Update version for 3.1.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qemu-bridge-helper: restrict interface name to IFNAMSIZ
2019-08-02 11:02:35 -05:00 · 2019-07-30 15:44:36 -05:00 · 2019-07-30 15:44:05 -05:00 · 2019-07-30 15:38:45 -05:00 · 2019-07-30 15:19:47 -05:00 · 2019-07-30 15:19:15 -05:00
3231 changed files with 67873 additions and 199184 deletions
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -1,27 +0,0 @@
-env:
-  CIRRUS_CLONE_DEPTH: 1
-
-freebsd_12_task:
-  freebsd_instance:
-    image: freebsd-12-0-release-amd64
-    cpu: 8
-    memory: 8G
-  install_script: pkg install -y
-    bison curl cyrus-sasl git glib gmake gnutls
-    nettle perl5 pixman pkgconf png usbredir
-  script:
-    - mkdir build
-    - cd build
-    - ../configure || { cat config.log; exit 1; }
-    - gmake -j8
-    - gmake -j8 V=1 check
-
-macos_task:
-  osx_instance:
-    image: mojave-base
-  install_script:
-    - brew install pkg-config python glib pixman make sdl2
-  script:
-    - ./configure --python=/usr/local/bin/python3 || { cat config.log; exit 1; }
-    - gmake -j$(sysctl -n hw.ncpu)
-    - gmake check -j$(sysctl -n hw.ncpu)
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-/.doctrees
 /config-devices.*
 /config-all-devices.*
 /config-all-disas.*
@@ -6,7 +5,6 @@
 /config-target.*
 /config.status
 /config-temp
-/elf2dmp
 /trace-events-all
 /trace/generated-events.h
 /trace/generated-events.c
@@ -32,15 +30,78 @@
 /qapi-gen-timestamp
 /qapi/qapi-builtin-types.[ch]
 /qapi/qapi-builtin-visit.[ch]
-/qapi/qapi-commands-*.[ch]
+/qapi/qapi-commands-block-core.[ch]
+/qapi/qapi-commands-block.[ch]
+/qapi/qapi-commands-char.[ch]
+/qapi/qapi-commands-common.[ch]
+/qapi/qapi-commands-crypto.[ch]
+/qapi/qapi-commands-introspect.[ch]
+/qapi/qapi-commands-job.[ch]
+/qapi/qapi-commands-migration.[ch]
+/qapi/qapi-commands-misc.[ch]
+/qapi/qapi-commands-net.[ch]
+/qapi/qapi-commands-rocker.[ch]
+/qapi/qapi-commands-run-state.[ch]
+/qapi/qapi-commands-sockets.[ch]
+/qapi/qapi-commands-tpm.[ch]
+/qapi/qapi-commands-trace.[ch]
+/qapi/qapi-commands-transaction.[ch]
+/qapi/qapi-commands-ui.[ch]
 /qapi/qapi-commands.[ch]
-/qapi/qapi-emit-events.[ch]
-/qapi/qapi-events-*.[ch]
+/qapi/qapi-events-block-core.[ch]
+/qapi/qapi-events-block.[ch]
+/qapi/qapi-events-char.[ch]
+/qapi/qapi-events-common.[ch]
+/qapi/qapi-events-crypto.[ch]
+/qapi/qapi-events-introspect.[ch]
+/qapi/qapi-events-job.[ch]
+/qapi/qapi-events-migration.[ch]
+/qapi/qapi-events-misc.[ch]
+/qapi/qapi-events-net.[ch]
+/qapi/qapi-events-rocker.[ch]
+/qapi/qapi-events-run-state.[ch]
+/qapi/qapi-events-sockets.[ch]
+/qapi/qapi-events-tpm.[ch]
+/qapi/qapi-events-trace.[ch]
+/qapi/qapi-events-transaction.[ch]
+/qapi/qapi-events-ui.[ch]
 /qapi/qapi-events.[ch]
 /qapi/qapi-introspect.[ch]
-/qapi/qapi-types-*.[ch]
+/qapi/qapi-types-block-core.[ch]
+/qapi/qapi-types-block.[ch]
+/qapi/qapi-types-char.[ch]
+/qapi/qapi-types-common.[ch]
+/qapi/qapi-types-crypto.[ch]
+/qapi/qapi-types-introspect.[ch]
+/qapi/qapi-types-job.[ch]
+/qapi/qapi-types-migration.[ch]
+/qapi/qapi-types-misc.[ch]
+/qapi/qapi-types-net.[ch]
+/qapi/qapi-types-rocker.[ch]
+/qapi/qapi-types-run-state.[ch]
+/qapi/qapi-types-sockets.[ch]
+/qapi/qapi-types-tpm.[ch]
+/qapi/qapi-types-trace.[ch]
+/qapi/qapi-types-transaction.[ch]
+/qapi/qapi-types-ui.[ch]
 /qapi/qapi-types.[ch]
-/qapi/qapi-visit-*.[ch]
+/qapi/qapi-visit-block-core.[ch]
+/qapi/qapi-visit-block.[ch]
+/qapi/qapi-visit-char.[ch]
+/qapi/qapi-visit-common.[ch]
+/qapi/qapi-visit-crypto.[ch]
+/qapi/qapi-visit-introspect.[ch]
+/qapi/qapi-visit-job.[ch]
+/qapi/qapi-visit-migration.[ch]
+/qapi/qapi-visit-misc.[ch]
+/qapi/qapi-visit-net.[ch]
+/qapi/qapi-visit-rocker.[ch]
+/qapi/qapi-visit-run-state.[ch]
+/qapi/qapi-visit-sockets.[ch]
+/qapi/qapi-visit-tpm.[ch]
+/qapi/qapi-visit-trace.[ch]
+/qapi/qapi-visit-transaction.[ch]
+/qapi/qapi-visit-ui.[ch]
 /qapi/qapi-visit.[ch]
 /qapi/qapi-doc.texi
 /qemu-doc.html
@@ -106,10 +167,6 @@
 /pc-bios/optionrom/linuxboot_dma.bin
 /pc-bios/optionrom/linuxboot_dma.raw
 /pc-bios/optionrom/linuxboot_dma.img
-/pc-bios/optionrom/pvh.asm
-/pc-bios/optionrom/pvh.bin
-/pc-bios/optionrom/pvh.raw
-/pc-bios/optionrom/pvh.img
 /pc-bios/optionrom/multiboot.asm
 /pc-bios/optionrom/multiboot.bin
 /pc-bios/optionrom/multiboot.raw
@@ -120,7 +177,6 @@
 /pc-bios/optionrom/kvmvapic.img
 /pc-bios/s390-ccw/s390-ccw.elf
 /pc-bios/s390-ccw/s390-ccw.img
-/docs/built
 /docs/interop/qemu-ga-qapi.texi
 /docs/interop/qemu-ga-ref.html
 /docs/interop/qemu-ga-ref.info*
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,73 +0,0 @@
-before_script:
- - apt-get update -qq
- - apt-get install -y -qq flex bison libglib2.0-dev libpixman-1-dev genisoimage
-
-build-system1:
- script:
- - apt-get install -y -qq libgtk-3-dev libvte-dev nettle-dev libcacard-dev
-      libusb-dev libvde-dev libspice-protocol-dev libgl1-mesa-dev
- - ./configure --enable-werror --target-list="aarch64-softmmu alpha-softmmu
-      cris-softmmu hppa-softmmu lm32-softmmu moxie-softmmu microblazeel-softmmu
-      mips64el-softmmu m68k-softmmu ppc-softmmu riscv64-softmmu sparc-softmmu"
- - make -j2
- - make -j2 check
-
-build-system2:
- script:
- - apt-get install -y -qq libsdl2-dev libgcrypt-dev libbrlapi-dev libaio-dev
-      libfdt-dev liblzo2-dev librdmacm-dev libibverbs-dev libibumad-dev
- - ./configure --enable-werror --target-list="tricore-softmmu unicore32-softmmu
-      microblaze-softmmu mips-softmmu riscv32-softmmu s390x-softmmu sh4-softmmu
-      sparc64-softmmu x86_64-softmmu xtensa-softmmu nios2-softmmu or1k-softmmu"
- - make -j2
- - make -j2 check
-
-build-disabled:
- script:
- - ./configure --enable-werror --disable-rdma --disable-slirp --disable-curl
-      --disable-capstone --disable-live-block-migration --disable-glusterfs
-      --disable-replication --disable-coroutine-pool --disable-smartcard
-      --disable-guest-agent --disable-curses --disable-libxml2 --disable-tpm
-      --disable-qom-cast-debug --disable-spice --disable-vhost-vsock
-      --disable-vhost-net --disable-vhost-crypto --disable-vhost-user
-      --target-list="i386-softmmu ppc64-softmmu mips64-softmmu i386-linux-user"
- - make -j2
- - make -j2 check-qtest SPEED=slow
-
-build-tcg-disabled:
- script:
- - apt-get install -y -qq clang libgtk-3-dev libbluetooth-dev libusb-dev
- - ./configure --cc=clang --enable-werror --disable-tcg --audio-drv-list=""
- - make -j2
- - make check-unit
- - make check-qapi-schema
- - cd tests/qemu-iotests/
- - ./check -raw 001 002 003 004 005 008 009 010 011 012 021 025 032 033 048
-            052 063 077 086 101 104 106 113 147 148 150 151 152 157 159 160
-            163 170 171 183 184 192 194 197 205 208 215 221 222 226 227 236
- - ./check -qcow2 001 002 003 004 005 007 008 009 010 011 012 013 017 018 019
-            020 021 022 024 025 027 028 029 031 032 033 034 035 036 037 038
-            039 040 042 043 046 047 048 049 050 051 052 053 054 056 057 058
-            060 061 062 063 065 066 067 068 069 071 072 073 074 079 080 082
-            085 086 089 090 091 095 096 097 098 099 102 103 104 105 107 108
-            110 111 114 117 120 122 124 126 127 129 130 132 133 134 137 138
-            139 140 141 142 143 144 145 147 150 151 152 154 155 156 157 158
-            161 165 170 172 174 176 177 179 184 186 187 190 192 194 195 196
-            197 200 202 203 205 208 209 214 215 216 217 218 222 226 227 229 234
-
-build-user:
- script:
- - ./configure --enable-werror --disable-system --disable-guest-agent
-               --disable-capstone --disable-slirp --disable-fdt
- - make -j2
- - make run-tcg-tests-i386-linux-user run-tcg-tests-x86_64-linux-user
-
-build-clang:
- script:
- - apt-get install -y -qq clang libsdl2-dev
-      xfslibs-dev libiscsi-dev libnfs-dev libseccomp-dev gnutls-dev librbd-dev
- - ./configure --cc=clang --cxx=clang++ --enable-werror
-      --target-list="alpha-softmmu arm-softmmu m68k-softmmu mips64-softmmu
-                     ppc-softmmu s390x-softmmu x86_64-softmmu arm-linux-user"
- - make -j2
- - make -j2 check
--- a/.gitmodules
+++ b/.gitmodules
@@ -49,6 +49,3 @@
 [submodule "tests/fp/berkeley-softfloat-3"]
 	path = tests/fp/berkeley-softfloat-3
 	url = https://github.com/cota/berkeley-softfloat-3
-[submodule "roms/edk2"]
-	path = roms/edk2
-	url = https://github.com/tianocore/edk2.git
--- a/.mailmap
+++ b/.mailmap
@@ -34,6 +34,6 @@ Justin Terry (VM) <juterry@microsoft.com> Justin Terry (VM) via Qemu-devel <qemu


 # Also list preferred name forms where people have changed their
-# git author config, or had utf8/latin1 encoding issues.
+# git author config, or having utf8/latin1 encoding issues.
 Daniel P. Berrangé <berrange@redhat.com>
 Reimar Döffinger <Reimar.Doeffinger@gmx.de>
--- a/.shippable.yml
+++ b/.shippable.yml
@@ -7,11 +7,10 @@ env:
  matrix:
    - IMAGE=debian-amd64
      TARGET_LIST=x86_64-softmmu,x86_64-linux-user
-    # currently disabled as the mxe.cc repos are down
-    # - IMAGE=debian-win32-cross
-    #   TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
-    # - IMAGE=debian-win64-cross
-    #   TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
+    - IMAGE=debian-win32-cross
+      TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
+    - IMAGE=debian-win64-cross
+      TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
    - IMAGE=debian-armel-cross
      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
    - IMAGE=debian-armhf-cross
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,13 +1,14 @@
-# The current Travis default is a VM based 16.04 Xenial on GCE
+# The current Travis default is a container based 14.04 Trust on EC2
 # Additional builds with specific requirements for a full VM need to
 # be added as additional matrix: entries later on
-dist: xenial
+sudo: false
+dist: trusty
 language: c
+python:
+  - "2.6"
 compiler:
  - gcc
 cache: ccache
-
-
 addons:
  apt:
    packages:
@@ -34,15 +35,10 @@ addons:
      - libssh2-1-dev
      - liburcu-dev
      - libusb-1.0-0-dev
-      - libvte-2.91-dev
+      - libvte-2.90-dev
      - sparse
      - uuid-dev
      - gcovr
-  homebrew:
-    packages:
-      - glib
-      - pixman
-

 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
 # to prevent IRC notifications from forks. This was created using:
@@ -53,183 +49,88 @@ notifications:
      - secure: "F7GDRgjuOo5IUyRLqSkmDL7kvdU4UcH3Lm/W2db2JnDHTGCqgEdaYEYKciyCLZ57vOTsTsOgesN8iUT7hNHBd1KWKjZe9KDTZWppWRYVwAwQMzVeSOsbbU4tRoJ6Pp+3qhH1Z0eGYR9ZgKYAoTumDFgSAYRp4IscKS8jkoedOqM="
    on_success: change
    on_failure: always
-
-
 env:
  global:
    - SRC_DIR="."
    - BUILD_DIR="."
-    - BASE_CONFIG="--disable-docs --disable-tools"
-    - TEST_CMD="make check -j3 V=1"
-    # This is broadly a list of "mainline" softmmu targets which have support across the major distros
-    - MAIN_SOFTMMU_TARGETS="aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
-
+    - TEST_CMD="make check"
+    - MAKEFLAGS="-j3"
+  matrix:
+    - CONFIG="--disable-system"
+    - CONFIG="--disable-user"
+    - CONFIG="--enable-debug --enable-debug-tcg"
+    - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-uuid --disable-libusb --disable-user"
+    - CONFIG="--enable-modules --disable-linux-user"
+    - CONFIG="--with-coroutine=ucontext --disable-linux-user"
+    - CONFIG="--with-coroutine=sigaltstack --disable-linux-user"
 git:
  # we want to do this ourselves
  submodules: false
-
-
+before_install:
+  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update ; fi
+  - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew install libffi gettext glib pixman ; fi
+  - git submodule update --init --recursive capstone dtc ui/keycodemapdb
 before_script:
  - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
-  - ${SRC_DIR}/configure ${BASE_CONFIG} ${CONFIG} || { cat config.log && exit 1; }
+  - ${SRC_DIR}/configure ${CONFIG} || { cat config.log && exit 1; }
 script:
-  - make -j3 && ${TEST_CMD}
-
-
+  - make ${MAKEFLAGS} && ${TEST_CMD}
 matrix:
  include:
-    - env:
-        - CONFIG="--disable-system"
-
-
-    # we split the system builds as it takes a while to build them all
-    - env:
-        - CONFIG="--disable-user --target-list=${MAIN_SOFTMMU_TARGETS}"
-
-
-    - env:
-        - CONFIG="--disable-user --target-list-exclude=${MAIN_SOFTMMU_TARGETS}"
-
-
-    # Just build tools and run minimal unit and softfloat checks
-    - env:
-        - BASE_CONFIG="--enable-tools"
-        - CONFIG="--disable-user --disable-system"
-        - TEST_CMD="make check-unit check-softfloat -j3"
-
-    - env:
-        - CONFIG="--enable-debug --enable-debug-tcg --disable-user"
-
-
-    # TCG debug can be run just on it's own and is mostly agnostic to user/softmmu distinctions
-    - env:
-        - CONFIG="--enable-debug-tcg --disable-system"
-
-
-    - env:
-        - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-libusb --disable-replication --target-list=${MAIN_SOFTMMU_TARGETS}"
-
-
-    # Module builds are mostly of interest to major distros
-    - env:
-        - CONFIG="--enable-modules --target-list=${MAIN_SOFTMMU_TARGETS}"
-
-
-    # Alternate coroutines implementations are only really of interest to KVM users
-    # However we can't test against KVM on Travis so we can only run unit tests
-    - env:
-        - CONFIG="--with-coroutine=ucontext --disable-tcg"
-        - TEST_CMD="make check-unit -j3 V=1"
-
-
-    - env:
-        - CONFIG="--with-coroutine=sigaltstack --disable-tcg"
-        - TEST_CMD="make check-unit -j3 V=1"
-
-
-    # Check we can build docs and tools (out of tree)
-    - env:
-        - BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
-        - BASE_CONFIG="--enable-tools --enable-docs"
-        - CONFIG="--target-list=x86_64-softmmu,aarch64-linux-user"
-      addons:
-        apt:
-          packages:
-            - python-sphinx
-            - texinfo
-            - perl
-
-
+    # Test out-of-tree builds
+    - env: CONFIG="--enable-debug --enable-debug-tcg"
+           BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
    # Test with Clang for compile portability (Travis uses clang-5.0)
-    - env:
-        - CONFIG="--disable-system"
+    - env: CONFIG="--disable-system"
      compiler: clang
-
-
-    - env:
-        - CONFIG="--disable-user --target-list=${MAIN_SOFTMMU_TARGETS}"
+    - env: CONFIG="--disable-user"
      compiler: clang
-
-
-    - env:
-        - CONFIG="--disable-user --target-list-exclude=${MAIN_SOFTMMU_TARGETS}"
-      compiler: clang
-
-
    # gprof/gcov are GCC features
-    - env:
-        - CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=${MAIN_SOFTMMU_TARGETS}"
+    - env: CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
      after_success:
        - ${SRC_DIR}/scripts/travis/coverage-summary.sh
-
-
+      compiler: gcc
    # We manually include builds which we disable "make check" for
-    - env:
-        - CONFIG="--without-default-devices --disable-user"
-        - TEST_CMD=""
-
-
-    # We manually include builds which we disable "make check" for
-    - env:
-        - CONFIG="--enable-debug --enable-tcg-interpreter"
-        - TEST_CMD=""
-
-
+    - env: CONFIG="--enable-debug --enable-tcg-interpreter"
+           TEST_CMD=""
+      compiler: gcc
    # We don't need to exercise every backend with every front-end
-    - env:
-        - CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
-        - TEST_CMD=""
-
-
-    - env:
-        - CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
-        - TEST_CMD=""
-
-
-    - env:
-        - CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
-        - TEST_CMD=""
-
-
+    - env: CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
+           TEST_CMD=""
+      compiler: gcc
+    - env: CONFIG="--disable-tcg"
+           TEST_CMD=""
+      compiler: gcc
    # MacOSX builds
-    - env:
-        - CONFIG="--target-list=${MAIN_SOFTMMU_TARGETS}"
+    - env: CONFIG="--target-list=aarch64-softmmu,arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
      os: osx
      osx_image: xcode9.4
      compiler: clang
-
-
-    - env:
-        - CONFIG="--target-list=i386-softmmu,ppc-softmmu,ppc64-softmmu,m68k-softmmu,x86_64-softmmu"
+    - env: CONFIG="--target-list=i386-softmmu,ppc-softmmu,ppc64-softmmu,m68k-softmmu,x86_64-softmmu"
      os: osx
-      osx_image: xcode10.2
+      osx_image: xcode10
      compiler: clang
-
-
    # Python builds
-    - env:
-        - CONFIG="--target-list=x86_64-softmmu"
-      language: python
+    - env: CONFIG="--target-list=x86_64-softmmu"
      python:
-        - "3.4"
-
-
-    - env:
-        - CONFIG="--target-list=x86_64-softmmu"
-      language: python
+        - "3.0"
+    - env: CONFIG="--target-list=x86_64-softmmu"
      python:
        - "3.6"
-
-
    # Acceptance (Functional) tests
-    - env:
-        - CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
-        - TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
+    - env: CONFIG="--python=/usr/bin/python3 --target-list=x86_64-softmmu"
+           TEST_CMD="make AVOCADO_SHOW=app check-acceptance"
      addons:
        apt:
          packages:
            - python3-pip
-            - python3.5-venv
+            - python3.4-venv
    # Using newer GCC with sanitizers
    - addons:
        apt:
@@ -263,7 +164,7 @@ matrix:
            - libssh2-1-dev
            - liburcu-dev
            - libusb-1.0-0-dev
-            - libvte-2.91-dev
+            - libvte-2.90-dev
            - sparse
            - uuid-dev
      language: generic
@@ -274,14 +175,11 @@ matrix:
        - TEST_CMD=""
      before_script:
        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || { cat config.log && exit 1; }
-
-
-    # Run check-tcg against linux-user
    - env:
-        - CONFIG="--disable-system"
-        - TEST_CMD="make -j3 check-tcg V=1"
-
-    # Run check-tcg against softmmu targets
-    - env:
-        - CONFIG="--target-list=xtensa-softmmu,arm-softmmu"
-        - TEST_CMD="make -j3 check-tcg V=1"
+        - CONFIG="--disable-system --disable-docs"
+        - TEST_CMD="make check-tcg"
+      script:
+        - make ${MAKEFLAGS} && ${TEST_CMD} ${MAKEFLAGS}
+      sudo: required
+      dist: trusty
+      compiler: gcc
--- a/COPYING.LIB
+++ b/COPYING.LIB
@@ -1,8 +1,8 @@
-                  GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 2.1, February 1999
+		  GNU LESSER GENERAL PUBLIC LICENSE
+		       Version 2.1, February 1999

 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+	51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

@@ -10,7 +10,7 @@
 as the successor of the GNU Library Public License, version 2, hence
 the version number 2.1.]

-                            Preamble
+			    Preamble

  The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -112,7 +112,7 @@ modification follow.  Pay close attention to the difference between a
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.

-                  GNU LESSER GENERAL PUBLIC LICENSE
+		  GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. This License Agreement applies to any software library or other
@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-
+  
  1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -432,7 +432,7 @@ decision will be guided by the two goals of preserving the free status
 of all derivatives of our free software and of promoting the sharing
 and reuse of software generally.

-                            NO WARRANTY
+			    NO WARRANTY

  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
 WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
@@ -455,7 +455,7 @@ FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
 SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.

-                     END OF TERMS AND CONDITIONS
+		     END OF TERMS AND CONDITIONS

           How to Apply These Terms to Your New Libraries

@@ -476,7 +476,7 @@ convey the exclusion of warranty; and each file should have at least the
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
-    version 2.1 of the License, or (at your option) any later version.
+    version 2 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -485,7 +485,7 @@ convey the exclusion of warranty; and each file should have at least the

    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

 Also add information on how to contact you by electronic and paper mail.

