Update version for 2.10.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
migration: disable auto-converge during bulk block migration
2017-10-02 12:42:58 -05:00 · 2017-09-28 16:55:44 -05:00 · 2017-09-28 16:55:08 -05:00 · 2017-09-28 16:53:20 -05:00 · 2017-09-28 16:53:11 -05:00 · 2017-09-28 16:53:04 -05:00
3688 changed files with 142084 additions and 527300 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,10 +1,4 @@
-# EditorConfig is a file format and collection of text editor plugins
-# for maintaining consistent coding styles between different editors
-# and IDEs. Most popular editors support this either natively or via
-# plugin.
-#
-# Check https://editorconfig.org for details.
-
+# http://editorconfig.org
 root = true

 [*]
@@ -12,23 +6,10 @@ end_of_line = lf
 insert_final_newline = true
 charset = utf-8

-[*.mak]
-indent_style = tab
-indent_size = 8
-file_type_emacs = makefile
-
 [Makefile*]
 indent_style = tab
 indent_size = 8
-file_type_emacs = makefile

 [*.{c,h}]
 indent_style = space
 indent_size = 4
-
-[*.{vert,frag}]
-file_type_emacs = glsl
-
-[*.json]
-indent_style = space
-file_type_emacs = python
--- a/.gitignore
+++ b/.gitignore
@@ -14,8 +14,6 @@
 /trace/generated-tcg-tracers.h
 /ui/shader/texture-blit-frag.h
 /ui/shader/texture-blit-vert.h
-/ui/shader/texture-blit-flip-vert.h
-/ui/input-keymap-*.c
 *-timestamp
 /*-softmmu
 /*-darwin-user
@@ -27,87 +25,16 @@
 /libuser
 /linux-headers/asm
 /qga/qapi-generated
-/qapi-gen-timestamp
-/qapi/qapi-builtin-types.[ch]
-/qapi/qapi-builtin-visit.[ch]
-/qapi/qapi-commands-block-core.[ch]
-/qapi/qapi-commands-block.[ch]
-/qapi/qapi-commands-char.[ch]
-/qapi/qapi-commands-common.[ch]
-/qapi/qapi-commands-crypto.[ch]
-/qapi/qapi-commands-introspect.[ch]
-/qapi/qapi-commands-job.[ch]
-/qapi/qapi-commands-migration.[ch]
-/qapi/qapi-commands-misc.[ch]
-/qapi/qapi-commands-net.[ch]
-/qapi/qapi-commands-rocker.[ch]
-/qapi/qapi-commands-run-state.[ch]
-/qapi/qapi-commands-sockets.[ch]
-/qapi/qapi-commands-tpm.[ch]
-/qapi/qapi-commands-trace.[ch]
-/qapi/qapi-commands-transaction.[ch]
-/qapi/qapi-commands-ui.[ch]
-/qapi/qapi-commands.[ch]
-/qapi/qapi-events-block-core.[ch]
-/qapi/qapi-events-block.[ch]
-/qapi/qapi-events-char.[ch]
-/qapi/qapi-events-common.[ch]
-/qapi/qapi-events-crypto.[ch]
-/qapi/qapi-events-introspect.[ch]
-/qapi/qapi-events-job.[ch]
-/qapi/qapi-events-migration.[ch]
-/qapi/qapi-events-misc.[ch]
-/qapi/qapi-events-net.[ch]
-/qapi/qapi-events-rocker.[ch]
-/qapi/qapi-events-run-state.[ch]
-/qapi/qapi-events-sockets.[ch]
-/qapi/qapi-events-tpm.[ch]
-/qapi/qapi-events-trace.[ch]
-/qapi/qapi-events-transaction.[ch]
-/qapi/qapi-events-ui.[ch]
-/qapi/qapi-events.[ch]
-/qapi/qapi-introspect.[ch]
-/qapi/qapi-types-block-core.[ch]
-/qapi/qapi-types-block.[ch]
-/qapi/qapi-types-char.[ch]
-/qapi/qapi-types-common.[ch]
-/qapi/qapi-types-crypto.[ch]
-/qapi/qapi-types-introspect.[ch]
-/qapi/qapi-types-job.[ch]
-/qapi/qapi-types-migration.[ch]
-/qapi/qapi-types-misc.[ch]
-/qapi/qapi-types-net.[ch]
-/qapi/qapi-types-rocker.[ch]
-/qapi/qapi-types-run-state.[ch]
-/qapi/qapi-types-sockets.[ch]
-/qapi/qapi-types-tpm.[ch]
-/qapi/qapi-types-trace.[ch]
-/qapi/qapi-types-transaction.[ch]
-/qapi/qapi-types-ui.[ch]
-/qapi/qapi-types.[ch]
-/qapi/qapi-visit-block-core.[ch]
-/qapi/qapi-visit-block.[ch]
-/qapi/qapi-visit-char.[ch]
-/qapi/qapi-visit-common.[ch]
-/qapi/qapi-visit-crypto.[ch]
-/qapi/qapi-visit-introspect.[ch]
-/qapi/qapi-visit-job.[ch]
-/qapi/qapi-visit-migration.[ch]
-/qapi/qapi-visit-misc.[ch]
-/qapi/qapi-visit-net.[ch]
-/qapi/qapi-visit-rocker.[ch]
-/qapi/qapi-visit-run-state.[ch]
-/qapi/qapi-visit-sockets.[ch]
-/qapi/qapi-visit-tpm.[ch]
-/qapi/qapi-visit-trace.[ch]
-/qapi/qapi-visit-transaction.[ch]
-/qapi/qapi-visit-ui.[ch]
-/qapi/qapi-visit.[ch]
-/qapi/qapi-doc.texi
+/qapi-generated
+/qapi-types.[ch]
+/qapi-visit.[ch]
+/qapi-event.[ch]
+/qmp-commands.h
+/qmp-introspect.[ch]
+/qmp-marshal.c
 /qemu-doc.html
 /qemu-doc.info
 /qemu-doc.txt
-/qemu-edid
 /qemu-img
 /qemu-nbd
 /qemu-options.def
@@ -117,17 +44,14 @@
 /qemu-io
 /qemu-ga
 /qemu-bridge-helper
-/qemu-keymap
 /qemu-monitor.texi
 /qemu-monitor-info.texi
 /qemu-version.h
 /qemu-version.h.tmp
 /module_block.h
-/scsi/qemu-pr-helper
+/vscclient
 /vhost-user-scsi
-/vhost-user-blk
 /fsdev/virtfs-proxy-helper
-*.tmp
 *.[1-9]
 *.a
 *.aux
@@ -156,7 +80,6 @@
 .sdk
 *.gcda
 *.gcno
-*.gcov
 /pc-bios/bios-pq/status
 /pc-bios/vgabios-pq/status
 /pc-bios/optionrom/linuxboot.asm
@@ -188,7 +111,6 @@
 /docs/version.texi
 *.tps
 .stgit-*
-.git-submodule-status
 cscope.*
 tags
 TAGS
@@ -212,4 +134,3 @@ trace-dtrace-root.h
 trace-dtrace-root.dtrace
 trace-ust-all.h
 trace-ust-all.c
-/target/arm/decode-sve.inc.c
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,51 +1,39 @@
+[submodule "roms/vgabios"]
+	path = roms/vgabios
+	url = git://git.qemu-project.org/vgabios.git/
 [submodule "roms/seabios"]
 	path = roms/seabios
-	url = https://git.qemu.org/git/seabios.git/
+	url = git://git.qemu-project.org/seabios.git/
 [submodule "roms/SLOF"]
 	path = roms/SLOF
-	url = https://git.qemu.org/git/SLOF.git
+	url = git://git.qemu-project.org/SLOF.git
 [submodule "roms/ipxe"]
 	path = roms/ipxe
-	url = https://git.qemu.org/git/ipxe.git
+	url = git://git.qemu-project.org/ipxe.git
 [submodule "roms/openbios"]
 	path = roms/openbios
-	url = https://git.qemu.org/git/openbios.git
+	url = git://git.qemu-project.org/openbios.git
 [submodule "roms/openhackware"]
 	path = roms/openhackware
-	url = https://git.qemu.org/git/openhackware.git
+	url = git://git.qemu-project.org/openhackware.git
 [submodule "roms/qemu-palcode"]
 	path = roms/qemu-palcode
-	url = https://git.qemu.org/git/qemu-palcode.git
+	url = git://github.com/rth7680/qemu-palcode.git
 [submodule "roms/sgabios"]
 	path = roms/sgabios
-	url = https://git.qemu.org/git/sgabios.git
+	url = git://git.qemu-project.org/sgabios.git
+[submodule "pixman"]
+	path = pixman
+	url = git://anongit.freedesktop.org/pixman
 [submodule "dtc"]
 	path = dtc
-	url = https://git.qemu.org/git/dtc.git
+	url = git://git.qemu-project.org/dtc.git
 [submodule "roms/u-boot"]
 	path = roms/u-boot
-	url = https://git.qemu.org/git/u-boot.git
+	url = git://git.qemu-project.org/u-boot.git
 [submodule "roms/skiboot"]
 	path = roms/skiboot
-	url = https://git.qemu.org/git/skiboot.git
+	url = git://git.qemu.org/skiboot.git
 [submodule "roms/QemuMacDrivers"]
 	path = roms/QemuMacDrivers
-	url = https://git.qemu.org/git/QemuMacDrivers.git
-[submodule "ui/keycodemapdb"]
-	path = ui/keycodemapdb
-	url = https://git.qemu.org/git/keycodemapdb.git
-[submodule "capstone"]
-	path = capstone
-	url = https://git.qemu.org/git/capstone.git
-[submodule "roms/seabios-hppa"]
-	path = roms/seabios-hppa
-	url = https://github.com/hdeller/seabios-hppa.git
-[submodule "roms/u-boot-sam460ex"]
-	path = roms/u-boot-sam460ex
-	url = https://git.qemu.org/git/u-boot-sam460ex.git
-[submodule "tests/fp/berkeley-testfloat-3"]
-	path = tests/fp/berkeley-testfloat-3
-	url = https://github.com/cota/berkeley-testfloat-3
-[submodule "tests/fp/berkeley-softfloat-3"]
-	path = tests/fp/berkeley-softfloat-3
-	url = https://github.com/cota/berkeley-softfloat-3
+	url = git://git.qemu.org/QemuMacDrivers.git
--- a/.gitpublish
+++ b/.gitpublish
@@ -1,51 +0,0 @@
-#
-# Common git-publish profiles that can be used to send patches to QEMU upstream.
-#
-# See https://github.com/stefanha/git-publish for more information
-#
-[gitpublishprofile "default"]
-base = master
-to = qemu-devel@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "rfc"]
-base = master
-prefix = RFC PATCH
-to = qemu-devel@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "stable"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-stable@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "trivial"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-trivial@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "block"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-block@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "arm"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-arm@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "s390"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-s390@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
-
-[gitpublishprofile "ppc"]
-base = master
-to = qemu-devel@nongnu.org
-cc = qemu-ppc@nongnu.org
-cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
--- a/.mailmap
+++ b/.mailmap
@@ -1,7 +1,6 @@
-# This mailmap fixes up author names/addresses.
-
-# The first section translates weird addresses from the original git import
-# into proper addresses so that they are counted properly by git shortlog.
+# This mailmap just translates the weird addresses from the original import into git
+# into proper addresses so that they are counted properly in git shortlog output.
+#
 Andrzej Zaborowski <balrogg@gmail.com> balrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>
 Anthony Liguori <anthony@codemonkey.ws> aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
@@ -9,31 +8,10 @@ Aurelien Jarno <aurelien@aurel32.net> aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-7
 Blue Swirl <blauwirbel@gmail.com> blueswir1 <blueswir1@c046a42c-6fe2-441c-8c8c-71466251a162>
 Edgar E. Iglesias <edgar.iglesias@gmail.com> edgar_igl <edgar_igl@c046a42c-6fe2-441c-8c8c-71466251a162>
 Fabrice Bellard <fabrice@bellard.org> bellard <bellard@c046a42c-6fe2-441c-8c8c-71466251a162>
-James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Jocelyn Mayer <l_indien@magic.fr> j_mayer <j_mayer@c046a42c-6fe2-441c-8c8c-71466251a162>
 Paul Brook <paul@codesourcery.com> pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
-Yongbok Kim <yongbok.kim@mips.com> <yongbok.kim@imgtec.com>
-Aleksandar Markovic <amarkovic@wavecomp.com> <aleksandar.markovic@mips.com>
-Aleksandar Markovic <amarkovic@wavecomp.com> <aleksandar.markovic@imgtec.com>
-Paul Burton <pburton@wavecomp.com> <paul.burton@mips.com>
-Paul Burton <pburton@wavecomp.com> <paul.burton@imgtec.com>
-Paul Burton <pburton@wavecomp.com> <paul@archlinuxmips.org>
 Thiemo Seufer <ths@networkno.de> ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162>
 malc <av1474@comtv.ru> malc <malc@c046a42c-6fe2-441c-8c8c-71466251a162>
-
 # There is also a:
 #    (no author) <(no author)@c046a42c-6fe2-441c-8c8c-71466251a162>
 # for the cvs2svn initialization commit e63c3dc74bf.
-
-# Next, translate a few commits where mailman rewrote the From: line due
-# to strict SPF, although we prefer to avoid adding more entries like that.
-Ed Swierk <eswierk@skyportsystems.com> Ed Swierk via Qemu-devel <qemu-devel@nongnu.org>
-Ian McKellar <ianloic@google.com> Ian McKellar via Qemu-devel <qemu-devel@nongnu.org>
-Julia Suvorova <jusual@mail.ru> Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>
-Justin Terry (VM) <juterry@microsoft.com> Justin Terry (VM) via Qemu-devel <qemu-devel@nongnu.org>
-
-
-# Also list preferred name forms where people have changed their
-# git author config, or having utf8/latin1 encoding issues.
-Daniel P. Berrangé <berrange@redhat.com>
-Reimar Döffinger <Reimar.Doeffinger@gmx.de>
--- a/.shippable.yml
+++ b/.shippable.yml
@@ -23,6 +23,8 @@ env:
      TARGET_LIST=mips-softmmu,mipsel-linux-user
    - IMAGE=debian-mips64el-cross
      TARGET_LIST=mips64el-softmmu,mips64el-linux-user
+    - IMAGE=debian-powerpc-cross
+      TARGET_LIST=ppc-softmmu,ppcemb-softmmu,ppc-linux-user
    - IMAGE=debian-ppc64el-cross
      TARGET_LIST=ppc64-softmmu,ppc64-linux-user,ppc64abi32-linux-user
 build:
@@ -35,5 +37,13 @@ build:
    options: "-e HOME=/root"
  ci:
    - unset CC
+    # some targets require newer up to date packages, for example TARGET_LIST matching
+    # aarch64*-softmmu|arm*-softmmu|ppc*-softmmu|microblaze*-softmmu|mips64el-softmmu)
+    # see the configure script:
+    #    error_exit "DTC (libfdt) version >= 1.4.2 not present. Your options:"
+    #    "  (1) Preferred: Install the DTC (libfdt) devel package"
+    #    "  (2) Fetch the DTC submodule, using:"
+    #    "      git submodule update --init dtc"
+    - dpkg --compare-versions `dpkg-query --showformat='${Version}' --show libfdt-dev` ge 1.4.2 || git submodule update --init dtc
    - ./configure ${QEMU_CONFIGURE_OPTS} --target-list=${TARGET_LIST}
    - make -j$(($(getconf _NPROCESSORS_ONLN) + 1))
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,11 +1,7 @@
-# The current Travis default is a container based 14.04 Trust on EC2
-# Additional builds with specific requirements for a full VM need to
-# be added as additional matrix: entries later on
 sudo: false
-dist: trusty
 language: c
 python:
-  - "2.6"
+  - "2.4"
 compiler:
  - gcc
 cache: ccache
@@ -17,13 +13,12 @@ addons:
      - libattr1-dev
      - libbrlapi-dev
      - libcap-ng-dev
-      - libgcc-4.8-dev
      - libgnutls-dev
      - libgtk-3-dev
      - libiscsi-dev
      - liblttng-ust-dev
-      - libncurses5-dev
      - libnfs-dev
+      - libncurses5-dev
      - libnss3-dev
      - libpixman-1-dev
      - libpng12-dev
@@ -38,7 +33,6 @@ addons:
      - libvte-2.90-dev
      - sparse
      - uuid-dev
-      - gcovr

 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
 # to prevent IRC notifications from forks. This was created using:
@@ -51,97 +45,124 @@ notifications:
    on_failure: always
 env:
  global:
-    - SRC_DIR="."
-    - BUILD_DIR="."
    - TEST_CMD="make check"
    - MAKEFLAGS="-j3"
  matrix:
-    - CONFIG="--disable-system"
-    - CONFIG="--disable-user"
-    - CONFIG="--enable-debug --enable-debug-tcg"
-    - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-uuid --disable-libusb --disable-user"
-    - CONFIG="--enable-modules --disable-linux-user"
-    - CONFIG="--with-coroutine=ucontext --disable-linux-user"
-    - CONFIG="--with-coroutine=sigaltstack --disable-linux-user"
+    - CONFIG=""
+    - CONFIG="--enable-debug --enable-debug-tcg --enable-trace-backends=log"
+    - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-uuid --disable-libusb"
+    - CONFIG="--enable-modules"
+    - CONFIG="--with-coroutine=ucontext"
+    - CONFIG="--with-coroutine=sigaltstack"
 git:
  # we want to do this ourselves
  submodules: false
 before_install:
  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update ; fi
  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew install libffi gettext glib pixman ; fi
-  - git submodule update --init --recursive capstone dtc ui/keycodemapdb
+  - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
+  - git submodule update --init --recursive
 before_script:
-  - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
-  - ${SRC_DIR}/configure ${CONFIG} || { cat config.log && exit 1; }
+  - ./configure ${CONFIG}
 script:
  - make ${MAKEFLAGS} && ${TEST_CMD}
 matrix:
  include:
-    # Test out-of-tree builds
-    - env: CONFIG="--enable-debug --enable-debug-tcg"
-           BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
-    # Test with Clang for compile portability (Travis uses clang-5.0)
-    - env: CONFIG="--disable-system"
-      compiler: clang
-    - env: CONFIG="--disable-user"
+    # Test with CLang for compile portability
+    - env: CONFIG=""
      compiler: clang
    # gprof/gcov are GCC features
-    - env: CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
-      after_success:
-        - ${SRC_DIR}/scripts/travis/coverage-summary.sh
+    - env: CONFIG="--enable-gprof --enable-gcov --disable-pie"
      compiler: gcc
    # We manually include builds which we disable "make check" for
    - env: CONFIG="--enable-debug --enable-tcg-interpreter"
           TEST_CMD=""
      compiler: gcc
-    # We don't need to exercise every backend with every front-end
-    - env: CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
+    - env: CONFIG="--enable-trace-backends=simple"
           TEST_CMD=""
      compiler: gcc
-    - env: CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
+    - env: CONFIG="--enable-trace-backends=ftrace"
           TEST_CMD=""
      compiler: gcc
-    - env: CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
+    - env: CONFIG="--enable-trace-backends=ust"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG="--disable-tcg"
           TEST_CMD=""
      compiler: gcc
-    # MacOSX builds
-    - env: CONFIG="--target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
+    - env: CONFIG=""
      os: osx
-      osx_image: xcode9.4
      compiler: clang
-    - env: CONFIG="--target-list=i386-softmmu,ppc-softmmu,ppc64-softmmu,m68k-softmmu,x86_64-softmmu"
-      os: osx
-      osx_image: xcode10
-      compiler: clang
-    # Python builds
-    - env: CONFIG="--target-list=x86_64-softmmu"
-      python:
-        - "3.0"
-    - env: CONFIG="--target-list=x86_64-softmmu"
-      python:
-        - "3.6"
-    # Acceptance (Functional) tests
-    - env: CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
-           TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
+    # Plain Trusty System Build
+    - env: CONFIG="--disable-linux-user"
+      sudo: required
      addons:
-        apt:
-          packages:
-            - python3-pip
-            - python3.4-venv
+      dist: trusty
+      compiler: gcc
+      before_install:
+        - sudo apt-get update -qq
+        - sudo apt-get build-dep -qq qemu
+        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
+        - git submodule update --init --recursive
+    # Plain Trusty Linux User Build
+    - env: CONFIG="--disable-system"
+      sudo: required
+      addons:
+      dist: trusty
+      compiler: gcc
+      before_install:
+        - sudo apt-get update -qq
+        - sudo apt-get build-dep -qq qemu
+        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
+        - git submodule update --init --recursive
+    # Trusty System build with latest stable clang
+    - sudo: required
+      addons:
+      dist: trusty
+      language: generic
+      compiler: none
+      env:
+        - COMPILER_NAME=clang CXX=clang++-3.9 CC=clang-3.9
+        - CONFIG="--disable-linux-user --cc=clang-3.9 --cxx=clang++-3.9"
+      before_install:
+        - wget -nv -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
+        - sudo apt-add-repository -y 'deb http://llvm.org/apt/trusty llvm-toolchain-trusty-3.9 main'
+        - sudo apt-get update -qq
+        - sudo apt-get install -qq -y clang-3.9
+        - sudo apt-get build-dep -qq qemu
+        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
+        - git submodule update --init --recursive
+      before_script:
+        - ./configure ${CONFIG} || cat config.log
+    # Trusty Linux User build with latest stable clang
+    - sudo: required
+      addons:
+      dist: trusty
+      language: generic
+      compiler: none
+      env:
+        - COMPILER_NAME=clang CXX=clang++-3.9 CC=clang-3.9
+        - CONFIG="--disable-system --cc=clang-3.9 --cxx=clang++-3.9"
+      before_install:
+        - wget -nv -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
+        - sudo apt-add-repository -y 'deb http://llvm.org/apt/trusty llvm-toolchain-trusty-3.9 main'
+        - sudo apt-get update -qq
+        - sudo apt-get install -qq -y clang-3.9
+        - sudo apt-get build-dep -qq qemu
+        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
+        - git submodule update --init --recursive
+      before_script:
+        - ./configure ${CONFIG} || cat config.log
    # Using newer GCC with sanitizers
    - addons:
        apt:
-          update: true
          sources:
            # PPAs for newer toolchains
            - ubuntu-toolchain-r-test
          packages:
            # Extra toolchains
-            - gcc-7
-            - g++-7
+            - gcc-5
+            - g++-5
            # Build dependencies
            - libaio-dev
            - libattr1-dev
@@ -170,16 +191,8 @@ matrix:
      language: generic
      compiler: none
      env:
-        - COMPILER_NAME=gcc CXX=g++-7 CC=gcc-7
-        - CONFIG="--cc=gcc-7 --cxx=g++-7 --disable-pie --disable-linux-user"
+        - COMPILER_NAME=gcc CXX=g++-5 CC=gcc-5
+        - CONFIG="--cc=gcc-5 --cxx=g++-5 --disable-pie --disable-linux-user"
        - TEST_CMD=""
      before_script:
-        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || { cat config.log && exit 1; }
-    - env:
-        - CONFIG="--disable-system --disable-docs"
-        - TEST_CMD="make check-tcg"
-      script:
-        - make ${MAKEFLAGS} && ${TEST_CMD} ${MAKEFLAGS}
-      sudo: required
-      dist: trusty
-      compiler: gcc
+        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || cat config.log
--- a/17
+++ b/17
@@ -124,23 +124,6 @@ We use traditional C-style /* */ comments and avoid // comments.
 Rationale: The // form is valid in C99, so this is purely a matter of
 consistency of style. The checkpatch script will warn you about this.

-Multiline comment blocks should have a row of stars on the left,
-and the initial /* and terminating */ both on their own lines:
-    /*
-     * like
-     * this
-     */
-This is the same format required by the Linux kernel coding style.
-
-(Some of the existing comments in the codebase use the GNU Coding
-Standards form which does not have stars on the left, or other
-variations; avoid these when writing new comments, but don't worry
-about converting to the preferred form unless you're editing that
-comment anyway.)
-
-Rationale: Consistency, and ease of visually picking out a multiline
-comment from the surrounding code.
-
 8. trace-events style

 8.1 0x prefix
--- a/2
+++ b/2
@@ -1,6 +1,6 @@
 This file documents changes for QEMU releases 0.12 and earlier.
 For changelog information for later releases, see
-https://wiki.qemu.org/ChangeLog or look at the git history for
+http://wiki.qemu-project.org/ChangeLog or look at the git history for
 more detailed information.


--- a/9
+++ b/9
@@ -118,15 +118,6 @@ Please note that g_malloc will exit on allocation failure, so there
 is no need to test for failure (as you would have to with malloc).
 Calling g_malloc with a zero size is valid and will return NULL.

-Prefer g_new(T, n) instead of g_malloc(sizeof(T) * n) for the following
-reasons:
-
-  a. It catches multiplication overflowing size_t;
-  b. It returns T * instead of void *, letting compiler catch more type
-     errors.
-
-Declarations like T *v = g_malloc(sizeof(*v)) are acceptable, though.
-
 Memory allocated by qemu_memalign or qemu_blockalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32.

--- a/817
+++ b/817
--- a/497
+++ b/497
@@ -6,13 +6,7 @@ BUILD_DIR=$(CURDIR)
 # Before including a proper config-host.mak, assume we are in the source tree
 SRC_PATH=.

-UNCHECKED_GOALS := %clean TAGS cscope ctags dist \
-    html info pdf txt \
-    help check-help print-% \
-    docker docker-% vm-test vm-build-%
-
-print-%:
-	@echo '$*=$($*)'
+UNCHECKED_GOALS := %clean TAGS cscope ctags docker docker-%

 # All following code might depend on configuration variables
 ifneq ($(wildcard config-host.mak),)
@@ -20,43 +14,13 @@ ifneq ($(wildcard config-host.mak),)
 all:
 include config-host.mak

-git-submodule-update:
-
-.PHONY: git-submodule-update
-
-git_module_status := $(shell \
-  cd '$(SRC_PATH)' && \
-  GIT="$(GIT)" ./scripts/git-submodule.sh status $(GIT_SUBMODULES); \
-  echo $$?; \
-)
-
-ifeq (1,$(git_module_status))
-ifeq (no,$(GIT_UPDATE))
-git-submodule-update:
-	$(call quiet-command, \
-            echo && \
-            echo "GIT submodule checkout is out of date. Please run" && \
-            echo "  scripts/git-submodule.sh update $(GIT_SUBMODULES)" && \
-            echo "from the source directory checkout $(SRC_PATH)" && \
-            echo && \
-            exit 1)
-else
-git-submodule-update:
-	$(call quiet-command, \
-          (cd $(SRC_PATH) && GIT="$(GIT)" ./scripts/git-submodule.sh update $(GIT_SUBMODULES)), \
-          "GIT","$(GIT_SUBMODULES)")
-endif
-endif
-
-.git-submodule-status: git-submodule-update config-host.mak
-
 # Check that we're not trying to do an out-of-tree build from
 # a tree that's been used for an in-tree build.
 ifneq ($(realpath $(SRC_PATH)),$(realpath .))
 ifneq ($(wildcard $(SRC_PATH)/config-host.mak),)
 $(error This is an out of tree build but your source tree ($(SRC_PATH)) \
 seems to have been used for an in-tree build. You can fix this by running \
-"$(MAKE) distclean && rm -rf *-linux-user *-softmmu" in your source tree)
+"make distclean && rm -rf *-linux-user *-softmmu" in your source tree)
 endif
 endif

@@ -88,82 +52,10 @@ endif
 include $(SRC_PATH)/rules.mak

 GENERATED_FILES = qemu-version.h config-host.h qemu-options.def
-GENERATED_FILES += qapi/qapi-builtin-types.h qapi/qapi-builtin-types.c
-GENERATED_FILES += qapi/qapi-types.h qapi/qapi-types.c
-GENERATED_FILES += qapi/qapi-types-block-core.h qapi/qapi-types-block-core.c
-GENERATED_FILES += qapi/qapi-types-block.h qapi/qapi-types-block.c
-GENERATED_FILES += qapi/qapi-types-char.h qapi/qapi-types-char.c
-GENERATED_FILES += qapi/qapi-types-common.h qapi/qapi-types-common.c
-GENERATED_FILES += qapi/qapi-types-crypto.h qapi/qapi-types-crypto.c
-GENERATED_FILES += qapi/qapi-types-introspect.h qapi/qapi-types-introspect.c
-GENERATED_FILES += qapi/qapi-types-job.h qapi/qapi-types-job.c
-GENERATED_FILES += qapi/qapi-types-migration.h qapi/qapi-types-migration.c
-GENERATED_FILES += qapi/qapi-types-misc.h qapi/qapi-types-misc.c
-GENERATED_FILES += qapi/qapi-types-net.h qapi/qapi-types-net.c
-GENERATED_FILES += qapi/qapi-types-rocker.h qapi/qapi-types-rocker.c
-GENERATED_FILES += qapi/qapi-types-run-state.h qapi/qapi-types-run-state.c
-GENERATED_FILES += qapi/qapi-types-sockets.h qapi/qapi-types-sockets.c
-GENERATED_FILES += qapi/qapi-types-tpm.h qapi/qapi-types-tpm.c
-GENERATED_FILES += qapi/qapi-types-trace.h qapi/qapi-types-trace.c
-GENERATED_FILES += qapi/qapi-types-transaction.h qapi/qapi-types-transaction.c
-GENERATED_FILES += qapi/qapi-types-ui.h qapi/qapi-types-ui.c
-GENERATED_FILES += qapi/qapi-builtin-visit.h qapi/qapi-builtin-visit.c
-GENERATED_FILES += qapi/qapi-visit.h qapi/qapi-visit.c
-GENERATED_FILES += qapi/qapi-visit-block-core.h qapi/qapi-visit-block-core.c
-GENERATED_FILES += qapi/qapi-visit-block.h qapi/qapi-visit-block.c
-GENERATED_FILES += qapi/qapi-visit-char.h qapi/qapi-visit-char.c
-GENERATED_FILES += qapi/qapi-visit-common.h qapi/qapi-visit-common.c
-GENERATED_FILES += qapi/qapi-visit-crypto.h qapi/qapi-visit-crypto.c
-GENERATED_FILES += qapi/qapi-visit-introspect.h qapi/qapi-visit-introspect.c
-GENERATED_FILES += qapi/qapi-visit-job.h qapi/qapi-visit-job.c
-GENERATED_FILES += qapi/qapi-visit-migration.h qapi/qapi-visit-migration.c
-GENERATED_FILES += qapi/qapi-visit-misc.h qapi/qapi-visit-misc.c
-GENERATED_FILES += qapi/qapi-visit-net.h qapi/qapi-visit-net.c
-GENERATED_FILES += qapi/qapi-visit-rocker.h qapi/qapi-visit-rocker.c
-GENERATED_FILES += qapi/qapi-visit-run-state.h qapi/qapi-visit-run-state.c
-GENERATED_FILES += qapi/qapi-visit-sockets.h qapi/qapi-visit-sockets.c
-GENERATED_FILES += qapi/qapi-visit-tpm.h qapi/qapi-visit-tpm.c
-GENERATED_FILES += qapi/qapi-visit-trace.h qapi/qapi-visit-trace.c
-GENERATED_FILES += qapi/qapi-visit-transaction.h qapi/qapi-visit-transaction.c
-GENERATED_FILES += qapi/qapi-visit-ui.h qapi/qapi-visit-ui.c
-GENERATED_FILES += qapi/qapi-commands.h qapi/qapi-commands.c
-GENERATED_FILES += qapi/qapi-commands-block-core.h qapi/qapi-commands-block-core.c
-GENERATED_FILES += qapi/qapi-commands-block.h qapi/qapi-commands-block.c
-GENERATED_FILES += qapi/qapi-commands-char.h qapi/qapi-commands-char.c
-GENERATED_FILES += qapi/qapi-commands-common.h qapi/qapi-commands-common.c
-GENERATED_FILES += qapi/qapi-commands-crypto.h qapi/qapi-commands-crypto.c
-GENERATED_FILES += qapi/qapi-commands-introspect.h qapi/qapi-commands-introspect.c
-GENERATED_FILES += qapi/qapi-commands-job.h qapi/qapi-commands-job.c
-GENERATED_FILES += qapi/qapi-commands-migration.h qapi/qapi-commands-migration.c
-GENERATED_FILES += qapi/qapi-commands-misc.h qapi/qapi-commands-misc.c
-GENERATED_FILES += qapi/qapi-commands-net.h qapi/qapi-commands-net.c
-GENERATED_FILES += qapi/qapi-commands-rocker.h qapi/qapi-commands-rocker.c
-GENERATED_FILES += qapi/qapi-commands-run-state.h qapi/qapi-commands-run-state.c
-GENERATED_FILES += qapi/qapi-commands-sockets.h qapi/qapi-commands-sockets.c
-GENERATED_FILES += qapi/qapi-commands-tpm.h qapi/qapi-commands-tpm.c
-GENERATED_FILES += qapi/qapi-commands-trace.h qapi/qapi-commands-trace.c
-GENERATED_FILES += qapi/qapi-commands-transaction.h qapi/qapi-commands-transaction.c
-GENERATED_FILES += qapi/qapi-commands-ui.h qapi/qapi-commands-ui.c
-GENERATED_FILES += qapi/qapi-events.h qapi/qapi-events.c
-GENERATED_FILES += qapi/qapi-events-block-core.h qapi/qapi-events-block-core.c
-GENERATED_FILES += qapi/qapi-events-block.h qapi/qapi-events-block.c
-GENERATED_FILES += qapi/qapi-events-char.h qapi/qapi-events-char.c
-GENERATED_FILES += qapi/qapi-events-common.h qapi/qapi-events-common.c
-GENERATED_FILES += qapi/qapi-events-crypto.h qapi/qapi-events-crypto.c
-GENERATED_FILES += qapi/qapi-events-introspect.h qapi/qapi-events-introspect.c
-GENERATED_FILES += qapi/qapi-events-job.h qapi/qapi-events-job.c
-GENERATED_FILES += qapi/qapi-events-migration.h qapi/qapi-events-migration.c
-GENERATED_FILES += qapi/qapi-events-misc.h qapi/qapi-events-misc.c
-GENERATED_FILES += qapi/qapi-events-net.h qapi/qapi-events-net.c
-GENERATED_FILES += qapi/qapi-events-rocker.h qapi/qapi-events-rocker.c
-GENERATED_FILES += qapi/qapi-events-run-state.h qapi/qapi-events-run-state.c
-GENERATED_FILES += qapi/qapi-events-sockets.h qapi/qapi-events-sockets.c
-GENERATED_FILES += qapi/qapi-events-tpm.h qapi/qapi-events-tpm.c
-GENERATED_FILES += qapi/qapi-events-trace.h qapi/qapi-events-trace.c
-GENERATED_FILES += qapi/qapi-events-transaction.h qapi/qapi-events-transaction.c
-GENERATED_FILES += qapi/qapi-events-ui.h qapi/qapi-events-ui.c
-GENERATED_FILES += qapi/qapi-introspect.c qapi/qapi-introspect.h
-GENERATED_FILES += qapi/qapi-doc.texi
+GENERATED_FILES += qmp-commands.h qapi-types.h qapi-visit.h qapi-event.h
+GENERATED_FILES += qmp-marshal.c qapi-types.c qapi-visit.c qapi-event.c
+GENERATED_FILES += qmp-introspect.h
+GENERATED_FILES += qmp-introspect.c

 GENERATED_FILES += trace/generated-tcg-tracers.h

@@ -192,7 +84,6 @@ endif
 GENERATED_FILES += $(TRACE_HEADERS)
 GENERATED_FILES += $(TRACE_SOURCES)
 GENERATED_FILES += $(BUILD_DIR)/trace-events-all
-GENERATED_FILES += .git-submodule-status

 trace-group-name = $(shell dirname $1 | sed -e 's/[^a-zA-Z0-9]/_/g')

@@ -300,64 +191,24 @@ trace-dtrace-root.h: trace-dtrace-root.dtrace

 trace-dtrace-root.o: trace-dtrace-root.dtrace

-KEYCODEMAP_GEN = $(SRC_PATH)/ui/keycodemapdb/tools/keymap-gen
-KEYCODEMAP_CSV = $(SRC_PATH)/ui/keycodemapdb/data/keymaps.csv
-
-KEYCODEMAP_FILES = \
-		 ui/input-keymap-atset1-to-qcode.c \
-		 ui/input-keymap-linux-to-qcode.c \
-		 ui/input-keymap-qcode-to-atset1.c \
-		 ui/input-keymap-qcode-to-atset2.c \
-		 ui/input-keymap-qcode-to-atset3.c \
-		 ui/input-keymap-qcode-to-linux.c \
-		 ui/input-keymap-qcode-to-qnum.c \
-		 ui/input-keymap-qcode-to-sun.c \
-		 ui/input-keymap-qnum-to-qcode.c \
-		 ui/input-keymap-usb-to-qcode.c \
-		 ui/input-keymap-win32-to-qcode.c \
-		 ui/input-keymap-x11-to-qcode.c \
-		 ui/input-keymap-xorgevdev-to-qcode.c \
-		 ui/input-keymap-xorgkbd-to-qcode.c \
-		 ui/input-keymap-xorgxquartz-to-qcode.c \
-		 ui/input-keymap-xorgxwin-to-qcode.c \
-		 ui/input-keymap-osx-to-qcode.c \
-		 $(NULL)
-
-GENERATED_FILES += $(KEYCODEMAP_FILES)
-
-ui/input-keymap-%.c: $(KEYCODEMAP_GEN) $(KEYCODEMAP_CSV) $(SRC_PATH)/ui/Makefile.objs
-	$(call quiet-command,\
-	    stem=$* && src=$${stem%-to-*} dst=$${stem#*-to-} && \
-	    test -e $(KEYCODEMAP_GEN) && \
-	    $(PYTHON) $(KEYCODEMAP_GEN) \
-	          --lang glib2 \
-	          --varname qemu_input_map_$${src}_to_$${dst} \
-	          code-map $(KEYCODEMAP_CSV) $${src} $${dst} \
-	        > $@ || rm -f $@, "GEN", "$@")
-
-$(KEYCODEMAP_GEN): .git-submodule-status
-$(KEYCODEMAP_CSV): .git-submodule-status
-
 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
 Makefile: ;
 configure: ;

 .PHONY: all clean cscope distclean html info install install-doc \
-	pdf txt recurse-all dist msi FORCE
+	pdf txt recurse-all speed test dist msi FORCE

 $(call set-vpath, $(SRC_PATH))

 LIBS+=-lz $(LIBS_TOOLS)

-HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXESUF)
+HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF)

 ifdef BUILD_DOCS
 DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
 DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
-DOCS+=docs/qemu-block-drivers.7
-DOCS+=docs/qemu-cpu-models.7
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
@@ -365,7 +216,7 @@ else
 DOCS=
 endif

-SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory --quiet) BUILD_DIR=$(BUILD_DIR)
+SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory) BUILD_DIR=$(BUILD_DIR)
 SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
 SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %-config-devices.mak.d, $(TARGET_DIRS))

@@ -395,7 +246,7 @@ endif
 	    else \
 	      echo "WARNING: $@ out of date.";\
 	    fi; \
-	    echo "Run \"$(MAKE) defconfig\" to regenerate."; \
+	    echo "Run \"make defconfig\" to regenerate."; \
 	    rm $@.tmp; \
 	  fi; \
 	 else \
@@ -415,12 +266,10 @@ dummy := $(call unnest-vars,, \
                chardev-obj-y \
                util-obj-y \
                qga-obj-y \
-                elf2dmp-obj-y \
                ivshmem-client-obj-y \
                ivshmem-server-obj-y \
                libvhost-user-obj-y \
                vhost-user-scsi-obj-y \
-                vhost-user-blk-obj-y \
                qga-vss-dll-obj-y \
                block-obj-y \
                block-obj-m \
@@ -430,10 +279,6 @@ dummy := $(call unnest-vars,, \
                io-obj-y \
                common-obj-y \
                common-obj-m \
-                ui-obj-y \
-                ui-obj-m \
-                audio-obj-y \
-                audio-obj-m \
                trace-obj-y)

 include $(SRC_PATH)/tests/Makefile.include
@@ -443,23 +288,21 @@ all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules
 qemu-version.h: FORCE
 	$(call quiet-command, \
 		(cd $(SRC_PATH); \
+		printf '#define QEMU_PKGVERSION '; \
 		if test -n "$(PKGVERSION)"; then \
-			pkgvers="$(PKGVERSION)"; \
+			printf '"$(PKGVERSION)"\n'; \
 		else \
 			if test -d .git; then \
-				pkgvers=$$(git describe --match 'v*' 2>/dev/null | tr -d '\n');\
+				printf '" ('; \
+				git describe --match 'v*' 2>/dev/null | tr -d '\n'; \
 				if ! git diff-index --quiet HEAD &>/dev/null; then \
-					pkgvers="$${pkgvers}-dirty"; \
+					printf -- '-dirty'; \
 				fi; \
+				printf ')"\n'; \
+			else \
+				printf '""\n'; \
 			fi; \
-		fi; \
-		printf "#define QEMU_PKGVERSION \"$${pkgvers}\"\n"; \
-		if test -n "$${pkgvers}"; then \
-			printf '#define QEMU_FULL_VERSION QEMU_VERSION " (" QEMU_PKGVERSION ")"\n'; \
-		else \
-			printf '#define QEMU_FULL_VERSION QEMU_VERSION\n'; \
-		fi; \
-		) > $@.tmp)
+		fi) > $@.tmp)
 	$(call quiet-command, if ! cmp -s $@ $@.tmp; then \
 	  mv $@.tmp $@; \
 	 else \
@@ -482,32 +325,26 @@ $(SOFTMMU_SUBDIR_RULES): config-all-devices.mak
 subdir-%:
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C $* V="$(V)" TARGET_DIR="$*/" all,)

+subdir-pixman: pixman/Makefile
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C pixman V="$(V)" all,)
+
+pixman/Makefile: $(SRC_PATH)/pixman/configure
+	(cd pixman; CFLAGS="$(CFLAGS) -fPIC $(extra_cflags) $(extra_ldflags)" $(SRC_PATH)/pixman/configure $(AUTOCONF_HOST) --disable-gtk --disable-shared --enable-static)
+
+$(SRC_PATH)/pixman/configure:
+	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
+
 DTC_MAKE_ARGS=-I$(SRC_PATH)/dtc VPATH=$(SRC_PATH)/dtc -C dtc V="$(V)" LIBFDT_srcdir=$(SRC_PATH)/dtc/libfdt
 DTC_CFLAGS=$(CFLAGS) $(QEMU_CFLAGS)
 DTC_CPPFLAGS=-I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt

-subdir-dtc: .git-submodule-status dtc/libfdt dtc/tests
+subdir-dtc:dtc/libfdt dtc/tests
 	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CPPFLAGS="$(DTC_CPPFLAGS)" CFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt/libfdt.a,)

-dtc/%: .git-submodule-status
-	@mkdir -p $@
+dtc/%:
+	mkdir -p $@

-# Overriding CFLAGS causes us to lose defines added in the sub-makefile.
-# Not overriding CFLAGS leads to mis-matches between compilation modes.
-# Therefore we replicate some of the logic in the sub-makefile.
-# Remove all the extra -Warning flags that QEMU uses that Capstone doesn't;
-# no need to annoy QEMU developers with such things.
-CAP_CFLAGS = $(patsubst -W%,,$(CFLAGS) $(QEMU_CFLAGS))
-CAP_CFLAGS += -DCAPSTONE_USE_SYS_DYN_MEM
-CAP_CFLAGS += -DCAPSTONE_HAS_ARM
-CAP_CFLAGS += -DCAPSTONE_HAS_ARM64
-CAP_CFLAGS += -DCAPSTONE_HAS_POWERPC
-CAP_CFLAGS += -DCAPSTONE_HAS_X86
-
-subdir-capstone: .git-submodule-status
-	$(call quiet-command,$(MAKE) -C $(SRC_PATH)/capstone CAPSTONE_SHARED=no BUILDDIR="$(BUILD_DIR)/capstone" CC="$(CC)" AR="$(AR)" LD="$(LD)" RANLIB="$(RANLIB)" CFLAGS="$(CAP_CFLAGS)" $(SUBDIR_MAKEFLAGS) $(BUILD_DIR)/capstone/$(LIBCAPSTONE))
-
-$(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) \
+$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y) $(chardev-obj-y) \
 	$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
@@ -527,12 +364,12 @@ Makefile: $(version-obj-y)
 ######################################################################
 # Build libraries

-libqemuutil.a: $(util-obj-y) $(trace-obj-y) $(stub-obj-y)
-libvhost-user.a: $(libvhost-user-obj-y)
+libqemustub.a: $(stub-obj-y)
+libqemuutil.a: $(util-obj-y) $(trace-obj-y)

 ######################################################################

-COMMON_LDADDS = libqemuutil.a
+COMMON_LDADDS = libqemuutil.a libqemustub.a

 qemu-img.o: qemu-img-cmds.h

@@ -542,148 +379,68 @@ qemu-io$(EXESUF): qemu-io.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o $(COMMON_LDADDS)

-qemu-keymap$(EXESUF): qemu-keymap.o ui/input-keymap.o $(COMMON_LDADDS)
-
-qemu-edid$(EXESUF): qemu-edid.o hw/display/edid-generate.o $(COMMON_LDADDS)
-
 fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal.o fsdev/9p-iov-marshal.o $(COMMON_LDADDS)
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

-scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
-ifdef CONFIG_MPATH
-scsi/qemu-pr-helper$(EXESUF): LIBS += -ludev -lmultipath -lmpathpersist
-endif
-
 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$@")

 qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)
 qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated

-qemu-keymap$(EXESUF): LIBS += $(XKBCOMMON_LIBS)
-qemu-keymap$(EXESUF): QEMU_CFLAGS += $(XKBCOMMON_CFLAGS)
+gen-out-type = $(subst .,-,$(suffix $@))

-qapi-py = $(SRC_PATH)/scripts/qapi/commands.py \
-$(SRC_PATH)/scripts/qapi/events.py \
-$(SRC_PATH)/scripts/qapi/introspect.py \
-$(SRC_PATH)/scripts/qapi/types.py \
-$(SRC_PATH)/scripts/qapi/visit.py \
-$(SRC_PATH)/scripts/qapi/common.py \
-$(SRC_PATH)/scripts/qapi/doc.py \
-$(SRC_PATH)/scripts/qapi-gen.py
+qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py

-qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h \
-qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h \
-qga/qapi-generated/qga-qapi-commands.h qga/qapi-generated/qga-qapi-commands.c \
-qga/qapi-generated/qga-qapi-doc.texi: \
-qga/qapi-generated/qapi-gen-timestamp ;
-qga/qapi-generated/qapi-gen-timestamp: $(SRC_PATH)/qga/qapi-schema.json $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-gen.py \
-		-o qga/qapi-generated -p "qga-" $<, \
-		"GEN","$(@:%-timestamp=%)")
-	@>$@
+qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
+$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
+		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
+		"GEN","$@")
+qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
+$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
+		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
+		"GEN","$@")
+qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
+$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
+		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
+		"GEN","$@")

-qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json $(SRC_PATH)/qapi/common.json \
+qapi-modules = $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/qapi/common.json \
               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
-               $(SRC_PATH)/qapi/char.json \
-               $(SRC_PATH)/qapi/crypto.json \
-               $(SRC_PATH)/qapi/introspect.json \
-               $(SRC_PATH)/qapi/job.json \
-               $(SRC_PATH)/qapi/migration.json \
-               $(SRC_PATH)/qapi/misc.json \
-               $(SRC_PATH)/qapi/net.json \
-               $(SRC_PATH)/qapi/rocker.json \
-               $(SRC_PATH)/qapi/run-state.json \
-               $(SRC_PATH)/qapi/sockets.json \
-               $(SRC_PATH)/qapi/tpm.json \
-               $(SRC_PATH)/qapi/trace.json \
-               $(SRC_PATH)/qapi/transaction.json \
-               $(SRC_PATH)/qapi/ui.json
+               $(SRC_PATH)/qapi/event.json $(SRC_PATH)/qapi/introspect.json \
+               $(SRC_PATH)/qapi/crypto.json $(SRC_PATH)/qapi/rocker.json \
+               $(SRC_PATH)/qapi/trace.json

-qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
-qapi/qapi-types.c qapi/qapi-types.h \
-qapi/qapi-types-block-core.c qapi/qapi-types-block-core.h \
-qapi/qapi-types-block.c qapi/qapi-types-block.h \
-qapi/qapi-types-char.c qapi/qapi-types-char.h \
-qapi/qapi-types-common.c qapi/qapi-types-common.h \
-qapi/qapi-types-crypto.c qapi/qapi-types-crypto.h \
-qapi/qapi-types-introspect.c qapi/qapi-types-introspect.h \
-qapi/qapi-types-job.c qapi/qapi-types-job.h \
-qapi/qapi-types-migration.c qapi/qapi-types-migration.h \
-qapi/qapi-types-misc.c qapi/qapi-types-misc.h \
-qapi/qapi-types-net.c qapi/qapi-types-net.h \
-qapi/qapi-types-rocker.c qapi/qapi-types-rocker.h \
-qapi/qapi-types-run-state.c qapi/qapi-types-run-state.h \
-qapi/qapi-types-sockets.c qapi/qapi-types-sockets.h \
-qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
-qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
-qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
-qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
-qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
-qapi/qapi-visit.c qapi/qapi-visit.h \
-qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
-qapi/qapi-visit-block.c qapi/qapi-visit-block.h \
-qapi/qapi-visit-char.c qapi/qapi-visit-char.h \
-qapi/qapi-visit-common.c qapi/qapi-visit-common.h \
-qapi/qapi-visit-crypto.c qapi/qapi-visit-crypto.h \
-qapi/qapi-visit-introspect.c qapi/qapi-visit-introspect.h \
-qapi/qapi-visit-job.c qapi/qapi-visit-job.h \
-qapi/qapi-visit-migration.c qapi/qapi-visit-migration.h \
-qapi/qapi-visit-misc.c qapi/qapi-visit-misc.h \
-qapi/qapi-visit-net.c qapi/qapi-visit-net.h \
-qapi/qapi-visit-rocker.c qapi/qapi-visit-rocker.h \
-qapi/qapi-visit-run-state.c qapi/qapi-visit-run-state.h \
-qapi/qapi-visit-sockets.c qapi/qapi-visit-sockets.h \
-qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
-qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
-qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
-qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
-qapi/qapi-commands.h qapi/qapi-commands.c \
-qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
-qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
-qapi/qapi-commands-char.c qapi/qapi-commands-char.h \
-qapi/qapi-commands-common.c qapi/qapi-commands-common.h \
-qapi/qapi-commands-crypto.c qapi/qapi-commands-crypto.h \
-qapi/qapi-commands-introspect.c qapi/qapi-commands-introspect.h \
-qapi/qapi-commands-job.c qapi/qapi-commands-job.h \
-qapi/qapi-commands-migration.c qapi/qapi-commands-migration.h \
-qapi/qapi-commands-misc.c qapi/qapi-commands-misc.h \
-qapi/qapi-commands-net.c qapi/qapi-commands-net.h \
-qapi/qapi-commands-rocker.c qapi/qapi-commands-rocker.h \
-qapi/qapi-commands-run-state.c qapi/qapi-commands-run-state.h \
-qapi/qapi-commands-sockets.c qapi/qapi-commands-sockets.h \
-qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
-qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
-qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
-qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
-qapi/qapi-events.c qapi/qapi-events.h \
-qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
-qapi/qapi-events-block.c qapi/qapi-events-block.h \
-qapi/qapi-events-char.c qapi/qapi-events-char.h \
-qapi/qapi-events-common.c qapi/qapi-events-common.h \
-qapi/qapi-events-crypto.c qapi/qapi-events-crypto.h \
-qapi/qapi-events-introspect.c qapi/qapi-events-introspect.h \
-qapi/qapi-events-job.c qapi/qapi-events-job.h \
-qapi/qapi-events-migration.c qapi/qapi-events-migration.h \
-qapi/qapi-events-misc.c qapi/qapi-events-misc.h \
-qapi/qapi-events-net.c qapi/qapi-events-net.h \
-qapi/qapi-events-rocker.c qapi/qapi-events-rocker.h \
-qapi/qapi-events-run-state.c qapi/qapi-events-run-state.h \
-qapi/qapi-events-sockets.c qapi/qapi-events-sockets.h \
-qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
-qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
-qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
-qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
-qapi/qapi-introspect.h qapi/qapi-introspect.c \
-qapi/qapi-doc.texi: \
-qapi-gen-timestamp ;
-qapi-gen-timestamp: $(qapi-modules) $(qapi-py)
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-gen.py \
-		-o "qapi" -b $<, \
-		"GEN","$(@:%-timestamp=%)")
-	@>$@
+qapi-types.c qapi-types.h :\
+$(qapi-modules) $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
+		$(gen-out-type) -o "." -b $<, \
+		"GEN","$@")
+qapi-visit.c qapi-visit.h :\
+$(qapi-modules) $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
+		$(gen-out-type) -o "." -b $<, \
+		"GEN","$@")
+qapi-event.c qapi-event.h :\
+$(qapi-modules) $(SRC_PATH)/scripts/qapi-event.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-event.py \
+		$(gen-out-type) -o "." $<, \
+		"GEN","$@")
+qmp-commands.h qmp-marshal.c :\
+$(qapi-modules) $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
+		$(gen-out-type) -o "." $<, \
+		"GEN","$@")
+qmp-introspect.h qmp-introspect.c :\
+$(qapi-modules) $(SRC_PATH)/scripts/qapi-introspect.py $(qapi-py)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-introspect.py \
+		$(gen-out-type) -o "." $<, \
+		"GEN","$@")

-QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qapi-commands.h)
+QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y): $(QGALIB_GEN)

 qemu-ga$(EXESUF): $(qga-obj-y) $(COMMON_LDADDS)
@@ -711,19 +468,13 @@ ifneq ($(EXESUF),)
 qemu-ga: qemu-ga$(EXESUF) $(QGA_VSS_PROVIDER) $(QEMU_GA_MSI)
 endif

-elf2dmp: LIBS = $(CURL_LIBS)
-elf2dmp: $(elf2dmp-obj-y)
-	$(call LINK, $^)
-
 ifdef CONFIG_IVSHMEM
 ivshmem-client$(EXESUF): $(ivshmem-client-obj-y) $(COMMON_LDADDS)
 	$(call LINK, $^)
 ivshmem-server$(EXESUF): $(ivshmem-server-obj-y) $(COMMON_LDADDS)
 	$(call LINK, $^)
 endif
-vhost-user-scsi$(EXESUF): $(vhost-user-scsi-obj-y) libvhost-user.a
-	$(call LINK, $^)
-vhost-user-blk$(EXESUF): $(vhost-user-blk-obj-y) libvhost-user.a
+vhost-user-scsi$(EXESUF): $(vhost-user-scsi-obj-y)
 	$(call LINK, $^)

 module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
@@ -731,14 +482,6 @@ module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
 	$(addprefix $(SRC_PATH)/,$(patsubst %.mo,%.c,$(block-obj-m))), \
 	"GEN","$@")

-ifdef CONFIG_GCOV
-.PHONY: clean-coverage
-clean-coverage:
-	$(call quiet-command, \
-		find . \( -name '*.gcda' -o -name '*.gcov' \) -type f -exec rm {} +, \
-		"CLEAN", "coverage files")
-endif
-
 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
@@ -746,20 +489,20 @@ clean:
 	rm -f *.msi
 	find . \( -name '*.so' -o -name '*.dll' -o -name '*.mo' -o -name '*.[oda]' \) -type f -exec rm {} +
 	rm -f $(filter-out %.tlb,$(TOOLS)) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
-	rm -f fsdev/*.pod scsi/*.pod
+	rm -f fsdev/*.pod
 	rm -f qemu-img-cmds.h
 	rm -f ui/shader/*-vert.h ui/shader/*-frag.h
 	@# May not be present in GENERATED_FILES
 	rm -f trace/generated-tracers-dtrace.dtrace*
 	rm -f trace/generated-tracers-dtrace.h*
 	rm -f $(foreach f,$(GENERATED_FILES),$(f) $(f)-timestamp)
-	rm -f qapi-gen-timestamp
+	rm -rf qapi-generated
 	rm -rf qga/qapi-generated
 	for d in $(ALL_SUBDIRS); do \
 	if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
 	rm -f $$d/qemu-options.def; \
        done
-	rm -f config-all-devices.mak
+	rm -f $(SUBDIR_DEVICES_MAK) config-all-devices.mak

 VERSION ?= $(shell cat VERSION)

@@ -771,7 +514,6 @@ qemu-%.tar.bz2:
 distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi qemu-monitor-info.texi
 	rm -f config-all-devices.mak config-all-disas.mak config.status
-	rm -f $(SUBDIR_DEVICES_MAK)
 	rm -f po/*.mo tests/qemu-iotests/common.env
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
 	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps
@@ -786,12 +528,11 @@ distclean: clean
 	rm -f docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
 	rm -f docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
 	rm -f docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
-	rm -f docs/qemu-block-drivers.7
-	rm -f docs/qemu-cpu-models.7
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
        done
 	rm -Rf .sdk
+	if test -f pixman/config.log; then $(MAKE) -C pixman distclean; fi
 	if test -f dtc/version_gen.h; then $(MAKE) $(DTC_MAKE_ARGS) clean; fi

 KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
@@ -802,7 +543,7 @@ bepo    cz
 ifdef INSTALL_BLOBS
 BLOBS=bios.bin bios-256k.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin vgabios-virtio.bin \
-vgabios-ramfb.bin vgabios-bochs-display.bin \
+acpi-dsdt.aml \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc QEMU,tcx.bin QEMU,cgthree.bin \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
@@ -810,14 +551,13 @@ efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
 efi-pcnet.rom efi-rtl8139.rom efi-virtio.rom \
 efi-e1000e.rom efi-vmxnet3.rom \
 qemu-icon.bmp qemu_logo_no_text.svg \
-bamboo.dtb canyonlands.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
+bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin \
 s390-ccw.img s390-netboot.img \
 spapr-rtas.bin slof.bin skiboot.lid \
 palcode-clipper \
-u-boot.e500 u-boot-sam460-20100605.bin \
-qemu_vga.ndrv \
-hppa-firmware.img
+u-boot.e500 \
+qemu_vga.ndrv
 else
 BLOBS=
 endif
@@ -833,8 +573,6 @@ ifdef CONFIG_POSIX
 	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man7"
 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
-	$(INSTALL_DATA) docs/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
-	$(INSTALL_DATA) docs/qemu-cpu-models.7 "$(DESTDIR)$(mandir)/man7"
 ifneq ($(TOOLS),)
 	$(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
@@ -883,7 +621,7 @@ ifneq ($(BLOBS),)
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(qemu_datadir)"; \
 	done
 endif
-ifdef CONFIG_GTK
+ifeq ($(CONFIG_GTK),y)
 	$(MAKE) -C po $@
 endif
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/keymaps"
@@ -895,6 +633,10 @@ endif
 	$(MAKE) $(SUBDIR_MAKEFLAGS) TARGET_DIR=$$d/ -C $$d $@ || exit 1 ; \
        done

+# various test targets
+test speed: all
+	$(MAKE) -C tests/tcg $@
+
 .PHONY: ctags
 ctags:
 	rm -f tags
@@ -923,10 +665,8 @@ ui/shader/%-frag.h: $(SRC_PATH)/ui/shader/%.frag $(SRC_PATH)/scripts/shaderinclu
 		perl $(SRC_PATH)/scripts/shaderinclude.pl $< > $@,\
 		"FRAG","$@")

-ui/shader.o: $(SRC_PATH)/ui/shader.c \
-	ui/shader/texture-blit-vert.h \
-	ui/shader/texture-blit-flip-vert.h \
-	ui/shader/texture-blit-frag.h
+ui/console-gl.o: $(SRC_PATH)/ui/console-gl.c \
+	ui/shader/texture-blit-vert.h ui/shader/texture-blit-frag.h

 # documentation
 MAKEINFO=makeinfo
@@ -964,11 +704,13 @@ qemu-monitor-info.texi: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxt
 qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")

-docs/interop/qemu-qmp-qapi.texi: qapi/qapi-doc.texi
-	@cp -p $< $@
+docs/interop/qemu-qmp-qapi.texi docs/interop/qemu-ga-qapi.texi: $(SRC_PATH)/scripts/qapi2texi.py $(qapi-py)

-docs/interop/qemu-ga-qapi.texi: qga/qapi-generated/qga-qapi-doc.texi
-	@cp -p $< $@
+docs/interop/qemu-qmp-qapi.texi: $(qapi-modules)
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi2texi.py $< > $@,"GEN","$@")
+
+docs/interop/qemu-ga-qapi.texi: $(SRC_PATH)/qga/qapi-schema.json
+	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi2texi.py $< > $@,"GEN","$@")

 qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
 qemu.1: qemu-option-trace.texi
@@ -976,8 +718,6 @@ qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 qemu-ga.8: qemu-ga.texi
-docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
-docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi

 html: qemu-doc.html docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
 info: qemu-doc.info docs/interop/qemu-qmp-ref.info docs/interop/qemu-ga-ref.info
@@ -986,9 +726,8 @@ txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt

 qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
-	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
-	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-	docs/qemu-cpu-models.texi
+	qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
+	qemu-monitor-info.texi

 docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
    docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
@@ -1000,16 +739,6 @@ docs/interop/qemu-qmp-ref.dvi docs/interop/qemu-qmp-ref.html \
    docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7: \
 	docs/interop/qemu-qmp-ref.texi docs/interop/qemu-qmp-qapi.texi

-# Reports/Analysis
-
-%/coverage-report.html:
-	@mkdir -p $*
-	$(call quiet-command,\
-		gcovr -p --html --html-details -o $@, \
-		"GEN", "coverage-report.html")
-
-.PHONY: coverage-report
-coverage-report: $(CURDIR)/reports/coverage/coverage-report.html

 ifdef CONFIG_WIN32

@@ -1084,15 +813,11 @@ endif
 -include $(wildcard *.d tests/*.d)

 include $(SRC_PATH)/tests/docker/Makefile.include
-include $(SRC_PATH)/tests/vm/Makefile.include

 .PHONY: help
 help:
 	@echo  'Generic targets:'
 	@echo  '  all             - Build all'
-ifdef CONFIG_MODULES
-	@echo  '  modules         - Build all modules'
-endif
 	@echo  '  dir/file.o      - Build specified target only'
 	@echo  '  install         - Install QEMU, documentation and tools'
 	@echo  '  ctags/TAGS      - Generate tags file for editors'
@@ -1105,23 +830,16 @@ endif
 		echo '')
 	@echo  'Cleaning targets:'
 	@echo  '  clean           - Remove most generated files but keep the config'
-ifdef CONFIG_GCOV
-	@echo  '  clean-coverage  - Remove coverage files'
-endif
 	@echo  '  distclean       - Remove all generated files'
 	@echo  '  dist            - Build a distributable tarball'
 	@echo  ''
 	@echo  'Test targets:'
 	@echo  '  check           - Run all tests (check-help for details)'
 	@echo  '  docker          - Help about targets running tests inside Docker containers'
-	@echo  '  vm-test         - Help about targets running tests inside VM'
 	@echo  ''
 	@echo  'Documentation targets:'
 	@echo  '  html info pdf txt'
 	@echo  '                  - Build documentation in specified format'
-ifdef CONFIG_GCOV
-	@echo  '  coverage-report - Create code coverage report'
-endif
 	@echo  ''
 ifdef CONFIG_WIN32
 	@echo  'Windows targets:'
@@ -1131,5 +849,4 @@ ifdef QEMU_GA_MSI_ENABLED
 endif
 	@echo  ''
 endif
-	@echo  '  $(MAKE) [targets]      (quiet build, default)'
-	@echo  '  $(MAKE) V=1 [targets]  (verbose build)'
+	@echo  '  make V=0|1 [targets] 0 => quiet build (default), 1 => verbose build'
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -2,63 +2,7 @@
 # Common libraries for tools and emulators
 stub-obj-y = stubs/ crypto/
 util-obj-y = util/ qobject/ qapi/
-util-obj-y += qapi/qapi-builtin-types.o
-util-obj-y += qapi/qapi-types.o
-util-obj-y += qapi/qapi-types-block-core.o
-util-obj-y += qapi/qapi-types-block.o
-util-obj-y += qapi/qapi-types-char.o
-util-obj-y += qapi/qapi-types-common.o
-util-obj-y += qapi/qapi-types-crypto.o
-util-obj-y += qapi/qapi-types-introspect.o
-util-obj-y += qapi/qapi-types-job.o
-util-obj-y += qapi/qapi-types-migration.o
-util-obj-y += qapi/qapi-types-misc.o
-util-obj-y += qapi/qapi-types-net.o
-util-obj-y += qapi/qapi-types-rocker.o
-util-obj-y += qapi/qapi-types-run-state.o
-util-obj-y += qapi/qapi-types-sockets.o
-util-obj-y += qapi/qapi-types-tpm.o
-util-obj-y += qapi/qapi-types-trace.o
-util-obj-y += qapi/qapi-types-transaction.o
-util-obj-y += qapi/qapi-types-ui.o
-util-obj-y += qapi/qapi-builtin-visit.o
-util-obj-y += qapi/qapi-visit.o
-util-obj-y += qapi/qapi-visit-block-core.o
-util-obj-y += qapi/qapi-visit-block.o
-util-obj-y += qapi/qapi-visit-char.o
-util-obj-y += qapi/qapi-visit-common.o
-util-obj-y += qapi/qapi-visit-crypto.o
-util-obj-y += qapi/qapi-visit-introspect.o
-util-obj-y += qapi/qapi-visit-job.o
-util-obj-y += qapi/qapi-visit-migration.o
-util-obj-y += qapi/qapi-visit-misc.o
-util-obj-y += qapi/qapi-visit-net.o
-util-obj-y += qapi/qapi-visit-rocker.o
-util-obj-y += qapi/qapi-visit-run-state.o
-util-obj-y += qapi/qapi-visit-sockets.o
-util-obj-y += qapi/qapi-visit-tpm.o
-util-obj-y += qapi/qapi-visit-trace.o
-util-obj-y += qapi/qapi-visit-transaction.o
-util-obj-y += qapi/qapi-visit-ui.o
-util-obj-y += qapi/qapi-events.o
-util-obj-y += qapi/qapi-events-block-core.o
-util-obj-y += qapi/qapi-events-block.o
-util-obj-y += qapi/qapi-events-char.o
-util-obj-y += qapi/qapi-events-common.o
-util-obj-y += qapi/qapi-events-crypto.o
-util-obj-y += qapi/qapi-events-introspect.o
-util-obj-y += qapi/qapi-events-job.o
-util-obj-y += qapi/qapi-events-migration.o
-util-obj-y += qapi/qapi-events-misc.o
-util-obj-y += qapi/qapi-events-net.o
-util-obj-y += qapi/qapi-events-rocker.o
-util-obj-y += qapi/qapi-events-run-state.o
-util-obj-y += qapi/qapi-events-sockets.o
-util-obj-y += qapi/qapi-events-tpm.o
-util-obj-y += qapi/qapi-events-trace.o
-util-obj-y += qapi/qapi-events-transaction.o
-util-obj-y += qapi/qapi-events-ui.o
-util-obj-y += qapi/qapi-introspect.o
+util-obj-y += qmp-introspect.o qapi-types.o qapi-visit.o qapi-event.o

 chardev-obj-y = chardev/

@@ -66,8 +10,8 @@ chardev-obj-y = chardev/
 # block-obj-y is code used by both qemu system emulation and qemu-img

 block-obj-y += nbd/
-block-obj-y += block.o blockjob.o job.o
-block-obj-y += block/ scsi/
+block-obj-y += block.o blockjob.o
+block-obj-y += block/
 block-obj-y += qemu-io-cmds.o
 block-obj-$(CONFIG_REPLICATION) += replication.o

