectors */
-    if (bs->backing_hd) {
-        if (qed_offset_into_cluster(s, sector_num * BDRV_SECTOR_SIZE) != 0) {
-            return -ENOTSUP;
-        }
-        if (qed_offset_into_cluster(s, nb_sectors * BDRV_SECTOR_SIZE) != 0) {
-            return -ENOTSUP;
-        }
-    }
-
-    /* Zero writes start without an I/O buffer.  If a buffer becomes necessary
-     * then it will be allocated during request processing.
-     */
-    iov.iov_base = NULL,
-    iov.iov_len  = nb_sectors * BDRV_SECTOR_SIZE,
-
-    qemu_iovec_init_external(&qiov, &iov, 1);
-    blockacb = qed_aio_setup(bs, sector_num, &qiov, nb_sectors,
-                             qed_co_write_zeroes_cb, &cb,
-                             QED_AIOCB_WRITE | QED_AIOCB_ZERO);
-    if (!blockacb) {
-        return -EIO;
-    }
-    if (!cb.done) {
-        cb.co = qemu_coroutine_self();
-        qemu_coroutine_yield();
-    }
-    assert(cb.done);
-    return cb.ret;
+    return bdrv_aio_flush(bs->file, cb, opaque);
 }

 static int bdrv_qed_truncate(BlockDriverState *bs, int64_t offset)
@@ -1444,7 +1368,6 @@ static int bdrv_qed_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)

    memset(bdi, 0, sizeof(*bdi));
    bdi->cluster_size = s->header.cluster_size;
-    bdi->is_dirty = s->header.features & QED_F_NEED_CHECK;
    return 0;
 }

@@ -1520,21 +1443,11 @@ static int bdrv_qed_change_backing_file(BlockDriverState *bs,
    return ret;
 }

-static void bdrv_qed_invalidate_cache(BlockDriverState *bs)
+static int bdrv_qed_check(BlockDriverState *bs, BdrvCheckResult *result)
 {
    BDRVQEDState *s = bs->opaque;

-    bdrv_qed_close(bs);
-    memset(s, 0, sizeof(BDRVQEDState));
-    bdrv_qed_open(bs, bs->open_flags);
-}
-
-static int bdrv_qed_check(BlockDriverState *bs, BdrvCheckResult *result,
-                          BdrvCheckMode fix)
-{
-    BDRVQEDState *s = bs->opaque;
-
-    return qed_check(s, result, !!fix);
+    return qed_check(s, result, false);
 }

 static QEMUOptionParameter qed_create_options[] = {
@@ -1569,21 +1482,18 @@ static BlockDriver bdrv_qed = {
    .create_options           = qed_create_options,

    .bdrv_probe               = bdrv_qed_probe,
-    .bdrv_rebind              = bdrv_qed_rebind,
    .bdrv_open                = bdrv_qed_open,
    .bdrv_close               = bdrv_qed_close,
-    .bdrv_reopen_prepare      = bdrv_qed_reopen_prepare,
    .bdrv_create              = bdrv_qed_create,
-    .bdrv_co_is_allocated     = bdrv_qed_co_is_allocated,
+    .bdrv_is_allocated        = bdrv_qed_is_allocated,
    .bdrv_make_empty          = bdrv_qed_make_empty,
    .bdrv_aio_readv           = bdrv_qed_aio_readv,
    .bdrv_aio_writev          = bdrv_qed_aio_writev,
-    .bdrv_co_write_zeroes     = bdrv_qed_co_write_zeroes,
+    .bdrv_aio_flush           = bdrv_qed_aio_flush,
    .bdrv_truncate            = bdrv_qed_truncate,
    .bdrv_getlength           = bdrv_qed_getlength,
    .bdrv_get_info            = bdrv_qed_get_info,
    .bdrv_change_backing_file = bdrv_qed_change_backing_file,
-    .bdrv_invalidate_cache    = bdrv_qed_invalidate_cache,
    .bdrv_check               = bdrv_qed_check,
 };

--- a/block/qed.h
+++ b/block/qed.h
@@ -15,7 +15,7 @@
 #ifndef BLOCK_QED_H
 #define BLOCK_QED_H