@@ -500,3 +500,5 @@ necessary.  Here is a sample; alter the names:
  Ty Coon, President of Vice

 That's all there is to it!
+
+
--- a/Kconfig.host
+++ b/Kconfig.host
@@ -1,33 +0,0 @@
-# These are "proxy" symbols used to pass config-host.mak values
-# down to Kconfig.  See also MINIKCONF_ARGS in the Makefile:
-# these two need to be kept in sync.
-
-config KVM
-    bool
-
-config LINUX
-    bool
-
-config OPENGL
-    bool
-
-config X11
-    bool
-
-config SPICE
-    bool
-
-config IVSHMEM
-    bool
-
-config TPM
-    bool
-
-config VHOST_USER
-    bool
-
-config XEN
-    bool
-
-config VIRTFS
-    bool
--- a/348
+++ b/348
@@ -110,6 +110,7 @@ Guest CPU cores (TCG):
 ----------------------
 Overall
 L: qemu-devel@nongnu.org
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Richard Henderson <rth@twiddle.net>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
@@ -117,8 +118,6 @@ F: cpus.c
 F: exec.c
 F: accel/tcg/
 F: accel/stubs/tcg-stub.c
-F: scripts/decodetree.py
-F: docs/devel/decodetree.rst
 F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/helper*.h
@@ -128,11 +127,9 @@ F: include/sysemu/cpus.h
 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
 M: Peter Maydell <peter.maydell@linaro.org>
-M: Alex Bennée <alex.bennee@linaro.org>
-S: Maintained
+S: Odd Fixes
 F: fpu/
 F: include/fpu/
-F: tests/fp/

 Alpha
 M: Richard Henderson <rth@twiddle.net>
@@ -186,7 +183,6 @@ F: disas/lm32.c
 F: hw/lm32/
 F: hw/*/lm32_*
 F: hw/*/milkymist-*
-F: include/hw/display/milkymist_tmu2.h
 F: include/hw/char/lm32_juart.h
 F: include/hw/lm32/
 F: tests/tcg/lm32/
@@ -207,23 +203,21 @@ F: disas/microblaze.c
 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: target/mips/
-F: default-configs/*mips*
-F: disas/mips.c
-F: disas/nanomips.cpp
-F: disas/nanomips.h
-F: hw/intc/mips_gic.c
 F: hw/mips/
 F: hw/misc/mips_*
+F: hw/intc/mips_gic.c
 F: hw/timer/mips_gictimer.c
-F: include/hw/intc/mips_gic.h
 F: include/hw/mips/
 F: include/hw/misc/mips_*
+F: include/hw/intc/mips_gic.h
 F: include/hw/timer/mips_gictimer.h
 F: tests/tcg/mips/
-K: ^Subject:.*(?i)mips
+F: disas/mips.c
+F: disas/nanomips.h
+F: disas/nanomips.cpp

 Moxie
 M: Anthony Green <green@moxielogic.com>
@@ -239,9 +233,7 @@ M: Marek Vasut <marex@denx.de>
 S: Maintained
 F: target/nios2/
 F: hw/nios2/
-F: hw/intc/nios2_iic.c
 F: disas/nios2.c
-F: default-configs/nios2-softmmu.mak

 OpenRISC
 M: Stafford Horne <shorne@gmail.com>
@@ -260,17 +252,17 @@ F: include/hw/ppc/
 F: disas/ppc.c

 RISC-V
+M: Michael Clark <mjc@sifive.com>
 M: Palmer Dabbelt <palmer@sifive.com>
 M: Alistair Francis <Alistair.Francis@wdc.com>
 M: Sagar Karandikar <sagark@eecs.berkeley.edu>
 M: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
 L: qemu-riscv@nongnu.org
-S: Supported
+S: Maintained
 F: target/riscv/
 F: hw/riscv/
 F: include/hw/riscv/
-F: linux-user/host/riscv32/
-F: linux-user/host/riscv64/
+F: disas/riscv.c

 S390
 M: Richard Henderson <rth@twiddle.net>
@@ -297,7 +289,6 @@ S: Maintained
 F: target/sparc/
 F: hw/sparc/
 F: hw/sparc64/
-F: include/hw/sparc/sparc64.h
 F: disas/sparc.c

 UniCore32
@@ -340,7 +331,6 @@ F: include/hw/tricore/

 Multiarch Linux User Tests
 M: Alex Bennée <alex.bennee@linaro.org>
-S: Maintained
 F: tests/tcg/multiarch/

 Guest CPU Cores (KVM):
@@ -365,7 +355,7 @@ F: target/arm/kvm.c

 MIPS
 M: James Hogan <jhogan@kernel.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: target/mips/kvm.c

@@ -375,10 +365,9 @@ S: Maintained
 F: target/ppc/kvm.c

 S390
-M: Halil Pasic <pasic@linux.ibm.com>
-M: Cornelia Huck <cohuck@redhat.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
-S: Supported
+M: Cornelia Huck <cohuck@redhat.com>
+S: Maintained
 F: target/s390x/kvm.c
 F: target/s390x/kvm_s390x.h
 F: target/s390x/kvm-stub.c
@@ -407,7 +396,6 @@ Guest CPU Cores (Xen):
 X86
 M: Stefano Stabellini <sstabellini@kernel.org>
 M: Anthony Perard <anthony.perard@citrix.com>
-M: Paul Durrant <paul.durrant@citrix.com>
 L: xen-devel@lists.xenproject.org
 S: Supported
 F: */xen*
@@ -415,12 +403,10 @@ F: hw/9pfs/xen-9p-backend.c
 F: hw/char/xen_console.c
 F: hw/display/xenfb.c
 F: hw/net/xen_nic.c
-F: hw/block/xen*
-F: hw/block/dataplane/xen*
+F: hw/block/xen_*
 F: hw/xen/
 F: hw/xenpv/
 F: hw/i386/xen/
-F: include/hw/block/dataplane/xen*
 F: include/hw/xen/
 F: include/sysemu/xen-mapcache.h

@@ -428,20 +414,15 @@ Hosts:
 ------

 LINUX
-M: Michael S. Tsirkin <mst@redhat.com>
-M: Cornelia Huck <cohuck@redhat.com>
-M: Paolo Bonzini <pbonzini@redhat.com>
+L: qemu-devel@nongnu.org
 S: Maintained
+F: linux-*
 F: linux-headers/
-F: scripts/update-linux-headers.sh

 POSIX
-M: Paolo Bonzini <pbonzini@redhat.com>
+L: qemu-devel@nongnu.org
 S: Maintained
-F: os-posix.c
-F: include/sysemu/os-posix.h
-F: util/*posix*.c
-F: include/qemu/*posix*.h
+F: *posix*

 NETBSD
 L: qemu-devel@nongnu.org
@@ -499,7 +480,6 @@ F: hw/sd/pl181.c
 F: hw/ssi/pl022.c
 F: include/hw/ssi/pl022.h
 F: hw/timer/pl031.c
-F: include/hw/timer/pl031.h
 F: include/hw/arm/primecell.h
 F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
@@ -524,7 +504,6 @@ F: hw/intc/arm*
 F: hw/intc/gic_internal.h
 F: hw/misc/a9scu.c
 F: hw/misc/arm11scu.c
-F: hw/misc/arm_l2x0.c
 F: hw/timer/a9gtimer*
 F: hw/timer/arm*
 F: include/hw/arm/arm*.h
@@ -559,7 +538,6 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
-F: include/hw/*/digic*

 Gumstix
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -597,7 +575,6 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
-F: include/hw/misc/arm_integrator_debug.h

 MCIMX6UL EVK / i.MX6ul
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -617,9 +594,7 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/mcimx7d-sabre.c
 F: hw/arm/fsl-imx7.c
-F: hw/misc/imx7_*.c
 F: include/hw/arm/fsl-imx7.h
-F: include/hw/misc/imx7_*.h
 F: hw/pci-host/designware.c
 F: include/hw/pci-host/designware.h

@@ -631,24 +606,12 @@ F: hw/arm/mps2.c
 F: hw/arm/mps2-tz.c
 F: hw/misc/mps2-*.c
 F: include/hw/misc/mps2-*.h
-F: hw/arm/armsse.c
-F: include/hw/arm/armsse.h
-F: hw/misc/iotkit-secctl.c
-F: include/hw/misc/iotkit-secctl.h
+F: hw/arm/iotkit.c
+F: include/hw/arm/iotkit.h
 F: hw/misc/iotkit-sysctl.c
 F: include/hw/misc/iotkit-sysctl.h
 F: hw/misc/iotkit-sysinfo.c
 F: include/hw/misc/iotkit-sysinfo.h
-F: hw/misc/armsse-cpuid.c
-F: include/hw/misc/armsse-cpuid.h
-F: hw/misc/armsse-mhu.c
-F: include/hw/misc/armsse-mhu.h
-
-Musca
-M: Peter Maydell <peter.maydell@linaro.org>
-L: qemu-arm@nongnu.org
-S: Maintained
-F: hw/arm/musca.c

 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
@@ -663,10 +626,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/nseries.c
-F: hw/input/lm832x.c
-F: hw/input/tsc2005.c
-F: hw/misc/cbus.c
-F: hw/timer/twl92230.c

 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
@@ -674,7 +633,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/palm.c
-F: hw/input/tsc210x.c

 Raspberry Pi
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -711,7 +669,6 @@ F: hw/display/tc6393xb.c
 F: hw/gpio/max7310.c
 F: hw/gpio/zaurus.c
 F: hw/misc/mst_fpga.c
-F: hw/misc/max111x.c
 F: include/hw/arm/pxa.h
 F: include/hw/arm/sharpsl.h

@@ -722,10 +679,10 @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/sabrelite.c
 F: hw/arm/fsl-imx6.c
-F: hw/misc/imx6_*.c
+F: hw/misc/imx6_src.c
 F: hw/ssi/imx_spi.c
 F: include/hw/arm/fsl-imx6.h
-F: include/hw/misc/imx6_*.h
+F: include/hw/misc/imx6_src.h
 F: include/hw/ssi/imx_spi.h

 Sharp SL-5500 (Collie) PDA
@@ -781,9 +738,6 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
 F: include/hw/*/xlnx*.h
-F: include/hw/ssi/xilinx_spips.h
-F: hw/display/dpcd.c
-F: include/hw/display/dpcd.h

 ARM ACPI Subsystem
 M: Shannon Zhao <shannon.zhaosl@gmail.com>
@@ -836,9 +790,7 @@ R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/*aspeed*
-F: hw/misc/pca9552.c
 F: include/hw/*/*aspeed*
-F: include/hw/misc/pca9552*.h
 F: hw/net/ftgmac100.c
 F: include/hw/net/ftgmac100.h

@@ -847,11 +799,9 @@ M: Joel Stanley <joel@jms.id.au>
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
-F: hw/*/nrf51*.c
-F: hw/*/microbit*.c
-F: include/hw/*/nrf51*.h
-F: include/hw/*/microbit*.h
-F: tests/microbit-test.c
+F: hw/arm/nrf51_soc.c
+F: hw/arm/microbit.c
+F: include/hw/arm/nrf51_soc.h

 CRIS Machines
 -------------
@@ -861,15 +811,6 @@ S: Maintained
 F: hw/cris/axis_dev88.c
 F: hw/*/etraxfs_*.c

-HP-PARISC Machines
------------------
-Dino
-M: Richard Henderson <rth@twiddle.net>
-R: Helge Deller <deller@gmx.de>
-S: Odd Fixes
-F: hw/hppa/
-F: pc-bios/hppa-firmware.img
-
 LM32 Machines
 -------------
 EVR32 and uclinux BSP
@@ -905,7 +846,6 @@ petalogix_s3adsp1800
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: hw/microblaze/petalogix_s3adsp1800_mmu.c
-F: include/hw/char/xilinx_uartlite.h

 petalogix_ml605
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -916,48 +856,45 @@ MIPS Machines
 -------------
 Jazz
 M: Hervé Poussineau <hpoussin@reactos.org>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_jazz.c
-F: hw/display/jazz_led.c
-F: hw/dma/rc4030.c

 Malta
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_malta.c

 Mipssim
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Odd Fixes
 F: hw/mips/mips_mipssim.c
 F: hw/net/mipsnet.c

 R4000
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/mips/mips_r4k.c

 Fulong 2E
 M: Aleksandar Markovic <amarkovic@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Odd Fixes
 F: hw/mips/mips_fulong2e.c
 F: hw/isa/vt82c686.c
-F: hw/pci-host/bonito.c
+
 F: include/hw/isa/vt82c686.h

 Boston
 M: Paul Burton <pburton@wavecomp.com>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: hw/core/loader-fit.c
 F: hw/mips/boston.c
 F: hw/pci-host/xilinx-pcie.c
-F: include/hw/pci-host/xilinx-pcie.h

 OpenRISC Machines
 -----------------
@@ -984,11 +921,8 @@ e500
 M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
-F: hw/ppc/e500*
-F: hw/gpio/mpc8xxx.c
-F: hw/i2c/mpc_i2c.c
-F: hw/net/fsl_etsec/
-F: hw/pci-host/ppce500.c
+F: hw/ppc/e500.[hc]
+F: hw/ppc/e500plat.c
 F: include/hw/ppc/ppc_e500.h
 F: include/hw/pci-host/ppce500.h
 F: pc-bios/u-boot.e500
@@ -1000,9 +934,8 @@ S: Odd Fixes
 F: hw/ppc/mpc8544ds.c
 F: hw/ppc/mpc8544_guts.c

-New World (mac99)
-M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-R: David Gibson <david@gibson.dropbear.id.au>
+New World
+M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/mac_newworld.c
@@ -1011,27 +944,18 @@ F: hw/pci-bridge/dec.[hc]
 F: hw/misc/macio/
 F: hw/misc/mos6522.c
 F: hw/nvram/mac_nvram.c
-F: hw/input/adb*
 F: include/hw/misc/macio/
 F: include/hw/misc/mos6522.h
 F: include/hw/ppc/mac_dbdma.h
-F: include/hw/pci-host/uninorth.h
-F: include/hw/input/adb*
-F: pc-bios/qemu_vga.ndrv

-Old World (g3beige)
-M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-R: David Gibson <david@gibson.dropbear.id.au>
+Old World
+M: David Gibson <david@gibson.dropbear.id.au>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/mac_oldworld.c
 F: hw/pci-host/grackle.c
 F: hw/misc/macio/
 F: hw/intc/heathrow_pic.c
-F: hw/input/adb*
-F: include/hw/intc/heathrow_pic.h
-F: include/hw/input/adb*
-F: pc-bios/qemu_vga.ndrv

 PReP
 M: Hervé Poussineau <hpoussin@reactos.org>
@@ -1061,6 +985,7 @@ F: include/hw/*/xics*
 F: pc-bios/spapr-rtas/*
 F: pc-bios/spapr-rtas.bin
 F: pc-bios/slof.bin
+F: pc-bios/skiboot.lid
 F: docs/specs/ppc-spapr-hcalls.txt
 F: docs/specs/ppc-spapr-hotplug.txt
 F: tests/spapr*
@@ -1068,18 +993,6 @@ F: tests/libqos/*spapr*
 F: tests/rtas*
 F: tests/libqos/rtas*

-PowerNV (Non-Virtualized)
-M: Cédric Le Goater <clg@kaod.org>
-M: David Gibson <david@gibson.dropbear.id.au>
-L: qemu-ppc@nongnu.org
-S: Maintained
-F: hw/ppc/pnv*
-F: hw/intc/pnv*
-F: hw/intc/xics_pnv.c
-F: include/hw/ppc/pnv*
-F: pc-bios/skiboot.lid
-F: tests/pnv*
-
 virtex_ml507
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 L: qemu-ppc@nongnu.org
@@ -1090,14 +1003,8 @@ sam460ex
 M: BALATON Zoltan <balaton@eik.bme.hu>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/sam460ex.c
-F: hw/ppc/ppc440_pcix.c
-F: hw/display/sm501*
 F: hw/ide/sii3112.c
 F: hw/timer/m41t80.c
-F: pc-bios/canyonlands.dt[sb]
-F: pc-bios/u-boot-sam460ex-20100605.bin
-F: roms/u-boot-sam460ex

 SH4 Machines
 ------------
@@ -1120,26 +1027,16 @@ M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 S: Maintained
 F: hw/sparc/sun4m.c
 F: hw/sparc/sun4m_iommu.c
-F: hw/display/cg3.c
-F: hw/display/tcx.c
 F: hw/dma/sparc32_dma.c
 F: hw/misc/eccmemctl.c
-F: hw/*/slavio_*.c
-F: include/hw/nvram/sun_nvram.h
+F: hw/misc/slavio_misc.c
 F: include/hw/sparc/sparc32_dma.h
-F: include/hw/sparc/sun4m_iommu.h
 F: pc-bios/openbios-sparc32

 Sun4u
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 S: Maintained
 F: hw/sparc64/sun4u.c
-F: hw/sparc64/sun4u_iommu.c
-F: include/hw/sparc/sun4u_iommu.h
-F: hw/pci-host/sabre.c
-F: include/hw/pci-host/sabre.h
-F: hw/pci-bridge/simba.c
-F: include/hw/pci-bridge/simba.h
 F: pc-bios/openbios-sparc64

 Sun4v
@@ -1160,7 +1057,6 @@ S390 Machines
 -------------
 S390 Virtio-ccw
 M: Cornelia Huck <cohuck@redhat.com>
-M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: hw/char/sclp*.[hc]
@@ -1219,10 +1115,6 @@ F: hw/acpi/ich9.c
 F: include/hw/acpi/ich9.h
 F: include/hw/acpi/piix4.h
 F: hw/misc/sga.c
-F: hw/isa/apm.c
-F: include/hw/isa/apm.h
-F: tests/test-x86-cpuid.c
-F: tests/test-x86-cpuid-compat.c

 PC Chipset
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -1244,13 +1136,11 @@ F: hw/timer/hpet*
 F: hw/timer/i8254*
 F: hw/timer/mc146818rtc*
 F: hw/watchdog/wdt_ib700.c
-F: hw/watchdog/wdt_i6300esb.c
 F: include/hw/display/vga.h
 F: include/hw/char/parallel.h
 F: include/hw/dma/i8257.h
 F: include/hw/i2c/pm_smbus.h
 F: include/hw/input/i8042.h
-F: include/hw/isa/i8259_internal.h
 F: include/hw/isa/superio.h
 F: include/hw/timer/hpet.h
 F: include/hw/timer/i8254*
@@ -1262,9 +1152,7 @@ M: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
 S: Supported
 F: hw/core/machine.c
 F: hw/core/null-machine.c
-F: hw/cpu/cluster.c
 F: include/hw/boards.h
-F: include/hw/cpu/cluster.h
 T: git https://github.com/ehabkost/qemu.git machine-next

 Xtensa Machines
@@ -1350,7 +1238,7 @@ M: Michael S. Tsirkin <mst@redhat.com>
 M: Igor Mammedov <imammedo@redhat.com>
 S: Supported
 F: include/hw/acpi/*
-F: include/hw/firmware/smbios.h
+F: include/hw/smbios/*
 F: hw/mem/*
 F: hw/acpi/*
 F: hw/smbios/*
@@ -1358,7 +1246,8 @@ F: hw/i386/acpi-build.[hc]
 F: hw/arm/virt-acpi-build.c
 F: tests/bios-tables-test.c
 F: tests/acpi-utils.[hc]
-F: tests/data/acpi/
+F: tests/acpi-test-data/*
+F: tests/acpi-test-data/*/*

 ppc4xx
 M: David Gibson <david@gibson.dropbear.id.au>
@@ -1369,6 +1258,14 @@ F: hw/i2c/ppc4xx_i2c.c
 F: include/hw/ppc/ppc4xx.h
 F: include/hw/i2c/ppc4xx_i2c.h

+ppce500
+M: David Gibson <david@gibson.dropbear.id.au>
+L: qemu-ppc@nongnu.org
+S: Odd Fixes
+F: hw/ppc/e500*
+F: hw/pci-host/ppce500.c
+F: hw/net/fsl_etsec/
+
 Character devices
 M: Marc-André Lureau <marcandre.lureau@redhat.com>
 R: Paolo Bonzini <pbonzini@redhat.com>
@@ -1385,7 +1282,7 @@ T: git https://github.com/jasowang/qemu.git net

 SCSI
 M: Paolo Bonzini <pbonzini@redhat.com>
-R: Fam Zheng <fam@euphon.net>
+R: Fam Zheng <famz@redhat.com>
 S: Supported
 F: include/hw/scsi/*
 F: hw/scsi/*
@@ -1393,6 +1290,7 @@ F: tests/virtio-scsi-test.c
 T: git https://github.com/bonzini/qemu.git scsi-next

 SSI
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/ssi/*
@@ -1403,6 +1301,7 @@ F: tests/m25p80-test.c

 Xilinx SPI
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 S: Maintained
 F: hw/ssi/xilinx_*

@@ -1466,9 +1365,7 @@ vhost
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: hw/*/*vhost*
-F: docs/interop/vhost-user.json
 F: docs/interop/vhost-user.txt
-F: contrib/vhost-user-*/

 virtio
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -1581,7 +1478,6 @@ S: Maintained
 F: hw/acpi/nvdimm.c
 F: hw/mem/nvdimm.c
 F: include/hw/mem/nvdimm.h
-F: docs/nvdimm.txt

 e1000x
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
@@ -1669,7 +1565,7 @@ F: include/hw/display/edid.h
 F: qemu-edid.c

 Firmware configuration (fw_cfg)
-M: Philippe Mathieu-Daudé <philmd@redhat.com>
+M: Philippe Mathieu-DaudÃ© <philmd@redhat.com>
 R: Laszlo Ersek <lersek@redhat.com>
 R: Gerd Hoffmann <kraxel@redhat.com>
 S: Supported
@@ -1681,14 +1577,6 @@ F: tests/libqos/fw_cfg.c
 F: tests/fw_cfg-test.c
 T: git https://github.com/philmd/qemu.git fw_cfg-next

-XIVE
-M: David Gibson <david@gibson.dropbear.id.au>
-M: Cédric Le Goater <clg@kaod.org>
-L: qemu-ppc@nongnu.org
-S: Supported
-F: hw/*/*xive*
-F: include/hw/*/*xive*
-
 Subsystems
 ----------
 Audio
@@ -1720,7 +1608,7 @@ T: git https://repo.or.cz/qemu/kevin.git block

 Block I/O path
 M: Stefan Hajnoczi <stefanha@redhat.com>
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: util/async.c
@@ -1734,14 +1622,14 @@ T: git https://github.com/stefanha/qemu.git block

 Block SCSI subsystem
 M: Paolo Bonzini <pbonzini@redhat.com>
-R: Fam Zheng <fam@euphon.net>
+R: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: include/scsi/*
 F: scsi/*

 Block Jobs
-M: John Snow <jsnow@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: blockjob.c
@@ -1754,7 +1642,7 @@ F: block/commit.c
 F: block/stream.c
 F: block/mirror.c
 F: qapi/job.json
-T: git https://github.com/jnsnow/qemu.git jobs
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Block QAPI, monitor, command line
 M: Markus Armbruster <armbru@redhat.com>
@@ -1766,7 +1654,7 @@ F: qapi/transaction.json
 T: git https://repo.or.cz/qemu/armbru.git block-next