@@ -97,7 +41,6 @@ io-obj-y = io/
 ifeq ($(CONFIG_SOFTMMU),y)
 common-obj-y = blockdev.o blockdev-nbd.o block/
 common-obj-y += bootdevice.o iothread.o
-common-obj-y += job-qmp.o
 common-obj-y += net/
 common-obj-y += qdev-monitor.o device-hotplug.o
 common-obj-$(CONFIG_WIN32) += os-win32.o
@@ -108,20 +51,18 @@ common-obj-$(CONFIG_LINUX) += fsdev/
 common-obj-y += migration/

 common-obj-y += audio/
-common-obj-m += audio/
 common-obj-y += hw/

 common-obj-y += replay/

 common-obj-y += ui/
-common-obj-m += ui/
 common-obj-y += bt-host.o bt-vhci.o
 bt-host.o-cflags := $(BLUEZ_CFLAGS)

 common-obj-y += dma-helpers.o
 common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
-common-obj-$(CONFIG_TPM) += tpm.o
+common-obj-y += tpm.o

 common-obj-$(CONFIG_SLIRP) += slirp/

@@ -129,33 +70,14 @@ common-obj-y += backends/
 common-obj-y += chardev/

 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
-qemu-seccomp.o-cflags := $(SECCOMP_CFLAGS)
-qemu-seccomp.o-libs := $(SECCOMP_LIBS)

 common-obj-$(CONFIG_FDT) += device_tree.o

 ######################################################################
 # qapi

-common-obj-y += qapi/qapi-commands.o
-common-obj-y += qapi/qapi-commands-block-core.o
-common-obj-y += qapi/qapi-commands-block.o
-common-obj-y += qapi/qapi-commands-char.o
-common-obj-y += qapi/qapi-commands-common.o
-common-obj-y += qapi/qapi-commands-crypto.o
-common-obj-y += qapi/qapi-commands-introspect.o
-common-obj-y += qapi/qapi-commands-job.o
-common-obj-y += qapi/qapi-commands-migration.o
-common-obj-y += qapi/qapi-commands-misc.o
-common-obj-y += qapi/qapi-commands-net.o
-common-obj-y += qapi/qapi-commands-rocker.o
-common-obj-y += qapi/qapi-commands-run-state.o
-common-obj-y += qapi/qapi-commands-sockets.o
-common-obj-y += qapi/qapi-commands-tpm.o
-common-obj-y += qapi/qapi-commands-trace.o
-common-obj-y += qapi/qapi-commands-transaction.o
-common-obj-y += qapi/qapi-commands-ui.o
-common-obj-y += qapi/qapi-introspect.o
+common-obj-y += qmp-marshal.o
+common-obj-y += qmp-introspect.o
 common-obj-y += qmp.o hmp.o
 endif

@@ -178,87 +100,74 @@ target-obj-y += trace/
 ######################################################################
 # guest agent

-# FIXME: a few definitions from qapi/qapi-types.o and
-# qapi/qapi-visit.o are needed by libqemuutil.a.  These should be
-# extracted into a QAPI schema module, or perhaps a separate schema.
+# FIXME: a few definitions from qapi-types.o/qapi-visit.o are needed
+# by libqemuutil.a.  These should be moved to a separate .json schema.
 qga-obj-y = qga/
 qga-vss-dll-obj-y = qga/

 ######################################################################
 # contrib
-elf2dmp-obj-y = contrib/elf2dmp/
 ivshmem-client-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-client/
 ivshmem-server-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-server/
 libvhost-user-obj-y = contrib/libvhost-user/
 vhost-user-scsi.o-cflags := $(LIBISCSI_CFLAGS)
 vhost-user-scsi.o-libs := $(LIBISCSI_LIBS)
 vhost-user-scsi-obj-y = contrib/vhost-user-scsi/
-vhost-user-blk-obj-y = contrib/vhost-user-blk/
+vhost-user-scsi-obj-y += contrib/libvhost-user/libvhost-user.o

 ######################################################################
 trace-events-subdirs =
-trace-events-subdirs += accel/kvm
-trace-events-subdirs += accel/tcg
-trace-events-subdirs += audio
+trace-events-subdirs += util
+trace-events-subdirs += crypto
+trace-events-subdirs += io
+trace-events-subdirs += migration
 trace-events-subdirs += block
 trace-events-subdirs += chardev
-trace-events-subdirs += crypto
-trace-events-subdirs += hw/9pfs
-trace-events-subdirs += hw/acpi
-trace-events-subdirs += hw/alpha
-trace-events-subdirs += hw/arm
-trace-events-subdirs += hw/audio
 trace-events-subdirs += hw/block
 trace-events-subdirs += hw/block/dataplane
 trace-events-subdirs += hw/char
-trace-events-subdirs += hw/display
-trace-events-subdirs += hw/dma
-trace-events-subdirs += hw/hppa
-trace-events-subdirs += hw/i2c
-trace-events-subdirs += hw/i386
-trace-events-subdirs += hw/i386/xen
-trace-events-subdirs += hw/ide
-trace-events-subdirs += hw/input
 trace-events-subdirs += hw/intc
+trace-events-subdirs += hw/net
+trace-events-subdirs += hw/virtio
+trace-events-subdirs += hw/audio
+trace-events-subdirs += hw/misc
+trace-events-subdirs += hw/usb
+trace-events-subdirs += hw/scsi
+trace-events-subdirs += hw/nvram
+trace-events-subdirs += hw/display
+trace-events-subdirs += hw/input
+trace-events-subdirs += hw/timer
+trace-events-subdirs += hw/dma
+trace-events-subdirs += hw/sparc
+trace-events-subdirs += hw/sd
 trace-events-subdirs += hw/isa
 trace-events-subdirs += hw/mem
-trace-events-subdirs += hw/misc
-trace-events-subdirs += hw/misc/macio
-trace-events-subdirs += hw/net
-trace-events-subdirs += hw/nvram
-trace-events-subdirs += hw/pci
-trace-events-subdirs += hw/pci-host
+trace-events-subdirs += hw/i386
+trace-events-subdirs += hw/i386/xen
+trace-events-subdirs += hw/9pfs
 trace-events-subdirs += hw/ppc
-trace-events-subdirs += hw/rdma
-trace-events-subdirs += hw/rdma/vmw
+trace-events-subdirs += hw/pci
 trace-events-subdirs += hw/s390x
-trace-events-subdirs += hw/scsi
-trace-events-subdirs += hw/sd
-trace-events-subdirs += hw/sparc
-trace-events-subdirs += hw/sparc64
-trace-events-subdirs += hw/timer
-trace-events-subdirs += hw/tpm
-trace-events-subdirs += hw/usb
 trace-events-subdirs += hw/vfio
-trace-events-subdirs += hw/virtio
-trace-events-subdirs += hw/watchdog
+trace-events-subdirs += hw/acpi
+trace-events-subdirs += hw/arm
+trace-events-subdirs += hw/alpha
 trace-events-subdirs += hw/xen
-trace-events-subdirs += io
-trace-events-subdirs += linux-user
-trace-events-subdirs += migration
-trace-events-subdirs += nbd
+trace-events-subdirs += ui
+trace-events-subdirs += audio
 trace-events-subdirs += net
-trace-events-subdirs += qapi
-trace-events-subdirs += qom
-trace-events-subdirs += scsi
 trace-events-subdirs += target/arm
 trace-events-subdirs += target/i386
 trace-events-subdirs += target/mips
-trace-events-subdirs += target/ppc
-trace-events-subdirs += target/s390x
 trace-events-subdirs += target/sparc
-trace-events-subdirs += ui
-trace-events-subdirs += util
+trace-events-subdirs += target/s390x
+trace-events-subdirs += target/ppc
+trace-events-subdirs += qom
+trace-events-subdirs += linux-user
+trace-events-subdirs += qapi
+trace-events-subdirs += accel/tcg
+trace-events-subdirs += accel/kvm
+trace-events-subdirs += nbd

 trace-events-files = $(SRC_PATH)/trace-events $(trace-events-subdirs:%=$(SRC_PATH)/%/trace-events)

--- a/Makefile.target
+++ b/Makefile.target
@@ -11,9 +11,9 @@ $(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
 ifdef CONFIG_LINUX
 QEMU_CFLAGS += -I../linux-headers
 endif
-QEMU_CFLAGS += -iquote .. -iquote $(SRC_PATH)/target/$(TARGET_BASE_ARCH) -DNEED_CPU_H
+QEMU_CFLAGS += -I.. -I$(SRC_PATH)/target/$(TARGET_BASE_ARCH) -DNEED_CPU_H

-QEMU_CFLAGS+=-iquote $(SRC_PATH)/include
+QEMU_CFLAGS+=-I$(SRC_PATH)/include

 ifdef CONFIG_USER_ONLY
 # user emulator name
@@ -22,7 +22,7 @@ QEMU_PROG_BUILD = $(QEMU_PROG)
 else
 # system emulator name
 QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
-ifneq (,$(findstring -mwindows,$(SDL_LIBS)))
+ifneq (,$(findstring -mwindows,$(libs_softmmu)))
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
 $(QEMU_PROG): $(QEMU_PROGW)
@@ -36,11 +36,6 @@ endif
 PROGS=$(QEMU_PROG) $(QEMU_PROGW)
 STPFILES=

-# Makefile Tests
-ifdef CONFIG_USER_ONLY
-include $(SRC_PATH)/tests/tcg/Makefile.include
-endif
-
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

@@ -98,14 +93,21 @@ all: $(PROGS) stap
 # cpu emulator library
 obj-y += exec.o
 obj-y += accel/
-obj-$(CONFIG_TCG) += tcg/tcg.o tcg/tcg-op.o tcg/tcg-op-vec.o tcg/tcg-op-gvec.o
-obj-$(CONFIG_TCG) += tcg/tcg-common.o tcg/optimize.o
+obj-$(CONFIG_TCG) += tcg/tcg.o tcg/tcg-op.o tcg/optimize.o
+obj-$(CONFIG_TCG) += tcg/tcg-common.o tcg/tcg-runtime.o
 obj-$(CONFIG_TCG_INTERPRETER) += tcg/tci.o
 obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
-obj-$(CONFIG_TCG) += fpu/softfloat.o
+obj-y += fpu/softfloat.o
 obj-y += target/$(TARGET_BASE_ARCH)/
 obj-y += disas.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
+obj-$(call lnot,$(CONFIG_HAX)) += hax-stub.o
+
+obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decContext.o
+obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decNumber.o
+obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal32.o
+obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal64.o
+obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/dpd/decimal128.o

 #########################################################
 # Linux user emulator target
@@ -117,7 +119,7 @@ QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) \
             -I$(SRC_PATH)/linux-user

 obj-y += linux-user/
-obj-y += gdbstub.o thunk.o
+obj-y += gdbstub.o thunk.o user-exec.o user-exec-stub.o

 endif #CONFIG_LINUX_USER

@@ -130,7 +132,7 @@ QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ABI_DIR) \
 			 -I$(SRC_PATH)/bsd-user/$(HOST_VARIANT_DIR)

 obj-y += bsd-user/
-obj-y += gdbstub.o
+obj-y += gdbstub.o user-exec.o user-exec-stub.o

 endif #CONFIG_BSD_USER

@@ -143,7 +145,6 @@ obj-y += hw/
 obj-y += memory.o
 obj-y += memory_mapping.o
 obj-y += dump.o
-obj-$(TARGET_X86_64) += win_dump.o
 obj-y += migration/ram.o
 LIBS := $(libs_softmmu) $(LIBS)

@@ -192,7 +193,7 @@ all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)

 $(QEMU_PROG_BUILD): config-devices.mak

-COMMON_LDADDS = ../libqemuutil.a
+COMMON_LDADDS = ../libqemuutil.a ../libqemustub.a

 # build either PROG or PROGW
 $(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS)
--- a/53
+++ b/53
@@ -44,9 +44,9 @@ of other UNIX targets. The simple steps to build QEMU are:

 Additional information can also be found online via the QEMU website:

-  https://qemu.org/Hosts/Linux
-  https://qemu.org/Hosts/Mac
-  https://qemu.org/Hosts/W32
+  http://qemu-project.org/Hosts/Linux
+  http://qemu-project.org/Hosts/Mac
+  http://qemu-project.org/Hosts/W32


 Submitting patches
@@ -54,9 +54,9 @@ Submitting patches

 The QEMU source code is maintained under the GIT version control system.

-   git clone https://git.qemu.org/git/qemu.git
+   git clone git://git.qemu-project.org/qemu.git

-When submitting patches, one common approach is to use 'git
+When submitting patches, the preferred approach is to use 'git
 format-patch' and/or 'git send-email' to format & send the mail to the
 qemu-devel@nongnu.org mailing list. All patches submitted must contain
 a 'Signed-off-by' line from the author. Patches should follow the
@@ -65,42 +65,9 @@ guidelines set out in the HACKING and CODING_STYLE files.
 Additional information on submitting patches can be found online via
 the QEMU website

-  https://qemu.org/Contribute/SubmitAPatch
-  https://qemu.org/Contribute/TrivialPatches
+  http://qemu-project.org/Contribute/SubmitAPatch
+  http://qemu-project.org/Contribute/TrivialPatches

-The QEMU website is also maintained under source control.
-
-  git clone https://git.qemu.org/git/qemu-web.git
-  https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/
-
-A 'git-publish' utility was created to make above process less
-cumbersome, and is highly recommended for making regular contributions,
-or even just for sending consecutive patch series revisions. It also
-requires a working 'git send-email' setup, and by default doesn't
-automate everything, so you may want to go through the above steps
-manually for once.
-
-For installation instructions, please go to
-
-  https://github.com/stefanha/git-publish
-
-The workflow with 'git-publish' is:
-
-  $ git checkout master -b my-feature
-  $ # work on new commits, add your 'Signed-off-by' lines to each
-  $ git publish
-
-Your patch series will be sent and tagged as my-feature-v1 if you need to refer
-back to it in the future.
-
-Sending v2:
-
-  $ git checkout my-feature # same topic branch
-  $ # making changes to the commits (using 'git rebase', for example)
-  $ git publish
-
-Your patch series will be sent with 'v2' tag in the subject and the git tip
-will be tagged as my-feature-v2.

 Bug reporting
 =============
@@ -118,7 +85,7 @@ reported via launchpad.

 For additional information on bug reporting consult:

-  https://qemu.org/Contribute/ReportABug
+  http://qemu-project.org/Contribute/ReportABug


 Contact
@@ -128,12 +95,12 @@ The QEMU community can be contacted in a number of ways, with the two
 main methods being email and IRC

 - qemu-devel@nongnu.org
-   https://lists.nongnu.org/mailman/listinfo/qemu-devel
+   http://lists.nongnu.org/mailman/listinfo/qemu-devel
 - #qemu on irc.oftc.net

 Information on additional methods of contacting the community can be
 found online via the QEMU website:

-  https://qemu.org/Contribute/StartHere
+  http://qemu-project.org/Contribute/StartHere

 -- End
--- a/2
+++ b/2
@@ -1 +1 @@
-3.1.1
+2.10.1
--- a/accel/Makefile.objs
+++ b/accel/Makefile.objs
@@ -1,4 +1,4 @@
 obj-$(CONFIG_SOFTMMU) += accel.o
-obj-$(CONFIG_KVM) += kvm/
+obj-y += kvm/
 obj-$(CONFIG_TCG) += tcg/
 obj-y += stubs/
--- a/accel/accel.c
+++ b/accel/accel.c
@@ -26,6 +26,7 @@
 #include "qemu/osdep.h"
 #include "sysemu/accel.h"
 #include "hw/boards.h"
+#include "qemu-common.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
@@ -33,7 +34,6 @@
 #include "hw/xen/xen.h"
 #include "qom/object.h"
 #include "qemu/error-report.h"
-#include "qemu/option.h"

 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
@@ -70,8 +70,8 @@ static int accel_init_machine(AccelClass *acc, MachineState *ms)

 void configure_accelerator(MachineState *ms)
 {
-    const char *accel;
-    char **accel_list, **tmp;
+    const char *accel, *p;
+    char buf[10];
    int ret;
    bool accel_initialised = false;
    bool init_failed = false;
@@ -83,10 +83,13 @@ void configure_accelerator(MachineState *ms)
        accel = "tcg";
    }

-    accel_list = g_strsplit(accel, ":", 0);
-
-    for (tmp = accel_list; !accel_initialised && tmp && *tmp; tmp++) {
-        acc = accel_find(*tmp);
+    p = accel;
+    while (!accel_initialised && *p != '\0') {
+        if (*p == ':') {
+            p++;
+        }
+        p = get_opt_name(buf, sizeof(buf), p, ':');
+        acc = accel_find(buf);
        if (!acc) {
            continue;
        }
@@ -104,7 +107,6 @@ void configure_accelerator(MachineState *ms)
            accel_initialised = true;
        }
    }
-    g_strfreev(accel_list);

    if (!accel_initialised) {
        if (!init_failed) {
@@ -124,15 +126,6 @@ void accel_register_compat_props(AccelState *accel)
    register_compat_props_array(class->global_props);
 }

-void accel_setup_post(MachineState *ms)
-{
-    AccelState *accel = ms->accelerator;
-    AccelClass *acc = ACCEL_GET_CLASS(accel);
-    if (acc->setup_post) {
-        acc->setup_post(ms, accel);
-    }
-}
-
 static void register_accel_types(void)
 {
    type_register_static(&accel_type);
--- a/accel/kvm/Makefile.objs
+++ b/accel/kvm/Makefile.objs
@@ -1,2 +1 @@
-obj-y += kvm-all.o
-obj-$(call lnot,$(CONFIG_SEV)) += sev-stub.o
+obj-$(CONFIG_KVM) += kvm-all.o
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -38,8 +38,6 @@
 #include "qemu/event_notifier.h"
 #include "trace.h"
 #include "hw/irq.h"
-#include "sysemu/sev.h"
-#include "sysemu/balloon.h"

 #include "hw/boards.h"

@@ -79,9 +77,9 @@ struct KVMState
    int fd;
    int vmfd;
    int coalesced_mmio;
-    int coalesced_pio;
    struct kvm_coalesced_mmio_ring *coalesced_mmio_ring;
    bool coalesced_flush_in_progress;
+    int broken_set_mem_region;
    int vcpu_events;
    int robust_singlestep;
    int debugregs;
@@ -90,7 +88,6 @@ struct KVMState
 #endif
    int many_ioeventfds;
    int intx_set_mask;
-    bool sync_mmu;
    /* The man page (and posix) say ioctl numbers are signed int, but
     * they're not.  Linux, glibc and *BSD all treat ioctl numbers as
     * unsigned, and treating them as signed here can break things */
@@ -106,10 +103,6 @@ struct KVMState
 #endif
    KVMMemoryListener memory_listener;
    QLIST_HEAD(, KVMParkedVcpu) kvm_parked_vcpus;
-
-    /* memory encryption */
-    void *memcrypt_handle;
-    int (*memcrypt_encrypt_data)(void *handle, uint8_t *ptr, uint64_t len);
 };

 KVMState *kvm_state;
@@ -134,7 +127,6 @@ static bool kvm_immediate_exit;
 static const KVMCapabilityInfo kvm_required_capabilites[] = {
    KVM_CAP_INFO(USER_MEMORY),
    KVM_CAP_INFO(DESTROY_MEMORY_REGION_WORKS),
-    KVM_CAP_INFO(JOIN_MEMORY_REGIONS_WORKS),
    KVM_CAP_LAST_INFO
 };

@@ -145,26 +137,6 @@ int kvm_get_max_memslots(void)
    return s->nr_slots;
 }

-bool kvm_memcrypt_enabled(void)
-{
-    if (kvm_state && kvm_state->memcrypt_handle) {
-        return true;
-    }
-
-    return false;
-}
-
-int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
-{
-    if (kvm_state->memcrypt_handle &&
-        kvm_state->memcrypt_encrypt_data) {
-        return kvm_state->memcrypt_encrypt_data(kvm_state->memcrypt_handle,
-                                              ptr, len);
-    }
-
-    return 1;
-}
-
 static KVMSlot *kvm_get_free_slot(KVMMemoryListener *kml)
 {
    KVMState *s = kvm_state;
@@ -200,7 +172,7 @@ static KVMSlot *kvm_alloc_slot(KVMMemoryListener *kml)

 static KVMSlot *kvm_lookup_matching_slot(KVMMemoryListener *kml,
                                         hwaddr start_addr,
-                                         hwaddr size)
+                                         hwaddr end_addr)
 {
    KVMState *s = kvm_state;
    int i;
@@ -208,7 +180,8 @@ static KVMSlot *kvm_lookup_matching_slot(KVMMemoryListener *kml,
    for (i = 0; i < s->nr_slots; i++) {
        KVMSlot *mem = &kml->slots[i];

-        if (start_addr == mem->start_addr && size == mem->memory_size) {
+        if (start_addr == mem->start_addr &&
+            end_addr == mem->start_addr + mem->memory_size) {
            return mem;
        }
    }
@@ -217,27 +190,31 @@ static KVMSlot *kvm_lookup_matching_slot(KVMMemoryListener *kml,
 }

 /*
- * Calculate and align the start address and the size of the section.
- * Return the size. If the size is 0, the aligned section is empty.
+ * Find overlapping slot with lowest start address
 */
-static hwaddr kvm_align_section(MemoryRegionSection *section,
-                                hwaddr *start)
+static KVMSlot *kvm_lookup_overlapping_slot(KVMMemoryListener *kml,
+                                            hwaddr start_addr,
+                                            hwaddr end_addr)
 {
-    hwaddr size = int128_get64(section->size);
-    hwaddr delta, aligned;
+    KVMState *s = kvm_state;
+    KVMSlot *found = NULL;
+    int i;

-    /* kvm works in page size chunks, but the function may be called
-       with sub-page size and unaligned start address. Pad the start
-       address to next and truncate size to previous page boundary. */
-    aligned = ROUND_UP(section->offset_within_address_space,
-                       qemu_real_host_page_size);
-    delta = aligned - section->offset_within_address_space;
-    *start = aligned;
-    if (delta > size) {
-        return 0;
+    for (i = 0; i < s->nr_slots; i++) {
+        KVMSlot *mem = &kml->slots[i];
+
+        if (mem->memory_size == 0 ||
+            (found && found->start_addr < mem->start_addr)) {
+            continue;
+        }
+
+        if (end_addr > mem->start_addr &&
+            start_addr < mem->start_addr + mem->memory_size) {
+            found = mem;
+        }
    }

-    return (size - delta) & qemu_real_host_page_mask;
+    return found;
 }

 int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
@@ -258,29 +235,24 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
    return 0;
 }

-static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot, bool new)
+static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot)
 {
    KVMState *s = kvm_state;
    struct kvm_userspace_memory_region mem;
-    int ret;

    mem.slot = slot->slot | (kml->as_id << 16);
    mem.guest_phys_addr = slot->start_addr;
    mem.userspace_addr = (unsigned long)slot->ram;
    mem.flags = slot->flags;

-    if (slot->memory_size && !new && (mem.flags ^ slot->old_flags) & KVM_MEM_READONLY) {
+    if (slot->memory_size && mem.flags & KVM_MEM_READONLY) {
        /* Set the slot size to 0 before setting the slot to the desired
         * value. This is needed based on KVM commit 75d61fbc. */
        mem.memory_size = 0;
        kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
    }
    mem.memory_size = slot->memory_size;
-    ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
-    slot->old_flags = mem.flags;
-    trace_kvm_set_user_memory(mem.slot, mem.flags, mem.guest_phys_addr,
-                              mem.memory_size, mem.userspace_addr, ret);
-    return ret;
+    return kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
 }

 int kvm_destroy_vcpu(CPUState *cpu)
@@ -394,34 +366,31 @@ static int kvm_mem_flags(MemoryRegion *mr)
 static int kvm_slot_update_flags(KVMMemoryListener *kml, KVMSlot *mem,
                                 MemoryRegion *mr)
 {
+    int old_flags;
+
+    old_flags = mem->flags;
    mem->flags = kvm_mem_flags(mr);

    /* If nothing changed effectively, no need to issue ioctl */
-    if (mem->flags == mem->old_flags) {
+    if (mem->flags == old_flags) {
        return 0;
    }

-    return kvm_set_user_memory_region(kml, mem, false);
+    return kvm_set_user_memory_region(kml, mem);
 }

 static int kvm_section_update_flags(KVMMemoryListener *kml,
                                    MemoryRegionSection *section)
 {
-    hwaddr start_addr, size;
-    KVMSlot *mem;
+    hwaddr phys_addr = section->offset_within_address_space;
+    ram_addr_t size = int128_get64(section->size);
+    KVMSlot *mem = kvm_lookup_matching_slot(kml, phys_addr, phys_addr + size);

-    size = kvm_align_section(section, &start_addr);
-    if (!size) {
+    if (mem == NULL)  {
        return 0;
+    } else {
+        return kvm_slot_update_flags(kml, mem, section->mr);
    }
-
-    mem = kvm_lookup_matching_slot(kml, start_addr, size);
-    if (!mem) {
-        /* We don't have a slot if we want to trap every access. */
-        return 0;
-    }
-
-    return kvm_slot_update_flags(kml, mem, section->mr);
 }

 static void kvm_log_start(MemoryListener *listener,
@@ -485,16 +454,18 @@ static int kvm_physical_sync_dirty_bitmap(KVMMemoryListener *kml,
                                          MemoryRegionSection *section)
 {
    KVMState *s = kvm_state;
+    unsigned long size, allocated_size = 0;
    struct kvm_dirty_log d = {};
    KVMSlot *mem;
-    hwaddr start_addr, size;
+    int ret = 0;
+    hwaddr start_addr = section->offset_within_address_space;
+    hwaddr end_addr = start_addr + int128_get64(section->size);

-    size = kvm_align_section(section, &start_addr);
-    if (size) {
-        mem = kvm_lookup_matching_slot(kml, start_addr, size);
-        if (!mem) {
-            /* We don't have a slot if we want to trap every access. */
-            return 0;
+    d.dirty_bitmap = NULL;
+    while (start_addr < end_addr) {
+        mem = kvm_lookup_overlapping_slot(kml, start_addr, end_addr);
+        if (mem == NULL) {
+            break;
        }

        /* XXX bad kernel interface alert
@@ -511,20 +482,27 @@ static int kvm_physical_sync_dirty_bitmap(KVMMemoryListener *kml,
         */
        size = ALIGN(((mem->memory_size) >> TARGET_PAGE_BITS),
                     /*HOST_LONG_BITS*/ 64) / 8;
-        d.dirty_bitmap = g_malloc0(size);
+        if (!d.dirty_bitmap) {
+            d.dirty_bitmap = g_malloc(size);
+        } else if (size > allocated_size) {
+            d.dirty_bitmap = g_realloc(d.dirty_bitmap, size);
+        }
+        allocated_size = size;
+        memset(d.dirty_bitmap, 0, allocated_size);

        d.slot = mem->slot | (kml->as_id << 16);
        if (kvm_vm_ioctl(s, KVM_GET_DIRTY_LOG, &d) == -1) {
            DPRINTF("ioctl failed %d\n", errno);
-            g_free(d.dirty_bitmap);
-            return -1;
+            ret = -1;
+            break;
        }

        kvm_get_dirty_pages_log_range(section, d.dirty_bitmap);
-        g_free(d.dirty_bitmap);
+        start_addr = mem->start_addr + mem->memory_size;
    }
+    g_free(d.dirty_bitmap);

-    return 0;
+    return ret;
 }

 static void kvm_coalesce_mmio_region(MemoryListener *listener,
@@ -561,45 +539,6 @@ static void kvm_uncoalesce_mmio_region(MemoryListener *listener,
    }
 }

-static void kvm_coalesce_pio_add(MemoryListener *listener,
-                                MemoryRegionSection *section,
-                                hwaddr start, hwaddr size)
-{
-    KVMState *s = kvm_state;
-
-    if (s->coalesced_pio) {
-        struct kvm_coalesced_mmio_zone zone;
-
-        zone.addr = start;
-        zone.size = size;
-        zone.pio = 1;
-
-        (void)kvm_vm_ioctl(s, KVM_REGISTER_COALESCED_MMIO, &zone);
-    }
-}
-
-static void kvm_coalesce_pio_del(MemoryListener *listener,
-                                MemoryRegionSection *section,
-                                hwaddr start, hwaddr size)
-{
-    KVMState *s = kvm_state;
-
-    if (s->coalesced_pio) {
-        struct kvm_coalesced_mmio_zone zone;
-
-        zone.addr = start;
-        zone.size = size;
-        zone.pio = 1;
-
-        (void)kvm_vm_ioctl(s, KVM_UNREGISTER_COALESCED_MMIO, &zone);
-     }
-}
-
-static MemoryListener kvm_coalesced_pio_listener = {
-    .coalesced_io_add = kvm_coalesce_pio_add,
-    .coalesced_io_del = kvm_coalesce_pio_del,
-};
-
 int kvm_check_extension(KVMState *s, unsigned int extension)
 {
    int ret;
@@ -757,12 +696,30 @@ kvm_check_extension_list(KVMState *s, const KVMCapabilityInfo *list)
 static void kvm_set_phys_mem(KVMMemoryListener *kml,
                             MemoryRegionSection *section, bool add)
 {
-    KVMSlot *mem;
+    KVMState *s = kvm_state;
+    KVMSlot *mem, old;
    int err;
    MemoryRegion *mr = section->mr;
    bool writeable = !mr->readonly && !mr->rom_device;
-    hwaddr start_addr, size;
-    void *ram;
+    hwaddr start_addr = section->offset_within_address_space;
+    ram_addr_t size = int128_get64(section->size);
+    void *ram = NULL;
+    unsigned delta;
+
+    /* kvm works in page size chunks, but the function may be called
+       with sub-page size and unaligned start address. Pad the start
+       address to next and truncate size to previous page boundary. */
+    delta = qemu_real_host_page_size - (start_addr & ~qemu_real_host_page_mask);
+    delta &= ~qemu_real_host_page_mask;
+    if (delta > size) {
+        return;
+    }
+    start_addr += delta;
+    size -= delta;
+    size &= qemu_real_host_page_mask;
+    if (!size || (start_addr & ~qemu_real_host_page_mask)) {
+        return;
+    }

    if (!memory_region_is_ram(mr)) {
        if (writeable || !kvm_readonly_mem_allowed) {
@@ -774,44 +731,122 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
        }
    }

-    size = kvm_align_section(section, &start_addr);
-    if (!size) {
-        return;
-    }
+    ram = memory_region_get_ram_ptr(mr) + section->offset_within_region + delta;

-    /* use aligned delta to align the ram address */
-    ram = memory_region_get_ram_ptr(mr) + section->offset_within_region +
-          (start_addr - section->offset_within_address_space);
-
-    if (!add) {
-        mem = kvm_lookup_matching_slot(kml, start_addr, size);
+    while (1) {
+        mem = kvm_lookup_overlapping_slot(kml, start_addr, start_addr + size);
        if (!mem) {
+            break;
+        }
+
+        if (add && start_addr >= mem->start_addr &&
+            (start_addr + size <= mem->start_addr + mem->memory_size) &&
+            (ram - start_addr == mem->ram - mem->start_addr)) {
+            /* The new slot fits into the existing one and comes with
+             * identical parameters - update flags and done. */
+            kvm_slot_update_flags(kml, mem, mr);
            return;
        }
+
+        old = *mem;
+
        if (mem->flags & KVM_MEM_LOG_DIRTY_PAGES) {
            kvm_physical_sync_dirty_bitmap(kml, section);
        }

-        /* unregister the slot */
+        /* unregister the overlapping slot */
        mem->memory_size = 0;
-        mem->flags = 0;
-        err = kvm_set_user_memory_region(kml, mem, false);
+        err = kvm_set_user_memory_region(kml, mem);
        if (err) {
-            fprintf(stderr, "%s: error unregistering slot: %s\n",
+            fprintf(stderr, "%s: error unregistering overlapping slot: %s\n",
                    __func__, strerror(-err));
            abort();
        }
-        return;
+
+        /* Workaround for older KVM versions: we can't join slots, even not by
+         * unregistering the previous ones and then registering the larger
+         * slot. We have to maintain the existing fragmentation. Sigh.
+         *
+         * This workaround assumes that the new slot starts at the same
+         * address as the first existing one. If not or if some overlapping
+         * slot comes around later, we will fail (not seen in practice so far)
+         * - and actually require a recent KVM version. */
+        if (s->broken_set_mem_region &&
+            old.start_addr == start_addr && old.memory_size < size && add) {
+            mem = kvm_alloc_slot(kml);
+            mem->memory_size = old.memory_size;
+            mem->start_addr = old.start_addr;
+            mem->ram = old.ram;
+            mem->flags = kvm_mem_flags(mr);
+
+            err = kvm_set_user_memory_region(kml, mem);
+            if (err) {
+                fprintf(stderr, "%s: error updating slot: %s\n", __func__,
+                        strerror(-err));
+                abort();
+            }
+
+            start_addr += old.memory_size;
+            ram += old.memory_size;
+            size -= old.memory_size;
+            continue;
+        }
+
+        /* register prefix slot */
+        if (old.start_addr < start_addr) {
+            mem = kvm_alloc_slot(kml);
+            mem->memory_size = start_addr - old.start_addr;
+            mem->start_addr = old.start_addr;
+            mem->ram = old.ram;
+            mem->flags =  kvm_mem_flags(mr);
+
+            err = kvm_set_user_memory_region(kml, mem);
+            if (err) {
+                fprintf(stderr, "%s: error registering prefix slot: %s\n",
+                        __func__, strerror(-err));
+#ifdef TARGET_PPC
+                fprintf(stderr, "%s: This is probably because your kernel's " \
+                                "PAGE_SIZE is too big. Please try to use 4k " \
+                                "PAGE_SIZE!\n", __func__);
+#endif
+                abort();
+            }
+        }
+
+        /* register suffix slot */
+        if (old.start_addr + old.memory_size > start_addr + size) {
+            ram_addr_t size_delta;
+
+            mem = kvm_alloc_slot(kml);
+            mem->start_addr = start_addr + size;
+            size_delta = mem->start_addr - old.start_addr;
+            mem->memory_size = old.memory_size - size_delta;
+            mem->ram = old.ram + size_delta;
+            mem->flags = kvm_mem_flags(mr);
+
+            err = kvm_set_user_memory_region(kml, mem);
+            if (err) {
+                fprintf(stderr, "%s: error registering suffix slot: %s\n",
+                        __func__, strerror(-err));
+                abort();
+            }
+        }
    }

-    /* register the new slot */
+    /* in case the KVM bug workaround already "consumed" the new slot */
+    if (!size) {
+        return;
+    }
+    if (!add) {
+        return;
+    }
    mem = kvm_alloc_slot(kml);
    mem->memory_size = size;
    mem->start_addr = start_addr;
    mem->ram = ram;
    mem->flags = kvm_mem_flags(mr);

-    err = kvm_set_user_memory_region(kml, mem, true);
+    err = kvm_set_user_memory_region(kml, mem);
    if (err) {
        fprintf(stderr, "%s: error registering slot: %s\n", __func__,
                strerror(-err));
@@ -1213,7 +1248,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
    int virq;
    MSIMessage msg = {0, 0};

-    if (pci_available && dev) {
+    if (dev) {
        msg = pci_get_msi_message(dev, vector);
    }

@@ -1236,7 +1271,7 @@ int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
    kroute.u.msi.address_lo = (uint32_t)msg.address;
    kroute.u.msi.address_hi = msg.address >> 32;
    kroute.u.msi.data = le32_to_cpu(msg.data);
-    if (pci_available && kvm_msi_devid_required()) {
+    if (kvm_msi_devid_required()) {
        kroute.flags = KVM_MSI_VALID_DEVID;
        kroute.u.msi.devid = pci_requester_id(dev);
    }
@@ -1274,7 +1309,7 @@ int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
    kroute.u.msi.address_lo = (uint32_t)msg.address;
    kroute.u.msi.address_hi = msg.address >> 32;
    kroute.u.msi.data = le32_to_cpu(msg.data);
-    if (pci_available && kvm_msi_devid_required()) {
+    if (kvm_msi_devid_required()) {
        kroute.flags = KVM_MSI_VALID_DEVID;
        kroute.u.msi.devid = pci_requester_id(dev);
    }
@@ -1498,7 +1533,7 @@ static void kvm_irqchip_create(MachineState *machine, KVMState *s)
 */
 static int kvm_recommended_vcpus(KVMState *s)
 {
-    int ret = kvm_vm_check_extension(s, KVM_CAP_NR_VCPUS);
+    int ret = kvm_check_extension(s, KVM_CAP_NR_VCPUS);
    return (ret) ? ret : 4;
 }

@@ -1588,6 +1623,27 @@ static int kvm_init(MachineState *ms)
        s->nr_slots = 32;
    }

+    /* check the vcpu limits */
+    soft_vcpus_limit = kvm_recommended_vcpus(s);
+    hard_vcpus_limit = kvm_max_vcpus(s);
+
+    while (nc->name) {
+        if (nc->num > soft_vcpus_limit) {
+            fprintf(stderr,
+                    "Warning: Number of %s cpus requested (%d) exceeds "
+                    "the recommended cpus supported by KVM (%d)\n",
+                    nc->name, nc->num, soft_vcpus_limit);
+
+            if (nc->num > hard_vcpus_limit) {
+                fprintf(stderr, "Number of %s cpus requested (%d) exceeds "
+                        "the maximum cpus supported by KVM (%d)\n",
+                        nc->name, nc->num, hard_vcpus_limit);
+                exit(1);
+            }
+        }
+        nc++;
+    }
+
    kvm_type = qemu_opt_get(qemu_get_machine_opts(), "kvm-type");
    if (mc->kvm_type) {
        type = mc->kvm_type(kvm_type);
@@ -1622,27 +1678,6 @@ static int kvm_init(MachineState *ms)
    }

    s->vmfd = ret;
-
-    /* check the vcpu limits */
-    soft_vcpus_limit = kvm_recommended_vcpus(s);
-    hard_vcpus_limit = kvm_max_vcpus(s);
-
-    while (nc->name) {
-        if (nc->num > soft_vcpus_limit) {
-            warn_report("Number of %s cpus requested (%d) exceeds "
-                        "the recommended cpus supported by KVM (%d)",
-                        nc->name, nc->num, soft_vcpus_limit);
-
-            if (nc->num > hard_vcpus_limit) {
-                fprintf(stderr, "Number of %s cpus requested (%d) exceeds "
-                        "the maximum cpus supported by KVM (%d)\n",
-                        nc->name, nc->num, hard_vcpus_limit);
-                exit(1);
-            }
-        }
-        nc++;
-    }
-
    missing_cap = kvm_check_extension_list(s, kvm_required_capabilites);
    if (!missing_cap) {
        missing_cap =
@@ -1656,8 +1691,12 @@ static int kvm_init(MachineState *ms)
    }

    s->coalesced_mmio = kvm_check_extension(s, KVM_CAP_COALESCED_MMIO);
-    s->coalesced_pio = s->coalesced_mmio &&
-                       kvm_check_extension(s, KVM_CAP_COALESCED_PIO);
+
+    s->broken_set_mem_region = 1;
+    ret = kvm_check_extension(s, KVM_CAP_JOIN_MEMORY_REGIONS_WORKS);
+    if (ret > 0) {
+        s->broken_set_mem_region = 0;
+    }

 #ifdef KVM_CAP_VCPU_EVENTS
    s->vcpu_events = kvm_check_extension(s, KVM_CAP_VCPU_EVENTS);
@@ -1681,8 +1720,10 @@ static int kvm_init(MachineState *ms)
        s->irq_set_ioctl = KVM_IRQ_LINE_STATUS;
    }

+#ifdef KVM_CAP_READONLY_MEM
    kvm_readonly_mem_allowed =
        (kvm_check_extension(s, KVM_CAP_READONLY_MEM) > 0);
+#endif

    kvm_eventfds_allowed =
        (kvm_check_extension(s, KVM_CAP_IOEVENTFD) > 0);
@@ -1701,20 +1742,6 @@ static int kvm_init(MachineState *ms)

    kvm_state = s;

-    /*
-     * if memory encryption object is specified then initialize the memory
-     * encryption context.
-     */
-    if (ms->memory_encryption) {
-        kvm_state->memcrypt_handle = sev_guest_init(ms->memory_encryption);
-        if (!kvm_state->memcrypt_handle) {
-            ret = -1;
-            goto err;
-        }
-
-        kvm_state->memcrypt_encrypt_data = sev_encrypt_data;
-    }
-
    ret = kvm_arch_init(ms, s);
    if (ret < 0) {
        goto err;
@@ -1728,23 +1755,16 @@ static int kvm_init(MachineState *ms)
        s->memory_listener.listener.eventfd_add = kvm_mem_ioeventfd_add;
        s->memory_listener.listener.eventfd_del = kvm_mem_ioeventfd_del;
    }
-    s->memory_listener.listener.coalesced_io_add = kvm_coalesce_mmio_region;
-    s->memory_listener.listener.coalesced_io_del = kvm_uncoalesce_mmio_region;
+    s->memory_listener.listener.coalesced_mmio_add = kvm_coalesce_mmio_region;
+    s->memory_listener.listener.coalesced_mmio_del = kvm_uncoalesce_mmio_region;

    kvm_memory_listener_register(s, &s->memory_listener,
                                 &address_space_memory, 0);
    memory_listener_register(&kvm_io_listener,
                             &address_space_io);
-    memory_listener_register(&kvm_coalesced_pio_listener,
-                             &address_space_io);

    s->many_ioeventfds = kvm_check_many_ioeventfds();

-    s->sync_mmu = !!kvm_vm_check_extension(kvm_state, KVM_CAP_SYNC_MMU);
-    if (!s->sync_mmu) {
-        qemu_balloon_inhibit(true);
-    }
-
    return 0;

 err:
@@ -1822,13 +1842,7 @@ void kvm_flush_coalesced_mmio_buffer(void)

            ent = &ring->coalesced_mmio[ring->first];

-            if (ent->pio == 1) {
-                address_space_rw(&address_space_io, ent->phys_addr,
-                                 MEMTXATTRS_UNSPECIFIED, ent->data,
-                                 ent->len, true);
-            } else {
-                cpu_physical_memory_write(ent->phys_addr, ent->data, ent->len);
-            }
+            cpu_physical_memory_write(ent->phys_addr, ent->data, ent->len);
            smp_wmb();
            ring->first = (ring->first + 1) % KVM_COALESCED_MMIO_MAX;
        }
@@ -2217,9 +2231,10 @@ int kvm_device_access(int fd, int group, uint64_t attr,
    return err;
 }

-bool kvm_has_sync_mmu(void)
+/* Return 1 on success, 0 on failure */
+int kvm_has_sync_mmu(void)
 {
-    return kvm_state->sync_mmu;
+    return kvm_check_extension(kvm_state, KVM_CAP_SYNC_MMU);
 }

 int kvm_has_vcpu_events(void)
--- a/accel/kvm/sev-stub.c
+++ b/accel/kvm/sev-stub.c
@@ -1,26 +0,0 @@
-/*
- * QEMU SEV stub
- *
- * Copyright Advanced Micro Devices 2018
- *
- * Authors:
- *      Brijesh Singh <brijesh.singh@amd.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "sysemu/sev.h"
-
-int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
-{
-    abort();
-}
-
-void *sev_guest_init(const char *id)
-{
-    return NULL;
-}
--- a/accel/kvm/trace-events
+++ b/accel/kvm/trace-events
@@ -12,5 +12,4 @@ kvm_irqchip_commit_routes(void) ""
 kvm_irqchip_add_msi_route(char *name, int vector, int virq) "dev %s vector %d virq %d"
 kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
 kvm_irqchip_release_virq(int virq) "virq %d"
-kvm_set_user_memory(uint32_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"

--- a/accel/stubs/Makefile.objs
+++ b/accel/stubs/Makefile.objs
@@ -1,5 +1,2 @@
-obj-$(call lnot,$(CONFIG_HAX))  += hax-stub.o
-obj-$(call lnot,$(CONFIG_HVF))  += hvf-stub.o
-obj-$(call lnot,$(CONFIG_WHPX)) += whpx-stub.o
-obj-$(call lnot,$(CONFIG_KVM))  += kvm-stub.o
-obj-$(call lnot,$(CONFIG_TCG))  += tcg-stub.o
+obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
+obj-$(call lnot,$(CONFIG_TCG)) += tcg-stub.o
--- a/accel/stubs/hvf-stub.c
+++ b/accel/stubs/hvf-stub.c
@@ -1,31 +0,0 @@
-/*
- * QEMU HVF support
- *
- * Copyright 2017 Red Hat, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2 or later, as published by the Free Software Foundation,
- * and may be copied, distributed, and modified under those terms.
- *
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "cpu.h"
-#include "sysemu/hvf.h"
-
-int hvf_init_vcpu(CPUState *cpu)
-{
-    return -ENOSYS;
-}
-
-int hvf_vcpu_exec(CPUState *cpu)
-{
-    return -ENOSYS;
-}
-
-void hvf_vcpu_destroy(CPUState *cpu)
-{
-}
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -64,9 +64,9 @@ int kvm_cpu_exec(CPUState *cpu)
    abort();
 }

-bool kvm_has_sync_mmu(void)
+int kvm_has_sync_mmu(void)
 {
-    return false;
+    return 0;
 }

 int kvm_has_many_ioeventfds(void)
@@ -105,16 +105,6 @@ int kvm_on_sigbus(int code, void *addr)
    return 1;
 }

-bool kvm_memcrypt_enabled(void)
-{
-    return false;
-}
-
-int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
-{
-  return 1;
-}
-
 #ifndef CONFIG_USER_ONLY
 int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
 {
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -20,7 +20,3 @@
 void tb_flush(CPUState *cpu)
 {
 }
-
-void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
-{
-}
--- a/accel/stubs/whpx-stub.c
+++ b/accel/stubs/whpx-stub.c
@@ -1,48 +0,0 @@
-/*
- * QEMU Windows Hypervisor Platform accelerator (WHPX) stub
- *
- * Copyright Microsoft Corp. 2017
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "cpu.h"
-#include "sysemu/whpx.h"
-
-int whpx_init_vcpu(CPUState *cpu)
-{
-    return -1;
-}
-
-int whpx_vcpu_exec(CPUState *cpu)
-{
-    return -1;
-}
-
-void whpx_destroy_vcpu(CPUState *cpu)
-{
-}
-
-void whpx_vcpu_kick(CPUState *cpu)
-{
-}
-
-void whpx_cpu_synchronize_state(CPUState *cpu)
-{
-}
-
-void whpx_cpu_synchronize_post_reset(CPUState *cpu)
-{
-}
-
-void whpx_cpu_synchronize_post_init(CPUState *cpu)
-{
-}
-
-void whpx_cpu_synchronize_pre_loadvm(CPUState *cpu)
-{
-}
--- a/accel/tcg/Makefile.objs
+++ b/accel/tcg/Makefile.objs
@@ -1,8 +1,3 @@
 obj-$(CONFIG_SOFTMMU) += tcg-all.o
 obj-$(CONFIG_SOFTMMU) += cputlb.o
-obj-y += tcg-runtime.o tcg-runtime-gvec.o
 obj-y += cpu-exec.o cpu-exec-common.o translate-all.o
-obj-y += translator.o
-
-obj-$(CONFIG_USER_ONLY) += user-exec.o
-obj-$(call lnot,$(CONFIG_SOFTMMU)) += user-exec-stub.o
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -1,368 +0,0 @@
-/*
- * Atomic helper templates
- * Included from tcg-runtime.c and cputlb.c.
- *
- * Copyright (c) 2016 Red Hat, Inc
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "trace/mem.h"
-
-#if DATA_SIZE == 16
-# define SUFFIX     o
-# define DATA_TYPE  Int128
-# define BSWAP      bswap128
-# define SHIFT      4
-#elif DATA_SIZE == 8
-# define SUFFIX     q
-# define DATA_TYPE  uint64_t
-# define SDATA_TYPE int64_t
-# define BSWAP      bswap64
-# define SHIFT      3
-#elif DATA_SIZE == 4
-# define SUFFIX     l
-# define DATA_TYPE  uint32_t
-# define SDATA_TYPE int32_t
-# define BSWAP      bswap32
-# define SHIFT      2
-#elif DATA_SIZE == 2
-# define SUFFIX     w
-# define DATA_TYPE  uint16_t
-# define SDATA_TYPE int16_t
-# define BSWAP      bswap16
-# define SHIFT      1
-#elif DATA_SIZE == 1
-# define SUFFIX     b
-# define DATA_TYPE  uint8_t
-# define SDATA_TYPE int8_t
-# define BSWAP
-# define SHIFT      0
-#else
-# error unsupported data size
-#endif
-
-#if DATA_SIZE >= 4
-# define ABI_TYPE  DATA_TYPE
-#else
-# define ABI_TYPE  uint32_t
-#endif
-
-#define ATOMIC_TRACE_RMW do {                                           \
-        uint8_t info = glue(trace_mem_build_info_no_se, MEND)(SHIFT, false); \
-                                                                        \
-        trace_guest_mem_before_exec(ENV_GET_CPU(env), addr, info);      \
-        trace_guest_mem_before_exec(ENV_GET_CPU(env), addr,             \
-                                    info | TRACE_MEM_ST);               \
-    } while (0)
-
-#define ATOMIC_TRACE_LD do {                                            \
-        uint8_t info = glue(trace_mem_build_info_no_se, MEND)(SHIFT, false); \
-                                                                        \
-        trace_guest_mem_before_exec(ENV_GET_CPU(env), addr, info);      \
-    } while (0)
-
-# define ATOMIC_TRACE_ST do {                                           \
-        uint8_t info = glue(trace_mem_build_info_no_se, MEND)(SHIFT, true); \
-                                                                        \
-        trace_guest_mem_before_exec(ENV_GET_CPU(env), addr, info);      \
-    } while (0)
-
-/* Define host-endian atomic operations.  Note that END is used within
-   the ATOMIC_NAME macro, and redefined below.  */
-#if DATA_SIZE == 1
-# define END
-# define MEND _be /* either le or be would be fine */
-#elif defined(HOST_WORDS_BIGENDIAN)
-# define END  _be
-# define MEND _be
-#else
-# define END  _le
-# define MEND _le
-#endif
-
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
-                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ret;
-
-    ATOMIC_TRACE_RMW;
-#if DATA_SIZE == 16
-    ret = atomic16_cmpxchg(haddr, cmpv, newv);
-#else
-    ret = atomic_cmpxchg__nocheck(haddr, cmpv, newv);
-#endif
-    ATOMIC_MMU_CLEANUP;
-    return ret;
-}
-
-#if DATA_SIZE >= 16
-#if HAVE_ATOMIC128
-ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
-
-    ATOMIC_TRACE_LD;
-    val = atomic16_read(haddr);
-    ATOMIC_MMU_CLEANUP;
-    return val;
-}
-
-void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
-                     ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-
-    ATOMIC_TRACE_ST;
-    atomic16_set(haddr, val);
-    ATOMIC_MMU_CLEANUP;
-}
-#endif
-#else
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
-                           ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ret;
-
-    ATOMIC_TRACE_RMW;
-    ret = atomic_xchg__nocheck(haddr, val);
-    ATOMIC_MMU_CLEANUP;
-    return ret;
-}
-
-#define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
-{                                                                   \
-    ATOMIC_MMU_DECLS;                                               \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-    DATA_TYPE ret;                                                  \
-                                                                    \
-    ATOMIC_TRACE_RMW;                                               \
-    ret = atomic_##X(haddr, val);                                   \
-    ATOMIC_MMU_CLEANUP;                                             \
-    return ret;                                                     \
-}
-
-GEN_ATOMIC_HELPER(fetch_add)
-GEN_ATOMIC_HELPER(fetch_and)
-GEN_ATOMIC_HELPER(fetch_or)
-GEN_ATOMIC_HELPER(fetch_xor)
-GEN_ATOMIC_HELPER(add_fetch)
-GEN_ATOMIC_HELPER(and_fetch)
-GEN_ATOMIC_HELPER(or_fetch)
-GEN_ATOMIC_HELPER(xor_fetch)
-
-#undef GEN_ATOMIC_HELPER
-
-/* These helpers are, as a whole, full barriers.  Within the helper,
- * the leading barrier is explicit and the trailing barrier is within
- * cmpxchg primitive.
- *
- * Trace this load + RMW loop as a single RMW op. This way, regardless
- * of CF_PARALLEL's value, we'll trace just a read and a write.
- */
-#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                        ABI_TYPE xval EXTRA_ARGS)                   \
-{                                                                   \
-    ATOMIC_MMU_DECLS;                                               \
-    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
-    XDATA_TYPE cmp, old, new, val = xval;                           \
-                                                                    \
-    ATOMIC_TRACE_RMW;                                               \
-    smp_mb();                                                       \
-    cmp = atomic_read__nocheck(haddr);                              \
-    do {                                                            \
-        old = cmp; new = FN(old, val);                              \
-        cmp = atomic_cmpxchg__nocheck(haddr, old, new);             \
-    } while (cmp != old);                                           \
-    ATOMIC_MMU_CLEANUP;                                             \
-    return RET;                                                     \
-}
-
-GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
-
-GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
-
-#undef GEN_ATOMIC_HELPER_FN
-#endif /* DATA SIZE >= 16 */
-
-#undef END
-#undef MEND
-
-#if DATA_SIZE > 1
-
-/* Define reverse-host-endian atomic operations.  Note that END is used
-   within the ATOMIC_NAME macro.  */
-#ifdef HOST_WORDS_BIGENDIAN
-# define END  _le
-# define MEND _le
-#else
-# define END  _be
-# define MEND _be
-#endif
-
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
-                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ret;
-
-    ATOMIC_TRACE_RMW;
-#if DATA_SIZE == 16
-    ret = atomic16_cmpxchg(haddr, BSWAP(cmpv), BSWAP(newv));
-#else
-    ret = atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv));
-#endif
-    ATOMIC_MMU_CLEANUP;
-    return BSWAP(ret);
-}
-
-#if DATA_SIZE >= 16
-#if HAVE_ATOMIC128
-ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
-
-    ATOMIC_TRACE_LD;
-    val = atomic16_read(haddr);
-    ATOMIC_MMU_CLEANUP;
-    return BSWAP(val);
-}
-
-void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
-                     ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-
-    ATOMIC_TRACE_ST;
-    val = BSWAP(val);
-    atomic16_set(haddr, val);
-    ATOMIC_MMU_CLEANUP;
-}
-#endif
-#else
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
-                           ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    ABI_TYPE ret;
-
-    ATOMIC_TRACE_RMW;
-    ret = atomic_xchg__nocheck(haddr, BSWAP(val));
-    ATOMIC_MMU_CLEANUP;
-    return BSWAP(ret);
-}
-
-#define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
-{                                                                   \
-    ATOMIC_MMU_DECLS;                                               \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-    DATA_TYPE ret;                                                  \
-                                                                    \
-    ATOMIC_TRACE_RMW;                                               \
-    ret = atomic_##X(haddr, BSWAP(val));                            \
-    ATOMIC_MMU_CLEANUP;                                             \
-    return BSWAP(ret);                                              \
-}
-
-GEN_ATOMIC_HELPER(fetch_and)
-GEN_ATOMIC_HELPER(fetch_or)
-GEN_ATOMIC_HELPER(fetch_xor)
-GEN_ATOMIC_HELPER(and_fetch)
-GEN_ATOMIC_HELPER(or_fetch)
-GEN_ATOMIC_HELPER(xor_fetch)
-
-#undef GEN_ATOMIC_HELPER
-
-/* These helpers are, as a whole, full barriers.  Within the helper,
- * the leading barrier is explicit and the trailing barrier is within
- * cmpxchg primitive.
- *
- * Trace this load + RMW loop as a single RMW op. This way, regardless
- * of CF_PARALLEL's value, we'll trace just a read and a write.
- */
-#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                        ABI_TYPE xval EXTRA_ARGS)                   \
-{                                                                   \
-    ATOMIC_MMU_DECLS;                                               \
-    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
-    XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
-                                                                    \
-    ATOMIC_TRACE_RMW;                                               \
-    smp_mb();                                                       \
-    ldn = atomic_read__nocheck(haddr);                              \
-    do {                                                            \
-        ldo = ldn; old = BSWAP(ldo); new = FN(old, val);            \
-        ldn = atomic_cmpxchg__nocheck(haddr, ldo, BSWAP(new));      \
-    } while (ldo != ldn);                                           \
-    ATOMIC_MMU_CLEANUP;                                             \
-    return RET;                                                     \
-}
-
-GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
-
-GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
-GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
-
-/* Note that for addition, we need to use a separate cmpxchg loop instead
-   of bswaps for the reverse-host-endian helpers.  */
-#define ADD(X, Y)   (X + Y)
-GEN_ATOMIC_HELPER_FN(fetch_add, ADD, DATA_TYPE, old)
-GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
-#undef ADD
-
-#undef GEN_ATOMIC_HELPER_FN
-#endif /* DATA_SIZE >= 16 */
-
-#undef END
-#undef MEND
-#endif /* DATA_SIZE > 1 */
-
-#undef ATOMIC_TRACE_ST
-#undef ATOMIC_TRACE_LD
-#undef ATOMIC_TRACE_RMW
-
-#undef BSWAP
-#undef ABI_TYPE
-#undef DATA_TYPE
-#undef SDATA_TYPE
-#undef SUFFIX
-#undef DATA_SIZE
-#undef SHIFT
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -21,14 +21,17 @@
 #include "cpu.h"
 #include "sysemu/cpus.h"
 #include "exec/exec-all.h"
+#include "exec/memory-internal.h"

 bool tcg_allowed;

 /* exit the current TB, but without causing any exception to be raised */
 void cpu_loop_exit_noexc(CPUState *cpu)
 {
+    /* XXX: restore cpu registers saved in host registers */
+
    cpu->exception_index = -1;
-    cpu_loop_exit(cpu);
+    siglongjmp(cpu->jmp_env, 1);
 }

 #if defined(CONFIG_SOFTMMU)
@@ -63,17 +66,15 @@ void cpu_reloading_memory_map(void)

 void cpu_loop_exit(CPUState *cpu)
 {
-    /* Undo the setting in cpu_tb_exec.  */
-    cpu->can_do_io = 1;
    siglongjmp(cpu->jmp_env, 1);
 }

 void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
 {
    if (pc) {
-        cpu_restore_state(cpu, pc, true);
+        cpu_restore_state(cpu, pc);
    }
-    cpu_loop_exit(cpu);
+    siglongjmp(cpu->jmp_env, 1);
 }

 void cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc)
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -25,9 +25,9 @@
 #include "qemu/atomic.h"
 #include "sysemu/qtest.h"
 #include "qemu/timer.h"
+#include "exec/address-spaces.h"
 #include "qemu/rcu.h"
 #include "exec/tb-hash.h"
-#include "exec/tb-lookup.h"
 #include "exec/log.h"
 #include "qemu/main-loop.h"
 #if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
@@ -142,27 +142,22 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
    uintptr_t ret;
    TranslationBlock *last_tb;
    int tb_exit;
-    uint8_t *tb_ptr = itb->tc.ptr;
+    uint8_t *tb_ptr = itb->tc_ptr;

    qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc,
-                           "Trace %d: %p ["
-                           TARGET_FMT_lx "/" TARGET_FMT_lx "/%#x] %s\n",
-                           cpu->cpu_index, itb->tc.ptr,
-                           itb->cs_base, itb->pc, itb->flags,
+                           "Trace %p [%d: " TARGET_FMT_lx "] %s\n",
+                           itb->tc_ptr, cpu->cpu_index, itb->pc,
                           lookup_symbol(itb->pc));

 #if defined(DEBUG_DISAS)
    if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
        && qemu_log_in_addr_range(itb->pc)) {
        qemu_log_lock();
-        int flags = 0;
-        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
-            flags |= CPU_DUMP_FPU;
-        }
 #if defined(TARGET_I386)
-        flags |= CPU_DUMP_CCOP;
+        log_cpu_state(cpu, CPU_DUMP_CCOP);
+#else
+        log_cpu_state(cpu, 0);
 #endif
-        log_cpu_state(cpu, flags);
        qemu_log_unlock();
    }
 #endif /* DEBUG_DISAS */
@@ -183,7 +178,7 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
                               "Stopped execution of TB chain before %p ["
                               TARGET_FMT_lx "] %s\n",
-                               last_tb->tc.ptr, last_tb->pc,
+                               last_tb->tc_ptr, last_tb->pc,
                               lookup_symbol(last_tb->pc));
        if (cc->synchronize_from_tb) {
            cc->synchronize_from_tb(cpu, last_tb);
@@ -202,81 +197,81 @@ static void cpu_exec_nocache(CPUState *cpu, int max_cycles,
                             TranslationBlock *orig_tb, bool ignore_icount)
 {
    TranslationBlock *tb;
-    uint32_t cflags = curr_cflags() | CF_NOCACHE;
-
-    if (ignore_icount) {
-        cflags &= ~CF_USE_ICOUNT;
-    }

    /* Should never happen.
       We only end up here when an existing TB is too long.  */
-    cflags |= MIN(max_cycles, CF_COUNT_MASK);
+    if (max_cycles > CF_COUNT_MASK)
+        max_cycles = CF_COUNT_MASK;

-    mmap_lock();
-    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base,
-                     orig_tb->flags, cflags);
+    tb_lock();
+    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
+                     max_cycles | CF_NOCACHE
+                         | (ignore_icount ? CF_IGNORE_ICOUNT : 0));
    tb->orig_tb = orig_tb;
-    mmap_unlock();
+    tb_unlock();

    /* execute the generated code */
    trace_exec_tb_nocache(tb, tb->pc);
    cpu_tb_exec(cpu, tb);

-    mmap_lock();
+    tb_lock();
    tb_phys_invalidate(tb, -1);
-    mmap_unlock();
-    tcg_tb_remove(tb);
+    tb_free(tb);
+    tb_unlock();
 }
 #endif

-void cpu_exec_step_atomic(CPUState *cpu)
+static void cpu_exec_step(CPUState *cpu)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
+    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
-    uint32_t cflags = 1;
-    uint32_t cf_mask = cflags & CF_HASH_MASK;
-    /* volatile because we modify it between setjmp and longjmp */
-    volatile bool in_exclusive_region = false;

+    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
    if (sigsetjmp(cpu->jmp_env, 0) == 0) {
-        tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
-        if (tb == NULL) {
-            mmap_lock();
-            tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
-            mmap_unlock();
-        }
+        mmap_lock();
+        tb_lock();
+        tb = tb_gen_code(cpu, pc, cs_base, flags,
+                         1 | CF_NOCACHE | CF_IGNORE_ICOUNT);
+        tb->orig_tb = NULL;
+        tb_unlock();
+        mmap_unlock();

-        start_exclusive();
-
-        /* Since we got here, we know that parallel_cpus must be true.  */
-        parallel_cpus = false;
-        in_exclusive_region = true;
        cc->cpu_exec_enter(cpu);
        /* execute the generated code */
-        trace_exec_tb(tb, pc);
+        trace_exec_tb_nocache(tb, pc);
        cpu_tb_exec(cpu, tb);
        cc->cpu_exec_exit(cpu);
+
+        tb_lock();
+        tb_phys_invalidate(tb, -1);
+        tb_free(tb);
+        tb_unlock();
    } else {
-        /*
+        /* We may have exited due to another problem here, so we need
+         * to reset any tb_locks we may have taken but didn't release.
         * The mmap_lock is dropped by tb_gen_code if it runs out of
         * memory.
         */
 #ifndef CONFIG_SOFTMMU
        tcg_debug_assert(!have_mmap_lock());
 #endif
-        assert_no_pages_locked();
+        tb_lock_reset();
    }
+}