-#include "block/block_int.h"
+#include "block_int.h"

 /* The layout of a QED file is as follows:
 *
@@ -123,17 +123,12 @@ typedef struct QEDRequest {
    CachedL2Table *l2_table;
 } QEDRequest;

-enum {
-    QED_AIOCB_WRITE = 0x0001,       /* read or write? */
-    QED_AIOCB_ZERO  = 0x0002,       /* zero write, used with QED_AIOCB_WRITE */
-};
-
 typedef struct QEDAIOCB {
    BlockDriverAIOCB common;
    QEMUBH *bh;
    int bh_ret;                     /* final return status for completion bh */
    QSIMPLEQ_ENTRY(QEDAIOCB) next;  /* next request */
-    int flags;                      /* QED_AIOCB_* bits ORed together */
+    bool is_write;                  /* false - read, true - write */
    bool *finished;                 /* signal for cancel completion */
    uint64_t end_pos;               /* request end on block device, in bytes */

@@ -169,6 +164,8 @@ typedef struct {

    /* Periodic flush and clear need check flag */
    QEMUTimer *need_check_timer;
+
+    Error *migration_blocker;
 } BDRVQEDState;

 enum {
@@ -210,11 +207,6 @@ typedef struct {
 void *gencb_alloc(size_t len, BlockDriverCompletionFunc *cb, void *opaque);
 void gencb_complete(void *opaque, int ret);

-/**
- * Header functions
- */
-int qed_write_header_sync(BDRVQEDState *s);
-
 /**
 * L2 cache functions
 */
--- a/block/raw-posix-aio.h
+++ b/block/raw-posix-aio.h
@@ -1,5 +1,5 @@
 /*
- * Declarations for AIO in the raw protocol
+ * QEMU Posix block I/O backend AIO support
 *
 * Copyright IBM, Corp. 2008
 *
@@ -9,43 +9,35 @@
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
 */
-#ifndef QEMU_RAW_AIO_H
-#define QEMU_RAW_AIO_H
+#ifndef QEMU_RAW_POSIX_AIO_H
+#define QEMU_RAW_POSIX_AIO_H

 /* AIO request types */
 #define QEMU_AIO_READ         0x0001
 #define QEMU_AIO_WRITE        0x0002
 #define QEMU_AIO_IOCTL        0x0004
 #define QEMU_AIO_FLUSH        0x0008
-#define QEMU_AIO_DISCARD      0x0010
 #define QEMU_AIO_TYPE_MASK \
-        (QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH| \
-         QEMU_AIO_DISCARD)
+	(QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH)

 /* AIO flags */
 #define QEMU_AIO_MISALIGNED   0x1000
-#define QEMU_AIO_BLKDEV       0x2000


+/* posix-aio-compat.c - thread pool based implementation */
+int paio_init(void);
+BlockDriverAIOCB *paio_submit(BlockDriverState *bs, int fd,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockDriverCompletionFunc *cb, void *opaque, int type);
+BlockDriverAIOCB *paio_ioctl(BlockDriverState *bs, int fd,
+        unsigned long int req, void *buf,
+        BlockDriverCompletionFunc *cb, void *opaque);
+
 /* linux-aio.c - Linux native implementation */
-#ifdef CONFIG_LINUX_AIO
 void *laio_init(void);
 BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type);
-#endif