 Dirty Bitmaps
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 M: John Snow <jsnow@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
@@ -1813,6 +1701,7 @@ F: qom/cpu.c
 F: include/qom/cpu.h

 Device Tree
+M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: device_tree.c
@@ -1838,7 +1727,8 @@ F: util/error.c
 F: util/qemu-error.c

 GDB stub
-S: Orphan
+L: qemu-devel@nongnu.org
+S: Odd Fixes
 F: gdbstub*
 F: gdb-xml/

@@ -1862,7 +1752,6 @@ F: ui/spice-*.c
 F: audio/spiceaudio.c
 F: hw/display/qxl*
 F: qapi/ui.json
-F: docs/spice-port-fqdn.txt

 Graphics
 M: Gerd Hoffmann <kraxel@redhat.com>
@@ -1974,14 +1863,10 @@ F: include/qapi/qmp/
 X: include/qapi/qmp/dispatch.h
 F: scripts/coccinelle/qobject.cocci
 F: tests/check-qdict.c
+F: tests/check-qnum.c
 F: tests/check-qjson.c
 F: tests/check-qlist.c
-F: tests/check-qlit.c
-F: tests/check-qnull.c
-F: tests/check-qnum.c
-F: tests/check-qobject.c
 F: tests/check-qstring.c
-F: tests/data/qobject/qdict.txt
 T: git https://repo.or.cz/qemu/armbru.git qapi-next

 QEMU Guest Agent
@@ -2011,7 +1896,6 @@ S: Supported
 F: qmp.c
 F: monitor.c
 F: docs/devel/*qmp-*
-F: docs/interop/*qmp-*
 F: scripts/qmp/
 F: tests/qmp-test.c
 F: tests/qmp-cmd-test.c
@@ -2057,7 +1941,6 @@ F: trace-events
 F: qemu-option-trace.texi
 F: scripts/tracetool.py
 F: scripts/tracetool/
-F: scripts/qemu-trace-stap*
 F: docs/devel/tracing.txt
 T: git https://github.com/stefanha/qemu.git tracing

@@ -2103,14 +1986,11 @@ F: crypto/
 F: include/crypto/
 F: tests/test-crypto-*
 F: tests/benchmark-crypto-*
-F: tests/crypto-tls-*
-F: tests/pkix_asn1_tab.c
 F: qemu.sasl

 Coroutines
 M: Stefan Hajnoczi <stefanha@redhat.com>
 M: Kevin Wolf <kwolf@redhat.com>
-S: Maintained
 F: util/*coroutine*
 F: include/qemu/coroutine*
 F: tests/test-coroutine.c
@@ -2128,14 +2008,6 @@ F: io/
 F: include/io/
 F: tests/test-io-*

-User authorization
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Maintained
-F: authz/
-F: qapi/authz.json
-F: include/authz/
-F: tests/test-authz-*
-
 Sockets
 M: Daniel P. Berrange <berrange@redhat.com>
 M: Gerd Hoffmann <kraxel@redhat.com>
@@ -2144,13 +2016,6 @@ F: include/qemu/sockets.h
 F: util/qemu-sockets.c
 F: qapi/sockets.json

-File monitor
-M: Daniel P. Berrange <berrange@redhat.com>
-S: Odd fixes
-F: util/filemonitor*.c
-F: include/qemu/filemonitor.h
-F: tests/test-util-filemonitor.c
-
 Throttling infrastructure
 M: Alberto Garcia <berto@igalia.com>
 S: Supported
@@ -2163,7 +2028,7 @@ F: tests/test-throttle.c
 L: qemu-block@nongnu.org

 UUID
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 S: Supported
 F: util/uuid.c
 F: include/qemu/uuid.h
@@ -2209,18 +2074,6 @@ M: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
 S: Maintained
 F: contrib/elf2dmp/

-I2C and SMBus
-M: Corey Minyard <cminyard@mvista.com>
-S: Maintained
-F: hw/i2c/core.c
-F: hw/i2c/smbus_slave.c
-F: hw/i2c/smbus_master.c
-F: hw/i2c/smbus_eeprom.c
-F: include/hw/i2c/i2c.h
-F: include/hw/i2c/smbus_master.h
-F: include/hw/i2c/smbus_slave.h
-F: include/hw/i2c/smbus_eeprom.h
-
 Usermode Emulation
 ------------------
 Overall
@@ -2266,14 +2119,14 @@ F: tcg/arm/
 F: disas/arm.c

 i386 target
-M: Richard Henderson <rth@twiddle.net>
+L: qemu-devel@nongnu.org
 S: Maintained
 F: tcg/i386/
 F: disas/i386.c

 MIPS target
 M: Aurelien Jarno <aurelien@aurel32.net>
-R: Aleksandar Rikalo <arikalo@wavecomp.com>
+R: Stefan Markovic <smarkovic@wavecomp.com>
 S: Maintained
 F: tcg/mips/
 F: disas/mips.c
@@ -2284,14 +2137,6 @@ S: Odd Fixes
 F: tcg/ppc/
 F: disas/ppc.c

-RISC-V
-M: Palmer Dabbelt <palmer@sifive.com>
-M: Alistair Francis <Alistair.Francis@wdc.com>
-L: qemu-riscv@nongnu.org
-S: Maintained
-F: tcg/riscv/
-F: disas/riscv.c
-
 S390 target
 M: Richard Henderson <rth@twiddle.net>
 S: Maintained
@@ -2314,29 +2159,33 @@ F: disas/tci.c
 Block drivers
 -------------
 VMDK
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/vmdk.c

 RBD
 M: Josh Durgin <jdurgin@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/rbd.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Sheepdog
 M: Liu Yuan <namei.unix@gmail.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
-L: sheepdog@lists.wpkg.org
-S: Odd Fixes
+S: Supported
 F: block/sheepdog.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 VHDX
-M: Jeff Cody <codyprime@gmail.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/vhdx*
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 VDI
 M: Stefan Weil <sw@weilnetz.de>
@@ -2366,35 +2215,43 @@ F: docs/interop/nbd.txt
 T: git https://repo.or.cz/qemu/ericb.git nbd

 NFS
+M: Jeff Cody <jcody@redhat.com>
 M: Peter Lieven <pl@kamp.de>
 L: qemu-block@nongnu.org
 S: Maintained
 F: block/nfs.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 SSH
 M: Richard W.M. Jones <rjones@redhat.com>
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/ssh.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 CURL
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/curl.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 GLUSTER
+M: Jeff Cody <jcody@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/gluster.c
+T: git https://github.com/codyprime/qemu-kvm-jtc.git block

 Null Block Driver
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/null.c

 NVMe Block Driver
-M: Fam Zheng <fam@euphon.net>
+M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/nvme*
@@ -2520,15 +2377,13 @@ S: Maintained
 F: hw/rdma/*
 F: hw/rdma/vmw/*
 F: docs/pvrdma.txt
-F: contrib/rdmacm-mux/*
-F: qapi/rdma.json

 Build and test automation
 -------------------------
 Build and test automation
 M: Alex Bennée <alex.bennee@linaro.org>
-M: Fam Zheng <fam@euphon.net>
-R: Philippe Mathieu-Daudé <philmd@redhat.com>
+M: Fam Zheng <famz@redhat.com>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 S: Maintained
 F: .travis.yml
@@ -2536,28 +2391,13 @@ F: scripts/travis/
 F: .shippable.yml
 F: tests/docker/
 F: tests/vm/
-F: scripts/archive-source.sh
 W: https://travis-ci.org/qemu/qemu
 W: https://app.shippable.com/github/qemu/qemu
 W: http://patchew.org/QEMU/

-FreeBSD Hosted Continuous Integration
-M: Ed Maste <emaste@freebsd.org>
-M: Li-Wen Hsu <lwhsu@freebsd.org>
-L: qemu-devel@nongnu.org
-S: Maintained
-F: .cirrus.yml
-W: https://cirrus-ci.com/github/qemu/qemu
-
-GitLab Continuous Integration
-M: Thomas Huth <thuth@redhat.com>
-S: Maintained
-F: .gitlab-ci.yml
-
 Guest Test Compilation Support
 M: Alex Bennée <alex.bennee@linaro.org>
 R: Philippe Mathieu-Daudé <f4bug@amsat.org>
-S: Maintained
 F: tests/tcg/Makefile
 F: tests/tcg/Makefile.include
 L: qemu-devel@nongnu.org
@@ -2569,12 +2409,6 @@ M: Daniel P. Berrange <berrange@redhat.com>
 S: Odd Fixes
 F: docs/devel/build-system.txt

-GIT Data Mining Config
-M: Alex Bennée <alex.bennee@linaro.org>
-S: Odd Fixes
-F: gitdm.config
-F: contrib/gitdm/*
-
 Incompatible changes
 R: libvir-list@redhat.com
 F: qemu-deprecated.texi
@@ -2585,9 +2419,3 @@ GIT submodules
 M: Daniel P. Berrange <berrange@redhat.com>
 S: Odd Fixes
 F: scripts/git-submodule.sh
-
-Sphinx documentation configuration and build machinery
-M: Peter Maydell <peter.maydell@linaro.org>
-S: Maintained
-F: docs/conf.py
-F: docs/*/conf.py
--- a/392
+++ b/392
@@ -67,7 +67,7 @@ CONFIG_ALL=y
 -include config-all-devices.mak
 -include config-all-disas.mak

-config-host.mak: $(SRC_PATH)/configure $(SRC_PATH)/pc-bios $(SRC_PATH)/VERSION
+config-host.mak: $(SRC_PATH)/configure $(SRC_PATH)/pc-bios
 	@echo $@ is out-of-date, running configure
 	@# TODO: The next lines include code which supports a smooth
 	@# transition from old configurations without config.status.
@@ -87,41 +87,83 @@ endif

 include $(SRC_PATH)/rules.mak

-# Create QEMU_PKGVERSION and FULL_VERSION strings
-# If PKGVERSION is set, use that; otherwise get version and -dirty status from git
-QEMU_PKGVERSION := $(if $(PKGVERSION),$(PKGVERSION),$(shell \
-  cd $(SRC_PATH); \
-  if test -e .git; then \
-    git describe --match 'v*' 2>/dev/null | tr -d '\n'; \
-    if ! git diff-index --quiet HEAD &>/dev/null; then \
-      echo "-dirty"; \
-    fi; \
-  fi))
-
-# Either "version (pkgversion)", or just "version" if pkgversion not set
-FULL_VERSION := $(if $(QEMU_PKGVERSION),$(VERSION) ($(QEMU_PKGVERSION)),$(VERSION))
-
 GENERATED_FILES = qemu-version.h config-host.h qemu-options.def
-
-GENERATED_QAPI_FILES = qapi/qapi-builtin-types.h qapi/qapi-builtin-types.c
-GENERATED_QAPI_FILES += qapi/qapi-types.h qapi/qapi-types.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-types-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-types-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-builtin-visit.h qapi/qapi-builtin-visit.c
-GENERATED_QAPI_FILES += qapi/qapi-visit.h qapi/qapi-visit.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-visit-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-visit-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-commands.h qapi/qapi-commands.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-commands-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-commands-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-emit-events.h qapi/qapi-emit-events.c
-GENERATED_QAPI_FILES += qapi/qapi-events.h qapi/qapi-events.c
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-events-%.h)
-GENERATED_QAPI_FILES += $(QAPI_MODULES:%=qapi/qapi-events-%.c)
-GENERATED_QAPI_FILES += qapi/qapi-introspect.c qapi/qapi-introspect.h
-GENERATED_QAPI_FILES += qapi/qapi-doc.texi
-
-GENERATED_FILES += $(GENERATED_QAPI_FILES)
+GENERATED_FILES += qapi/qapi-builtin-types.h qapi/qapi-builtin-types.c
+GENERATED_FILES += qapi/qapi-types.h qapi/qapi-types.c
+GENERATED_FILES += qapi/qapi-types-block-core.h qapi/qapi-types-block-core.c
+GENERATED_FILES += qapi/qapi-types-block.h qapi/qapi-types-block.c
+GENERATED_FILES += qapi/qapi-types-char.h qapi/qapi-types-char.c
+GENERATED_FILES += qapi/qapi-types-common.h qapi/qapi-types-common.c
+GENERATED_FILES += qapi/qapi-types-crypto.h qapi/qapi-types-crypto.c
+GENERATED_FILES += qapi/qapi-types-introspect.h qapi/qapi-types-introspect.c
+GENERATED_FILES += qapi/qapi-types-job.h qapi/qapi-types-job.c
+GENERATED_FILES += qapi/qapi-types-migration.h qapi/qapi-types-migration.c
+GENERATED_FILES += qapi/qapi-types-misc.h qapi/qapi-types-misc.c
+GENERATED_FILES += qapi/qapi-types-net.h qapi/qapi-types-net.c
+GENERATED_FILES += qapi/qapi-types-rocker.h qapi/qapi-types-rocker.c
+GENERATED_FILES += qapi/qapi-types-run-state.h qapi/qapi-types-run-state.c
+GENERATED_FILES += qapi/qapi-types-sockets.h qapi/qapi-types-sockets.c
+GENERATED_FILES += qapi/qapi-types-tpm.h qapi/qapi-types-tpm.c
+GENERATED_FILES += qapi/qapi-types-trace.h qapi/qapi-types-trace.c
+GENERATED_FILES += qapi/qapi-types-transaction.h qapi/qapi-types-transaction.c
+GENERATED_FILES += qapi/qapi-types-ui.h qapi/qapi-types-ui.c
+GENERATED_FILES += qapi/qapi-builtin-visit.h qapi/qapi-builtin-visit.c
+GENERATED_FILES += qapi/qapi-visit.h qapi/qapi-visit.c
+GENERATED_FILES += qapi/qapi-visit-block-core.h qapi/qapi-visit-block-core.c
+GENERATED_FILES += qapi/qapi-visit-block.h qapi/qapi-visit-block.c
+GENERATED_FILES += qapi/qapi-visit-char.h qapi/qapi-visit-char.c
+GENERATED_FILES += qapi/qapi-visit-common.h qapi/qapi-visit-common.c
+GENERATED_FILES += qapi/qapi-visit-crypto.h qapi/qapi-visit-crypto.c
+GENERATED_FILES += qapi/qapi-visit-introspect.h qapi/qapi-visit-introspect.c
+GENERATED_FILES += qapi/qapi-visit-job.h qapi/qapi-visit-job.c
+GENERATED_FILES += qapi/qapi-visit-migration.h qapi/qapi-visit-migration.c
+GENERATED_FILES += qapi/qapi-visit-misc.h qapi/qapi-visit-misc.c
+GENERATED_FILES += qapi/qapi-visit-net.h qapi/qapi-visit-net.c
+GENERATED_FILES += qapi/qapi-visit-rocker.h qapi/qapi-visit-rocker.c
+GENERATED_FILES += qapi/qapi-visit-run-state.h qapi/qapi-visit-run-state.c
+GENERATED_FILES += qapi/qapi-visit-sockets.h qapi/qapi-visit-sockets.c
+GENERATED_FILES += qapi/qapi-visit-tpm.h qapi/qapi-visit-tpm.c
+GENERATED_FILES += qapi/qapi-visit-trace.h qapi/qapi-visit-trace.c
+GENERATED_FILES += qapi/qapi-visit-transaction.h qapi/qapi-visit-transaction.c
+GENERATED_FILES += qapi/qapi-visit-ui.h qapi/qapi-visit-ui.c
+GENERATED_FILES += qapi/qapi-commands.h qapi/qapi-commands.c
+GENERATED_FILES += qapi/qapi-commands-block-core.h qapi/qapi-commands-block-core.c
+GENERATED_FILES += qapi/qapi-commands-block.h qapi/qapi-commands-block.c
+GENERATED_FILES += qapi/qapi-commands-char.h qapi/qapi-commands-char.c
+GENERATED_FILES += qapi/qapi-commands-common.h qapi/qapi-commands-common.c
+GENERATED_FILES += qapi/qapi-commands-crypto.h qapi/qapi-commands-crypto.c
+GENERATED_FILES += qapi/qapi-commands-introspect.h qapi/qapi-commands-introspect.c
+GENERATED_FILES += qapi/qapi-commands-job.h qapi/qapi-commands-job.c
+GENERATED_FILES += qapi/qapi-commands-migration.h qapi/qapi-commands-migration.c
+GENERATED_FILES += qapi/qapi-commands-misc.h qapi/qapi-commands-misc.c
+GENERATED_FILES += qapi/qapi-commands-net.h qapi/qapi-commands-net.c
+GENERATED_FILES += qapi/qapi-commands-rocker.h qapi/qapi-commands-rocker.c
+GENERATED_FILES += qapi/qapi-commands-run-state.h qapi/qapi-commands-run-state.c
+GENERATED_FILES += qapi/qapi-commands-sockets.h qapi/qapi-commands-sockets.c
+GENERATED_FILES += qapi/qapi-commands-tpm.h qapi/qapi-commands-tpm.c
+GENERATED_FILES += qapi/qapi-commands-trace.h qapi/qapi-commands-trace.c
+GENERATED_FILES += qapi/qapi-commands-transaction.h qapi/qapi-commands-transaction.c
+GENERATED_FILES += qapi/qapi-commands-ui.h qapi/qapi-commands-ui.c
+GENERATED_FILES += qapi/qapi-events.h qapi/qapi-events.c
+GENERATED_FILES += qapi/qapi-events-block-core.h qapi/qapi-events-block-core.c
+GENERATED_FILES += qapi/qapi-events-block.h qapi/qapi-events-block.c
+GENERATED_FILES += qapi/qapi-events-char.h qapi/qapi-events-char.c
+GENERATED_FILES += qapi/qapi-events-common.h qapi/qapi-events-common.c
+GENERATED_FILES += qapi/qapi-events-crypto.h qapi/qapi-events-crypto.c
+GENERATED_FILES += qapi/qapi-events-introspect.h qapi/qapi-events-introspect.c
+GENERATED_FILES += qapi/qapi-events-job.h qapi/qapi-events-job.c
+GENERATED_FILES += qapi/qapi-events-migration.h qapi/qapi-events-migration.c
+GENERATED_FILES += qapi/qapi-events-misc.h qapi/qapi-events-misc.c
+GENERATED_FILES += qapi/qapi-events-net.h qapi/qapi-events-net.c
+GENERATED_FILES += qapi/qapi-events-rocker.h qapi/qapi-events-rocker.c
+GENERATED_FILES += qapi/qapi-events-run-state.h qapi/qapi-events-run-state.c
+GENERATED_FILES += qapi/qapi-events-sockets.h qapi/qapi-events-sockets.c
+GENERATED_FILES += qapi/qapi-events-tpm.h qapi/qapi-events-tpm.c
+GENERATED_FILES += qapi/qapi-events-trace.h qapi/qapi-events-trace.c
+GENERATED_FILES += qapi/qapi-events-transaction.h qapi/qapi-events-transaction.c
+GENERATED_FILES += qapi/qapi-events-ui.h qapi/qapi-events-ui.c
+GENERATED_FILES += qapi/qapi-introspect.c qapi/qapi-introspect.h
+GENERATED_FILES += qapi/qapi-doc.texi

 GENERATED_FILES += trace/generated-tcg-tracers.h

@@ -159,7 +201,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace.h: %/trace.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=h \
@@ -168,7 +210,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace.c: %/trace.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace.c-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace.c-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=c \
@@ -177,7 +219,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 %/trace-ust.h: %/trace-ust.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-%/trace-ust.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+%/trace-ust.h-timestamp: $(SRC_PATH)/%/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=$(call trace-group-name,$@) \
 		--format=ust-events-h \
@@ -201,7 +243,7 @@ tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")

 trace-root.h: trace-root.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=h \
@@ -210,7 +252,7 @@ trace-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/con

 trace-root.c: trace-root.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=c \
@@ -219,7 +261,7 @@ trace-root.c-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/con

 trace-ust-root.h: trace-ust-root.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=root \
 		--format=ust-events-h \
@@ -228,7 +270,7 @@ trace-ust-root.h-timestamp: $(SRC_PATH)/trace-events $(tracetool-y) $(BUILD_DIR)

 trace-ust-all.h: trace-ust-all.h-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=ust-events-h \
@@ -237,7 +279,7 @@ trace-ust-all.h-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/con

 trace-ust-all.c: trace-ust-all.c-timestamp
 	@cmp $< $@ >/dev/null 2>&1 || cp $< $@
-trace-ust-all.c-timestamp: $(trace-events-files) $(tracetool-y) $(BUILD_DIR)/config-host.mak
+trace-ust-all.c-timestamp: $(trace-events-files) $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=ust-events-c \
@@ -319,16 +361,13 @@ DOCS+=docs/qemu-cpu-models.7
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-DOCS+=scripts/qemu-trace-stap.1
-endif
 else
 DOCS=
 endif

 SUBDIR_MAKEFLAGS=$(if $(V),,--no-print-directory --quiet) BUILD_DIR=$(BUILD_DIR)
-SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(filter %-softmmu, $(TARGET_DIRS)))
-SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %.d, $(SUBDIR_DEVICES_MAK))
+SUBDIR_DEVICES_MAK=$(patsubst %, %/config-devices.mak, $(TARGET_DIRS))
+SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %-config-devices.mak.d, $(TARGET_DIRS))

 ifeq ($(SUBDIR_DEVICES_MAK),)
 config-all-devices.mak:
@@ -343,26 +382,9 @@ endif

 -include $(SUBDIR_DEVICES_MAK_DEP)