-    if (in_exclusive_region) {
-        /* We might longjump out of either the codegen or the
-         * execution, so must make sure we only end the exclusive
-         * region if we started it.
-         */
-        parallel_cpus = true;
-        end_exclusive();
-    }
+void cpu_exec_step_atomic(CPUState *cpu)
+{
+    start_exclusive();
+
+    /* Since we got here, we know that parallel_cpus must be true.  */
+    parallel_cpus = false;
+    cpu_exec_step(cpu);
+    parallel_cpus = true;
+
+    end_exclusive();
 }

 struct tb_desc {
@@ -285,11 +280,10 @@ struct tb_desc {
    CPUArchState *env;
    tb_page_addr_t phys_page1;
    uint32_t flags;
-    uint32_t cf_mask;
    uint32_t trace_vcpu_dstate;
 };

-static bool tb_lookup_cmp(const void *p, const void *d)
+static bool tb_cmp(const void *p, const void *d)
 {
    const TranslationBlock *tb = p;
    const struct tb_desc *desc = d;
@@ -299,7 +293,7 @@ static bool tb_lookup_cmp(const void *p, const void *d)
        tb->cs_base == desc->cs_base &&
        tb->flags == desc->flags &&
        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
-        (tb_cflags(tb) & (CF_HASH_MASK | CF_INVALID)) == desc->cf_mask) {
+        !atomic_read(&tb->invalid)) {
        /* check next page if needed */
        if (tb->page_addr[1] == -1) {
            return true;
@@ -318,8 +312,7 @@ static bool tb_lookup_cmp(const void *p, const void *d)
 }

 TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
-                                   target_ulong cs_base, uint32_t flags,
-                                   uint32_t cf_mask)
+                                   target_ulong cs_base, uint32_t flags)
 {
    tb_page_addr_t phys_pc;
    struct tb_desc desc;
@@ -328,81 +321,55 @@ TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
    desc.env = (CPUArchState *)cpu->env_ptr;
    desc.cs_base = cs_base;
    desc.flags = flags;
-    desc.cf_mask = cf_mask;
    desc.trace_vcpu_dstate = *cpu->trace_dstate;
    desc.pc = pc;
    phys_pc = get_page_addr_code(desc.env, pc);
-    if (phys_pc == -1) {
-        return NULL;
-    }
    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
-    h = tb_hash_func(phys_pc, pc, flags, cf_mask, *cpu->trace_dstate);
-    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
-}
-
-void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
-{
-    if (TCG_TARGET_HAS_direct_jump) {
-        uintptr_t offset = tb->jmp_target_arg[n];
-        uintptr_t tc_ptr = (uintptr_t)tb->tc.ptr;
-        tb_target_set_jmp_target(tc_ptr, tc_ptr + offset, addr);
-    } else {
-        tb->jmp_target_arg[n] = addr;
-    }
-}
-
-static inline void tb_add_jump(TranslationBlock *tb, int n,
-                               TranslationBlock *tb_next)
-{
-    uintptr_t old;
-
-    assert(n < ARRAY_SIZE(tb->jmp_list_next));
-    qemu_spin_lock(&tb_next->jmp_lock);
-
-    /* make sure the destination TB is valid */
-    if (tb_next->cflags & CF_INVALID) {
-        goto out_unlock_next;
-    }
-    /* Atomically claim the jump destination slot only if it was NULL */
-    old = atomic_cmpxchg(&tb->jmp_dest[n], (uintptr_t)NULL, (uintptr_t)tb_next);
-    if (old) {
-        goto out_unlock_next;
-    }
-
-    /* patch the native jump address */
-    tb_set_jmp_target(tb, n, (uintptr_t)tb_next->tc.ptr);
-
-    /* add in TB jmp list */
-    tb->jmp_list_next[n] = tb_next->jmp_list_head;
-    tb_next->jmp_list_head = (uintptr_t)tb | n;
-
-    qemu_spin_unlock(&tb_next->jmp_lock);
-
-    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
-                           "Linking TBs %p [" TARGET_FMT_lx
-                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
-                           tb->tc.ptr, tb->pc, n,
-                           tb_next->tc.ptr, tb_next->pc);
-    return;
-
- out_unlock_next:
-    qemu_spin_unlock(&tb_next->jmp_lock);
-    return;
+    h = tb_hash_func(phys_pc, pc, flags, *cpu->trace_dstate);
+    return qht_lookup(&tcg_ctx.tb_ctx.htable, tb_cmp, &desc, h);
 }

 static inline TranslationBlock *tb_find(CPUState *cpu,
                                        TranslationBlock *last_tb,
-                                        int tb_exit, uint32_t cf_mask)
+                                        int tb_exit)
 {
+    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
+    bool have_tb_lock = false;
+
+    /* we record a subset of the CPU state. It will
+       always be the same before a given translated block
+       is executed. */
+    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
+    tb = atomic_rcu_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]);
+    if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
+                 tb->flags != flags ||
+                 tb->trace_vcpu_dstate != *cpu->trace_dstate)) {
+        tb = tb_htable_lookup(cpu, pc, cs_base, flags);
+        if (!tb) {
+
+            /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
+             * taken outside tb_lock. As system emulation is currently
+             * single threaded the locks are NOPs.
+             */
+            mmap_lock();
+            tb_lock();
+            have_tb_lock = true;
+
+            /* There's a chance that our desired tb has been translated while
+             * taking the locks so we check again inside the lock.
+             */
+            tb = tb_htable_lookup(cpu, pc, cs_base, flags);
+            if (!tb) {
+                /* if no translated code available, then translate it now */
+                tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+            }
+
+            mmap_unlock();
+        }

-    tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
-    if (tb == NULL) {
-        mmap_lock();
-        tb = tb_gen_code(cpu, pc, cs_base, flags, cf_mask);
-        mmap_unlock();
        /* We add the TB in the virtual pc hash table for the fast lookup */
        atomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
    }
@@ -416,8 +383,17 @@ static inline TranslationBlock *tb_find(CPUState *cpu,
    }
 #endif
    /* See if we can patch the calling TB. */
-    if (last_tb) {
-        tb_add_jump(last_tb, tb_exit, tb);
+    if (last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+        if (!have_tb_lock) {
+            tb_lock();
+            have_tb_lock = true;
+        }
+        if (!tb->invalid) {
+            tb_add_jump(last_tb, tb_exit, tb);
+        }
+    }
+    if (have_tb_lock) {
+        tb_unlock();
    }
    return tb;
 }
@@ -461,51 +437,48 @@ static inline void cpu_handle_debug_exception(CPUState *cpu)

 static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 {
-    if (cpu->exception_index < 0) {
-#ifndef CONFIG_USER_ONLY
-        if (replay_has_exception()
-               && cpu->icount_decr.u16.low + cpu->icount_extra == 0) {
-            /* try to cause an exception pending in the log */
-            cpu_exec_nocache(cpu, 1, tb_find(cpu, NULL, 0, curr_cflags()), true);
-        }
-#endif
-        if (cpu->exception_index < 0) {
-            return false;
-        }
-    }
-
-    if (cpu->exception_index >= EXCP_INTERRUPT) {
-        /* exit request from the cpu execution loop */
-        *ret = cpu->exception_index;
-        if (*ret == EXCP_DEBUG) {
-            cpu_handle_debug_exception(cpu);
-        }
-        cpu->exception_index = -1;
-        return true;
-    } else {
-#if defined(CONFIG_USER_ONLY)
-        /* if user mode only, we simulate a fake exception
-           which will be handled outside the cpu execution
-           loop */
-#if defined(TARGET_I386)
-        CPUClass *cc = CPU_GET_CLASS(cpu);
-        cc->do_interrupt(cpu);
-#endif
-        *ret = cpu->exception_index;
-        cpu->exception_index = -1;
-        return true;
-#else
-        if (replay_exception()) {
-            CPUClass *cc = CPU_GET_CLASS(cpu);
-            qemu_mutex_lock_iothread();
-            cc->do_interrupt(cpu);
-            qemu_mutex_unlock_iothread();
+    if (cpu->exception_index >= 0) {
+        if (cpu->exception_index >= EXCP_INTERRUPT) {
+            /* exit request from the cpu execution loop */
+            *ret = cpu->exception_index;
+            if (*ret == EXCP_DEBUG) {
+                cpu_handle_debug_exception(cpu);
+            }
            cpu->exception_index = -1;
-        } else if (!replay_has_interrupt()) {
-            /* give a chance to iothread in replay mode */
-            *ret = EXCP_INTERRUPT;
            return true;
+        } else {
+#if defined(CONFIG_USER_ONLY)
+            /* if user mode only, we simulate a fake exception
+               which will be handled outside the cpu execution
+               loop */
+#if defined(TARGET_I386)
+            CPUClass *cc = CPU_GET_CLASS(cpu);
+            cc->do_interrupt(cpu);
+#endif
+            *ret = cpu->exception_index;
+            cpu->exception_index = -1;
+            return true;
+#else
+            if (replay_exception()) {
+                CPUClass *cc = CPU_GET_CLASS(cpu);
+                qemu_mutex_lock_iothread();
+                cc->do_interrupt(cpu);
+                qemu_mutex_unlock_iothread();
+                cpu->exception_index = -1;
+            } else if (!replay_has_interrupt()) {
+                /* give a chance to iothread in replay mode */
+                *ret = EXCP_INTERRUPT;
+                return true;
+            }
+#endif
        }
+#ifndef CONFIG_USER_ONLY
+    } else if (replay_has_exception()
+               && cpu->icount_decr.u16.low + cpu->icount_extra == 0) {
+        /* try to cause an exception pending in the log */
+        cpu_exec_nocache(cpu, 1, tb_find(cpu, NULL, 0), true);
+        *ret = -1;
+        return true;
 #endif
    }

@@ -517,13 +490,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);

-    /* Clear the interrupt flag now since we're processing
-     * cpu->interrupt_request and cpu->exit_request.
-     * Ensure zeroing happens before reading cpu->exit_request or
-     * cpu->interrupt_request (see also smp_wmb in cpu_exit())
-     */
-    atomic_mb_set(&cpu->icount_decr.u16.high, 0);
-
    if (unlikely(atomic_read(&cpu->interrupt_request))) {
        int interrupt_request;
        qemu_mutex_lock_iothread();
@@ -574,7 +540,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
        else {
            if (cc->cpu_exec_interrupt(cpu, interrupt_request)) {
                replay_interrupt();
-                cpu->exception_index = -1;
                *last_tb = NULL;
            }
            /* The target hook may have updated the 'cpu->interrupt_request';
@@ -596,9 +561,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
    if (unlikely(atomic_read(&cpu->exit_request)
        || (use_icount && cpu->icount_decr.u16.low + cpu->icount_extra == 0))) {
        atomic_set(&cpu->exit_request, 0);
-        if (cpu->exception_index == -1) {
-            cpu->exception_index = EXCP_INTERRUPT;
-        }
+        cpu->exception_index = EXCP_INTERRUPT;
        return true;
    }

@@ -622,14 +585,17 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,

    *last_tb = NULL;
    insns_left = atomic_read(&cpu->icount_decr.u32);
+    atomic_set(&cpu->icount_decr.u16.high, 0);
    if (insns_left < 0) {
        /* Something asked us to stop executing chained TBs; just
         * continue round the main loop. Whatever requested the exit
         * will also have set something else (eg exit_request or
-         * interrupt_request) which will be handled by
-         * cpu_handle_interrupt.  cpu_handle_interrupt will also
-         * clear cpu->icount_decr.u16.high.
+         * interrupt_request) which we will handle next time around
+         * the loop.  But we need to ensure the zeroing of icount_decr
+         * comes before the next read of cpu->exit_request
+         * or cpu->interrupt_request.
         */
+        smp_mb();
        return;
    }

@@ -693,9 +659,8 @@ int cpu_exec(CPUState *cpu)
        g_assert(cpu == current_cpu);
        g_assert(cc == CPU_GET_CLASS(cpu));
 #endif /* buggy compiler */
-#ifndef CONFIG_SOFTMMU
-        tcg_debug_assert(!have_mmap_lock());
-#endif
+        cpu->can_do_io = 1;
+        tb_lock_reset();
        if (qemu_mutex_iothread_locked()) {
            qemu_mutex_unlock_iothread();
        }
@@ -707,21 +672,7 @@ int cpu_exec(CPUState *cpu)
        int tb_exit = 0;

        while (!cpu_handle_interrupt(cpu, &last_tb)) {
-            uint32_t cflags = cpu->cflags_next_tb;
-            TranslationBlock *tb;
-
-            /* When requested, use an exact setting for cflags for the next
-               execution.  This is used for icount, precise smc, and stop-
-               after-access watchpoints.  Since this request should never
-               have CF_INVALID set, -1 is a convenient invalid value that
-               does not require tcg headers for cpu_common_reset.  */
-            if (cflags == -1) {
-                cflags = curr_cflags();
-            } else {
-                cpu->cflags_next_tb = -1;
-            }
-
-            tb = tb_find(cpu, last_tb, tb_exit, cflags);
+            TranslationBlock *tb = tb_find(cpu, last_tb, tb_exit);
            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
            /* Try to align the host and virtual clocks
               if the guest is in advance */
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -51,7 +51,7 @@ static void tcg_handle_interrupt(CPUState *cpu, int mask)
    if (!qemu_cpu_is_self(cpu)) {
        qemu_cpu_kick(cpu);
    } else {
-        atomic_set(&cpu->icount_decr.u16.high, -1);
+        cpu->icount_decr.u16.high = -1;
        if (use_icount &&
            !cpu->can_do_io
            && (mask & ~old_mask) != 0) {
--- a/accel/tcg/tcg-runtime-gvec.c
+++ b/accel/tcg/tcg-runtime-gvec.c
@@ -1,997 +0,0 @@
-/*
- * Generic vectorized operation runtime
- *
- * Copyright (c) 2018 Linaro
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "qemu/host-utils.h"
-#include "cpu.h"
-#include "exec/helper-proto.h"
-#include "tcg-gvec-desc.h"
-
-
-/* Virtually all hosts support 16-byte vectors.  Those that don't can emulate
- * them via GCC's generic vector extension.  This turns out to be simpler and
- * more reliable than getting the compiler to autovectorize.
- *
- * In tcg-op-gvec.c, we asserted that both the size and alignment of the data
- * are multiples of 16.
- *
- * When the compiler does not support all of the operations we require, the
- * loops are written so that we can always fall back on the base types.
- */
-#ifdef CONFIG_VECTOR16
-typedef uint8_t vec8 __attribute__((vector_size(16)));
-typedef uint16_t vec16 __attribute__((vector_size(16)));
-typedef uint32_t vec32 __attribute__((vector_size(16)));
-typedef uint64_t vec64 __attribute__((vector_size(16)));
-
-typedef int8_t svec8 __attribute__((vector_size(16)));
-typedef int16_t svec16 __attribute__((vector_size(16)));
-typedef int32_t svec32 __attribute__((vector_size(16)));
-typedef int64_t svec64 __attribute__((vector_size(16)));
-
-#define DUP16(X)  { X, X, X, X, X, X, X, X, X, X, X, X, X, X, X, X }
-#define DUP8(X)   { X, X, X, X, X, X, X, X }
-#define DUP4(X)   { X, X, X, X }
-#define DUP2(X)   { X, X }
-#else
-typedef uint8_t vec8;
-typedef uint16_t vec16;
-typedef uint32_t vec32;
-typedef uint64_t vec64;
-
-typedef int8_t svec8;
-typedef int16_t svec16;
-typedef int32_t svec32;
-typedef int64_t svec64;
-
-#define DUP16(X)  X
-#define DUP8(X)   X
-#define DUP4(X)   X
-#define DUP2(X)   X
-#endif /* CONFIG_VECTOR16 */
-
-static inline void clear_high(void *d, intptr_t oprsz, uint32_t desc)
-{
-    intptr_t maxsz = simd_maxsz(desc);
-    intptr_t i;
-
-    if (unlikely(maxsz > oprsz)) {
-        for (i = oprsz; i < maxsz; i += sizeof(uint64_t)) {
-            *(uint64_t *)(d + i) = 0;
-        }
-    }
-}
-
-void HELPER(gvec_add8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) + *(vec8 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_add16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) + *(vec16 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_add32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) + *(vec32 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_add64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) + *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_adds8)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec8 vecb = (vec8)DUP16(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) + vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_adds16)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec16 vecb = (vec16)DUP8(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) + vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_adds32)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec32 vecb = (vec32)DUP4(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) + vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_adds64)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) + vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sub8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) - *(vec8 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sub16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) - *(vec16 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sub32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) - *(vec32 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sub64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) - *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_subs8)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec8 vecb = (vec8)DUP16(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) - vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_subs16)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec16 vecb = (vec16)DUP8(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) - vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_subs32)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec32 vecb = (vec32)DUP4(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) - vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_subs64)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) - vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_mul8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) * *(vec8 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_mul16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) * *(vec16 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_mul32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) * *(vec32 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_mul64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) * *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_muls8)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec8 vecb = (vec8)DUP16(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) * vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_muls16)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec16 vecb = (vec16)DUP8(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) * vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_muls32)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec32 vecb = (vec32)DUP4(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) * vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_muls64)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) * vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_neg8)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = -*(vec8 *)(a + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_neg16)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = -*(vec16 *)(a + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_neg32)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = -*(vec32 *)(a + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_neg64)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = -*(vec64 *)(a + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_mov)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-
-    memcpy(d, a, oprsz);
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_dup64)(void *d, uint32_t desc, uint64_t c)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    if (c == 0) {
-        oprsz = 0;
-    } else {
-        for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-            *(uint64_t *)(d + i) = c;
-        }
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_dup32)(void *d, uint32_t desc, uint32_t c)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    if (c == 0) {
-        oprsz = 0;
-    } else {
-        for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-            *(uint32_t *)(d + i) = c;
-        }
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_dup16)(void *d, uint32_t desc, uint32_t c)
-{
-    HELPER(gvec_dup32)(d, desc, 0x00010001 * (c & 0xffff));
-}
-
-void HELPER(gvec_dup8)(void *d, uint32_t desc, uint32_t c)
-{
-    HELPER(gvec_dup32)(d, desc, 0x01010101 * (c & 0xff));
-}
-
-void HELPER(gvec_not)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~*(vec64 *)(a + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_and)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) & *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_or)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) | *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_xor)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) ^ *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_andc)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) &~ *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_orc)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) |~ *(vec64 *)(b + i);
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ands)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) & vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_xors)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) ^ vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ors)(void *d, void *a, uint64_t b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    vec64 vecb = (vec64)DUP2(b);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) | vecb;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shl8i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) << shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shl16i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) << shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shl32i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) << shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shl64i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) << shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shr8i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(vec8 *)(d + i) = *(vec8 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shr16i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(vec16 *)(d + i) = *(vec16 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shr32i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(vec32 *)(d + i) = *(vec32 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_shr64i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = *(vec64 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sar8i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec8)) {
-        *(svec8 *)(d + i) = *(svec8 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sar16i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec16)) {
-        *(svec16 *)(d + i) = *(svec16 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sar32i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec32)) {
-        *(svec32 *)(d + i) = *(svec32 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sar64i)(void *d, void *a, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    int shift = simd_data(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(svec64 *)(d + i) = *(svec64 *)(a + i) >> shift;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-/* If vectors are enabled, the compiler fills in -1 for true.
-   Otherwise, we must take care of this by hand.  */
-#ifdef CONFIG_VECTOR16
-# define DO_CMP0(X)  X
-#else
-# define DO_CMP0(X)  -(X)
-#endif
-
-#define DO_CMP1(NAME, TYPE, OP)                                            \
-void HELPER(NAME)(void *d, void *a, void *b, uint32_t desc)                \
-{                                                                          \
-    intptr_t oprsz = simd_oprsz(desc);                                     \
-    intptr_t i;                                                            \
-    for (i = 0; i < oprsz; i += sizeof(TYPE)) {                            \
-        *(TYPE *)(d + i) = DO_CMP0(*(TYPE *)(a + i) OP *(TYPE *)(b + i));  \
-    }                                                                      \
-    clear_high(d, oprsz, desc);                                            \
-}
-
-#define DO_CMP2(SZ) \
-    DO_CMP1(gvec_eq##SZ, vec##SZ, ==)    \
-    DO_CMP1(gvec_ne##SZ, vec##SZ, !=)    \
-    DO_CMP1(gvec_lt##SZ, svec##SZ, <)    \
-    DO_CMP1(gvec_le##SZ, svec##SZ, <=)   \
-    DO_CMP1(gvec_ltu##SZ, vec##SZ, <)    \
-    DO_CMP1(gvec_leu##SZ, vec##SZ, <=)
-
-DO_CMP2(8)
-DO_CMP2(16)
-DO_CMP2(32)
-DO_CMP2(64)
-
-#undef DO_CMP0
-#undef DO_CMP1
-#undef DO_CMP2
-
-void HELPER(gvec_ssadd8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int8_t)) {
-        int r = *(int8_t *)(a + i) + *(int8_t *)(b + i);
-        if (r > INT8_MAX) {
-            r = INT8_MAX;
-        } else if (r < INT8_MIN) {
-            r = INT8_MIN;
-        }
-        *(int8_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ssadd16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int r = *(int16_t *)(a + i) + *(int16_t *)(b + i);
-        if (r > INT16_MAX) {
-            r = INT16_MAX;
-        } else if (r < INT16_MIN) {
-            r = INT16_MIN;
-        }
-        *(int16_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ssadd32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t ai = *(int32_t *)(a + i);
-        int32_t bi = *(int32_t *)(b + i);
-        int32_t di = ai + bi;
-        if (((di ^ ai) &~ (ai ^ bi)) < 0) {
-            /* Signed overflow.  */
-            di = (di < 0 ? INT32_MAX : INT32_MIN);
-        }
-        *(int32_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ssadd64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t ai = *(int64_t *)(a + i);
-        int64_t bi = *(int64_t *)(b + i);
-        int64_t di = ai + bi;
-        if (((di ^ ai) &~ (ai ^ bi)) < 0) {
-            /* Signed overflow.  */
-            di = (di < 0 ? INT64_MAX : INT64_MIN);
-        }
-        *(int64_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sssub8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        int r = *(int8_t *)(a + i) - *(int8_t *)(b + i);
-        if (r > INT8_MAX) {
-            r = INT8_MAX;
-        } else if (r < INT8_MIN) {
-            r = INT8_MIN;
-        }
-        *(uint8_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sssub16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int r = *(int16_t *)(a + i) - *(int16_t *)(b + i);
-        if (r > INT16_MAX) {
-            r = INT16_MAX;
-        } else if (r < INT16_MIN) {
-            r = INT16_MIN;
-        }
-        *(int16_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sssub32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t ai = *(int32_t *)(a + i);
-        int32_t bi = *(int32_t *)(b + i);
-        int32_t di = ai - bi;
-        if (((di ^ ai) & (ai ^ bi)) < 0) {
-            /* Signed overflow.  */
-            di = (di < 0 ? INT32_MAX : INT32_MIN);
-        }
-        *(int32_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_sssub64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t ai = *(int64_t *)(a + i);
-        int64_t bi = *(int64_t *)(b + i);
-        int64_t di = ai - bi;
-        if (((di ^ ai) & (ai ^ bi)) < 0) {
-            /* Signed overflow.  */
-            di = (di < 0 ? INT64_MAX : INT64_MIN);
-        }
-        *(int64_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_usadd8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        unsigned r = *(uint8_t *)(a + i) + *(uint8_t *)(b + i);
-        if (r > UINT8_MAX) {
-            r = UINT8_MAX;
-        }
-        *(uint8_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_usadd16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        unsigned r = *(uint16_t *)(a + i) + *(uint16_t *)(b + i);
-        if (r > UINT16_MAX) {
-            r = UINT16_MAX;
-        }
-        *(uint16_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_usadd32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t ai = *(uint32_t *)(a + i);
-        uint32_t bi = *(uint32_t *)(b + i);
-        uint32_t di = ai + bi;
-        if (di < ai) {
-            di = UINT32_MAX;
-        }
-        *(uint32_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_usadd64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t ai = *(uint64_t *)(a + i);
-        uint64_t bi = *(uint64_t *)(b + i);
-        uint64_t di = ai + bi;
-        if (di < ai) {
-            di = UINT64_MAX;
-        }
-        *(uint64_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ussub8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        int r = *(uint8_t *)(a + i) - *(uint8_t *)(b + i);
-        if (r < 0) {
-            r = 0;
-        }
-        *(uint8_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ussub16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        int r = *(uint16_t *)(a + i) - *(uint16_t *)(b + i);
-        if (r < 0) {
-            r = 0;
-        }
-        *(uint16_t *)(d + i) = r;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ussub32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t ai = *(uint32_t *)(a + i);
-        uint32_t bi = *(uint32_t *)(b + i);
-        uint32_t di = ai - bi;
-        if (ai < bi) {
-            di = 0;
-        }
-        *(uint32_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_ussub64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t ai = *(uint64_t *)(a + i);
-        uint64_t bi = *(uint64_t *)(b + i);
-        uint64_t di = ai - bi;
-        if (ai < bi) {
-            di = 0;
-        }
-        *(uint64_t *)(d + i) = di;
-    }
-    clear_high(d, oprsz, desc);
-}
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -1,262 +0,0 @@
-DEF_HELPER_FLAGS_2(div_i32, TCG_CALL_NO_RWG_SE, s32, s32, s32)
-DEF_HELPER_FLAGS_2(rem_i32, TCG_CALL_NO_RWG_SE, s32, s32, s32)
-DEF_HELPER_FLAGS_2(divu_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-DEF_HELPER_FLAGS_2(remu_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-
-DEF_HELPER_FLAGS_2(div_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-DEF_HELPER_FLAGS_2(rem_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-DEF_HELPER_FLAGS_2(divu_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-DEF_HELPER_FLAGS_2(remu_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-
-DEF_HELPER_FLAGS_2(shl_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-DEF_HELPER_FLAGS_2(shr_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-
-DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-
-DEF_HELPER_FLAGS_2(clz_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-DEF_HELPER_FLAGS_2(ctz_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-DEF_HELPER_FLAGS_2(clz_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-DEF_HELPER_FLAGS_2(ctz_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-DEF_HELPER_FLAGS_1(clrsb_i32, TCG_CALL_NO_RWG_SE, i32, i32)
-DEF_HELPER_FLAGS_1(clrsb_i64, TCG_CALL_NO_RWG_SE, i64, i64)
-DEF_HELPER_FLAGS_1(ctpop_i32, TCG_CALL_NO_RWG_SE, i32, i32)
-DEF_HELPER_FLAGS_1(ctpop_i64, TCG_CALL_NO_RWG_SE, i64, i64)
-
-DEF_HELPER_FLAGS_1(lookup_tb_ptr, TCG_CALL_NO_WG_SE, ptr, env)
-
-DEF_HELPER_FLAGS_1(exit_atomic, TCG_CALL_NO_WG, noreturn, env)
-
-#ifdef CONFIG_SOFTMMU
-
-DEF_HELPER_FLAGS_5(atomic_cmpxchgb, TCG_CALL_NO_WG,
-                   i32, env, tl, i32, i32, i32)
-DEF_HELPER_FLAGS_5(atomic_cmpxchgw_be, TCG_CALL_NO_WG,
-                   i32, env, tl, i32, i32, i32)
-DEF_HELPER_FLAGS_5(atomic_cmpxchgw_le, TCG_CALL_NO_WG,
-                   i32, env, tl, i32, i32, i32)
-DEF_HELPER_FLAGS_5(atomic_cmpxchgl_be, TCG_CALL_NO_WG,
-                   i32, env, tl, i32, i32, i32)
-DEF_HELPER_FLAGS_5(atomic_cmpxchgl_le, TCG_CALL_NO_WG,
-                   i32, env, tl, i32, i32, i32)
-#ifdef CONFIG_ATOMIC64
-DEF_HELPER_FLAGS_5(atomic_cmpxchgq_be, TCG_CALL_NO_WG,
-                   i64, env, tl, i64, i64, i32)
-DEF_HELPER_FLAGS_5(atomic_cmpxchgq_le, TCG_CALL_NO_WG,
-                   i64, env, tl, i64, i64, i32)
-#endif
-
-#ifdef CONFIG_ATOMIC64
-#define GEN_ATOMIC_HELPERS(NAME)                                  \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), b),              \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_le),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_be),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_le),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_be),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), q_le),           \
-                       TCG_CALL_NO_WG, i64, env, tl, i64, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), q_be),           \
-                       TCG_CALL_NO_WG, i64, env, tl, i64, i32)
-#else
-#define GEN_ATOMIC_HELPERS(NAME)                                  \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), b),              \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_le),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_be),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_le),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
-    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_be),           \
-                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-#endif /* CONFIG_ATOMIC64 */
-
-#else
-
-DEF_HELPER_FLAGS_4(atomic_cmpxchgb, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-DEF_HELPER_FLAGS_4(atomic_cmpxchgw_be, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-DEF_HELPER_FLAGS_4(atomic_cmpxchgw_le, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-DEF_HELPER_FLAGS_4(atomic_cmpxchgl_be, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-DEF_HELPER_FLAGS_4(atomic_cmpxchgl_le, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
-#ifdef CONFIG_ATOMIC64
-DEF_HELPER_FLAGS_4(atomic_cmpxchgq_be, TCG_CALL_NO_WG, i64, env, tl, i64, i64)
-DEF_HELPER_FLAGS_4(atomic_cmpxchgq_le, TCG_CALL_NO_WG, i64, env, tl, i64, i64)
-#endif
-
-#ifdef CONFIG_ATOMIC64
-#define GEN_ATOMIC_HELPERS(NAME)                             \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), b),         \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_le),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_be),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_le),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_be),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), q_le),      \
-                       TCG_CALL_NO_WG, i64, env, tl, i64)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), q_be),      \
-                       TCG_CALL_NO_WG, i64, env, tl, i64)
-#else
-#define GEN_ATOMIC_HELPERS(NAME)                             \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), b),         \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_le),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_be),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_le),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
-    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_be),      \
-                       TCG_CALL_NO_WG, i32, env, tl, i32)
-#endif /* CONFIG_ATOMIC64 */
-
-#endif /* CONFIG_SOFTMMU */
-
-GEN_ATOMIC_HELPERS(fetch_add)
-GEN_ATOMIC_HELPERS(fetch_and)
-GEN_ATOMIC_HELPERS(fetch_or)
-GEN_ATOMIC_HELPERS(fetch_xor)
-GEN_ATOMIC_HELPERS(fetch_smin)
-GEN_ATOMIC_HELPERS(fetch_umin)
-GEN_ATOMIC_HELPERS(fetch_smax)
-GEN_ATOMIC_HELPERS(fetch_umax)
-
-GEN_ATOMIC_HELPERS(add_fetch)
-GEN_ATOMIC_HELPERS(and_fetch)
-GEN_ATOMIC_HELPERS(or_fetch)
-GEN_ATOMIC_HELPERS(xor_fetch)
-GEN_ATOMIC_HELPERS(smin_fetch)
-GEN_ATOMIC_HELPERS(umin_fetch)
-GEN_ATOMIC_HELPERS(smax_fetch)
-GEN_ATOMIC_HELPERS(umax_fetch)
-
-GEN_ATOMIC_HELPERS(xchg)
-
-#undef GEN_ATOMIC_HELPERS
-
-DEF_HELPER_FLAGS_3(gvec_mov, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_dup8, TCG_CALL_NO_RWG, void, ptr, i32, i32)
-DEF_HELPER_FLAGS_3(gvec_dup16, TCG_CALL_NO_RWG, void, ptr, i32, i32)
-DEF_HELPER_FLAGS_3(gvec_dup32, TCG_CALL_NO_RWG, void, ptr, i32, i32)
-DEF_HELPER_FLAGS_3(gvec_dup64, TCG_CALL_NO_RWG, void, ptr, i32, i64)
-
-DEF_HELPER_FLAGS_4(gvec_add8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_add16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_add32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_add64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_adds8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_adds16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_adds32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_adds64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_subs8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_subs16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_subs32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_subs64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(gvec_mul8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_mul16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_mul32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_mul64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_muls8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_muls16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_muls32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_muls64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_4(gvec_ssadd8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ssadd16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ssadd32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ssadd64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_sssub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sssub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sssub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_sssub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_usadd8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_usadd16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_usadd32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_usadd64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_ussub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ussub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ussub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ussub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_neg8, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_neg16, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_neg32, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_neg64, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_not, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_and, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_or, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_xor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_andc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_orc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_ands, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_xors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-DEF_HELPER_FLAGS_4(gvec_ors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
-
-DEF_HELPER_FLAGS_3(gvec_shl8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shl16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shl32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shl64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_shr8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shr16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shr32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_shr64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_3(gvec_sar8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sar16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sar32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-DEF_HELPER_FLAGS_3(gvec_sar64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_eq8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_eq16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_eq32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_eq64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_ne8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ne16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ne32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ne64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_lt8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_lt16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_lt32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_lt64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_le8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_le16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_le32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_le64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_ltu8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ltu16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ltu32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_ltu64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_leu8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_leu16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_leu32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_leu64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -23,13 +23,10 @@


 /* translate-all.c */
-struct page_collection *page_collection_lock(tb_page_addr_t start,
-                                             tb_page_addr_t end);
-void page_collection_unlock(struct page_collection *set);
-void tb_invalidate_phys_page_fast(struct page_collection *pages,
-                                  tb_page_addr_t start, int len);
+void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
                                   int is_cpu_write_access);
+void tb_invalidate_phys_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu);

 #ifdef CONFIG_USER_ONLY
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -1,141 +0,0 @@
-/*
- * Generic intermediate code generation.
- *
- * Copyright (C) 2016-2017 Lluís Vilanova <vilanova@ac.upc.edu>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "qemu/error-report.h"
-#include "cpu.h"
-#include "tcg/tcg.h"
-#include "tcg/tcg-op.h"
-#include "exec/exec-all.h"
-#include "exec/gen-icount.h"
-#include "exec/log.h"
-#include "exec/translator.h"
-
-/* Pairs with tcg_clear_temp_count.
-   To be called by #TranslatorOps.{translate_insn,tb_stop} if
-   (1) the target is sufficiently clean to support reporting,
-   (2) as and when all temporaries are known to be consumed.
-   For most targets, (2) is at the end of translate_insn.  */
-void translator_loop_temp_check(DisasContextBase *db)
-{
-    if (tcg_check_temp_count()) {
-        qemu_log("warning: TCG temporary leaks before "
-                 TARGET_FMT_lx "\n", db->pc_next);
-    }
-}
-
-void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
-                     CPUState *cpu, TranslationBlock *tb)
-{
-    int bp_insn = 0;
-
-    /* Initialize DisasContext */
-    db->tb = tb;
-    db->pc_first = tb->pc;
-    db->pc_next = db->pc_first;
-    db->is_jmp = DISAS_NEXT;
-    db->num_insns = 0;
-    db->singlestep_enabled = cpu->singlestep_enabled;
-
-    /* Instruction counting */
-    db->max_insns = tb_cflags(db->tb) & CF_COUNT_MASK;
-    if (db->max_insns == 0) {
-        db->max_insns = CF_COUNT_MASK;
-    }
-    if (db->max_insns > TCG_MAX_INSNS) {
-        db->max_insns = TCG_MAX_INSNS;
-    }
-    if (db->singlestep_enabled || singlestep) {
-        db->max_insns = 1;
-    }
-
-    ops->init_disas_context(db, cpu);
-    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-
-    /* Reset the temp count so that we can identify leaks */
-    tcg_clear_temp_count();
-
-    /* Start translating.  */
-    gen_tb_start(db->tb);
-    ops->tb_start(db, cpu);
-    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-
-    while (true) {
-        db->num_insns++;
-        ops->insn_start(db, cpu);
-        tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
-
-        /* Pass breakpoint hits to target for further processing */
-        if (!db->singlestep_enabled
-            && unlikely(!QTAILQ_EMPTY(&cpu->breakpoints))) {
-            CPUBreakpoint *bp;
-            QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
-                if (bp->pc == db->pc_next) {
-                    if (ops->breakpoint_check(db, cpu, bp)) {
-                        bp_insn = 1;
-                        break;
-                    }
-                }
-            }
-            /* The breakpoint_check hook may use DISAS_TOO_MANY to indicate
-               that only one more instruction is to be executed.  Otherwise
-               it should use DISAS_NORETURN when generating an exception,
-               but may use a DISAS_TARGET_* value for Something Else.  */
-            if (db->is_jmp > DISAS_TOO_MANY) {
-                break;
-            }
-        }
-
-        /* Disassemble one instruction.  The translate_insn hook should
-           update db->pc_next and db->is_jmp to indicate what should be
-           done next -- either exiting this loop or locate the start of
-           the next instruction.  */
-        if (db->num_insns == db->max_insns
-            && (tb_cflags(db->tb) & CF_LAST_IO)) {
-            /* Accept I/O on the last instruction.  */
-            gen_io_start();
-            ops->translate_insn(db, cpu);
-            gen_io_end();
-        } else {
-            ops->translate_insn(db, cpu);
-        }
-
-        /* Stop translation if translate_insn so indicated.  */
-        if (db->is_jmp != DISAS_NEXT) {
-            break;
-        }
-
-        /* Stop translation if the output buffer is full,
-           or we have executed all of the allowed instructions.  */
-        if (tcg_op_buf_full() || db->num_insns >= db->max_insns) {
-            db->is_jmp = DISAS_TOO_MANY;
-            break;
-        }
-    }
-
-    /* Emit code to exit the TB, as indicated by db->is_jmp.  */
-    ops->tb_stop(db, cpu);
-    gen_tb_end(db->tb, db->num_insns - bp_insn);
-
-    /* The disas_log hook may use these values rather than recompute.  */
-    db->tb->size = db->pc_next - db->pc_first;
-    db->tb->icount = db->num_insns;
-
-#ifdef DEBUG_DISAS
-    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
-        && qemu_log_in_addr_range(db->pc_first)) {
-        qemu_log_lock();
-        qemu_log("----------------\n");
-        ops->disas_log(db, cpu);
-        qemu_log("\n");
-        qemu_log_unlock();
-    }
-#endif
-}
--- a/arch_init.c
+++ b/arch_init.c
@@ -28,10 +28,9 @@
 #include "sysemu/arch_init.h"
 #include "hw/pci/pci.h"
 #include "hw/audio/soundhw.h"
-#include "qapi/qapi-commands-misc.h"
-#include "qapi/error.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
+#include "qmp-commands.h"
 #include "hw/acpi/acpi.h"
 #include "qemu/help_option.h"

@@ -52,14 +51,12 @@ int graphic_depth = 32;
 #define QEMU_ARCH QEMU_ARCH_ARM
 #elif defined(TARGET_CRIS)
 #define QEMU_ARCH QEMU_ARCH_CRIS
-#elif defined(TARGET_HPPA)
-#define QEMU_ARCH QEMU_ARCH_HPPA
 #elif defined(TARGET_I386)
 #define QEMU_ARCH QEMU_ARCH_I386
-#elif defined(TARGET_LM32)
-#define QEMU_ARCH QEMU_ARCH_LM32
 #elif defined(TARGET_M68K)
 #define QEMU_ARCH QEMU_ARCH_M68K
+#elif defined(TARGET_LM32)
+#define QEMU_ARCH QEMU_ARCH_LM32
 #elif defined(TARGET_MICROBLAZE)
 #define QEMU_ARCH QEMU_ARCH_MICROBLAZE
 #elif defined(TARGET_MIPS)
@@ -72,20 +69,18 @@ int graphic_depth = 32;
 #define QEMU_ARCH QEMU_ARCH_OPENRISC
 #elif defined(TARGET_PPC)
 #define QEMU_ARCH QEMU_ARCH_PPC
-#elif defined(TARGET_RISCV)
-#define QEMU_ARCH QEMU_ARCH_RISCV
 #elif defined(TARGET_S390X)
 #define QEMU_ARCH QEMU_ARCH_S390X
 #elif defined(TARGET_SH4)
 #define QEMU_ARCH QEMU_ARCH_SH4
 #elif defined(TARGET_SPARC)
 #define QEMU_ARCH QEMU_ARCH_SPARC
-#elif defined(TARGET_TRICORE)
-#define QEMU_ARCH QEMU_ARCH_TRICORE
-#elif defined(TARGET_UNICORE32)
-#define QEMU_ARCH QEMU_ARCH_UNICORE32
 #elif defined(TARGET_XTENSA)
 #define QEMU_ARCH QEMU_ARCH_XTENSA
+#elif defined(TARGET_UNICORE32)
+#define QEMU_ARCH QEMU_ARCH_UNICORE32
+#elif defined(TARGET_TRICORE)
+#define QEMU_ARCH QEMU_ARCH_TRICORE
 #endif

 const uint32_t arch_type = QEMU_ARCH;
@@ -113,8 +108,7 @@ TargetInfo *qmp_query_target(Error **errp)
 {
    TargetInfo *info = g_malloc0(sizeof(*info));

-    info->arch = qapi_enum_parse(&SysEmuTarget_lookup, TARGET_NAME, -1,
-                                 &error_abort);
+    info->arch = g_strdup(TARGET_NAME);

    return info;
 }
--- a/atomic_template.h
+++ b/atomic_template.h
@@ -0,0 +1,215 @@
+/*
+ * Atomic helper templates
+ * Included from tcg-runtime.c and cputlb.c.
+ *
+ * Copyright (c) 2016 Red Hat, Inc
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#if DATA_SIZE == 16
+# define SUFFIX     o
+# define DATA_TYPE  Int128
+# define BSWAP      bswap128
+#elif DATA_SIZE == 8
+# define SUFFIX     q
+# define DATA_TYPE  uint64_t
+# define BSWAP      bswap64
+#elif DATA_SIZE == 4
+# define SUFFIX     l
+# define DATA_TYPE  uint32_t
+# define BSWAP      bswap32
+#elif DATA_SIZE == 2
+# define SUFFIX     w
+# define DATA_TYPE  uint16_t
+# define BSWAP      bswap16
+#elif DATA_SIZE == 1
+# define SUFFIX     b
+# define DATA_TYPE  uint8_t
+# define BSWAP
+#else
+# error unsupported data size
+#endif
+
+#if DATA_SIZE >= 4
+# define ABI_TYPE  DATA_TYPE
+#else
+# define ABI_TYPE  uint32_t
+#endif
+
+/* Define host-endian atomic operations.  Note that END is used within
+   the ATOMIC_NAME macro, and redefined below.  */
+#if DATA_SIZE == 1
+# define END
+#elif defined(HOST_WORDS_BIGENDIAN)
+# define END  _be
+#else
+# define END  _le
+#endif
+
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
+                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    return atomic_cmpxchg__nocheck(haddr, cmpv, newv);
+}
+
+#if DATA_SIZE >= 16
+ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
+{
+    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
+    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
+    return val;
+}
+
+void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
+                     ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
+}
+#else
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
+                           ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    return atomic_xchg__nocheck(haddr, val);
+}
+
+#define GEN_ATOMIC_HELPER(X)                                        \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+                 ABI_TYPE val EXTRA_ARGS)                           \
+{                                                                   \
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
+    return atomic_##X(haddr, val);                                  \
+}                                                                   \
+
+GEN_ATOMIC_HELPER(fetch_add)
+GEN_ATOMIC_HELPER(fetch_and)
+GEN_ATOMIC_HELPER(fetch_or)
+GEN_ATOMIC_HELPER(fetch_xor)
+GEN_ATOMIC_HELPER(add_fetch)
+GEN_ATOMIC_HELPER(and_fetch)
+GEN_ATOMIC_HELPER(or_fetch)
+GEN_ATOMIC_HELPER(xor_fetch)
+
+#undef GEN_ATOMIC_HELPER
+#endif /* DATA SIZE >= 16 */
+
+#undef END
+
+#if DATA_SIZE > 1
+
+/* Define reverse-host-endian atomic operations.  Note that END is used
+   within the ATOMIC_NAME macro.  */
+#ifdef HOST_WORDS_BIGENDIAN
+# define END  _le
+#else
+# define END  _be
+#endif
+
+ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
+                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    return BSWAP(atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv)));
+}
+
+#if DATA_SIZE >= 16
+ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
+{
+    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
+    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
+    return BSWAP(val);
+}
+
+void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
+                     ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    val = BSWAP(val);
+    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
+}
+#else
+ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
+                           ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    return BSWAP(atomic_xchg__nocheck(haddr, BSWAP(val)));
+}
+
+#define GEN_ATOMIC_HELPER(X)                                        \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+                 ABI_TYPE val EXTRA_ARGS)                           \
+{                                                                   \
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
+    return BSWAP(atomic_##X(haddr, BSWAP(val)));                    \
+}
+
+GEN_ATOMIC_HELPER(fetch_and)
+GEN_ATOMIC_HELPER(fetch_or)
+GEN_ATOMIC_HELPER(fetch_xor)
+GEN_ATOMIC_HELPER(and_fetch)
+GEN_ATOMIC_HELPER(or_fetch)
+GEN_ATOMIC_HELPER(xor_fetch)
+
+#undef GEN_ATOMIC_HELPER
+
+/* Note that for addition, we need to use a separate cmpxchg loop instead
+   of bswaps for the reverse-host-endian helpers.  */
+ABI_TYPE ATOMIC_NAME(fetch_add)(CPUArchState *env, target_ulong addr,
+                         ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE ldo, ldn, ret, sto;
+
+    ldo = atomic_read__nocheck(haddr);
+    while (1) {
+        ret = BSWAP(ldo);
+        sto = BSWAP(ret + val);
+        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
+        if (ldn == ldo) {
+            return ret;
+        }
+        ldo = ldn;
+    }
+}
+
+ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
+                         ABI_TYPE val EXTRA_ARGS)
+{
+    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
+    DATA_TYPE ldo, ldn, ret, sto;
+
+    ldo = atomic_read__nocheck(haddr);
+    while (1) {
+        ret = BSWAP(ldo) + val;
+        sto = BSWAP(ret);
+        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
+        if (ldn == ldo) {
+            return ret;
+        }
+        ldo = ldn;
+    }
+}
+#endif /* DATA_SIZE >= 16 */
+
+#undef END
+#endif /* DATA_SIZE > 1 */
+
+#undef BSWAP
+#undef ABI_TYPE
+#undef DATA_TYPE
+#undef SUFFIX
+#undef DATA_SIZE
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,31 +1,13 @@
 common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
+common-obj-$(CONFIG_SDL) += sdlaudio.o
+common-obj-$(CONFIG_OSS) += ossaudio.o
 common-obj-$(CONFIG_SPICE) += spiceaudio.o
-common-obj-$(CONFIG_AUDIO_COREAUDIO) += coreaudio.o
-common-obj-$(CONFIG_AUDIO_DSOUND) += dsoundaudio.o
+common-obj-$(CONFIG_COREAUDIO) += coreaudio.o
+common-obj-$(CONFIG_ALSA) += alsaaudio.o
+common-obj-$(CONFIG_DSOUND) += dsoundaudio.o
+common-obj-$(CONFIG_PA) += paaudio.o
 common-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
 common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o

-coreaudio.o-libs := $(COREAUDIO_LIBS)
-dsoundaudio.o-libs := $(DSOUND_LIBS)
-
-# alsa module
-common-obj-$(CONFIG_AUDIO_ALSA) += alsa.mo
-alsa.mo-objs = alsaaudio.o
-alsa.mo-libs := $(ALSA_LIBS)
-
-# oss module
-common-obj-$(CONFIG_AUDIO_OSS) += oss.mo
-oss.mo-objs = ossaudio.o
-oss.mo-libs := $(OSS_LIBS)
-
-# pulseaudio module
-common-obj-$(CONFIG_AUDIO_PA) += pa.mo
-pa.mo-objs = paaudio.o
-pa.mo-libs := $(PULSE_LIBS)
-
-# sdl module
-common-obj-$(CONFIG_AUDIO_SDL) += sdl.mo
-sdl.mo-objs = sdlaudio.o
-sdl.mo-cflags := $(SDL_CFLAGS)
-sdl.mo-libs := $(SDL_LIBS)
+sdlaudio.o-cflags := $(SDL_CFLAGS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -823,7 +823,7 @@ static int alsa_init_out(HWVoiceOut *hw, struct audsettings *as,
    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = obt.samples;

-    alsa->pcm_buf = audio_calloc(__func__, obt.samples, 1 << hw->info.shift);
+    alsa->pcm_buf = audio_calloc (AUDIO_FUNC, obt.samples, 1 << hw->info.shift);
    if (!alsa->pcm_buf) {
        dolog ("Could not allocate DAC buffer (%d samples, each %d bytes)\n",
               hw->samples, 1 << hw->info.shift);
@@ -934,7 +934,7 @@ static int alsa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = obt.samples;

-    alsa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+    alsa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    if (!alsa->pcm_buf) {
        dolog ("Could not allocate ADC buffer (%d samples, each %d bytes)\n",
               hw->samples, 1 << hw->info.shift);
@@ -1213,7 +1213,7 @@ static struct audio_pcm_ops alsa_pcm_ops = {
    .ctl_in   = alsa_ctl_in,
 };

-static struct audio_driver alsa_audio_driver = {
+struct audio_driver alsa_audio_driver = {
    .name           = "alsa",
    .descr          = "ALSA http://www.alsa-project.org",
    .options        = alsa_options,
@@ -1226,9 +1226,3 @@ static struct audio_driver alsa_audio_driver = {
    .voice_size_out = sizeof (ALSAVoiceOut),
    .voice_size_in  = sizeof (ALSAVoiceIn)
 };
-
-static void register_audio_alsa(void)
-{
-    audio_driver_register(&alsa_audio_driver);
-}
-type_init(register_audio_alsa);
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -29,7 +29,6 @@
 #include "sysemu/sysemu.h"
 #include "qemu/cutils.h"
 #include "sysemu/replay.h"
-#include "trace.h"

 #define AUDIO_CAP "audio"
 #include "audio_int.h"
@@ -46,49 +45,15 @@
   The 1st one is the one used by default, that is the reason
    that we generate the list.
 */
-static const char *audio_prio_list[] = {
-    "spice",
+static struct audio_driver *drvtab[] = {
+#ifdef CONFIG_SPICE
+    &spice_audio_driver,
+#endif
    CONFIG_AUDIO_DRIVERS
-    "none",
-    "wav",
+    &no_audio_driver,
+    &wav_audio_driver
 };

-static QLIST_HEAD(, audio_driver) audio_drivers;
-
-void audio_driver_register(audio_driver *drv)
-{
-    QLIST_INSERT_HEAD(&audio_drivers, drv, next);
-}
-
-audio_driver *audio_driver_lookup(const char *name)
-{
-    struct audio_driver *d;
-
-    QLIST_FOREACH(d, &audio_drivers, next) {
-        if (strcmp(name, d->name) == 0) {
-            return d;
-        }
-    }
-
-    audio_module_load_one(name);
-    QLIST_FOREACH(d, &audio_drivers, next) {
-        if (strcmp(name, d->name) == 0) {
-            return d;
-        }
-    }
-
-    return NULL;
-}
-
-static void audio_module_load_all(void)
-{
-    int i;
-
-    for (i = 0; i < ARRAY_SIZE(audio_prio_list); i++) {
-        audio_driver_lookup(audio_prio_list[i]);
-    }
-}
-
 struct fixed_settings {
    int enabled;
    int nb_voices;
@@ -336,8 +301,9 @@ static int audio_get_conf_int (const char *key, int defval, int *defaultp)
    char *strval;

    strval = getenv (key);
-    if (strval && !qemu_strtoi(strval, NULL, 10, &val)) {
+    if (strval) {
        *defaultp = 0;
+        val = atoi (strval);
        return val;
    }
    else {
@@ -458,12 +424,12 @@ static void audio_process_options (const char *prefix,
    const char qemu_prefix[] = "QEMU_";
    size_t preflen, optlen;

-    if (audio_bug(__func__, !prefix)) {
+    if (audio_bug (AUDIO_FUNC, !prefix)) {
        dolog ("prefix = NULL\n");
        return;
    }

-    if (audio_bug(__func__, !opt)) {
+    if (audio_bug (AUDIO_FUNC, !opt)) {
        dolog ("opt = NULL\n");
        return;
    }
@@ -826,7 +792,7 @@ static int audio_attach_capture (HWVoiceOut *hw)
        SWVoiceOut *sw;
        HWVoiceOut *hw_cap = &cap->hw;

-        sc = audio_calloc(__func__, 1, sizeof(*sc));
+        sc = audio_calloc (AUDIO_FUNC, 1, sizeof (*sc));
        if (!sc) {
            dolog ("Could not allocate soft capture voice (%zu bytes)\n",
                   sizeof (*sc));
@@ -882,7 +848,7 @@ static int audio_pcm_hw_find_min_in (HWVoiceIn *hw)
 int audio_pcm_hw_get_live_in (HWVoiceIn *hw)
 {
    int live = hw->total_samples_captured - audio_pcm_hw_find_min_in (hw);
-    if (audio_bug(__func__, live < 0 || live > hw->samples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > hw->samples)) {
        dolog ("live=%d hw->samples=%d\n", live, hw->samples);
        return 0;
    }
@@ -920,7 +886,7 @@ static int audio_pcm_sw_get_rpos_in (SWVoiceIn *sw)
    int live = hw->total_samples_captured - sw->total_hw_samples_acquired;
    int rpos;

-    if (audio_bug(__func__, live < 0 || live > hw->samples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > hw->samples)) {
        dolog ("live=%d hw->samples=%d\n", live, hw->samples);
        return 0;
    }
@@ -943,7 +909,7 @@ int audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int size)
    rpos = audio_pcm_sw_get_rpos_in (sw) % hw->samples;

    live = hw->total_samples_captured - sw->total_hw_samples_acquired;
-    if (audio_bug(__func__, live < 0 || live > hw->samples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > hw->samples)) {
        dolog ("live_in=%d hw->samples=%d\n", live, hw->samples);
        return 0;
    }
@@ -969,7 +935,7 @@ int audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int size)
        }
        osamp = swlim;

-        if (audio_bug(__func__, osamp < 0)) {
+        if (audio_bug (AUDIO_FUNC, osamp < 0)) {
            dolog ("osamp=%d\n", osamp);
            return 0;
        }
@@ -1024,7 +990,7 @@ static int audio_pcm_hw_get_live_out (HWVoiceOut *hw, int *nb_live)
    if (nb_live1) {
        int live = smin;

-        if (audio_bug(__func__, live < 0 || live > hw->samples)) {
+        if (audio_bug (AUDIO_FUNC, live < 0 || live > hw->samples)) {
            dolog ("live=%d hw->samples=%d\n", live, hw->samples);
            return 0;
        }
@@ -1048,7 +1014,7 @@ int audio_pcm_sw_write (SWVoiceOut *sw, void *buf, int size)
    hwsamples = sw->hw->samples;

    live = sw->total_hw_samples_mixed;
-    if (audio_bug(__func__, live < 0 || live > hwsamples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > hwsamples)){
        dolog ("live=%d hw->samples=%d\n", live, hwsamples);
        return 0;
    }
@@ -1130,10 +1096,6 @@ static void audio_pcm_print_info (const char *cap, struct audio_pcm_info *info)
 /*
 * Timer
 */
-
-static bool audio_timer_running;
-static uint64_t audio_timer_last;
-
 static int audio_is_timer_needed (void)
 {
    HWVoiceIn *hwi = NULL;
@@ -1153,31 +1115,14 @@ static void audio_reset_timer (AudioState *s)
    if (audio_is_timer_needed ()) {
        timer_mod_anticipate_ns(s->ts,
            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + conf.period.ticks);
-        if (!audio_timer_running) {
-            audio_timer_running = true;
-            audio_timer_last = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-            trace_audio_timer_start(conf.period.ticks / SCALE_MS);
-        }
-    } else {
-        timer_del(s->ts);
-        if (audio_timer_running) {
-            audio_timer_running = false;
-            trace_audio_timer_stop();
-        }
+    }
+    else {
+        timer_del (s->ts);
    }
 }

 static void audio_timer (void *opaque)
 {
-    int64_t now, diff;
-
-    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    diff = now - audio_timer_last;
-    if (diff > conf.period.ticks * 3 / 2) {
-        trace_audio_timer_delayed(diff / SCALE_MS);
-    }
-    audio_timer_last = now;
-
    audio_run ("timer");
    audio_reset_timer (opaque);
 }
@@ -1318,7 +1263,7 @@ static int audio_get_avail (SWVoiceIn *sw)
    }

    live = sw->hw->total_samples_captured - sw->total_hw_samples_acquired;
-    if (audio_bug(__func__, live < 0 || live > sw->hw->samples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > sw->hw->samples)) {
        dolog ("live=%d sw->hw->samples=%d\n", live, sw->hw->samples);
        return 0;
    }
@@ -1342,7 +1287,7 @@ static int audio_get_free (SWVoiceOut *sw)

    live = sw->total_hw_samples_mixed;

-    if (audio_bug(__func__, live < 0 || live > sw->hw->samples)) {
+    if (audio_bug (AUDIO_FUNC, live < 0 || live > sw->hw->samples)) {
        dolog ("live=%d sw->hw->samples=%d\n", live, sw->hw->samples);
        return 0;
    }
@@ -1409,7 +1354,7 @@ static void audio_run_out (AudioState *s)
            live = 0;
        }

-        if (audio_bug(__func__, live < 0 || live > hw->samples)) {
+        if (audio_bug (AUDIO_FUNC, live < 0 || live > hw->samples)) {
            dolog ("live=%d hw->samples=%d\n", live, hw->samples);
            continue;
        }
@@ -1444,7 +1389,7 @@ static void audio_run_out (AudioState *s)
        prev_rpos = hw->rpos;
        played = hw->pcm_ops->run_out (hw, live);
        replay_audio_out(&played);
-        if (audio_bug(__func__, hw->rpos >= hw->samples)) {
+        if (audio_bug (AUDIO_FUNC, hw->rpos >= hw->samples)) {
            dolog ("hw->rpos=%d hw->samples=%d played=%d\n",
                   hw->rpos, hw->samples, played);
            hw->rpos = 0;
@@ -1465,7 +1410,7 @@ static void audio_run_out (AudioState *s)
                continue;
            }

-            if (audio_bug(__func__, played > sw->total_hw_samples_mixed)) {
+            if (audio_bug (AUDIO_FUNC, played > sw->total_hw_samples_mixed)) {
                dolog ("played=%d sw->total_hw_samples_mixed=%d\n",
                       played, sw->total_hw_samples_mixed);
                played = sw->total_hw_samples_mixed;
@@ -1568,7 +1513,7 @@ static void audio_run_capture (AudioState *s)
                continue;
            }

-            if (audio_bug(__func__, captured > sw->total_hw_samples_mixed)) {
+            if (audio_bug (AUDIO_FUNC, captured > sw->total_hw_samples_mixed)) {
                dolog ("captured=%d sw->total_hw_samples_mixed=%d\n",
                       captured, sw->total_hw_samples_mixed);
                captured = sw->total_hw_samples_mixed;
@@ -1711,13 +1656,11 @@ static void audio_pp_nb_voices (const char *typ, int nb)

 void AUD_help (void)
 {
-    struct audio_driver *d;
-
-    /* make sure we print the help text for modular drivers too */
-    audio_module_load_all();
+    size_t i;

    audio_process_options ("AUDIO", audio_options);
-    QLIST_FOREACH(d, &audio_drivers, next) {
+    for (i = 0; i < ARRAY_SIZE (drvtab); i++) {
+        struct audio_driver *d = drvtab[i];
        if (d->options) {
            audio_process_options (d->name, d->options);
        }
@@ -1729,7 +1672,8 @@ void AUD_help (void)

    printf ("Available drivers:\n");

-    QLIST_FOREACH(d, &audio_drivers, next) {
+    for (i = 0; i < ARRAY_SIZE (drvtab); i++) {
+        struct audio_driver *d = drvtab[i];

        printf ("Name: %s\n", d->name);
        printf ("Description: %s\n", d->descr);
@@ -1863,7 +1807,6 @@ static void audio_init (void)
    const char *drvname;
    VMChangeStateEntry *e;
    AudioState *s = &glob_audio_state;
-    struct audio_driver *driver;

    if (s->drv) {
        return;
@@ -1899,27 +1842,32 @@ static void audio_init (void)
    }

    if (drvname) {
-        driver = audio_driver_lookup(drvname);
-        if (driver) {
-            done = !audio_driver_init(s, driver);
-        } else {
+        int found = 0;
+
+        for (i = 0; i < ARRAY_SIZE (drvtab); i++) {
+            if (!strcmp (drvname, drvtab[i]->name)) {
+                done = !audio_driver_init (s, drvtab[i]);
+                found = 1;
+                break;
+            }
+        }
+
+        if (!found) {
            dolog ("Unknown audio driver `%s'\n", drvname);
            dolog ("Run with -audio-help to list available drivers\n");
        }
    }

    if (!done) {
-        for (i = 0; !done && i < ARRAY_SIZE(audio_prio_list); i++) {
-            driver = audio_driver_lookup(audio_prio_list[i]);
-            if (driver && driver->can_be_default) {
-                done = !audio_driver_init(s, driver);
+        for (i = 0; !done && i < ARRAY_SIZE (drvtab); i++) {
+            if (drvtab[i]->can_be_default) {
+                done = !audio_driver_init (s, drvtab[i]);
            }
        }
    }

    if (!done) {
-        driver = audio_driver_lookup("none");
-        done = !audio_driver_init(s, driver);
+        done = !audio_driver_init (s, &no_audio_driver);
        assert(done);
        dolog("warning: Using timer based audio emulation\n");
    }
@@ -1976,7 +1924,7 @@ CaptureVoiceOut *AUD_add_capture (
        goto err0;
    }

-    cb = audio_calloc(__func__, 1, sizeof(*cb));
+    cb = audio_calloc (AUDIO_FUNC, 1, sizeof (*cb));
    if (!cb) {
        dolog ("Could not allocate capture callback information, size %zu\n",
               sizeof (*cb));
@@ -1994,7 +1942,7 @@ CaptureVoiceOut *AUD_add_capture (
        HWVoiceOut *hw;
        CaptureVoiceOut *cap;

-        cap = audio_calloc(__func__, 1, sizeof(*cap));
+        cap = audio_calloc (AUDIO_FUNC, 1, sizeof (*cap));
        if (!cap) {
            dolog ("Could not allocate capture voice, size %zu\n",
                   sizeof (*cap));
@@ -2007,8 +1955,8 @@ CaptureVoiceOut *AUD_add_capture (

        /* XXX find a more elegant way */
        hw->samples = 4096 * 4;
-        hw->mix_buf = audio_calloc(__func__, hw->samples,
-                                   sizeof(struct st_sample));
+        hw->mix_buf = audio_calloc (AUDIO_FUNC, hw->samples,
+                                    sizeof (struct st_sample));
        if (!hw->mix_buf) {
            dolog ("Could not allocate capture mix buffer (%d samples)\n",
                   hw->samples);
@@ -2017,7 +1965,7 @@ CaptureVoiceOut *AUD_add_capture (

        audio_pcm_init_info (&hw->info, as);

-        cap->buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+        cap->buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
        if (!cap->buf) {
            dolog ("Could not allocate capture buffer "
                   "(%d samples, each %d bytes)\n",
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -25,7 +25,7 @@
 #ifndef QEMU_AUDIO_INT_H
 #define QEMU_AUDIO_INT_H

-#ifdef CONFIG_AUDIO_COREAUDIO
+#ifdef CONFIG_COREAUDIO
 #define FLOAT_MIXENG
 /* #define RECIPROCAL */
 #endif
@@ -141,7 +141,6 @@ struct SWVoiceIn {
    QLIST_ENTRY (SWVoiceIn) entries;
 };

-typedef struct audio_driver audio_driver;
 struct audio_driver {
    const char *name;
    const char *descr;
@@ -155,7 +154,6 @@ struct audio_driver {
    int voice_size_out;
    int voice_size_in;
    int ctl_caps;
-    QLIST_ENTRY(audio_driver) next;
 };

 struct audio_pcm_ops {
@@ -205,11 +203,17 @@ struct AudioState {
    int vm_running;
 };

+extern struct audio_driver no_audio_driver;
+extern struct audio_driver oss_audio_driver;
+extern struct audio_driver sdl_audio_driver;
+extern struct audio_driver wav_audio_driver;
+extern struct audio_driver alsa_audio_driver;
+extern struct audio_driver coreaudio_audio_driver;
+extern struct audio_driver dsound_audio_driver;
+extern struct audio_driver pa_audio_driver;
+extern struct audio_driver spice_audio_driver;
 extern const struct mixeng_volume nominal_volume;

-void audio_driver_register(audio_driver *drv);
-audio_driver *audio_driver_lookup(const char *name);
-
 void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as);
 void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len);

@@ -248,4 +252,10 @@ static inline int audio_ring_dist (int dst, int src, int len)
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)

+#if defined _MSC_VER || defined __GNUC__
+#define AUDIO_FUNC __FUNCTION__
+#else
+#define AUDIO_FUNC __FILE__ ":" AUDIO_STRINGIFY (__LINE__)
+#endif
+
 #endif /* QEMU_AUDIO_INT_H */
--- a/audio/audio_pt_int.c
+++ b/audio/audio_pt_int.c
@@ -31,7 +31,7 @@ int audio_pt_init (struct audio_pt *p, void *(*func) (void *),

    err = sigfillset (&set);
    if (err) {
-        logerr(p, errno, "%s(%s): sigfillset failed", cap, __func__);
+        logerr (p, errno, "%s(%s): sigfillset failed", cap, AUDIO_FUNC);
        return -1;
    }