-#ifdef _WIN32
-typedef struct QEMUWin32AIOState QEMUWin32AIOState;
-QEMUWin32AIOState *win32_aio_init(void);
-int win32_aio_attach(QEMUWin32AIOState *aio, HANDLE hfile);
-BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
-        QEMUWin32AIOState *aio, HANDLE hfile,
-        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
-        BlockDriverCompletionFunc *cb, void *opaque, int type);
-#endif
-
-#endif /* QEMU_RAW_AIO_H */
+#endif /* QEMU_RAW_POSIX_AIO_H */
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Justin M. Forbes	3ffb4001c2	Version 1.0.1 Signed-off-by: Justin M. Forbes <jforbes@redhat.com>	2012-02-02 16:44:08 -06:00
Justin M. Forbes	86a8d63bc1	Merge branch 's390-1.0' of git://repo.or.cz/qemu/agraf	2012-02-01 11:25:23 -06:00
Justin M. Forbes	102dd9167c	Merge branch 'ppc-1.0' of git://repo.or.cz/qemu/agraf	2012-02-01 11:24:47 -06:00
Anthony Liguori	d0ed2d2e8e	e1000: bounds packet size against buffer size Otherwise we can write beyond the buffer and corrupt memory. This is tracked as CVE-2012-0029. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2012-01-23 15:07:00 -06:00
Christian Borntraeger	d194ba1cdb	s390: fix cpu hotplug / cpu activity on interrupts The add_del/running_cpu code and env->halted are tracking stopped cpus. Sleeping cpus (idle and enabled for interrupts) are waiting inside the kernel. No interrupt besides the restart can move a cpu from stopped to operational. This is already handled over there. So lets just remove the bogus wakup from the common interrupt delivery, otherwise any interrupt will wake up a cpu, even if this cpu is stopped (Thus leading to strange hangs on sigp restart) This fixes echo 0 > /sys/devices/system/cpu/cpu0/online echo 1 > /sys/devices/system/cpu/cpu0/online in the guest Signed-off-by: Christian Borntraeger<borntraeger@de.ibm.com> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit `93116ac0cf`)	2012-01-12 18:41:08 +01:00
Alexander Graf	8a0a9cf35b	s390x: add TR function for EXECUTE Newer gcc versions (or glibc?) also generate code that tries to EXECUTE the TR opcode. Implement it so that we don't break valid guests. Reported-by: Andreas Faerber <afaerber@suse.de> Signed-off-by: Alexander Graf <agraf@suse.de>	2012-01-12 18:41:08 +01:00
David Gibson	d928541b51	pseries: Don't try to munmap() a malloc()ed TCE table For the pseries machine, TCE (IOMMU) tables can either be directly malloc()ed in qemu or, when running on a KVM which supports it, mmap()ed from a KVM ioctl. The latter option is used when available, because it allows the (frequent bottlenext) H_PUT_TCE hypercall to be KVM accelerated. However, even when KVM is persent, TCE acceleration is not always possible. Only KVM HV supports this ioctl(), not KVM PR, or the kernel could run out of contiguous memory to allocate the new table. In this case we need to fall back on the malloc()ed table. When a device is removed, and we need to remove the TCE table, we need to either munmap() or free() the table as appropriate for how it was allocated. The code is supposed to do that, but we buggily fail to initialize the tcet->fd variable in the malloc() case, which is used as a flag to determine which is the right choice. This patch fixes the bug, and cleans up error messages relating to this path while we're at it. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de>	2012-01-12 18:30:51 +01:00
David Gibson	7a6d80e93c	pseries: Populate "/chosen/linux,stdout-path" in the FDT There is a device tree property "/chosen/linux,stdout-path" which indicates which device should be used as stdout - ie. "the console". Currently we don't specify anything, which means both firmware and Linux choose something arbitrarily. Use the routine we added in the last patch to pick a default vty and specify it as stdout. Currently SLOF doesn't use the property, but we are hoping to update it to do so. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit `68f3a94c64`)	2012-01-12 18:30:51 +01:00
David Gibson	447a3b3473	pseries: Add a routine to find a stable "default" vty and use it In vty_lookup() we have a special case for supporting early debug in the kernel. This accepts reg == 0 as a special case to mean "any vty". We implement this by searching the vtys on the bus and returning the first we find. This means that the vty we chose depends on the order the vtys are specified on the QEMU command line - because that determines the order of the vtys on the bus. We'd rather the command line order was irrelevant, so instead return the vty with the lowest reg value. This is still a guess as to what the user really means, but it is at least stable WRT command line ordering. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf] fix braces (cherry picked from commit `98331f8ad6`)	2012-01-12 18:30:50 +01:00