-# This has to be kept in sync with Kconfig.host.
-MINIKCONF_ARGS = \
-    $(CONFIG_MINIKCONF_MODE) \
-    $@ $*-config.devices.mak.d $< $(MINIKCONF_INPUTS) \
-    CONFIG_KVM=$(CONFIG_KVM) \
-    CONFIG_SPICE=$(CONFIG_SPICE) \
-    CONFIG_IVSHMEM=$(CONFIG_IVSHMEM) \
-    CONFIG_TPM=$(CONFIG_TPM) \
-    CONFIG_XEN=$(CONFIG_XEN) \
-    CONFIG_OPENGL=$(CONFIG_OPENGL) \
-    CONFIG_X11=$(CONFIG_X11) \
-    CONFIG_VHOST_USER=$(CONFIG_VHOST_USER) \
-    CONFIG_VIRTFS=$(CONFIG_VIRTFS) \
-    CONFIG_LINUX=$(CONFIG_LINUX)
-
-MINIKCONF_INPUTS = $(SRC_PATH)/Kconfig.host $(SRC_PATH)/hw/Kconfig
-MINIKCONF = $(PYTHON) $(SRC_PATH)/scripts/minikconf.py \
-
-$(SUBDIR_DEVICES_MAK): %/config-devices.mak: default-configs/%.mak $(MINIKCONF_INPUTS) $(BUILD_DIR)/config-host.mak
-	$(call quiet-command, $(MINIKCONF) $(MINIKCONF_ARGS) > $@.tmp, "GEN", "$@.tmp")
+%/config-devices.mak: default-configs/%.mak $(SRC_PATH)/scripts/make_device_config.sh
+	$(call quiet-command, \
+            $(SHELL) $(SRC_PATH)/scripts/make_device_config.sh $< $*-config-devices.mak.d $@ > $@.tmp,"GEN","$@.tmp")
 	$(call quiet-command, if test -f $@; then \
 	  if cmp -s $@.old $@; then \
 	    mv $@.tmp $@; \
@@ -390,14 +412,12 @@ endif

 dummy := $(call unnest-vars,, \
                stub-obj-y \
-                authz-obj-y \
                chardev-obj-y \
                util-obj-y \
                qga-obj-y \
                elf2dmp-obj-y \
                ivshmem-client-obj-y \
                ivshmem-server-obj-y \
-                rdmacm-mux-obj-y \
                libvhost-user-obj-y \
                vhost-user-scsi-obj-y \
                vhost-user-blk-obj-y \
@@ -418,12 +438,27 @@ dummy := $(call unnest-vars,, \

 include $(SRC_PATH)/tests/Makefile.include

-all: $(DOCS) $(if $(BUILD_DOCS),sphinxdocs) $(TOOLS) $(HELPERS-y) recurse-all modules
+all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules

 qemu-version.h: FORCE
 	$(call quiet-command, \
-                (printf '#define QEMU_PKGVERSION "$(QEMU_PKGVERSION)"\n'; \
-		printf '#define QEMU_FULL_VERSION "$(FULL_VERSION)"\n'; \
+		(cd $(SRC_PATH); \
+		if test -n "$(PKGVERSION)"; then \
+			pkgvers="$(PKGVERSION)"; \
+		else \
+			if test -d .git; then \
+				pkgvers=$$(git describe --match 'v*' 2>/dev/null | tr -d '\n');\
+				if ! git diff-index --quiet HEAD &>/dev/null; then \
+					pkgvers="$${pkgvers}-dirty"; \
+				fi; \
+			fi; \
+		fi; \
+		printf "#define QEMU_PKGVERSION \"$${pkgvers}\"\n"; \
+		if test -n "$${pkgvers}"; then \
+			printf '#define QEMU_FULL_VERSION QEMU_VERSION " (" QEMU_PKGVERSION ")"\n'; \
+		else \
+			printf '#define QEMU_FULL_VERSION QEMU_VERSION\n'; \
+		fi; \
 		) > $@.tmp)
 	$(call quiet-command, if ! cmp -s $@ $@.tmp; then \
 	  mv $@.tmp $@; \
@@ -439,7 +474,6 @@ qemu-options.def: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))

-$(SOFTMMU_SUBDIR_RULES): $(authz-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(block-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(crypto-obj-y)
 $(SOFTMMU_SUBDIR_RULES): $(io-obj-y)
@@ -473,9 +507,6 @@ CAP_CFLAGS += -DCAPSTONE_HAS_X86
 subdir-capstone: .git-submodule-status
 	$(call quiet-command,$(MAKE) -C $(SRC_PATH)/capstone CAPSTONE_SHARED=no BUILDDIR="$(BUILD_DIR)/capstone" CC="$(CC)" AR="$(AR)" LD="$(LD)" RANLIB="$(RANLIB)" CFLAGS="$(CAP_CFLAGS)" $(SUBDIR_MAKEFLAGS) $(BUILD_DIR)/capstone/$(LIBCAPSTONE))

-subdir-slirp: .git-submodule-status
-	$(call quiet-command,$(MAKE) -C $(SRC_PATH)/slirp BUILD_DIR="$(BUILD_DIR)/slirp" CC="$(CC)" AR="$(AR)" LD="$(LD)" RANLIB="$(RANLIB)" CFLAGS="$(QEMU_CFLAGS)")
-
 $(SUBDIR_RULES): libqemuutil.a $(common-obj-y) $(chardev-obj-y) \
 	$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))

@@ -497,7 +528,7 @@ Makefile: $(version-obj-y)
 # Build libraries

 libqemuutil.a: $(util-obj-y) $(trace-obj-y) $(stub-obj-y)
-libvhost-user.a: $(libvhost-user-obj-y) $(util-obj-y) $(stub-obj-y)
+libvhost-user.a: $(libvhost-user-obj-y)

 ######################################################################

@@ -505,9 +536,9 @@ COMMON_LDADDS = libqemuutil.a

 qemu-img.o: qemu-img-cmds.h

-qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
-qemu-nbd$(EXESUF): qemu-nbd.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
-qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-img$(EXESUF): qemu-img.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+qemu-io$(EXESUF): qemu-io.o $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o $(COMMON_LDADDS)

@@ -518,7 +549,7 @@ qemu-edid$(EXESUF): qemu-edid.o hw/display/edid-generate.o $(COMMON_LDADDS)
 fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal.o fsdev/9p-iov-marshal.o $(COMMON_LDADDS)
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

-scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(authz-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+scsi/qemu-pr-helper$(EXESUF): scsi/qemu-pr-helper.o scsi/utils.o $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
 ifdef CONFIG_MPATH
 scsi/qemu-pr-helper$(EXESUF): LIBS += -ludev -lmultipath -lmpathpersist
 endif
@@ -552,10 +583,100 @@ qga/qapi-generated/qapi-gen-timestamp: $(SRC_PATH)/qga/qapi-schema.json $(qapi-p
 		"GEN","$(@:%-timestamp=%)")
 	@>$@

-qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json \
-               $(QAPI_MODULES:%=$(SRC_PATH)/qapi/%.json)
+qapi-modules = $(SRC_PATH)/qapi/qapi-schema.json $(SRC_PATH)/qapi/common.json \
+               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
+               $(SRC_PATH)/qapi/char.json \
+               $(SRC_PATH)/qapi/crypto.json \
+               $(SRC_PATH)/qapi/introspect.json \
+               $(SRC_PATH)/qapi/job.json \
+               $(SRC_PATH)/qapi/migration.json \
+               $(SRC_PATH)/qapi/misc.json \
+               $(SRC_PATH)/qapi/net.json \
+               $(SRC_PATH)/qapi/rocker.json \
+               $(SRC_PATH)/qapi/run-state.json \
+               $(SRC_PATH)/qapi/sockets.json \
+               $(SRC_PATH)/qapi/tpm.json \
+               $(SRC_PATH)/qapi/trace.json \
+               $(SRC_PATH)/qapi/transaction.json \
+               $(SRC_PATH)/qapi/ui.json

-$(GENERATED_QAPI_FILES): qapi-gen-timestamp ;
+qapi/qapi-builtin-types.c qapi/qapi-builtin-types.h \
+qapi/qapi-types.c qapi/qapi-types.h \
+qapi/qapi-types-block-core.c qapi/qapi-types-block-core.h \
+qapi/qapi-types-block.c qapi/qapi-types-block.h \
+qapi/qapi-types-char.c qapi/qapi-types-char.h \
+qapi/qapi-types-common.c qapi/qapi-types-common.h \
+qapi/qapi-types-crypto.c qapi/qapi-types-crypto.h \
+qapi/qapi-types-introspect.c qapi/qapi-types-introspect.h \
+qapi/qapi-types-job.c qapi/qapi-types-job.h \
+qapi/qapi-types-migration.c qapi/qapi-types-migration.h \
+qapi/qapi-types-misc.c qapi/qapi-types-misc.h \
+qapi/qapi-types-net.c qapi/qapi-types-net.h \
+qapi/qapi-types-rocker.c qapi/qapi-types-rocker.h \
+qapi/qapi-types-run-state.c qapi/qapi-types-run-state.h \
+qapi/qapi-types-sockets.c qapi/qapi-types-sockets.h \
+qapi/qapi-types-tpm.c qapi/qapi-types-tpm.h \
+qapi/qapi-types-trace.c qapi/qapi-types-trace.h \
+qapi/qapi-types-transaction.c qapi/qapi-types-transaction.h \
+qapi/qapi-types-ui.c qapi/qapi-types-ui.h \
+qapi/qapi-builtin-visit.c qapi/qapi-builtin-visit.h \
+qapi/qapi-visit.c qapi/qapi-visit.h \
+qapi/qapi-visit-block-core.c qapi/qapi-visit-block-core.h \
+qapi/qapi-visit-block.c qapi/qapi-visit-block.h \
+qapi/qapi-visit-char.c qapi/qapi-visit-char.h \
+qapi/qapi-visit-common.c qapi/qapi-visit-common.h \
+qapi/qapi-visit-crypto.c qapi/qapi-visit-crypto.h \
+qapi/qapi-visit-introspect.c qapi/qapi-visit-introspect.h \
+qapi/qapi-visit-job.c qapi/qapi-visit-job.h \
+qapi/qapi-visit-migration.c qapi/qapi-visit-migration.h \
+qapi/qapi-visit-misc.c qapi/qapi-visit-misc.h \
+qapi/qapi-visit-net.c qapi/qapi-visit-net.h \
+qapi/qapi-visit-rocker.c qapi/qapi-visit-rocker.h \
+qapi/qapi-visit-run-state.c qapi/qapi-visit-run-state.h \
+qapi/qapi-visit-sockets.c qapi/qapi-visit-sockets.h \
+qapi/qapi-visit-tpm.c qapi/qapi-visit-tpm.h \
+qapi/qapi-visit-trace.c qapi/qapi-visit-trace.h \
+qapi/qapi-visit-transaction.c qapi/qapi-visit-transaction.h \
+qapi/qapi-visit-ui.c qapi/qapi-visit-ui.h \
+qapi/qapi-commands.h qapi/qapi-commands.c \
+qapi/qapi-commands-block-core.c qapi/qapi-commands-block-core.h \
+qapi/qapi-commands-block.c qapi/qapi-commands-block.h \
+qapi/qapi-commands-char.c qapi/qapi-commands-char.h \
+qapi/qapi-commands-common.c qapi/qapi-commands-common.h \
+qapi/qapi-commands-crypto.c qapi/qapi-commands-crypto.h \
+qapi/qapi-commands-introspect.c qapi/qapi-commands-introspect.h \
+qapi/qapi-commands-job.c qapi/qapi-commands-job.h \
+qapi/qapi-commands-migration.c qapi/qapi-commands-migration.h \
+qapi/qapi-commands-misc.c qapi/qapi-commands-misc.h \
+qapi/qapi-commands-net.c qapi/qapi-commands-net.h \
+qapi/qapi-commands-rocker.c qapi/qapi-commands-rocker.h \
+qapi/qapi-commands-run-state.c qapi/qapi-commands-run-state.h \
+qapi/qapi-commands-sockets.c qapi/qapi-commands-sockets.h \
+qapi/qapi-commands-tpm.c qapi/qapi-commands-tpm.h \
+qapi/qapi-commands-trace.c qapi/qapi-commands-trace.h \
+qapi/qapi-commands-transaction.c qapi/qapi-commands-transaction.h \
+qapi/qapi-commands-ui.c qapi/qapi-commands-ui.h \
+qapi/qapi-events.c qapi/qapi-events.h \
+qapi/qapi-events-block-core.c qapi/qapi-events-block-core.h \
+qapi/qapi-events-block.c qapi/qapi-events-block.h \
+qapi/qapi-events-char.c qapi/qapi-events-char.h \
+qapi/qapi-events-common.c qapi/qapi-events-common.h \
+qapi/qapi-events-crypto.c qapi/qapi-events-crypto.h \
+qapi/qapi-events-introspect.c qapi/qapi-events-introspect.h \
+qapi/qapi-events-job.c qapi/qapi-events-job.h \
+qapi/qapi-events-migration.c qapi/qapi-events-migration.h \
+qapi/qapi-events-misc.c qapi/qapi-events-misc.h \
+qapi/qapi-events-net.c qapi/qapi-events-net.h \
+qapi/qapi-events-rocker.c qapi/qapi-events-rocker.h \
+qapi/qapi-events-run-state.c qapi/qapi-events-run-state.h \
+qapi/qapi-events-sockets.c qapi/qapi-events-sockets.h \
+qapi/qapi-events-tpm.c qapi/qapi-events-tpm.h \
+qapi/qapi-events-trace.c qapi/qapi-events-trace.h \
+qapi/qapi-events-transaction.c qapi/qapi-events-transaction.h \
+qapi/qapi-events-ui.c qapi/qapi-events-ui.h \
+qapi/qapi-introspect.h qapi/qapi-introspect.c \
+qapi/qapi-doc.texi: \
+qapi-gen-timestamp ;
 qapi-gen-timestamp: $(qapi-modules) $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-gen.py \
 		-o "qapi" -b $<, \
@@ -590,8 +711,8 @@ ifneq ($(EXESUF),)
 qemu-ga: qemu-ga$(EXESUF) $(QGA_VSS_PROVIDER) $(QEMU_GA_MSI)
 endif

-elf2dmp$(EXESUF): LIBS += $(CURL_LIBS)
-elf2dmp$(EXESUF): $(elf2dmp-obj-y)
+elf2dmp: LIBS = $(CURL_LIBS)
+elf2dmp: $(elf2dmp-obj-y)
 	$(call LINK, $^)

 ifdef CONFIG_IVSHMEM
@@ -605,10 +726,6 @@ vhost-user-scsi$(EXESUF): $(vhost-user-scsi-obj-y) libvhost-user.a
 vhost-user-blk$(EXESUF): $(vhost-user-blk-obj-y) libvhost-user.a
 	$(call LINK, $^)

-rdmacm-mux$(EXESUF): LIBS += "-libumad"
-rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
-	$(call LINK, $^)
-
 module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
 	$(call quiet-command,$(PYTHON) $< $@ \
 	$(addprefix $(SRC_PATH)/,$(patsubst %.mo,%.c,$(block-obj-m))), \
@@ -627,11 +744,7 @@ clean:
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
 	rm -f *.msi
-	find . \( -name '*.so' -o -name '*.dll' -o -name '*.mo' -o -name '*.[oda]' \) -type f \
-		! -path ./roms/edk2/ArmPkg/Library/GccLto/liblto-aarch64.a \
-		! -path ./roms/edk2/ArmPkg/Library/GccLto/liblto-arm.a \
-		! -path ./roms/edk2/BaseTools/Source/Python/UPT/Dll/sqlite3.dll \
-		-exec rm {} +
+	find . \( -name '*.so' -o -name '*.dll' -o -name '*.mo' -o -name '*.[oda]' \) -type f -exec rm {} +
 	rm -f $(filter-out %.tlb,$(TOOLS)) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
 	rm -f fsdev/*.pod scsi/*.pod
 	rm -f qemu-img-cmds.h
@@ -655,22 +768,6 @@ dist: qemu-$(VERSION).tar.bz2
 qemu-%.tar.bz2:
 	$(SRC_PATH)/scripts/make-release "$(SRC_PATH)" "$(patsubst qemu-%.tar.bz2,%,$@)"

-# Sphinx does not allow building manuals into the same directory as
-# the source files, so if we're doing an in-tree QEMU build we must
-# build the manuals into a subdirectory (and then install them from
-# there for 'make install'). For an out-of-tree build we can just
-# use the docs/ subdirectory in the build tree as normal.
-ifeq ($(realpath $(SRC_PATH)),$(realpath .))
-MANUAL_BUILDDIR := docs/built
-else
-MANUAL_BUILDDIR := docs
-endif
-
-define clean-manual =
-rm -rf $(MANUAL_BUILDDIR)/$1/_static
-rm -f $(MANUAL_BUILDDIR)/$1/objects.inv $(MANUAL_BUILDDIR)/$1/searchindex.js $(MANUAL_BUILDDIR)/$1/*.html
-endef
-
 distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi qemu-monitor-info.texi
 	rm -f config-all-devices.mak config-all-disas.mak config.status
@@ -691,18 +788,15 @@ distclean: clean
 	rm -f docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
 	rm -f docs/qemu-block-drivers.7
 	rm -f docs/qemu-cpu-models.7
-	rm -rf .doctrees
-	$(call clean-manual,devel)
-	$(call clean-manual,interop)
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
        done
 	rm -Rf .sdk
 	if test -f dtc/version_gen.h; then $(MAKE) $(DTC_MAKE_ARGS) clean; fi

-KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  no  pt-br  sv \
+KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
-de-ch  es     fo  fr-ca  hu     ja  mk  pt  sl     tr \
+common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr \
 bepo    cz

 ifdef INSTALL_BLOBS
@@ -715,8 +809,9 @@ pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
 efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
 efi-pcnet.rom efi-rtl8139.rom efi-virtio.rom \
 efi-e1000e.rom efi-vmxnet3.rom \
+qemu-icon.bmp qemu_logo_no_text.svg \
 bamboo.dtb canyonlands.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
-multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin pvh.bin \
+multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin \
 s390-ccw.img s390-netboot.img \
 spapr-rtas.bin slof.bin skiboot.lid \
 palcode-clipper \
@@ -727,20 +822,7 @@ else
 BLOBS=
 endif

-# Note that we manually filter-out the non-Sphinx documentation which
-# is currently built into the docs/interop directory in the build tree.
-define install-manual =
-for d in $$(cd $(MANUAL_BUILDDIR) && find $1 -type d); do $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)/$$d"; done
-for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
-endef
-
-# Note that we deliberately do not install the "devel" manual: it is
-# for QEMU developers, and not interesting to our users.
-.PHONY: install-sphinxdocs
-install-sphinxdocs: sphinxdocs
-	$(call install-manual,interop)
-
-install-doc: $(DOCS) install-sphinxdocs
+install-doc: $(DOCS)
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.txt "$(DESTDIR)$(qemu_docdir)"
@@ -758,9 +840,6 @@ ifneq ($(TOOLS),)
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-	$(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
-endif
 ifneq (,$(findstring qemu-ga,$(TOOLS)))
 	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
@@ -783,7 +862,6 @@ ifneq (,$(findstring qemu-ga,$(TOOLS)))
 endif
 endif

-ICON_SIZES=16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512

 install: all $(if $(BUILD_DOCS),install-doc) install-datadir install-localstatedir
 ifneq ($(TOOLS),)
@@ -800,28 +878,11 @@ endif
 ifneq ($(HELPERS-y),)
 	$(call install-prog,$(HELPERS-y),$(DESTDIR)$(libexecdir))
 endif
-ifdef CONFIG_TRACE_SYSTEMTAP
-	$(INSTALL_PROG) "scripts/qemu-trace-stap" $(DESTDIR)$(bindir)
-endif
 ifneq ($(BLOBS),)
 	set -e; for x in $(BLOBS); do \
 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(qemu_datadir)"; \
 	done
 endif
-	for s in $(ICON_SIZES); do \
-		mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/$${s}/apps"; \
-		$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu_$${s}.png \
-			"$(DESTDIR)/$(qemu_icondir)/hicolor/$${s}/apps/qemu.png"; \
-	done; \
-	mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/32x32/apps"; \
-	$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu_32x32.bmp \
-		"$(DESTDIR)/$(qemu_icondir)/hicolor/32x32/apps/qemu.bmp"; \
-	mkdir -p "$(DESTDIR)/$(qemu_icondir)/hicolor/scalable/apps"; \
-	$(INSTALL_DATA) $(SRC_PATH)/ui/icons/qemu.svg \
-		"$(DESTDIR)/$(qemu_icondir)/hicolor/scalable/apps/qemu.svg"
-	mkdir -p "$(DESTDIR)/$(qemu_desktopdir)"
-	$(INSTALL_DATA) $(SRC_PATH)/ui/qemu.desktop \
-		"$(DESTDIR)/$(qemu_desktopdir)/qemu.desktop"
 ifdef CONFIG_GTK
 	$(MAKE) -C po $@
 endif
@@ -891,23 +952,6 @@ docs/version.texi: $(SRC_PATH)/VERSION
 %.pdf: %.texi docs/version.texi
 	$(call quiet-command,texi2pdf $(TEXI2PDFFLAGS) $< -o $@,"GEN","$@")

-# Sphinx builds all its documentation at once in one invocation
-# and handles "don't rebuild things unless necessary" itself.
-# The '.doctrees' files are cached information to speed this up.
-.PHONY: sphinxdocs
-sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html
-
-# Canned command to build a single manual
-build-manual = $(call quiet-command,sphinx-build $(if $(V),,-q) -b html -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
-# We assume all RST files in the manual's directory are used in it
-manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
-
-$(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
-	$(call build-manual,devel)
-
-$(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
-	$(call build-manual,interop)
-
 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")

@@ -934,9 +978,8 @@ qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 qemu-ga.8: qemu-ga.texi
 docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
-scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi

-html: qemu-doc.html docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html sphinxdocs
+html: qemu-doc.html docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
 info: qemu-doc.info docs/interop/qemu-qmp-ref.info docs/interop/qemu-ga-ref.info
 pdf: qemu-doc.pdf docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
 txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
@@ -957,15 +1000,12 @@ docs/interop/qemu-qmp-ref.dvi docs/interop/qemu-qmp-ref.html \
    docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7: \
 	docs/interop/qemu-qmp-ref.texi docs/interop/qemu-qmp-qapi.texi

-$(filter %.1 %.7 %.8,$(DOCS)): scripts/texi2pod.pl
-
 # Reports/Analysis

 %/coverage-report.html:
 	@mkdir -p $*
 	$(call quiet-command,\
-		gcovr -r $(SRC_PATH) --object-directory $(BUILD_PATH) \
-		-p --html --html-details -o $@, \
+		gcovr -p --html --html-details -o $@, \
 		"GEN", "coverage-report.html")