@@ -57,8 +57,8 @@ int audio_pt_init (struct audio_pt *p, void *(*func) (void *),

    err2 = pthread_sigmask (SIG_SETMASK, &old_set, NULL);
    if (err2) {
-        logerr(p, err2, "%s(%s): pthread_sigmask (restore) failed",
-               cap, __func__);
+        logerr (p, err2, "%s(%s): pthread_sigmask (restore) failed",
+                cap, AUDIO_FUNC);
        /* We have failed to restore original signal mask, all bets are off,
           so terminate the process */
        exit (EXIT_FAILURE);
@@ -74,17 +74,17 @@ int audio_pt_init (struct audio_pt *p, void *(*func) (void *),
 err2:
    err2 = pthread_cond_destroy (&p->cond);
    if (err2) {
-        logerr(p, err2, "%s(%s): pthread_cond_destroy failed", cap, __func__);
+        logerr (p, err2, "%s(%s): pthread_cond_destroy failed", cap, AUDIO_FUNC);
    }

 err1:
    err2 = pthread_mutex_destroy (&p->mutex);
    if (err2) {
-        logerr(p, err2, "%s(%s): pthread_mutex_destroy failed", cap, __func__);
+        logerr (p, err2, "%s(%s): pthread_mutex_destroy failed", cap, AUDIO_FUNC);
    }

 err0:
-    logerr(p, err, "%s(%s): %s failed", cap, __func__, efunc);
+    logerr (p, err, "%s(%s): %s failed", cap, AUDIO_FUNC, efunc);
    return -1;
 }

@@ -94,13 +94,13 @@ int audio_pt_fini (struct audio_pt *p, const char *cap)

    err = pthread_cond_destroy (&p->cond);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_cond_destroy failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_cond_destroy failed", cap, AUDIO_FUNC);
        ret = -1;
    }

    err = pthread_mutex_destroy (&p->mutex);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_mutex_destroy failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_mutex_destroy failed", cap, AUDIO_FUNC);
        ret = -1;
    }
    return ret;
@@ -112,7 +112,7 @@ int audio_pt_lock (struct audio_pt *p, const char *cap)

    err = pthread_mutex_lock (&p->mutex);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_mutex_lock failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_mutex_lock failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
@@ -124,7 +124,7 @@ int audio_pt_unlock (struct audio_pt *p, const char *cap)

    err = pthread_mutex_unlock (&p->mutex);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_mutex_unlock failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_mutex_unlock failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
@@ -136,7 +136,7 @@ int audio_pt_wait (struct audio_pt *p, const char *cap)

    err = pthread_cond_wait (&p->cond, &p->mutex);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_cond_wait failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_cond_wait failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
@@ -148,12 +148,12 @@ int audio_pt_unlock_and_signal (struct audio_pt *p, const char *cap)

    err = pthread_mutex_unlock (&p->mutex);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_mutex_unlock failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_mutex_unlock failed", cap, AUDIO_FUNC);
        return -1;
    }
    err = pthread_cond_signal (&p->cond);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_cond_signal failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_cond_signal failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
@@ -166,7 +166,7 @@ int audio_pt_join (struct audio_pt *p, void **arg, const char *cap)

    err = pthread_join (p->thread, &ret);
    if (err) {
-        logerr(p, err, "%s(%s): pthread_join failed", cap, __func__);
+        logerr (p, err, "%s(%s): pthread_join failed", cap, AUDIO_FUNC);
        return -1;
    }
    *arg = ret;
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -57,13 +57,13 @@ static void glue (audio_init_nb_voices_, TYPE) (struct audio_driver *drv)
        glue (s->nb_hw_voices_, TYPE) = max_voices;
    }

-    if (audio_bug(__func__, !voice_size && max_voices)) {
+    if (audio_bug (AUDIO_FUNC, !voice_size && max_voices)) {
        dolog ("drv=`%s' voice_size=0 max_voices=%d\n",
               drv->name, max_voices);
        glue (s->nb_hw_voices_, TYPE) = 0;
    }

-    if (audio_bug(__func__, voice_size && !max_voices)) {
+    if (audio_bug (AUDIO_FUNC, voice_size && !max_voices)) {
        dolog ("drv=`%s' voice_size=%d max_voices=0\n",
               drv->name, voice_size);
    }
@@ -77,7 +77,7 @@ static void glue (audio_pcm_hw_free_resources_, TYPE) (HW *hw)

 static int glue (audio_pcm_hw_alloc_resources_, TYPE) (HW *hw)
 {
-    HWBUF = audio_calloc(__func__, hw->samples, sizeof(struct st_sample));
+    HWBUF = audio_calloc (AUDIO_FUNC, hw->samples, sizeof (struct st_sample));
    if (!HWBUF) {
        dolog ("Could not allocate " NAME " buffer (%d samples)\n",
               hw->samples);
@@ -105,7 +105,7 @@ static int glue (audio_pcm_sw_alloc_resources_, TYPE) (SW *sw)

    samples = ((int64_t) sw->hw->samples << 32) / sw->ratio;

-    sw->buf = audio_calloc(__func__, samples, sizeof(struct st_sample));
+    sw->buf = audio_calloc (AUDIO_FUNC, samples, sizeof (struct st_sample));
    if (!sw->buf) {
        dolog ("Could not allocate buffer for `%s' (%d samples)\n",
               SW_NAME (sw), samples);
@@ -238,17 +238,17 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
        return NULL;
    }

-    if (audio_bug(__func__, !drv)) {
+    if (audio_bug (AUDIO_FUNC, !drv)) {
        dolog ("No host audio driver\n");
        return NULL;
    }

-    if (audio_bug(__func__, !drv->pcm_ops)) {
+    if (audio_bug (AUDIO_FUNC, !drv->pcm_ops)) {
        dolog ("Host audio driver without pcm_ops\n");
        return NULL;
    }

-    hw = audio_calloc(__func__, 1, glue(drv->voice_size_, TYPE));
+    hw = audio_calloc (AUDIO_FUNC, 1, glue (drv->voice_size_, TYPE));
    if (!hw) {
        dolog ("Can not allocate voice `%s' size %d\n",
               drv->name, glue (drv->voice_size_, TYPE));
@@ -266,7 +266,7 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
        goto err0;
    }

-    if (audio_bug(__func__, hw->samples <= 0)) {
+    if (audio_bug (AUDIO_FUNC, hw->samples <= 0)) {
        dolog ("hw->samples=%d\n", hw->samples);
        goto err1;
    }
@@ -339,7 +339,7 @@ static SW *glue (audio_pcm_create_voice_pair_, TYPE) (
        hw_as = *as;
    }

-    sw = audio_calloc(__func__, 1, sizeof(*sw));
+    sw = audio_calloc (AUDIO_FUNC, 1, sizeof (*sw));
    if (!sw) {
        dolog ("Could not allocate soft voice `%s' (%zu bytes)\n",
               sw_name ? sw_name : "unknown", sizeof (*sw));
@@ -379,7 +379,7 @@ static void glue (audio_close_, TYPE) (SW *sw)
 void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
 {
    if (sw) {
-        if (audio_bug(__func__, !card)) {
+        if (audio_bug (AUDIO_FUNC, !card)) {
            dolog ("card=%p\n", card);
            return;
        }
@@ -399,7 +399,7 @@ SW *glue (AUD_open_, TYPE) (
 {
    AudioState *s = &glob_audio_state;

-    if (audio_bug(__func__, !card || !name || !callback_fn || !as)) {
+    if (audio_bug (AUDIO_FUNC, !card || !name || !callback_fn || !as)) {
        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
               card, name, callback_fn, as);
        goto fail;
@@ -408,12 +408,12 @@ SW *glue (AUD_open_, TYPE) (
    ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
            name, as->freq, as->nchannels, as->fmt);

-    if (audio_bug(__func__, audio_validate_settings(as))) {
+    if (audio_bug (AUDIO_FUNC, audio_validate_settings (as))) {
        audio_print_settings (as);
        goto fail;
    }

-    if (audio_bug(__func__, !s->drv)) {
+    if (audio_bug (AUDIO_FUNC, !s->drv)) {
        dolog ("Can not open `%s' (no host audio driver)\n", name);
        goto fail;
    }
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -722,7 +722,7 @@ static struct audio_pcm_ops coreaudio_pcm_ops = {
    .ctl_out  = coreaudio_ctl_out
 };

-static struct audio_driver coreaudio_audio_driver = {
+struct audio_driver coreaudio_audio_driver = {
    .name           = "coreaudio",
    .descr          = "CoreAudio http://developer.apple.com/audio/coreaudio.html",
    .options        = coreaudio_options,
@@ -735,9 +735,3 @@ static struct audio_driver coreaudio_audio_driver = {
    .voice_size_out = sizeof (coreaudioVoiceOut),
    .voice_size_in  = 0
 };
-
-static void register_audio_coreaudio(void)
-{
-    audio_driver_register(&coreaudio_audio_driver);
-}
-type_init(register_audio_coreaudio);
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -543,7 +543,7 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
        }
    }

-    if (audio_bug(__func__, len < 0 || len > bufsize)) {
+    if (audio_bug (AUDIO_FUNC, len < 0 || len > bufsize)) {
        dolog ("len=%d bufsize=%d old_pos=%ld ppos=%ld\n",
               len, bufsize, old_pos, ppos);
        return 0;
@@ -890,7 +890,7 @@ static struct audio_pcm_ops dsound_pcm_ops = {
    .ctl_in   = dsound_ctl_in
 };

-static struct audio_driver dsound_audio_driver = {
+struct audio_driver dsound_audio_driver = {
    .name           = "dsound",
    .descr          = "DirectSound http://wikipedia.org/wiki/DirectSound",
    .options        = dsound_options,
@@ -903,9 +903,3 @@ static struct audio_driver dsound_audio_driver = {
    .voice_size_out = sizeof (DSoundVoiceOut),
    .voice_size_in  = sizeof (DSoundVoiceIn)
 };
-
-static void register_audio_dsound(void)
-{
-    audio_driver_register(&dsound_audio_driver);
-}
-type_init(register_audio_dsound);
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -344,7 +344,7 @@ struct rate {
 */
 void *st_rate_start (int inrate, int outrate)
 {
-    struct rate *rate = audio_calloc(__func__, 1, sizeof(*rate));
+    struct rate *rate = audio_calloc (AUDIO_FUNC, 1, sizeof (*rate));

    if (!rate) {
        dolog ("Could not allocate resampler (%zu bytes)\n", sizeof (*rate));
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -160,7 +160,7 @@ static struct audio_pcm_ops no_pcm_ops = {
    .ctl_in   = no_ctl_in
 };

-static struct audio_driver no_audio_driver = {
+struct audio_driver no_audio_driver = {
    .name           = "none",
    .descr          = "Timer based audio emulation",
    .options        = NULL,
@@ -173,9 +173,3 @@ static struct audio_driver no_audio_driver = {
    .voice_size_out = sizeof (NoVoiceOut),
    .voice_size_in  = sizeof (NoVoiceIn)
 };
-
-static void register_audio_none(void)
-{
-    audio_driver_register(&no_audio_driver);
-}
-type_init(register_audio_none);
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -582,9 +582,11 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    }

    if (!oss->mmapped) {
-        oss->pcm_buf = audio_calloc(__func__,
-                                    hw->samples,
-                                    1 << hw->info.shift);
+        oss->pcm_buf = audio_calloc (
+            AUDIO_FUNC,
+            hw->samples,
+            1 << hw->info.shift
+            );
        if (!oss->pcm_buf) {
            dolog (
                "Could not allocate DAC buffer (%d samples, each %d bytes)\n",
@@ -703,7 +705,7 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }

    hw->samples = (obt.nfrags * obt.fragsize) >> hw->info.shift;
-    oss->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+    oss->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    if (!oss->pcm_buf) {
        dolog ("Could not allocate ADC buffer (%d samples, each %d bytes)\n",
               hw->samples, 1 << hw->info.shift);
@@ -922,7 +924,7 @@ static struct audio_pcm_ops oss_pcm_ops = {
    .ctl_in   = oss_ctl_in
 };

-static struct audio_driver oss_audio_driver = {
+struct audio_driver oss_audio_driver = {
    .name           = "oss",
    .descr          = "OSS http://www.opensound.com",
    .options        = oss_options,
@@ -935,9 +937,3 @@ static struct audio_driver oss_audio_driver = {
    .voice_size_out = sizeof (OSSVoiceOut),
    .voice_size_in  = sizeof (OSSVoiceIn)
 };
-
-static void register_audio_oss(void)
-{
-    audio_driver_register(&oss_audio_driver);
-}
-type_init(register_audio_oss);
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -89,7 +89,7 @@ static inline int PA_STREAM_IS_GOOD(pa_stream_state_t x)
            }                                                   \
            goto label;                                         \
        }                                                       \
-    } while (0)
+    } while (0);

 #define CHECK_DEAD_GOTO(c, stream, rerror, label)                       \
    do {                                                                \
@@ -107,7 +107,7 @@ static inline int PA_STREAM_IS_GOOD(pa_stream_state_t x)
            }                                                           \
            goto label;                                                 \
        }                                                               \
-    } while (0)
+    } while (0);

 static int qpa_simple_read (PAVoiceIn *p, void *data, size_t length, int *rerror)
 {
@@ -206,7 +206,7 @@ static void *qpa_thread_out (void *arg)
    PAVoiceOut *pa = arg;
    HWVoiceOut *hw = &pa->hw;

-    if (audio_pt_lock(&pa->pt, __func__)) {
+    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return NULL;
    }

@@ -222,15 +222,15 @@ static void *qpa_thread_out (void *arg)
                break;
            }

-            if (audio_pt_wait(&pa->pt, __func__)) {
+            if (audio_pt_wait (&pa->pt, AUDIO_FUNC)) {
                goto exit;
            }
        }

-        decr = to_mix = audio_MIN(pa->live, pa->g->conf.samples >> 5);
+        decr = to_mix = audio_MIN (pa->live, pa->g->conf.samples >> 2);
        rpos = pa->rpos;

-        if (audio_pt_unlock(&pa->pt, __func__)) {
+        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
        }

@@ -251,7 +251,7 @@ static void *qpa_thread_out (void *arg)
            to_mix -= chunk;
        }

-        if (audio_pt_lock(&pa->pt, __func__)) {
+        if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
        }

@@ -261,7 +261,7 @@ static void *qpa_thread_out (void *arg)
    }

 exit:
-    audio_pt_unlock(&pa->pt, __func__);
+    audio_pt_unlock (&pa->pt, AUDIO_FUNC);
    return NULL;
 }

@@ -270,7 +270,7 @@ static int qpa_run_out (HWVoiceOut *hw, int live)
    int decr;
    PAVoiceOut *pa = (PAVoiceOut *) hw;

-    if (audio_pt_lock(&pa->pt, __func__)) {
+    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return 0;
    }

@@ -279,10 +279,10 @@ static int qpa_run_out (HWVoiceOut *hw, int live)
    pa->live = live - decr;
    hw->rpos = pa->rpos;
    if (pa->live > 0) {
-        audio_pt_unlock_and_signal(&pa->pt, __func__);
+        audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    }
    else {
-        audio_pt_unlock(&pa->pt, __func__);
+        audio_pt_unlock (&pa->pt, AUDIO_FUNC);
    }
    return decr;
 }
@@ -298,7 +298,7 @@ static void *qpa_thread_in (void *arg)
    PAVoiceIn *pa = arg;
    HWVoiceIn *hw = &pa->hw;

-    if (audio_pt_lock(&pa->pt, __func__)) {
+    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return NULL;
    }

@@ -314,15 +314,15 @@ static void *qpa_thread_in (void *arg)
                break;
            }

-            if (audio_pt_wait(&pa->pt, __func__)) {
+            if (audio_pt_wait (&pa->pt, AUDIO_FUNC)) {
                goto exit;
            }
        }

-        incr = to_grab = audio_MIN(pa->dead, pa->g->conf.samples >> 5);
+        incr = to_grab = audio_MIN (pa->dead, pa->g->conf.samples >> 2);
        wpos = pa->wpos;

-        if (audio_pt_unlock(&pa->pt, __func__)) {
+        if (audio_pt_unlock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
        }

@@ -342,7 +342,7 @@ static void *qpa_thread_in (void *arg)
            to_grab -= chunk;
        }

-        if (audio_pt_lock(&pa->pt, __func__)) {
+        if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
            return NULL;
        }

@@ -352,7 +352,7 @@ static void *qpa_thread_in (void *arg)
    }

 exit:
-    audio_pt_unlock(&pa->pt, __func__);
+    audio_pt_unlock (&pa->pt, AUDIO_FUNC);
    return NULL;
 }

@@ -361,7 +361,7 @@ static int qpa_run_in (HWVoiceIn *hw)
    int live, incr, dead;
    PAVoiceIn *pa = (PAVoiceIn *) hw;

-    if (audio_pt_lock(&pa->pt, __func__)) {
+    if (audio_pt_lock (&pa->pt, AUDIO_FUNC)) {
        return 0;
    }

@@ -372,10 +372,10 @@ static int qpa_run_in (HWVoiceIn *hw)
    pa->dead = dead - incr;
    hw->wpos = pa->wpos;
    if (pa->dead > 0) {
-        audio_pt_unlock_and_signal(&pa->pt, __func__);
+        audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
    }
    else {
-        audio_pt_unlock(&pa->pt, __func__);
+        audio_pt_unlock (&pa->pt, AUDIO_FUNC);
    }
    return incr;
 }
@@ -579,7 +579,7 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,

    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = g->conf.samples;
-    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->rpos = hw->rpos;
    if (!pa->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
@@ -587,7 +587,7 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
        goto fail2;
    }

-    if (audio_pt_init(&pa->pt, qpa_thread_out, hw, AUDIO_CAP, __func__)) {
+    if (audio_pt_init (&pa->pt, qpa_thread_out, hw, AUDIO_CAP, AUDIO_FUNC)) {
        goto fail3;
    }

@@ -636,7 +636,7 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)

    audio_pcm_init_info (&hw->info, &obt_as);
    hw->samples = g->conf.samples;
-    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+    pa->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    pa->wpos = hw->wpos;
    if (!pa->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
@@ -644,7 +644,7 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
        goto fail2;
    }

-    if (audio_pt_init(&pa->pt, qpa_thread_in, hw, AUDIO_CAP, __func__)) {
+    if (audio_pt_init (&pa->pt, qpa_thread_in, hw, AUDIO_CAP, AUDIO_FUNC)) {
        goto fail3;
    }

@@ -667,17 +667,17 @@ static void qpa_fini_out (HWVoiceOut *hw)
    void *ret;
    PAVoiceOut *pa = (PAVoiceOut *) hw;

-    audio_pt_lock(&pa->pt, __func__);
+    audio_pt_lock (&pa->pt, AUDIO_FUNC);
    pa->done = 1;
-    audio_pt_unlock_and_signal(&pa->pt, __func__);
-    audio_pt_join(&pa->pt, &ret, __func__);
+    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
+    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);

    if (pa->stream) {
        pa_stream_unref (pa->stream);
        pa->stream = NULL;
    }

-    audio_pt_fini(&pa->pt, __func__);
+    audio_pt_fini (&pa->pt, AUDIO_FUNC);
    g_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }
@@ -687,17 +687,17 @@ static void qpa_fini_in (HWVoiceIn *hw)
    void *ret;
    PAVoiceIn *pa = (PAVoiceIn *) hw;

-    audio_pt_lock(&pa->pt, __func__);
+    audio_pt_lock (&pa->pt, AUDIO_FUNC);
    pa->done = 1;
-    audio_pt_unlock_and_signal(&pa->pt, __func__);
-    audio_pt_join(&pa->pt, &ret, __func__);
+    audio_pt_unlock_and_signal (&pa->pt, AUDIO_FUNC);
+    audio_pt_join (&pa->pt, &ret, AUDIO_FUNC);

    if (pa->stream) {
        pa_stream_unref (pa->stream);
        pa->stream = NULL;
    }

-    audio_pt_fini(&pa->pt, __func__);
+    audio_pt_fini (&pa->pt, AUDIO_FUNC);
    g_free (pa->pcm_buf);
    pa->pcm_buf = NULL;
 }
@@ -937,7 +937,7 @@ static struct audio_pcm_ops qpa_pcm_ops = {
    .ctl_in   = qpa_ctl_in
 };

-static struct audio_driver pa_audio_driver = {
+struct audio_driver pa_audio_driver = {
    .name           = "pa",
    .descr          = "http://www.pulseaudio.org/",
    .options        = qpa_options,
@@ -951,9 +951,3 @@ static struct audio_driver pa_audio_driver = {
    .voice_size_in  = sizeof (PAVoiceIn),
    .ctl_caps       = VOICE_VOLUME_CAP
 };
-
-static void register_audio_pa(void)
-{
-    audio_driver_register(&pa_audio_driver);
-}
-type_init(register_audio_pa);
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -277,7 +277,7 @@ static void sdl_callback (void *opaque, Uint8 *buf, int len)
            return;
        }

-        if (audio_bug(__func__, sdl->live < 0 || sdl->live > hw->samples)) {
+        if (audio_bug (AUDIO_FUNC, sdl->live < 0 || sdl->live > hw->samples)) {
            dolog ("sdl->live=%d hw->samples=%d\n",
                   sdl->live, hw->samples);
            return;
@@ -500,7 +500,7 @@ static struct audio_pcm_ops sdl_pcm_ops = {
    .ctl_out  = sdl_ctl_out,
 };

-static struct audio_driver sdl_audio_driver = {
+struct audio_driver sdl_audio_driver = {
    .name           = "sdl",
    .descr          = "SDL http://www.libsdl.org",
    .options        = sdl_options,
@@ -513,9 +513,3 @@ static struct audio_driver sdl_audio_driver = {
    .voice_size_out = sizeof (SDLVoiceOut),
    .voice_size_in  = 0
 };
-
-static void register_audio_sdl(void)
-{
-    audio_driver_register(&sdl_audio_driver);
-}
-type_init(register_audio_sdl);
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -391,7 +391,7 @@ static struct audio_pcm_ops audio_callbacks = {
    .ctl_in   = line_in_ctl,
 };

-static struct audio_driver spice_audio_driver = {
+struct audio_driver spice_audio_driver = {
    .name           = "spice",
    .descr          = "spice audio driver",
    .options        = audio_options,
@@ -411,9 +411,3 @@ void qemu_spice_audio_init (void)
 {
    spice_audio_driver.can_be_default = 1;
 }
-
-static void register_audio_spice(void)
-{
-    audio_driver_register(&spice_audio_driver);
-}
-type_init(register_audio_spice);
--- a/audio/trace-events
+++ b/audio/trace-events
@@ -15,8 +15,3 @@ alsa_no_frames(int state) "No frames available and ALSA state is %d"
 # audio/ossaudio.c
 oss_version(int version) "OSS version = 0x%x"
 oss_invalid_available_size(int size, int bufsize) "Invalid available size, size=%d bufsize=%d"
-
-# audio/audio.c
-audio_timer_start(int interval) "interval %d ms"
-audio_timer_stop(void) ""
-audio_timer_delayed(int interval) "interval %d ms"
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -139,7 +139,7 @@ static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
    audio_pcm_init_info (&hw->info, &wav_as);

    hw->samples = 1024;
-    wav->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
+    wav->pcm_buf = audio_calloc (AUDIO_FUNC, hw->samples, 1 << hw->info.shift);
    if (!wav->pcm_buf) {
        dolog ("Could not allocate buffer (%d bytes)\n",
               hw->samples << hw->info.shift);
@@ -278,7 +278,7 @@ static struct audio_pcm_ops wav_pcm_ops = {
    .ctl_out  = wav_ctl_out,
 };

-static struct audio_driver wav_audio_driver = {
+struct audio_driver wav_audio_driver = {
    .name           = "wav",
    .descr          = "WAV renderer http://wikipedia.org/wiki/WAV",
    .options        = wav_options,
@@ -291,9 +291,3 @@ static struct audio_driver wav_audio_driver = {
    .voice_size_out = sizeof (WAVVoiceOut),
    .voice_size_in  = 0
 };
-
-static void register_audio_wav(void)
-{
-    audio_driver_register(&wav_audio_driver);
-}
-type_init(register_audio_wav);
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,7 +1,6 @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "monitor/monitor.h"
-#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "audio.h"

--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -4,15 +4,7 @@ common-obj-$(CONFIG_POSIX) += rng-random.o
 common-obj-$(CONFIG_TPM) += tpm.o

 common-obj-y += hostmem.o hostmem-ram.o
-common-obj-$(CONFIG_POSIX) += hostmem-file.o
+common-obj-$(CONFIG_LINUX) += hostmem-file.o

 common-obj-y += cryptodev.o
 common-obj-y += cryptodev-builtin.o
-
-ifeq ($(CONFIG_VIRTIO),y)
-common-obj-y += cryptodev-vhost.o
-common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_LINUX)) += \
-    cryptodev-vhost-user.o
-endif
-
-common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -78,7 +78,6 @@ static void cryptodev_builtin_init(
              "cryptodev-builtin", NULL);
    cc->info_str = g_strdup_printf("cryptodev-builtin0");
    cc->queue_index = 0;
-    cc->type = CRYPTODEV_BACKEND_TYPE_BUILTIN;
    backend->conf.peers.ccs[0] = cc;

    backend->conf.crypto_services =
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -1,390 +0,0 @@
-/*
- * QEMU Cryptodev backend for QEMU cipher APIs
- *
- * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
- *
- * Authors:
- *    Gonglei <arei.gonglei@huawei.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "hw/boards.h"
-#include "qapi/error.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/error-report.h"
-#include "hw/virtio/vhost-user.h"
-#include "standard-headers/linux/virtio_crypto.h"
-#include "sysemu/cryptodev-vhost.h"
-#include "chardev/char-fe.h"
-#include "sysemu/cryptodev-vhost-user.h"
-
-
-/**
- * @TYPE_CRYPTODEV_BACKEND_VHOST_USER:
- * name of backend that uses vhost user server
- */
-#define TYPE_CRYPTODEV_BACKEND_VHOST_USER "cryptodev-vhost-user"
-
-#define CRYPTODEV_BACKEND_VHOST_USER(obj) \
-    OBJECT_CHECK(CryptoDevBackendVhostUser, \
-                 (obj), TYPE_CRYPTODEV_BACKEND_VHOST_USER)
-
-
-typedef struct CryptoDevBackendVhostUser {
-    CryptoDevBackend parent_obj;
-
-    VhostUserState *vhost_user;
-    CharBackend chr;
-    char *chr_name;
-    bool opened;
-    CryptoDevBackendVhost *vhost_crypto[MAX_CRYPTO_QUEUE_NUM];
-} CryptoDevBackendVhostUser;
-
-static int
-cryptodev_vhost_user_running(
-             CryptoDevBackendVhost *crypto)
-{
-    return crypto ? 1 : 0;
-}
-
-CryptoDevBackendVhost *
-cryptodev_vhost_user_get_vhost(
-                         CryptoDevBackendClient *cc,
-                         CryptoDevBackend *b,
-                         uint16_t queue)
-{
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(b);
-    assert(cc->type == CRYPTODEV_BACKEND_TYPE_VHOST_USER);
-    assert(queue < MAX_CRYPTO_QUEUE_NUM);
-
-    return s->vhost_crypto[queue];
-}
-
-static void cryptodev_vhost_user_stop(int queues,
-                          CryptoDevBackendVhostUser *s)
-{
-    size_t i;
-
-    for (i = 0; i < queues; i++) {
-        if (!cryptodev_vhost_user_running(s->vhost_crypto[i])) {
-            continue;
-        }
-
-        cryptodev_vhost_cleanup(s->vhost_crypto[i]);
-        s->vhost_crypto[i] = NULL;
-    }
-}
-
-static int
-cryptodev_vhost_user_start(int queues,
-                         CryptoDevBackendVhostUser *s)
-{
-    CryptoDevBackendVhostOptions options;
-    CryptoDevBackend *b = CRYPTODEV_BACKEND(s);
-    int max_queues;
-    size_t i;
-
-    for (i = 0; i < queues; i++) {
-        if (cryptodev_vhost_user_running(s->vhost_crypto[i])) {
-            continue;
-        }
-
-        options.opaque = s->vhost_user;
-        options.backend_type = VHOST_BACKEND_TYPE_USER;
-        options.cc = b->conf.peers.ccs[i];
-        s->vhost_crypto[i] = cryptodev_vhost_init(&options);
-        if (!s->vhost_crypto[i]) {
-            error_report("failed to init vhost_crypto for queue %zu", i);
-            goto err;
-        }
-
-        if (i == 0) {
-            max_queues =
-              cryptodev_vhost_get_max_queues(s->vhost_crypto[i]);
-            if (queues > max_queues) {
-                error_report("you are asking more queues than supported: %d",
-                             max_queues);
-                goto err;
-            }
-        }
-    }
-
-    return 0;
-
-err:
-    cryptodev_vhost_user_stop(i + 1, s);
-    return -1;
-}
-
-static Chardev *
-cryptodev_vhost_claim_chardev(CryptoDevBackendVhostUser *s,
-                                    Error **errp)
-{
-    Chardev *chr;
-
-    if (s->chr_name == NULL) {
-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
-                   "chardev", "a valid character device");
-        return NULL;
-    }
-
-    chr = qemu_chr_find(s->chr_name);
-    if (chr == NULL) {
-        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
-                  "Device '%s' not found", s->chr_name);
-        return NULL;
-    }
-
-    return chr;
-}
-
-static void cryptodev_vhost_user_event(void *opaque, int event)
-{
-    CryptoDevBackendVhostUser *s = opaque;
-    CryptoDevBackend *b = CRYPTODEV_BACKEND(s);
-    int queues = b->conf.peers.queues;
-
-    assert(queues < MAX_CRYPTO_QUEUE_NUM);
-
-    switch (event) {
-    case CHR_EVENT_OPENED:
-        if (cryptodev_vhost_user_start(queues, s) < 0) {
-            exit(1);
-        }
-        b->ready = true;
-        break;
-    case CHR_EVENT_CLOSED:
-        b->ready = false;
-        cryptodev_vhost_user_stop(queues, s);
-        break;
-    }
-}
-
-static void cryptodev_vhost_user_init(
-             CryptoDevBackend *backend, Error **errp)
-{
-    int queues = backend->conf.peers.queues;
-    size_t i;
-    Error *local_err = NULL;
-    Chardev *chr;
-    VhostUserState *user;
-    CryptoDevBackendClient *cc;
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(backend);
-
-    chr = cryptodev_vhost_claim_chardev(s, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    s->opened = true;
-
-    for (i = 0; i < queues; i++) {
-        cc = cryptodev_backend_new_client(
-                  "cryptodev-vhost-user", NULL);
-        cc->info_str = g_strdup_printf("cryptodev-vhost-user%zu to %s ",
-                                       i, chr->label);
-        cc->queue_index = i;
-        cc->type = CRYPTODEV_BACKEND_TYPE_VHOST_USER;
-
-        backend->conf.peers.ccs[i] = cc;
-
-        if (i == 0) {
-            if (!qemu_chr_fe_init(&s->chr, chr, &local_err)) {
-                error_propagate(errp, local_err);
-                return;
-            }
-        }
-    }
-
-    user = vhost_user_init();
-    if (!user) {
-        error_setg(errp, "Failed to init vhost_user");
-        return;
-    }
-
-    user->chr = &s->chr;
-    s->vhost_user = user;
-
-    qemu_chr_fe_set_handlers(&s->chr, NULL, NULL,
-                     cryptodev_vhost_user_event, NULL, s, NULL, true);
-
-    backend->conf.crypto_services =
-                         1u << VIRTIO_CRYPTO_SERVICE_CIPHER |
-                         1u << VIRTIO_CRYPTO_SERVICE_HASH |
-                         1u << VIRTIO_CRYPTO_SERVICE_MAC;
-    backend->conf.cipher_algo_l = 1u << VIRTIO_CRYPTO_CIPHER_AES_CBC;
-    backend->conf.hash_algo = 1u << VIRTIO_CRYPTO_HASH_SHA1;
-
-    backend->conf.max_size = UINT64_MAX;
-    backend->conf.max_cipher_key_len = VHOST_USER_MAX_CIPHER_KEY_LEN;
-    backend->conf.max_auth_key_len = VHOST_USER_MAX_AUTH_KEY_LEN;
-}
-
-static int64_t cryptodev_vhost_user_sym_create_session(
-           CryptoDevBackend *backend,
-           CryptoDevBackendSymSessionInfo *sess_info,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendClient *cc =
-                   backend->conf.peers.ccs[queue_index];
-    CryptoDevBackendVhost *vhost_crypto;
-    uint64_t session_id = 0;
-    int ret;
-
-    vhost_crypto = cryptodev_vhost_user_get_vhost(cc, backend, queue_index);
-    if (vhost_crypto) {
-        struct vhost_dev *dev = &(vhost_crypto->dev);
-        ret = dev->vhost_ops->vhost_crypto_create_session(dev,
-                                                          sess_info,
-                                                          &session_id);
-        if (ret < 0) {
-            return -1;
-        } else {
-            return session_id;
-        }
-    }
-    return -1;
-}
-
-static int cryptodev_vhost_user_sym_close_session(
-           CryptoDevBackend *backend,
-           uint64_t session_id,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendClient *cc =
-                  backend->conf.peers.ccs[queue_index];
-    CryptoDevBackendVhost *vhost_crypto;
-    int ret;
-
-    vhost_crypto = cryptodev_vhost_user_get_vhost(cc, backend, queue_index);
-    if (vhost_crypto) {
-        struct vhost_dev *dev = &(vhost_crypto->dev);
-        ret = dev->vhost_ops->vhost_crypto_close_session(dev,
-                                                         session_id);
-        if (ret < 0) {
-            return -1;
-        } else {
-            return 0;
-        }
-    }
-    return -1;
-}
-
-static void cryptodev_vhost_user_cleanup(
-             CryptoDevBackend *backend,
-             Error **errp)
-{
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(backend);
-    size_t i;
-    int queues = backend->conf.peers.queues;
-    CryptoDevBackendClient *cc;
-
-    cryptodev_vhost_user_stop(queues, s);
-
-    for (i = 0; i < queues; i++) {
-        cc = backend->conf.peers.ccs[i];
-        if (cc) {
-            cryptodev_backend_free_client(cc);
-            backend->conf.peers.ccs[i] = NULL;
-        }
-    }
-
-    if (s->vhost_user) {
-        vhost_user_cleanup(s->vhost_user);
-        g_free(s->vhost_user);
-        s->vhost_user = NULL;
-    }
-}
-
-static void cryptodev_vhost_user_set_chardev(Object *obj,
-                                    const char *value, Error **errp)
-{
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(obj);
-
-    if (s->opened) {
-        error_setg(errp, QERR_PERMISSION_DENIED);
-    } else {
-        g_free(s->chr_name);
-        s->chr_name = g_strdup(value);
-    }
-}
-
-static char *
-cryptodev_vhost_user_get_chardev(Object *obj, Error **errp)
-{
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(obj);
-    Chardev *chr = qemu_chr_fe_get_driver(&s->chr);
-
-    if (chr && chr->label) {
-        return g_strdup(chr->label);
-    }
-
-    return NULL;
-}
-
-static void cryptodev_vhost_user_instance_int(Object *obj)
-{
-    object_property_add_str(obj, "chardev",
-                            cryptodev_vhost_user_get_chardev,
-                            cryptodev_vhost_user_set_chardev,
-                            NULL);
-}
-
-static void cryptodev_vhost_user_finalize(Object *obj)
-{
-    CryptoDevBackendVhostUser *s =
-                      CRYPTODEV_BACKEND_VHOST_USER(obj);
-
-    qemu_chr_fe_deinit(&s->chr, false);
-
-    g_free(s->chr_name);
-}
-
-static void
-cryptodev_vhost_user_class_init(ObjectClass *oc, void *data)
-{
-    CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
-
-    bc->init = cryptodev_vhost_user_init;
-    bc->cleanup = cryptodev_vhost_user_cleanup;
-    bc->create_session = cryptodev_vhost_user_sym_create_session;
-    bc->close_session = cryptodev_vhost_user_sym_close_session;
-    bc->do_sym_op = NULL;
-}
-
-static const TypeInfo cryptodev_vhost_user_info = {
-    .name = TYPE_CRYPTODEV_BACKEND_VHOST_USER,
-    .parent = TYPE_CRYPTODEV_BACKEND,
-    .class_init = cryptodev_vhost_user_class_init,
-    .instance_init = cryptodev_vhost_user_instance_int,
-    .instance_finalize = cryptodev_vhost_user_finalize,
-    .instance_size = sizeof(CryptoDevBackendVhostUser),
-};
-
-static void
-cryptodev_vhost_user_register_types(void)
-{
-    type_register_static(&cryptodev_vhost_user_info);
-}
-
-type_init(cryptodev_vhost_user_register_types);
--- a/backends/cryptodev-vhost.c
+++ b/backends/cryptodev-vhost.c
@@ -1,347 +0,0 @@
-/*
- * QEMU Cryptodev backend for QEMU cipher APIs
- *
- * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
- *
- * Authors:
- *    Gonglei <arei.gonglei@huawei.com>
- *    Jay Zhou <jianjay.zhou@huawei.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "hw/virtio/virtio-bus.h"
-#include "sysemu/cryptodev-vhost.h"
-
-#ifdef CONFIG_VHOST_CRYPTO
-#include "qapi/error.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/error-report.h"
-#include "hw/virtio/virtio-crypto.h"
-#include "sysemu/cryptodev-vhost-user.h"
-
-uint64_t
-cryptodev_vhost_get_max_queues(
-                        CryptoDevBackendVhost *crypto)
-{
-    return crypto->dev.max_queues;
-}
-
-void cryptodev_vhost_cleanup(CryptoDevBackendVhost *crypto)
-{
-    vhost_dev_cleanup(&crypto->dev);
-    g_free(crypto);
-}
-
-struct CryptoDevBackendVhost *
-cryptodev_vhost_init(
-             CryptoDevBackendVhostOptions *options)
-{
-    int r;
-    CryptoDevBackendVhost *crypto;
-
-    crypto = g_new(CryptoDevBackendVhost, 1);
-    crypto->dev.max_queues = 1;
-    crypto->dev.nvqs = 1;
-    crypto->dev.vqs = crypto->vqs;
-
-    crypto->cc = options->cc;
-
-    crypto->dev.protocol_features = 0;
-    crypto->backend = -1;
-
-    /* vhost-user needs vq_index to initiate a specific queue pair */
-    crypto->dev.vq_index = crypto->cc->queue_index * crypto->dev.nvqs;
-
-    r = vhost_dev_init(&crypto->dev, options->opaque, options->backend_type, 0);
-    if (r < 0) {
-        goto fail;
-    }
-
-    return crypto;
-fail:
-    g_free(crypto);
-    return NULL;
-}
-
-static int
-cryptodev_vhost_start_one(CryptoDevBackendVhost *crypto,
-                                  VirtIODevice *dev)
-{
-    int r;
-
-    crypto->dev.nvqs = 1;
-    crypto->dev.vqs = crypto->vqs;
-
-    r = vhost_dev_enable_notifiers(&crypto->dev, dev);
-    if (r < 0) {
-        goto fail_notifiers;
-    }
-
-    r = vhost_dev_start(&crypto->dev, dev);
-    if (r < 0) {
-        goto fail_start;
-    }
-
-    return 0;
-
-fail_start:
-    vhost_dev_disable_notifiers(&crypto->dev, dev);
-fail_notifiers:
-    return r;
-}
-
-static void
-cryptodev_vhost_stop_one(CryptoDevBackendVhost *crypto,
-                                 VirtIODevice *dev)
-{
-    vhost_dev_stop(&crypto->dev, dev);
-    vhost_dev_disable_notifiers(&crypto->dev, dev);
-}
-
-CryptoDevBackendVhost *
-cryptodev_get_vhost(CryptoDevBackendClient *cc,
-                            CryptoDevBackend *b,
-                            uint16_t queue)
-{
-    CryptoDevBackendVhost *vhost_crypto = NULL;
-
-    if (!cc) {
-        return NULL;
-    }
-
-    switch (cc->type) {
-#if defined(CONFIG_VHOST_USER) && defined(CONFIG_LINUX)
-    case CRYPTODEV_BACKEND_TYPE_VHOST_USER:
-        vhost_crypto = cryptodev_vhost_user_get_vhost(cc, b, queue);
-        break;
-#endif
-    default:
-        break;
-    }
-
-    return vhost_crypto;
-}
-
-static void
-cryptodev_vhost_set_vq_index(CryptoDevBackendVhost *crypto,
-                                     int vq_index)
-{
-    crypto->dev.vq_index = vq_index;
-}
-
-static int
-vhost_set_vring_enable(CryptoDevBackendClient *cc,
-                            CryptoDevBackend *b,
-                            uint16_t queue, int enable)
-{
-    CryptoDevBackendVhost *crypto =
-                       cryptodev_get_vhost(cc, b, queue);
-    const VhostOps *vhost_ops;
-
-    cc->vring_enable = enable;
-
-    if (!crypto) {
-        return 0;
-    }
-
-    vhost_ops = crypto->dev.vhost_ops;
-    if (vhost_ops->vhost_set_vring_enable) {
-        return vhost_ops->vhost_set_vring_enable(&crypto->dev, enable);
-    }
-
-    return 0;
-}
-
-int cryptodev_vhost_start(VirtIODevice *dev, int total_queues)
-{
-    VirtIOCrypto *vcrypto = VIRTIO_CRYPTO(dev);
-    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(dev)));
-    VirtioBusState *vbus = VIRTIO_BUS(qbus);
-    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);
-    int r, e;
-    int i;
-    CryptoDevBackend *b = vcrypto->cryptodev;
-    CryptoDevBackendVhost *vhost_crypto;
-    CryptoDevBackendClient *cc;
-
-    if (!k->set_guest_notifiers) {
-        error_report("binding does not support guest notifiers");
-        return -ENOSYS;
-    }
-
-    for (i = 0; i < total_queues; i++) {
-        cc = b->conf.peers.ccs[i];
-
-        vhost_crypto = cryptodev_get_vhost(cc, b, i);
-        cryptodev_vhost_set_vq_index(vhost_crypto, i);
-
-        /* Suppress the masking guest notifiers on vhost user
-         * because vhost user doesn't interrupt masking/unmasking
-         * properly.
-         */
-        if (cc->type == CRYPTODEV_BACKEND_TYPE_VHOST_USER) {
-            dev->use_guest_notifier_mask = false;
-        }
-     }
-
-    r = k->set_guest_notifiers(qbus->parent, total_queues, true);
-    if (r < 0) {
-        error_report("error binding guest notifier: %d", -r);
-        goto err;
-    }
-
-    for (i = 0; i < total_queues; i++) {
-        cc = b->conf.peers.ccs[i];
-
-        vhost_crypto = cryptodev_get_vhost(cc, b, i);
-        r = cryptodev_vhost_start_one(vhost_crypto, dev);
-
-        if (r < 0) {
-            goto err_start;
-        }
-
-        if (cc->vring_enable) {
-            /* restore vring enable state */
-            r = vhost_set_vring_enable(cc, b, i, cc->vring_enable);
-
-            if (r < 0) {
-                goto err_start;
-            }
-        }
-    }
-
-    return 0;
-
-err_start:
-    while (--i >= 0) {
-        cc = b->conf.peers.ccs[i];
-        vhost_crypto = cryptodev_get_vhost(cc, b, i);
-        cryptodev_vhost_stop_one(vhost_crypto, dev);
-    }
-    e = k->set_guest_notifiers(qbus->parent, total_queues, false);
-    if (e < 0) {
-        error_report("vhost guest notifier cleanup failed: %d", e);
-    }
-err:
-    return r;
-}
-
-void cryptodev_vhost_stop(VirtIODevice *dev, int total_queues)
-{
-    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(dev)));
-    VirtioBusState *vbus = VIRTIO_BUS(qbus);
-    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);
-    VirtIOCrypto *vcrypto = VIRTIO_CRYPTO(dev);
-    CryptoDevBackend *b = vcrypto->cryptodev;
-    CryptoDevBackendVhost *vhost_crypto;
-    CryptoDevBackendClient *cc;
-    size_t i;
-    int r;
-
-    for (i = 0; i < total_queues; i++) {
-        cc = b->conf.peers.ccs[i];
-
-        vhost_crypto = cryptodev_get_vhost(cc, b, i);
-        cryptodev_vhost_stop_one(vhost_crypto, dev);
-    }
-
-    r = k->set_guest_notifiers(qbus->parent, total_queues, false);
-    if (r < 0) {
-        error_report("vhost guest notifier cleanup failed: %d", r);
-    }
-    assert(r >= 0);
-}
-
-void cryptodev_vhost_virtqueue_mask(VirtIODevice *dev,
-                                           int queue,
-                                           int idx, bool mask)
-{
-    VirtIOCrypto *vcrypto = VIRTIO_CRYPTO(dev);
-    CryptoDevBackend *b = vcrypto->cryptodev;
-    CryptoDevBackendVhost *vhost_crypto;
-    CryptoDevBackendClient *cc;
-
-    assert(queue < MAX_CRYPTO_QUEUE_NUM);
-
-    cc = b->conf.peers.ccs[queue];
-    vhost_crypto = cryptodev_get_vhost(cc, b, queue);
-
-    vhost_virtqueue_mask(&vhost_crypto->dev, dev, idx, mask);
-}
-
-bool cryptodev_vhost_virtqueue_pending(VirtIODevice *dev,
-                                              int queue, int idx)
-{
-    VirtIOCrypto *vcrypto = VIRTIO_CRYPTO(dev);
-    CryptoDevBackend *b = vcrypto->cryptodev;
-    CryptoDevBackendVhost *vhost_crypto;
-    CryptoDevBackendClient *cc;
-
-    assert(queue < MAX_CRYPTO_QUEUE_NUM);
-
-    cc = b->conf.peers.ccs[queue];
-    vhost_crypto = cryptodev_get_vhost(cc, b, queue);
-
-    return vhost_virtqueue_pending(&vhost_crypto->dev, idx);
-}
-
-#else
-uint64_t
-cryptodev_vhost_get_max_queues(CryptoDevBackendVhost *crypto)
-{
-    return 0;
-}
-
-void cryptodev_vhost_cleanup(CryptoDevBackendVhost *crypto)
-{
-}
-
-struct CryptoDevBackendVhost *
-cryptodev_vhost_init(CryptoDevBackendVhostOptions *options)
-{
-    return NULL;
-}
-
-CryptoDevBackendVhost *
-cryptodev_get_vhost(CryptoDevBackendClient *cc,
-                    CryptoDevBackend *b,
-                    uint16_t queue)
-{
-    return NULL;
-}
-
-int cryptodev_vhost_start(VirtIODevice *dev, int total_queues)
-{
-    return -1;
-}
-
-void cryptodev_vhost_stop(VirtIODevice *dev, int total_queues)
-{
-}
-
-void cryptodev_vhost_virtqueue_mask(VirtIODevice *dev,
-                                    int queue,
-                                    int idx, bool mask)
-{
-}
-
-bool cryptodev_vhost_virtqueue_pending(VirtIODevice *dev,
-                                       int queue, int idx)
-{
-    return false;
-}
-#endif
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -26,6 +26,8 @@
 #include "hw/boards.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
+#include "qapi-types.h"
+#include "qapi-visit.h"
 #include "qemu/config-file.h"
 #include "qom/object_interfaces.h"
 #include "hw/virtio/virtio-crypto.h"
@@ -213,7 +215,7 @@ bool cryptodev_backend_is_ready(CryptoDevBackend *backend)
 }

 static bool
-cryptodev_backend_can_be_deleted(UserCreatable *uc)
+cryptodev_backend_can_be_deleted(UserCreatable *uc, Error **errp)
 {
    return !cryptodev_backend_is_used(CRYPTODEV_BACKEND(uc));
 }
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -12,7 +12,6 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "qemu/error-report.h"
 #include "sysemu/hostmem.h"
 #include "sysemu/sysemu.h"
 #include "qom/object_interfaces.h"
@@ -32,19 +31,14 @@ typedef struct HostMemoryBackendFile HostMemoryBackendFile;
 struct HostMemoryBackendFile {
    HostMemoryBackend parent_obj;

+    bool share;
    char *mem_path;
-    uint64_t align;
-    bool discard_data;
-    bool is_pmem;
 };

 static void
 file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);
-#ifdef CONFIG_POSIX
-    gchar *path;
-#endif

    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
@@ -54,18 +48,19 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
        error_setg(errp, "mem-path property not set");
        return;
    }
-#ifndef CONFIG_POSIX
+#ifndef CONFIG_LINUX
    error_setg(errp, "-mem-path not supported on this host");
 #else
-    backend->force_prealloc = mem_prealloc;
-    path = object_get_canonical_path(OBJECT(backend));
-    memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
-                                     path,
-                                     backend->size, fb->align,
-                                     (backend->share ? RAM_SHARED : 0) |
-                                     (fb->is_pmem ? RAM_PMEM : 0),
-                                     fb->mem_path, errp);
-    g_free(path);
+    if (!host_memory_backend_mr_inited(backend)) {
+        gchar *path;
+        backend->force_prealloc = mem_prealloc;
+        path = object_get_canonical_path(OBJECT(backend));
+        memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
+                                 path,
+                                 backend->size, fb->share,
+                                 fb->mem_path, errp);
+        g_free(path);
+    }
 #endif
 }

@@ -89,101 +84,23 @@ static void set_mem_path(Object *o, const char *str, Error **errp)
    fb->mem_path = g_strdup(str);
 }

-static bool file_memory_backend_get_discard_data(Object *o, Error **errp)
-{
-    return MEMORY_BACKEND_FILE(o)->discard_data;
-}
-
-static void file_memory_backend_set_discard_data(Object *o, bool value,
-                                               Error **errp)
-{
-    MEMORY_BACKEND_FILE(o)->discard_data = value;
-}
-
-static void file_memory_backend_get_align(Object *o, Visitor *v,
-                                          const char *name, void *opaque,
-                                          Error **errp)
+static bool file_memory_backend_get_share(Object *o, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-    uint64_t val = fb->align;

-    visit_type_size(v, name, &val, errp);
+    return fb->share;
 }

-static void file_memory_backend_set_align(Object *o, Visitor *v,
-                                          const char *name, void *opaque,
-                                          Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(o);
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
-    Error *local_err = NULL;
-    uint64_t val;
-
-    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(&local_err, "cannot change property value");
-        goto out;
-    }
-
-    visit_type_size(v, name, &val, &local_err);
-    if (local_err) {
-        goto out;
-    }
-    fb->align = val;
-
- out:
-    error_propagate(errp, local_err);
-}
-
-static bool file_memory_backend_get_pmem(Object *o, Error **errp)
-{
-    return MEMORY_BACKEND_FILE(o)->is_pmem;
-}
-
-static void file_memory_backend_set_pmem(Object *o, bool value, Error **errp)
+static void file_memory_backend_set_share(Object *o, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

    if (host_memory_backend_mr_inited(backend)) {
-        char *path = object_get_canonical_path_component(o);
-
-        error_setg(errp, "cannot change property 'pmem' of %s '%s'",
-                   object_get_typename(o),
-                   path);
-        g_free(path);
+        error_setg(errp, "cannot change property value");
        return;
    }
-
-#ifndef CONFIG_LIBPMEM
-    if (value) {
-        Error *local_err = NULL;
-        char *path = object_get_canonical_path_component(o);
-
-        error_setg(&local_err,
-                   "Lack of libpmem support while setting the 'pmem=on'"
-                   " of %s '%s'. We can't ensure data persistence.",
-                   object_get_typename(o),
-                   path);
-        g_free(path);
-        error_propagate(errp, local_err);
-        return;
-    }
-#endif
-
-    fb->is_pmem = value;
-}
-
-static void file_backend_unparent(Object *obj)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(obj);
-
-    if (host_memory_backend_mr_inited(backend) && fb->discard_data) {
-        void *ptr = memory_region_get_ram_ptr(&backend->mr);
-        uint64_t sz = memory_region_size(&backend->mr);
-
-        qemu_madvise(ptr, sz, QEMU_MADV_REMOVE);
-    }
+    fb->share = value;
 }

 static void
@@ -192,21 +109,13 @@ file_backend_class_init(ObjectClass *oc, void *data)
    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);

    bc->alloc = file_backend_memory_alloc;
-    oc->unparent = file_backend_unparent;

-    object_class_property_add_bool(oc, "discard-data",
-        file_memory_backend_get_discard_data, file_memory_backend_set_discard_data,
+    object_class_property_add_bool(oc, "share",
+        file_memory_backend_get_share, file_memory_backend_set_share,
        &error_abort);
    object_class_property_add_str(oc, "mem-path",
        get_mem_path, set_mem_path,
        &error_abort);
-    object_class_property_add(oc, "align", "int",
-        file_memory_backend_get_align,
-        file_memory_backend_set_align,
-        NULL, NULL, &error_abort);
-    object_class_property_add_bool(oc, "pmem",
-        file_memory_backend_get_pmem, file_memory_backend_set_pmem,
-        &error_abort);
 }

 static void file_backend_instance_finalize(Object *o)
--- a/backends/hostmem-memfd.c
+++ b/backends/hostmem-memfd.c
@@ -1,183 +0,0 @@
-/*
- * QEMU host memfd memory backend
- *
- * Copyright (C) 2018 Red Hat Inc
- *
- * Authors:
- *   Marc-André Lureau <marcandre.lureau@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "sysemu/hostmem.h"
-#include "sysemu/sysemu.h"
-#include "qom/object_interfaces.h"
-#include "qemu/memfd.h"
-#include "qapi/error.h"
-
-#define TYPE_MEMORY_BACKEND_MEMFD "memory-backend-memfd"
-
-#define MEMORY_BACKEND_MEMFD(obj)                                        \
-    OBJECT_CHECK(HostMemoryBackendMemfd, (obj), TYPE_MEMORY_BACKEND_MEMFD)
-
-typedef struct HostMemoryBackendMemfd HostMemoryBackendMemfd;
-
-struct HostMemoryBackendMemfd {
-    HostMemoryBackend parent_obj;
-
-    bool hugetlb;
-    uint64_t hugetlbsize;
-    bool seal;
-};
-
-static void
-memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
-{
-    HostMemoryBackendMemfd *m = MEMORY_BACKEND_MEMFD(backend);
-    char *name;
-    int fd;
-
-    if (!backend->size) {
-        error_setg(errp, "can't create backend with size 0");
-        return;
-    }
-
-    backend->force_prealloc = mem_prealloc;
-    fd = qemu_memfd_create(TYPE_MEMORY_BACKEND_MEMFD, backend->size,
-                           m->hugetlb, m->hugetlbsize, m->seal ?
-                           F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL : 0,
-                           errp);
-    if (fd == -1) {
-        return;
-    }
-
-    name = object_get_canonical_path(OBJECT(backend));
-    memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
-                                   name, backend->size,
-                                   backend->share, fd, errp);
-    g_free(name);
-}
-
-static bool
-memfd_backend_get_hugetlb(Object *o, Error **errp)
-{
-    return MEMORY_BACKEND_MEMFD(o)->hugetlb;
-}
-
-static void
-memfd_backend_set_hugetlb(Object *o, bool value, Error **errp)
-{
-    MEMORY_BACKEND_MEMFD(o)->hugetlb = value;
-}
-
-static void
-memfd_backend_set_hugetlbsize(Object *obj, Visitor *v, const char *name,
-                              void *opaque, Error **errp)
-{
-    HostMemoryBackendMemfd *m = MEMORY_BACKEND_MEMFD(obj);
-    Error *local_err = NULL;
-    uint64_t value;
-
-    if (host_memory_backend_mr_inited(MEMORY_BACKEND(obj))) {
-        error_setg(&local_err, "cannot change property value");
-        goto out;
-    }
-
-    visit_type_size(v, name, &value, &local_err);
-    if (local_err) {
-        goto out;
-    }
-    if (!value) {
-        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
-                   PRIu64 "'", object_get_typename(obj), name, value);
-        goto out;
-    }
-    m->hugetlbsize = value;
-out:
-    error_propagate(errp, local_err);
-}
-
-static void
-memfd_backend_get_hugetlbsize(Object *obj, Visitor *v, const char *name,
-                              void *opaque, Error **errp)
-{
-    HostMemoryBackendMemfd *m = MEMORY_BACKEND_MEMFD(obj);
-    uint64_t value = m->hugetlbsize;
-
-    visit_type_size(v, name, &value, errp);
-}
-
-static bool
-memfd_backend_get_seal(Object *o, Error **errp)
-{
-    return MEMORY_BACKEND_MEMFD(o)->seal;
-}
-
-static void
-memfd_backend_set_seal(Object *o, bool value, Error **errp)
-{
-    MEMORY_BACKEND_MEMFD(o)->seal = value;
-}
-
-static void
-memfd_backend_instance_init(Object *obj)
-{
-    HostMemoryBackendMemfd *m = MEMORY_BACKEND_MEMFD(obj);
-
-    /* default to sealed file */
-    m->seal = true;
-    MEMORY_BACKEND(m)->share = true;
-}
-
-static void
-memfd_backend_class_init(ObjectClass *oc, void *data)
-{
-    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
-
-    bc->alloc = memfd_backend_memory_alloc;
-
-    if (qemu_memfd_check(MFD_HUGETLB)) {
-        object_class_property_add_bool(oc, "hugetlb",
-                                       memfd_backend_get_hugetlb,
-                                       memfd_backend_set_hugetlb,
-                                       &error_abort);
-        object_class_property_set_description(oc, "hugetlb",
-                                              "Use huge pages",
-                                              &error_abort);
-        object_class_property_add(oc, "hugetlbsize", "int",
-                                  memfd_backend_get_hugetlbsize,
-                                  memfd_backend_set_hugetlbsize,
-                                  NULL, NULL, &error_abort);
-        object_class_property_set_description(oc, "hugetlbsize",
-                                              "Huge pages size (ex: 2M, 1G)",
-                                              &error_abort);
-    }
-    if (qemu_memfd_check(MFD_ALLOW_SEALING)) {
-        object_class_property_add_bool(oc, "seal",
-                                       memfd_backend_get_seal,
-                                       memfd_backend_set_seal,
-                                       &error_abort);
-        object_class_property_set_description(oc, "seal",
-                                              "Seal growing & shrinking",
-                                              &error_abort);
-    }
-}
-
-static const TypeInfo memfd_backend_info = {
-    .name = TYPE_MEMORY_BACKEND_MEMFD,
-    .parent = TYPE_MEMORY_BACKEND,
-    .instance_init = memfd_backend_instance_init,
-    .class_init = memfd_backend_class_init,
-    .instance_size = sizeof(HostMemoryBackendMemfd),
-};
-
-static void register_types(void)
-{
-    if (qemu_memfd_check(0)) {
-        type_register_static(&memfd_backend_info);
-    }
-}
-
-type_init(register_types);
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -28,8 +28,8 @@ ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
    }

    path = object_get_canonical_path_component(OBJECT(backend));
-    memory_region_init_ram_shared_nomigrate(&backend->mr, OBJECT(backend), path,
-                           backend->size, backend->share, errp);
+    memory_region_init_ram_nomigrate(&backend->mr, OBJECT(backend), path,
+                           backend->size, errp);
    g_free(path);
 }

--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -9,16 +9,15 @@
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
-
 #include "qemu/osdep.h"
 #include "sysemu/hostmem.h"
 #include "hw/boards.h"
 #include "qapi/error.h"
-#include "qapi/qapi-builtin-visit.h"
 #include "qapi/visitor.h"
+#include "qapi-types.h"
+#include "qapi-visit.h"
 #include "qemu/config-file.h"
 #include "qom/object_interfaces.h"
-#include "qemu/mmap-alloc.h"

 #ifdef CONFIG_NUMA
 #include <numaif.h>
@@ -247,7 +246,8 @@ bool host_memory_backend_mr_inited(HostMemoryBackend *backend)
    return memory_region_size(&backend->mr) != 0;
 }

-MemoryRegion *host_memory_backend_get_memory(HostMemoryBackend *backend)
+MemoryRegion *
+host_memory_backend_get_memory(HostMemoryBackend *backend, Error **errp)
 {
    return host_memory_backend_mr_inited(backend) ? &backend->mr : NULL;
 }
@@ -262,23 +262,6 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
    return backend->is_mapped;
 }

-#ifdef __linux__
-size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
-{
-    Object *obj = OBJECT(memdev);
-    char *path = object_property_get_str(obj, "mem-path", NULL);
-    size_t pagesize = qemu_mempath_getpagesize(path);
-
-    g_free(path);
-    return pagesize;
-}
-#else
-size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
-{
-    return getpagesize();
-}
-#endif
-
 static void
 host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
 {
@@ -321,7 +304,7 @@ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
            return;
        } else if (maxnode == 0 && backend->policy != MPOL_DEFAULT) {
            error_setg(errp, "host-nodes must be set for policy %s",
-                       HostMemPolicy_str(backend->policy));
+                       HostMemPolicy_lookup[backend->policy]);
            return;
        }

@@ -359,7 +342,7 @@ out:
 }

 static bool
-host_memory_backend_can_be_deleted(UserCreatable *uc)
+host_memory_backend_can_be_deleted(UserCreatable *uc, Error **errp)
 {
    if (host_memory_backend_is_mapped(MEMORY_BACKEND(uc))) {
        return false;
@@ -368,22 +351,22 @@ host_memory_backend_can_be_deleted(UserCreatable *uc)
    }
 }

-static bool host_memory_backend_get_share(Object *o, Error **errp)
+static char *get_id(Object *o, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);

-    return backend->share;
+    return g_strdup(backend->id);
 }

-static void host_memory_backend_set_share(Object *o, bool value, Error **errp)
+static void set_id(Object *o, const char *str, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(o);

-    if (host_memory_backend_mr_inited(backend)) {
+    if (backend->id) {
        error_setg(errp, "cannot change property value");
        return;
    }
-    backend->share = value;
+    backend->id = g_strdup(str);
 }

 static void
@@ -397,41 +380,31 @@ host_memory_backend_class_init(ObjectClass *oc, void *data)
    object_class_property_add_bool(oc, "merge",
        host_memory_backend_get_merge,
        host_memory_backend_set_merge, &error_abort);
-    object_class_property_set_description(oc, "merge",
-        "Mark memory as mergeable", &error_abort);
    object_class_property_add_bool(oc, "dump",
        host_memory_backend_get_dump,
        host_memory_backend_set_dump, &error_abort);
-    object_class_property_set_description(oc, "dump",
-        "Set to 'off' to exclude from core dump", &error_abort);
    object_class_property_add_bool(oc, "prealloc",
        host_memory_backend_get_prealloc,
        host_memory_backend_set_prealloc, &error_abort);
-    object_class_property_set_description(oc, "prealloc",
-        "Preallocate memory", &error_abort);
    object_class_property_add(oc, "size", "int",
        host_memory_backend_get_size,
        host_memory_backend_set_size,
        NULL, NULL, &error_abort);
-    object_class_property_set_description(oc, "size",
-        "Size of the memory region (ex: 500M)", &error_abort);
    object_class_property_add(oc, "host-nodes", "int",
        host_memory_backend_get_host_nodes,
        host_memory_backend_set_host_nodes,
        NULL, NULL, &error_abort);
-    object_class_property_set_description(oc, "host-nodes",
-        "Binds memory to the list of NUMA host nodes", &error_abort);
    object_class_property_add_enum(oc, "policy", "HostMemPolicy",
-        &HostMemPolicy_lookup,
+        HostMemPolicy_lookup,
        host_memory_backend_get_policy,
        host_memory_backend_set_policy, &error_abort);
-    object_class_property_set_description(oc, "policy",
-        "Set the NUMA policy", &error_abort);
-    object_class_property_add_bool(oc, "share",
-        host_memory_backend_get_share, host_memory_backend_set_share,
-        &error_abort);
-    object_class_property_set_description(oc, "share",
-        "Mark the memory as private to QEMU or shared", &error_abort);
+    object_class_property_add_str(oc, "id", get_id, set_id, &error_abort);
+}
+
+static void host_memory_backend_finalize(Object *o)
+{
+    HostMemoryBackend *backend = MEMORY_BACKEND(o);
+    g_free(backend->id);
 }

 static const TypeInfo host_memory_backend_info = {
@@ -442,6 +415,7 @@ static const TypeInfo host_memory_backend_info = {
    .class_init = host_memory_backend_class_init,
    .instance_size = sizeof(HostMemoryBackend),
    .instance_init = host_memory_backend_init,
+    .instance_finalize = host_memory_backend_finalize,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
--- a/backends/tpm.c
+++ b/backends/tpm.c
@@ -15,193 +15,184 @@
 #include "qemu/osdep.h"
 #include "sysemu/tpm_backend.h"
 #include "qapi/error.h"
+#include "qapi/qmp/qerror.h"
 #include "sysemu/tpm.h"
 #include "qemu/thread.h"
-#include "qemu/main-loop.h"
-#include "block/thread-pool.h"
-#include "qemu/error-report.h"
-
-static void tpm_backend_request_completed(void *opaque, int ret)
-{
-    TPMBackend *s = TPM_BACKEND(opaque);
-    TPMIfClass *tic = TPM_IF_GET_CLASS(s->tpmif);
-
-    tic->request_completed(s->tpmif, ret);
-
-    /* no need for atomic, as long the BQL is taken */
-    s->cmd = NULL;
-    object_unref(OBJECT(s));
-}
-
-static int tpm_backend_worker_thread(gpointer data)
-{
-    TPMBackend *s = TPM_BACKEND(data);
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-    Error *err = NULL;
-
-    k->handle_request(s, s->cmd, &err);
-    if (err) {
-        error_report_err(err);
-        return -1;
-    }
-
-    return 0;
-}
-
-void tpm_backend_finish_sync(TPMBackend *s)
-{
-    while (s->cmd) {
-        aio_poll(qemu_get_aio_context(), true);
-    }
-}
+#include "sysemu/tpm_backend_int.h"

 enum TpmType tpm_backend_get_type(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    return k->type;
+    return k->ops->type;
 }