David Gibson	e295c31e25	pseries: Emit device tree nodes in reg order Although in theory the device tree has no inherent ordering, in practice the order of nodes in the device tree does effect the order that devices are detected by software. Currently the ordering is determined by the order the devices appear on the QEMU command line. Although that does give the user control over the ordering, it is fragile, especially when the user does not generate the command line manually - eg. when using libvirt etc. So order the device tree based on the reg value, ie. the address of on the VIO bus of the devices. This gives us a sane and stable ordering. Signed-off-by: Michael Ellerman <michael@ellerman.id.au> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf] add braces (cherry picked from commit `05c194384f`)	2012-01-12 18:30:50 +01:00
Liu Yu-B13201	adf6c527b0	kvm-ppc: halt secondary cpus when guest reset When guest reset, we need to halt secondary cpus until guest kick them. This already works for tcg. The patch add the support for kvm. Signed-off-by: Liu Yu <yu.liu@freescale.com> Signed-off-by: Alexander Graf <agraf@suse.de> [agraf: remove in-kernel irqchip code] (cherry picked from commit `157feeadba`)	2012-01-12 18:30:50 +01:00
David Gibson	57ee5f77c0	pseries: Fix array overrun bug in PCI code spapr_populate_pci_devices() containd a loop with PCI_NUM_REGIONS (7) iterations. However this overruns the 'bars' global array, which only has 6 elements. In fact we only want to run this loop for things listed in the bars array, so this patch corrects the loop bounds to reflect that. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Alexander Graf <agraf@suse.de> (cherry picked from commit 135712de61dfa22368e98914d65b8b0860ec8505)	2012-01-12 18:30:50 +01:00
Alexander Graf	986626efec	console: Fix segfault on screendump without VGA adapter When trying to create a screen dump without having any VGA adapter inside the guest, QEMU segfaults. This is because it's trying to switch back to the "previous" screen it was on before dumping the VGA screen. Unfortunately, in my case there simply is no previous screen so it accesses a NULL pointer. Fix it by checking if previous_active_console is actually available. This is 1.0 material. Signed-off-by: Alexander Graf <agraf@suse.de>	2012-01-12 18:30:50 +01:00
Justin M. Forbes	85a4ca797d	Merge branch 'master' of ssh://git.qemu.org/pub/git/qemu-stable-1.0	2012-01-10 14:41:17 -06:00
Josh Durgin	e47c212cb5	rbd: always set out parameter in qemu_rbd_snap_list The caller expects psn_tab to be NULL when there are no snapshots or an error occurs. This results in calling g_free on an invalid address. Reported-by: Oliver Francke <Oliver@filoo.de> Signed-off-by: Josh Durgin <josh.durgin@dreamhost.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>	2012-01-10 13:37:11 -06:00
Kevin Wolf	8afe984ef7	Documentation: Add qemu-img -t parameter in man page Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>	2012-01-10 13:37:02 -06:00
Kevin Wolf	5bb37d151b	qemu-img rebase: Fix for undersized backing files Backing files may be smaller than the corresponding COW file. When reading directly from the backing file, qemu-img rebase must consider this and assume zero sectors after the end of backing files. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>	2012-01-10 13:36:51 -06:00
Avi Kivity	fe5c13ebf1	coroutine: switch per-thread free pool to a global pool ucontext-based coroutines use a free pool to reduce allocations and deallocations of coroutine objects. The pool is per-thread, presumably to improve locality. However, as coroutines are usually allocated in a vcpu thread and freed in the I/O thread, the pool accounting gets screwed up and we end allocating and freeing a coroutine for every I/O request. This is expensive since large objects are allocated via the kernel, and are not cached by the C runtime. Fix by switching to a global pool. This is safe since we're protected by the global mutex. Signed-off-by: Avi Kivity <avi@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>	2012-01-10 13:36:39 -06:00
Paolo Bonzini	6061f16a8a	qiov: prevent double free or use-after-free qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data could thus be used after free or freed again. While I do not know any example in the tree, I observed this using virtio-scsi (and SCSI scatter/gather) when canceling DMA requests. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>	2012-01-10 13:36:27 -06:00