 .PHONY: coverage-report
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,19 +1,71 @@
 #######################################################################
 # Common libraries for tools and emulators
-stub-obj-y = stubs/ util/ crypto/
+stub-obj-y = stubs/ crypto/
 util-obj-y = util/ qobject/ qapi/
+util-obj-y += qapi/qapi-builtin-types.o
+util-obj-y += qapi/qapi-types.o
+util-obj-y += qapi/qapi-types-block-core.o
+util-obj-y += qapi/qapi-types-block.o
+util-obj-y += qapi/qapi-types-char.o
+util-obj-y += qapi/qapi-types-common.o
+util-obj-y += qapi/qapi-types-crypto.o
+util-obj-y += qapi/qapi-types-introspect.o
+util-obj-y += qapi/qapi-types-job.o
+util-obj-y += qapi/qapi-types-migration.o
+util-obj-y += qapi/qapi-types-misc.o
+util-obj-y += qapi/qapi-types-net.o
+util-obj-y += qapi/qapi-types-rocker.o
+util-obj-y += qapi/qapi-types-run-state.o
+util-obj-y += qapi/qapi-types-sockets.o
+util-obj-y += qapi/qapi-types-tpm.o
+util-obj-y += qapi/qapi-types-trace.o
+util-obj-y += qapi/qapi-types-transaction.o
+util-obj-y += qapi/qapi-types-ui.o
+util-obj-y += qapi/qapi-builtin-visit.o
+util-obj-y += qapi/qapi-visit.o
+util-obj-y += qapi/qapi-visit-block-core.o
+util-obj-y += qapi/qapi-visit-block.o
+util-obj-y += qapi/qapi-visit-char.o
+util-obj-y += qapi/qapi-visit-common.o
+util-obj-y += qapi/qapi-visit-crypto.o
+util-obj-y += qapi/qapi-visit-introspect.o
+util-obj-y += qapi/qapi-visit-job.o
+util-obj-y += qapi/qapi-visit-migration.o
+util-obj-y += qapi/qapi-visit-misc.o
+util-obj-y += qapi/qapi-visit-net.o
+util-obj-y += qapi/qapi-visit-rocker.o
+util-obj-y += qapi/qapi-visit-run-state.o
+util-obj-y += qapi/qapi-visit-sockets.o
+util-obj-y += qapi/qapi-visit-tpm.o
+util-obj-y += qapi/qapi-visit-trace.o
+util-obj-y += qapi/qapi-visit-transaction.o
+util-obj-y += qapi/qapi-visit-ui.o
+util-obj-y += qapi/qapi-events.o
+util-obj-y += qapi/qapi-events-block-core.o
+util-obj-y += qapi/qapi-events-block.o
+util-obj-y += qapi/qapi-events-char.o
+util-obj-y += qapi/qapi-events-common.o
+util-obj-y += qapi/qapi-events-crypto.o
+util-obj-y += qapi/qapi-events-introspect.o
+util-obj-y += qapi/qapi-events-job.o
+util-obj-y += qapi/qapi-events-migration.o
+util-obj-y += qapi/qapi-events-misc.o
+util-obj-y += qapi/qapi-events-net.o
+util-obj-y += qapi/qapi-events-rocker.o
+util-obj-y += qapi/qapi-events-run-state.o
+util-obj-y += qapi/qapi-events-sockets.o
+util-obj-y += qapi/qapi-events-tpm.o
+util-obj-y += qapi/qapi-events-trace.o
+util-obj-y += qapi/qapi-events-transaction.o
+util-obj-y += qapi/qapi-events-ui.o
+util-obj-y += qapi/qapi-introspect.o

 chardev-obj-y = chardev/

-#######################################################################
-# authz-obj-y is code used by both qemu system emulation and qemu-img
-
-authz-obj-y = authz/
-
 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = nbd/
+block-obj-y += nbd/
 block-obj-y += block.o blockjob.o job.o
 block-obj-y += block/ scsi/
 block-obj-y += qemu-io-cmds.o
@@ -71,6 +123,8 @@ common-obj-y += vl.o
 vl.o-cflags := $(GPROF_CFLAGS) $(SDL_CFLAGS)
 common-obj-$(CONFIG_TPM) += tpm.o

+common-obj-$(CONFIG_SLIRP) += slirp/
+
 common-obj-y += backends/
 common-obj-y += chardev/

@@ -83,8 +137,26 @@ common-obj-$(CONFIG_FDT) += device_tree.o
 ######################################################################
 # qapi

+common-obj-y += qapi/qapi-commands.o
+common-obj-y += qapi/qapi-commands-block-core.o
+common-obj-y += qapi/qapi-commands-block.o
+common-obj-y += qapi/qapi-commands-char.o
+common-obj-y += qapi/qapi-commands-common.o
+common-obj-y += qapi/qapi-commands-crypto.o
+common-obj-y += qapi/qapi-commands-introspect.o
+common-obj-y += qapi/qapi-commands-job.o
+common-obj-y += qapi/qapi-commands-migration.o
+common-obj-y += qapi/qapi-commands-misc.o
+common-obj-y += qapi/qapi-commands-net.o
+common-obj-y += qapi/qapi-commands-rocker.o
+common-obj-y += qapi/qapi-commands-run-state.o
+common-obj-y += qapi/qapi-commands-sockets.o
+common-obj-y += qapi/qapi-commands-tpm.o
+common-obj-y += qapi/qapi-commands-trace.o
+common-obj-y += qapi/qapi-commands-transaction.o
+common-obj-y += qapi/qapi-commands-ui.o
+common-obj-y += qapi/qapi-introspect.o
 common-obj-y += qmp.o hmp.o
-common-obj-y += qapi/
 endif

 #######################################################################
@@ -101,6 +173,7 @@ version-obj-$(CONFIG_WIN32) += $(BUILD_DIR)/version.o
 ######################################################################
 # tracing
 util-obj-y +=  trace/
+target-obj-y += trace/

 ######################################################################
 # guest agent
@@ -121,14 +194,12 @@ vhost-user-scsi.o-cflags := $(LIBISCSI_CFLAGS)
 vhost-user-scsi.o-libs := $(LIBISCSI_LIBS)
 vhost-user-scsi-obj-y = contrib/vhost-user-scsi/
 vhost-user-blk-obj-y = contrib/vhost-user-blk/
-rdmacm-mux-obj-y = contrib/rdmacm-mux/

 ######################################################################
 trace-events-subdirs =
 trace-events-subdirs += accel/kvm
 trace-events-subdirs += accel/tcg
 trace-events-subdirs += audio
-trace-events-subdirs += authz
 trace-events-subdirs += block
 trace-events-subdirs += chardev
 trace-events-subdirs += crypto
@@ -172,7 +243,6 @@ trace-events-subdirs += hw/vfio
 trace-events-subdirs += hw/virtio
 trace-events-subdirs += hw/watchdog
 trace-events-subdirs += hw/xen
-trace-events-subdirs += hw/gpio
 trace-events-subdirs += io
 trace-events-subdirs += linux-user
 trace-events-subdirs += migration
@@ -182,11 +252,9 @@ trace-events-subdirs += qapi
 trace-events-subdirs += qom
 trace-events-subdirs += scsi
 trace-events-subdirs += target/arm
-trace-events-subdirs += target/hppa
 trace-events-subdirs += target/i386
 trace-events-subdirs += target/mips
 trace-events-subdirs += target/ppc
-trace-events-subdirs += target/riscv
 trace-events-subdirs += target/s390x
 trace-events-subdirs += target/sparc
 trace-events-subdirs += ui
--- a/Makefile.target
+++ b/Makefile.target
@@ -4,11 +4,8 @@ BUILD_DIR?=$(CURDIR)/..

 include ../config-host.mak
 include config-target.mak
-include $(SRC_PATH)/rules.mak
-
-ifdef CONFIG_SOFTMMU
 include config-devices.mak
-endif
+include $(SRC_PATH)/rules.mak

 $(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
 ifdef CONFIG_LINUX
@@ -40,13 +37,15 @@ PROGS=$(QEMU_PROG) $(QEMU_PROGW)
 STPFILES=

 # Makefile Tests
+ifdef CONFIG_USER_ONLY
 include $(SRC_PATH)/tests/tcg/Makefile.include
+endif

 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak

 ifdef CONFIG_TRACE_SYSTEMTAP
-stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp $(QEMU_PROG)-log.stp
+stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp

 ifdef CONFIG_USER_ONLY
 TARGET_TYPE=user
@@ -85,14 +84,6 @@ $(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")

-$(QEMU_PROG)-log.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
-	$(call quiet-command,$(TRACETOOL) \
-		--group=all \
-		--format=log-stap \
-		--backends=$(TRACE_BACKENDS) \
-		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
-		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-log.stp")
-
 else
 stap:
 endif
@@ -103,8 +94,6 @@ all: $(PROGS) stap
 # Dummy command so that make thinks it has done something
 	@true

-obj-y += trace/
-
 #########################################################
 # cpu emulator library
 obj-y += exec.o
@@ -151,7 +140,6 @@ ifdef CONFIG_SOFTMMU
 obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
 obj-y += qtest.o
 obj-y += hw/
-obj-y += qapi/
 obj-y += memory.o
 obj-y += memory_mapping.o
 obj-y += dump.o
@@ -170,12 +158,20 @@ GENERATED_FILES += hmp-commands.h hmp-commands-info.h

 endif # CONFIG_SOFTMMU

+# Workaround for http://gcc.gnu.org/PR55489, see configure.
+%/translate.o: QEMU_CFLAGS += $(TRANSLATE_OPT_CFLAGS)
+
 dummy := $(call unnest-vars,,obj-y)
 all-obj-y := $(obj-y)

+target-obj-y :=
+block-obj-y :=
+common-obj-y :=
+chardev-obj-y :=
 include $(SRC_PATH)/Makefile.objs
+dummy := $(call unnest-vars,,target-obj-y)
+target-obj-y-save := $(target-obj-y)
 dummy := $(call unnest-vars,.., \
-               authz-obj-y \
               block-obj-y \
               block-obj-m \
               chardev-obj-y \
@@ -185,17 +181,16 @@ dummy := $(call unnest-vars,.., \
               io-obj-y \
               common-obj-y \
               common-obj-m)
+target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
+all-obj-y += $(target-obj-y)
 all-obj-y += $(qom-obj-y)
-all-obj-$(CONFIG_SOFTMMU) += $(authz-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y) $(chardev-obj-y)
 all-obj-$(CONFIG_USER_ONLY) += $(crypto-aes-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)

-ifdef CONFIG_SOFTMMU
 $(QEMU_PROG_BUILD): config-devices.mak
-endif

 COMMON_LDADDS = ../libqemuutil.a

@@ -220,7 +215,6 @@ clean: clean-target
 	rm -f *.a *~ $(PROGS)
 	rm -f $(shell find . -name '*.[od]')
 	rm -f hmp-commands.h gdbstub-xml.c
-	rm -f trace/generated-helpers.c trace/generated-helpers.c-timestamp
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
 endif
@@ -233,7 +227,6 @@ ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp-installed "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG).stp"
 	$(INSTALL_DATA) $(QEMU_PROG)-simpletrace.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-simpletrace.stp"
-	$(INSTALL_DATA) $(QEMU_PROG)-log.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-log.stp"
 endif

 GENERATED_FILES += config-target.h
--- a/2
+++ b/2
@@ -1 +1 @@
-3.1.91
+3.1.1
--- a/accel/accel.c
+++ b/accel/accel.c
@@ -34,7 +34,6 @@
 #include "qom/object.h"
 #include "qemu/error-report.h"
 #include "qemu/option.h"
-#include "qapi/error.h"

 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
@@ -66,11 +65,10 @@ static int accel_init_machine(AccelClass *acc, MachineState *ms)
        *(acc->allowed) = false;
        object_unref(OBJECT(accel));
    }
-    object_set_accelerator_compat_props(acc->compat_props);
    return ret;
 }

-void configure_accelerator(MachineState *ms, const char *progname)
+void configure_accelerator(MachineState *ms)
 {
    const char *accel;
    char **accel_list, **tmp;
@@ -81,22 +79,8 @@ void configure_accelerator(MachineState *ms, const char *progname)

    accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
    if (accel == NULL) {
-        /* Select the default accelerator */
-        int pnlen = strlen(progname);
-        if (pnlen >= 3 && g_str_equal(&progname[pnlen - 3], "kvm")) {
-            /* If the program name ends with "kvm", we prefer KVM */
-            accel = "kvm:tcg";
-        } else {
-#if defined(CONFIG_TCG)
-            accel = "tcg";
-#elif defined(CONFIG_KVM)
-            accel = "kvm";
-#else
-            error_report("No accelerator selected and"
-                         " no default accelerator available");
-            exit(1);
-#endif
-        }
+        /* Use the default "accelerator", tcg */
+        accel = "tcg";
    }

    accel_list = g_strsplit(accel, ":", 0);
@@ -134,6 +118,12 @@ void configure_accelerator(MachineState *ms, const char *progname)
    }
 }

+void accel_register_compat_props(AccelState *accel)
+{
+    AccelClass *class = ACCEL_GET_CLASS(accel);
+    register_compat_props_array(class->global_props);
+}
+
 void accel_setup_post(MachineState *ms)
 {
    AccelState *accel = ms->accelerator;
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -86,7 +86,7 @@ struct KVMState
    int robust_singlestep;
    int debugregs;
 #ifdef KVM_CAP_SET_GUEST_DEBUG
-    QTAILQ_HEAD(, kvm_sw_breakpoint) kvm_sw_breakpoints;
+    struct kvm_sw_breakpoint_head kvm_sw_breakpoints;
 #endif
    int many_ioeventfds;
    int intx_set_mask;
@@ -102,7 +102,7 @@ struct KVMState
    int nr_allocated_irq_routes;
    unsigned long *used_gsi_bitmap;
    unsigned int gsi_count;
-    QTAILQ_HEAD(, KVMMSIRoute) msi_hashtab[KVM_MSI_HASHTAB_SIZE];
+    QTAILQ_HEAD(msi_hashtab, KVMMSIRoute) msi_hashtab[KVM_MSI_HASHTAB_SIZE];
 #endif
    KVMMemoryListener memory_listener;
    QLIST_HEAD(, KVMParkedVcpu) kvm_parked_vcpus;
@@ -657,8 +657,6 @@ static int kvm_set_ioeventfd_mmio(int fd, hwaddr addr, uint32_t val,
        .fd = fd,
    };

-    trace_kvm_set_ioeventfd_mmio(fd, (uint64_t)addr, val, assign, size,
-                                 datamatch);
    if (!kvm_enabled()) {
        return -ENOSYS;
    }
@@ -690,7 +688,6 @@ static int kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint16_t val,
        .fd = fd,
    };
    int r;
-    trace_kvm_set_ioeventfd_pio(fd, addr, val, assign, size, datamatch);
    if (!kvm_enabled()) {
        return -ENOSYS;
    }
@@ -1593,7 +1590,7 @@ static int kvm_init(MachineState *ms)

    kvm_type = qemu_opt_get(qemu_get_machine_opts(), "kvm-type");
    if (mc->kvm_type) {
-        type = mc->kvm_type(ms, kvm_type);
+        type = mc->kvm_type(kvm_type);
    } else if (kvm_type) {
        ret = -EINVAL;
        fprintf(stderr, "Invalid argument kvm-type=%s\n", kvm_type);
--- a/accel/kvm/trace-events
+++ b/accel/kvm/trace-events
@@ -1,4 +1,4 @@
-# See docs/devel/tracing.txt for syntax documentation.
+# Trace events for debugging and performance instrumentation

 # kvm-all.c
 kvm_ioctl(int type, void *arg) "type 0x%x, arg %p"
@@ -12,7 +12,5 @@ kvm_irqchip_commit_routes(void) ""
 kvm_irqchip_add_msi_route(char *name, int vector, int virq) "dev %s vector %d virq %d"
 kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
 kvm_irqchip_release_virq(int virq) "virq %d"
-kvm_set_ioeventfd_mmio(int fd, uint64_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%" PRIx64 " val=0x%x assign: %d size: %d match: %d"
-kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%x val=0x%x assign: %d size: %d match: %d"
 kvm_set_user_memory(uint32_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"

--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -7,7 +7,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -266,9 +266,6 @@ void cpu_exec_step_atomic(CPUState *cpu)
 #ifndef CONFIG_SOFTMMU
        tcg_debug_assert(!have_mmap_lock());
 #endif
-        if (qemu_mutex_iothread_locked()) {
-            qemu_mutex_unlock_iothread();
-        }
        assert_no_pages_locked();
    }

@@ -702,7 +699,6 @@ int cpu_exec(CPUState *cpu)
        if (qemu_mutex_iothread_locked()) {
            qemu_mutex_unlock_iothread();
        }
-        assert_no_pages_locked();
    }

    /* if an exception is pending, we execute it here */
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -74,166 +74,6 @@ QEMU_BUILD_BUG_ON(sizeof(target_ulong) > sizeof(run_on_cpu_data));
 QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)

-static inline size_t sizeof_tlb(CPUArchState *env, uintptr_t mmu_idx)
-{
-    return env->tlb_mask[mmu_idx] + (1 << CPU_TLB_ENTRY_BITS);
-}
-
-static void tlb_window_reset(CPUTLBWindow *window, int64_t ns,
-                             size_t max_entries)
-{
-    window->begin_ns = ns;
-    window->max_entries = max_entries;
-}
-
-static void tlb_dyn_init(CPUArchState *env)
-{
-    int i;
-
-    for (i = 0; i < NB_MMU_MODES; i++) {
-        CPUTLBDesc *desc = &env->tlb_d[i];
-        size_t n_entries = 1 << CPU_TLB_DYN_DEFAULT_BITS;
-
-        tlb_window_reset(&desc->window, get_clock_realtime(), 0);
-        desc->n_used_entries = 0;
-        env->tlb_mask[i] = (n_entries - 1) << CPU_TLB_ENTRY_BITS;
-        env->tlb_table[i] = g_new(CPUTLBEntry, n_entries);
-        env->iotlb[i] = g_new(CPUIOTLBEntry, n_entries);
-    }
-}
-
-/**
- * tlb_mmu_resize_locked() - perform TLB resize bookkeeping; resize if necessary
- * @env: CPU that owns the TLB
- * @mmu_idx: MMU index of the TLB
- *
- * Called with tlb_lock_held.
- *
- * We have two main constraints when resizing a TLB: (1) we only resize it
- * on a TLB flush (otherwise we'd have to take a perf hit by either rehashing
- * the array or unnecessarily flushing it), which means we do not control how
- * frequently the resizing can occur; (2) we don't have access to the guest's
- * future scheduling decisions, and therefore have to decide the magnitude of
- * the resize based on past observations.
- *
- * In general, a memory-hungry process can benefit greatly from an appropriately
- * sized TLB, since a guest TLB miss is very expensive. This doesn't mean that
- * we just have to make the TLB as large as possible; while an oversized TLB
- * results in minimal TLB miss rates, it also takes longer to be flushed
- * (flushes can be _very_ frequent), and the reduced locality can also hurt
- * performance.
- *
- * To achieve near-optimal performance for all kinds of workloads, we:
- *
- * 1. Aggressively increase the size of the TLB when the use rate of the
- * TLB being flushed is high, since it is likely that in the near future this
- * memory-hungry process will execute again, and its memory hungriness will
- * probably be similar.
- *
- * 2. Slowly reduce the size of the TLB as the use rate declines over a
- * reasonably large time window. The rationale is that if in such a time window
- * we have not observed a high TLB use rate, it is likely that we won't observe
- * it in the near future. In that case, once a time window expires we downsize
- * the TLB to match the maximum use rate observed in the window.
- *
- * 3. Try to keep the maximum use rate in a time window in the 30-70% range,
- * since in that range performance is likely near-optimal. Recall that the TLB
- * is direct mapped, so we want the use rate to be low (or at least not too
- * high), since otherwise we are likely to have a significant amount of
- * conflict misses.
- */
-static void tlb_mmu_resize_locked(CPUArchState *env, int mmu_idx)
-{
-    CPUTLBDesc *desc = &env->tlb_d[mmu_idx];
-    size_t old_size = tlb_n_entries(env, mmu_idx);
-    size_t rate;
-    size_t new_size = old_size;
-    int64_t now = get_clock_realtime();
-    int64_t window_len_ms = 100;
-    int64_t window_len_ns = window_len_ms * 1000 * 1000;
-    bool window_expired = now > desc->window.begin_ns + window_len_ns;
-
-    if (desc->n_used_entries > desc->window.max_entries) {
-        desc->window.max_entries = desc->n_used_entries;
-    }
-    rate = desc->window.max_entries * 100 / old_size;
-
-    if (rate > 70) {
-        new_size = MIN(old_size << 1, 1 << CPU_TLB_DYN_MAX_BITS);
-    } else if (rate < 30 && window_expired) {
-        size_t ceil = pow2ceil(desc->window.max_entries);
-        size_t expected_rate = desc->window.max_entries * 100 / ceil;
-
-        /*
-         * Avoid undersizing when the max number of entries seen is just below
-         * a pow2. For instance, if max_entries == 1025, the expected use rate
-         * would be 1025/2048==50%. However, if max_entries == 1023, we'd get
-         * 1023/1024==99.9% use rate, so we'd likely end up doubling the size
-         * later. Thus, make sure that the expected use rate remains below 70%.
-         * (and since we double the size, that means the lowest rate we'd
-         * expect to get is 35%, which is still in the 30-70% range where
-         * we consider that the size is appropriate.)
-         */
-        if (expected_rate > 70) {
-            ceil *= 2;
-        }
-        new_size = MAX(ceil, 1 << CPU_TLB_DYN_MIN_BITS);
-    }
-
-    if (new_size == old_size) {
-        if (window_expired) {
-            tlb_window_reset(&desc->window, now, desc->n_used_entries);
-        }
-        return;
-    }
-
-    g_free(env->tlb_table[mmu_idx]);
-    g_free(env->iotlb[mmu_idx]);
-
-    tlb_window_reset(&desc->window, now, 0);
-    /* desc->n_used_entries is cleared by the caller */
-    env->tlb_mask[mmu_idx] = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-    env->tlb_table[mmu_idx] = g_try_new(CPUTLBEntry, new_size);
-    env->iotlb[mmu_idx] = g_try_new(CPUIOTLBEntry, new_size);
-    /*
-     * If the allocations fail, try smaller sizes. We just freed some
-     * memory, so going back to half of new_size has a good chance of working.
-     * Increased memory pressure elsewhere in the system might cause the
-     * allocations to fail though, so we progressively reduce the allocation
-     * size, aborting if we cannot even allocate the smallest TLB we support.
-     */
-    while (env->tlb_table[mmu_idx] == NULL || env->iotlb[mmu_idx] == NULL) {
-        if (new_size == (1 << CPU_TLB_DYN_MIN_BITS)) {
-            error_report("%s: %s", __func__, strerror(errno));
-            abort();
-        }
-        new_size = MAX(new_size >> 1, 1 << CPU_TLB_DYN_MIN_BITS);
-        env->tlb_mask[mmu_idx] = (new_size - 1) << CPU_TLB_ENTRY_BITS;
-
-        g_free(env->tlb_table[mmu_idx]);
-        g_free(env->iotlb[mmu_idx]);
-        env->tlb_table[mmu_idx] = g_try_new(CPUTLBEntry, new_size);
-        env->iotlb[mmu_idx] = g_try_new(CPUIOTLBEntry, new_size);
-    }
-}
-
-static inline void tlb_table_flush_by_mmuidx(CPUArchState *env, int mmu_idx)
-{
-    tlb_mmu_resize_locked(env, mmu_idx);
-    memset(env->tlb_table[mmu_idx], -1, sizeof_tlb(env, mmu_idx));
-    env->tlb_d[mmu_idx].n_used_entries = 0;
-}
-
-static inline void tlb_n_used_entries_inc(CPUArchState *env, uintptr_t mmu_idx)
-{
-    env->tlb_d[mmu_idx].n_used_entries++;
-}
-
-static inline void tlb_n_used_entries_dec(CPUArchState *env, uintptr_t mmu_idx)
-{
-    env->tlb_d[mmu_idx].n_used_entries--;
-}
-
 void tlb_init(CPUState *cpu)
 {
    CPUArchState *env = cpu->env_ptr;
@@ -242,8 +82,6 @@ void tlb_init(CPUState *cpu)

    /* Ensure that cpu_reset performs a full flush.  */
    env->tlb_c.dirty = ALL_MMUIDX_BITS;
-
-    tlb_dyn_init(env);
 }