-int tpm_backend_init(TPMBackend *s, TPMIf *tpmif, Error **errp)
+const char *tpm_backend_get_desc(TPMBackend *s)
 {
-    if (s->tpmif) {
-        error_setg(errp, "TPM backend '%s' is already initialized", s->id);
-        return -1;
-    }
-
-    s->tpmif = tpmif;
-    object_ref(OBJECT(tpmif));
-
-    s->had_startup_error = false;
-
-    return 0;
-}
-
-int tpm_backend_startup_tpm(TPMBackend *s, size_t buffersize)
-{
-    int res = 0;
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    /* terminate a running TPM */
-    tpm_backend_finish_sync(s);
+    return k->ops->desc();
+}

-    res = k->startup_tpm ? k->startup_tpm(s, buffersize) : 0;
+void tpm_backend_destroy(TPMBackend *s)
+{
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    s->had_startup_error = (res != 0);
+    k->ops->destroy(s);
+}

-    return res;
+int tpm_backend_init(TPMBackend *s, TPMState *state,
+                     TPMRecvDataCB *datacb)
+{
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
+
+    return k->ops->init(s, state, datacb);
+}
+
+int tpm_backend_startup_tpm(TPMBackend *s)
+{
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
+
+    return k->ops->startup_tpm(s);
 }

 bool tpm_backend_had_startup_error(TPMBackend *s)
 {
-    return s->had_startup_error;
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
+
+    return k->ops->had_startup_error(s);
 }

-void tpm_backend_deliver_request(TPMBackend *s, TPMBackendCmd *cmd)
+size_t tpm_backend_realloc_buffer(TPMBackend *s, TPMSizedBuffer *sb)
 {
-    ThreadPool *pool = aio_get_thread_pool(qemu_get_aio_context());
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    if (s->cmd != NULL) {
-        error_report("There is a TPM request pending");
-        return;
-    }
+    return k->ops->realloc_buffer(sb);
+}

-    s->cmd = cmd;
-    object_ref(OBJECT(s));
-    thread_pool_submit_aio(pool, tpm_backend_worker_thread, s,
-                           tpm_backend_request_completed, s);
+void tpm_backend_deliver_request(TPMBackend *s)
+{
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
+
+    k->ops->deliver_request(s);
 }

 void tpm_backend_reset(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    if (k->reset) {
-        k->reset(s);
-    }
-
-    tpm_backend_finish_sync(s);
-
-    s->had_startup_error = false;
+    k->ops->reset(s);
 }

 void tpm_backend_cancel_cmd(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    k->cancel_cmd(s);
+    k->ops->cancel_cmd(s);
 }

 bool tpm_backend_get_tpm_established_flag(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    return k->get_tpm_established_flag ?
-           k->get_tpm_established_flag(s) : false;
+    return k->ops->get_tpm_established_flag(s);
 }

 int tpm_backend_reset_tpm_established_flag(TPMBackend *s, uint8_t locty)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    return k->reset_tpm_established_flag ?
-           k->reset_tpm_established_flag(s, locty) : 0;
+    return k->ops->reset_tpm_established_flag(s, locty);
 }

 TPMVersion tpm_backend_get_tpm_version(TPMBackend *s)
 {
    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);

-    return k->get_tpm_version(s);
+    return k->ops->get_tpm_version(s);
 }

-size_t tpm_backend_get_buffer_size(TPMBackend *s)
-{
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-
-    return k->get_buffer_size(s);
-}
-
-TPMInfo *tpm_backend_query_tpm(TPMBackend *s)
-{
-    TPMInfo *info = g_new0(TPMInfo, 1);
-    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
-    TPMIfClass *tic = TPM_IF_GET_CLASS(s->tpmif);
-
-    info->id = g_strdup(s->id);
-    info->model = tic->model;
-    info->options = k->get_tpm_options(s);
-
-    return info;
-}
-
-static void tpm_backend_instance_finalize(Object *obj)
+static bool tpm_backend_prop_get_opened(Object *obj, Error **errp)
 {
    TPMBackend *s = TPM_BACKEND(obj);

-    object_unref(OBJECT(s->tpmif));
-    g_free(s->id);
+    return s->opened;
+}
+
+void tpm_backend_open(TPMBackend *s, Error **errp)
+{
+    object_property_set_bool(OBJECT(s), true, "opened", errp);
+}
+
+static void tpm_backend_prop_set_opened(Object *obj, bool value, Error **errp)
+{
+    TPMBackend *s = TPM_BACKEND(obj);
+    TPMBackendClass *k = TPM_BACKEND_GET_CLASS(s);
+    Error *local_err = NULL;
+
+    if (value == s->opened) {
+        return;
+    }
+
+    if (!value && s->opened) {
+        error_setg(errp, QERR_PERMISSION_DENIED);
+        return;
+    }
+
+    if (k->opened) {
+        k->opened(s, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+
+    s->opened = true;
+}
+
+static void tpm_backend_instance_init(Object *obj)
+{
+    object_property_add_bool(obj, "opened",
+                             tpm_backend_prop_get_opened,
+                             tpm_backend_prop_set_opened,
+                             NULL);
+}
+
+void tpm_backend_thread_deliver_request(TPMBackendThread *tbt)
+{
+   g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_PROCESS_CMD, NULL);
+}
+
+void tpm_backend_thread_create(TPMBackendThread *tbt,
+                               GFunc func, gpointer user_data)
+{
+    if (!tbt->pool) {
+        tbt->pool = g_thread_pool_new(func, user_data, 1, TRUE, NULL);
+        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_INIT, NULL);
+    }
+}
+
+void tpm_backend_thread_end(TPMBackendThread *tbt)
+{
+    if (tbt->pool) {
+        g_thread_pool_push(tbt->pool, (gpointer)TPM_BACKEND_CMD_END, NULL);
+        g_thread_pool_free(tbt->pool, FALSE, TRUE);
+        tbt->pool = NULL;
+    }
 }

 static const TypeInfo tpm_backend_info = {
    .name = TYPE_TPM_BACKEND,
    .parent = TYPE_OBJECT,
    .instance_size = sizeof(TPMBackend),
-    .instance_finalize = tpm_backend_instance_finalize,
+    .instance_init = tpm_backend_instance_init,
    .class_size = sizeof(TPMBackendClass),
    .abstract = true,
 };

-static const TypeInfo tpm_if_info = {
-    .name = TYPE_TPM_IF,
-    .parent = TYPE_INTERFACE,
-    .class_size = sizeof(TPMIfClass),
-};
-
 static void register_types(void)
 {
    type_register_static(&tpm_backend_info);
-    type_register_static(&tpm_if_info);
 }

 type_init(register_types);
--- a/balloon.c
+++ b/balloon.c
@@ -26,34 +26,27 @@

 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "qemu/atomic.h"
 #include "exec/cpu-common.h"
 #include "sysemu/kvm.h"
 #include "sysemu/balloon.h"
 #include "trace-root.h"
-#include "qapi/error.h"
-#include "qapi/qapi-commands-misc.h"
+#include "qmp-commands.h"
 #include "qapi/qmp/qerror.h"
+#include "qapi/qmp/qjson.h"

 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
 static void *balloon_opaque;
-static int balloon_inhibit_count;
+static bool balloon_inhibited;

 bool qemu_balloon_is_inhibited(void)
 {
-    return atomic_read(&balloon_inhibit_count) > 0;
+    return balloon_inhibited;
 }

 void qemu_balloon_inhibit(bool state)
 {
-    if (state) {
-        atomic_inc(&balloon_inhibit_count);
-    } else {
-        atomic_dec(&balloon_inhibit_count);
-    }
-
-    assert(atomic_read(&balloon_inhibit_count) >= 0);
+    balloon_inhibited = state;
 }

 static bool have_balloon(Error **errp)
--- a/block.c
+++ b/block.c
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -1,29 +1,18 @@
-block-obj-y += raw-format.o vmdk.o vpc.o
-block-obj-$(CONFIG_QCOW1) += qcow.o
-block-obj-$(CONFIG_VDI) += vdi.o
-block-obj-$(CONFIG_CLOOP) += cloop.o
-block-obj-$(CONFIG_BOCHS) += bochs.o
-block-obj-$(CONFIG_VVFAT) += vvfat.o
-block-obj-$(CONFIG_DMG) += dmg.o
-
+block-obj-y += raw-format.o qcow.o vdi.o vmdk.o cloop.o bochs.o vpc.o vvfat.o dmg.o
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o qcow2-bitmap.o
-block-obj-$(CONFIG_QED) += qed.o qed-l2-cache.o qed-table.o qed-cluster.o
-block-obj-$(CONFIG_QED) += qed-check.o
+block-obj-y += qed.o qed-l2-cache.o qed-table.o qed-cluster.o
+block-obj-y += qed-check.o
 block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += quorum.o
-block-obj-y += blkdebug.o blkverify.o blkreplay.o
-block-obj-$(CONFIG_PARALLELS) += parallels.o
-block-obj-y += blklogwrites.o
+block-obj-y += parallels.o blkdebug.o blkverify.o blkreplay.o
 block-obj-y += block-backend.o snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += file-win32.o win32-aio.o
 block-obj-$(CONFIG_POSIX) += file-posix.o
 block-obj-$(CONFIG_LINUX_AIO) += linux-aio.o
-block-obj-y += null.o mirror.o commit.o io.o create.o
+block-obj-y += null.o mirror.o commit.o io.o
 block-obj-y += throttle-groups.o
-block-obj-$(CONFIG_LINUX) += nvme.o

-block-obj-y += nbd.o nbd-client.o
-block-obj-$(CONFIG_SHEEPDOG) += sheepdog.o
+block-obj-y += nbd.o nbd-client.o sheepdog.o
 block-obj-$(CONFIG_LIBISCSI) += iscsi.o
 block-obj-$(if $(CONFIG_LIBISCSI),y,n) += iscsi-opts.o
 block-obj-$(CONFIG_LIBNFS) += nfs.o
@@ -36,7 +25,6 @@ block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
 block-obj-y += backup.o
 block-obj-$(CONFIG_REPLICATION) += replication.o
-block-obj-y += throttle.o copy-on-read.o

 block-obj-y += crypto.o

@@ -54,10 +42,7 @@ gluster.o-libs     := $(GLUSTERFS_LIBS)
 vxhs.o-libs        := $(VXHS_LIBS)
 ssh.o-cflags       := $(LIBSSH2_CFLAGS)
 ssh.o-libs         := $(LIBSSH2_LIBS)
-block-obj-dmg-bz2-$(CONFIG_BZIP2) += dmg-bz2.o
-block-obj-$(if $(CONFIG_DMG),m,n) += $(block-obj-dmg-bz2-y)
+block-obj-$(if $(CONFIG_BZIP2),m,n) += dmg-bz2.o
 dmg-bz2.o-libs     := $(BZIP2_LIBS)
 qcow.o-libs        := -lz
 linux-aio.o-libs   := -laio
-parallels.o-cflags := $(LIBXML2_CFLAGS)
-parallels.o-libs   := $(LIBXML2_LIBS)
--- a/block/accounting.c
+++ b/block/accounting.c
@@ -94,94 +94,6 @@ void block_acct_start(BlockAcctStats *stats, BlockAcctCookie *cookie,
    cookie->type = type;
 }

-/* block_latency_histogram_compare_func:
- * Compare @key with interval [@it[0], @it[1]).
- * Return: -1 if @key < @it[0]
- *          0 if @key in [@it[0], @it[1])
- *         +1 if @key >= @it[1]
- */
-static int block_latency_histogram_compare_func(const void *key, const void *it)
-{
-    uint64_t k = *(uint64_t *)key;
-    uint64_t a = ((uint64_t *)it)[0];
-    uint64_t b = ((uint64_t *)it)[1];
-
-    return k < a ? -1 : (k < b ? 0 : 1);
-}
-
-static void block_latency_histogram_account(BlockLatencyHistogram *hist,
-                                            int64_t latency_ns)
-{
-    uint64_t *pos;
-
-    if (hist->bins == NULL) {
-        /* histogram disabled */
-        return;
-    }
-
-
-    if (latency_ns < hist->boundaries[0]) {
-        hist->bins[0]++;
-        return;
-    }
-
-    if (latency_ns >= hist->boundaries[hist->nbins - 2]) {
-        hist->bins[hist->nbins - 1]++;
-        return;
-    }
-
-    pos = bsearch(&latency_ns, hist->boundaries, hist->nbins - 2,
-                  sizeof(hist->boundaries[0]),
-                  block_latency_histogram_compare_func);
-    assert(pos != NULL);
-
-    hist->bins[pos - hist->boundaries + 1]++;
-}
-
-int block_latency_histogram_set(BlockAcctStats *stats, enum BlockAcctType type,
-                                uint64List *boundaries)
-{
-    BlockLatencyHistogram *hist = &stats->latency_histogram[type];
-    uint64List *entry;
-    uint64_t *ptr;
-    uint64_t prev = 0;
-    int new_nbins = 1;
-
-    for (entry = boundaries; entry; entry = entry->next) {
-        if (entry->value <= prev) {
-            return -EINVAL;
-        }
-        new_nbins++;
-        prev = entry->value;
-    }
-
-    hist->nbins = new_nbins;
-    g_free(hist->boundaries);
-    hist->boundaries = g_new(uint64_t, hist->nbins - 1);
-    for (entry = boundaries, ptr = hist->boundaries; entry;
-         entry = entry->next, ptr++)
-    {
-        *ptr = entry->value;
-    }
-
-    g_free(hist->bins);
-    hist->bins = g_new0(uint64_t, hist->nbins);
-
-    return 0;
-}
-
-void block_latency_histograms_clear(BlockAcctStats *stats)
-{
-    int i;
-
-    for (i = 0; i < BLOCK_MAX_IOTYPE; i++) {
-        BlockLatencyHistogram *hist = &stats->latency_histogram[i];
-        g_free(hist->bins);
-        g_free(hist->boundaries);
-        memset(hist, 0, sizeof(*hist));
-    }
-}
-
 static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,
                                 bool failed)
 {
@@ -204,9 +116,6 @@ static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,
        stats->nr_ops[cookie->type]++;
    }

-    block_latency_histogram_account(&stats->latency_histogram[cookie->type],
-                                    latency_ns);
-
    if (!failed || stats->account_failed) {
        stats->total_time_ns[cookie->type] += latency_ns;
        stats->last_access_time_ns = time_ns;
--- a/block/backup.c
+++ b/block/backup.c
@@ -27,6 +27,7 @@
 #include "qemu/error-report.h"

 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)
+#define SLICE_TIME 100000000ULL /* ns */

 typedef struct BackupBlockJob {
    BlockJob common;
@@ -34,25 +35,18 @@ typedef struct BackupBlockJob {
    /* bitmap for sync=incremental */
    BdrvDirtyBitmap *sync_bitmap;
    MirrorSyncMode sync_mode;
+    RateLimit limit;
    BlockdevOnError on_source_error;
    BlockdevOnError on_target_error;
    CoRwlock flush_rwlock;
-    uint64_t len;
    uint64_t bytes_read;
+    unsigned long *done_bitmap;
    int64_t cluster_size;
    bool compress;
    NotifierWithReturn before_write;
    QLIST_HEAD(, CowRequest) inflight_reqs;
-
-    HBitmap *copy_bitmap;
-    bool use_copy_range;
-    int64_t copy_range_size;
-
-    bool serialize_target_writes;
 } BackupBlockJob;

-static const BlockJobDriver backup_job_driver;
-
 /* See if in-flight requests overlap and wait for them to complete */
 static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
                                                       int64_t start,
@@ -90,104 +84,19 @@ static void cow_request_end(CowRequest *req)
    qemu_co_queue_restart_all(&req->wait_queue);
 }

-/* Copy range to target with a bounce buffer and return the bytes copied. If
- * error occurred, return a negative error number */
-static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
-                                                      int64_t start,
-                                                      int64_t end,
-                                                      bool is_write_notifier,
-                                                      bool *error_is_read,
-                                                      void **bounce_buffer)
-{
-    int ret;
-    struct iovec iov;
-    QEMUIOVector qiov;
-    BlockBackend *blk = job->common.blk;
-    int nbytes;
-    int read_flags = is_write_notifier ? BDRV_REQ_NO_SERIALISING : 0;
-    int write_flags = job->serialize_target_writes ? BDRV_REQ_SERIALISING : 0;
-
-    hbitmap_reset(job->copy_bitmap, start / job->cluster_size, 1);
-    nbytes = MIN(job->cluster_size, job->len - start);
-    if (!*bounce_buffer) {
-        *bounce_buffer = blk_blockalign(blk, job->cluster_size);
-    }
-    iov.iov_base = *bounce_buffer;
-    iov.iov_len = nbytes;
-    qemu_iovec_init_external(&qiov, &iov, 1);
-
-    ret = blk_co_preadv(blk, start, qiov.size, &qiov, read_flags);
-    if (ret < 0) {
-        trace_backup_do_cow_read_fail(job, start, ret);
-        if (error_is_read) {
-            *error_is_read = true;
-        }
-        goto fail;
-    }
-
-    if (qemu_iovec_is_zero(&qiov)) {
-        ret = blk_co_pwrite_zeroes(job->target, start,
-                                   qiov.size, write_flags | BDRV_REQ_MAY_UNMAP);
-    } else {
-        ret = blk_co_pwritev(job->target, start,
-                             qiov.size, &qiov, write_flags |
-                             (job->compress ? BDRV_REQ_WRITE_COMPRESSED : 0));
-    }
-    if (ret < 0) {
-        trace_backup_do_cow_write_fail(job, start, ret);
-        if (error_is_read) {
-            *error_is_read = false;
-        }
-        goto fail;
-    }
-
-    return nbytes;
-fail:
-    hbitmap_set(job->copy_bitmap, start / job->cluster_size, 1);
-    return ret;
-
-}
-
-/* Copy range to target and return the bytes copied. If error occurred, return a
- * negative error number. */
-static int coroutine_fn backup_cow_with_offload(BackupBlockJob *job,
-                                                int64_t start,
-                                                int64_t end,
-                                                bool is_write_notifier)
-{
-    int ret;
-    int nr_clusters;
-    BlockBackend *blk = job->common.blk;
-    int nbytes;
-    int read_flags = is_write_notifier ? BDRV_REQ_NO_SERIALISING : 0;
-    int write_flags = job->serialize_target_writes ? BDRV_REQ_SERIALISING : 0;
-
-    assert(QEMU_IS_ALIGNED(job->copy_range_size, job->cluster_size));
-    nbytes = MIN(job->copy_range_size, end - start);
-    nr_clusters = DIV_ROUND_UP(nbytes, job->cluster_size);
-    hbitmap_reset(job->copy_bitmap, start / job->cluster_size,
-                  nr_clusters);
-    ret = blk_co_copy_range(blk, start, job->target, start, nbytes,
-                            read_flags, write_flags);
-    if (ret < 0) {
-        trace_backup_do_cow_copy_range_fail(job, start, ret);
-        hbitmap_set(job->copy_bitmap, start / job->cluster_size,
-                    nr_clusters);
-        return ret;
-    }
-
-    return nbytes;
-}
-
 static int coroutine_fn backup_do_cow(BackupBlockJob *job,
                                      int64_t offset, uint64_t bytes,
                                      bool *error_is_read,
                                      bool is_write_notifier)
 {
+    BlockBackend *blk = job->common.blk;
    CowRequest cow_request;
+    struct iovec iov;
+    QEMUIOVector bounce_qiov;
+    void *bounce_buffer = NULL;
    int ret = 0;
    int64_t start, end; /* bytes */
-    void *bounce_buffer = NULL;
+    int n; /* bytes */

    qemu_co_rwlock_rdlock(&job->flush_rwlock);

@@ -199,38 +108,59 @@ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
    wait_for_overlapping_requests(job, start, end);
    cow_request_begin(&cow_request, job, start, end);

-    while (start < end) {
-        if (!hbitmap_get(job->copy_bitmap, start / job->cluster_size)) {
+    for (; start < end; start += job->cluster_size) {
+        if (test_bit(start / job->cluster_size, job->done_bitmap)) {
            trace_backup_do_cow_skip(job, start);
-            start += job->cluster_size;
            continue; /* already copied */
        }

        trace_backup_do_cow_process(job, start);

-        if (job->use_copy_range) {
-            ret = backup_cow_with_offload(job, start, end, is_write_notifier);
-            if (ret < 0) {
-                job->use_copy_range = false;
-            }
+        n = MIN(job->cluster_size, job->common.len - start);
+
+        if (!bounce_buffer) {
+            bounce_buffer = blk_blockalign(blk, job->cluster_size);
        }
-        if (!job->use_copy_range) {
-            ret = backup_cow_with_bounce_buffer(job, start, end, is_write_notifier,
-                                                error_is_read, &bounce_buffer);
+        iov.iov_base = bounce_buffer;
+        iov.iov_len = n;
+        qemu_iovec_init_external(&bounce_qiov, &iov, 1);
+
+        ret = blk_co_preadv(blk, start, bounce_qiov.size, &bounce_qiov,
+                            is_write_notifier ? BDRV_REQ_NO_SERIALISING : 0);
+        if (ret < 0) {
+            trace_backup_do_cow_read_fail(job, start, ret);
+            if (error_is_read) {
+                *error_is_read = true;
+            }
+            goto out;
+        }
+
+        if (buffer_is_zero(iov.iov_base, iov.iov_len)) {
+            ret = blk_co_pwrite_zeroes(job->target, start,
+                                       bounce_qiov.size, BDRV_REQ_MAY_UNMAP);
+        } else {
+            ret = blk_co_pwritev(job->target, start,
+                                 bounce_qiov.size, &bounce_qiov,
+                                 job->compress ? BDRV_REQ_WRITE_COMPRESSED : 0);
        }
        if (ret < 0) {
-            break;
+            trace_backup_do_cow_write_fail(job, start, ret);
+            if (error_is_read) {
+                *error_is_read = false;
+            }
+            goto out;
        }

+        set_bit(start / job->cluster_size, job->done_bitmap);
+
        /* Publish progress, guest I/O counts as progress too.  Note that the
         * offset field is an opaque progress value, it is not a disk offset.
         */
-        start += ret;
-        job->bytes_read += ret;
-        job_progress_update(&job->common.job, ret);
-        ret = 0;
+        job->bytes_read += n;
+        job->common.offset += n;
    }

+out:
    if (bounce_buffer) {
        qemu_vfree(bounce_buffer);
    }
@@ -258,12 +188,23 @@ static int coroutine_fn backup_before_write_notify(
    return backup_do_cow(job, req->offset, req->bytes, NULL, true);
 }

+static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
+{
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
+
+    if (speed < 0) {
+        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
+        return;
+    }
+    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
+}
+
 static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
 {
    BdrvDirtyBitmap *bm;
    BlockDriverState *bs = blk_bs(job->common.blk);

-    if (ret < 0) {
+    if (ret < 0 || block_job_is_cancelled(&job->common)) {
        /* Merge the successor back into the parent, delete nothing. */
        bm = bdrv_reclaim_dirty_bitmap(bs, job->sync_bitmap, NULL);
        assert(bm);
@@ -274,25 +215,25 @@ static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
    }
 }

-static void backup_commit(Job *job)
+static void backup_commit(BlockJob *job)
 {
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    if (s->sync_bitmap) {
        backup_cleanup_sync_bitmap(s, 0);
    }
 }

-static void backup_abort(Job *job)
+static void backup_abort(BlockJob *job)
 {
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    if (s->sync_bitmap) {
        backup_cleanup_sync_bitmap(s, -1);
    }
 }

-static void backup_clean(Job *job)
+static void backup_clean(BlockJob *job)
 {
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    assert(s->target);
    blk_unref(s->target);
    s->target = NULL;
@@ -310,7 +251,7 @@ void backup_do_checkpoint(BlockJob *job, Error **errp)
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t len;

-    assert(block_job_driver(job) == &backup_job_driver);
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);

    if (backup_job->sync_mode != MIRROR_SYNC_MODE_NONE) {
        error_setg(errp, "The backup job only supports block checkpoint in"
@@ -318,8 +259,8 @@ void backup_do_checkpoint(BlockJob *job, Error **errp)
        return;
    }

-    len = DIV_ROUND_UP(backup_job->len, backup_job->cluster_size);
-    hbitmap_set(backup_job->copy_bitmap, 0, len);
+    len = DIV_ROUND_UP(backup_job->common.len, backup_job->cluster_size);
+    bitmap_zero(backup_job->done_bitmap, len);
 }

 void backup_wait_for_overlapping_requests(BlockJob *job, int64_t offset,
@@ -328,7 +269,7 @@ void backup_wait_for_overlapping_requests(BlockJob *job, int64_t offset,
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t start, end;

-    assert(block_job_driver(job) == &backup_job_driver);
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);

    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
@@ -341,7 +282,7 @@ void backup_cow_request_begin(CowRequest *req, BlockJob *job,
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
    int64_t start, end;

-    assert(block_job_driver(job) == &backup_job_driver);
+    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);

    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
@@ -380,21 +321,37 @@ static BlockErrorAction backup_error_action(BackupBlockJob *job,
    }
 }

+typedef struct {
+    int ret;
+} BackupCompleteData;
+
+static void backup_complete(BlockJob *job, void *opaque)
+{
+    BackupCompleteData *data = opaque;
+
+    block_job_completed(job, data->ret);
+    g_free(data);
+}
+
 static bool coroutine_fn yield_and_check(BackupBlockJob *job)
 {
-    uint64_t delay_ns;
-
-    if (job_is_cancelled(&job->common.job)) {
+    if (block_job_is_cancelled(&job->common)) {
        return true;
    }

-    /* We need to yield even for delay_ns = 0 so that bdrv_drain_all() can
-     * return. Without a yield, the VM would not reboot. */
-    delay_ns = block_job_ratelimit_get_delay(&job->common, job->bytes_read);
-    job->bytes_read = 0;
-    job_sleep_ns(&job->common.job, delay_ns);
+    /* we need to yield so that bdrv_drain_all() returns.
+     * (without, VM does not reboot)
+     */
+    if (job->common.speed) {
+        uint64_t delay_ns = ratelimit_calculate_delay(&job->limit,
+                                                      job->bytes_read);
+        job->bytes_read = 0;
+        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, delay_ns);
+    } else {
+        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, 0);
+    }

-    if (job_is_cancelled(&job->common.job)) {
+    if (block_job_is_cancelled(&job->common)) {
        return true;
    }

@@ -403,124 +360,111 @@ static bool coroutine_fn yield_and_check(BackupBlockJob *job)

 static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
 {
-    int ret;
    bool error_is_read;
-    int64_t cluster;
-    HBitmapIter hbi;
-
-    hbitmap_iter_init(&hbi, job->copy_bitmap, 0);
-    while ((cluster = hbitmap_iter_next(&hbi, true)) != -1) {
-        do {
-            if (yield_and_check(job)) {
-                return 0;
-            }
-            ret = backup_do_cow(job, cluster * job->cluster_size,
-                                job->cluster_size, &error_is_read, false);
-            if (ret < 0 && backup_error_action(job, error_is_read, -ret) ==
-                           BLOCK_ERROR_ACTION_REPORT)
-            {
-                return ret;
-            }
-        } while (ret < 0);
-    }
-
-    return 0;
-}
-
-/* init copy_bitmap from sync_bitmap */
-static void backup_incremental_init_copy_bitmap(BackupBlockJob *job)
-{
-    BdrvDirtyBitmapIter *dbi;
+    int ret = 0;
+    int clusters_per_iter;
+    uint32_t granularity;
    int64_t offset;
-    int64_t end = DIV_ROUND_UP(bdrv_dirty_bitmap_size(job->sync_bitmap),
-                               job->cluster_size);
+    int64_t cluster;
+    int64_t end;
+    int64_t last_cluster = -1;
+    BdrvDirtyBitmapIter *dbi;

-    dbi = bdrv_dirty_iter_new(job->sync_bitmap);
-    while ((offset = bdrv_dirty_iter_next(dbi)) != -1) {
-        int64_t cluster = offset / job->cluster_size;
-        int64_t next_cluster;
+    granularity = bdrv_dirty_bitmap_granularity(job->sync_bitmap);
+    clusters_per_iter = MAX((granularity / job->cluster_size), 1);
+    dbi = bdrv_dirty_iter_new(job->sync_bitmap, 0);

-        offset += bdrv_dirty_bitmap_granularity(job->sync_bitmap);
-        if (offset >= bdrv_dirty_bitmap_size(job->sync_bitmap)) {
-            hbitmap_set(job->copy_bitmap, cluster, end - cluster);
-            break;
+    /* Find the next dirty sector(s) */
+    while ((offset = bdrv_dirty_iter_next(dbi) * BDRV_SECTOR_SIZE) >= 0) {
+        cluster = offset / job->cluster_size;
+
+        /* Fake progress updates for any clusters we skipped */
+        if (cluster != last_cluster + 1) {
+            job->common.offset += ((cluster - last_cluster - 1) *
+                                   job->cluster_size);
        }

-        offset = bdrv_dirty_bitmap_next_zero(job->sync_bitmap, offset);
-        if (offset == -1) {
-            hbitmap_set(job->copy_bitmap, cluster, end - cluster);
-            break;
+        for (end = cluster + clusters_per_iter; cluster < end; cluster++) {
+            do {
+                if (yield_and_check(job)) {
+                    goto out;
+                }
+                ret = backup_do_cow(job, cluster * job->cluster_size,
+                                    job->cluster_size, &error_is_read,
+                                    false);
+                if ((ret < 0) &&
+                    backup_error_action(job, error_is_read, -ret) ==
+                    BLOCK_ERROR_ACTION_REPORT) {
+                    goto out;
+                }
+            } while (ret < 0);
        }

-        next_cluster = DIV_ROUND_UP(offset, job->cluster_size);
-        hbitmap_set(job->copy_bitmap, cluster, next_cluster - cluster);
-        if (next_cluster >= end) {
-            break;
+        /* If the bitmap granularity is smaller than the backup granularity,
+         * we need to advance the iterator pointer to the next cluster. */
+        if (granularity < job->cluster_size) {
+            bdrv_set_dirty_iter(dbi,
+                                cluster * job->cluster_size / BDRV_SECTOR_SIZE);
        }

-        bdrv_set_dirty_iter(dbi, next_cluster * job->cluster_size);
+        last_cluster = cluster - 1;
    }

-    /* TODO job_progress_set_remaining() would make more sense */
-    job_progress_update(&job->common.job,
-        job->len - hbitmap_count(job->copy_bitmap) * job->cluster_size);
+    /* Play some final catchup with the progress meter */
+    end = DIV_ROUND_UP(job->common.len, job->cluster_size);
+    if (last_cluster + 1 < end) {
+        job->common.offset += ((end - last_cluster - 1) * job->cluster_size);
+    }

+out:
    bdrv_dirty_iter_free(dbi);
+    return ret;
 }

-static int coroutine_fn backup_run(Job *job, Error **errp)
+static void coroutine_fn backup_run(void *opaque)
 {
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
-    BlockDriverState *bs = blk_bs(s->common.blk);
-    int64_t offset, nb_clusters;
+    BackupBlockJob *job = opaque;
+    BackupCompleteData *data;
+    BlockDriverState *bs = blk_bs(job->common.blk);
+    int64_t offset;
    int ret = 0;

-    QLIST_INIT(&s->inflight_reqs);
-    qemu_co_rwlock_init(&s->flush_rwlock);
+    QLIST_INIT(&job->inflight_reqs);
+    qemu_co_rwlock_init(&job->flush_rwlock);

-    nb_clusters = DIV_ROUND_UP(s->len, s->cluster_size);
-    job_progress_set_remaining(job, s->len);
+    job->done_bitmap = bitmap_new(DIV_ROUND_UP(job->common.len,
+                                               job->cluster_size));

-    s->copy_bitmap = hbitmap_alloc(nb_clusters, 0);
-    if (s->sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
-        backup_incremental_init_copy_bitmap(s);
-    } else {
-        hbitmap_set(s->copy_bitmap, 0, nb_clusters);
-    }
+    job->before_write.notify = backup_before_write_notify;
+    bdrv_add_before_write_notifier(bs, &job->before_write);

-
-    s->before_write.notify = backup_before_write_notify;
-    bdrv_add_before_write_notifier(bs, &s->before_write);
-
-    if (s->sync_mode == MIRROR_SYNC_MODE_NONE) {
-        /* All bits are set in copy_bitmap to allow any cluster to be copied.
-         * This does not actually require them to be copied. */
-        while (!job_is_cancelled(job)) {
+    if (job->sync_mode == MIRROR_SYNC_MODE_NONE) {
+        while (!block_job_is_cancelled(&job->common)) {
            /* Yield until the job is cancelled.  We just let our before_write
             * notify callback service CoW requests. */
-            job_yield(job);
+            block_job_yield(&job->common);
        }
-    } else if (s->sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
-        ret = backup_run_incremental(s);
+    } else if (job->sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
+        ret = backup_run_incremental(job);
    } else {
        /* Both FULL and TOP SYNC_MODE's require copying.. */
-        for (offset = 0; offset < s->len;
-             offset += s->cluster_size) {
+        for (offset = 0; offset < job->common.len;
+             offset += job->cluster_size) {
            bool error_is_read;
            int alloced = 0;

-            if (yield_and_check(s)) {
+            if (yield_and_check(job)) {
                break;
            }

-            if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
+            if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
                int i;
                int64_t n;

                /* Check to see if these blocks are already in the
                 * backing file. */

-                for (i = 0; i < s->cluster_size;) {
+                for (i = 0; i < job->cluster_size;) {
                    /* bdrv_is_allocated() only returns true/false based
                     * on the first set of sectors it comes across that
                     * are are all in the same state.
@@ -529,7 +473,7 @@ static int coroutine_fn backup_run(Job *job, Error **errp)
                     * needed but at some point that is always the case. */
                    alloced =
                        bdrv_is_allocated(bs, offset + i,
-                                          s->cluster_size - i, &n);
+                                          job->cluster_size - i, &n);
                    i += n;

                    if (alloced || n == 0) {
@@ -547,45 +491,43 @@ static int coroutine_fn backup_run(Job *job, Error **errp)
            if (alloced < 0) {
                ret = alloced;
            } else {
-                ret = backup_do_cow(s, offset, s->cluster_size,
+                ret = backup_do_cow(job, offset, job->cluster_size,
                                    &error_is_read, false);
            }
            if (ret < 0) {
                /* Depending on error action, fail now or retry cluster */
                BlockErrorAction action =
-                    backup_error_action(s, error_is_read, -ret);
+                    backup_error_action(job, error_is_read, -ret);
                if (action == BLOCK_ERROR_ACTION_REPORT) {
                    break;
                } else {
-                    offset -= s->cluster_size;
+                    offset -= job->cluster_size;
                    continue;
                }
            }
        }
    }

-    notifier_with_return_remove(&s->before_write);
+    notifier_with_return_remove(&job->before_write);

    /* wait until pending backup_do_cow() calls have completed */
-    qemu_co_rwlock_wrlock(&s->flush_rwlock);
-    qemu_co_rwlock_unlock(&s->flush_rwlock);
-    hbitmap_free(s->copy_bitmap);
+    qemu_co_rwlock_wrlock(&job->flush_rwlock);
+    qemu_co_rwlock_unlock(&job->flush_rwlock);
+    g_free(job->done_bitmap);

-    return ret;
+    data = g_malloc(sizeof(*data));
+    data->ret = ret;
+    block_job_defer_to_main_loop(&job->common, backup_complete, data);
 }

 static const BlockJobDriver backup_job_driver = {
-    .job_driver = {
-        .instance_size          = sizeof(BackupBlockJob),
-        .job_type               = JOB_TYPE_BACKUP,
-        .free                   = block_job_free,
-        .user_resume            = block_job_user_resume,
-        .drain                  = block_job_drain,
-        .run                    = backup_run,
-        .commit                 = backup_commit,
-        .abort                  = backup_abort,
-        .clean                  = backup_clean,
-    },
+    .instance_size          = sizeof(BackupBlockJob),
+    .job_type               = BLOCK_JOB_TYPE_BACKUP,
+    .start                  = backup_run,
+    .set_speed              = backup_set_speed,
+    .commit                 = backup_commit,
+    .abort                  = backup_abort,
+    .clean                  = backup_clean,
    .attached_aio_context   = backup_attached_aio_context,
    .drain                  = backup_drain,
 };
@@ -598,7 +540,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                  BlockdevOnError on_target_error,
                  int creation_flags,
                  BlockCompletionFunc *cb, void *opaque,
-                  JobTxn *txn, Error **errp)
+                  BlockJobTxn *txn, Error **errp)
 {
    int64_t len;
    BlockDriverInfo bdi;
@@ -654,7 +596,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
        error_setg(errp,
                   "a sync_bitmap was provided to backup_run, "
                   "but received an incompatible sync_mode (%s)",
-                   MirrorSyncMode_str(sync_mode));
+                   MirrorSyncMode_lookup[sync_mode]);
        return NULL;
    }

@@ -665,8 +607,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
        goto error;
    }

-    /* job->len is fixed, so we can't allow resize */
-    job = block_job_create(job_id, &backup_job_driver, txn, bs,
+    /* job->common.len is fixed, so we can't allow resize */
+    job = block_job_create(job_id, &backup_job_driver, bs,
                           BLK_PERM_CONSISTENT_READ,
                           BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE |
                           BLK_PERM_WRITE_UNCHANGED | BLK_PERM_GRAPH_MOD,
@@ -691,9 +633,6 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                       sync_bitmap : NULL;
    job->compress = compress;

-    /* Detect image-fleecing (and similar) schemes */
-    job->serialize_target_writes = bdrv_chain_contains(target, bs);
-
    /* If there is no backing file on the target, we cannot rely on COW if our
     * backup cluster size is smaller than the target cluster size. Even for
     * targets with a backing file, try to avoid COW if possible. */
@@ -720,17 +659,12 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
    } else {
        job->cluster_size = MAX(BACKUP_CLUSTER_SIZE_DEFAULT, bdi.cluster_size);
    }
-    job->use_copy_range = true;
-    job->copy_range_size = MIN_NON_ZERO(blk_get_max_transfer(job->common.blk),
-                                        blk_get_max_transfer(job->target));
-    job->copy_range_size = MAX(job->cluster_size,
-                               QEMU_ALIGN_UP(job->copy_range_size,
-                                             job->cluster_size));

    /* Required permissions are already taken with target's blk_new() */
    block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                       &error_abort);
-    job->len = len;
+    job->common.len = len;
+    block_job_txn_add_job(txn, &job->common);

    return &job->common;

@@ -739,8 +673,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
        bdrv_reclaim_dirty_bitmap(bs, sync_bitmap, NULL);
    }
    if (job) {
-        backup_clean(&job->common.job);
-        job_early_fail(&job->common.job);
+        backup_clean(&job->common);
+        block_job_early_fail(&job->common);
    }

    return NULL;
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -29,7 +29,7 @@
 #include "qemu/config-file.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
-#include "qemu/option.h"
+#include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
 #include "sysemu/qtest.h"
@@ -149,6 +149,20 @@ static QemuOptsList *config_groups[] = {
    NULL
 };

+static int get_event_by_name(const char *name, BlkdebugEvent *event)
+{
+    int i;
+
+    for (i = 0; i < BLKDBG__MAX; i++) {
+        if (!strcmp(BlkdebugEvent_lookup[i], name)) {
+            *event = i;
+            return 0;
+        }
+    }
+
+    return -1;
+}
+
 struct add_rule_data {
    BDRVBlkdebugState *s;
    int action;
@@ -159,7 +173,7 @@ static int add_rule(void *opaque, QemuOpts *opts, Error **errp)
    struct add_rule_data *d = opaque;
    BDRVBlkdebugState *s = d->s;
    const char* event_name;
-    int event;
+    BlkdebugEvent event;
    struct BlkdebugRule *rule;
    int64_t sector;

@@ -168,9 +182,8 @@ static int add_rule(void *opaque, QemuOpts *opts, Error **errp)
    if (!event_name) {
        error_setg(errp, "Missing event name for rule");
        return -1;
-    }
-    event = qapi_enum_parse(&BlkdebugEvent_lookup, event_name, -1, errp);
-    if (event < 0) {
+    } else if (get_event_by_name(event_name, &event) < 0) {
+        error_setg(errp, "Invalid event name \"%s\"", event_name);
        return -1;
    }

@@ -244,6 +257,7 @@ static int read_config(BDRVBlkdebugState *s, const char *filename,
        ret = qemu_config_parse(f, config_groups, filename);
        if (ret < 0) {
            error_setg(errp, "Could not parse blkdebug config file");
+            ret = -EINVAL;
            goto fail;
        }
    }
@@ -305,7 +319,7 @@ static void blkdebug_parse_filename(const char *filename, QDict *options,

    if (c != filename) {
        QString *config_path;
-        config_path = qstring_from_substr(filename, 0, c - filename);
+        config_path = qstring_from_substr(filename, 0, c - filename - 1);
        qdict_put(options, "config", config_path);
    }

@@ -398,11 +412,10 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
        goto out;
    }

-    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
-        (BDRV_REQ_FUA & bs->file->bs->supported_write_flags);
-    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
-        ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP) &
-            bs->file->bs->supported_zero_flags);
+    bs->supported_write_flags = BDRV_REQ_FUA &
+        bs->file->bs->supported_write_flags;
+    bs->supported_zero_flags = (BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP) &
+        bs->file->bs->supported_zero_flags;
    ret = -EINVAL;

    /* Set alignment overrides */
@@ -625,20 +638,17 @@ static int coroutine_fn blkdebug_co_pdiscard(BlockDriverState *bs,
        return err;
    }

-    return bdrv_co_pdiscard(bs->file, offset, bytes);
+    return bdrv_co_pdiscard(bs->file->bs, offset, bytes);
 }

-static int coroutine_fn blkdebug_co_block_status(BlockDriverState *bs,
-                                                 bool want_zero,
-                                                 int64_t offset,
-                                                 int64_t bytes,
-                                                 int64_t *pnum,
-                                                 int64_t *map,
-                                                 BlockDriverState **file)
+static int64_t coroutine_fn blkdebug_co_get_block_status(
+    BlockDriverState *bs, int64_t sector_num, int nb_sectors, int *pnum,
+    BlockDriverState **file)
 {
-    assert(QEMU_IS_ALIGNED(offset | bytes, bs->bl.request_alignment));
-    return bdrv_co_block_status_from_file(bs, want_zero, offset, bytes,
-                                          pnum, map, file);
+    *pnum = nb_sectors;
+    *file = bs->file->bs;
+    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+        (sector_num << BDRV_SECTOR_BITS);
 }

 static void blkdebug_close(BlockDriverState *bs)
@@ -733,13 +743,13 @@ static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
 {
    BDRVBlkdebugState *s = bs->opaque;
    struct BlkdebugRule *rule;
-    int blkdebug_event;
+    BlkdebugEvent blkdebug_event;

-    blkdebug_event = qapi_enum_parse(&BlkdebugEvent_lookup, event, -1, NULL);
-    if (blkdebug_event < 0) {
+    if (get_event_by_name(event, &blkdebug_event) < 0) {
        return -ENOENT;
    }

+
    rule = g_malloc(sizeof(*rule));
    *rule = (struct BlkdebugRule) {
        .event  = blkdebug_event,
@@ -811,6 +821,12 @@ static int64_t blkdebug_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

+static int blkdebug_truncate(BlockDriverState *bs, int64_t offset,
+                             PreallocMode prealloc, Error **errp)
+{
+    return bdrv_truncate(bs->file, offset, prealloc, errp);
+}
+
 static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkdebugState *s = bs->opaque;
@@ -846,12 +862,13 @@ static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
    opts = qdict_new();
    qdict_put_str(opts, "driver", "blkdebug");

-    qdict_put(opts, "image", qobject_ref(bs->file->bs->full_open_options));
+    QINCREF(bs->file->bs->full_open_options);
+    qdict_put(opts, "image", bs->file->bs->full_open_options);

    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
        if (strcmp(qdict_entry_key(e), "x-image")) {
-            qdict_put_obj(opts, qdict_entry_key(e),
-                          qobject_ref(qdict_entry_value(e)));
+            qobject_incref(qdict_entry_value(e));
+            qdict_put_obj(opts, qdict_entry_key(e), qdict_entry_value(e));
        }
    }

@@ -892,7 +909,6 @@ static BlockDriver bdrv_blkdebug = {
    .format_name            = "blkdebug",
    .protocol_name          = "blkdebug",
    .instance_size          = sizeof(BDRVBlkdebugState),
-    .is_filter              = true,

    .bdrv_parse_filename    = blkdebug_parse_filename,
    .bdrv_file_open         = blkdebug_open,
@@ -901,6 +917,7 @@ static BlockDriver bdrv_blkdebug = {
    .bdrv_child_perm        = bdrv_filter_default_perms,

    .bdrv_getlength         = blkdebug_getlength,
+    .bdrv_truncate          = blkdebug_truncate,
    .bdrv_refresh_filename  = blkdebug_refresh_filename,
    .bdrv_refresh_limits    = blkdebug_refresh_limits,

@@ -909,7 +926,7 @@ static BlockDriver bdrv_blkdebug = {
    .bdrv_co_flush_to_disk  = blkdebug_co_flush,
    .bdrv_co_pwrite_zeroes  = blkdebug_co_pwrite_zeroes,
    .bdrv_co_pdiscard       = blkdebug_co_pdiscard,
-    .bdrv_co_block_status   = blkdebug_co_block_status,
+    .bdrv_co_get_block_status = blkdebug_co_get_block_status,

    .bdrv_debug_event           = blkdebug_debug_event,
    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -1,550 +0,0 @@
-/*
- * Write logging blk driver based on blkverify and blkdebug.
- *
- * Copyright (c) 2017 Tuomas Tynkkynen <tuomas@tuxera.com>
- * Copyright (c) 2018 Aapo Vienamo <aapo@tuxera.com>
- * Copyright (c) 2018 Ari Sundholm <ari@tuxera.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
-#include "block/block_int.h"
-#include "qapi/qmp/qdict.h"
-#include "qapi/qmp/qstring.h"
-#include "qemu/cutils.h"
-#include "qemu/option.h"
-
-/* Disk format stuff - taken from Linux drivers/md/dm-log-writes.c */
-
-#define LOG_FLUSH_FLAG   (1 << 0)
-#define LOG_FUA_FLAG     (1 << 1)
-#define LOG_DISCARD_FLAG (1 << 2)
-#define LOG_MARK_FLAG    (1 << 3)
-#define LOG_FLAG_MASK    (LOG_FLUSH_FLAG \
-                         | LOG_FUA_FLAG \
-                         | LOG_DISCARD_FLAG \
-                         | LOG_MARK_FLAG)
-
-#define WRITE_LOG_VERSION 1ULL
-#define WRITE_LOG_MAGIC 0x6a736677736872ULL
-
-/* All fields are little-endian. */
-struct log_write_super {
-    uint64_t magic;
-    uint64_t version;
-    uint64_t nr_entries;
-    uint32_t sectorsize;
-} QEMU_PACKED;
-
-struct log_write_entry {
-    uint64_t sector;
-    uint64_t nr_sectors;
-    uint64_t flags;
-    uint64_t data_len;
-} QEMU_PACKED;
-
-/* End of disk format structures. */
-
-typedef struct {
-    BdrvChild *log_file;
-    uint32_t sectorsize;
-    uint32_t sectorbits;
-    uint64_t cur_log_sector;
-    uint64_t nr_entries;
-    uint64_t update_interval;
-} BDRVBlkLogWritesState;
-
-static QemuOptsList runtime_opts = {
-    .name = "blklogwrites",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = "log-append",
-            .type = QEMU_OPT_BOOL,
-            .help = "Append to an existing log",
-        },
-        {
-            .name = "log-sector-size",
-            .type = QEMU_OPT_SIZE,
-            .help = "Log sector size",
-        },
-        {
-            .name = "log-super-update-interval",
-            .type = QEMU_OPT_NUMBER,
-            .help = "Log superblock update interval (# of write requests)",
-        },
-        { /* end of list */ }
-    },
-};
-
-static inline uint32_t blk_log_writes_log2(uint32_t value)
-{
-    assert(value > 0);
-    return 31 - clz32(value);
-}
-
-static inline bool blk_log_writes_sector_size_valid(uint32_t sector_size)
-{
-    return is_power_of_2(sector_size) &&
-        sector_size >= sizeof(struct log_write_super) &&
-        sector_size >= sizeof(struct log_write_entry) &&
-        sector_size < (1ull << 24);
-}
-
-static uint64_t blk_log_writes_find_cur_log_sector(BdrvChild *log,
-                                                   uint32_t sector_size,
-                                                   uint64_t nr_entries,
-                                                   Error **errp)
-{
-    uint64_t cur_sector = 1;
-    uint64_t cur_idx = 0;
-    uint32_t sector_bits = blk_log_writes_log2(sector_size);
-    struct log_write_entry cur_entry;
-
-    while (cur_idx < nr_entries) {
-        int read_ret = bdrv_pread(log, cur_sector << sector_bits, &cur_entry,
-                                  sizeof(cur_entry));
-        if (read_ret < 0) {
-            error_setg_errno(errp, -read_ret,
-                             "Failed to read log entry %"PRIu64, cur_idx);
-            return (uint64_t)-1ull;
-        }
-
-        if (cur_entry.flags & ~cpu_to_le64(LOG_FLAG_MASK)) {
-            error_setg(errp, "Invalid flags 0x%"PRIx64" in log entry %"PRIu64,
-                       le64_to_cpu(cur_entry.flags), cur_idx);
-            return (uint64_t)-1ull;
-        }
-
-        /* Account for the sector of the entry itself */
-        ++cur_sector;
-
-        /*
-         * Account for the data of the write.
-         * For discards, this data is not present.
-         */
-        if (!(cur_entry.flags & cpu_to_le64(LOG_DISCARD_FLAG))) {
-            cur_sector += le64_to_cpu(cur_entry.nr_sectors);
-        }
-
-        ++cur_idx;
-    }
-
-    return cur_sector;
-}
-
-static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
-                               Error **errp)
-{
-    BDRVBlkLogWritesState *s = bs->opaque;
-    QemuOpts *opts;
-    Error *local_err = NULL;
-    int ret;
-    uint64_t log_sector_size;
-    bool log_append;
-
-    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
-        ret = -EINVAL;
-        error_propagate(errp, local_err);
-        goto fail;
-    }
-
-    /* Open the file */
-    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, false,
-                               &local_err);
-    if (local_err) {
-        ret = -EINVAL;
-        error_propagate(errp, local_err);
-        goto fail;
-    }
-
-    /* Open the log file */
-    s->log_file = bdrv_open_child(NULL, options, "log", bs, &child_file, false,
-                                  &local_err);
-    if (local_err) {
-        ret = -EINVAL;
-        error_propagate(errp, local_err);
-        goto fail;
-    }
-
-    log_append = qemu_opt_get_bool(opts, "log-append", false);
-
-    if (log_append) {
-        struct log_write_super log_sb = { 0, 0, 0, 0 };
-
-        if (qemu_opt_find(opts, "log-sector-size")) {
-            ret = -EINVAL;
-            error_setg(errp, "log-append and log-sector-size are mutually "
-                       "exclusive");
-            goto fail_log;
-        }
-
-        /* Read log superblock or fake one for an empty log */
-        if (!bdrv_getlength(s->log_file->bs)) {
-            log_sb.magic      = cpu_to_le64(WRITE_LOG_MAGIC);
-            log_sb.version    = cpu_to_le64(WRITE_LOG_VERSION);
-            log_sb.nr_entries = cpu_to_le64(0);
-            log_sb.sectorsize = cpu_to_le32(BDRV_SECTOR_SIZE);
-        } else {
-            ret = bdrv_pread(s->log_file, 0, &log_sb, sizeof(log_sb));
-            if (ret < 0) {
-                error_setg_errno(errp, -ret, "Could not read log superblock");
-                goto fail_log;
-            }
-        }
-
-        if (log_sb.magic != cpu_to_le64(WRITE_LOG_MAGIC)) {
-            ret = -EINVAL;
-            error_setg(errp, "Invalid log superblock magic");
-            goto fail_log;
-        }
-
-        if (log_sb.version != cpu_to_le64(WRITE_LOG_VERSION)) {
-            ret = -EINVAL;
-            error_setg(errp, "Unsupported log version %"PRIu64,
-                       le64_to_cpu(log_sb.version));
-            goto fail_log;
-        }
-
-        log_sector_size = le32_to_cpu(log_sb.sectorsize);
-        s->cur_log_sector = 1;
-        s->nr_entries = 0;
-
-        if (blk_log_writes_sector_size_valid(log_sector_size)) {
-            s->cur_log_sector =
-                blk_log_writes_find_cur_log_sector(s->log_file, log_sector_size,
-                                    le64_to_cpu(log_sb.nr_entries), &local_err);
-            if (local_err) {
-                ret = -EINVAL;
-                error_propagate(errp, local_err);
-                goto fail_log;
-            }
-
-            s->nr_entries = le64_to_cpu(log_sb.nr_entries);
-        }
-    } else {
-        log_sector_size = qemu_opt_get_size(opts, "log-sector-size",
-                                            BDRV_SECTOR_SIZE);
-        s->cur_log_sector = 1;
-        s->nr_entries = 0;
-    }
-
-    if (!blk_log_writes_sector_size_valid(log_sector_size)) {
-        ret = -EINVAL;
-        error_setg(errp, "Invalid log sector size %"PRIu64, log_sector_size);
-        goto fail_log;
-    }
-
-    s->sectorsize = log_sector_size;
-    s->sectorbits = blk_log_writes_log2(log_sector_size);
-    s->update_interval = qemu_opt_get_number(opts, "log-super-update-interval",
-                                             4096);
-    if (!s->update_interval) {
-        ret = -EINVAL;
-        error_setg(errp, "Invalid log superblock update interval %"PRIu64,
-                   s->update_interval);
-        goto fail_log;
-    }
-
-    ret = 0;
-fail_log:
-    if (ret < 0) {
-        bdrv_unref_child(bs, s->log_file);
-        s->log_file = NULL;
-    }
-fail:
-    if (ret < 0) {
-        bdrv_unref_child(bs, bs->file);
-        bs->file = NULL;
-    }
-    qemu_opts_del(opts);
-    return ret;
-}
-
-static void blk_log_writes_close(BlockDriverState *bs)
-{
-    BDRVBlkLogWritesState *s = bs->opaque;
-
-    bdrv_unref_child(bs, s->log_file);
-    s->log_file = NULL;
-}
-
-static int64_t blk_log_writes_getlength(BlockDriverState *bs)
-{
-    return bdrv_getlength(bs->file->bs);
-}
-
-static void blk_log_writes_refresh_filename(BlockDriverState *bs,
-                                            QDict *options)
-{
-    BDRVBlkLogWritesState *s = bs->opaque;
-
-    /* bs->file->bs has already been refreshed */
-    bdrv_refresh_filename(s->log_file->bs);
-
-    if (bs->file->bs->full_open_options
-        && s->log_file->bs->full_open_options)
-    {
-        QDict *opts = qdict_new();
-        qdict_put_str(opts, "driver", "blklogwrites");
-
-        qobject_ref(bs->file->bs->full_open_options);
-        qdict_put_obj(opts, "file", QOBJECT(bs->file->bs->full_open_options));
-        qobject_ref(s->log_file->bs->full_open_options);
-        qdict_put_obj(opts, "log",
-                      QOBJECT(s->log_file->bs->full_open_options));
-        qdict_put_int(opts, "log-sector-size", s->sectorsize);
-
-        bs->full_open_options = opts;
-    }
-}
-
-static void blk_log_writes_child_perm(BlockDriverState *bs, BdrvChild *c,
-                                      const BdrvChildRole *role,
-                                      BlockReopenQueue *ro_q,
-                                      uint64_t perm, uint64_t shrd,
-                                      uint64_t *nperm, uint64_t *nshrd)
-{
-    if (!c) {
-        *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
-        *nshrd = (shrd & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
-        return;
-    }
-
-    if (!strcmp(c->name, "log")) {
-        bdrv_format_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
-    } else {
-        bdrv_filter_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
-    }
-}
-
-static void blk_log_writes_refresh_limits(BlockDriverState *bs, Error **errp)
-{
-    BDRVBlkLogWritesState *s = bs->opaque;
-    bs->bl.request_alignment = s->sectorsize;
-}
-
-static int coroutine_fn
-blk_log_writes_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
-                         QEMUIOVector *qiov, int flags)
-{
-    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
-}
-
-typedef struct BlkLogWritesFileReq {
-    BlockDriverState *bs;
-    uint64_t offset;
-    uint64_t bytes;
-    int file_flags;
-    QEMUIOVector *qiov;
-    int (*func)(struct BlkLogWritesFileReq *r);
-    int file_ret;
-} BlkLogWritesFileReq;
-
-typedef struct {
-    BlockDriverState *bs;
-    QEMUIOVector *qiov;
-    struct log_write_entry entry;
-    uint64_t zero_size;
-    int log_ret;
-} BlkLogWritesLogReq;
-
-static void coroutine_fn blk_log_writes_co_do_log(BlkLogWritesLogReq *lr)
-{
-    BDRVBlkLogWritesState *s = lr->bs->opaque;
-    uint64_t cur_log_offset = s->cur_log_sector << s->sectorbits;
-
-    s->nr_entries++;
-    s->cur_log_sector +=
-            ROUND_UP(lr->qiov->size, s->sectorsize) >> s->sectorbits;
-
-    lr->log_ret = bdrv_co_pwritev(s->log_file, cur_log_offset, lr->qiov->size,
-                                  lr->qiov, 0);
-
-    /* Logging for the "write zeroes" operation */
-    if (lr->log_ret == 0 && lr->zero_size) {
-        cur_log_offset = s->cur_log_sector << s->sectorbits;
-        s->cur_log_sector +=
-                ROUND_UP(lr->zero_size, s->sectorsize) >> s->sectorbits;
-
-        lr->log_ret = bdrv_co_pwrite_zeroes(s->log_file, cur_log_offset,
-                                            lr->zero_size, 0);
-    }
-
-    /* Update super block on flush or every update interval */
-    if (lr->log_ret == 0 && ((lr->entry.flags & LOG_FLUSH_FLAG)
-        || (s->nr_entries % s->update_interval == 0)))
-    {
-        struct log_write_super super = {
-            .magic      = cpu_to_le64(WRITE_LOG_MAGIC),
-            .version    = cpu_to_le64(WRITE_LOG_VERSION),
-            .nr_entries = cpu_to_le64(s->nr_entries),
-            .sectorsize = cpu_to_le32(s->sectorsize),
-        };
-        void *zeroes = g_malloc0(s->sectorsize - sizeof(super));
-        QEMUIOVector qiov;
-
-        qemu_iovec_init(&qiov, 2);
-        qemu_iovec_add(&qiov, &super, sizeof(super));
-        qemu_iovec_add(&qiov, zeroes, s->sectorsize - sizeof(super));
-
-        lr->log_ret =
-            bdrv_co_pwritev(s->log_file, 0, s->sectorsize, &qiov, 0);
-        if (lr->log_ret == 0) {
-            lr->log_ret = bdrv_co_flush(s->log_file->bs);
-        }
-        qemu_iovec_destroy(&qiov);
-        g_free(zeroes);
-    }
-}
-
-static void coroutine_fn blk_log_writes_co_do_file(BlkLogWritesFileReq *fr)
-{
-    fr->file_ret = fr->func(fr);
-}
-
-static int coroutine_fn
-blk_log_writes_co_log(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
-                      QEMUIOVector *qiov, int flags,
-                      int (*file_func)(BlkLogWritesFileReq *r),
-                      uint64_t entry_flags, bool is_zero_write)
-{
-    QEMUIOVector log_qiov;
-    size_t niov = qiov ? qiov->niov : 0;
-    BDRVBlkLogWritesState *s = bs->opaque;
-    BlkLogWritesFileReq fr = {
-        .bs         = bs,
-        .offset     = offset,
-        .bytes      = bytes,
-        .file_flags = flags,
-        .qiov       = qiov,
-        .func       = file_func,
-    };
-    BlkLogWritesLogReq lr = {
-        .bs             = bs,
-        .qiov           = &log_qiov,
-        .entry = {
-            .sector     = cpu_to_le64(offset >> s->sectorbits),
-            .nr_sectors = cpu_to_le64(bytes >> s->sectorbits),
-            .flags      = cpu_to_le64(entry_flags),
-            .data_len   = 0,
-        },
-        .zero_size = is_zero_write ? bytes : 0,
-    };
-    void *zeroes = g_malloc0(s->sectorsize - sizeof(lr.entry));
-
-    assert((1 << s->sectorbits) == s->sectorsize);
-    assert(bs->bl.request_alignment == s->sectorsize);
-    assert(QEMU_IS_ALIGNED(offset, bs->bl.request_alignment));
-    assert(QEMU_IS_ALIGNED(bytes, bs->bl.request_alignment));
-
-    qemu_iovec_init(&log_qiov, niov + 2);
-    qemu_iovec_add(&log_qiov, &lr.entry, sizeof(lr.entry));
-    qemu_iovec_add(&log_qiov, zeroes, s->sectorsize - sizeof(lr.entry));
-    if (qiov) {
-        qemu_iovec_concat(&log_qiov, qiov, 0, qiov->size);
-    }
-
-    blk_log_writes_co_do_file(&fr);
-    blk_log_writes_co_do_log(&lr);
-
-    qemu_iovec_destroy(&log_qiov);
-    g_free(zeroes);
-
-    if (lr.log_ret < 0) {
-        return lr.log_ret;
-    }
-
-    return fr.file_ret;
-}
-
-static int coroutine_fn
-blk_log_writes_co_do_file_pwritev(BlkLogWritesFileReq *fr)
-{
-    return bdrv_co_pwritev(fr->bs->file, fr->offset, fr->bytes,
-                           fr->qiov, fr->file_flags);
-}
-
-static int coroutine_fn
-blk_log_writes_co_do_file_pwrite_zeroes(BlkLogWritesFileReq *fr)
-{
-    return bdrv_co_pwrite_zeroes(fr->bs->file, fr->offset, fr->bytes,
-                                 fr->file_flags);
-}
-
-static int coroutine_fn blk_log_writes_co_do_file_flush(BlkLogWritesFileReq *fr)
-{
-    return bdrv_co_flush(fr->bs->file->bs);
-}
-
-static int coroutine_fn
-blk_log_writes_co_do_file_pdiscard(BlkLogWritesFileReq *fr)
-{
-    return bdrv_co_pdiscard(fr->bs->file, fr->offset, fr->bytes);
-}
-
-static int coroutine_fn
-blk_log_writes_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
-                          QEMUIOVector *qiov, int flags)
-{
-    return blk_log_writes_co_log(bs, offset, bytes, qiov, flags,
-                                 blk_log_writes_co_do_file_pwritev, 0, false);
-}
-
-static int coroutine_fn
-blk_log_writes_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int bytes,
-                                BdrvRequestFlags flags)
-{
-    return blk_log_writes_co_log(bs, offset, bytes, NULL, flags,
-                                 blk_log_writes_co_do_file_pwrite_zeroes, 0,
-                                 true);
-}
-
-static int coroutine_fn blk_log_writes_co_flush_to_disk(BlockDriverState *bs)
-{
-    return blk_log_writes_co_log(bs, 0, 0, NULL, 0,
-                                 blk_log_writes_co_do_file_flush,
-                                 LOG_FLUSH_FLAG, false);
-}
-
-static int coroutine_fn
-blk_log_writes_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
-{
-    return blk_log_writes_co_log(bs, offset, count, NULL, 0,
-                                 blk_log_writes_co_do_file_pdiscard,
-                                 LOG_DISCARD_FLAG, false);
-}
-
-static BlockDriver bdrv_blk_log_writes = {
-    .format_name            = "blklogwrites",
-    .instance_size          = sizeof(BDRVBlkLogWritesState),
-
-    .bdrv_open              = blk_log_writes_open,
-    .bdrv_close             = blk_log_writes_close,
-    .bdrv_getlength         = blk_log_writes_getlength,
-    .bdrv_refresh_filename  = blk_log_writes_refresh_filename,
-    .bdrv_child_perm        = blk_log_writes_child_perm,
-    .bdrv_refresh_limits    = blk_log_writes_refresh_limits,
-
-    .bdrv_co_preadv         = blk_log_writes_co_preadv,
-    .bdrv_co_pwritev        = blk_log_writes_co_pwritev,
-    .bdrv_co_pwrite_zeroes  = blk_log_writes_co_pwrite_zeroes,
-    .bdrv_co_flush_to_disk  = blk_log_writes_co_flush_to_disk,
-    .bdrv_co_pdiscard       = blk_log_writes_co_pdiscard,
-    .bdrv_co_block_status   = bdrv_co_block_status_from_file,
-
-    .is_filter              = true,
-};
-
-static void bdrv_blk_log_writes_init(void)
-{
-    bdrv_register(&bdrv_blk_log_writes);
-}
-
-block_init(bdrv_blk_log_writes_init);
--- a/block/blkreplay.c
+++ b/block/blkreplay.c
@@ -35,14 +35,15 @@ static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED;
-    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED;
-
    ret = 0;
 fail:
    return ret;
 }