Alexander Graf	fbcf305e5a	PPC: Fix linker scripts on ppc hosts When compiling qemu statically with multilib on PPC, we hit the same issue that commit `845f2c2812` is fixing. Do the same here. Signed-off-by: Alexander Graf <agraf@suse.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `665a04ae1c`)	2012-01-10 18:30:12 +01:00
Aurelien Jarno	37769d2727	target-sh4: ignore ocbp and ocbwb instructions ocbp and ocbwb controls the writeback of a cache line to memory. They are supposed to do nothing in case of a cache miss. Given QEMU only partially emulate caches, it is safe to ignore these instructions. This fixes a kernel oops when trying to access an rtl8139 NIC with recent versions. Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `0cdb95549f`)	2012-01-10 18:30:08 +01:00
Andriy Gapon	23201c64a7	usb-ohci: td.cbp incorrectly updated near page end The current code that updates the cbp value after a transfer looks like this: td.cbp += ret; if ((td.cbp & 0xfff) + ret > 0xfff) { <handle page overflow> because the 'ret' value is effectively added twice the check may fire too early when the overflow hasn't happened yet. Below is one of the possible changes that correct the behavior: Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>	2012-01-10 09:45:48 -06:00
Gerd Hoffmann	c936f649d4	usb-host: properly release port on unplug & exit Factor out port release into a separate function. Call release function in exit notifier too. Add explicit call the USBDEVFS_RELEASE_PORT ioctl, just closing the hub file handle seems not to be enougth. Make sure we release the port before resetting the device, otherwise host drivers will not re-attach. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>	2012-01-10 09:45:37 -06:00
Gerd Hoffmann	f63d074313	usb-storage: cancel I/O on reset When resetting the usb-storage device we'll have to carefully cancel and clear any requests which might be in flight, otherwise we'll confuse the state machine. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>	2012-01-10 09:45:28 -06:00
Cao,Bing Bu	9b81fbdbb0	Fix parse of usb device description with multiple configurations Changed From V1: Use DPRINTF instead of fprintf,because it is not an error. When testing ipod on QEMU by He Jie Xu<xuhj@linux.vnet.ibm.com>,qemu made a assertion. We found that the ipod with 2 configurations,and the usb-linux did not parse the descriptor correctly. The descr_len returned is the total length of the all configurations,not one configuration. The older version will through the other configurations instead of skip,continue parsing the descriptor of interfaces/endpoints in other configurations,then went wrong. This patch will put the configuration descriptor parse in loop outside and dispel the other configurations not requested. Signed-off-by: Cao,Bing Bu <mars@linux.vnet.ibm.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>	2012-01-10 09:45:14 -06:00
Anthony Liguori	7e2191ae98	pc: fix event_idx compatibility for virtio devices event_idx was introduced in 0.15 and must be disabled for all virtio-pci devices (including virtio-balloon-pci). Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2012-01-10 09:37:20 -06:00
Anthony Liguori	a25808dc5b	pc: add pc-0.15 Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2012-01-10 09:33:28 -06:00
Stefan Sandstrom	3e8088148b	cris: Handle conditional stores on CRISv10 Signed-off-by: Stefan Sandstrom <Stefan.Sandstrom@axis.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>	2012-01-10 09:32:19 -06:00
Brad	6d450bfbc8	configure: Enable build by default PIE / read-only relocation sections on OpenBSD amd64/i386. Enable build by default PIE / read-only relocation sections for the QEMU binaries on OpenBSD amd64/i386. Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>	2012-01-10 09:31:46 -06:00
Andreas Gustafsson	abf80f8804	target-i386: fix cmpxchg instruction emulation When the i386 cmpxchg instruction is executed with a memory operand and the comparison result is "unequal", do the memory write before changing the accumulator instead of the other way around, because otherwise the new accumulator value will incorrectly be used in the comparison when the instruction is restarted after a page fault. This bug was originally reported on 2010-04-25 as https://bugs.launchpad.net/qemu/+bug/569760 Signed-off-by: Andreas Gustafsson <gson@gson.org>	2012-01-10 09:31:37 -06:00