 /* flush_all_helper: run fn across all cpus
@@ -284,7 +122,7 @@ void tlb_flush_counts(size_t *pfull, size_t *ppart, size_t *pelide)

 static void tlb_flush_one_mmuidx_locked(CPUArchState *env, int mmu_idx)
 {
-    tlb_table_flush_by_mmuidx(env, mmu_idx);
+    memset(env->tlb_table[mmu_idx], -1, sizeof(env->tlb_table[0]));
    memset(env->tlb_v_table[mmu_idx], -1, sizeof(env->tlb_v_table[0]));
    env->tlb_d[mmu_idx].large_page_addr = -1;
    env->tlb_d[mmu_idx].large_page_mask = -1;
@@ -386,24 +224,13 @@ static inline bool tlb_hit_page_anyprot(CPUTLBEntry *tlb_entry,
           tlb_hit_page(tlb_entry->addr_code, page);
 }

-/**
- * tlb_entry_is_empty - return true if the entry is not in use
- * @te: pointer to CPUTLBEntry
- */
-static inline bool tlb_entry_is_empty(const CPUTLBEntry *te)
-{
-    return te->addr_read == -1 && te->addr_write == -1 && te->addr_code == -1;
-}
-
 /* Called with tlb_c.lock held */
-static inline bool tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
+static inline void tlb_flush_entry_locked(CPUTLBEntry *tlb_entry,
                                          target_ulong page)
 {
    if (tlb_hit_page_anyprot(tlb_entry, page)) {
        memset(tlb_entry, -1, sizeof(*tlb_entry));
-        return true;
    }
-    return false;
 }

 /* Called with tlb_c.lock held */
@@ -414,9 +241,7 @@ static inline void tlb_flush_vtlb_page_locked(CPUArchState *env, int mmu_idx,

    assert_cpu_is_self(ENV_GET_CPU(env));
    for (k = 0; k < CPU_VTLB_SIZE; k++) {
-        if (tlb_flush_entry_locked(&env->tlb_v_table[mmu_idx][k], page)) {
-            tlb_n_used_entries_dec(env, mmu_idx);
-        }
+        tlb_flush_entry_locked(&env->tlb_v_table[mmu_idx][k], page);
    }
 }

@@ -433,9 +258,7 @@ static void tlb_flush_page_locked(CPUArchState *env, int midx,
                  midx, lp_addr, lp_mask);
        tlb_flush_one_mmuidx_locked(env, midx);
    } else {
-        if (tlb_flush_entry_locked(tlb_entry(env, midx, page), page)) {
-            tlb_n_used_entries_dec(env, midx);
-        }
+        tlb_flush_entry_locked(tlb_entry(env, midx, page), page);
        tlb_flush_vtlb_page_locked(env, midx, page);
    }
 }
@@ -612,9 +435,8 @@ void tlb_reset_dirty(CPUState *cpu, ram_addr_t start1, ram_addr_t length)
    qemu_spin_lock(&env->tlb_c.lock);
    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
        unsigned int i;
-        unsigned int n = tlb_n_entries(env, mmu_idx);

-        for (i = 0; i < n; i++) {
+        for (i = 0; i < CPU_TLB_SIZE; i++) {
            tlb_reset_dirty_range_locked(&env->tlb_table[mmu_idx][i], start1,
                                         length);
        }
@@ -769,14 +591,13 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
     * Only evict the old entry to the victim tlb if it's for a
     * different page; otherwise just overwrite the stale data.
     */
-    if (!tlb_hit_page_anyprot(te, vaddr_page) && !tlb_entry_is_empty(te)) {
+    if (!tlb_hit_page_anyprot(te, vaddr_page)) {
        unsigned vidx = env->tlb_d[mmu_idx].vindex++ % CPU_VTLB_SIZE;
        CPUTLBEntry *tv = &env->tlb_v_table[mmu_idx][vidx];

        /* Evict the old entry into the victim tlb.  */
        copy_tlb_helper_locked(tv, te);
        env->iotlb_v[mmu_idx][vidx] = env->iotlb[mmu_idx][index];
-        tlb_n_used_entries_dec(env, mmu_idx);
    }

    /* refill the tlb */
@@ -828,7 +649,6 @@ void tlb_set_page_with_attrs(CPUState *cpu, target_ulong vaddr,
    }

    copy_tlb_helper_locked(te, &tn);
-    tlb_n_used_entries_inc(env, mmu_idx);
    qemu_spin_unlock(&env->tlb_c.lock);
 }

@@ -1045,8 +865,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr)
    if (unlikely(!tlb_hit(entry->addr_code, addr))) {
        if (!VICTIM_TLB_HIT(addr_code, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, 0, MMU_INST_FETCH, mmu_idx, 0);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        assert(tlb_hit(entry->addr_code, addr));
    }
@@ -1127,8 +945,6 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, 1 << s_bits, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            tlbe = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(tlbe) & ~TLB_INVALID_MASK;
    }
--- a/accel/tcg/softmmu_template.h
+++ b/accel/tcg/softmmu_template.h
@@ -11,7 +11,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -129,8 +129,6 @@ WORD_TYPE helper_le_ld_name(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = entry->ADDR_READ;
    }
@@ -200,8 +198,6 @@ WORD_TYPE helper_be_ld_name(CPUArchState *env, target_ulong addr,
        if (!VICTIM_TLB_HIT(ADDR_READ, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, READ_ACCESS_TYPE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = entry->ADDR_READ;
    }
@@ -298,8 +294,6 @@ void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
    }
@@ -378,8 +372,6 @@ void helper_be_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val,
        if (!VICTIM_TLB_HIT(addr_write, addr)) {
            tlb_fill(ENV_GET_CPU(env), addr, DATA_SIZE, MMU_DATA_STORE,
                     mmu_idx, retaddr);
-            index = tlb_index(env, mmu_idx, addr);
-            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = tlb_addr_write(entry) & ~TLB_INVALID_MASK;
    }
--- a/accel/tcg/tcg-runtime-gvec.c
+++ b/accel/tcg/tcg-runtime-gvec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -512,39 +512,6 @@ void HELPER(gvec_orc)(void *d, void *a, void *b, uint32_t desc)
    clear_high(d, oprsz, desc);
 }

-void HELPER(gvec_nand)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) & *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_nor)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) | *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_eqv)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(vec64)) {
-        *(vec64 *)(d + i) = ~(*(vec64 *)(a + i) ^ *(vec64 *)(b + i));
-    }
-    clear_high(d, oprsz, desc);
-}
-
 void HELPER(gvec_ands)(void *d, void *a, uint64_t b, uint32_t desc)
 {
    intptr_t oprsz = simd_oprsz(desc);
@@ -1028,227 +995,3 @@ void HELPER(gvec_ussub64)(void *d, void *a, void *b, uint32_t desc)
    }
    clear_high(d, oprsz, desc);
 }
-
-void HELPER(gvec_smin8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int8_t)) {
-        int8_t aa = *(int8_t *)(a + i);
-        int8_t bb = *(int8_t *)(b + i);
-        int8_t dd = aa < bb ? aa : bb;
-        *(int8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int16_t aa = *(int16_t *)(a + i);
-        int16_t bb = *(int16_t *)(b + i);
-        int16_t dd = aa < bb ? aa : bb;
-        *(int16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t aa = *(int32_t *)(a + i);
-        int32_t bb = *(int32_t *)(b + i);
-        int32_t dd = aa < bb ? aa : bb;
-        *(int32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smin64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t aa = *(int64_t *)(a + i);
-        int64_t bb = *(int64_t *)(b + i);
-        int64_t dd = aa < bb ? aa : bb;
-        *(int64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int8_t)) {
-        int8_t aa = *(int8_t *)(a + i);
-        int8_t bb = *(int8_t *)(b + i);
-        int8_t dd = aa > bb ? aa : bb;
-        *(int8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int16_t)) {
-        int16_t aa = *(int16_t *)(a + i);
-        int16_t bb = *(int16_t *)(b + i);
-        int16_t dd = aa > bb ? aa : bb;
-        *(int16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int32_t)) {
-        int32_t aa = *(int32_t *)(a + i);
-        int32_t bb = *(int32_t *)(b + i);
-        int32_t dd = aa > bb ? aa : bb;
-        *(int32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_smax64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(int64_t)) {
-        int64_t aa = *(int64_t *)(a + i);
-        int64_t bb = *(int64_t *)(b + i);
-        int64_t dd = aa > bb ? aa : bb;
-        *(int64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        uint8_t aa = *(uint8_t *)(a + i);
-        uint8_t bb = *(uint8_t *)(b + i);
-        uint8_t dd = aa < bb ? aa : bb;
-        *(uint8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        uint16_t aa = *(uint16_t *)(a + i);
-        uint16_t bb = *(uint16_t *)(b + i);
-        uint16_t dd = aa < bb ? aa : bb;
-        *(uint16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t aa = *(uint32_t *)(a + i);
-        uint32_t bb = *(uint32_t *)(b + i);
-        uint32_t dd = aa < bb ? aa : bb;
-        *(uint32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umin64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t aa = *(uint64_t *)(a + i);
-        uint64_t bb = *(uint64_t *)(b + i);
-        uint64_t dd = aa < bb ? aa : bb;
-        *(uint64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax8)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint8_t)) {
-        uint8_t aa = *(uint8_t *)(a + i);
-        uint8_t bb = *(uint8_t *)(b + i);
-        uint8_t dd = aa > bb ? aa : bb;
-        *(uint8_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax16)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint16_t)) {
-        uint16_t aa = *(uint16_t *)(a + i);
-        uint16_t bb = *(uint16_t *)(b + i);
-        uint16_t dd = aa > bb ? aa : bb;
-        *(uint16_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax32)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint32_t)) {
-        uint32_t aa = *(uint32_t *)(a + i);
-        uint32_t bb = *(uint32_t *)(b + i);
-        uint32_t dd = aa > bb ? aa : bb;
-        *(uint32_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
-
-void HELPER(gvec_umax64)(void *d, void *a, void *b, uint32_t desc)
-{
-    intptr_t oprsz = simd_oprsz(desc);
-    intptr_t i;
-
-    for (i = 0; i < oprsz; i += sizeof(uint64_t)) {
-        uint64_t aa = *(uint64_t *)(a + i);
-        uint64_t bb = *(uint64_t *)(b + i);
-        uint64_t dd = aa > bb ? aa : bb;
-        *(uint64_t *)(d + i) = dd;
-    }
-    clear_high(d, oprsz, desc);
-}
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -200,26 +200,6 @@ DEF_HELPER_FLAGS_4(gvec_ussub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)

-DEF_HELPER_FLAGS_4(gvec_smin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_smax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_smax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
-DEF_HELPER_FLAGS_4(gvec_umax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_umax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-
 DEF_HELPER_FLAGS_3(gvec_neg8, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg16, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg32, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
@@ -231,9 +211,6 @@ DEF_HELPER_FLAGS_4(gvec_or, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_xor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_andc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_orc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_nand, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_nor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
-DEF_HELPER_FLAGS_4(gvec_eqv, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)

 DEF_HELPER_FLAGS_4(gvec_ands, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_xors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
--- a/accel/tcg/trace-events
+++ b/accel/tcg/trace-events
@@ -1,4 +1,4 @@
-# See docs/devel/tracing.txt for syntax documentation.
+# Trace events for debugging and performance instrumentation

 # TCG related tracing (mostly disabled by default)
 # cpu-exec.c
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -16,8 +16,12 @@
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
+#ifdef _WIN32
+#include <windows.h>
+#endif
 #include "qemu/osdep.h"

+
 #include "qemu-common.h"
 #define NO_CPU_IO_DEFS
 #include "cpu.h"
@@ -1688,9 +1692,6 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
        cflags |= CF_NOCACHE | 1;
    }

-    cflags &= ~CF_CLUSTER_MASK;
-    cflags |= cpu->cluster_index << CF_CLUSTER_SHIFT;
-
 buffer_overflow:
    tb = tb_alloc(pc);
    if (unlikely(!tb)) {
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -6,7 +6,7 @@
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
+ * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -479,66 +479,28 @@ int cpu_signal_handler(int host_signum, void *pinfo,

 #elif defined(__aarch64__)

-#ifndef ESR_MAGIC
-/* Pre-3.16 kernel headers don't have these, so provide fallback definitions */
-#define ESR_MAGIC 0x45535201
-struct esr_context {
-    struct _aarch64_ctx head;
-    uint64_t esr;
-};
-#endif
-
-static inline struct _aarch64_ctx *first_ctx(ucontext_t *uc)
-{
-    return (struct _aarch64_ctx *)&uc->uc_mcontext.__reserved;
-}
-
-static inline struct _aarch64_ctx *next_ctx(struct _aarch64_ctx *hdr)
-{
-    return (struct _aarch64_ctx *)((char *)hdr + hdr->size);
-}
-
 int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
 {
    siginfo_t *info = pinfo;
    ucontext_t *uc = puc;
    uintptr_t pc = uc->uc_mcontext.pc;
+    uint32_t insn = *(uint32_t *)pc;
    bool is_write;
-    struct _aarch64_ctx *hdr;
-    struct esr_context const *esrctx = NULL;

-    /* Find the esr_context, which has the WnR bit in it */
-    for (hdr = first_ctx(uc); hdr->magic; hdr = next_ctx(hdr)) {
-        if (hdr->magic == ESR_MAGIC) {
-            esrctx = (struct esr_context const *)hdr;
-            break;
-        }
-    }
+    /* XXX: need kernel patch to get write flag faster.  */
+    is_write = (   (insn & 0xbfff0000) == 0x0c000000   /* C3.3.1 */
+                || (insn & 0xbfe00000) == 0x0c800000   /* C3.3.2 */
+                || (insn & 0xbfdf0000) == 0x0d000000   /* C3.3.3 */
+                || (insn & 0xbfc00000) == 0x0d800000   /* C3.3.4 */
+                || (insn & 0x3f400000) == 0x08000000   /* C3.3.6 */
+                || (insn & 0x3bc00000) == 0x39000000   /* C3.3.13 */
+                || (insn & 0x3fc00000) == 0x3d800000   /* ... 128bit */
+                /* Ingore bits 10, 11 & 21, controlling indexing.  */
+                || (insn & 0x3bc00000) == 0x38000000   /* C3.3.8-12 */
+                || (insn & 0x3fe00000) == 0x3c800000   /* ... 128bit */
+                /* Ignore bits 23 & 24, controlling indexing.  */
+                || (insn & 0x3a400000) == 0x28000000); /* C3.3.7,14-16 */

-    if (esrctx) {
-        /* For data aborts ESR.EC is 0b10010x: then bit 6 is the WnR bit */
-        uint64_t esr = esrctx->esr;
-        is_write = extract32(esr, 27, 5) == 0x12 && extract32(esr, 6, 1) == 1;
-    } else {
-        /*
-         * Fall back to parsing instructions; will only be needed
-         * for really ancient (pre-3.16) kernels.
-         */
-        uint32_t insn = *(uint32_t *)pc;
-
-        is_write = ((insn & 0xbfff0000) == 0x0c000000   /* C3.3.1 */
-                    || (insn & 0xbfe00000) == 0x0c800000   /* C3.3.2 */
-                    || (insn & 0xbfdf0000) == 0x0d000000   /* C3.3.3 */
-                    || (insn & 0xbfc00000) == 0x0d800000   /* C3.3.4 */
-                    || (insn & 0x3f400000) == 0x08000000   /* C3.3.6 */
-                    || (insn & 0x3bc00000) == 0x39000000   /* C3.3.13 */
-                    || (insn & 0x3fc00000) == 0x3d800000   /* ... 128bit */
-                    /* Ignore bits 10, 11 & 21, controlling indexing.  */
-                    || (insn & 0x3bc00000) == 0x38000000   /* C3.3.8-12 */
-                    || (insn & 0x3fe00000) == 0x3c800000   /* ... 128bit */
-                    /* Ignore bits 23 & 24, controlling indexing.  */
-                    || (insn & 0x3a400000) == 0x28000000); /* C3.3.7,14-16 */
-    }
    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }

@@ -609,81 +571,6 @@ int cpu_signal_handler(int host_signum, void *pinfo,
    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
 }

-#elif defined(__riscv)
-
-int cpu_signal_handler(int host_signum, void *pinfo,
-                       void *puc)
-{
-    siginfo_t *info = pinfo;
-    ucontext_t *uc = puc;
-    greg_t pc = uc->uc_mcontext.__gregs[REG_PC];
-    uint32_t insn = *(uint32_t *)pc;
-    int is_write = 0;
-
-    /* Detect store by reading the instruction at the program
-       counter. Note: we currently only generate 32-bit
-       instructions so we thus only detect 32-bit stores */
-    switch (((insn >> 0) & 0b11)) {
-    case 3:
-        switch (((insn >> 2) & 0b11111)) {
-        case 8:
-            switch (((insn >> 12) & 0b111)) {
-            case 0: /* sb */
-            case 1: /* sh */
-            case 2: /* sw */
-            case 3: /* sd */
-            case 4: /* sq */
-                is_write = 1;
-                break;
-            default:
-                break;
-            }
-            break;
-        case 9:
-            switch (((insn >> 12) & 0b111)) {
-            case 2: /* fsw */
-            case 3: /* fsd */
-            case 4: /* fsq */
-                is_write = 1;
-                break;
-            default:
-                break;
-            }
-            break;
-        default:
-            break;
-        }
-    }
-
-    /* Check for compressed instructions */
-    switch (((insn >> 13) & 0b111)) {
-    case 7:
-        switch (insn & 0b11) {
-        case 0: /*c.sd */
-        case 2: /* c.sdsp */
-            is_write = 1;
-            break;
-        default:
-            break;
-        }
-        break;
-    case 6:
-        switch (insn & 0b11) {
-        case 0: /* c.sw */
-        case 3: /* c.swsp */
-            is_write = 1;
-            break;
-        default:
-            break;
-        }
-        break;
-    default:
-        break;
-    }
-
-    return handle_cpu_signal(pc, info, is_write, &uc->uc_sigmask);
-}
-
 #else

 #error host CPU specific signal handler needed
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,4 +1,4 @@
-common-obj-y = audio.o audio_legacy.o noaudio.o wavaudio.o mixeng.o
+common-obj-y = audio.o noaudio.o wavaudio.o mixeng.o
 common-obj-$(CONFIG_SPICE) += spiceaudio.o
 common-obj-$(CONFIG_AUDIO_COREAUDIO) += coreaudio.o
 common-obj-$(CONFIG_AUDIO_DSOUND) += dsoundaudio.o
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -28,14 +28,35 @@
 #include "audio.h"
 #include "trace.h"

+#if QEMU_GNUC_PREREQ(4, 3)
 #pragma GCC diagnostic ignored "-Waddress"
+#endif

 #define AUDIO_CAP "alsa"
 #include "audio_int.h"

+typedef struct ALSAConf {
+    int size_in_usec_in;
+    int size_in_usec_out;
+    const char *pcm_name_in;
+    const char *pcm_name_out;
+    unsigned int buffer_size_in;
+    unsigned int period_size_in;
+    unsigned int buffer_size_out;
+    unsigned int period_size_out;
+    unsigned int threshold;
+
+    int buffer_size_in_overridden;
+    int period_size_in_overridden;
+
+    int buffer_size_out_overridden;
+    int period_size_out_overridden;
+} ALSAConf;
+
 struct pollhlp {
    snd_pcm_t *handle;
    struct pollfd *pfds;
+    ALSAConf *conf;
    int count;
    int mask;
 };
@@ -47,7 +68,6 @@ typedef struct ALSAVoiceOut {
    void *pcm_buf;
    snd_pcm_t *handle;
    struct pollhlp pollhlp;
-    Audiodev *dev;
 } ALSAVoiceOut;

 typedef struct ALSAVoiceIn {
@@ -55,18 +75,21 @@ typedef struct ALSAVoiceIn {
    snd_pcm_t *handle;
    void *pcm_buf;
    struct pollhlp pollhlp;
-    Audiodev *dev;
 } ALSAVoiceIn;

 struct alsa_params_req {
    int freq;
    snd_pcm_format_t fmt;
    int nchannels;
+    int size_in_usec;
+    int override_mask;
+    unsigned int buffer_size;
+    unsigned int period_size;
 };

 struct alsa_params_obt {
    int freq;
-    AudioFormat fmt;
+    audfmt_e fmt;
    int endianness;
    int nchannels;
    snd_pcm_uframes_t samples;
@@ -273,16 +296,16 @@ static int alsa_write (SWVoiceOut *sw, void *buf, int len)
    return audio_pcm_sw_write (sw, buf, len);
 }

-static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
+static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int endianness)
 {
    switch (fmt) {
-    case AUDIO_FORMAT_S8:
+    case AUD_FMT_S8:
        return SND_PCM_FORMAT_S8;

-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_U8:
        return SND_PCM_FORMAT_U8;

-    case AUDIO_FORMAT_S16:
+    case AUD_FMT_S16:
        if (endianness) {
            return SND_PCM_FORMAT_S16_BE;
        }
@@ -290,7 +313,7 @@ static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
            return SND_PCM_FORMAT_S16_LE;
        }

-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_U16:
        if (endianness) {
            return SND_PCM_FORMAT_U16_BE;
        }
@@ -298,7 +321,7 @@ static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
            return SND_PCM_FORMAT_U16_LE;
        }

-    case AUDIO_FORMAT_S32:
+    case AUD_FMT_S32:
        if (endianness) {
            return SND_PCM_FORMAT_S32_BE;
        }
@@ -306,7 +329,7 @@ static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
            return SND_PCM_FORMAT_S32_LE;
        }

-    case AUDIO_FORMAT_U32:
+    case AUD_FMT_U32:
        if (endianness) {
            return SND_PCM_FORMAT_U32_BE;
        }
@@ -323,58 +346,58 @@ static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
    }
 }