+static void blkreplay_close(BlockDriverState *bs)
+{
+}
+
 static int64_t blkreplay_getlength(BlockDriverState *bs)
 {
    return bdrv_getlength(bs->file->bs);
@@ -109,7 +110,7 @@ static int coroutine_fn blkreplay_co_pdiscard(BlockDriverState *bs,
                                              int64_t offset, int bytes)
 {
    uint64_t reqid = blkreplay_next_id();
-    int ret = bdrv_co_pdiscard(bs->file, offset, bytes);
+    int ret = bdrv_co_pdiscard(bs->file->bs, offset, bytes);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();

@@ -128,9 +129,11 @@ static int coroutine_fn blkreplay_co_flush(BlockDriverState *bs)

 static BlockDriver bdrv_blkreplay = {
    .format_name            = "blkreplay",
+    .protocol_name          = "blkreplay",
    .instance_size          = 0,

-    .bdrv_open              = blkreplay_open,
+    .bdrv_file_open         = blkreplay_open,
+    .bdrv_close             = blkreplay_close,
    .bdrv_child_perm        = bdrv_filter_default_perms,
    .bdrv_getlength         = blkreplay_getlength,

--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -14,7 +14,6 @@
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
 #include "qemu/cutils.h"
-#include "qemu/option.h"

 typedef struct {
    BdrvChild *test_file;
@@ -80,7 +79,7 @@ static void blkverify_parse_filename(const char *filename, QDict *options,
    }

    /* TODO Implement option pass-through and set raw.filename here */
-    raw_path = qstring_from_substr(filename, 0, c - filename);
+    raw_path = qstring_from_substr(filename, 0, c - filename - 1);
    qdict_put(options, "x-raw", raw_path);

    /* TODO Allow multi-level nesting and set file.filename here */
@@ -141,9 +140,6 @@ static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED;
-    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED;
-
    ret = 0;
 fail:
    qemu_opts_del(opts);
@@ -294,10 +290,10 @@ static void blkverify_refresh_filename(BlockDriverState *bs, QDict *options)
        QDict *opts = qdict_new();
        qdict_put_str(opts, "driver", "blkverify");

-        qdict_put(opts, "raw",
-                  qobject_ref(bs->file->bs->full_open_options));
-        qdict_put(opts, "test",
-                  qobject_ref(s->test_file->bs->full_open_options));
+        QINCREF(bs->file->bs->full_open_options);
+        qdict_put(opts, "raw", bs->file->bs->full_open_options);
+        QINCREF(s->test_file->bs->full_open_options);
+        qdict_put(opts, "test", s->test_file->bs->full_open_options);

        bs->full_open_options = opts;
    }
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -17,10 +17,8 @@
 #include "block/throttle-groups.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
-#include "qapi/error.h"
-#include "qapi/qapi-events-block.h"
+#include "qapi-event.h"
 #include "qemu/id.h"
-#include "qemu/option.h"
 #include "trace.h"
 #include "migration/misc.h"

@@ -31,13 +29,6 @@

 static AioContext *blk_aiocb_get_aio_context(BlockAIOCB *acb);

-typedef struct BlockBackendAioNotifier {
-    void (*attached_aio_context)(AioContext *new_context, void *opaque);
-    void (*detach_aio_context)(void *opaque);
-    void *opaque;
-    QLIST_ENTRY(BlockBackendAioNotifier) list;
-} BlockBackendAioNotifier;
-
 struct BlockBackend {
    char *name;
    int refcnt;
@@ -76,18 +67,10 @@ struct BlockBackend {
    bool allow_write_beyond_eof;

    NotifierList remove_bs_notifiers, insert_bs_notifiers;
-    QLIST_HEAD(, BlockBackendAioNotifier) aio_notifiers;

    int quiesce_counter;
    VMChangeStateEntry *vmsh;
    bool force_allow_inactivate;
-
-    /* Number of in-flight aio requests.  BlockDriverState also counts
-     * in-flight requests but aio requests can exist even when blk->root is
-     * NULL, so we cannot rely on its counter for that case.
-     * Accessed with atomic ops.
-     */
-    unsigned int in_flight;
 };

 typedef struct BlockBackendAIOCB {
@@ -120,7 +103,6 @@ static void blk_root_inherit_options(int *child_flags, QDict *child_options,
    abort();
 }
 static void blk_root_drained_begin(BdrvChild *child);
-static bool blk_root_drained_poll(BdrvChild *child);
 static void blk_root_drained_end(BdrvChild *child);

 static void blk_root_change_media(BdrvChild *child, bool load);
@@ -255,36 +237,6 @@ static int blk_root_inactivate(BdrvChild *child)
    return 0;
 }

-static void blk_root_attach(BdrvChild *child)
-{
-    BlockBackend *blk = child->opaque;
-    BlockBackendAioNotifier *notifier;
-
-    trace_blk_root_attach(child, blk, child->bs);
-
-    QLIST_FOREACH(notifier, &blk->aio_notifiers, list) {
-        bdrv_add_aio_context_notifier(child->bs,
-                notifier->attached_aio_context,
-                notifier->detach_aio_context,
-                notifier->opaque);
-    }
-}
-
-static void blk_root_detach(BdrvChild *child)
-{
-    BlockBackend *blk = child->opaque;
-    BlockBackendAioNotifier *notifier;
-
-    trace_blk_root_detach(child, blk, child->bs);
-
-    QLIST_FOREACH(notifier, &blk->aio_notifiers, list) {
-        bdrv_remove_aio_context_notifier(child->bs,
-                notifier->attached_aio_context,
-                notifier->detach_aio_context,
-                notifier->opaque);
-    }
-}
-
 static const BdrvChildRole child_root = {
    .inherit_options    = blk_root_inherit_options,

@@ -294,14 +246,10 @@ static const BdrvChildRole child_root = {
    .get_parent_desc    = blk_root_get_parent_desc,

    .drained_begin      = blk_root_drained_begin,
-    .drained_poll       = blk_root_drained_poll,
    .drained_end        = blk_root_drained_end,

    .activate           = blk_root_activate,
    .inactivate         = blk_root_inactivate,
-
-    .attach             = blk_root_attach,
-    .detach             = blk_root_detach,
 };

 /*
@@ -325,14 +273,13 @@ BlockBackend *blk_new(uint64_t perm, uint64_t shared_perm)
    blk->shared_perm = shared_perm;
    blk_set_enable_write_cache(blk, true);

-    blk->on_read_error = BLOCKDEV_ON_ERROR_REPORT;
-    blk->on_write_error = BLOCKDEV_ON_ERROR_ENOSPC;
-
+    qemu_co_mutex_init(&blk->public.throttled_reqs_lock);
+    qemu_co_queue_init(&blk->public.throttled_reqs[0]);
+    qemu_co_queue_init(&blk->public.throttled_reqs[1]);
    block_acct_init(&blk->stats);

    notifier_list_init(&blk->remove_bs_notifiers);
    notifier_list_init(&blk->insert_bs_notifiers);
-    QLIST_INIT(&blk->aio_notifiers);

    QTAILQ_INSERT_TAIL(&block_backends, blk, link);
    return blk;
@@ -355,7 +302,7 @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
 {
    BlockBackend *blk;
    BlockDriverState *bs;
-    uint64_t perm = 0;
+    uint64_t perm;

    /* blk_new_open() is mainly used in .bdrv_create implementations and the
     * tools where sharing isn't a concern because the BDS stays private, so we
@@ -365,11 +312,9 @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
     * caller of blk_new_open() doesn't make use of the permissions, but they
     * shouldn't hurt either. We can still share everything here because the
     * guest devices will add their own blockers if they can't share. */
-    if ((flags & BDRV_O_NO_IO) == 0) {
-        perm |= BLK_PERM_CONSISTENT_READ;
-        if (flags & BDRV_O_RDWR) {
-            perm |= BLK_PERM_WRITE;
-        }
+    perm = BLK_PERM_CONSISTENT_READ;
+    if (flags & BDRV_O_RDWR) {
+        perm |= BLK_PERM_WRITE;
    }
    if (flags & BDRV_O_RESIZE) {
        perm |= BLK_PERM_RESIZE;
@@ -398,7 +343,7 @@ static void blk_delete(BlockBackend *blk)
    assert(!blk->refcnt);
    assert(!blk->name);
    assert(!blk->dev);
-    if (blk->public.throttle_group_member.throttle_state) {
+    if (blk->public.throttle_state) {
        blk_io_limits_disable(blk);
    }
    if (blk->root) {
@@ -410,7 +355,6 @@ static void blk_delete(BlockBackend *blk)
    }
    assert(QLIST_EMPTY(&blk->remove_bs_notifiers.notifiers));
    assert(QLIST_EMPTY(&blk->insert_bs_notifiers.notifiers));
-    assert(QLIST_EMPTY(&blk->aio_notifiers));
    QTAILQ_REMOVE(&block_backends, blk, link);
    drive_info_del(blk->legacy_dinfo);
    block_acct_cleanup(&blk->stats);
@@ -423,6 +367,7 @@ static void drive_info_del(DriveInfo *dinfo)
        return;
    }
    qemu_opts_del(dinfo->opts);
+    g_free(dinfo->serial);
    g_free(dinfo);
 }

@@ -437,7 +382,6 @@ int blk_get_refcnt(BlockBackend *blk)
 */
 void blk_ref(BlockBackend *blk)
 {
-    assert(blk->refcnt > 0);
    blk->refcnt++;
 }

@@ -450,13 +394,7 @@ void blk_unref(BlockBackend *blk)
 {
    if (blk) {
        assert(blk->refcnt > 0);
-        if (blk->refcnt > 1) {
-            blk->refcnt--;
-        } else {
-            blk_drain(blk);
-            /* blk_drain() cannot resurrect blk, nobody held a reference */
-            assert(blk->refcnt == 1);
-            blk->refcnt = 0;
+        if (!--blk->refcnt) {
            blk_delete(blk);
        }
    }
@@ -507,37 +445,21 @@ BlockBackend *blk_next(BlockBackend *blk)
 * the monitor or attached to a BlockBackend */
 BlockDriverState *bdrv_next(BdrvNextIterator *it)
 {
-    BlockDriverState *bs, *old_bs;
-
-    /* Must be called from the main loop */
-    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
+    BlockDriverState *bs;

    /* First, return all root nodes of BlockBackends. In order to avoid
     * returning a BDS twice when multiple BBs refer to it, we only return it
     * if the BB is the first one in the parent list of the BDS. */
    if (it->phase == BDRV_NEXT_BACKEND_ROOTS) {
-        BlockBackend *old_blk = it->blk;
-
-        old_bs = old_blk ? blk_bs(old_blk) : NULL;
-
        do {
            it->blk = blk_all_next(it->blk);
            bs = it->blk ? blk_bs(it->blk) : NULL;
        } while (it->blk && (bs == NULL || bdrv_first_blk(bs) != it->blk));

-        if (it->blk) {
-            blk_ref(it->blk);
-        }
-        blk_unref(old_blk);
-
        if (bs) {
-            bdrv_ref(bs);
-            bdrv_unref(old_bs);
            return bs;
        }
        it->phase = BDRV_NEXT_MONITOR_OWNED;
-    } else {
-        old_bs = it->bs;
    }

    /* Then return the monitor-owned BDSes without a BB attached. Ignore all
@@ -548,46 +470,18 @@ BlockDriverState *bdrv_next(BdrvNextIterator *it)
        bs = it->bs;
    } while (bs && bdrv_has_blk(bs));

-    if (bs) {
-        bdrv_ref(bs);
-    }
-    bdrv_unref(old_bs);
-
    return bs;
 }

-static void bdrv_next_reset(BdrvNextIterator *it)
-{
-    *it = (BdrvNextIterator) {
-        .phase = BDRV_NEXT_BACKEND_ROOTS,
-    };
-}
-
 BlockDriverState *bdrv_first(BdrvNextIterator *it)
 {
-    bdrv_next_reset(it);
+    *it = (BdrvNextIterator) {
+        .phase = BDRV_NEXT_BACKEND_ROOTS,
+    };
+
    return bdrv_next(it);
 }

-/* Must be called when aborting a bdrv_next() iteration before
- * bdrv_next() returns NULL */
-void bdrv_next_cleanup(BdrvNextIterator *it)
-{
-    /* Must be called from the main loop */
-    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
-
-    if (it->phase == BDRV_NEXT_BACKEND_ROOTS) {
-        if (it->blk) {
-            bdrv_unref(blk_bs(it->blk));
-            blk_unref(it->blk);
-        }
-    } else {
-        bdrv_unref(it->bs);
-    }
-
-    bdrv_next_reset(it);
-}
-
 /*
 * Add a BlockBackend into the list of backends referenced by the monitor, with
 * the given @name acting as the handle for the monitor.
@@ -764,25 +658,13 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
 */
 void blk_remove_bs(BlockBackend *blk)
 {
-    ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
-    BlockDriverState *bs;
-
    notifier_list_notify(&blk->remove_bs_notifiers, blk);
-    if (tgm->throttle_state) {
-        bs = blk_bs(blk);
-        bdrv_drained_begin(bs);
-        throttle_group_detach_aio_context(tgm);
-        throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
-        bdrv_drained_end(bs);
+    if (blk->public.throttle_state) {
+        throttle_timers_detach_aio_context(&blk->public.throttle_timers);
    }

    blk_update_root_state(blk);

-    /* bdrv_root_unref_child() will cause blk->root to become stale and may
-     * switch to a completion coroutine later on. Let's drain all I/O here
-     * to avoid that and a potential QEMU crash.
-     */
-    blk_drain(blk);
    bdrv_root_unref_child(blk->root);
    blk->root = NULL;
 }
@@ -792,7 +674,6 @@ void blk_remove_bs(BlockBackend *blk)
 */
 int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
 {
-    ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
    blk->root = bdrv_root_attach_child(bs, "root", &child_root,
                                       blk->perm, blk->shared_perm, blk, errp);
    if (blk->root == NULL) {
@@ -801,9 +682,9 @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
    bdrv_ref(bs);

    notifier_list_notify(&blk->insert_bs_notifiers, blk);
-    if (tgm->throttle_state) {
-        throttle_group_detach_aio_context(tgm);
-        throttle_group_attach_aio_context(tgm, bdrv_get_aio_context(bs));
+    if (blk->public.throttle_state) {
+        throttle_timers_attach_aio_context(
+            &blk->public.throttle_timers, bdrv_get_aio_context(bs));
    }

    return 0;
@@ -918,8 +799,7 @@ char *blk_get_attached_dev_id(BlockBackend *blk)
    } else if (dev->id) {
        return g_strdup(dev->id);
    }
-
-    return object_get_canonical_path(OBJECT(dev)) ?: g_strdup("");
+    return object_get_canonical_path(OBJECT(dev));
 }

 /*
@@ -992,7 +872,8 @@ void blk_dev_change_media_cb(BlockBackend *blk, bool load, Error **errp)

        if (tray_was_open != tray_is_open) {
            char *id = blk_get_attached_dev_id(blk);
-            qapi_event_send_device_tray_moved(blk_name(blk), id, tray_is_open);
+            qapi_event_send_device_tray_moved(blk_name(blk), id, tray_is_open,
+                                              &error_abort);
            g_free(id);
        }
    }
@@ -1165,9 +1046,8 @@ int coroutine_fn blk_co_preadv(BlockBackend *blk, int64_t offset,
    bdrv_inc_in_flight(bs);

    /* throttling disk I/O */
-    if (blk->public.throttle_group_member.throttle_state) {
-        throttle_group_co_io_limits_intercept(&blk->public.throttle_group_member,
-                bytes, false);
+    if (blk->public.throttle_state) {
+        throttle_group_co_io_limits_intercept(blk, bytes, false);
    }

    ret = bdrv_co_preadv(blk->root, offset, bytes, qiov, flags);
@@ -1190,10 +1070,10 @@ int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
    }

    bdrv_inc_in_flight(bs);
+
    /* throttling disk I/O */
-    if (blk->public.throttle_group_member.throttle_state) {
-        throttle_group_co_io_limits_intercept(&blk->public.throttle_group_member,
-                bytes, true);
+    if (blk->public.throttle_state) {
+        throttle_group_co_io_limits_intercept(blk, bytes, true);
    }

    if (!blk->enable_write_cache) {
@@ -1208,7 +1088,7 @@ int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
 typedef struct BlkRwCo {
    BlockBackend *blk;
    int64_t offset;
-    void *iobuf;
+    QEMUIOVector *qiov;
    int ret;
    BdrvRequestFlags flags;
 } BlkRwCo;
@@ -1216,21 +1096,17 @@ typedef struct BlkRwCo {
 static void blk_read_entry(void *opaque)
 {
    BlkRwCo *rwco = opaque;
-    QEMUIOVector *qiov = rwco->iobuf;

-    rwco->ret = blk_co_preadv(rwco->blk, rwco->offset, qiov->size,
-                              qiov, rwco->flags);
-    aio_wait_kick();
+    rwco->ret = blk_co_preadv(rwco->blk, rwco->offset, rwco->qiov->size,
+                              rwco->qiov, rwco->flags);
 }

 static void blk_write_entry(void *opaque)
 {
    BlkRwCo *rwco = opaque;
-    QEMUIOVector *qiov = rwco->iobuf;

-    rwco->ret = blk_co_pwritev(rwco->blk, rwco->offset, qiov->size,
-                               qiov, rwco->flags);
-    aio_wait_kick();
+    rwco->ret = blk_co_pwritev(rwco->blk, rwco->offset, rwco->qiov->size,
+                               rwco->qiov, rwco->flags);
 }

 static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
@@ -1250,7 +1126,7 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
    rwco = (BlkRwCo) {
        .blk    = blk,
        .offset = offset,
-        .iobuf  = &qiov,
+        .qiov   = &qiov,
        .flags  = flags,
        .ret    = NOT_DONE,
    };
@@ -1295,22 +1171,11 @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
    return bdrv_make_zero(blk->root, flags);
 }

-static void blk_inc_in_flight(BlockBackend *blk)
-{
-    atomic_inc(&blk->in_flight);
-}
-
-static void blk_dec_in_flight(BlockBackend *blk)
-{
-    atomic_dec(&blk->in_flight);
-    aio_wait_kick();
-}
-
 static void error_callback_bh(void *opaque)
 {
    struct BlockBackendAIOCB *acb = opaque;

-    blk_dec_in_flight(acb->blk);
+    bdrv_dec_in_flight(acb->common.bs);
    acb->common.cb(acb->common.opaque, acb->ret);
    qemu_aio_unref(acb);
 }
@@ -1321,7 +1186,7 @@ BlockAIOCB *blk_abort_aio_request(BlockBackend *blk,
 {
    struct BlockBackendAIOCB *acb;

-    blk_inc_in_flight(blk);
+    bdrv_inc_in_flight(blk_bs(blk));
    acb = blk_aio_get(&block_backend_aiocb_info, blk, cb, opaque);
    acb->blk = blk;
    acb->ret = ret;
@@ -1344,8 +1209,8 @@ static const AIOCBInfo blk_aio_em_aiocb_info = {
 static void blk_aio_complete(BlkAioEmAIOCB *acb)
 {
    if (acb->has_returned) {
+        bdrv_dec_in_flight(acb->common.bs);
        acb->common.cb(acb->common.opaque, acb->rwco.ret);
-        blk_dec_in_flight(acb->rwco.blk);
        qemu_aio_unref(acb);
    }
 }
@@ -1358,19 +1223,19 @@ static void blk_aio_complete_bh(void *opaque)
 }

 static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
-                                void *iobuf, CoroutineEntry co_entry,
+                                QEMUIOVector *qiov, CoroutineEntry co_entry,
                                BdrvRequestFlags flags,
                                BlockCompletionFunc *cb, void *opaque)
 {
    BlkAioEmAIOCB *acb;
    Coroutine *co;

-    blk_inc_in_flight(blk);
+    bdrv_inc_in_flight(blk_bs(blk));
    acb = blk_aio_get(&blk_aio_em_aiocb_info, blk, cb, opaque);
    acb->rwco = (BlkRwCo) {
        .blk    = blk,
        .offset = offset,
-        .iobuf  = iobuf,
+        .qiov   = qiov,
        .flags  = flags,
        .ret    = NOT_DONE,
    };
@@ -1393,11 +1258,10 @@ static void blk_aio_read_entry(void *opaque)
 {
    BlkAioEmAIOCB *acb = opaque;
    BlkRwCo *rwco = &acb->rwco;
-    QEMUIOVector *qiov = rwco->iobuf;

-    assert(qiov->size == acb->bytes);
+    assert(rwco->qiov->size == acb->bytes);
    rwco->ret = blk_co_preadv(rwco->blk, rwco->offset, acb->bytes,
-                              qiov, rwco->flags);
+                              rwco->qiov, rwco->flags);
    blk_aio_complete(acb);
 }

@@ -1405,11 +1269,10 @@ static void blk_aio_write_entry(void *opaque)
 {
    BlkAioEmAIOCB *acb = opaque;
    BlkRwCo *rwco = &acb->rwco;
-    QEMUIOVector *qiov = rwco->iobuf;

-    assert(!qiov || qiov->size == acb->bytes);
+    assert(!rwco->qiov || rwco->qiov->size == acb->bytes);
    rwco->ret = blk_co_pwritev(rwco->blk, rwco->offset, acb->bytes,
-                               qiov, rwco->flags);
+                               rwco->qiov, rwco->flags);
    blk_aio_complete(acb);
 }

@@ -1538,11 +1401,8 @@ int blk_co_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
 static void blk_ioctl_entry(void *opaque)
 {
    BlkRwCo *rwco = opaque;
-    QEMUIOVector *qiov = rwco->iobuf;
-
    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,
-                             qiov->iov[0].iov_base);
-    aio_wait_kick();
+                             rwco->qiov->iov[0].iov_base);
 }

 int blk_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
@@ -1555,15 +1415,24 @@ static void blk_aio_ioctl_entry(void *opaque)
    BlkAioEmAIOCB *acb = opaque;
    BlkRwCo *rwco = &acb->rwco;

-    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset, rwco->iobuf);
-
+    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,
+                             rwco->qiov->iov[0].iov_base);
    blk_aio_complete(acb);
 }

 BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
                          BlockCompletionFunc *cb, void *opaque)
 {
-    return blk_aio_prwv(blk, req, 0, buf, blk_aio_ioctl_entry, 0, cb, opaque);
+    QEMUIOVector qiov;
+    struct iovec iov;
+
+    iov = (struct iovec) {
+        .iov_base = buf,
+        .iov_len = 0,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
+    return blk_aio_prwv(blk, req, 0, &qiov, blk_aio_ioctl_entry, 0, cb, opaque);
 }

 int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
@@ -1573,7 +1442,7 @@ int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
        return ret;
    }

-    return bdrv_co_pdiscard(blk->root, offset, bytes);
+    return bdrv_co_pdiscard(blk_bs(blk), offset, bytes);
 }

 int blk_co_flush(BlockBackend *blk)
@@ -1589,7 +1458,6 @@ static void blk_flush_entry(void *opaque)
 {
    BlkRwCo *rwco = opaque;
    rwco->ret = blk_co_flush(rwco->blk);
-    aio_wait_kick();
 }

 int blk_flush(BlockBackend *blk)
@@ -1599,39 +1467,14 @@ int blk_flush(BlockBackend *blk)

 void blk_drain(BlockBackend *blk)
 {
-    BlockDriverState *bs = blk_bs(blk);
-
-    if (bs) {
-        bdrv_drained_begin(bs);
-    }
-
-    /* We may have -ENOMEDIUM completions in flight */
-    AIO_WAIT_WHILE(blk_get_aio_context(blk),
-                   atomic_mb_read(&blk->in_flight) > 0);
-
-    if (bs) {
-        bdrv_drained_end(bs);
+    if (blk_bs(blk)) {
+        bdrv_drain(blk_bs(blk));
    }
 }

 void blk_drain_all(void)
 {
-    BlockBackend *blk = NULL;
-
-    bdrv_drain_all_begin();
-
-    while ((blk = blk_all_next(blk)) != NULL) {
-        AioContext *ctx = blk_get_aio_context(blk);
-
-        aio_context_acquire(ctx);
-
-        /* We may have -ENOMEDIUM completions in flight */
-        AIO_WAIT_WHILE(ctx, atomic_mb_read(&blk->in_flight) > 0);
-
-        aio_context_release(ctx);
-    }
-
-    bdrv_drain_all_end();
+    bdrv_drain_all();
 }

 void blk_set_on_error(BlockBackend *blk, BlockdevOnError on_read_error,
@@ -1672,13 +1515,13 @@ static void send_qmp_error_event(BlockBackend *blk,
                                 bool is_read, int error)
 {
    IoOperationType optype;
-    BlockDriverState *bs = blk_bs(blk);

    optype = is_read ? IO_OPERATION_TYPE_READ : IO_OPERATION_TYPE_WRITE;
-    qapi_event_send_block_io_error(blk_name(blk), !!bs,
-                                   bs ? bdrv_get_node_name(bs) : NULL, optype,
+    qapi_event_send_block_io_error(blk_name(blk),
+                                   bdrv_get_node_name(blk_bs(blk)), optype,
                                   action, blk_iostatus_is_enabled(blk),
-                                   error == ENOSPC, strerror(error));
+                                   error == ENOSPC, strerror(error),
+                                   &error_abort);
 }

 /* This is done by device models because, while the block layer knows
@@ -1713,7 +1556,7 @@ void blk_error_action(BlockBackend *blk, BlockErrorAction action,
    }
 }

-bool blk_is_read_only(BlockBackend *blk)
+int blk_is_read_only(BlockBackend *blk)
 {
    BlockDriverState *bs = blk_bs(blk);

@@ -1724,18 +1567,18 @@ bool blk_is_read_only(BlockBackend *blk)
    }
 }

-bool blk_is_sg(BlockBackend *blk)
+int blk_is_sg(BlockBackend *blk)
 {
    BlockDriverState *bs = blk_bs(blk);

    if (!bs) {
-        return false;
+        return 0;
    }

    return bdrv_is_sg(bs);
 }

-bool blk_enable_write_cache(BlockBackend *blk)
+int blk_enable_write_cache(BlockBackend *blk)
 {
    return blk->enable_write_cache;
 }
@@ -1794,7 +1637,7 @@ void blk_eject(BlockBackend *blk, bool eject_flag)
     * the frontend experienced a tray event. */
    id = blk_get_attached_dev_id(blk);
    qapi_event_send_device_tray_moved(blk_name(blk), id,
-                                      eject_flag);
+                                      eject_flag, &error_abort);
    g_free(id);
 }

@@ -1881,7 +1724,13 @@ void blk_op_unblock_all(BlockBackend *blk, Error *reason)

 AioContext *blk_get_aio_context(BlockBackend *blk)
 {
-    return bdrv_get_aio_context(blk_bs(blk));
+    BlockDriverState *bs = blk_bs(blk);
+
+    if (bs) {
+        return bdrv_get_aio_context(bs);
+    } else {
+        return qemu_get_aio_context();
+    }
 }

 static AioContext *blk_aiocb_get_aio_context(BlockAIOCB *acb)
@@ -1893,16 +1742,16 @@ static AioContext *blk_aiocb_get_aio_context(BlockAIOCB *acb)
 void blk_set_aio_context(BlockBackend *blk, AioContext *new_context)
 {
    BlockDriverState *bs = blk_bs(blk);
-    ThrottleGroupMember *tgm = &blk->public.throttle_group_member;

    if (bs) {
-        if (tgm->throttle_state) {
-            bdrv_drained_begin(bs);
-            throttle_group_detach_aio_context(tgm);
-            throttle_group_attach_aio_context(tgm, new_context);
-            bdrv_drained_end(bs);
+        if (blk->public.throttle_state) {
+            throttle_timers_detach_aio_context(&blk->public.throttle_timers);
        }
        bdrv_set_aio_context(bs, new_context);
+        if (blk->public.throttle_state) {
+            throttle_timers_attach_aio_context(&blk->public.throttle_timers,
+                                               new_context);
+        }
    }
 }

@@ -1910,15 +1759,8 @@ void blk_add_aio_context_notifier(BlockBackend *blk,
        void (*attached_aio_context)(AioContext *new_context, void *opaque),
        void (*detach_aio_context)(void *opaque), void *opaque)
 {
-    BlockBackendAioNotifier *notifier;
    BlockDriverState *bs = blk_bs(blk);

-    notifier = g_new(BlockBackendAioNotifier, 1);
-    notifier->attached_aio_context = attached_aio_context;
-    notifier->detach_aio_context = detach_aio_context;
-    notifier->opaque = opaque;
-    QLIST_INSERT_HEAD(&blk->aio_notifiers, notifier, list);
-
    if (bs) {
        bdrv_add_aio_context_notifier(bs, attached_aio_context,
                                      detach_aio_context, opaque);
@@ -1931,25 +1773,12 @@ void blk_remove_aio_context_notifier(BlockBackend *blk,
                                     void (*detach_aio_context)(void *),
                                     void *opaque)
 {
-    BlockBackendAioNotifier *notifier;
    BlockDriverState *bs = blk_bs(blk);

    if (bs) {
        bdrv_remove_aio_context_notifier(bs, attached_aio_context,
                                         detach_aio_context, opaque);
    }
-
-    QLIST_FOREACH(notifier, &blk->aio_notifiers, list) {
-        if (notifier->attached_aio_context == attached_aio_context &&
-            notifier->detach_aio_context == detach_aio_context &&
-            notifier->opaque == opaque) {
-            QLIST_REMOVE(notifier, list);
-            g_free(notifier);
-            return;
-        }
-    }
-
-    abort();
 }

 void blk_add_remove_bs_notifier(BlockBackend *blk, Notifier *notify)
@@ -2019,10 +1848,7 @@ int blk_truncate(BlockBackend *blk, int64_t offset, PreallocMode prealloc,
 static void blk_pdiscard_entry(void *opaque)
 {
    BlkRwCo *rwco = opaque;
-    QEMUIOVector *qiov = rwco->iobuf;
-
-    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, qiov->size);
-    aio_wait_kick();
+    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, rwco->qiov->size);
 }

 int blk_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
@@ -2143,41 +1969,33 @@ int blk_commit_all(void)
 /* throttling disk I/O limits */
 void blk_set_io_limits(BlockBackend *blk, ThrottleConfig *cfg)
 {
-    throttle_group_config(&blk->public.throttle_group_member, cfg);
+    throttle_group_config(blk, cfg);
 }

 void blk_io_limits_disable(BlockBackend *blk)
 {
-    BlockDriverState *bs = blk_bs(blk);
-    ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
-    assert(tgm->throttle_state);
-    if (bs) {
-        bdrv_drained_begin(bs);
-    }
-    throttle_group_unregister_tgm(tgm);
-    if (bs) {
-        bdrv_drained_end(bs);
-    }
+    assert(blk->public.throttle_state);
+    bdrv_drained_begin(blk_bs(blk));
+    throttle_group_unregister_blk(blk);
+    bdrv_drained_end(blk_bs(blk));
 }

 /* should be called before blk_set_io_limits if a limit is set */
 void blk_io_limits_enable(BlockBackend *blk, const char *group)
 {
-    assert(!blk->public.throttle_group_member.throttle_state);
-    throttle_group_register_tgm(&blk->public.throttle_group_member,
-                                group, blk_get_aio_context(blk));
+    assert(!blk->public.throttle_state);
+    throttle_group_register_blk(blk, group);
 }

 void blk_io_limits_update_group(BlockBackend *blk, const char *group)
 {
    /* this BB is not part of any group */
-    if (!blk->public.throttle_group_member.throttle_state) {
+    if (!blk->public.throttle_state) {
        return;
    }

    /* this BB is a part of the same group than the one we want */
-    if (!g_strcmp0(throttle_group_get_name(&blk->public.throttle_group_member),
-                group)) {
+    if (!g_strcmp0(throttle_group_get_name(blk), group)) {
        return;
    }

@@ -2199,25 +2017,18 @@ static void blk_root_drained_begin(BdrvChild *child)
    /* Note that blk->root may not be accessible here yet if we are just
     * attaching to a BlockDriverState that is drained. Use child instead. */

-    if (atomic_fetch_inc(&blk->public.throttle_group_member.io_limits_disabled) == 0) {
-        throttle_group_restart_tgm(&blk->public.throttle_group_member);
+    if (atomic_fetch_inc(&blk->public.io_limits_disabled) == 0) {
+        throttle_group_restart_blk(blk);
    }
 }

-static bool blk_root_drained_poll(BdrvChild *child)
-{
-    BlockBackend *blk = child->opaque;
-    assert(blk->quiesce_counter);
-    return !!blk->in_flight;
-}
-
 static void blk_root_drained_end(BdrvChild *child)
 {
    BlockBackend *blk = child->opaque;
    assert(blk->quiesce_counter);

-    assert(blk->public.throttle_group_member.io_limits_disabled);
-    atomic_dec(&blk->public.throttle_group_member.io_limits_disabled);
+    assert(blk->public.io_limits_disabled);
+    atomic_dec(&blk->public.io_limits_disabled);

    if (--blk->quiesce_counter == 0) {
        if (blk->dev_ops && blk->dev_ops->drained_end) {
@@ -2225,32 +2036,3 @@ static void blk_root_drained_end(BdrvChild *child)
        }
    }
 }
-
-void blk_register_buf(BlockBackend *blk, void *host, size_t size)
-{
-    bdrv_register_buf(blk_bs(blk), host, size);
-}
-
-void blk_unregister_buf(BlockBackend *blk, void *host)
-{
-    bdrv_unregister_buf(blk_bs(blk), host);
-}
-
-int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
-                                   BlockBackend *blk_out, int64_t off_out,
-                                   int bytes, BdrvRequestFlags read_flags,
-                                   BdrvRequestFlags write_flags)
-{
-    int r;
-    r = blk_check_byte_request(blk_in, off_in, bytes);
-    if (r) {
-        return r;
-    }
-    r = blk_check_byte_request(blk_out, off_out, bytes);
-    if (r) {
-        return r;
-    }
-    return bdrv_co_copy_range(blk_in->root, off_in,
-                              blk_out->root, off_out,
-                              bytes, read_flags, write_flags);
-}
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -28,7 +28,6 @@
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "qemu/bswap.h"
-#include "qemu/error-report.h"

 /**************************************************************/

@@ -105,18 +104,17 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
    struct bochs_header bochs;
    int ret;

-    /* No write support yet */
-    ret = bdrv_apply_auto_read_only(bs, NULL, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
    if (!bs->file) {
        return -EINVAL;
    }

+    ret = bdrv_set_read_only(bs, true, errp); /* no write support yet */
+    if (ret < 0) {
+        return ret;
+    }
+
    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
    if (ret < 0) {
        return ret;
--- a/block/cloop.c
+++ b/block/cloop.c
@@ -23,7 +23,6 @@
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qemu/error-report.h"
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
@@ -67,17 +66,17 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
    uint32_t offsets_size, max_compressed_block_size = 1, i;
    int ret;

-    ret = bdrv_apply_auto_read_only(bs, NULL, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
    if (!bs->file) {
        return -EINVAL;
    }

+    ret = bdrv_set_read_only(bs, true, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
    /* read header */
    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
    if (ret < 0) {
--- a/block/commit.c
+++ b/block/commit.c
@@ -31,14 +31,18 @@ enum {
    COMMIT_BUFFER_SIZE = 512 * 1024, /* in bytes */
 };

+#define SLICE_TIME 100000000ULL /* ns */
+
 typedef struct CommitBlockJob {
    BlockJob common;
+    RateLimit limit;
+    BlockDriverState *active;
    BlockDriverState *commit_top_bs;
    BlockBackend *top;
    BlockBackend *base;
-    BlockDriverState *base_bs;
    BlockdevOnError on_error;
    int base_flags;
+    int orig_overlay_flags;
    char *backing_file_str;
 } CommitBlockJob;

@@ -69,93 +73,99 @@ static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
    return 0;
 }

-static int commit_prepare(Job *job)
+typedef struct {
+    int ret;
+} CommitCompleteData;
+
+static void commit_complete(BlockJob *job, void *opaque)
 {
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
+    CommitBlockJob *s = container_of(job, CommitBlockJob, common);
+    CommitCompleteData *data = opaque;
+    BlockDriverState *active = s->active;
+    BlockDriverState *top = blk_bs(s->top);
+    BlockDriverState *base = blk_bs(s->base);
+    BlockDriverState *overlay_bs = bdrv_find_overlay(active, s->commit_top_bs);
+    int ret = data->ret;
+    bool remove_commit_top_bs = false;
+
+    /* Make sure overlay_bs and top stay around until bdrv_set_backing_hd() */
+    bdrv_ref(top);
+    if (overlay_bs) {
+        bdrv_ref(overlay_bs);
+    }

    /* Remove base node parent that still uses BLK_PERM_WRITE/RESIZE before
     * the normal backing chain can be restored. */
    blk_unref(s->base);
-    s->base = NULL;

-    /* FIXME: bdrv_drop_intermediate treats total failures and partial failures
-     * identically. Further work is needed to disambiguate these cases. */
-    return bdrv_drop_intermediate(s->commit_top_bs, s->base_bs,
-                                  s->backing_file_str);
-}
-
-static void commit_abort(Job *job)
-{
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
-    BlockDriverState *top_bs = blk_bs(s->top);
-
-    /* Make sure commit_top_bs and top stay around until bdrv_replace_node() */
-    bdrv_ref(top_bs);
-    bdrv_ref(s->commit_top_bs);
-
-    if (s->base) {
-        blk_unref(s->base);
+    if (!block_job_is_cancelled(&s->common) && ret == 0) {
+        /* success */
+        ret = bdrv_drop_intermediate(active, s->commit_top_bs, base,
+                                     s->backing_file_str);
+    } else if (overlay_bs) {
+        /* XXX Can (or should) we somehow keep 'consistent read' blocked even
+         * after the failed/cancelled commit job is gone? If we already wrote
+         * something to base, the intermediate images aren't valid any more. */
+        remove_commit_top_bs = true;
    }

-    /* free the blockers on the intermediate nodes so that bdrv_replace_nodes
-     * can succeed */
-    block_job_remove_all_bdrv(&s->common);
-
-    /* If bdrv_drop_intermediate() failed (or was not invoked), remove the
-     * commit filter driver from the backing chain now. Do this as the final
-     * step so that the 'consistent read' permission can be granted.
-     *
-     * XXX Can (or should) we somehow keep 'consistent read' blocked even
-     * after the failed/cancelled commit job is gone? If we already wrote
-     * something to base, the intermediate images aren't valid any more. */
-    bdrv_child_try_set_perm(s->commit_top_bs->backing, 0, BLK_PERM_ALL,
-                            &error_abort);
-    bdrv_replace_node(s->commit_top_bs, backing_bs(s->commit_top_bs),
-                      &error_abort);
-
-    bdrv_unref(s->commit_top_bs);
-    bdrv_unref(top_bs);
-}
-
-static void commit_clean(Job *job)
-{
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
-
    /* restore base open flags here if appropriate (e.g., change the base back
     * to r/o). These reopens do not need to be atomic, since we won't abort
     * even on failure here */
-    if (s->base_flags != bdrv_get_flags(s->base_bs)) {
-        bdrv_reopen(s->base_bs, s->base_flags, NULL);
+    if (s->base_flags != bdrv_get_flags(base)) {
+        bdrv_reopen(base, s->base_flags, NULL);
+    }
+    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
+        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
    }
-
    g_free(s->backing_file_str);
    blk_unref(s->top);
+
+    /* If there is more than one reference to the job (e.g. if called from
+     * block_job_finish_sync()), block_job_completed() won't free it and
+     * therefore the blockers on the intermediate nodes remain. This would
+     * cause bdrv_set_backing_hd() to fail. */
+    block_job_remove_all_bdrv(job);
+
+    block_job_completed(&s->common, ret);
+    g_free(data);
+
+    /* If bdrv_drop_intermediate() didn't already do that, remove the commit
+     * filter driver from the backing chain. Do this as the final step so that
+     * the 'consistent read' permission can be granted.  */
+    if (remove_commit_top_bs) {
+        bdrv_set_backing_hd(overlay_bs, top, &error_abort);
+    }
+
+    bdrv_unref(overlay_bs);
+    bdrv_unref(top);
 }

-static int coroutine_fn commit_run(Job *job, Error **errp)
+static void coroutine_fn commit_run(void *opaque)
 {
-    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
+    CommitBlockJob *s = opaque;
+    CommitCompleteData *data;
    int64_t offset;
    uint64_t delay_ns = 0;
    int ret = 0;
    int64_t n = 0; /* bytes */
    void *buf = NULL;
    int bytes_written = 0;
-    int64_t len, base_len;
+    int64_t base_len;

-    ret = len = blk_getlength(s->top);
-    if (len < 0) {
+    ret = s->common.len = blk_getlength(s->top);
+
+    if (s->common.len < 0) {
        goto out;
    }
-    job_progress_set_remaining(&s->common.job, len);

    ret = base_len = blk_getlength(s->base);
    if (base_len < 0) {
        goto out;
    }

-    if (base_len < len) {
-        ret = blk_truncate(s->base, len, PREALLOC_MODE_OFF, NULL);
+    if (base_len < s->common.len) {
+        ret = blk_truncate(s->base, s->common.len, PREALLOC_MODE_OFF, NULL);
        if (ret) {
            goto out;
        }
@@ -163,14 +173,14 @@ static int coroutine_fn commit_run(Job *job, Error **errp)

    buf = blk_blockalign(s->top, COMMIT_BUFFER_SIZE);

-    for (offset = 0; offset < len; offset += n) {
+    for (offset = 0; offset < s->common.len; offset += n) {
        bool copy;

        /* Note that even when no rate limit is applied we need to yield
         * with no pending I/O here so that bdrv_drain_all() returns.
         */
-        job_sleep_ns(&s->common.job, delay_ns);
-        if (job_is_cancelled(&s->common.job)) {
+        block_job_sleep_ns(&s->common, QEMU_CLOCK_REALTIME, delay_ns);
+        if (block_job_is_cancelled(&s->common)) {
            break;
        }
        /* Copy if allocated above the base */
@@ -193,12 +203,10 @@ static int coroutine_fn commit_run(Job *job, Error **errp)
            }
        }
        /* Publish progress */
-        job_progress_update(&s->common.job, n);
+        s->common.offset += n;

-        if (copy) {
-            delay_ns = block_job_ratelimit_get_delay(&s->common, n);
-        } else {
-            delay_ns = 0;
+        if (copy && s->common.speed) {
+            delay_ns = ratelimit_calculate_delay(&s->limit, n);
        }
    }

@@ -207,21 +215,27 @@ static int coroutine_fn commit_run(Job *job, Error **errp)
 out:
    qemu_vfree(buf);

-    return ret;
+    data = g_malloc(sizeof(*data));
+    data->ret = ret;
+    block_job_defer_to_main_loop(&s->common, commit_complete, data);
+}
+
+static void commit_set_speed(BlockJob *job, int64_t speed, Error **errp)
+{
+    CommitBlockJob *s = container_of(job, CommitBlockJob, common);
+
+    if (speed < 0) {
+        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
+        return;
+    }
+    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
 }

 static const BlockJobDriver commit_job_driver = {
-    .job_driver = {
-        .instance_size = sizeof(CommitBlockJob),
-        .job_type      = JOB_TYPE_COMMIT,
-        .free          = block_job_free,
-        .user_resume   = block_job_user_resume,
-        .drain         = block_job_drain,
-        .run           = commit_run,
-        .prepare       = commit_prepare,
-        .abort         = commit_abort,
-        .clean         = commit_clean
-    },
+    .instance_size = sizeof(CommitBlockJob),
+    .job_type      = BLOCK_JOB_TYPE_COMMIT,
+    .set_speed     = commit_set_speed,
+    .start         = commit_run,
 };

 static int coroutine_fn bdrv_commit_top_preadv(BlockDriverState *bs,
@@ -230,6 +244,16 @@ static int coroutine_fn bdrv_commit_top_preadv(BlockDriverState *bs,
    return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
 }

+static int64_t coroutine_fn bdrv_commit_top_get_block_status(
+    BlockDriverState *bs, int64_t sector_num, int nb_sectors, int *pnum,
+    BlockDriverState **file)
+{
+    *pnum = nb_sectors;
+    *file = bs->backing->bs;
+    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+           (sector_num << BDRV_SECTOR_BITS);
+}
+
 static void bdrv_commit_top_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
    bdrv_refresh_filename(bs->backing->bs);
@@ -237,9 +261,12 @@ static void bdrv_commit_top_refresh_filename(BlockDriverState *bs, QDict *opts)
            bs->backing->bs->filename);
 }

+static void bdrv_commit_top_close(BlockDriverState *bs)
+{
+}
+
 static void bdrv_commit_top_child_perm(BlockDriverState *bs, BdrvChild *c,
                                       const BdrvChildRole *role,
-                                       BlockReopenQueue *reopen_queue,
                                       uint64_t perm, uint64_t shared,
                                       uint64_t *nperm, uint64_t *nshared)
 {
@@ -252,20 +279,23 @@ static void bdrv_commit_top_child_perm(BlockDriverState *bs, BdrvChild *c,
 static BlockDriver bdrv_commit_top = {
    .format_name                = "commit_top",
    .bdrv_co_preadv             = bdrv_commit_top_preadv,
-    .bdrv_co_block_status       = bdrv_co_block_status_from_backing,
+    .bdrv_co_get_block_status   = bdrv_commit_top_get_block_status,
    .bdrv_refresh_filename      = bdrv_commit_top_refresh_filename,
+    .bdrv_close                 = bdrv_commit_top_close,
    .bdrv_child_perm            = bdrv_commit_top_child_perm,
 };

 void commit_start(const char *job_id, BlockDriverState *bs,
-                  BlockDriverState *base, BlockDriverState *top,
-                  int creation_flags, int64_t speed,
+                  BlockDriverState *base, BlockDriverState *top, int64_t speed,
                  BlockdevOnError on_error, const char *backing_file_str,
                  const char *filter_node_name, Error **errp)
 {
    CommitBlockJob *s;
+    BlockReopenQueue *reopen_queue = NULL;
+    int orig_overlay_flags;
    int orig_base_flags;
    BlockDriverState *iter;
+    BlockDriverState *overlay_bs;
    BlockDriverState *commit_top_bs = NULL;
    Error *local_err = NULL;
    int ret;
@@ -276,16 +306,33 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        return;
    }

-    s = block_job_create(job_id, &commit_job_driver, NULL, bs, 0, BLK_PERM_ALL,
-                         speed, creation_flags, NULL, NULL, errp);
+    overlay_bs = bdrv_find_overlay(bs, top);
+
+    if (overlay_bs == NULL) {
+        error_setg(errp, "Could not find overlay image for %s:", top->filename);
+        return;
+    }
+
+    s = block_job_create(job_id, &commit_job_driver, bs, 0, BLK_PERM_ALL,
+                         speed, BLOCK_JOB_DEFAULT, NULL, NULL, errp);
    if (!s) {
        return;
    }

-    /* convert base to r/w, if necessary */
-    orig_base_flags = bdrv_get_flags(base);
+    orig_base_flags    = bdrv_get_flags(base);
+    orig_overlay_flags = bdrv_get_flags(overlay_bs);
+
+    /* convert base & overlay_bs to r/w, if necessary */
    if (!(orig_base_flags & BDRV_O_RDWR)) {
-        bdrv_reopen(base, orig_base_flags | BDRV_O_RDWR, &local_err);
+        reopen_queue = bdrv_reopen_queue(reopen_queue, base, NULL,
+                                         orig_base_flags | BDRV_O_RDWR);
+    }
+    if (!(orig_overlay_flags & BDRV_O_RDWR)) {
+        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs, NULL,
+                                         orig_overlay_flags | BDRV_O_RDWR);
+    }
+    if (reopen_queue) {
+        bdrv_reopen_multiple(bdrv_get_aio_context(bs), reopen_queue, &local_err);
        if (local_err != NULL) {
            error_propagate(errp, local_err);
            goto fail;
@@ -312,7 +359,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        error_propagate(errp, local_err);
        goto fail;
    }
-    bdrv_replace_node(top, commit_top_bs, &local_err);
+    bdrv_set_backing_hd(overlay_bs, commit_top_bs, &local_err);
    if (local_err) {
        bdrv_unref(commit_top_bs);
        commit_top_bs = NULL;
@@ -344,6 +391,14 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

+    /* overlay_bs must be blocked because it needs to be modified to
+     * update the backing image string. */
+    ret = block_job_add_bdrv(&s->common, "overlay of top", overlay_bs,
+                             BLK_PERM_GRAPH_MOD, BLK_PERM_ALL, errp);
+    if (ret < 0) {
+        goto fail;
+    }
+
    s->base = blk_new(BLK_PERM_CONSISTENT_READ
                      | BLK_PERM_WRITE
                      | BLK_PERM_RESIZE,
@@ -354,7 +409,6 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    if (ret < 0) {
        goto fail;
    }
-    s->base_bs = base;

    /* Required permissions are already taken with block_job_add_bdrv() */
    s->top = blk_new(0, BLK_PERM_ALL);
@@ -363,12 +417,17 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

-    s->base_flags = orig_base_flags;
+    s->active = bs;
+
+    s->base_flags          = orig_base_flags;
+    s->orig_overlay_flags  = orig_overlay_flags;
+
    s->backing_file_str = g_strdup(backing_file_str);
+
    s->on_error = on_error;

    trace_commit_start(bs, base, top, s);
-    job_start(&s->common.job);
+    block_job_start(&s->common);
    return;

 fail:
@@ -379,9 +438,9 @@ fail:
        blk_unref(s->top);
    }
    if (commit_top_bs) {
-        bdrv_replace_node(commit_top_bs, top, &error_abort);
+        bdrv_set_backing_hd(overlay_bs, top, &error_abort);
    }
-    job_early_fail(&s->common.job);
+    block_job_early_fail(&s->common);
 }


--- a/block/copy-on-read.c
+++ b/block/copy-on-read.c
@@ -1,167 +0,0 @@
-/*
- * Copy-on-read filter block driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * Author:
- *   Max Reitz <mreitz@redhat.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 or
- * (at your option) version 3 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "block/block_int.h"
-
-
-static int cor_open(BlockDriverState *bs, QDict *options, int flags,
-                    Error **errp)
-{
-    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, false,
-                               errp);
-    if (!bs->file) {
-        return -EINVAL;
-    }
-
-    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
-                                (BDRV_REQ_FUA &
-                                    bs->file->bs->supported_write_flags);
-
-    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
-                               ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP) &
-                                    bs->file->bs->supported_zero_flags);
-
-    return 0;
-}
-
-
-#define PERM_PASSTHROUGH (BLK_PERM_CONSISTENT_READ \
-                          | BLK_PERM_WRITE \
-                          | BLK_PERM_RESIZE)
-#define PERM_UNCHANGED (BLK_PERM_ALL & ~PERM_PASSTHROUGH)
-
-static void cor_child_perm(BlockDriverState *bs, BdrvChild *c,
-                           const BdrvChildRole *role,
-                           BlockReopenQueue *reopen_queue,
-                           uint64_t perm, uint64_t shared,
-                           uint64_t *nperm, uint64_t *nshared)
-{
-    if (c == NULL) {
-        *nperm = (perm & PERM_PASSTHROUGH) | BLK_PERM_WRITE_UNCHANGED;
-        *nshared = (shared & PERM_PASSTHROUGH) | PERM_UNCHANGED;
-        return;
-    }
-
-    *nperm = (perm & PERM_PASSTHROUGH) |
-             (c->perm & PERM_UNCHANGED);
-    *nshared = (shared & PERM_PASSTHROUGH) |
-               (c->shared_perm & PERM_UNCHANGED);
-}
-
-
-static int64_t cor_getlength(BlockDriverState *bs)
-{
-    return bdrv_getlength(bs->file->bs);
-}
-
-
-static int coroutine_fn cor_co_truncate(BlockDriverState *bs, int64_t offset,
-                                        PreallocMode prealloc, Error **errp)
-{
-    return bdrv_co_truncate(bs->file, offset, prealloc, errp);
-}
-
-
-static int coroutine_fn cor_co_preadv(BlockDriverState *bs,
-                                      uint64_t offset, uint64_t bytes,
-                                      QEMUIOVector *qiov, int flags)
-{
-    return bdrv_co_preadv(bs->file, offset, bytes, qiov,
-                          flags | BDRV_REQ_COPY_ON_READ);
-}
-
-
-static int coroutine_fn cor_co_pwritev(BlockDriverState *bs,
-                                       uint64_t offset, uint64_t bytes,
-                                       QEMUIOVector *qiov, int flags)
-{
-
-    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
-}
-
-
-static int coroutine_fn cor_co_pwrite_zeroes(BlockDriverState *bs,
-                                             int64_t offset, int bytes,
-                                             BdrvRequestFlags flags)
-{
-    return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
-}
-
-
-static int coroutine_fn cor_co_pdiscard(BlockDriverState *bs,
-                                        int64_t offset, int bytes)
-{
-    return bdrv_co_pdiscard(bs->file, offset, bytes);
-}
-
-
-static void cor_eject(BlockDriverState *bs, bool eject_flag)
-{
-    bdrv_eject(bs->file->bs, eject_flag);
-}
-
-
-static void cor_lock_medium(BlockDriverState *bs, bool locked)
-{
-    bdrv_lock_medium(bs->file->bs, locked);
-}
-
-
-static bool cor_recurse_is_first_non_filter(BlockDriverState *bs,
-                                            BlockDriverState *candidate)
-{
-    return bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
-}
-
-
-BlockDriver bdrv_copy_on_read = {
-    .format_name                        = "copy-on-read",
-
-    .bdrv_open                          = cor_open,
-    .bdrv_child_perm                    = cor_child_perm,
-
-    .bdrv_getlength                     = cor_getlength,
-    .bdrv_co_truncate                   = cor_co_truncate,
-
-    .bdrv_co_preadv                     = cor_co_preadv,
-    .bdrv_co_pwritev                    = cor_co_pwritev,
-    .bdrv_co_pwrite_zeroes              = cor_co_pwrite_zeroes,
-    .bdrv_co_pdiscard                   = cor_co_pdiscard,
-
-    .bdrv_eject                         = cor_eject,
-    .bdrv_lock_medium                   = cor_lock_medium,
-
-    .bdrv_co_block_status               = bdrv_co_block_status_from_file,
-
-    .bdrv_recurse_is_first_non_filter   = cor_recurse_is_first_non_filter,
-
-    .has_variable_length                = true,
-    .is_filter                          = true,
-};
-
-static void bdrv_copy_on_read_init(void)
-{
-    bdrv_register(&bdrv_copy_on_read);
-}
-
-block_init(bdrv_copy_on_read_init);
--- a/block/create.c
+++ b/block/create.c
@@ -1,94 +0,0 @@
-/*
- * Block layer code related to image creation
- *
- * Copyright (c) 2018 Kevin Wolf <kwolf@redhat.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "block/block_int.h"
-#include "qemu/job.h"
-#include "qapi/qapi-commands-block-core.h"
-#include "qapi/qapi-visit-block-core.h"
-#include "qapi/clone-visitor.h"
-#include "qapi/error.h"
-
-typedef struct BlockdevCreateJob {
-    Job common;
-    BlockDriver *drv;
-    BlockdevCreateOptions *opts;
-} BlockdevCreateJob;
-
-static int coroutine_fn blockdev_create_run(Job *job, Error **errp)
-{
-    BlockdevCreateJob *s = container_of(job, BlockdevCreateJob, common);
-    int ret;
-
-    job_progress_set_remaining(&s->common, 1);
-    ret = s->drv->bdrv_co_create(s->opts, errp);
-    job_progress_update(&s->common, 1);
-
-    qapi_free_BlockdevCreateOptions(s->opts);
-
-    return ret;
-}
-
-static const JobDriver blockdev_create_job_driver = {
-    .instance_size = sizeof(BlockdevCreateJob),
-    .job_type      = JOB_TYPE_CREATE,
-    .run           = blockdev_create_run,
-};
-
-void qmp_blockdev_create(const char *job_id, BlockdevCreateOptions *options,
-                         Error **errp)
-{
-    BlockdevCreateJob *s;
-    const char *fmt = BlockdevDriver_str(options->driver);
-    BlockDriver *drv = bdrv_find_format(fmt);
-
-    /* If the driver is in the schema, we know that it exists. But it may not
-     * be whitelisted. */
-    assert(drv);
-    if (bdrv_uses_whitelist() && !bdrv_is_whitelisted(drv, false)) {
-        error_setg(errp, "Driver is not whitelisted");
-        return;
-    }
-
-    /* Error out if the driver doesn't support .bdrv_co_create */
-    if (!drv->bdrv_co_create) {
-        error_setg(errp, "Driver does not support blockdev-create");
-        return;
-    }
-
-    /* Create the block job */
-    /* TODO Running in the main context. Block drivers need to error out or add
-     * locking when they use a BDS in a different AioContext. */
-    s = job_create(job_id, &blockdev_create_job_driver, NULL,
-                   qemu_get_aio_context(), JOB_DEFAULT | JOB_MANUAL_DISMISS,
-                   NULL, NULL, errp);
-    if (!s) {
-        return;
-    }
-
-    s->drv = drv,
-    s->opts = QAPI_CLONE(BlockdevCreateOptions, options),
-
-    job_start(&s->common);
-}
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -21,15 +21,13 @@
 #include "qemu/osdep.h"

 #include "block/block_int.h"
-#include "block/qdict.h"
 #include "sysemu/block-backend.h"
 #include "crypto/block.h"
 #include "qapi/opts-visitor.h"
-#include "qapi/qapi-visit-crypto.h"
 #include "qapi/qobject-input-visitor.h"
+#include "qapi-visit.h"
 #include "qapi/error.h"
-#include "qemu/option.h"
-#include "crypto.h"
+#include "block/crypto.h"

 typedef struct BlockCrypto BlockCrypto;

@@ -71,6 +69,8 @@ static ssize_t block_crypto_read_func(QCryptoBlock *block,


 struct BlockCryptoCreateData {
+    const char *filename;
+    QemuOpts *opts;
    BlockBackend *blk;
    uint64_t size;
 };
@@ -101,18 +101,27 @@ static ssize_t block_crypto_init_func(QCryptoBlock *block,
                                      Error **errp)
 {
    struct BlockCryptoCreateData *data = opaque;
-
-    if (data->size > INT64_MAX || headerlen > INT64_MAX - data->size) {
-        error_setg(errp, "The requested file size is too large");
-        return -EFBIG;
-    }
+    int ret;

    /* User provided size should reflect amount of space made
     * available to the guest, so we must take account of that
     * which will be used by the crypto header
     */
-    return blk_truncate(data->blk, data->size + headerlen, PREALLOC_MODE_OFF,
-                        errp);
+    data->size += headerlen;
+
+    qemu_opt_set_number(data->opts, BLOCK_OPT_SIZE, data->size, &error_abort);
+    ret = bdrv_create_file(data->filename, data->opts, errp);
+    if (ret < 0) {
+        return -1;
+    }
+
+    data->blk = blk_new_open(data->filename, NULL, NULL,
+                             BDRV_O_RDWR | BDRV_O_PROTOCOL, errp);
+    if (!data->blk) {
+        return -1;
+    }
+
+    return 0;
 }


@@ -148,36 +157,102 @@ static QemuOptsList block_crypto_create_opts_luks = {


 QCryptoBlockOpenOptions *
-block_crypto_open_opts_init(QDict *opts, Error **errp)
+block_crypto_open_opts_init(QCryptoBlockFormat format,
+                            QDict *opts,
+                            Error **errp)
 {
    Visitor *v;
-    QCryptoBlockOpenOptions *ret;
+    QCryptoBlockOpenOptions *ret = NULL;
+    Error *local_err = NULL;

-    v = qobject_input_visitor_new_flat_confused(opts, errp);
-    if (!v) {
-        return NULL;
+    ret = g_new0(QCryptoBlockOpenOptions, 1);
+    ret->format = format;
+
+    v = qobject_input_visitor_new_keyval(QOBJECT(opts));
+
+    visit_start_struct(v, NULL, NULL, 0, &local_err);
+    if (local_err) {
+        goto out;
    }

-    visit_type_QCryptoBlockOpenOptions(v, NULL, &ret, errp);
+    switch (format) {
+    case Q_CRYPTO_BLOCK_FORMAT_LUKS:
+        visit_type_QCryptoBlockOptionsLUKS_members(
+            v, &ret->u.luks, &local_err);
+        break;

+    case Q_CRYPTO_BLOCK_FORMAT_QCOW:
+        visit_type_QCryptoBlockOptionsQCow_members(
+            v, &ret->u.qcow, &local_err);
+        break;
+
+    default:
+        error_setg(&local_err, "Unsupported block format %d", format);
+        break;
+    }
+    if (!local_err) {
+        visit_check_struct(v, &local_err);
+    }
+
+    visit_end_struct(v, NULL);
+
+ out:
+    if (local_err) {
+        error_propagate(errp, local_err);
+        qapi_free_QCryptoBlockOpenOptions(ret);
+        ret = NULL;
+    }
    visit_free(v);
    return ret;
 }


 QCryptoBlockCreateOptions *
-block_crypto_create_opts_init(QDict *opts, Error **errp)
+block_crypto_create_opts_init(QCryptoBlockFormat format,
+                              QDict *opts,
+                              Error **errp)
 {
    Visitor *v;
-    QCryptoBlockCreateOptions *ret;
+    QCryptoBlockCreateOptions *ret = NULL;
+    Error *local_err = NULL;

-    v = qobject_input_visitor_new_flat_confused(opts, errp);
-    if (!v) {
-        return NULL;
+    ret = g_new0(QCryptoBlockCreateOptions, 1);
+    ret->format = format;
+
+    v = qobject_input_visitor_new_keyval(QOBJECT(opts));
+
+    visit_start_struct(v, NULL, NULL, 0, &local_err);
+    if (local_err) {
+        goto out;
    }

-    visit_type_QCryptoBlockCreateOptions(v, NULL, &ret, errp);
+    switch (format) {
+    case Q_CRYPTO_BLOCK_FORMAT_LUKS:
+        visit_type_QCryptoBlockCreateOptionsLUKS_members(
+            v, &ret->u.luks, &local_err);
+        break;

+    case Q_CRYPTO_BLOCK_FORMAT_QCOW:
+        visit_type_QCryptoBlockOptionsQCow_members(
+            v, &ret->u.qcow, &local_err);
+        break;
+
+    default:
+        error_setg(&local_err, "Unsupported block format %d", format);
+        break;
+    }
+    if (!local_err) {
+        visit_check_struct(v, &local_err);
+    }
+
+    visit_end_struct(v, NULL);
+
+ out:
+    if (local_err) {
+        error_propagate(errp, local_err);
+        qapi_free_QCryptoBlockCreateOptions(ret);
+        ret = NULL;
+    }
    visit_free(v);
    return ret;
 }
@@ -204,9 +279,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
        return -EINVAL;
    }

-    bs->supported_write_flags = BDRV_REQ_FUA &
-        bs->file->bs->supported_write_flags;
-
    opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
@@ -215,9 +287,8 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
    }

    cryptoopts = qemu_opts_to_qdict(opts, NULL);
-    qdict_put_str(cryptoopts, "format", QCryptoBlockFormat_str(format));

-    open_opts = block_crypto_open_opts_init(cryptoopts, errp);
+    open_opts = block_crypto_open_opts_init(format, cryptoopts, errp);
    if (!open_opts) {
        goto cleanup;
    }
@@ -240,35 +311,36 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,

    ret = 0;
 cleanup:
-    qobject_unref(cryptoopts);
+    QDECREF(cryptoopts);
    qapi_free_QCryptoBlockOpenOptions(open_opts);
    return ret;
 }


-static int block_crypto_co_create_generic(BlockDriverState *bs,
-                                          int64_t size,
-                                          QCryptoBlockCreateOptions *opts,
-                                          Error **errp)
+static int block_crypto_create_generic(QCryptoBlockFormat format,
+                                       const char *filename,
+                                       QemuOpts *opts,
+                                       Error **errp)
 {
-    int ret;
-    BlockBackend *blk;
+    int ret = -EINVAL;
+    QCryptoBlockCreateOptions *create_opts = NULL;
    QCryptoBlock *crypto = NULL;
-    struct BlockCryptoCreateData data;
+    struct BlockCryptoCreateData data = {
+        .size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
+                         BDRV_SECTOR_SIZE),
+        .opts = opts,
+        .filename = filename,
+    };
+    QDict *cryptoopts;

-    blk = blk_new(BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL);
+    cryptoopts = qemu_opts_to_qdict(opts, NULL);

-    ret = blk_insert_bs(blk, bs, errp);
-    if (ret < 0) {
-        goto cleanup;
+    create_opts = block_crypto_create_opts_init(format, cryptoopts, errp);
+    if (!create_opts) {
+        return -1;
    }

-    data = (struct BlockCryptoCreateData) {
-        .blk = blk,
-        .size = size,
-    };
-
-    crypto = qcrypto_block_create(opts, NULL,
+    crypto = qcrypto_block_create(create_opts, NULL,
                                  block_crypto_init_func,
                                  block_crypto_write_func,
                                  &data,
@@ -281,27 +353,23 @@ static int block_crypto_co_create_generic(BlockDriverState *bs,

    ret = 0;
 cleanup:
+    QDECREF(cryptoopts);
    qcrypto_block_free(crypto);
-    blk_unref(blk);
+    blk_unref(data.blk);
+    qapi_free_QCryptoBlockCreateOptions(create_opts);
    return ret;
 }

-static int coroutine_fn
-block_crypto_co_truncate(BlockDriverState *bs, int64_t offset,
-                         PreallocMode prealloc, Error **errp)
+static int block_crypto_truncate(BlockDriverState *bs, int64_t offset,
+                                 PreallocMode prealloc, Error **errp)
 {
    BlockCrypto *crypto = bs->opaque;
-    uint64_t payload_offset =
+    size_t payload_offset =
        qcrypto_block_get_payload_offset(crypto->block);