Aneesh Kumar K.V	3d3ec7b809	hw/9pfs: Use the correct signed type for different variables Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:29:25 -06:00
Stefan Hajnoczi	45d6cdff48	hw/9pfs: replace iovec manipulation with QEMUIOVector The v9fs_read() and v9fs_write() functions rely on iovec[] manipulation code should be replaced with QEMUIOVector to avoid duplicating code. In the future it may be possible to make the code even more concise by using QEMUIOVector consistently across virtio and 9pfs. The "v" format specifier for pdu_marshal() and pdu_unmarshal() is dropped since it does not actually pack/unpack anything. The specifier was also not implemented to update the offset variable and could only be used at the end of a format string, another sign that this shouldn't really be a format specifier. Instead, see the new v9fs_init_qiov_from_pdu() function. This change avoids a possible iovec[] buffer overflow when indirect vrings are used since the number of vectors is now limited by the underlying VirtQueueElement and cannot be out-of-bounds. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:29:11 -06:00
Aneesh Kumar K.V	ed6857bf98	hw/9pfs: Use the correct file descriptor in Fsdriver Callback Fsdriver callback that operate on file descriptor need to differentiate between directory fd and file fd. Based on the original patch from Sassan Panahinejad <sassan@sassan.me.uk> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:27:11 -06:00
Aneesh Kumar K.V	64dd41bc2d	hw/9pfs: Add qdev.reset callback for virtio-9p-pci device Add the device reset callback Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:27:00 -06:00
Deepak C Shetty	c554919f74	hw/9pfs: Reset server state during TVERSION As per the 9p rfc, during TVERSION its necessary to clean all the active fids, so that we start the session from a clean state. Its also needed in scenarios where the guest is booting off 9p, and boot fails, and client restarts, without any knowledge of the past, it will issue a TVERSION again so this ensures that we always start from a clean state. Signed-off-by: Deepak C Shetty <deepakcs@linux.vnet.ibm.com> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:26:50 -06:00
Aneesh Kumar K.V	77a0262181	hw/9pfs: use migration blockers to prevent live migration when virtfs export path is mounted Now when you try to migrate with VirtFS export path mounted, you get a proper QMP error: (qemu) migrate tcp:localhost:4444 Migration is disabled when VirtFS export path '/tmp/' is mounted in the guest using mount_tag 'v_tmp' (qemu) Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:26:39 -06:00
Aneesh Kumar K.V	f03969b952	hw/9pfs: Improve portability to older systems handle fs driver require a set of newly added syscalls. Don't Compile handle FS driver if those syscalls are not available. Instead of adding #ifdef for all those syscalls we check for open by handle syscall. If that is available then rest of the syscalls used by the driver should be available. Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>	2012-01-10 09:26:28 -06:00
Andreas Färber	2061800b85	exec.c: Fix subpage memory access to RAM MemoryRegion Commit `95c318f5e1` (Fix segfault in mmio subpage handling code.) prevented a segfault by making all subpage registrations over an existing memory page perform an unassigned access. Symptoms were writes not taking effect and reads returning zero. Very small page sizes are not currently supported either, so subpage memory areas cannot fully be avoided. Therefore change the previous fix to use a new IO_MEM_SUBPAGE_RAM instead of IO_MEM_UNASSIGNED. Suggested by Avi. Reviewed-by: Avi Kivity <avi@redhat.com> Signed-off-by: Andreas Färber <afaerber@suse.de> Cc: Avi Kivity <avi@redhat.com> Cc: Gleb Natapov <gleb@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>	2012-01-10 09:22:55 -06:00
Stefan Weil	0b23c5d40e	malta: Fix regression (i8259 interrupts did not work) Commit `5632ae46d5` passes the address of i8259 to qemu_irq_proxy. i8259 is an auto variable with undefined value outside of mips_malta_init. This made the interrupt proxy unusable: either QEMU crashes, or the interrupt handler was not called. Ethernet for example no longer worked with MIPS Malta. v2: While v1 used a static variable for i8259, this patch introduces a qdev for the malta machine. i8259 is now part of the device status. This is a minimal qdev implementation to keep the patch small. Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `e9b40fd34c`)	2012-01-08 15:11:39 +01:00
@@ -1 +1 @@
 .4.2
 .0,1