-static int alsa_to_audfmt (snd_pcm_format_t alsafmt, AudioFormat *fmt,
+static int alsa_to_audfmt (snd_pcm_format_t alsafmt, audfmt_e *fmt,
                           int *endianness)
 {
    switch (alsafmt) {
    case SND_PCM_FORMAT_S8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S8;
+        *fmt = AUD_FMT_S8;
        break;

    case SND_PCM_FORMAT_U8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U8;
+        *fmt = AUD_FMT_U8;
        break;

    case SND_PCM_FORMAT_S16_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case SND_PCM_FORMAT_U16_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    case SND_PCM_FORMAT_S16_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case SND_PCM_FORMAT_U16_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    case SND_PCM_FORMAT_S32_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S32;
+        *fmt = AUD_FMT_S32;
        break;

    case SND_PCM_FORMAT_U32_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U32;
+        *fmt = AUD_FMT_U32;
        break;

    case SND_PCM_FORMAT_S32_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_S32;
+        *fmt = AUD_FMT_S32;
        break;

    case SND_PCM_FORMAT_U32_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_U32;
+        *fmt = AUD_FMT_U32;
        break;

    default:
@@ -387,18 +410,17 @@ static int alsa_to_audfmt (snd_pcm_format_t alsafmt, AudioFormat *fmt,

 static void alsa_dump_info (struct alsa_params_req *req,
                            struct alsa_params_obt *obt,
-                            snd_pcm_format_t obtfmt,
-                            AudiodevAlsaPerDirectionOptions *apdo)
+                            snd_pcm_format_t obtfmt)
 {
-    dolog("parameter | requested value | obtained value\n");
-    dolog("format    |      %10d |     %10d\n", req->fmt, obtfmt);
-    dolog("channels  |      %10d |     %10d\n",
-          req->nchannels, obt->nchannels);
-    dolog("frequency |      %10d |     %10d\n", req->freq, obt->freq);
-    dolog("============================================\n");
-    dolog("requested: buffer len %" PRId32 " period len %" PRId32 "\n",
-          apdo->buffer_length, apdo->period_length);
-    dolog("obtained: samples %ld\n", obt->samples);
+    dolog ("parameter | requested value | obtained value\n");
+    dolog ("format    |      %10d |     %10d\n", req->fmt, obtfmt);
+    dolog ("channels  |      %10d |     %10d\n",
+           req->nchannels, obt->nchannels);
+    dolog ("frequency |      %10d |     %10d\n", req->freq, obt->freq);
+    dolog ("============================================\n");
+    dolog ("requested: buffer size %d period size %d\n",
+           req->buffer_size, req->period_size);
+    dolog ("obtained: samples %ld\n", obt->samples);
 }

 static void alsa_set_threshold (snd_pcm_t *handle, snd_pcm_uframes_t threshold)
@@ -431,23 +453,23 @@ static void alsa_set_threshold (snd_pcm_t *handle, snd_pcm_uframes_t threshold)
    }
 }

-static int alsa_open(bool in, struct alsa_params_req *req,
-                     struct alsa_params_obt *obt, snd_pcm_t **handlep,
-                     Audiodev *dev)
+static int alsa_open (int in, struct alsa_params_req *req,
+                      struct alsa_params_obt *obt, snd_pcm_t **handlep,
+                      ALSAConf *conf)
 {
-    AudiodevAlsaOptions *aopts = &dev->u.alsa;
-    AudiodevAlsaPerDirectionOptions *apdo = in ? aopts->in : aopts->out;
    snd_pcm_t *handle;
    snd_pcm_hw_params_t *hw_params;
    int err;
+    int size_in_usec;
    unsigned int freq, nchannels;
-    const char *pcm_name = apdo->has_dev ? apdo->dev : "default";
+    const char *pcm_name = in ? conf->pcm_name_in : conf->pcm_name_out;
    snd_pcm_uframes_t obt_buffer_size;
    const char *typ = in ? "ADC" : "DAC";
    snd_pcm_format_t obtfmt;

    freq = req->freq;
    nchannels = req->nchannels;
+    size_in_usec = req->size_in_usec;

    snd_pcm_hw_params_alloca (&hw_params);

@@ -507,42 +529,79 @@ static int alsa_open(bool in, struct alsa_params_req *req,
        goto err;
    }

-    if (apdo->buffer_length) {
-        int dir = 0;
-        unsigned int btime = apdo->buffer_length;
+    if (req->buffer_size) {
+        unsigned long obt;

-        err = snd_pcm_hw_params_set_buffer_time_near(
-            handle, hw_params, &btime, &dir);
+        if (size_in_usec) {
+            int dir = 0;
+            unsigned int btime = req->buffer_size;

+            err = snd_pcm_hw_params_set_buffer_time_near (
+                handle,
+                hw_params,
+                &btime,
+                &dir
+                );
+            obt = btime;
+        }
+        else {
+            snd_pcm_uframes_t bsize = req->buffer_size;
+
+            err = snd_pcm_hw_params_set_buffer_size_near (
+                handle,
+                hw_params,
+                &bsize
+                );
+            obt = bsize;
+        }
        if (err < 0) {
-            alsa_logerr2(err, typ, "Failed to set buffer time to %" PRId32 "\n",
-                         apdo->buffer_length);
+            alsa_logerr2 (err, typ, "Failed to set buffer %s to %d\n",
+                          size_in_usec ? "time" : "size", req->buffer_size);
            goto err;
        }

-        if (apdo->has_buffer_length && btime != apdo->buffer_length) {
-            dolog("Requested buffer time %" PRId32
-                  " was rejected, using %u\n", apdo->buffer_length, btime);
-        }
+        if ((req->override_mask & 2) && (obt - req->buffer_size))
+            dolog ("Requested buffer %s %u was rejected, using %lu\n",
+                   size_in_usec ? "time" : "size", req->buffer_size, obt);
    }

-    if (apdo->period_length) {
-        int dir = 0;
-        unsigned int ptime = apdo->period_length;
+    if (req->period_size) {
+        unsigned long obt;

-        err = snd_pcm_hw_params_set_period_time_near(handle, hw_params, &ptime,
-                                                     &dir);
+        if (size_in_usec) {
+            int dir = 0;
+            unsigned int ptime = req->period_size;
+
+            err = snd_pcm_hw_params_set_period_time_near (
+                handle,
+                hw_params,
+                &ptime,
+                &dir
+                );
+            obt = ptime;
+        }
+        else {
+            int dir = 0;
+            snd_pcm_uframes_t psize = req->period_size;
+
+            err = snd_pcm_hw_params_set_period_size_near (
+                handle,
+                hw_params,
+                &psize,
+                &dir
+                );
+            obt = psize;
+        }

        if (err < 0) {
-            alsa_logerr2(err, typ, "Failed to set period time to %" PRId32 "\n",
-                         apdo->period_length);
+            alsa_logerr2 (err, typ, "Failed to set period %s to %d\n",
+                          size_in_usec ? "time" : "size", req->period_size);
            goto err;
        }

-        if (apdo->has_period_length && ptime != apdo->period_length) {
-            dolog("Requested period time %" PRId32 " was rejected, using %d\n",
-                  apdo->period_length, ptime);
-        }
+        if (((req->override_mask & 1) && (obt - req->period_size)))
+            dolog ("Requested period %s %u was rejected, using %lu\n",
+                   size_in_usec ? "time" : "size", req->period_size, obt);
    }

    err = snd_pcm_hw_params (handle, hw_params);
@@ -574,12 +633,30 @@ static int alsa_open(bool in, struct alsa_params_req *req,
        goto err;
    }

-    if (!in && aopts->has_threshold && aopts->threshold) {
-        struct audsettings as = { .freq = freq };
-        alsa_set_threshold(
-            handle,
-            audio_buffer_frames(qapi_AudiodevAlsaPerDirectionOptions_base(apdo),
-                                &as, aopts->threshold));
+    if (!in && conf->threshold) {
+        snd_pcm_uframes_t threshold;
+        int bytes_per_sec;
+
+        bytes_per_sec = freq << (nchannels == 2);
+
+        switch (obt->fmt) {
+        case AUD_FMT_S8:
+        case AUD_FMT_U8:
+            break;
+
+        case AUD_FMT_S16:
+        case AUD_FMT_U16:
+            bytes_per_sec <<= 1;
+            break;
+
+        case AUD_FMT_S32:
+        case AUD_FMT_U32:
+            bytes_per_sec <<= 2;
+            break;
+        }
+
+        threshold = (conf->threshold * bytes_per_sec) / 1000;
+        alsa_set_threshold (handle, threshold);
    }

    obt->nchannels = nchannels;
@@ -592,11 +669,11 @@ static int alsa_open(bool in, struct alsa_params_req *req,
         obt->nchannels != req->nchannels ||
         obt->freq != req->freq) {
        dolog ("Audio parameters for %s\n", typ);
-        alsa_dump_info(req, obt, obtfmt, apdo);
+        alsa_dump_info (req, obt, obtfmt);
    }

 #ifdef DEBUG
-    alsa_dump_info(req, obt, obtfmt, pdo);
+    alsa_dump_info (req, obt, obtfmt);
 #endif
    return 0;

@@ -722,13 +799,19 @@ static int alsa_init_out(HWVoiceOut *hw, struct audsettings *as,
    struct alsa_params_obt obt;
    snd_pcm_t *handle;
    struct audsettings obt_as;
-    Audiodev *dev = drv_opaque;
+    ALSAConf *conf = drv_opaque;

    req.fmt = aud_to_alsafmt (as->fmt, as->endianness);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
+    req.period_size = conf->period_size_out;
+    req.buffer_size = conf->buffer_size_out;
+    req.size_in_usec = conf->size_in_usec_out;
+    req.override_mask =
+        (conf->period_size_out_overridden ? 1 : 0) |
+        (conf->buffer_size_out_overridden ? 2 : 0);

-    if (alsa_open(0, &req, &obt, &handle, dev)) {
+    if (alsa_open (0, &req, &obt, &handle, conf)) {
        return -1;
    }

@@ -749,7 +832,7 @@ static int alsa_init_out(HWVoiceOut *hw, struct audsettings *as,
    }

    alsa->handle = handle;
-    alsa->dev = dev;
+    alsa->pollhlp.conf = conf;
    return 0;
 }

@@ -789,12 +872,16 @@ static int alsa_voice_ctl (snd_pcm_t *handle, const char *typ, int ctl)
 static int alsa_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
    ALSAVoiceOut *alsa = (ALSAVoiceOut *) hw;
-    AudiodevAlsaPerDirectionOptions *apdo = alsa->dev->u.alsa.out;

    switch (cmd) {
    case VOICE_ENABLE:
        {
-            bool poll_mode = apdo->try_poll;
+            va_list ap;
+            int poll_mode;
+
+            va_start (ap, cmd);
+            poll_mode = va_arg (ap, int);
+            va_end (ap);

            ldebug ("enabling voice\n");
            if (poll_mode && alsa_poll_out (hw)) {
@@ -823,13 +910,19 @@ static int alsa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    struct alsa_params_obt obt;
    snd_pcm_t *handle;
    struct audsettings obt_as;
-    Audiodev *dev = drv_opaque;
+    ALSAConf *conf = drv_opaque;

    req.fmt = aud_to_alsafmt (as->fmt, as->endianness);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
+    req.period_size = conf->period_size_in;
+    req.buffer_size = conf->buffer_size_in;
+    req.size_in_usec = conf->size_in_usec_in;
+    req.override_mask =
+        (conf->period_size_in_overridden ? 1 : 0) |
+        (conf->buffer_size_in_overridden ? 2 : 0);

-    if (alsa_open(1, &req, &obt, &handle, dev)) {
+    if (alsa_open (1, &req, &obt, &handle, conf)) {
        return -1;
    }

@@ -850,7 +943,7 @@ static int alsa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }

    alsa->handle = handle;
-    alsa->dev = dev;
+    alsa->pollhlp.conf = conf;
    return 0;
 }

@@ -992,12 +1085,16 @@ static int alsa_read (SWVoiceIn *sw, void *buf, int size)
 static int alsa_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
    ALSAVoiceIn *alsa = (ALSAVoiceIn *) hw;
-    AudiodevAlsaPerDirectionOptions *apdo = alsa->dev->u.alsa.in;

    switch (cmd) {
    case VOICE_ENABLE:
        {
-            bool poll_mode = apdo->try_poll;
+            va_list ap;
+            int poll_mode;
+
+            va_start (ap, cmd);
+            poll_mode = va_arg (ap, int);
+            va_end (ap);

            ldebug ("enabling voice\n");
            if (poll_mode && alsa_poll_in (hw)) {
@@ -1020,54 +1117,88 @@ static int alsa_ctl_in (HWVoiceIn *hw, int cmd, ...)
    return -1;
 }

-static void alsa_init_per_direction(AudiodevAlsaPerDirectionOptions *apdo)
+static ALSAConf glob_conf = {
+    .buffer_size_out = 4096,
+    .period_size_out = 1024,
+    .pcm_name_out = "default",
+    .pcm_name_in = "default",
+};
+
+static void *alsa_audio_init (void)
 {
-    if (!apdo->has_try_poll) {
-        apdo->try_poll = true;
-        apdo->has_try_poll = true;
-    }
-}
-
-static void *alsa_audio_init(Audiodev *dev)
-{
-    AudiodevAlsaOptions *aopts;
-    assert(dev->driver == AUDIODEV_DRIVER_ALSA);
-
-    aopts = &dev->u.alsa;
-    alsa_init_per_direction(aopts->in);
-    alsa_init_per_direction(aopts->out);
-
-    /*
-     * need to define them, as otherwise alsa produces no sound
-     * doesn't set has_* so alsa_open can identify it wasn't set by the user
-     */
-    if (!dev->u.alsa.out->has_period_length) {
-        /* 1024 frames assuming 44100Hz */
-        dev->u.alsa.out->period_length = 1024 * 1000000 / 44100;
-    }
-    if (!dev->u.alsa.out->has_buffer_length) {
-        /* 4096 frames assuming 44100Hz */
-        dev->u.alsa.out->buffer_length = 4096ll * 1000000 / 44100;
-    }
-
-    /*
-     * OptsVisitor sets unspecified optional fields to zero, but do not depend
-     * on it...
-     */
-    if (!dev->u.alsa.in->has_period_length) {
-        dev->u.alsa.in->period_length = 0;
-    }
-    if (!dev->u.alsa.in->has_buffer_length) {
-        dev->u.alsa.in->buffer_length = 0;
-    }
-
-    return dev;
+    ALSAConf *conf = g_malloc(sizeof(ALSAConf));
+    *conf = glob_conf;
+    return conf;
 }

 static void alsa_audio_fini (void *opaque)
 {
+    g_free(opaque);
 }

+static struct audio_option alsa_options[] = {
+    {
+        .name        = "DAC_SIZE_IN_USEC",
+        .tag         = AUD_OPT_BOOL,
+        .valp        = &glob_conf.size_in_usec_out,
+        .descr       = "DAC period/buffer size in microseconds (otherwise in frames)"
+    },
+    {
+        .name        = "DAC_PERIOD_SIZE",
+        .tag         = AUD_OPT_INT,
+        .valp        = &glob_conf.period_size_out,
+        .descr       = "DAC period size (0 to go with system default)",
+        .overriddenp = &glob_conf.period_size_out_overridden
+    },
+    {
+        .name        = "DAC_BUFFER_SIZE",
+        .tag         = AUD_OPT_INT,
+        .valp        = &glob_conf.buffer_size_out,
+        .descr       = "DAC buffer size (0 to go with system default)",
+        .overriddenp = &glob_conf.buffer_size_out_overridden
+    },
+    {
+        .name        = "ADC_SIZE_IN_USEC",
+        .tag         = AUD_OPT_BOOL,
+        .valp        = &glob_conf.size_in_usec_in,
+        .descr       =
+        "ADC period/buffer size in microseconds (otherwise in frames)"
+    },
+    {
+        .name        = "ADC_PERIOD_SIZE",
+        .tag         = AUD_OPT_INT,
+        .valp        = &glob_conf.period_size_in,
+        .descr       = "ADC period size (0 to go with system default)",
+        .overriddenp = &glob_conf.period_size_in_overridden
+    },
+    {
+        .name        = "ADC_BUFFER_SIZE",
+        .tag         = AUD_OPT_INT,
+        .valp        = &glob_conf.buffer_size_in,
+        .descr       = "ADC buffer size (0 to go with system default)",
+        .overriddenp = &glob_conf.buffer_size_in_overridden
+    },
+    {
+        .name        = "THRESHOLD",
+        .tag         = AUD_OPT_INT,
+        .valp        = &glob_conf.threshold,
+        .descr       = "(undocumented)"
+    },
+    {
+        .name        = "DAC_DEV",
+        .tag         = AUD_OPT_STR,
+        .valp        = &glob_conf.pcm_name_out,
+        .descr       = "DAC device name (for instance dmix)"
+    },
+    {
+        .name        = "ADC_DEV",
+        .tag         = AUD_OPT_STR,
+        .valp        = &glob_conf.pcm_name_in,
+        .descr       = "ADC device name"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops alsa_pcm_ops = {
    .init_out = alsa_init_out,
    .fini_out = alsa_fini_out,
@@ -1085,6 +1216,7 @@ static struct audio_pcm_ops alsa_pcm_ops = {
 static struct audio_driver alsa_audio_driver = {
    .name           = "alsa",
    .descr          = "ALSA http://www.alsa-project.org",
+    .options        = alsa_options,
    .init           = alsa_audio_init,
    .fini           = alsa_audio_fini,
    .pcm_ops        = &alsa_pcm_ops,
--- a/audio/audio.c
+++ b/audio/audio.c
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -26,31 +26,30 @@
 #define QEMU_AUDIO_H

 #include "qemu/queue.h"
-#include "qapi/qapi-types-audio.h"

 typedef void (*audio_callback_fn) (void *opaque, int avail);

+typedef enum {
+    AUD_FMT_U8,
+    AUD_FMT_S8,
+    AUD_FMT_U16,
+    AUD_FMT_S16,
+    AUD_FMT_U32,
+    AUD_FMT_S32
+} audfmt_e;
+
 #ifdef HOST_WORDS_BIGENDIAN
 #define AUDIO_HOST_ENDIANNESS 1
 #else
 #define AUDIO_HOST_ENDIANNESS 0
 #endif

-typedef struct audsettings {
+struct audsettings {
    int freq;
    int nchannels;
-    AudioFormat fmt;
+    audfmt_e fmt;
    int endianness;
-} audsettings;
-
-audsettings audiodev_to_audsettings(AudiodevPerDirectionOptions *pdo);
-int audioformat_bytes_per_sample(AudioFormat fmt);
-int audio_buffer_frames(AudiodevPerDirectionOptions *pdo,
-                        audsettings *as, int def_usecs);
-int audio_buffer_samples(AudiodevPerDirectionOptions *pdo,
-                         audsettings *as, int def_usecs);
-int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
-                       audsettings *as, int def_usecs);
+};

 typedef enum {
    AUD_CNOTIFY_ENABLE,
@@ -90,6 +89,7 @@ typedef struct QEMUAudioTimeStamp {
 void AUD_vlog (const char *cap, const char *fmt, va_list ap) GCC_FMT_ATTR(2, 0);
 void AUD_log (const char *cap, const char *fmt, ...) GCC_FMT_ATTR(2, 3);

+void AUD_help (void);
 void AUD_register_card (const char *name, QEMUSoundCard *card);
 void AUD_remove_card (QEMUSoundCard *card);
 CaptureVoiceOut *AUD_add_capture (
@@ -171,8 +171,4 @@ void audio_sample_to_uint64(void *samples, int pos,
 void audio_sample_from_uint64(void *samples, int pos,
                            uint64_t left, uint64_t right);

-void audio_parse_option(const char *opt);
-void audio_init_audiodevs(void);
-void audio_legacy_help(void);
-
 #endif /* QEMU_AUDIO_H */
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -33,6 +33,22 @@

 struct audio_pcm_ops;

+typedef enum {
+    AUD_OPT_INT,
+    AUD_OPT_FMT,
+    AUD_OPT_STR,
+    AUD_OPT_BOOL
+} audio_option_tag_e;
+
+struct audio_option {
+    const char *name;
+    audio_option_tag_e tag;
+    void *valp;
+    const char *descr;
+    int *overriddenp;
+    int overridden;
+};
+
 struct audio_callback {
    void *opaque;
    audio_callback_fn fn;
@@ -129,7 +145,8 @@ typedef struct audio_driver audio_driver;
 struct audio_driver {
    const char *name;
    const char *descr;
-    void *(*init) (Audiodev *);
+    struct audio_option *options;
+    void *(*init) (void);
    void (*fini) (void *);
    struct audio_pcm_ops *pcm_ops;
    int can_be_default;
@@ -174,9 +191,8 @@ struct SWVoiceCap {
    QLIST_ENTRY (SWVoiceCap) entries;
 };

-typedef struct AudioState {
+struct AudioState {
    struct audio_driver *drv;
-    Audiodev *dev;
    void *drv_opaque;

    QEMUTimer *ts;
@@ -187,13 +203,10 @@ typedef struct AudioState {
    int nb_hw_voices_out;
    int nb_hw_voices_in;
    int vm_running;
-    int64_t period_ticks;
-} AudioState;
+};

 extern const struct mixeng_volume nominal_volume;

-extern const char *audio_prio_list[];
-
 void audio_driver_register(audio_driver *drv);
 audio_driver *audio_driver_lookup(const char *name);

@@ -235,18 +248,4 @@ static inline int audio_ring_dist (int dst, int src, int len)
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)