-    if (payload_offset > INT64_MAX - offset) {
-        error_setg(errp, "The requested file size is too large");
-        return -EFBIG;
-    }
-
    offset += payload_offset;

-    return bdrv_co_truncate(bs->file, offset, prealloc, errp);
+    return bdrv_truncate(bs->file, offset, prealloc, errp);
 }

 static void block_crypto_close(BlockDriverState *bs)
@@ -310,72 +378,67 @@ static void block_crypto_close(BlockDriverState *bs)
    qcrypto_block_free(crypto->block);
 }

-static int block_crypto_reopen_prepare(BDRVReopenState *state,
-                                       BlockReopenQueue *queue, Error **errp)
-{
-    /* nothing needs checking */
-    return 0;
-}

-/*
- * 1 MB bounce buffer gives good performance / memory tradeoff
- * when using cache=none|directsync.
- */
-#define BLOCK_CRYPTO_MAX_IO_SIZE (1024 * 1024)
+#define BLOCK_CRYPTO_MAX_SECTORS 32

 static coroutine_fn int
-block_crypto_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
-                       QEMUIOVector *qiov, int flags)
+block_crypto_co_readv(BlockDriverState *bs, int64_t sector_num,
+                      int remaining_sectors, QEMUIOVector *qiov)
 {
    BlockCrypto *crypto = bs->opaque;
-    uint64_t cur_bytes; /* number of bytes in current iteration */
+    int cur_nr_sectors; /* number of sectors in current iteration */
    uint64_t bytes_done = 0;
    uint8_t *cipher_data = NULL;
    QEMUIOVector hd_qiov;
    int ret = 0;
-    uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
-    uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
-
-    assert(!flags);
-    assert(payload_offset < INT64_MAX);
-    assert(QEMU_IS_ALIGNED(offset, sector_size));
-    assert(QEMU_IS_ALIGNED(bytes, sector_size));
+    size_t payload_offset =
+        qcrypto_block_get_payload_offset(crypto->block) / 512;

    qemu_iovec_init(&hd_qiov, qiov->niov);

-    /* Bounce buffer because we don't wish to expose cipher text
-     * in qiov which points to guest memory.
+    /* Bounce buffer so we have a linear mem region for
+     * entire sector. XXX optimize so we avoid bounce
+     * buffer in case that qiov->niov == 1
     */
    cipher_data =
-        qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE,
+        qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_SECTORS * 512,
                                              qiov->size));
    if (cipher_data == NULL) {
        ret = -ENOMEM;
        goto cleanup;
    }

-    while (bytes) {
-        cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE);
+    while (remaining_sectors) {
+        cur_nr_sectors = remaining_sectors;
+
+        if (cur_nr_sectors > BLOCK_CRYPTO_MAX_SECTORS) {
+            cur_nr_sectors = BLOCK_CRYPTO_MAX_SECTORS;
+        }

        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes);
+        qemu_iovec_add(&hd_qiov, cipher_data, cur_nr_sectors * 512);

-        ret = bdrv_co_preadv(bs->file, payload_offset + offset + bytes_done,
-                             cur_bytes, &hd_qiov, 0);
+        ret = bdrv_co_readv(bs->file,
+                            payload_offset + sector_num,
+                            cur_nr_sectors, &hd_qiov);
        if (ret < 0) {
            goto cleanup;
        }

-        if (qcrypto_block_decrypt(crypto->block, offset + bytes_done,
-                                  cipher_data, cur_bytes, NULL) < 0) {
+        if (qcrypto_block_decrypt(crypto->block,
+                                  sector_num,
+                                  cipher_data, cur_nr_sectors * 512,
+                                  NULL) < 0) {
            ret = -EIO;
            goto cleanup;
        }

-        qemu_iovec_from_buf(qiov, bytes_done, cipher_data, cur_bytes);
+        qemu_iovec_from_buf(qiov, bytes_done,
+                            cipher_data, cur_nr_sectors * 512);

-        bytes -= cur_bytes;
-        bytes_done += cur_bytes;
+        remaining_sectors -= cur_nr_sectors;
+        sector_num += cur_nr_sectors;
+        bytes_done += cur_nr_sectors * 512;
    }

 cleanup:
@@ -387,58 +450,63 @@ block_crypto_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,


 static coroutine_fn int
-block_crypto_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
-                        QEMUIOVector *qiov, int flags)
+block_crypto_co_writev(BlockDriverState *bs, int64_t sector_num,
+                       int remaining_sectors, QEMUIOVector *qiov)
 {
    BlockCrypto *crypto = bs->opaque;
-    uint64_t cur_bytes; /* number of bytes in current iteration */
+    int cur_nr_sectors; /* number of sectors in current iteration */
    uint64_t bytes_done = 0;
    uint8_t *cipher_data = NULL;
    QEMUIOVector hd_qiov;
    int ret = 0;
-    uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
-    uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
-
-    assert(!(flags & ~BDRV_REQ_FUA));
-    assert(payload_offset < INT64_MAX);
-    assert(QEMU_IS_ALIGNED(offset, sector_size));
-    assert(QEMU_IS_ALIGNED(bytes, sector_size));
+    size_t payload_offset =
+        qcrypto_block_get_payload_offset(crypto->block) / 512;

    qemu_iovec_init(&hd_qiov, qiov->niov);

-    /* Bounce buffer because we're not permitted to touch
-     * contents of qiov - it points to guest memory.
+    /* Bounce buffer so we have a linear mem region for
+     * entire sector. XXX optimize so we avoid bounce
+     * buffer in case that qiov->niov == 1
     */
    cipher_data =
-        qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_IO_SIZE,
+        qemu_try_blockalign(bs->file->bs, MIN(BLOCK_CRYPTO_MAX_SECTORS * 512,
                                              qiov->size));
    if (cipher_data == NULL) {
        ret = -ENOMEM;
        goto cleanup;
    }

-    while (bytes) {
-        cur_bytes = MIN(bytes, BLOCK_CRYPTO_MAX_IO_SIZE);
+    while (remaining_sectors) {
+        cur_nr_sectors = remaining_sectors;

-        qemu_iovec_to_buf(qiov, bytes_done, cipher_data, cur_bytes);
+        if (cur_nr_sectors > BLOCK_CRYPTO_MAX_SECTORS) {
+            cur_nr_sectors = BLOCK_CRYPTO_MAX_SECTORS;
+        }

-        if (qcrypto_block_encrypt(crypto->block, offset + bytes_done,
-                                  cipher_data, cur_bytes, NULL) < 0) {
+        qemu_iovec_to_buf(qiov, bytes_done,
+                          cipher_data, cur_nr_sectors * 512);
+
+        if (qcrypto_block_encrypt(crypto->block,
+                                  sector_num,
+                                  cipher_data, cur_nr_sectors * 512,
+                                  NULL) < 0) {
            ret = -EIO;
            goto cleanup;
        }

        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_add(&hd_qiov, cipher_data, cur_bytes);
+        qemu_iovec_add(&hd_qiov, cipher_data, cur_nr_sectors * 512);

-        ret = bdrv_co_pwritev(bs->file, payload_offset + offset + bytes_done,
-                              cur_bytes, &hd_qiov, flags);
+        ret = bdrv_co_writev(bs->file,
+                             payload_offset + sector_num,
+                             cur_nr_sectors, &hd_qiov);
        if (ret < 0) {
            goto cleanup;
        }

-        bytes -= cur_bytes;
-        bytes_done += cur_bytes;
+        remaining_sectors -= cur_nr_sectors;
+        sector_num += cur_nr_sectors;
+        bytes_done += cur_nr_sectors * 512;
    }

 cleanup:
@@ -448,25 +516,13 @@ block_crypto_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    return ret;
 }

-static void block_crypto_refresh_limits(BlockDriverState *bs, Error **errp)
-{
-    BlockCrypto *crypto = bs->opaque;
-    uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
-    bs->bl.request_alignment = sector_size; /* No sub-sector I/O */
-}
-

 static int64_t block_crypto_getlength(BlockDriverState *bs)
 {
    BlockCrypto *crypto = bs->opaque;
    int64_t len = bdrv_getlength(bs->file->bs);

-    uint64_t offset = qcrypto_block_get_payload_offset(crypto->block);
-    assert(offset < INT64_MAX);
-
-    if (offset > len) {
-        return -EIO;
-    }
+    ssize_t offset = qcrypto_block_get_payload_offset(crypto->block);

    len -= offset;

@@ -491,88 +547,12 @@ static int block_crypto_open_luks(BlockDriverState *bs,
                                     bs, options, flags, errp);
 }

-static int coroutine_fn
-block_crypto_co_create_luks(BlockdevCreateOptions *create_options, Error **errp)
+static int block_crypto_create_luks(const char *filename,
+                                    QemuOpts *opts,
+                                    Error **errp)
 {
-    BlockdevCreateOptionsLUKS *luks_opts;
-    BlockDriverState *bs = NULL;
-    QCryptoBlockCreateOptions create_opts;
-    int ret;
-
-    assert(create_options->driver == BLOCKDEV_DRIVER_LUKS);
-    luks_opts = &create_options->u.luks;
-
-    bs = bdrv_open_blockdev_ref(luks_opts->file, errp);
-    if (bs == NULL) {
-        return -EIO;
-    }
-
-    create_opts = (QCryptoBlockCreateOptions) {
-        .format = Q_CRYPTO_BLOCK_FORMAT_LUKS,
-        .u.luks = *qapi_BlockdevCreateOptionsLUKS_base(luks_opts),
-    };
-
-    ret = block_crypto_co_create_generic(bs, luks_opts->size, &create_opts,
-                                         errp);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    ret = 0;
-fail:
-    bdrv_unref(bs);
-    return ret;
-}
-
-static int coroutine_fn block_crypto_co_create_opts_luks(const char *filename,
-                                                         QemuOpts *opts,
-                                                         Error **errp)
-{
-    QCryptoBlockCreateOptions *create_opts = NULL;
-    BlockDriverState *bs = NULL;
-    QDict *cryptoopts;
-    int64_t size;
-    int ret;
-
-    /* Parse options */
-    size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-
-    cryptoopts = qemu_opts_to_qdict_filtered(opts, NULL,
-                                             &block_crypto_create_opts_luks,
-                                             true);
-
-    qdict_put_str(cryptoopts, "format", "luks");
-    create_opts = block_crypto_create_opts_init(cryptoopts, errp);
-    if (!create_opts) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    /* Create protocol layer */
-    ret = bdrv_create_file(filename, opts, errp);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    bs = bdrv_open(filename, NULL, NULL,
-                   BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
-    if (!bs) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    /* Create format layer */
-    ret = block_crypto_co_create_generic(bs, size, create_opts, errp);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    ret = 0;
-fail:
-    bdrv_unref(bs);
-    qapi_free_QCryptoBlockCreateOptions(create_opts);
-    qobject_unref(cryptoopts);
-    return ret;
+    return block_crypto_create_generic(Q_CRYPTO_BLOCK_FORMAT_LUKS,
+                                       filename, opts, errp);
 }

 static int block_crypto_get_info_luks(BlockDriverState *bs,
@@ -587,6 +567,7 @@ static int block_crypto_get_info_luks(BlockDriverState *bs,
    }

    bdi->unallocated_blocks_are_zero = false;
+    bdi->can_write_zeroes_with_unmap = false;
    bdi->cluster_size = subbdi.cluster_size;

    return 0;
@@ -627,18 +608,13 @@ BlockDriver bdrv_crypto_luks = {
    .bdrv_probe         = block_crypto_probe_luks,
    .bdrv_open          = block_crypto_open_luks,
    .bdrv_close         = block_crypto_close,
-    /* This driver doesn't modify LUKS metadata except when creating image.
-     * Allow share-rw=on as a special case. */
-    .bdrv_child_perm    = bdrv_filter_default_perms,
-    .bdrv_co_create     = block_crypto_co_create_luks,
-    .bdrv_co_create_opts = block_crypto_co_create_opts_luks,
-    .bdrv_co_truncate   = block_crypto_co_truncate,
+    .bdrv_child_perm    = bdrv_format_default_perms,
+    .bdrv_create        = block_crypto_create_luks,
+    .bdrv_truncate      = block_crypto_truncate,
    .create_opts        = &block_crypto_create_opts_luks,

-    .bdrv_reopen_prepare = block_crypto_reopen_prepare,
-    .bdrv_refresh_limits = block_crypto_refresh_limits,
-    .bdrv_co_preadv     = block_crypto_co_preadv,
-    .bdrv_co_pwritev    = block_crypto_co_pwritev,
+    .bdrv_co_readv      = block_crypto_co_readv,
+    .bdrv_co_writev     = block_crypto_co_writev,
    .bdrv_getlength     = block_crypto_getlength,
    .bdrv_get_info      = block_crypto_get_info_luks,
    .bdrv_get_specific_info = block_crypto_get_specific_info_luks,
--- a/block/crypto.h
+++ b/block/crypto.h
@@ -89,9 +89,13 @@
    }

 QCryptoBlockCreateOptions *
-block_crypto_create_opts_init(QDict *opts, Error **errp);
+block_crypto_create_opts_init(QCryptoBlockFormat format,
+                              QDict *opts,
+                              Error **errp);

 QCryptoBlockOpenOptions *
-block_crypto_open_opts_init(QDict *opts, Error **errp);
+block_crypto_open_opts_init(QCryptoBlockFormat format,
+                            QDict *opts,
+                            Error **errp);

 #endif /* BLOCK_CRYPTO_H__ */
--- a/block/curl.c
+++ b/block/curl.c
@@ -21,13 +21,12 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
-
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "qemu-common.h"
 #include "qemu/error-report.h"
-#include "qemu/option.h"
 #include "block/block_int.h"
-#include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qstring.h"
 #include "crypto/secret.h"
 #include <curl/curl.h>
@@ -90,8 +89,6 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,

 struct BDRVCURLState;

-static bool libcurl_initialized;
-
 typedef struct CURLAIOCB {
    Coroutine *co;
    QEMUIOVector *qiov;
@@ -102,6 +99,8 @@ typedef struct CURLAIOCB {

    size_t start;
    size_t end;
+
+    QSIMPLEQ_ENTRY(CURLAIOCB) next;
 } CURLAIOCB;

 typedef struct CURLSocket {
@@ -137,7 +136,7 @@ typedef struct BDRVCURLState {
    bool accept_range;
    AioContext *aio_context;
    QemuMutex mutex;
-    CoQueue free_state_waitq;
+    QSIMPLEQ_HEAD(, CURLAIOCB) free_state_waitq;
    char *username;
    char *password;
    char *proxyusername;
@@ -483,8 +482,6 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
                         (long) s->sslverify);
-        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,
-                         s->sslverify ? 2L : 0L);
        if (s->cookie) {
            curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie);
        }
@@ -539,6 +536,7 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
 /* Called with s->mutex held.  */
 static void curl_clean_state(CURLState *s)
 {
+    CURLAIOCB *next;
    int j;
    for (j = 0; j < CURL_NUM_ACB; j++) {
        assert(!s->acb[j]);
@@ -556,7 +554,13 @@ static void curl_clean_state(CURLState *s)

    s->in_use = 0;

-    qemu_co_enter_next(&s->s->free_state_waitq, &s->s->mutex);
+    next = QSIMPLEQ_FIRST(&s->s->free_state_waitq);
+    if (next) {
+        QSIMPLEQ_REMOVE_HEAD(&s->s->free_state_waitq, next);
+        qemu_mutex_unlock(&s->s->mutex);
+        aio_co_wake(next->co);
+        qemu_mutex_lock(&s->s->mutex);
+    }
 }

 static void curl_parse_filename(const char *filename, QDict *options,
@@ -682,21 +686,12 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    double d;
    const char *secretid;
    const char *protocol_delimiter;
-    int ret;

-    ret = bdrv_apply_auto_read_only(bs, "curl driver does not support writes",
-                                    errp);
-    if (ret < 0) {
-        return ret;
-    }
+    static int inited = 0;

-    if (!libcurl_initialized) {
-        ret = curl_global_init(CURL_GLOBAL_ALL);
-        if (ret) {
-            error_setg(errp, "libcurl initialization failed with %d", ret);
-            return -EIO;
-        }
-        libcurl_initialized = true;
+    if (flags & BDRV_O_RDWR) {
+        error_setg(errp, "curl block device does not support writes");
+        return -EROFS;
    }

    qemu_mutex_init(&s->mutex);
@@ -777,8 +772,13 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
        }
    }

+    if (!inited) {
+        curl_global_init(CURL_GLOBAL_ALL);
+        inited = 1;
+    }
+
    DPRINTF("CURL: Opening %s\n", file);
-    qemu_co_queue_init(&s->free_state_waitq);
+    QSIMPLEQ_INIT(&s->free_state_waitq);
    s->aio_context = bdrv_get_aio_context(bs);
    s->url = g_strdup(file);
    qemu_mutex_lock(&s->mutex);
@@ -806,7 +806,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }
    /* Prior CURL 7.19.4 return value of 0 could mean that the file size is not
     * know or the size is zero. From 7.19.4 CURL returns -1 if size is not
-     * known and zero if it is really zero-length file. */
+     * known and zero if it is realy zero-length file. */
 #if LIBCURL_VERSION_NUM >= 0x071304
    if (d < 0) {
        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
@@ -851,9 +851,6 @@ out_noclean:
    qemu_mutex_destroy(&s->mutex);
    g_free(s->cookie);
    g_free(s->url);
-    g_free(s->username);
-    g_free(s->proxyusername);
-    g_free(s->proxypassword);
    qemu_opts_del(opts);
    return -EINVAL;
 }
@@ -882,7 +879,10 @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
        if (state) {
            break;
        }
-        qemu_co_queue_wait(&s->free_state_waitq, &s->mutex);
+        QSIMPLEQ_INSERT_TAIL(&s->free_state_waitq, acb, next);
+        qemu_mutex_unlock(&s->mutex);
+        qemu_coroutine_yield();
+        qemu_mutex_lock(&s->mutex);
    }

    if (curl_init_state(s, state) < 0) {
@@ -949,9 +949,6 @@ static void curl_close(BlockDriverState *bs)

    g_free(s->cookie);
    g_free(s->url);
-    g_free(s->username);
-    g_free(s->proxyusername);
-    g_free(s->proxypassword);
 }

 static int64_t curl_getlength(BlockDriverState *bs)
--- a/block/dirty-bitmap.c
+++ b/block/dirty-bitmap.c
@@ -1,7 +1,7 @@
 /*
 * Block Dirty Bitmap
 *
- * Copyright (c) 2016-2017 Red Hat. Inc
+ * Copyright (c) 2016 Red Hat. Inc
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -38,13 +38,11 @@
 */
 struct BdrvDirtyBitmap {
    QemuMutex *mutex;
-    HBitmap *bitmap;            /* Dirty bitmap implementation */
+    HBitmap *bitmap;            /* Dirty sector bitmap implementation */
    HBitmap *meta;              /* Meta dirty bitmap */
-    bool qmp_locked;            /* Bitmap is locked, it can't be modified
-                                   through QMP */
    BdrvDirtyBitmap *successor; /* Anonymous child; implies frozen status */
    char *name;                 /* Optional non-empty unique ID */
-    int64_t size;               /* Size of the bitmap, in bytes */
+    int64_t size;               /* Size of the bitmap (Number of sectors) */
    bool disabled;              /* Bitmap is disabled. It ignores all writes to
                                   the device */
    int active_iterators;       /* How many iterators are active */
@@ -54,11 +52,9 @@ struct BdrvDirtyBitmap {
                                   Such operations must fail and both the image
                                   and this bitmap must remain unchanged while
                                   this flag is set. */
+    bool autoload;              /* For persistent bitmaps: bitmap must be
+                                   autoloaded on image opening */
    bool persistent;            /* bitmap must be saved to owner disk image */
-    bool migration;             /* Bitmap is selected for migration, it should
-                                   not be stored on the next inactivation
-                                   (persistent flag doesn't matter until next
-                                   invalidation).*/
    QLIST_ENTRY(BdrvDirtyBitmap) list;
 };

@@ -101,6 +97,16 @@ BdrvDirtyBitmap *bdrv_find_dirty_bitmap(BlockDriverState *bs, const char *name)
    return NULL;
 }

+/* Called with BQL taken.  */
+void bdrv_dirty_bitmap_make_anon(BdrvDirtyBitmap *bitmap)
+{
+    assert(!bdrv_dirty_bitmap_frozen(bitmap));
+    g_free(bitmap->name);
+    bitmap->name = NULL;
+    bitmap->persistent = false;
+    bitmap->autoload = false;
+}
+
 /* Called with BQL taken.  */
 BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
                                          uint32_t granularity,
@@ -109,14 +115,17 @@ BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
 {
    int64_t bitmap_size;
    BdrvDirtyBitmap *bitmap;
+    uint32_t sector_granularity;

-    assert(is_power_of_2(granularity) && granularity >= BDRV_SECTOR_SIZE);
+    assert((granularity & (granularity - 1)) == 0);

    if (name && bdrv_find_dirty_bitmap(bs, name)) {
        error_setg(errp, "Bitmap already exists: %s", name);
        return NULL;
    }
-    bitmap_size = bdrv_getlength(bs);
+    sector_granularity = granularity >> BDRV_SECTOR_BITS;
+    assert(sector_granularity);
+    bitmap_size = bdrv_nb_sectors(bs);
    if (bitmap_size < 0) {
        error_setg_errno(errp, -bitmap_size, "could not get length of device");
        errno = -bitmap_size;
@@ -124,7 +133,7 @@ BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
    }
    bitmap = g_new0(BdrvDirtyBitmap, 1);
    bitmap->mutex = &bs->dirty_bitmap_mutex;
-    bitmap->bitmap = hbitmap_alloc(bitmap_size, ctz32(granularity));
+    bitmap->bitmap = hbitmap_alloc(bitmap_size, ctz32(sector_granularity));
    bitmap->size = bitmap_size;
    bitmap->name = g_strdup(name);
    bitmap->disabled = false;
@@ -164,6 +173,45 @@ void bdrv_release_meta_dirty_bitmap(BdrvDirtyBitmap *bitmap)
    qemu_mutex_unlock(bitmap->mutex);
 }

+int bdrv_dirty_bitmap_get_meta_locked(BlockDriverState *bs,
+                                      BdrvDirtyBitmap *bitmap, int64_t sector,
+                                      int nb_sectors)
+{
+    uint64_t i;
+    int sectors_per_bit = 1 << hbitmap_granularity(bitmap->meta);
+
+    /* To optimize: we can make hbitmap to internally check the range in a
+     * coarse level, or at least do it word by word. */
+    for (i = sector; i < sector + nb_sectors; i += sectors_per_bit) {
+        if (hbitmap_get(bitmap->meta, i)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+int bdrv_dirty_bitmap_get_meta(BlockDriverState *bs,
+                               BdrvDirtyBitmap *bitmap, int64_t sector,
+                               int nb_sectors)
+{
+    bool dirty;
+
+    qemu_mutex_lock(bitmap->mutex);
+    dirty = bdrv_dirty_bitmap_get_meta_locked(bs, bitmap, sector, nb_sectors);
+    qemu_mutex_unlock(bitmap->mutex);
+
+    return dirty;
+}
+
+void bdrv_dirty_bitmap_reset_meta(BlockDriverState *bs,
+                                  BdrvDirtyBitmap *bitmap, int64_t sector,
+                                  int nb_sectors)
+{
+    qemu_mutex_lock(bitmap->mutex);
+    hbitmap_reset(bitmap->meta, sector, nb_sectors);
+    qemu_mutex_unlock(bitmap->mutex);
+}
+
 int64_t bdrv_dirty_bitmap_size(const BdrvDirtyBitmap *bitmap)
 {
    return bitmap->size;
@@ -180,24 +228,6 @@ bool bdrv_dirty_bitmap_frozen(BdrvDirtyBitmap *bitmap)
    return bitmap->successor;
 }

-/* Both conditions disallow user-modification via QMP. */
-bool bdrv_dirty_bitmap_user_locked(BdrvDirtyBitmap *bitmap) {
-    return bdrv_dirty_bitmap_frozen(bitmap) ||
-           bdrv_dirty_bitmap_qmp_locked(bitmap);
-}
-
-void bdrv_dirty_bitmap_set_qmp_locked(BdrvDirtyBitmap *bitmap, bool qmp_locked)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    bitmap->qmp_locked = qmp_locked;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-bool bdrv_dirty_bitmap_qmp_locked(BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->qmp_locked;
-}
-
 /* Called with BQL taken.  */
 bool bdrv_dirty_bitmap_enabled(BdrvDirtyBitmap *bitmap)
 {
@@ -209,8 +239,6 @@ DirtyBitmapStatus bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap)
 {
    if (bdrv_dirty_bitmap_frozen(bitmap)) {
        return DIRTY_BITMAP_STATUS_FROZEN;
-    } else if (bdrv_dirty_bitmap_qmp_locked(bitmap)) {
-        return DIRTY_BITMAP_STATUS_LOCKED;
    } else if (!bdrv_dirty_bitmap_enabled(bitmap)) {
        return DIRTY_BITMAP_STATUS_DISABLED;
    } else {
@@ -251,33 +279,6 @@ int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,
    return 0;
 }

-void bdrv_enable_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap)
-{
-    assert(!bdrv_dirty_bitmap_frozen(bitmap));
-    bitmap->disabled = false;
-}
-
-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_enable_successor(BdrvDirtyBitmap *bitmap)
-{
-    assert(bitmap->mutex == bitmap->successor->mutex);
-    qemu_mutex_lock(bitmap->mutex);
-    bdrv_enable_dirty_bitmap_locked(bitmap->successor);
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-/* Called within bdrv_dirty_bitmap_lock..unlock and with BQL taken.  */
-static void bdrv_release_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap)
-{
-    assert(!bitmap->active_iterators);
-    assert(!bdrv_dirty_bitmap_frozen(bitmap));
-    assert(!bitmap->meta);
-    QLIST_REMOVE(bitmap, list);
-    hbitmap_free(bitmap->bitmap);
-    g_free(bitmap->name);
-    g_free(bitmap);
-}
-
 /**
 * For a bitmap with a successor, yield our name to the successor,
 * delete the old bitmap, and return a handle to the new bitmap.
@@ -302,6 +303,8 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
    bitmap->successor = NULL;
    successor->persistent = bitmap->persistent;
    bitmap->persistent = false;
+    successor->autoload = bitmap->autoload;
+    bitmap->autoload = false;
    bdrv_release_dirty_bitmap(bs, bitmap);

    return successor;
@@ -311,11 +314,11 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
 * In cases of failure where we can no longer safely delete the parent,
 * we may wish to re-join the parent and child/successor.
 * The merged parent will be un-frozen, but not explicitly re-enabled.
- * Called within bdrv_dirty_bitmap_lock..unlock and with BQL taken.
+ * Called with BQL taken.
 */
-BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BlockDriverState *bs,
-                                                  BdrvDirtyBitmap *parent,
-                                                  Error **errp)
+BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap(BlockDriverState *bs,
+                                           BdrvDirtyBitmap *parent,
+                                           Error **errp)
 {
    BdrvDirtyBitmap *successor = parent->successor;

@@ -324,54 +327,74 @@ BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BlockDriverState *bs,
        return NULL;
    }

-    if (!hbitmap_merge(parent->bitmap, successor->bitmap, parent->bitmap)) {
+    if (!hbitmap_merge(parent->bitmap, successor->bitmap)) {
        error_setg(errp, "Merging of parent and successor bitmap failed");
        return NULL;
    }
-    bdrv_release_dirty_bitmap_locked(successor);
+    bdrv_release_dirty_bitmap(bs, successor);
    parent->successor = NULL;

    return parent;
 }

-/* Called with BQL taken. */
-BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap(BlockDriverState *bs,
-                                           BdrvDirtyBitmap *parent,
-                                           Error **errp)
-{
-    BdrvDirtyBitmap *ret;
-
-    qemu_mutex_lock(parent->mutex);
-    ret = bdrv_reclaim_dirty_bitmap_locked(bs, parent, errp);
-    qemu_mutex_unlock(parent->mutex);
-
-    return ret;
-}
-
 /**
 * Truncates _all_ bitmaps attached to a BDS.
 * Called with BQL taken.
 */
-void bdrv_dirty_bitmap_truncate(BlockDriverState *bs, int64_t bytes)
+void bdrv_dirty_bitmap_truncate(BlockDriverState *bs)
 {
    BdrvDirtyBitmap *bitmap;
+    uint64_t size = bdrv_nb_sectors(bs);

    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {
        assert(!bdrv_dirty_bitmap_frozen(bitmap));
        assert(!bitmap->active_iterators);
-        hbitmap_truncate(bitmap->bitmap, bytes);
-        bitmap->size = bytes;
+        hbitmap_truncate(bitmap->bitmap, size);
+        bitmap->size = size;
    }
    bdrv_dirty_bitmaps_unlock(bs);
 }

+static bool bdrv_dirty_bitmap_has_name(BdrvDirtyBitmap *bitmap)
+{
+    return !!bdrv_dirty_bitmap_name(bitmap);
+}
+
+/* Called with BQL taken.  */
+static void bdrv_do_release_matching_dirty_bitmap(
+    BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
+    bool (*cond)(BdrvDirtyBitmap *bitmap))
+{
+    BdrvDirtyBitmap *bm, *next;
+    bdrv_dirty_bitmaps_lock(bs);
+    QLIST_FOREACH_SAFE(bm, &bs->dirty_bitmaps, list, next) {
+        if ((!bitmap || bm == bitmap) && (!cond || cond(bm))) {
+            assert(!bm->active_iterators);
+            assert(!bdrv_dirty_bitmap_frozen(bm));
+            assert(!bm->meta);
+            QLIST_REMOVE(bm, list);
+            hbitmap_free(bm->bitmap);
+            g_free(bm->name);
+            g_free(bm);
+
+            if (bitmap) {
+                goto out;
+            }
+        }
+    }
+    if (bitmap) {
+        abort();
+    }
+
+out:
+    bdrv_dirty_bitmaps_unlock(bs);
+}
+
 /* Called with BQL taken.  */
 void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)
 {
-    bdrv_dirty_bitmaps_lock(bs);
-    bdrv_release_dirty_bitmap_locked(bitmap);
-    bdrv_dirty_bitmaps_unlock(bs);
+    bdrv_do_release_matching_dirty_bitmap(bs, bitmap, NULL);
 }

 /**
@@ -382,15 +405,19 @@ void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)
 */
 void bdrv_release_named_dirty_bitmaps(BlockDriverState *bs)
 {
-    BdrvDirtyBitmap *bm, *next;
+    bdrv_do_release_matching_dirty_bitmap(bs, NULL, bdrv_dirty_bitmap_has_name);
+}

-    bdrv_dirty_bitmaps_lock(bs);
-    QLIST_FOREACH_SAFE(bm, &bs->dirty_bitmaps, list, next) {
-        if (bdrv_dirty_bitmap_name(bm)) {
-            bdrv_release_dirty_bitmap_locked(bm);
-        }
-    }
-    bdrv_dirty_bitmaps_unlock(bs);
+/**
+ * Release all persistent dirty bitmaps attached to a BDS (for use in
+ * bdrv_inactivate_recurse()).
+ * There must not be any frozen bitmaps attached.
+ * This function does not remove persistent bitmaps from the storage.
+ */
+void bdrv_release_persistent_dirty_bitmaps(BlockDriverState *bs)
+{
+    bdrv_do_release_matching_dirty_bitmap(bs, NULL,
+                                          bdrv_dirty_bitmap_get_persistance);
 }

 /**
@@ -410,19 +437,18 @@ void bdrv_remove_persistent_dirty_bitmap(BlockDriverState *bs,
    }
 }

+/* Called with BQL taken.  */
 void bdrv_disable_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
-    bdrv_dirty_bitmap_lock(bitmap);
    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    bitmap->disabled = true;
-    bdrv_dirty_bitmap_unlock(bitmap);
 }

+/* Called with BQL taken.  */
 void bdrv_enable_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
-    bdrv_dirty_bitmap_lock(bitmap);
-    bdrv_enable_dirty_bitmap_locked(bitmap);
-    bdrv_dirty_bitmap_unlock(bitmap);
+    assert(!bdrv_dirty_bitmap_frozen(bitmap));
+    bitmap->disabled = false;
 }

 BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
@@ -435,7 +461,7 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
    QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
        BlockDirtyInfo *info = g_new0(BlockDirtyInfo, 1);
        BlockDirtyInfoList *entry = g_new0(BlockDirtyInfoList, 1);
-        info->count = bdrv_get_dirty_count(bm);
+        info->count = bdrv_get_dirty_count(bm) << BDRV_SECTOR_BITS;
        info->granularity = bdrv_dirty_bitmap_granularity(bm);
        info->has_name = !!bm->name;
        info->name = g_strdup(bm->name);
@@ -450,13 +476,13 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
 }

 /* Called within bdrv_dirty_bitmap_lock..unlock */
-bool bdrv_get_dirty_locked(BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
-                           int64_t offset)
+int bdrv_get_dirty_locked(BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
+                          int64_t sector)
 {
    if (bitmap) {
-        return hbitmap_get(bitmap->bitmap, offset);
+        return hbitmap_get(bitmap->bitmap, sector);
    } else {
-        return false;
+        return 0;
    }
 }

@@ -482,13 +508,19 @@ uint32_t bdrv_get_default_bitmap_granularity(BlockDriverState *bs)

 uint32_t bdrv_dirty_bitmap_granularity(const BdrvDirtyBitmap *bitmap)
 {
-    return 1U << hbitmap_granularity(bitmap->bitmap);
+    return BDRV_SECTOR_SIZE << hbitmap_granularity(bitmap->bitmap);
 }

-BdrvDirtyBitmapIter *bdrv_dirty_iter_new(BdrvDirtyBitmap *bitmap)
+uint32_t bdrv_dirty_bitmap_meta_granularity(BdrvDirtyBitmap *bitmap)
+{
+    return BDRV_SECTOR_SIZE << hbitmap_granularity(bitmap->meta);
+}
+
+BdrvDirtyBitmapIter *bdrv_dirty_iter_new(BdrvDirtyBitmap *bitmap,
+                                         uint64_t first_sector)
 {
    BdrvDirtyBitmapIter *iter = g_new(BdrvDirtyBitmapIter, 1);
-    hbitmap_iter_init(&iter->hbi, bitmap->bitmap, 0);
+    hbitmap_iter_init(&iter->hbi, bitmap->bitmap, first_sector);
    iter->bitmap = bitmap;
    bitmap->active_iterators++;
    return iter;
@@ -515,100 +547,46 @@ void bdrv_dirty_iter_free(BdrvDirtyBitmapIter *iter)

 int64_t bdrv_dirty_iter_next(BdrvDirtyBitmapIter *iter)
 {
-    return hbitmap_iter_next(&iter->hbi, true);
-}
-
-/**
- * Return the next consecutively dirty area in the dirty bitmap
- * belonging to the given iterator @iter.
- *
- * @max_offset: Maximum value that may be returned for
- *              *offset + *bytes
- * @offset:     Will contain the start offset of the next dirty area
- * @bytes:      Will contain the length of the next dirty area
- *
- * Returns: True if a dirty area could be found before max_offset
- *          (which means that *offset and *bytes then contain valid
- *          values), false otherwise.
- *
- * Note that @iter is never advanced if false is returned.  If an area
- * is found (which means that true is returned), it will be advanced
- * past that area.
- */
-bool bdrv_dirty_iter_next_area(BdrvDirtyBitmapIter *iter, uint64_t max_offset,
-                               uint64_t *offset, int *bytes)
-{
-    uint32_t granularity = bdrv_dirty_bitmap_granularity(iter->bitmap);
-    uint64_t gran_max_offset;
-    int64_t ret;
-    int size;
-
-    if (max_offset == iter->bitmap->size) {
-        /* If max_offset points to the image end, round it up by the
-         * bitmap granularity */
-        gran_max_offset = ROUND_UP(max_offset, granularity);
-    } else {
-        gran_max_offset = max_offset;
-    }
-
-    ret = hbitmap_iter_next(&iter->hbi, false);
-    if (ret < 0 || ret + granularity > gran_max_offset) {
-        return false;
-    }
-
-    *offset = ret;
-    size = 0;
-
-    assert(granularity <= INT_MAX);
-
-    do {
-        /* Advance iterator */
-        ret = hbitmap_iter_next(&iter->hbi, true);
-        size += granularity;
-    } while (ret + granularity <= gran_max_offset &&
-             hbitmap_iter_next(&iter->hbi, false) == ret + granularity &&
-             size <= INT_MAX - granularity);
-
-    *bytes = MIN(size, max_offset - *offset);
-    return true;
+    return hbitmap_iter_next(&iter->hbi);
 }

 /* Called within bdrv_dirty_bitmap_lock..unlock */
 void bdrv_set_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
-                                  int64_t offset, int64_t bytes)
+                                  int64_t cur_sector, int64_t nr_sectors)
 {
    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    hbitmap_set(bitmap->bitmap, offset, bytes);
+    hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);
 }

 void bdrv_set_dirty_bitmap(BdrvDirtyBitmap *bitmap,
-                           int64_t offset, int64_t bytes)
+                           int64_t cur_sector, int64_t nr_sectors)
 {
    bdrv_dirty_bitmap_lock(bitmap);
-    bdrv_set_dirty_bitmap_locked(bitmap, offset, bytes);
+    bdrv_set_dirty_bitmap_locked(bitmap, cur_sector, nr_sectors);
    bdrv_dirty_bitmap_unlock(bitmap);
 }

 /* Called within bdrv_dirty_bitmap_lock..unlock */
 void bdrv_reset_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
-                                    int64_t offset, int64_t bytes)
+                                    int64_t cur_sector, int64_t nr_sectors)
 {
    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    hbitmap_reset(bitmap->bitmap, offset, bytes);
+    hbitmap_reset(bitmap->bitmap, cur_sector, nr_sectors);
 }

 void bdrv_reset_dirty_bitmap(BdrvDirtyBitmap *bitmap,
-                             int64_t offset, int64_t bytes)
+                             int64_t cur_sector, int64_t nr_sectors)
 {
    bdrv_dirty_bitmap_lock(bitmap);
-    bdrv_reset_dirty_bitmap_locked(bitmap, offset, bytes);
+    bdrv_reset_dirty_bitmap_locked(bitmap, cur_sector, nr_sectors);
    bdrv_dirty_bitmap_unlock(bitmap);
 }

 void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
 {
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    bdrv_dirty_bitmap_lock(bitmap);
    if (!out) {
@@ -622,52 +600,52 @@ void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
    bdrv_dirty_bitmap_unlock(bitmap);
 }

-void bdrv_restore_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *backup)
+void bdrv_undo_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *in)
 {
    HBitmap *tmp = bitmap->bitmap;
    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    bitmap->bitmap = backup;
+    bitmap->bitmap = in;
    hbitmap_free(tmp);
 }

 uint64_t bdrv_dirty_bitmap_serialization_size(const BdrvDirtyBitmap *bitmap,
-                                              uint64_t offset, uint64_t bytes)
+                                              uint64_t start, uint64_t count)
 {
-    return hbitmap_serialization_size(bitmap->bitmap, offset, bytes);
+    return hbitmap_serialization_size(bitmap->bitmap, start, count);
 }

 uint64_t bdrv_dirty_bitmap_serialization_align(const BdrvDirtyBitmap *bitmap)
 {
-    return hbitmap_serialization_align(bitmap->bitmap);
+    return hbitmap_serialization_granularity(bitmap->bitmap);
 }

 void bdrv_dirty_bitmap_serialize_part(const BdrvDirtyBitmap *bitmap,
-                                      uint8_t *buf, uint64_t offset,
-                                      uint64_t bytes)
+                                      uint8_t *buf, uint64_t start,
+                                      uint64_t count)
 {
-    hbitmap_serialize_part(bitmap->bitmap, buf, offset, bytes);
+    hbitmap_serialize_part(bitmap->bitmap, buf, start, count);
 }

 void bdrv_dirty_bitmap_deserialize_part(BdrvDirtyBitmap *bitmap,
-                                        uint8_t *buf, uint64_t offset,
-                                        uint64_t bytes, bool finish)
+                                        uint8_t *buf, uint64_t start,
+                                        uint64_t count, bool finish)
 {
-    hbitmap_deserialize_part(bitmap->bitmap, buf, offset, bytes, finish);
+    hbitmap_deserialize_part(bitmap->bitmap, buf, start, count, finish);
 }

 void bdrv_dirty_bitmap_deserialize_zeroes(BdrvDirtyBitmap *bitmap,
-                                          uint64_t offset, uint64_t bytes,
+                                          uint64_t start, uint64_t count,
                                          bool finish)
 {
-    hbitmap_deserialize_zeroes(bitmap->bitmap, offset, bytes, finish);
+    hbitmap_deserialize_zeroes(bitmap->bitmap, start, count, finish);
 }

 void bdrv_dirty_bitmap_deserialize_ones(BdrvDirtyBitmap *bitmap,
-                                        uint64_t offset, uint64_t bytes,
+                                        uint64_t start, uint64_t count,
                                        bool finish)
 {
-    hbitmap_deserialize_ones(bitmap->bitmap, offset, bytes, finish);
+    hbitmap_deserialize_ones(bitmap->bitmap, start, count, finish);
 }

 void bdrv_dirty_bitmap_deserialize_finish(BdrvDirtyBitmap *bitmap)
@@ -675,7 +653,8 @@ void bdrv_dirty_bitmap_deserialize_finish(BdrvDirtyBitmap *bitmap)
    hbitmap_deserialize_finish(bitmap->bitmap);
 }

-void bdrv_set_dirty(BlockDriverState *bs, int64_t offset, int64_t bytes)
+void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
+                    int64_t nr_sectors)
 {
    BdrvDirtyBitmap *bitmap;

@@ -689,7 +668,7 @@ void bdrv_set_dirty(BlockDriverState *bs, int64_t offset, int64_t bytes)
            continue;
        }
        assert(!bdrv_dirty_bitmap_readonly(bitmap));
-        hbitmap_set(bitmap->bitmap, offset, bytes);
+        hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);
    }
    bdrv_dirty_bitmaps_unlock(bs);
 }
@@ -697,9 +676,9 @@ void bdrv_set_dirty(BlockDriverState *bs, int64_t offset, int64_t bytes)
 /**
 * Advance a BdrvDirtyBitmapIter to an arbitrary offset.
 */
-void bdrv_set_dirty_iter(BdrvDirtyBitmapIter *iter, int64_t offset)
+void bdrv_set_dirty_iter(BdrvDirtyBitmapIter *iter, int64_t sector_num)
 {
-    hbitmap_iter_init(&iter->hbi, iter->hbi.hb, offset);
+    hbitmap_iter_init(&iter->hbi, iter->hbi.hb, sector_num);
 }

 int64_t bdrv_get_dirty_count(BdrvDirtyBitmap *bitmap)
@@ -737,6 +716,19 @@ bool bdrv_has_readonly_bitmaps(BlockDriverState *bs)
    return false;
 }

+/* Called with BQL taken. */
+void bdrv_dirty_bitmap_set_autoload(BdrvDirtyBitmap *bitmap, bool autoload)
+{
+    qemu_mutex_lock(bitmap->mutex);
+    bitmap->autoload = autoload;
+    qemu_mutex_unlock(bitmap->mutex);
+}
+
+bool bdrv_dirty_bitmap_get_autoload(const BdrvDirtyBitmap *bitmap)
+{
+    return bitmap->autoload;
+}
+
 /* Called with BQL taken. */
 void bdrv_dirty_bitmap_set_persistance(BdrvDirtyBitmap *bitmap, bool persistent)
 {
@@ -745,24 +737,16 @@ void bdrv_dirty_bitmap_set_persistance(BdrvDirtyBitmap *bitmap, bool persistent)
    qemu_mutex_unlock(bitmap->mutex);
 }

-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_migration(BdrvDirtyBitmap *bitmap, bool migration)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    bitmap->migration = migration;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
 bool bdrv_dirty_bitmap_get_persistance(BdrvDirtyBitmap *bitmap)
 {
-    return bitmap->persistent && !bitmap->migration;
+    return bitmap->persistent;
 }

 bool bdrv_has_changed_persistent_bitmaps(BlockDriverState *bs)
 {
    BdrvDirtyBitmap *bm;
    QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
-        if (bm->persistent && !bm->readonly && !bm->migration) {
+        if (bm->persistent && !bm->readonly) {
            return true;
        }
    }
@@ -781,48 +765,3 @@ char *bdrv_dirty_bitmap_sha256(const BdrvDirtyBitmap *bitmap, Error **errp)
 {
    return hbitmap_sha256(bitmap->bitmap, errp);
 }
-
-int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, uint64_t offset)
-{
-    return hbitmap_next_zero(bitmap->bitmap, offset);
-}
-
-void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
-                             HBitmap **backup, Error **errp)
-{
-    bool ret;
-
-    /* only bitmaps from one bds are supported */
-    assert(dest->mutex == src->mutex);
-
-    qemu_mutex_lock(dest->mutex);
-
-    if (bdrv_dirty_bitmap_user_locked(dest)) {
-        error_setg(errp, "Bitmap '%s' is currently in use by another"
-        " operation and cannot be modified", dest->name);
-        goto out;
-    }
-
-    if (bdrv_dirty_bitmap_readonly(dest)) {
-        error_setg(errp, "Bitmap '%s' is readonly and cannot be modified",
-                   dest->name);
-        goto out;
-    }
-
-    if (!hbitmap_can_merge(dest->bitmap, src->bitmap)) {
-        error_setg(errp, "Bitmaps are incompatible and can't be merged");
-        goto out;
-    }
-
-    if (backup) {
-        *backup = dest->bitmap;
-        dest->bitmap = hbitmap_alloc(dest->size, hbitmap_granularity(*backup));
-        ret = hbitmap_merge(*backup, src->bitmap, dest->bitmap);
-    } else {
-        ret = hbitmap_merge(dest->bitmap, src->bitmap, dest->bitmap);
-    }
-    assert(ret);
-
-out:
-    qemu_mutex_unlock(dest->mutex);
-}
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -111,7 +111,7 @@ static void update_max_chunk_size(BDRVDMGState *s, uint32_t chunk,
        uncompressed_sectors = s->sectorcounts[chunk];
        break;
    case 1: /* copy */
-        uncompressed_sectors = DIV_ROUND_UP(s->lengths[chunk], 512);
+        uncompressed_sectors = (s->lengths[chunk] + 511) / 512;
        break;
    case 2: /* zero */
        /* as the all-zeroes block may be large, it is treated specially: the
@@ -413,17 +413,17 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    int64_t offset;
    int ret;

-    ret = bdrv_apply_auto_read_only(bs, NULL, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
    if (!bs->file) {
        return -EINVAL;
    }

+    ret = bdrv_set_read_only(bs, true, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
    block_module_load_one("dmg-bz2");

    s->n_chunks = 0;
--- a/block/dmg.h
+++ b/block/dmg.h
@@ -26,6 +26,7 @@
 #ifndef BLOCK_DMG_H
 #define BLOCK_DMG_H

+#include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "block/block_int.h"
 #include <zlib.h>
--- a/block/file-posix.c
+++ b/block/file-posix.c
--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -21,19 +21,17 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
-
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
-#include "qemu/option.h"
 #include "block/raw-aio.h"
 #include "trace.h"
 #include "block/thread-pool.h"
 #include "qemu/iov.h"
-#include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
+#include "qapi/util.h"
 #include <windows.h>
 #include <winioctl.h>

@@ -162,7 +160,7 @@ static BlockAIOCB *paio_submit(BlockDriverState *bs, HANDLE hfile,
    acb->aio_nbytes = count;
    acb->aio_offset = offset;

-    trace_file_paio_submit(acb, opaque, offset, count, type);
+    trace_paio_submit(acb, opaque, offset, count, type);
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
    return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);
 }
@@ -251,11 +249,7 @@ static void raw_probe_alignment(BlockDriverState *bs, Error **errp)
                         &dg.Geometry.BytesPerSector,
                         &freeClusters, &totalClusters);
        bs->bl.request_alignment = dg.Geometry.BytesPerSector;
-        return;
    }
-
-    /* XXX Does Windows support AIO on less than 512-byte alignment? */
-    bs->bl.request_alignment = 512;
 }

 static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
@@ -309,8 +303,8 @@ static bool get_aio_option(QemuOpts *opts, int flags, Error **errp)

    aio_default = (flags & BDRV_O_NATIVE_AIO) ? BLOCKDEV_AIO_OPTIONS_NATIVE
                                              : BLOCKDEV_AIO_OPTIONS_THREADS;
-    aio = qapi_enum_parse(&BlockdevAioOptions_lookup, qemu_opt_get(opts, "aio"),
-                          aio_default, errp);
+    aio = qapi_enum_parse(BlockdevAioOptions_lookup, qemu_opt_get(opts, "aio"),
+                          BLOCKDEV_AIO_OPTIONS__MAX, aio_default, errp);

    switch (aio) {
    case BLOCKDEV_AIO_OPTIONS_NATIVE:
@@ -414,32 +408,32 @@ fail:
    return ret;
 }

-static BlockAIOCB *raw_aio_preadv(BlockDriverState *bs,
-                                  uint64_t offset, uint64_t bytes,
-                                  QEMUIOVector *qiov, int flags,
-                                  BlockCompletionFunc *cb, void *opaque)
+static BlockAIOCB *raw_aio_readv(BlockDriverState *bs,
+                         int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+                         BlockCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;
    if (s->aio) {
-        return win32_aio_submit(bs, s->aio, s->hfile, offset, bytes, qiov,
-                                cb, opaque, QEMU_AIO_READ);
+        return win32_aio_submit(bs, s->aio, s->hfile, sector_num, qiov,
+                                nb_sectors, cb, opaque, QEMU_AIO_READ);
    } else {
-        return paio_submit(bs, s->hfile, offset, qiov, bytes,
+        return paio_submit(bs, s->hfile, sector_num << BDRV_SECTOR_BITS, qiov,
+                           nb_sectors << BDRV_SECTOR_BITS,
                           cb, opaque, QEMU_AIO_READ);
    }
 }

-static BlockAIOCB *raw_aio_pwritev(BlockDriverState *bs,
-                                   uint64_t offset, uint64_t bytes,
-                                   QEMUIOVector *qiov, int flags,
-                                   BlockCompletionFunc *cb, void *opaque)
+static BlockAIOCB *raw_aio_writev(BlockDriverState *bs,
+                          int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+                          BlockCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;
    if (s->aio) {
-        return win32_aio_submit(bs, s->aio, s->hfile, offset, bytes, qiov,
-                                cb, opaque, QEMU_AIO_WRITE);
+        return win32_aio_submit(bs, s->aio, s->hfile, sector_num, qiov,
+                                nb_sectors, cb, opaque, QEMU_AIO_WRITE);
    } else {
-        return paio_submit(bs, s->hfile, offset, qiov, bytes,
+        return paio_submit(bs, s->hfile, sector_num << BDRV_SECTOR_BITS, qiov,
+                           nb_sectors << BDRV_SECTOR_BITS,
                           cb, opaque, QEMU_AIO_WRITE);
    }
 }
@@ -467,8 +461,8 @@ static void raw_close(BlockDriverState *bs)
    }
 }

-static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
-                                        PreallocMode prealloc, Error **errp)
+static int raw_truncate(BlockDriverState *bs, int64_t offset,
+                        PreallocMode prealloc, Error **errp)
 {
    BDRVRawState *s = bs->opaque;
    LONG low, high;
@@ -476,7 +470,7 @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,

    if (prealloc != PREALLOC_MODE_OFF) {
        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_str(prealloc));
+                   PreallocMode_lookup[prealloc]);
        return -ENOTSUP;
    }

@@ -557,40 +551,9 @@ static int64_t raw_get_allocated_file_size(BlockDriverState *bs)
    return st.st_size;
 }

-static int raw_co_create(BlockdevCreateOptions *options, Error **errp)
+static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
 {
-    BlockdevCreateOptionsFile *file_opts;
    int fd;
-
-    assert(options->driver == BLOCKDEV_DRIVER_FILE);
-    file_opts = &options->u.file;
-
-    if (file_opts->has_preallocation) {
-        error_setg(errp, "Preallocation is not supported on Windows");
-        return -EINVAL;
-    }
-    if (file_opts->has_nocow) {
-        error_setg(errp, "nocow is not supported on Windows");
-        return -EINVAL;
-    }
-
-    fd = qemu_open(file_opts->filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
-                   0644);
-    if (fd < 0) {
-        error_setg_errno(errp, errno, "Could not create file");
-        return -EIO;
-    }
-    set_sparse(fd);
-    ftruncate(fd, file_opts->size);
-    qemu_close(fd);
-
-    return 0;
-}
-
-static int coroutine_fn raw_co_create_opts(const char *filename, QemuOpts *opts,
-                                           Error **errp)
-{
-    BlockdevCreateOptions options;
    int64_t total_size = 0;

    strstart(filename, "file:", &filename);
@@ -599,18 +562,19 @@ static int coroutine_fn raw_co_create_opts(const char *filename, QemuOpts *opts,
    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                          BDRV_SECTOR_SIZE);

-    options = (BlockdevCreateOptions) {
-        .driver     = BLOCKDEV_DRIVER_FILE,
-        .u.file     = {
-            .filename           = (char *) filename,
-            .size               = total_size,
-            .has_preallocation  = false,
-            .has_nocow          = false,
-        },
-    };
-    return raw_co_create(&options, errp);
+    fd = qemu_open(filename, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
+                   0644);
+    if (fd < 0) {
+        error_setg_errno(errp, errno, "Could not create file");
+        return -EIO;
+    }
+    set_sparse(fd);
+    ftruncate(fd, total_size);
+    qemu_close(fd);
+    return 0;
 }

+
 static QemuOptsList raw_create_opts = {
    .name = "raw-create-opts",
    .head = QTAILQ_HEAD_INITIALIZER(raw_create_opts.head),
@@ -633,14 +597,14 @@ BlockDriver bdrv_file = {
    .bdrv_file_open     = raw_open,
    .bdrv_refresh_limits = raw_probe_alignment,
    .bdrv_close         = raw_close,
-    .bdrv_co_create_opts = raw_co_create_opts,
+    .bdrv_create        = raw_create,
    .bdrv_has_zero_init = bdrv_has_zero_init_1,

-    .bdrv_aio_preadv    = raw_aio_preadv,
-    .bdrv_aio_pwritev   = raw_aio_pwritev,
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush     = raw_aio_flush,

-    .bdrv_co_truncate   = raw_co_truncate,
+    .bdrv_truncate	= raw_truncate,
    .bdrv_getlength	= raw_getlength,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
@@ -712,12 +676,6 @@ static void hdev_parse_filename(const char *filename, QDict *options,
    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
 }

-static void hdev_refresh_limits(BlockDriverState *bs, Error **errp)
-{
-    /* XXX Does Windows support AIO on less than 512-byte alignment? */
-    bs->bl.request_alignment = 512;
-}
-
 static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
                     Error **errp)
 {
@@ -803,10 +761,9 @@ static BlockDriver bdrv_host_device = {
    .bdrv_probe_device	= hdev_probe_device,
    .bdrv_file_open	= hdev_open,
    .bdrv_close		= raw_close,
-    .bdrv_refresh_limits = hdev_refresh_limits,

-    .bdrv_aio_preadv    = raw_aio_preadv,
-    .bdrv_aio_pwritev   = raw_aio_pwritev,
+    .bdrv_aio_readv     = raw_aio_readv,
+    .bdrv_aio_writev    = raw_aio_writev,
    .bdrv_aio_flush     = raw_aio_flush,

    .bdrv_detach_aio_context = raw_detach_aio_context,
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -7,23 +7,16 @@
 * See the COPYING file in the top-level directory.
 *
 */
-
 #include "qemu/osdep.h"
 #include <glusterfs/api/glfs.h>
 #include "block/block_int.h"
-#include "block/qdict.h"
 #include "qapi/error.h"
-#include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
+#include "qapi/util.h"
 #include "qemu/uri.h"
 #include "qemu/error-report.h"
-#include "qemu/option.h"
 #include "qemu/cutils.h"

-#ifdef CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT
-# define glfs_ftruncate(fd, offset) glfs_ftruncate(fd, offset, NULL, NULL)
-#endif
-
 #define GLUSTER_OPT_FILENAME        "filename"
 #define GLUSTER_OPT_VOLUME          "volume"
 #define GLUSTER_OPT_PATH            "path"
@@ -172,12 +165,7 @@ static QemuOptsList runtime_unix_opts = {
        {
            .name = GLUSTER_OPT_SOCKET,
            .type = QEMU_OPT_STRING,
-            .help = "socket file path (legacy)",
-        },
-        {
-            .name = GLUSTER_OPT_PATH,
-            .type = QEMU_OPT_STRING,
-            .help = "socket file path (QAPI)",
+            .help = "socket file path)",
        },
        { /* end of list */ }
    },
@@ -556,7 +544,8 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
        if (!strcmp(ptr, "tcp")) {
            ptr = "inet";       /* accept legacy "tcp" */
        }
-        type = qapi_enum_parse(&SocketAddressType_lookup, ptr, -1, NULL);
+        type = qapi_enum_parse(SocketAddressType_lookup, ptr,
+                               SOCKET_ADDRESS_TYPE__MAX, -1, NULL);
        if (type != SOCKET_ADDRESS_TYPE_INET
            && type != SOCKET_ADDRESS_TYPE_UNIX) {
            error_setg(&local_err,
@@ -625,18 +614,10 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
                goto out;
            }

-            ptr = qemu_opt_get(opts, GLUSTER_OPT_PATH);
-            if (!ptr) {
-                ptr = qemu_opt_get(opts, GLUSTER_OPT_SOCKET);
-            } else if (qemu_opt_get(opts, GLUSTER_OPT_SOCKET)) {
-                error_setg(&local_err,
-                           "Conflicting parameters 'path' and 'socket'");
-                error_append_hint(&local_err, GERR_INDEX_HINT, i);
-                goto out;
-            }
+            ptr = qemu_opt_get(opts, GLUSTER_OPT_SOCKET);
            if (!ptr) {
                error_setg(&local_err, QERR_MISSING_PARAMETER,
-                           GLUSTER_OPT_PATH);
+                           GLUSTER_OPT_SOCKET);
                error_append_hint(&local_err, GERR_INDEX_HINT, i);
                goto out;
            }
@@ -655,7 +636,7 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
        }
        gsconf = NULL;

-        qobject_unref(backing_options);
+        QDECREF(backing_options);
        backing_options = NULL;
        g_free(str);
        str = NULL;
@@ -668,27 +649,26 @@ out:
    qapi_free_SocketAddress(gsconf);
    qemu_opts_del(opts);
    g_free(str);
-    qobject_unref(backing_options);
+    QDECREF(backing_options);
    errno = EINVAL;
    return -errno;
 }

-/* Converts options given in @filename and the @options QDict into the QAPI
- * object @gconf. */
-static int qemu_gluster_parse(BlockdevOptionsGluster *gconf,
-                              const char *filename,
-                              QDict *options, Error **errp)
+static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
+                                      const char *filename,
+                                      QDict *options, Error **errp)
 {
    int ret;
    if (filename) {
        ret = qemu_gluster_parse_uri(gconf, filename);
        if (ret < 0) {
-            error_setg(errp, "invalid URI %s", filename);
+            error_setg(errp, "invalid URI");
            error_append_hint(errp, "Usage: file=gluster[+transport]://"
                                    "[host[:port]]volume/path[?socket=...]"
                                    "[,file.debug=N]"
                                    "[,file.logfile=/path/filename.log]\n");
-            return ret;
+            errno = -ret;
+            return NULL;
        }
    } else {
        ret = qemu_gluster_parse_json(gconf, options, errp);
@@ -702,25 +682,12 @@ static int qemu_gluster_parse(BlockdevOptionsGluster *gconf,
                             "file.server.0.host=1.2.3.4,"
                             "file.server.0.port=24007,"
                             "file.server.1.transport=unix,"
-                             "file.server.1.path=/var/run/glusterd.socket ..."
+                             "file.server.1.socket=/var/run/glusterd.socket ..."
                             "\n");
-            return ret;
+            errno = -ret;
+            return NULL;
        }
-    }

-    return 0;
-}
-
-static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
-                                      const char *filename,
-                                      QDict *options, Error **errp)
-{
-    int ret;
-
-    ret = qemu_gluster_parse(gconf, filename, options, errp);
-    if (ret < 0) {
-        errno = -ret;
-        return NULL;
    }

    return qemu_gluster_glfs_init(gconf, errp);
@@ -729,11 +696,7 @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
 /*
 * AIO callback routine called from GlusterFS thread.
 */
-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
-#ifdef CONFIG_GLUSTERFS_IOCB_HAS_STAT
-                                 struct glfs_stat *pre, struct glfs_stat *post,
-#endif
-                                 void *arg)
+static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
 {
    GlusterAIOCB *acb = (GlusterAIOCB *)arg;

@@ -857,16 +820,8 @@ static int qemu_gluster_open(BlockDriverState *bs,  QDict *options,
    qemu_gluster_parse_flags(bdrv_flags, &open_flags);

    s->fd = glfs_open(s->glfs, gconf->path, open_flags);
-    ret = s->fd ? 0 : -errno;
-
-    if (ret == -EACCES || ret == -EROFS) {
-        /* Try to degrade to read-only, but if it doesn't work, still use the
-         * normal error message. */
-        if (bdrv_apply_auto_read_only(bs, NULL, NULL) == 0) {
-            open_flags = (open_flags & ~O_RDWR) | O_RDONLY;
-            s->fd = glfs_open(s->glfs, gconf->path, open_flags);
-            ret = s->fd ? 0 : -errno;
-        }
+    if (!s->fd) {
+        ret = -errno;
    }

    s->supports_seek_data = qemu_gluster_test_seek(s->fd);
@@ -1009,128 +964,19 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
 }
 #endif

-static int qemu_gluster_do_truncate(struct glfs_fd *fd, int64_t offset,
-                                    PreallocMode prealloc, Error **errp)
+static int qemu_gluster_create(const char *filename,
+                               QemuOpts *opts, Error **errp)
 {
-    int64_t current_length;
-
-    current_length = glfs_lseek(fd, 0, SEEK_END);
-    if (current_length < 0) {
-        error_setg_errno(errp, errno, "Failed to determine current size");
-        return -errno;
-    }
-
-    if (current_length > offset && prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Cannot use preallocation for shrinking files");
-        return -ENOTSUP;
-    }
-
-    if (current_length == offset) {
-        return 0;
-    }
-
-    switch (prealloc) {
-#ifdef CONFIG_GLUSTERFS_FALLOCATE
-    case PREALLOC_MODE_FALLOC:
-        if (glfs_fallocate(fd, 0, current_length, offset - current_length)) {
-            error_setg_errno(errp, errno, "Could not preallocate data");
-            return -errno;
-        }
-        break;
-#endif /* CONFIG_GLUSTERFS_FALLOCATE */
-#ifdef CONFIG_GLUSTERFS_ZEROFILL
-    case PREALLOC_MODE_FULL:
-        if (glfs_ftruncate(fd, offset)) {
-            error_setg_errno(errp, errno, "Could not resize file");
-            return -errno;
-        }
-        if (glfs_zerofill(fd, current_length, offset - current_length)) {
-            error_setg_errno(errp, errno, "Could not zerofill the new area");
-            return -errno;
-        }
-        break;
-#endif /* CONFIG_GLUSTERFS_ZEROFILL */
-    case PREALLOC_MODE_OFF:
-        if (glfs_ftruncate(fd, offset)) {
-            error_setg_errno(errp, errno, "Could not resize file");
-            return -errno;
-        }
-        break;
-    default:
-        error_setg(errp, "Unsupported preallocation mode: %s",
-                   PreallocMode_str(prealloc));
-        return -EINVAL;
-    }
-
-    return 0;
-}
-
-static int qemu_gluster_co_create(BlockdevCreateOptions *options,
-                                  Error **errp)
-{
-    BlockdevCreateOptionsGluster *opts = &options->u.gluster;
-    struct glfs *glfs;
-    struct glfs_fd *fd = NULL;
-    int ret = 0;
-
-    assert(options->driver == BLOCKDEV_DRIVER_GLUSTER);
-
-    glfs = qemu_gluster_glfs_init(opts->location, errp);
-    if (!glfs) {
-        ret = -errno;
-        goto out;
-    }
-
-    fd = glfs_creat(glfs, opts->location->path,
-                    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
-    if (!fd) {
-        ret = -errno;
-        goto out;
-    }
-
-    ret = qemu_gluster_do_truncate(fd, opts->size, opts->preallocation, errp);
-
-out:
-    if (fd) {
-        if (glfs_close(fd) != 0 && ret == 0) {
-            ret = -errno;
-        }
-    }
-    glfs_clear_preopened(glfs);
-    return ret;
-}
-
-static int coroutine_fn qemu_gluster_co_create_opts(const char *filename,
-                                                    QemuOpts *opts,
-                                                    Error **errp)
-{
-    BlockdevCreateOptions *options;
-    BlockdevCreateOptionsGluster *gopts;
    BlockdevOptionsGluster *gconf;
+    struct glfs *glfs;
+    struct glfs_fd *fd;
+    int ret = 0;
+    PreallocMode prealloc;
+    int64_t total_size = 0;
    char *tmp = NULL;
    Error *local_err = NULL;
-    int ret;
-
-    options = g_new0(BlockdevCreateOptions, 1);
-    options->driver = BLOCKDEV_DRIVER_GLUSTER;
-    gopts = &options->u.gluster;

    gconf = g_new0(BlockdevOptionsGluster, 1);
-    gopts->location = gconf;
-
-    gopts->size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
-                           BDRV_SECTOR_SIZE);
-
-    tmp = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
-    gopts->preallocation = qapi_enum_parse(&PreallocMode_lookup, tmp,
-                                           PREALLOC_MODE_OFF, &local_err);
-    g_free(tmp);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
    gconf->debug = qemu_opt_get_number_del(opts, GLUSTER_OPT_DEBUG,
                                           GLUSTER_DEBUG_DEFAULT);
    if (gconf->debug < 0) {
@@ -1146,19 +992,74 @@ static int coroutine_fn qemu_gluster_co_create_opts(const char *filename,
    }
    gconf->has_logfile = true;

-    ret = qemu_gluster_parse(gconf, filename, NULL, errp);
-    if (ret < 0) {
-        goto fail;
+    glfs = qemu_gluster_init(gconf, filename, NULL, errp);
+    if (!glfs) {
+        ret = -errno;
+        goto out;
    }

-    ret = qemu_gluster_co_create(options, errp);
-    if (ret < 0) {
-        goto fail;
+    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
+                          BDRV_SECTOR_SIZE);
+
+    tmp = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
+    prealloc = qapi_enum_parse(PreallocMode_lookup, tmp,
+                               PREALLOC_MODE__MAX, PREALLOC_MODE_OFF,
+                               &local_err);
+    g_free(tmp);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        ret = -EINVAL;
+        goto out;
    }

-    ret = 0;
-fail:
-    qapi_free_BlockdevCreateOptions(options);
+    fd = glfs_creat(glfs, gconf->path,
+                    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
+    if (!fd) {
+        ret = -errno;
+        goto out;
+    }
+
+    switch (prealloc) {
+#ifdef CONFIG_GLUSTERFS_FALLOCATE
+    case PREALLOC_MODE_FALLOC:
+        if (glfs_fallocate(fd, 0, 0, total_size)) {
+            error_setg(errp, "Could not preallocate data for the new file");
+            ret = -errno;
+        }
+        break;
+#endif /* CONFIG_GLUSTERFS_FALLOCATE */
+#ifdef CONFIG_GLUSTERFS_ZEROFILL
+    case PREALLOC_MODE_FULL:
+        if (!glfs_ftruncate(fd, total_size)) {
+            if (glfs_zerofill(fd, 0, total_size)) {
+                error_setg(errp, "Could not zerofill the new file");
+                ret = -errno;
+            }
+        } else {
+            error_setg(errp, "Could not resize file");
+            ret = -errno;
+        }
+        break;
+#endif /* CONFIG_GLUSTERFS_ZEROFILL */
+    case PREALLOC_MODE_OFF:
+        if (glfs_ftruncate(fd, total_size) != 0) {
+            ret = -errno;
+            error_setg(errp, "Could not resize file");
+        }
+        break;
+    default:
+        ret = -EINVAL;
+        error_setg(errp, "Unsupported preallocation mode: %s",
+                   PreallocMode_lookup[prealloc]);
+        break;
+    }
+
+    if (glfs_close(fd) != 0) {
+        ret = -errno;
+    }
+out:
+    qapi_free_BlockdevOptionsGluster(gconf);
+    glfs_clear_preopened(glfs);
    return ret;
 }

@@ -1193,13 +1094,26 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
    return acb.ret;
 }

-static coroutine_fn int qemu_gluster_co_truncate(BlockDriverState *bs,
-                                                 int64_t offset,
-                                                 PreallocMode prealloc,
-                                                 Error **errp)
+static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset,
+                                 PreallocMode prealloc, Error **errp)
 {
+    int ret;
    BDRVGlusterState *s = bs->opaque;
-    return qemu_gluster_do_truncate(s->fd, offset, prealloc, errp);
+
+    if (prealloc != PREALLOC_MODE_OFF) {
+        error_setg(errp, "Unsupported preallocation mode '%s'",
+                   PreallocMode_lookup[prealloc]);
+        return -ENOTSUP;
+    }
+
+    ret = glfs_ftruncate(s->fd, offset);
+    if (ret < 0) {
+        ret = -errno;
+        error_setg_errno(errp, -ret, "Failed to truncate file");
+        return ret;
+    }
+
+    return 0;
 }

 static coroutine_fn int qemu_gluster_co_readv(BlockDriverState *bs,
@@ -1213,10 +1127,8 @@ static coroutine_fn int qemu_gluster_co_readv(BlockDriverState *bs,
 static coroutine_fn int qemu_gluster_co_writev(BlockDriverState *bs,
                                               int64_t sector_num,
                                               int nb_sectors,
-                                               QEMUIOVector *qiov,
-                                               int flags)
+                                               QEMUIOVector *qiov)
 {
-    assert(!flags);
    return qemu_gluster_co_rw(bs, sector_num, nb_sectors, qiov, 1);
 }

@@ -1342,7 +1254,7 @@ static int qemu_gluster_has_zero_init(BlockDriverState *bs)
 * If @start is in a trailing hole or beyond EOF, return -ENXIO.
 * If we can't find out, return a negative errno other than -ENXIO.
 *
- * (Shamefully copied from file-posix.c, only minuscule adaptions.)
+ * (Shamefully copied from file-posix.c, only miniscule adaptions.)
 */
 static int find_allocation(BlockDriverState *bs, off_t start,
                           off_t *data, off_t *hole)
@@ -1440,66 +1352,68 @@ exit:
 }

 /*
- * Returns the allocation status of the specified offset.
+ * Returns the allocation status of the specified sectors.
 *
- * The block layer guarantees 'offset' and 'bytes' are within bounds.
+ * If 'sector_num' is beyond the end of the disk image the return value is 0
+ * and 'pnum' is set to 0.
 *
- * 'pnum' is set to the number of bytes (including and immediately following
- * the specified offset) that are known to be in the same
+ * 'pnum' is set to the number of sectors (including and immediately following
+ * the specified sector) that are known to be in the same
 * allocated/unallocated state.
 *
- * 'bytes' is the max value 'pnum' should be set to.
+ * 'nb_sectors' is the max value 'pnum' should be set to.  If nb_sectors goes
+ * beyond the end of the disk image it will be clamped.
 *
- * (Based on raw_co_block_status() from file-posix.c.)
+ * (Based on raw_co_get_block_status() from file-posix.c.)
 */
-static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
-                                                     bool want_zero,
-                                                     int64_t offset,
-                                                     int64_t bytes,
-                                                     int64_t *pnum,
-                                                     int64_t *map,
-                                                     BlockDriverState **file)
+static int64_t coroutine_fn qemu_gluster_co_get_block_status(
+        BlockDriverState *bs, int64_t sector_num, int nb_sectors, int *pnum,
+        BlockDriverState **file)
 {
    BDRVGlusterState *s = bs->opaque;
-    off_t data = 0, hole = 0;
+    off_t start, data = 0, hole = 0;
+    int64_t total_size;
    int ret = -EINVAL;

    if (!s->fd) {
        return ret;
    }

-    if (!want_zero) {
-        *pnum = bytes;
-        *map = offset;
-        *file = bs;
-        return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID;
+    start = sector_num * BDRV_SECTOR_SIZE;
+    total_size = bdrv_getlength(bs);
+    if (total_size < 0) {
+        return total_size;
+    } else if (start >= total_size) {
+        *pnum = 0;
+        return 0;
+    } else if (start + nb_sectors * BDRV_SECTOR_SIZE > total_size) {
+        nb_sectors = DIV_ROUND_UP(total_size - start, BDRV_SECTOR_SIZE);
    }

-    ret = find_allocation(bs, offset, &data, &hole);
+    ret = find_allocation(bs, start, &data, &hole);
    if (ret == -ENXIO) {
        /* Trailing hole */
-        *pnum = bytes;
+        *pnum = nb_sectors;
        ret = BDRV_BLOCK_ZERO;
    } else if (ret < 0) {
        /* No info available, so pretend there are no holes */
-        *pnum = bytes;
+        *pnum = nb_sectors;
        ret = BDRV_BLOCK_DATA;
-    } else if (data == offset) {
-        /* On a data extent, compute bytes to the end of the extent,
+    } else if (data == start) {
+        /* On a data extent, compute sectors to the end of the extent,
         * possibly including a partial sector at EOF. */
-        *pnum = MIN(bytes, hole - offset);
+        *pnum = MIN(nb_sectors, DIV_ROUND_UP(hole - start, BDRV_SECTOR_SIZE));
        ret = BDRV_BLOCK_DATA;
    } else {
-        /* On a hole, compute bytes to the beginning of the next extent.  */
-        assert(hole == offset);
-        *pnum = MIN(bytes, data - offset);
+        /* On a hole, compute sectors to the beginning of the next extent.  */
+        assert(hole == start);
+        *pnum = MIN(nb_sectors, (data - start) / BDRV_SECTOR_SIZE);
        ret = BDRV_BLOCK_ZERO;
    }

-    *map = offset;
    *file = bs;

-    return ret | BDRV_BLOCK_OFFSET_VALID;
+    return ret | BDRV_BLOCK_OFFSET_VALID | start;
 }


@@ -1513,11 +1427,10 @@ static BlockDriver bdrv_gluster = {
    .bdrv_reopen_commit           = qemu_gluster_reopen_commit,
    .bdrv_reopen_abort            = qemu_gluster_reopen_abort,
    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_co_create               = qemu_gluster_co_create,
-    .bdrv_co_create_opts          = qemu_gluster_co_create_opts,
+    .bdrv_create                  = qemu_gluster_create,
    .bdrv_getlength               = qemu_gluster_getlength,
    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_co_truncate             = qemu_gluster_co_truncate,
+    .bdrv_truncate                = qemu_gluster_truncate,
    .bdrv_co_readv                = qemu_gluster_co_readv,
    .bdrv_co_writev               = qemu_gluster_co_writev,
    .bdrv_co_flush_to_disk        = qemu_gluster_co_flush_to_disk,
@@ -1528,7 +1441,7 @@ static BlockDriver bdrv_gluster = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_pwrite_zeroes        = qemu_gluster_co_pwrite_zeroes,
 #endif
-    .bdrv_co_block_status         = qemu_gluster_co_block_status,
+    .bdrv_co_get_block_status     = qemu_gluster_co_get_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
 };

@@ -1542,11 +1455,10 @@ static BlockDriver bdrv_gluster_tcp = {
    .bdrv_reopen_commit           = qemu_gluster_reopen_commit,
    .bdrv_reopen_abort            = qemu_gluster_reopen_abort,
    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_co_create               = qemu_gluster_co_create,
-    .bdrv_co_create_opts          = qemu_gluster_co_create_opts,
+    .bdrv_create                  = qemu_gluster_create,
    .bdrv_getlength               = qemu_gluster_getlength,
    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_co_truncate             = qemu_gluster_co_truncate,
+    .bdrv_truncate                = qemu_gluster_truncate,
    .bdrv_co_readv                = qemu_gluster_co_readv,
    .bdrv_co_writev               = qemu_gluster_co_writev,
    .bdrv_co_flush_to_disk        = qemu_gluster_co_flush_to_disk,
@@ -1557,7 +1469,7 @@ static BlockDriver bdrv_gluster_tcp = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_pwrite_zeroes        = qemu_gluster_co_pwrite_zeroes,
 #endif
-    .bdrv_co_block_status         = qemu_gluster_co_block_status,
+    .bdrv_co_get_block_status     = qemu_gluster_co_get_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
 };

@@ -1571,11 +1483,10 @@ static BlockDriver bdrv_gluster_unix = {
    .bdrv_reopen_commit           = qemu_gluster_reopen_commit,
    .bdrv_reopen_abort            = qemu_gluster_reopen_abort,
    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_co_create               = qemu_gluster_co_create,
-    .bdrv_co_create_opts          = qemu_gluster_co_create_opts,
+    .bdrv_create                  = qemu_gluster_create,
    .bdrv_getlength               = qemu_gluster_getlength,
    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_co_truncate             = qemu_gluster_co_truncate,
+    .bdrv_truncate                = qemu_gluster_truncate,
    .bdrv_co_readv                = qemu_gluster_co_readv,
    .bdrv_co_writev               = qemu_gluster_co_writev,
    .bdrv_co_flush_to_disk        = qemu_gluster_co_flush_to_disk,
@@ -1586,7 +1497,7 @@ static BlockDriver bdrv_gluster_unix = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_pwrite_zeroes        = qemu_gluster_co_pwrite_zeroes,
 #endif
-    .bdrv_co_block_status         = qemu_gluster_co_block_status,
+    .bdrv_co_get_block_status     = qemu_gluster_co_get_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
 };

@@ -1606,11 +1517,10 @@ static BlockDriver bdrv_gluster_rdma = {
    .bdrv_reopen_commit           = qemu_gluster_reopen_commit,
    .bdrv_reopen_abort            = qemu_gluster_reopen_abort,
    .bdrv_close                   = qemu_gluster_close,
-    .bdrv_co_create               = qemu_gluster_co_create,
-    .bdrv_co_create_opts          = qemu_gluster_co_create_opts,
+    .bdrv_create                  = qemu_gluster_create,
    .bdrv_getlength               = qemu_gluster_getlength,
    .bdrv_get_allocated_file_size = qemu_gluster_allocated_file_size,
-    .bdrv_co_truncate             = qemu_gluster_co_truncate,
+    .bdrv_truncate                = qemu_gluster_truncate,
    .bdrv_co_readv                = qemu_gluster_co_readv,
    .bdrv_co_writev               = qemu_gluster_co_writev,
    .bdrv_co_flush_to_disk        = qemu_gluster_co_flush_to_disk,
@@ -1621,7 +1531,7 @@ static BlockDriver bdrv_gluster_rdma = {
 #ifdef CONFIG_GLUSTERFS_ZEROFILL
    .bdrv_co_pwrite_zeroes        = qemu_gluster_co_pwrite_zeroes,
 #endif
-    .bdrv_co_block_status         = qemu_gluster_co_block_status,
+    .bdrv_co_get_block_status     = qemu_gluster_co_get_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
 };

--- a/block/io.c
+++ b/block/io.c
--- a/block/iscsi-opts.c
+++ b/block/iscsi-opts.c
@@ -25,7 +25,6 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/config-file.h"
-#include "qemu/option.h"

 static QemuOptsList qemu_iscsi_opts = {
    .name = "iscsi",
--- a/block/iscsi.c
+++ b/block/iscsi.c
--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -15,7 +15,6 @@
 #include "block/raw-aio.h"
 #include "qemu/event_notifier.h"
 #include "qemu/coroutine.h"
-#include "qapi/error.h"

 #include <libaio.h>

@@ -234,9 +233,9 @@ static void qemu_laio_process_completions(LinuxAioState *s)

 static void qemu_laio_process_completions_and_submit(LinuxAioState *s)
 {
-    aio_context_acquire(s->aio_context);
    qemu_laio_process_completions(s);

+    aio_context_acquire(s->aio_context);
    if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
        ioq_submit(s);
    }
@@ -471,21 +470,16 @@ void laio_attach_aio_context(LinuxAioState *s, AioContext *new_context)
                           qemu_laio_poll_cb);
 }

-LinuxAioState *laio_init(Error **errp)
+LinuxAioState *laio_init(void)
 {
-    int rc;
    LinuxAioState *s;

    s = g_malloc0(sizeof(*s));
-    rc = event_notifier_init(&s->e, false);
-    if (rc < 0) {
-        error_setg_errno(errp, -rc, "failed to to initialize event notifier");
+    if (event_notifier_init(&s->e, false) < 0) {
        goto out_free_state;
    }

-    rc = io_setup(MAX_EVENTS, &s->ctx);
-    if (rc < 0) {
-        error_setg_errno(errp, -rc, "failed to create linux AIO context");
+    if (io_setup(MAX_EVENTS, &s->ctx) != 0) {
        goto out_close_efd;
    }

--- a/block/mirror.c
+++ b/block/mirror.c
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -31,10 +31,10 @@
 #include "qapi/error.h"
 #include "nbd-client.h"

-#define HANDLE_TO_INDEX(bs, handle) ((handle) ^ (uint64_t)(intptr_t)(bs))
-#define INDEX_TO_HANDLE(bs, index)  ((index)  ^ (uint64_t)(intptr_t)(bs))
+#define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
+#define INDEX_TO_HANDLE(bs, index)  ((index)  ^ ((uint64_t)(intptr_t)bs))

-static void nbd_recv_coroutines_wake_all(NBDClientSession *s)
+static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
 {
    int i;

@@ -78,7 +78,7 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
    while (!s->quit) {
        assert(s->reply.handle == 0);
        ret = nbd_receive_reply(s->ioc, &s->reply, &local_err);
-        if (local_err) {
+        if (ret < 0) {
            error_report_err(local_err);
        }
        if (ret <= 0) {
@@ -92,9 +92,7 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
        i = HANDLE_TO_INDEX(s, s->reply.handle);
        if (i >= MAX_NBD_REQUESTS ||
            !s->requests[i].coroutine ||
-            !s->requests[i].receiving ||
-            (nbd_reply_is_structured(&s->reply) && !s->info.structured_reply))
-        {
+            !s->requests[i].receiving) {
            break;
        }

@@ -114,9 +112,8 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
    }

    s->quit = true;
-    nbd_recv_coroutines_wake_all(s);
+    nbd_recv_coroutines_enter_all(s);
    s->read_reply_co = NULL;
-    aio_wait_kick();
 }

 static int nbd_co_send_request(BlockDriverState *bs,
@@ -124,7 +121,7 @@ static int nbd_co_send_request(BlockDriverState *bs,
                               QEMUIOVector *qiov)
 {
    NBDClientSession *s = nbd_get_client_session(bs);
-    int rc, i;
+    int rc, ret, i;

    qemu_co_mutex_lock(&s->send_mutex);
    while (s->in_flight == MAX_NBD_REQUESTS) {
@@ -142,7 +139,6 @@ static int nbd_co_send_request(BlockDriverState *bs,
    assert(i < MAX_NBD_REQUESTS);

    s->requests[i].coroutine = qemu_coroutine_self();
-    s->requests[i].offset = request->from;
    s->requests[i].receiving = false;

    request->handle = INDEX_TO_HANDLE(s, i);
@@ -160,12 +156,11 @@ static int nbd_co_send_request(BlockDriverState *bs,
        qio_channel_set_cork(s->ioc, true);
        rc = nbd_send_request(s->ioc, request);
        if (rc >= 0 && !s->quit) {
-            if (qio_channel_writev_all(s->ioc, qiov->iov, qiov->niov,
-                                       NULL) < 0) {
+            ret = nbd_rwv(s->ioc, qiov->iov, qiov->niov, request->len, false,
+                          NULL);
+            if (ret != request->len) {
                rc = -EIO;
            }
-        } else if (rc >= 0) {
-            rc = -EIO;
        }
        qio_channel_set_cork(s->ioc, false);
    } else {
@@ -183,629 +178,70 @@ err:
    return rc;
 }

-static inline uint16_t payload_advance16(uint8_t **payload)
+static void nbd_co_receive_reply(NBDClientSession *s,
+                                 NBDRequest *request,
+                                 NBDReply *reply,
+                                 QEMUIOVector *qiov)
 {
-    *payload += 2;
-    return lduw_be_p(*payload - 2);
-}
-
-static inline uint32_t payload_advance32(uint8_t **payload)
-{
-    *payload += 4;
-    return ldl_be_p(*payload - 4);
-}
-
-static inline uint64_t payload_advance64(uint8_t **payload)
-{
-    *payload += 8;
-    return ldq_be_p(*payload - 8);
-}
-
-static int nbd_parse_offset_hole_payload(NBDStructuredReplyChunk *chunk,
-                                         uint8_t *payload, uint64_t orig_offset,
-                                         QEMUIOVector *qiov, Error **errp)
-{
-    uint64_t offset;
-    uint32_t hole_size;
-
-    if (chunk->length != sizeof(offset) + sizeof(hole_size)) {
-        error_setg(errp, "Protocol error: invalid payload for "
-                         "NBD_REPLY_TYPE_OFFSET_HOLE");
-        return -EINVAL;
-    }
-
-    offset = payload_advance64(&payload);
-    hole_size = payload_advance32(&payload);
-
-    if (!hole_size || offset < orig_offset || hole_size > qiov->size ||
-        offset > orig_offset + qiov->size - hole_size) {
-        error_setg(errp, "Protocol error: server sent chunk exceeding requested"
-                         " region");
-        return -EINVAL;
-    }
-
-    qemu_iovec_memset(qiov, offset - orig_offset, 0, hole_size);
-
-    return 0;
-}
-
-/* nbd_parse_blockstatus_payload
- * support only one extent in reply and only for
- * base:allocation context
- */
-static int nbd_parse_blockstatus_payload(NBDClientSession *client,
-                                         NBDStructuredReplyChunk *chunk,
-                                         uint8_t *payload, uint64_t orig_length,
-                                         NBDExtent *extent, Error **errp)
-{
-    uint32_t context_id;
-
-    if (chunk->length != sizeof(context_id) + sizeof(*extent)) {
-        error_setg(errp, "Protocol error: invalid payload for "
-                         "NBD_REPLY_TYPE_BLOCK_STATUS");
-        return -EINVAL;
-    }
-
-    context_id = payload_advance32(&payload);
-    if (client->info.meta_base_allocation_id != context_id) {
-        error_setg(errp, "Protocol error: unexpected context id %d for "
-                         "NBD_REPLY_TYPE_BLOCK_STATUS, when negotiated context "
-                         "id is %d", context_id,
-                         client->info.meta_base_allocation_id);
-        return -EINVAL;
-    }
-
-    extent->length = payload_advance32(&payload);
-    extent->flags = payload_advance32(&payload);
-
-    if (extent->length == 0 ||
-        (client->info.min_block && !QEMU_IS_ALIGNED(extent->length,
-                                                    client->info.min_block))) {
-        error_setg(errp, "Protocol error: server sent status chunk with "
-                   "invalid length");
-        return -EINVAL;
-    }
-
-    /* The server is allowed to send us extra information on the final
-     * extent; just clamp it to the length we requested. */
-    if (extent->length > orig_length) {
-        extent->length = orig_length;
-    }
-
-    return 0;
-}
-
-/* nbd_parse_error_payload
- * on success @errp contains message describing nbd error reply
- */
-static int nbd_parse_error_payload(NBDStructuredReplyChunk *chunk,
-                                   uint8_t *payload, int *request_ret,
-                                   Error **errp)
-{
-    uint32_t error;
-    uint16_t message_size;
-
-    assert(chunk->type & (1 << 15));
-
-    if (chunk->length < sizeof(error) + sizeof(message_size)) {
-        error_setg(errp,
-                   "Protocol error: invalid payload for structured error");
-        return -EINVAL;
-    }
-
-    error = nbd_errno_to_system_errno(payload_advance32(&payload));
-    if (error == 0) {
-        error_setg(errp, "Protocol error: server sent structured error chunk "
-                         "with error = 0");
-        return -EINVAL;
-    }
-
-    *request_ret = -error;
-    message_size = payload_advance16(&payload);
-
-    if (message_size > chunk->length - sizeof(error) - sizeof(message_size)) {
-        error_setg(errp, "Protocol error: server sent structured error chunk "
-                         "with incorrect message size");
-        return -EINVAL;
-    }
-
-    /* TODO: Add a trace point to mention the server complaint */
-
-    /* TODO handle ERROR_OFFSET */
-
-    return 0;
-}
-
-static int nbd_co_receive_offset_data_payload(NBDClientSession *s,
-                                              uint64_t orig_offset,
-                                              QEMUIOVector *qiov, Error **errp)
-{
-    QEMUIOVector sub_qiov;
-    uint64_t offset;
-    size_t data_size;
+    int i = HANDLE_TO_INDEX(s, request->handle);
    int ret;
-    NBDStructuredReplyChunk *chunk = &s->reply.structured;
-
-    assert(nbd_reply_is_structured(&s->reply));
-
-    /* The NBD spec requires at least one byte of payload */
-    if (chunk->length <= sizeof(offset)) {
-        error_setg(errp, "Protocol error: invalid payload for "
-                         "NBD_REPLY_TYPE_OFFSET_DATA");
-        return -EINVAL;
-    }
-
-    if (nbd_read(s->ioc, &offset, sizeof(offset), errp) < 0) {
-        return -EIO;
-    }
-    be64_to_cpus(&offset);
-
-    data_size = chunk->length - sizeof(offset);
-    assert(data_size);
-    if (offset < orig_offset || data_size > qiov->size ||
-        offset > orig_offset + qiov->size - data_size) {
-        error_setg(errp, "Protocol error: server sent chunk exceeding requested"
-                         " region");
-        return -EINVAL;
-    }
-
-    qemu_iovec_init(&sub_qiov, qiov->niov);
-    qemu_iovec_concat(&sub_qiov, qiov, offset - orig_offset, data_size);
-    ret = qio_channel_readv_all(s->ioc, sub_qiov.iov, sub_qiov.niov, errp);
-    qemu_iovec_destroy(&sub_qiov);
-
-    return ret < 0 ? -EIO : 0;
-}
-
-#define NBD_MAX_MALLOC_PAYLOAD 1000
-/* nbd_co_receive_structured_payload
- */
-static coroutine_fn int nbd_co_receive_structured_payload(
-        NBDClientSession *s, void **payload, Error **errp)
-{
-    int ret;
-    uint32_t len;
-
-    assert(nbd_reply_is_structured(&s->reply));
-
-    len = s->reply.structured.length;
-
-    if (len == 0) {
-        return 0;
-    }
-
-    if (payload == NULL) {
-        error_setg(errp, "Unexpected structured payload");
-        return -EINVAL;
-    }
-
-    if (len > NBD_MAX_MALLOC_PAYLOAD) {
-        error_setg(errp, "Payload too large");
-        return -EINVAL;
-    }
-
-    *payload = g_new(char, len);
-    ret = nbd_read(s->ioc, *payload, len, errp);
-    if (ret < 0) {
-        g_free(*payload);
-        *payload = NULL;
-        return ret;
-    }
-
-    return 0;
-}
-
-/* nbd_co_do_receive_one_chunk
- * for simple reply:
- *   set request_ret to received reply error
- *   if qiov is not NULL: read payload to @qiov
- * for structured reply chunk:
- *   if error chunk: read payload, set @request_ret, do not set @payload
- *   else if offset_data chunk: read payload data to @qiov, do not set @payload
- *   else: read payload to @payload
- *
- * If function fails, @errp contains corresponding error message, and the
- * connection with the server is suspect.  If it returns 0, then the
- * transaction succeeded (although @request_ret may be a negative errno
- * corresponding to the server's error reply), and errp is unchanged.
- */
-static coroutine_fn int nbd_co_do_receive_one_chunk(
-        NBDClientSession *s, uint64_t handle, bool only_structured,
-        int *request_ret, QEMUIOVector *qiov, void **payload, Error **errp)
-{
-    int ret;
-    int i = HANDLE_TO_INDEX(s, handle);
-    void *local_payload = NULL;
-    NBDStructuredReplyChunk *chunk;
-
-    if (payload) {
-        *payload = NULL;
-    }
-    *request_ret = 0;

    /* Wait until we're woken up by nbd_read_reply_entry.  */
    s->requests[i].receiving = true;
    qemu_coroutine_yield();
    s->requests[i].receiving = false;
-    if (!s->ioc || s->quit) {
-        error_setg(errp, "Connection closed");
-        return -EIO;
-    }
-
-    assert(s->reply.handle == handle);
-
-    if (nbd_reply_is_simple(&s->reply)) {
-        if (only_structured) {
-            error_setg(errp, "Protocol error: simple reply when structured "
-                             "reply chunk was expected");
-            return -EINVAL;
-        }
-
-        *request_ret = -nbd_errno_to_system_errno(s->reply.simple.error);
-        if (*request_ret < 0 || !qiov) {
-            return 0;
-        }
-
-        return qio_channel_readv_all(s->ioc, qiov->iov, qiov->niov,
-                                     errp) < 0 ? -EIO : 0;
-    }
-
-    /* handle structured reply chunk */
-    assert(s->info.structured_reply);
-    chunk = &s->reply.structured;
-
-    if (chunk->type == NBD_REPLY_TYPE_NONE) {
-        if (!(chunk->flags & NBD_REPLY_FLAG_DONE)) {
-            error_setg(errp, "Protocol error: NBD_REPLY_TYPE_NONE chunk without"
-                       " NBD_REPLY_FLAG_DONE flag set");
-            return -EINVAL;
-        }
-        if (chunk->length) {
-            error_setg(errp, "Protocol error: NBD_REPLY_TYPE_NONE chunk with"
-                       " nonzero length");
-            return -EINVAL;
-        }
-        return 0;
-    }
-
-    if (chunk->type == NBD_REPLY_TYPE_OFFSET_DATA) {
-        if (!qiov) {
-            error_setg(errp, "Unexpected NBD_REPLY_TYPE_OFFSET_DATA chunk");
-            return -EINVAL;
-        }
-
-        return nbd_co_receive_offset_data_payload(s, s->requests[i].offset,
-                                                  qiov, errp);
-    }
-
-    if (nbd_reply_type_is_error(chunk->type)) {
-        payload = &local_payload;
-    }
-
-    ret = nbd_co_receive_structured_payload(s, payload, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (nbd_reply_type_is_error(chunk->type)) {
-        ret = nbd_parse_error_payload(chunk, local_payload, request_ret, errp);
-        g_free(local_payload);
-        return ret;
-    }
-
-    return 0;
-}
-
-/* nbd_co_receive_one_chunk
- * Read reply, wake up read_reply_co and set s->quit if needed.
- * Return value is a fatal error code or normal nbd reply error code
- */
-static coroutine_fn int nbd_co_receive_one_chunk(
-        NBDClientSession *s, uint64_t handle, bool only_structured,
-        QEMUIOVector *qiov, NBDReply *reply, void **payload, Error **errp)
-{
-    int request_ret;
-    int ret = nbd_co_do_receive_one_chunk(s, handle, only_structured,
-                                          &request_ret, qiov, payload, errp);
-
-    if (ret < 0) {
-        s->quit = true;
+    *reply = s->reply;
+    if (reply->handle != request->handle || !s->ioc || s->quit) {
+        reply->error = EIO;
    } else {
-        /* For assert at loop start in nbd_read_reply_entry */
-        if (reply) {
-            *reply = s->reply;
+        if (qiov && reply->error == 0) {
+            ret = nbd_rwv(s->ioc, qiov->iov, qiov->niov, request->len, true,
+                          NULL);
+            if (ret != request->len) {
+                reply->error = EIO;
+                s->quit = true;
+            }
        }
+
+        /* Tell the read handler to read another header.  */
        s->reply.handle = 0;
-        ret = request_ret;
    }

+    s->requests[i].coroutine = NULL;
+
+    /* Kick the read_reply_co to get the next reply.  */
    if (s->read_reply_co) {
        aio_co_wake(s->read_reply_co);
    }

-    return ret;
-}
-
-typedef struct NBDReplyChunkIter {
-    int ret;
-    bool fatal;
-    Error *err;
-    bool done, only_structured;
-} NBDReplyChunkIter;
-
-static void nbd_iter_error(NBDReplyChunkIter *iter, bool fatal,
-                           int ret, Error **local_err)
-{
-    assert(ret < 0);
-
-    if ((fatal && !iter->fatal) || iter->ret == 0) {
-        if (iter->ret != 0) {
-            error_free(iter->err);
-            iter->err = NULL;
-        }
-        iter->fatal = fatal;
-        iter->ret = ret;
-        error_propagate(&iter->err, *local_err);
-    } else {
-        error_free(*local_err);
-    }
-
-    *local_err = NULL;
-}
-
-/* NBD_FOREACH_REPLY_CHUNK
- */
-#define NBD_FOREACH_REPLY_CHUNK(s, iter, handle, structured, \
-                                qiov, reply, payload) \
-    for (iter = (NBDReplyChunkIter) { .only_structured = structured }; \
-         nbd_reply_chunk_iter_receive(s, &iter, handle, qiov, reply, payload);)
-
-/* nbd_reply_chunk_iter_receive
- */
-static bool nbd_reply_chunk_iter_receive(NBDClientSession *s,
-                                         NBDReplyChunkIter *iter,
-                                         uint64_t handle,
-                                         QEMUIOVector *qiov, NBDReply *reply,
-                                         void **payload)
-{
-    int ret;
-    NBDReply local_reply;
-    NBDStructuredReplyChunk *chunk;
-    Error *local_err = NULL;
-    if (s->quit) {
-        error_setg(&local_err, "Connection closed");
-        nbd_iter_error(iter, true, -EIO, &local_err);
-        goto break_loop;
-    }
-
-    if (iter->done) {
-        /* Previous iteration was last. */
-        goto break_loop;
-    }
-
-    if (reply == NULL) {
-        reply = &local_reply;
-    }
-
-    ret = nbd_co_receive_one_chunk(s, handle, iter->only_structured,
-                                   qiov, reply, payload, &local_err);
-    if (ret < 0) {
-        /* If it is a fatal error s->quit is set by nbd_co_receive_one_chunk */
-        nbd_iter_error(iter, s->quit, ret, &local_err);
-    }
-
-    /* Do not execute the body of NBD_FOREACH_REPLY_CHUNK for simple reply. */
-    if (nbd_reply_is_simple(&s->reply) || s->quit) {
-        goto break_loop;
-    }
-
-    chunk = &reply->structured;
-    iter->only_structured = true;
-
-    if (chunk->type == NBD_REPLY_TYPE_NONE) {
-        /* NBD_REPLY_FLAG_DONE is already checked in nbd_co_receive_one_chunk */
-        assert(chunk->flags & NBD_REPLY_FLAG_DONE);
-        goto break_loop;
-    }
-
-    if (chunk->flags & NBD_REPLY_FLAG_DONE) {
-        /* This iteration is last. */
-        iter->done = true;
-    }
-
-    /* Execute the loop body */
-    return true;
-
-break_loop:
-    s->requests[HANDLE_TO_INDEX(s, handle)].coroutine = NULL;
-
    qemu_co_mutex_lock(&s->send_mutex);
    s->in_flight--;
    qemu_co_queue_next(&s->free_sema);
    qemu_co_mutex_unlock(&s->send_mutex);
-
-    return false;
-}
-
-static int nbd_co_receive_return_code(NBDClientSession *s, uint64_t handle,
-                                      Error **errp)
-{
-    NBDReplyChunkIter iter;
-
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, false, NULL, NULL, NULL) {
-        /* nbd_reply_chunk_iter_receive does all the work */
-    }
-
-    error_propagate(errp, iter.err);
-    return iter.ret;
-}
-
-static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
-                                        uint64_t offset, QEMUIOVector *qiov,
-                                        Error **errp)
-{
-    NBDReplyChunkIter iter;
-    NBDReply reply;
-    void *payload = NULL;
-    Error *local_err = NULL;
-
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, s->info.structured_reply,
-                            qiov, &reply, &payload)
-    {
-        int ret;
-        NBDStructuredReplyChunk *chunk = &reply.structured;
-
-        assert(nbd_reply_is_structured(&reply));
-
-        switch (chunk->type) {
-        case NBD_REPLY_TYPE_OFFSET_DATA:
-            /* special cased in nbd_co_receive_one_chunk, data is already
-             * in qiov */
-            break;
-        case NBD_REPLY_TYPE_OFFSET_HOLE:
-            ret = nbd_parse_offset_hole_payload(&reply.structured, payload,
-                                                offset, qiov, &local_err);
-            if (ret < 0) {
-                s->quit = true;
-                nbd_iter_error(&iter, true, ret, &local_err);
-            }
-            break;
-        default:
-            if (!nbd_reply_type_is_error(chunk->type)) {
-                /* not allowed reply type */
-                s->quit = true;
-                error_setg(&local_err,
-                           "Unexpected reply type: %d (%s) for CMD_READ",
-                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_error(&iter, true, -EINVAL, &local_err);
-            }
-        }
-
-        g_free(payload);
-        payload = NULL;
-    }
-
-    error_propagate(errp, iter.err);
-    return iter.ret;
-}
-
-static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
-                                            uint64_t handle, uint64_t length,
-                                            NBDExtent *extent, Error **errp)
-{
-    NBDReplyChunkIter iter;
-    NBDReply reply;
-    void *payload = NULL;
-    Error *local_err = NULL;
-    bool received = false;
-
-    assert(!extent->length);
-    NBD_FOREACH_REPLY_CHUNK(s, iter, handle, s->info.structured_reply,
-                            NULL, &reply, &payload)
-    {
-        int ret;
-        NBDStructuredReplyChunk *chunk = &reply.structured;
-
-        assert(nbd_reply_is_structured(&reply));
-
-        switch (chunk->type) {
-        case NBD_REPLY_TYPE_BLOCK_STATUS:
-            if (received) {
-                s->quit = true;
-                error_setg(&local_err, "Several BLOCK_STATUS chunks in reply");
-                nbd_iter_error(&iter, true, -EINVAL, &local_err);
-            }
-            received = true;
-
-            ret = nbd_parse_blockstatus_payload(s, &reply.structured,
-                                                payload, length, extent,
-                                                &local_err);
-            if (ret < 0) {
-                s->quit = true;
-                nbd_iter_error(&iter, true, ret, &local_err);
-            }
-            break;
-        default:
-            if (!nbd_reply_type_is_error(chunk->type)) {
-                s->quit = true;
-                error_setg(&local_err,
-                           "Unexpected reply type: %d (%s) "
-                           "for CMD_BLOCK_STATUS",
-                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_error(&iter, true, -EINVAL, &local_err);
-            }
-        }
-
-        g_free(payload);
-        payload = NULL;
-    }
-
-    if (!extent->length && !iter.err) {
-        error_setg(&iter.err,
-                   "Server did not reply with any status extents");
-        if (!iter.ret) {
-            iter.ret = -EIO;
-        }
-    }
-    error_propagate(errp, iter.err);
-    return iter.ret;
-}
-
-static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
-                          QEMUIOVector *write_qiov)
-{
-    int ret;
-    Error *local_err = NULL;
-    NBDClientSession *client = nbd_get_client_session(bs);
-
-    assert(request->type != NBD_CMD_READ);
-    if (write_qiov) {
-        assert(request->type == NBD_CMD_WRITE);
-        assert(request->len == iov_size(write_qiov->iov, write_qiov->niov));
-    } else {
-        assert(request->type != NBD_CMD_WRITE);
-    }
-    ret = nbd_co_send_request(bs, request, write_qiov);
-    if (ret < 0) {
-        return ret;
-    }
-
-    ret = nbd_co_receive_return_code(client, request->handle, &local_err);
-    if (local_err) {
-        error_report_err(local_err);
-    }
-    return ret;
 }

 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    int ret;
-    Error *local_err = NULL;
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
        .type = NBD_CMD_READ,
        .from = offset,
        .len = bytes,
    };
+    NBDReply reply;
+    ssize_t ret;

    assert(bytes <= NBD_MAX_BUFFER_SIZE);
    assert(!flags);

-    if (!bytes) {
-        return 0;
-    }
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
-        return ret;
+        reply.error = -ret;
+    } else {
+        nbd_co_receive_reply(client, &request, &reply, qiov);
    }
-
-    ret = nbd_co_receive_cmdread_reply(client, request.handle, offset, qiov,
-                                       &local_err);
-    if (local_err) {
-        error_report_err(local_err);
-    }
-    return ret;
+    return -reply.error;
 }

 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
@@ -817,8 +253,9 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
        .from = offset,
        .len = bytes,
    };
+    NBDReply reply;
+    ssize_t ret;

-    assert(!(client->info.flags & NBD_FLAG_READ_ONLY));
    if (flags & BDRV_REQ_FUA) {
        assert(client->info.flags & NBD_FLAG_SEND_FUA);
        request.flags |= NBD_CMD_FLAG_FUA;
@@ -826,23 +263,27 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,

    assert(bytes <= NBD_MAX_BUFFER_SIZE);

-    if (!bytes) {
-        return 0;
+    ret = nbd_co_send_request(bs, &request, qiov);
+    if (ret < 0) {
+        reply.error = -ret;
+    } else {
+        nbd_co_receive_reply(client, &request, &reply, NULL);
    }
-    return nbd_co_request(bs, &request, qiov);
+    return -reply.error;
 }

 int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
                                int bytes, BdrvRequestFlags flags)
 {
+    ssize_t ret;
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
        .type = NBD_CMD_WRITE_ZEROES,
        .from = offset,
        .len = bytes,
    };
+    NBDReply reply;

-    assert(!(client->info.flags & NBD_FLAG_READ_ONLY));
    if (!(client->info.flags & NBD_FLAG_SEND_WRITE_ZEROES)) {
        return -ENOTSUP;
    }
@@ -855,16 +296,21 @@ int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
        request.flags |= NBD_CMD_FLAG_NO_HOLE;
    }

-    if (!bytes) {
-        return 0;
+    ret = nbd_co_send_request(bs, &request, NULL);
+    if (ret < 0) {
+        reply.error = -ret;
+    } else {
+        nbd_co_receive_reply(client, &request, &reply, NULL);
    }
-    return nbd_co_request(bs, &request, NULL);
+    return -reply.error;
 }

 int nbd_client_co_flush(BlockDriverState *bs)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = { .type = NBD_CMD_FLUSH };
+    NBDReply reply;
+    ssize_t ret;

    if (!(client->info.flags & NBD_FLAG_SEND_FLUSH)) {
        return 0;
@@ -873,7 +319,13 @@ int nbd_client_co_flush(BlockDriverState *bs)
    request.from = 0;
    request.len = 0;

-    return nbd_co_request(bs, &request, NULL);
+    ret = nbd_co_send_request(bs, &request, NULL);
+    if (ret < 0) {
+        reply.error = -ret;
+    } else {
+        nbd_co_receive_reply(client, &request, &reply, NULL);
+    }
+    return -reply.error;
 }

 int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
@@ -884,58 +336,21 @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
        .from = offset,
        .len = bytes,
    };
+    NBDReply reply;
+    ssize_t ret;

-    assert(!(client->info.flags & NBD_FLAG_READ_ONLY));
-    if (!(client->info.flags & NBD_FLAG_SEND_TRIM) || !bytes) {
+    if (!(client->info.flags & NBD_FLAG_SEND_TRIM)) {
        return 0;
    }

-    return nbd_co_request(bs, &request, NULL);
-}
-
-int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
-                                            bool want_zero,
-                                            int64_t offset, int64_t bytes,
-                                            int64_t *pnum, int64_t *map,
-                                            BlockDriverState **file)
-{
-    int64_t ret;
-    NBDExtent extent = { 0 };
-    NBDClientSession *client = nbd_get_client_session(bs);
-    Error *local_err = NULL;
-
-    NBDRequest request = {
-        .type = NBD_CMD_BLOCK_STATUS,
-        .from = offset,
-        .len = MIN(MIN_NON_ZERO(QEMU_ALIGN_DOWN(INT_MAX,
-                                                bs->bl.request_alignment),
-                                client->info.max_block), bytes),
-        .flags = NBD_CMD_FLAG_REQ_ONE,
-    };
-
-    if (!client->info.base_allocation) {
-        *pnum = bytes;
-        return BDRV_BLOCK_DATA;
-    }
-
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
-        return ret;
+        reply.error = -ret;
+    } else {
+        nbd_co_receive_reply(client, &request, &reply, NULL);
    }
+    return -reply.error;

-    ret = nbd_co_receive_blockstatus_reply(client, request.handle, bytes,
-                                           &extent, &local_err);
-    if (local_err) {
-        error_report_err(local_err);
-    }
-    if (ret < 0) {
-        return ret;
-    }
-
-    assert(extent.length);
-    *pnum = extent.length;
-    return (extent.flags & NBD_STATE_HOLE ? 0 : BDRV_BLOCK_DATA) |
-           (extent.flags & NBD_STATE_ZERO ? BDRV_BLOCK_ZERO : 0);
 }

 void nbd_client_detach_aio_context(BlockDriverState *bs)
@@ -971,7 +386,6 @@ int nbd_client_init(BlockDriverState *bs,
                    const char *export,
                    QCryptoTLSCreds *tlscreds,
                    const char *hostname,
-                    const char *x_dirty_bitmap,
                    Error **errp)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
@@ -982,29 +396,13 @@ int nbd_client_init(BlockDriverState *bs,
    qio_channel_set_blocking(QIO_CHANNEL(sioc), true, NULL);

    client->info.request_sizes = true;
-    client->info.structured_reply = true;
-    client->info.base_allocation = true;
-    client->info.x_dirty_bitmap = g_strdup(x_dirty_bitmap);
    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), export,
                                tlscreds, hostname,
                                &client->ioc, &client->info, errp);
-    g_free(client->info.x_dirty_bitmap);
    if (ret < 0) {
        logout("Failed to negotiate with the NBD server\n");
        return ret;
    }
-    if (x_dirty_bitmap && !client->info.base_allocation) {
-        error_setg(errp, "requested x-dirty-bitmap %s not found",
-                   x_dirty_bitmap);
-        ret = -EINVAL;
-        goto fail;
-    }
-    if (client->info.flags & NBD_FLAG_READ_ONLY) {
-        ret = bdrv_apply_auto_read_only(bs, "NBD export is read-only", errp);
-        if (ret < 0) {
-            goto fail;
-        }
-    }
    if (client->info.flags & NBD_FLAG_SEND_FUA) {
        bs->supported_write_flags = BDRV_REQ_FUA;
        bs->supported_zero_flags |= BDRV_REQ_FUA;
@@ -1012,6 +410,9 @@ int nbd_client_init(BlockDriverState *bs,
    if (client->info.flags & NBD_FLAG_SEND_WRITE_ZEROES) {
        bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
    }
+    if (client->info.min_block > bs->bl.request_alignment) {
+        bs->bl.request_alignment = client->info.min_block;
+    }

    qemu_co_mutex_init(&client->send_mutex);
    qemu_co_queue_init(&client->free_sema);
@@ -1031,17 +432,4 @@ int nbd_client_init(BlockDriverState *bs,

    logout("Established connection with NBD server\n");
    return 0;
-
- fail:
-    /*
-     * We have connected, but must fail for other reasons. The
-     * connection is still blocking; send NBD_CMD_DISC as a courtesy
-     * to the server.
-     */
-    {
-        NBDRequest request = { .type = NBD_CMD_DISC };
-
-        nbd_send_request(client->ioc ?: QIO_CHANNEL(sioc), &request);
-        return ret;
-    }
 }
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -19,7 +19,6 @@

 typedef struct {
    Coroutine *coroutine;
-    uint64_t offset;        /* original offset of the request */
    bool receiving;         /* waiting for read_reply_co? */
 } NBDClientRequest;

@@ -45,7 +44,6 @@ int nbd_client_init(BlockDriverState *bs,
                    const char *export_name,
                    QCryptoTLSCreds *tlscreds,
                    const char *hostname,
-                    const char *x_dirty_bitmap,
                    Error **errp);
 void nbd_client_close(BlockDriverState *bs);

@@ -62,10 +60,4 @@ void nbd_client_detach_aio_context(BlockDriverState *bs);
 void nbd_client_attach_aio_context(BlockDriverState *bs,
                                   AioContext *new_context);

-int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
-                                            bool want_zero,
-                                            int64_t offset, int64_t bytes,
-                                            int64_t *pnum, int64_t *map,
-                                            BlockDriverState **file);
-
 #endif /* NBD_CLIENT_H */
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -27,17 +27,16 @@
 */

 #include "qemu/osdep.h"
-#include "nbd-client.h"
-#include "block/qdict.h"
+#include "block/nbd-client.h"
 #include "qapi/error.h"
 #include "qemu/uri.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
-#include "qemu/option.h"
-#include "qapi/qapi-visit-sockets.h"
+#include "qapi-visit.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
 #include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qstring.h"
 #include "qemu/cutils.h"

@@ -109,7 +108,7 @@ static int nbd_parse_uri(const char *filename, QDict *options)
        /* strip braces from literal IPv6 address */
        if (uri->server[0] == '[') {
            host = qstring_from_substr(uri->server, 1,
-                                       strlen(uri->server) - 1);
+                                       strlen(uri->server) - 2);
        } else {
            host = qstring_from_str(uri->server);
        }
@@ -263,6 +262,7 @@ static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
 {
    SocketAddress *saddr = NULL;
    QDict *addr = NULL;
+    QObject *crumpled_addr = NULL;
    Visitor *iv = NULL;
    Error *local_err = NULL;

@@ -272,11 +272,20 @@ static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
        goto done;
    }

-    iv = qobject_input_visitor_new_flat_confused(addr, errp);
-    if (!iv) {
+    crumpled_addr = qdict_crumple(addr, errp);
+    if (!crumpled_addr) {
        goto done;
    }

+    /*
+     * FIXME .numeric, .to, .ipv4 or .ipv6 don't work with -drive
+     * server.type=inet.  .to doesn't matter, it's ignored anyway.
+     * That's because when @options come from -blockdev or
+     * blockdev_add, members are typed according to the QAPI schema,
+     * but when they come from -drive, they're all QString.  The
+     * visitor expects the former.
+     */
+    iv = qobject_input_visitor_new(crumpled_addr);
    visit_type_SocketAddress(iv, NULL, &saddr, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
@@ -284,7 +293,8 @@ static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
    }

 done:
-    qobject_unref(addr);
+    QDECREF(addr);
+    qobject_decref(crumpled_addr);
    visit_free(iv);
    return saddr;
 }
@@ -378,13 +388,6 @@ static QemuOptsList nbd_runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "ID of the TLS credentials to use",
        },
-        {
-            .name = "x-dirty-bitmap",
-            .type = QEMU_OPT_STRING,
-            .help = "experimental: expose named dirty bitmap in place of "
-                    "block status",
-        },
-        { /* end of list */ }
    },
 };

@@ -444,8 +447,8 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
    }

    /* NBD handshake */
-    ret = nbd_client_init(bs, sioc, s->export, tlscreds, hostname,
-                          qemu_opt_get(opts, "x-dirty-bitmap"), errp);
+    ret = nbd_client_init(bs, sioc, s->export,
+                          tlscreds, hostname, errp);
 error:
    if (sioc) {
        object_unref(OBJECT(sioc));
@@ -470,10 +473,8 @@ static int nbd_co_flush(BlockDriverState *bs)
 static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)
 {
    NBDClientSession *s = nbd_get_client_session(bs);
-    uint32_t min = s->info.min_block;
    uint32_t max = MIN_NON_ZERO(NBD_MAX_BUFFER_SIZE, s->info.max_block);

-    bs->bl.request_alignment = min ? min : BDRV_SECTOR_SIZE;
    bs->bl.max_pdiscard = max;
    bs->bl.max_pwrite_zeroes = max;
    bs->bl.max_transfer = max;
@@ -581,7 +582,6 @@ static BlockDriver bdrv_nbd = {
    .bdrv_detach_aio_context    = nbd_detach_aio_context,
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
-    .bdrv_co_block_status       = nbd_client_co_block_status,
 };

 static BlockDriver bdrv_nbd_tcp = {
@@ -601,7 +601,6 @@ static BlockDriver bdrv_nbd_tcp = {
    .bdrv_detach_aio_context    = nbd_detach_aio_context,
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
-    .bdrv_co_block_status       = nbd_client_co_block_status,
 };

 static BlockDriver bdrv_nbd_unix = {
@@ -621,7 +620,6 @@ static BlockDriver bdrv_nbd_unix = {
    .bdrv_detach_aio_context    = nbd_detach_aio_context,
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
-    .bdrv_co_block_status       = nbd_client_co_block_status,
 };

 static void bdrv_nbd_init(void)
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -1,7 +1,7 @@
 /*
 * QEMU Block driver for native access to files on NFS shares
 *
- * Copyright (c) 2014-2017 Peter Lieven <pl@kamp.de>
+ * Copyright (c) 2014-2016 Peter Lieven <pl@kamp.de>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -25,20 +25,19 @@
 #include "qemu/osdep.h"

 #include <poll.h>
+#include "qemu-common.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "block/block_int.h"
-#include "block/qdict.h"
 #include "trace.h"
 #include "qemu/iov.h"
-#include "qemu/option.h"
 #include "qemu/uri.h"
 #include "qemu/cutils.h"
 #include "sysemu/sysemu.h"
-#include "qapi/qapi-visit-block-core.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
+#include "qapi-visit.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
 #include <nfsc/libnfs.h>
@@ -368,6 +367,49 @@ static int coroutine_fn nfs_co_flush(BlockDriverState *bs)
    return task.ret;
 }

+static QemuOptsList runtime_opts = {
+    .name = "nfs",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "path",
+            .type = QEMU_OPT_STRING,
+            .help = "Path of the image on the host",
+        },
+        {
+            .name = "user",
+            .type = QEMU_OPT_NUMBER,
+            .help = "UID value to use when talking to the server",
+        },
+        {
+            .name = "group",
+            .type = QEMU_OPT_NUMBER,
+            .help = "GID value to use when talking to the server",
+        },
+        {
+            .name = "tcp-syn-count",
+            .type = QEMU_OPT_NUMBER,
+            .help = "Number of SYNs to send during the session establish",
+        },
+        {
+            .name = "readahead-size",
+            .type = QEMU_OPT_NUMBER,
+            .help = "Set the readahead size in bytes",
+        },
+        {
+            .name = "page-cache-size",
+            .type = QEMU_OPT_NUMBER,
+            .help = "Set the pagecache size in bytes",
+        },
+        {
+            .name = "debug",
+            .type = QEMU_OPT_NUMBER,
+            .help = "Set the NFS debug level (max 2)",
+        },
+        { /* end of list */ }
+    },
+};
+
 static void nfs_detach_aio_context(BlockDriverState *bs)
 {
    NFSClient *client = bs->opaque;
@@ -410,16 +452,71 @@ static void nfs_file_close(BlockDriverState *bs)
    nfs_client_close(client);
 }

-static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
+static NFSServer *nfs_config(QDict *options, Error **errp)
+{
+    NFSServer *server = NULL;
+    QDict *addr = NULL;
+    QObject *crumpled_addr = NULL;
+    Visitor *iv = NULL;
+    Error *local_error = NULL;
+
+    qdict_extract_subqdict(options, &addr, "server.");
+    if (!qdict_size(addr)) {
+        error_setg(errp, "NFS server address missing");
+        goto out;
+    }
+
+    crumpled_addr = qdict_crumple(addr, errp);
+    if (!crumpled_addr) {
+        goto out;
+    }
+
+    /*
+     * Caution: this works only because all scalar members of
+     * NFSServer are QString in @crumpled_addr.  The visitor expects
+     * @crumpled_addr to be typed according to the QAPI schema.  It
+     * is when @options come from -blockdev or blockdev_add.  But when
+     * they come from -drive, they're all QString.
+     */
+    iv = qobject_input_visitor_new(crumpled_addr);
+    visit_type_NFSServer(iv, NULL, &server, &local_error);
+    if (local_error) {
+        error_propagate(errp, local_error);
+        goto out;
+    }
+
+out:
+    QDECREF(addr);
+    qobject_decref(crumpled_addr);
+    visit_free(iv);
+    return server;
+}
+
+
+static int64_t nfs_client_open(NFSClient *client, QDict *options,
                               int flags, int open_flags, Error **errp)
 {
-    int64_t ret = -EINVAL;
+    int ret = -EINVAL;
+    QemuOpts *opts = NULL;
+    Error *local_err = NULL;
    struct stat st;
    char *file = NULL, *strp = NULL;

    qemu_mutex_init(&client->mutex);
+    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        ret = -EINVAL;
+        goto fail;
+    }

-    client->path = g_strdup(opts->path);
+    client->path = g_strdup(qemu_opt_get(opts, "path"));
+    if (!client->path) {
+        ret = -EINVAL;
+        error_setg(errp, "No path was specified");
+        goto fail;
+    }

    strp = strrchr(client->path, '/');
    if (strp == NULL) {
@@ -429,10 +526,12 @@ static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
    file = g_strdup(strp);
    *strp = 0;

-    /* Steal the NFSServer object from opts; set the original pointer to NULL
-     * to avoid use after free and double free. */
-    client->server = opts->server;
-    opts->server = NULL;
+    /* Pop the config into our state object, Exit if invalid */
+    client->server = nfs_config(options, errp);
+    if (!client->server) {
+        ret = -EINVAL;
+        goto fail;
+    }

    client->context = nfs_init_context();
    if (client->context == NULL) {
@@ -440,29 +539,29 @@ static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
        goto fail;
    }

-    if (opts->has_user) {
-        client->uid = opts->user;
+    if (qemu_opt_get(opts, "user")) {
+        client->uid = qemu_opt_get_number(opts, "user", 0);
        nfs_set_uid(client->context, client->uid);
    }

-    if (opts->has_group) {
-        client->gid = opts->group;
+    if (qemu_opt_get(opts, "group")) {
+        client->gid = qemu_opt_get_number(opts, "group", 0);
        nfs_set_gid(client->context, client->gid);
    }

-    if (opts->has_tcp_syn_count) {
-        client->tcp_syncnt = opts->tcp_syn_count;
+    if (qemu_opt_get(opts, "tcp-syn-count")) {
+        client->tcp_syncnt = qemu_opt_get_number(opts, "tcp-syn-count", 0);
        nfs_set_tcp_syncnt(client->context, client->tcp_syncnt);
    }

 #ifdef LIBNFS_FEATURE_READAHEAD
-    if (opts->has_readahead_size) {
+    if (qemu_opt_get(opts, "readahead-size")) {
        if (open_flags & BDRV_O_NOCACHE) {
            error_setg(errp, "Cannot enable NFS readahead "
                             "if cache.direct = on");
            goto fail;
        }
-        client->readahead = opts->readahead_size;
+        client->readahead = qemu_opt_get_number(opts, "readahead-size", 0);
        if (client->readahead > QEMU_NFS_MAX_READAHEAD_SIZE) {
            warn_report("Truncating NFS readahead size to %d",
                        QEMU_NFS_MAX_READAHEAD_SIZE);
@@ -477,13 +576,13 @@ static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
 #endif

 #ifdef LIBNFS_FEATURE_PAGECACHE
-    if (opts->has_page_cache_size) {
+    if (qemu_opt_get(opts, "page-cache-size")) {
        if (open_flags & BDRV_O_NOCACHE) {
            error_setg(errp, "Cannot enable NFS pagecache "
                             "if cache.direct = on");
            goto fail;
        }
-        client->pagecache = opts->page_cache_size;
+        client->pagecache = qemu_opt_get_number(opts, "page-cache-size", 0);
        if (client->pagecache > QEMU_NFS_MAX_PAGECACHE_SIZE) {
            warn_report("Truncating NFS pagecache size to %d pages",
                        QEMU_NFS_MAX_PAGECACHE_SIZE);
@@ -496,8 +595,8 @@ static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
 #endif

 #ifdef LIBNFS_FEATURE_DEBUG
-    if (opts->has_debug) {
-        client->debug = opts->debug;
+    if (qemu_opt_get(opts, "debug")) {
+        client->debug = qemu_opt_get_number(opts, "debug", 0);
        /* limit the maximum debug level to avoid potential flooding
         * of our log files. */
        if (client->debug > QEMU_NFS_MAX_DEBUG_LEVEL) {
@@ -548,58 +647,11 @@ static int64_t nfs_client_open(NFSClient *client, BlockdevOptionsNfs *opts,
 fail:
    nfs_client_close(client);
 out:
+    qemu_opts_del(opts);
    g_free(file);
    return ret;
 }

-static BlockdevOptionsNfs *nfs_options_qdict_to_qapi(QDict *options,
-                                                     Error **errp)
-{
-    BlockdevOptionsNfs *opts = NULL;
-    Visitor *v;
-    const QDictEntry *e;
-    Error *local_err = NULL;
-
-    v = qobject_input_visitor_new_flat_confused(options, errp);
-    if (!v) {
-        return NULL;
-    }
-
-    visit_type_BlockdevOptionsNfs(v, NULL, &opts, &local_err);
-    visit_free(v);
-
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return NULL;
-    }
-
-    /* Remove the processed options from the QDict (the visitor processes
-     * _all_ options in the QDict) */
-    while ((e = qdict_first(options))) {
-        qdict_del(options, e->key);
-    }
-
-    return opts;
-}
-
-static int64_t nfs_client_open_qdict(NFSClient *client, QDict *options,
-                                     int flags, int open_flags, Error **errp)
-{
-    BlockdevOptionsNfs *opts;
-    int ret;
-
-    opts = nfs_options_qdict_to_qapi(options, errp);
-    if (opts == NULL) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = nfs_client_open(client, opts, flags, open_flags, errp);
-fail:
-    qapi_free_BlockdevOptionsNfs(opts);
-    return ret;
-}
-
 static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp) {
    NFSClient *client = bs->opaque;
@@ -607,9 +659,9 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,

    client->aio_context = bdrv_get_aio_context(bs);

-    ret = nfs_client_open_qdict(client, options,
-                                (flags & BDRV_O_RDWR) ? O_RDWR : O_RDONLY,
-                                bs->open_flags, errp);
+    ret = nfs_client_open(client, options,
+                          (flags & BDRV_O_RDWR) ? O_RDWR : O_RDONLY,
+                          bs->open_flags, errp);
    if (ret < 0) {
        return ret;
    }
@@ -632,43 +684,18 @@ static QemuOptsList nfs_create_opts = {
    }
 };

-static int nfs_file_co_create(BlockdevCreateOptions *options, Error **errp)
+static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
 {
-    BlockdevCreateOptionsNfs *opts = &options->u.nfs;
+    int ret = 0;
+    int64_t total_size = 0;
    NFSClient *client = g_new0(NFSClient, 1);
-    int ret;
-
-    assert(options->driver == BLOCKDEV_DRIVER_NFS);
+    QDict *options = NULL;

    client->aio_context = qemu_get_aio_context();

-    ret = nfs_client_open(client, opts->location, O_CREAT, 0, errp);
-    if (ret < 0) {
-        goto out;
-    }
-    ret = nfs_ftruncate(client->context, client->fh, opts->size);
-    nfs_client_close(client);
-
-out:
-    g_free(client);
-    return ret;
-}
-
-static int coroutine_fn nfs_file_co_create_opts(const char *url, QemuOpts *opts,
-                                                Error **errp)
-{
-    BlockdevCreateOptions *create_options;
-    BlockdevCreateOptionsNfs *nfs_opts;
-    QDict *options;
-    int ret;
-
-    create_options = g_new0(BlockdevCreateOptions, 1);
-    create_options->driver = BLOCKDEV_DRIVER_NFS;
-    nfs_opts = &create_options->u.nfs;
-
    /* Read out options */
-    nfs_opts->size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
-                              BDRV_SECTOR_SIZE);
+    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
+                          BDRV_SECTOR_SIZE);

    options = qdict_new();
    ret = nfs_parse_uri(url, options, errp);
@@ -676,21 +703,15 @@ static int coroutine_fn nfs_file_co_create_opts(const char *url, QemuOpts *opts,
        goto out;
    }

-    nfs_opts->location = nfs_options_qdict_to_qapi(options, errp);
-    if (nfs_opts->location == NULL) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    ret = nfs_file_co_create(create_options, errp);
+    ret = nfs_client_open(client, options, O_CREAT, 0, errp);
    if (ret < 0) {
        goto out;
    }
-
-    ret = 0;
+    ret = nfs_ftruncate(client->context, client->fh, total_size);
+    nfs_client_close(client);
 out:
-    qobject_unref(options);
-    qapi_free_BlockdevCreateOptions(create_options);
+    QDECREF(options);
+    g_free(client);
    return ret;
 }

@@ -743,16 +764,15 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
    return (task.ret < 0 ? task.ret : st.st_blocks * 512);
 }

-static int coroutine_fn
-nfs_file_co_truncate(BlockDriverState *bs, int64_t offset,
-                     PreallocMode prealloc, Error **errp)
+static int nfs_file_truncate(BlockDriverState *bs, int64_t offset,
+                             PreallocMode prealloc, Error **errp)
 {
    NFSClient *client = bs->opaque;
    int ret;

    if (prealloc != PREALLOC_MODE_OFF) {
        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_str(prealloc));
+                   PreallocMode_lookup[prealloc]);
        return -ENOTSUP;
    }

@@ -856,8 +876,8 @@ static void nfs_refresh_filename(BlockDriverState *bs, QDict *options)
 }

 #ifdef LIBNFS_FEATURE_PAGECACHE
-static void coroutine_fn nfs_co_invalidate_cache(BlockDriverState *bs,
-                                                 Error **errp)
+static void nfs_invalidate_cache(BlockDriverState *bs,
+                                 Error **errp)
 {
    NFSClient *client = bs->opaque;
    nfs_pagecache_invalidate(client->context, client->fh);
@@ -874,12 +894,11 @@ static BlockDriver bdrv_nfs = {

    .bdrv_has_zero_init             = nfs_has_zero_init,
    .bdrv_get_allocated_file_size   = nfs_get_allocated_file_size,
-    .bdrv_co_truncate               = nfs_file_co_truncate,
+    .bdrv_truncate                  = nfs_file_truncate,

    .bdrv_file_open                 = nfs_file_open,
    .bdrv_close                     = nfs_file_close,
-    .bdrv_co_create                 = nfs_file_co_create,
-    .bdrv_co_create_opts            = nfs_file_co_create_opts,
+    .bdrv_create                    = nfs_file_create,
    .bdrv_reopen_prepare            = nfs_reopen_prepare,

    .bdrv_co_preadv                 = nfs_co_preadv,
@@ -891,7 +910,7 @@ static BlockDriver bdrv_nfs = {
    .bdrv_refresh_filename          = nfs_refresh_filename,

 #ifdef LIBNFS_FEATURE_PAGECACHE
-    .bdrv_co_invalidate_cache       = nfs_co_invalidate_cache,
+    .bdrv_invalidate_cache          = nfs_invalidate_cache,
 #endif
 };

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.1
 .10.1