-typedef struct AudiodevListEntry {
-    Audiodev *dev;
-    QSIMPLEQ_ENTRY(AudiodevListEntry) next;
-} AudiodevListEntry;
-
-typedef QSIMPLEQ_HEAD(, AudiodevListEntry) AudiodevListHead;
-AudiodevListHead audio_handle_legacy_opts(void);
-
-void audio_free_audiodev_list(AudiodevListHead *head);
-
-void audio_create_pdos(Audiodev *dev);
-AudiodevPerDirectionOptions *audio_get_pdo_in(Audiodev *dev);
-AudiodevPerDirectionOptions *audio_get_pdo_out(Audiodev *dev);
-
 #endif /* QEMU_AUDIO_INT_H */
--- a/audio/audio_legacy.c
+++ b/audio/audio_legacy.c
@@ -1,544 +0,0 @@
-/*
- * QEMU Audio subsystem: legacy configuration handling
- *
- * Copyright (c) 2015-2019 Zoltán Kővágó <DirtY.iCE.hu@gmail.com>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "audio.h"
-#include "audio_int.h"
-#include "qemu-common.h"
-#include "qemu/cutils.h"
-#include "qapi/error.h"
-#include "qapi/qapi-visit-audio.h"
-#include "qapi/visitor-impl.h"
-
-#define AUDIO_CAP "audio-legacy"
-#include "audio_int.h"
-
-static uint32_t toui32(const char *str)
-{
-    unsigned long long ret;
-    if (parse_uint_full(str, &ret, 10) || ret > UINT32_MAX) {
-        dolog("Invalid integer value `%s'\n", str);
-        exit(1);
-    }
-    return ret;
-}
-
-/* helper functions to convert env variables */
-static void get_bool(const char *env, bool *dst, bool *has_dst)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = toui32(val) != 0;
-        *has_dst = true;
-    }
-}
-
-static void get_int(const char *env, uint32_t *dst, bool *has_dst)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = toui32(val);
-        *has_dst = true;
-    }
-}
-
-static void get_str(const char *env, char **dst, bool *has_dst)
-{
-    const char *val = getenv(env);
-    if (val) {
-        if (*has_dst) {
-            g_free(*dst);
-        }
-        *dst = g_strdup(val);
-        *has_dst = true;
-    }
-}
-
-static void get_fmt(const char *env, AudioFormat *dst, bool *has_dst)
-{
-    const char *val = getenv(env);
-    if (val) {
-        size_t i;
-        for (i = 0; AudioFormat_lookup.size; ++i) {
-            if (strcasecmp(val, AudioFormat_lookup.array[i]) == 0) {
-                *dst = i;
-                *has_dst = true;
-                return;
-            }
-        }
-
-        dolog("Invalid audio format `%s'\n", val);
-        exit(1);
-    }
-}
-
-
-static void get_millis_to_usecs(const char *env, uint32_t *dst, bool *has_dst)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = toui32(val) * 1000;
-        *has_dst = true;
-    }
-}
-
-static uint32_t frames_to_usecs(uint32_t frames,
-                                AudiodevPerDirectionOptions *pdo)
-{
-    uint32_t freq = pdo->has_frequency ? pdo->frequency : 44100;
-    return (frames * 1000000 + freq / 2) / freq;
-}
-
-
-static void get_frames_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
-                                AudiodevPerDirectionOptions *pdo)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = frames_to_usecs(toui32(val), pdo);
-        *has_dst = true;
-    }
-}
-
-static uint32_t samples_to_usecs(uint32_t samples,
-                                 AudiodevPerDirectionOptions *pdo)
-{
-    uint32_t channels = pdo->has_channels ? pdo->channels : 2;
-    return frames_to_usecs(samples / channels, pdo);
-}
-
-static void get_samples_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
-                                 AudiodevPerDirectionOptions *pdo)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = samples_to_usecs(toui32(val), pdo);
-        *has_dst = true;
-    }
-}
-
-static uint32_t bytes_to_usecs(uint32_t bytes, AudiodevPerDirectionOptions *pdo)
-{
-    AudioFormat fmt = pdo->has_format ? pdo->format : AUDIO_FORMAT_S16;
-    uint32_t bytes_per_sample = audioformat_bytes_per_sample(fmt);
-    return samples_to_usecs(bytes / bytes_per_sample, pdo);
-}
-
-static void get_bytes_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
-                               AudiodevPerDirectionOptions *pdo)
-{
-    const char *val = getenv(env);
-    if (val) {
-        *dst = bytes_to_usecs(toui32(val), pdo);
-        *has_dst = true;
-    }
-}
-
-/* backend specific functions */
-/* ALSA */
-static void handle_alsa_per_direction(
-    AudiodevAlsaPerDirectionOptions *apdo, const char *prefix)
-{
-    char buf[64];
-    size_t len = strlen(prefix);
-    bool size_in_usecs = false;
-    bool dummy;
-
-    memcpy(buf, prefix, len);
-    strcpy(buf + len, "TRY_POLL");
-    get_bool(buf, &apdo->try_poll, &apdo->has_try_poll);
-
-    strcpy(buf + len, "DEV");
-    get_str(buf, &apdo->dev, &apdo->has_dev);
-
-    strcpy(buf + len, "SIZE_IN_USEC");
-    get_bool(buf, &size_in_usecs, &dummy);
-
-    strcpy(buf + len, "PERIOD_SIZE");
-    get_int(buf, &apdo->period_length, &apdo->has_period_length);
-    if (apdo->has_period_length && !size_in_usecs) {
-        apdo->period_length = frames_to_usecs(
-            apdo->period_length,
-            qapi_AudiodevAlsaPerDirectionOptions_base(apdo));
-    }
-
-    strcpy(buf + len, "BUFFER_SIZE");
-    get_int(buf, &apdo->buffer_length, &apdo->has_buffer_length);
-    if (apdo->has_buffer_length && !size_in_usecs) {
-        apdo->buffer_length = frames_to_usecs(
-            apdo->buffer_length,
-            qapi_AudiodevAlsaPerDirectionOptions_base(apdo));
-    }
-}
-
-static void handle_alsa(Audiodev *dev)
-{
-    AudiodevAlsaOptions *aopt = &dev->u.alsa;
-    handle_alsa_per_direction(aopt->in, "QEMU_ALSA_ADC_");
-    handle_alsa_per_direction(aopt->out, "QEMU_ALSA_DAC_");
-
-    get_millis_to_usecs("QEMU_ALSA_THRESHOLD",
-                        &aopt->threshold, &aopt->has_threshold);
-}
-
-/* coreaudio */
-static void handle_coreaudio(Audiodev *dev)
-{
-    get_frames_to_usecs(
-        "QEMU_COREAUDIO_BUFFER_SIZE",
-        &dev->u.coreaudio.out->buffer_length,
-        &dev->u.coreaudio.out->has_buffer_length,
-        qapi_AudiodevCoreaudioPerDirectionOptions_base(dev->u.coreaudio.out));
-    get_int("QEMU_COREAUDIO_BUFFER_COUNT",
-            &dev->u.coreaudio.out->buffer_count,
-            &dev->u.coreaudio.out->has_buffer_count);
-}
-
-/* dsound */
-static void handle_dsound(Audiodev *dev)
-{
-    get_millis_to_usecs("QEMU_DSOUND_LATENCY_MILLIS",
-                        &dev->u.dsound.latency, &dev->u.dsound.has_latency);
-    get_bytes_to_usecs("QEMU_DSOUND_BUFSIZE_OUT",
-                       &dev->u.dsound.out->buffer_length,
-                       &dev->u.dsound.out->has_buffer_length,
-                       dev->u.dsound.out);
-    get_bytes_to_usecs("QEMU_DSOUND_BUFSIZE_IN",
-                       &dev->u.dsound.in->buffer_length,
-                       &dev->u.dsound.in->has_buffer_length,
-                       dev->u.dsound.in);
-}
-
-/* OSS */
-static void handle_oss_per_direction(
-    AudiodevOssPerDirectionOptions *opdo, const char *try_poll_env,
-    const char *dev_env)
-{
-    get_bool(try_poll_env, &opdo->try_poll, &opdo->has_try_poll);
-    get_str(dev_env, &opdo->dev, &opdo->has_dev);
-
-    get_bytes_to_usecs("QEMU_OSS_FRAGSIZE",
-                       &opdo->buffer_length, &opdo->has_buffer_length,
-                       qapi_AudiodevOssPerDirectionOptions_base(opdo));
-    get_int("QEMU_OSS_NFRAGS", &opdo->buffer_count,
-            &opdo->has_buffer_count);
-}
-
-static void handle_oss(Audiodev *dev)
-{
-    AudiodevOssOptions *oopt = &dev->u.oss;
-    handle_oss_per_direction(oopt->in, "QEMU_AUDIO_ADC_TRY_POLL",
-                             "QEMU_OSS_ADC_DEV");
-    handle_oss_per_direction(oopt->out, "QEMU_AUDIO_DAC_TRY_POLL",
-                             "QEMU_OSS_DAC_DEV");
-
-    get_bool("QEMU_OSS_MMAP", &oopt->try_mmap, &oopt->has_try_mmap);
-    get_bool("QEMU_OSS_EXCLUSIVE", &oopt->exclusive, &oopt->has_exclusive);
-    get_int("QEMU_OSS_POLICY", &oopt->dsp_policy, &oopt->has_dsp_policy);
-}
-
-/* pulseaudio */
-static void handle_pa_per_direction(
-    AudiodevPaPerDirectionOptions *ppdo, const char *env)
-{
-    get_str(env, &ppdo->name, &ppdo->has_name);
-}
-
-static void handle_pa(Audiodev *dev)
-{
-    handle_pa_per_direction(dev->u.pa.in, "QEMU_PA_SOURCE");
-    handle_pa_per_direction(dev->u.pa.out, "QEMU_PA_SINK");
-
-    get_samples_to_usecs(
-        "QEMU_PA_SAMPLES", &dev->u.pa.in->buffer_length,
-        &dev->u.pa.in->has_buffer_length,
-        qapi_AudiodevPaPerDirectionOptions_base(dev->u.pa.in));
-    get_samples_to_usecs(
-        "QEMU_PA_SAMPLES", &dev->u.pa.out->buffer_length,
-        &dev->u.pa.out->has_buffer_length,
-        qapi_AudiodevPaPerDirectionOptions_base(dev->u.pa.out));
-
-    get_str("QEMU_PA_SERVER", &dev->u.pa.server, &dev->u.pa.has_server);
-}
-
-/* SDL */
-static void handle_sdl(Audiodev *dev)
-{
-    /* SDL is output only */
-    get_samples_to_usecs("QEMU_SDL_SAMPLES", &dev->u.sdl.out->buffer_length,
-                         &dev->u.sdl.out->has_buffer_length, dev->u.sdl.out);
-}
-
-/* wav */
-static void handle_wav(Audiodev *dev)
-{
-    get_int("QEMU_WAV_FREQUENCY",
-            &dev->u.wav.out->frequency, &dev->u.wav.out->has_frequency);
-    get_fmt("QEMU_WAV_FORMAT", &dev->u.wav.out->format,
-            &dev->u.wav.out->has_format);
-    get_int("QEMU_WAV_DAC_FIXED_CHANNELS",
-            &dev->u.wav.out->channels, &dev->u.wav.out->has_channels);
-    get_str("QEMU_WAV_PATH", &dev->u.wav.path, &dev->u.wav.has_path);
-}
-
-/* general */
-static void handle_per_direction(
-    AudiodevPerDirectionOptions *pdo, const char *prefix)
-{
-    char buf[64];
-    size_t len = strlen(prefix);
-
-    memcpy(buf, prefix, len);
-    strcpy(buf + len, "FIXED_SETTINGS");
-    get_bool(buf, &pdo->fixed_settings, &pdo->has_fixed_settings);
-
-    strcpy(buf + len, "FIXED_FREQ");
-    get_int(buf, &pdo->frequency, &pdo->has_frequency);
-
-    strcpy(buf + len, "FIXED_FMT");
-    get_fmt(buf, &pdo->format, &pdo->has_format);
-
-    strcpy(buf + len, "FIXED_CHANNELS");
-    get_int(buf, &pdo->channels, &pdo->has_channels);
-
-    strcpy(buf + len, "VOICES");
-    get_int(buf, &pdo->voices, &pdo->has_voices);
-}
-
-static AudiodevListEntry *legacy_opt(const char *drvname)
-{
-    AudiodevListEntry *e = g_malloc0(sizeof(AudiodevListEntry));
-    e->dev = g_malloc0(sizeof(Audiodev));
-    e->dev->id = g_strdup(drvname);
-    e->dev->driver = qapi_enum_parse(
-        &AudiodevDriver_lookup, drvname, -1, &error_abort);
-
-    audio_create_pdos(e->dev);
-
-    handle_per_direction(audio_get_pdo_in(e->dev), "QEMU_AUDIO_ADC_");
-    handle_per_direction(audio_get_pdo_out(e->dev), "QEMU_AUDIO_DAC_");
-
-    get_int("QEMU_AUDIO_TIMER_PERIOD",
-            &e->dev->timer_period, &e->dev->has_timer_period);
-
-    switch (e->dev->driver) {
-    case AUDIODEV_DRIVER_ALSA:
-        handle_alsa(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_COREAUDIO:
-        handle_coreaudio(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_DSOUND:
-        handle_dsound(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_OSS:
-        handle_oss(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_PA:
-        handle_pa(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_SDL:
-        handle_sdl(e->dev);
-        break;
-
-    case AUDIODEV_DRIVER_WAV:
-        handle_wav(e->dev);
-        break;
-
-    default:
-        break;
-    }
-
-    return e;
-}
-
-AudiodevListHead audio_handle_legacy_opts(void)
-{
-    const char *drvname = getenv("QEMU_AUDIO_DRV");
-    AudiodevListHead head = QSIMPLEQ_HEAD_INITIALIZER(head);
-
-    if (drvname) {
-        AudiodevListEntry *e;
-        audio_driver *driver = audio_driver_lookup(drvname);
-        if (!driver) {
-            dolog("Unknown audio driver `%s'\n", drvname);
-            exit(1);
-        }
-        e = legacy_opt(drvname);
-        QSIMPLEQ_INSERT_TAIL(&head, e, next);
-    } else {
-        for (int i = 0; audio_prio_list[i]; i++) {
-            audio_driver *driver = audio_driver_lookup(audio_prio_list[i]);
-            if (driver && driver->can_be_default) {
-                AudiodevListEntry *e = legacy_opt(driver->name);
-                QSIMPLEQ_INSERT_TAIL(&head, e, next);
-            }
-        }
-        if (QSIMPLEQ_EMPTY(&head)) {
-            dolog("Internal error: no default audio driver available\n");
-            exit(1);
-        }
-    }
-
-    return head;
-}
-
-/* visitor to print -audiodev option */
-typedef struct {
-    Visitor visitor;
-
-    bool comma;
-    GList *path;
-} LegacyPrintVisitor;
-
-static void lv_start_struct(Visitor *v, const char *name, void **obj,
-                            size_t size, Error **errp)
-{
-    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
-    lv->path = g_list_append(lv->path, g_strdup(name));
-}
-
-static void lv_end_struct(Visitor *v, void **obj)
-{
-    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
-    lv->path = g_list_delete_link(lv->path, g_list_last(lv->path));
-}
-
-static void lv_print_key(Visitor *v, const char *name)
-{
-    GList *e;
-    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
-    if (lv->comma) {
-        putchar(',');
-    } else {
-        lv->comma = true;
-    }
-
-    for (e = lv->path; e; e = e->next) {
-        if (e->data) {
-            printf("%s.", (const char *) e->data);
-        }
-    }
-
-    printf("%s=", name);
-}
-
-static void lv_type_int64(Visitor *v, const char *name, int64_t *obj,
-                          Error **errp)
-{
-    lv_print_key(v, name);
-    printf("%" PRIi64, *obj);
-}
-
-static void lv_type_uint64(Visitor *v, const char *name, uint64_t *obj,
-                           Error **errp)
-{
-    lv_print_key(v, name);
-    printf("%" PRIu64, *obj);
-}
-
-static void lv_type_bool(Visitor *v, const char *name, bool *obj, Error **errp)
-{
-    lv_print_key(v, name);
-    printf("%s", *obj ? "on" : "off");
-}
-
-static void lv_type_str(Visitor *v, const char *name, char **obj, Error **errp)
-{
-    const char *str = *obj;
-    lv_print_key(v, name);
-
-    while (*str) {
-        if (*str == ',') {
-            putchar(',');
-        }
-        putchar(*str++);
-    }
-}
-
-static void lv_complete(Visitor *v, void *opaque)
-{
-    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
-    assert(lv->path == NULL);
-}
-
-static void lv_free(Visitor *v)
-{
-    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
-
-    g_list_free_full(lv->path, g_free);
-    g_free(lv);
-}
-
-static Visitor *legacy_visitor_new(void)
-{
-    LegacyPrintVisitor *lv = g_malloc0(sizeof(LegacyPrintVisitor));
-
-    lv->visitor.start_struct = lv_start_struct;
-    lv->visitor.end_struct = lv_end_struct;
-    /* lists not supported */
-    lv->visitor.type_int64 = lv_type_int64;
-    lv->visitor.type_uint64 = lv_type_uint64;
-    lv->visitor.type_bool = lv_type_bool;
-    lv->visitor.type_str = lv_type_str;
-
-    lv->visitor.type = VISITOR_OUTPUT;
-    lv->visitor.complete = lv_complete;
-    lv->visitor.free = lv_free;
-
-    return &lv->visitor;
-}
-
-void audio_legacy_help(void)
-{
-    AudiodevListHead head;
-    AudiodevListEntry *e;
-
-    printf("Environment variable based configuration deprecated.\n");
-    printf("Please use the new -audiodev option.\n");
-
-    head = audio_handle_legacy_opts();
-    printf("\nEquivalent -audiodev to your current environment variables:\n");
-    if (!getenv("QEMU_AUDIO_DRV")) {
-        printf("(Since you didn't specify QEMU_AUDIO_DRV, I'll list all "
-               "possibilities)\n");
-    }
-
-    QSIMPLEQ_FOREACH(e, &head, next) {
-        Visitor *v;
-        Audiodev *dev = e->dev;
-        printf("-audiodev ");
-
-        v = legacy_visitor_new();
-        visit_type_Audiodev(v, NULL, &dev, &error_abort);
-        visit_free(v);
-
-        printf("\n");
-    }
-    audio_free_audiodev_list(&head);
-}
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -299,42 +299,11 @@ static HW *glue (audio_pcm_hw_add_new_, TYPE) (struct audsettings *as)
    return NULL;
 }

-AudiodevPerDirectionOptions *glue(audio_get_pdo_, TYPE)(Audiodev *dev)
-{
-    switch (dev->driver) {
-    case AUDIODEV_DRIVER_NONE:
-        return dev->u.none.TYPE;
-    case AUDIODEV_DRIVER_ALSA:
-        return qapi_AudiodevAlsaPerDirectionOptions_base(dev->u.alsa.TYPE);
-    case AUDIODEV_DRIVER_COREAUDIO:
-        return qapi_AudiodevCoreaudioPerDirectionOptions_base(
-            dev->u.coreaudio.TYPE);
-    case AUDIODEV_DRIVER_DSOUND:
-        return dev->u.dsound.TYPE;
-    case AUDIODEV_DRIVER_OSS:
-        return qapi_AudiodevOssPerDirectionOptions_base(dev->u.oss.TYPE);
-    case AUDIODEV_DRIVER_PA:
-        return qapi_AudiodevPaPerDirectionOptions_base(dev->u.pa.TYPE);
-    case AUDIODEV_DRIVER_SDL:
-        return dev->u.sdl.TYPE;
-    case AUDIODEV_DRIVER_SPICE:
-        return dev->u.spice.TYPE;
-    case AUDIODEV_DRIVER_WAV:
-        return dev->u.wav.TYPE;
-
-    case AUDIODEV_DRIVER__MAX:
-        break;
-    }
-    abort();
-}
-
 static HW *glue (audio_pcm_hw_add_, TYPE) (struct audsettings *as)
 {
    HW *hw;
-    AudioState *s = &glob_audio_state;
-    AudiodevPerDirectionOptions *pdo = glue(audio_get_pdo_, TYPE)(s->dev);

-    if (pdo->fixed_settings) {
+    if (glue (conf.fixed_, TYPE).enabled && glue (conf.fixed_, TYPE).greedy) {
        hw = glue (audio_pcm_hw_add_new_, TYPE) (as);
        if (hw) {
            return hw;
@@ -362,11 +331,9 @@ static SW *glue (audio_pcm_create_voice_pair_, TYPE) (
    SW *sw;
    HW *hw;
    struct audsettings hw_as;
-    AudioState *s = &glob_audio_state;
-    AudiodevPerDirectionOptions *pdo = glue(audio_get_pdo_, TYPE)(s->dev);

-    if (pdo->fixed_settings) {
-        hw_as = audiodev_to_audsettings(pdo);
+    if (glue (conf.fixed_, TYPE).enabled) {
+        hw_as = glue (conf.fixed_, TYPE).settings;
    }
    else {
        hw_as = *as;
@@ -431,7 +398,6 @@ SW *glue (AUD_open_, TYPE) (
    )
 {
    AudioState *s = &glob_audio_state;
-    AudiodevPerDirectionOptions *pdo = glue(audio_get_pdo_, TYPE)(s->dev);

    if (audio_bug(__func__, !card || !name || !callback_fn || !as)) {
        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
@@ -456,7 +422,7 @@ SW *glue (AUD_open_, TYPE) (
        return sw;
    }

-    if (!pdo->fixed_settings && sw) {
+    if (!glue (conf.fixed_, TYPE).enabled && sw) {
        glue (AUD_close_, TYPE) (card, sw);
        sw = NULL;
    }
--- a/audio/audio_win_int.c
+++ b/audio/audio_win_int.c
@@ -24,20 +24,20 @@ int waveformat_from_audio_settings (WAVEFORMATEX *wfx,
    wfx->cbSize = 0;

    switch (as->fmt) {
-    case AUDIO_FORMAT_S8:
-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_S8:
+    case AUD_FMT_U8:
        wfx->wBitsPerSample = 8;
        break;

-    case AUDIO_FORMAT_S16:
-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_S16:
+    case AUD_FMT_U16:
        wfx->wBitsPerSample = 16;
        wfx->nAvgBytesPerSec <<= 1;
        wfx->nBlockAlign <<= 1;
        break;

-    case AUDIO_FORMAT_S32:
-    case AUDIO_FORMAT_U32:
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
        wfx->wBitsPerSample = 32;
        wfx->nAvgBytesPerSec <<= 2;
        wfx->nBlockAlign <<= 2;
@@ -85,15 +85,15 @@ int waveformat_to_audio_settings (WAVEFORMATEX *wfx,

    switch (wfx->wBitsPerSample) {
    case 8:
-        as->fmt = AUDIO_FORMAT_U8;
+        as->fmt = AUD_FMT_U8;
        break;

    case 16:
-        as->fmt = AUDIO_FORMAT_S16;
+        as->fmt = AUD_FMT_S16;
        break;

    case 32:
-        as->fmt = AUDIO_FORMAT_S32;
+        as->fmt = AUD_FMT_S32;
        break;

    default:
--- a/audio/coreaudio.c
+++ b/audio/coreaudio.c
@@ -36,6 +36,11 @@
 #define MAC_OS_X_VERSION_10_6 1060
 #endif

+typedef struct {
+    int buffer_frames;
+    int nbuffers;
+} CoreaudioConf;
+
 typedef struct coreaudioVoiceOut {
    HWVoiceOut hw;
    pthread_mutex_t mutex;
@@ -502,9 +507,7 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
    int err;
    const char *typ = "playback";
    AudioValueRange frameRange;
-    Audiodev *dev = drv_opaque;
-    AudiodevCoreaudioPerDirectionOptions *cpdo = dev->u.coreaudio.out;
-    int frames;
+    CoreaudioConf *conf = drv_opaque;

    /* create mutex */
    err = pthread_mutex_init(&core->mutex, NULL);
@@ -535,17 +538,16 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
        return -1;
    }

-    frames = audio_buffer_frames(
-        qapi_AudiodevCoreaudioPerDirectionOptions_base(cpdo), as, 11610);
-    if (frameRange.mMinimum > frames) {
+    if (frameRange.mMinimum > conf->buffer_frames) {
        core->audioDevicePropertyBufferFrameSize = (UInt32) frameRange.mMinimum;
        dolog ("warning: Upsizing Buffer Frames to %f\n", frameRange.mMinimum);
-    } else if (frameRange.mMaximum < frames) {
+    }
+    else if (frameRange.mMaximum < conf->buffer_frames) {
        core->audioDevicePropertyBufferFrameSize = (UInt32) frameRange.mMaximum;
        dolog ("warning: Downsizing Buffer Frames to %f\n", frameRange.mMaximum);
    }
    else {
-        core->audioDevicePropertyBufferFrameSize = frames;
+        core->audioDevicePropertyBufferFrameSize = conf->buffer_frames;
    }

    /* set Buffer Frame Size */
@@ -566,8 +568,7 @@ static int coreaudio_init_out(HWVoiceOut *hw, struct audsettings *as,
                           "Could not get device buffer frame size\n");
        return -1;
    }
-    hw->samples = (cpdo->has_buffer_count ? cpdo->buffer_count : 4) *
-        core->audioDevicePropertyBufferFrameSize;
+    hw->samples = conf->nbuffers * core->audioDevicePropertyBufferFrameSize;

    /* get StreamFormat */
    status = coreaudio_get_streamformat(core->outputDeviceID,
@@ -679,15 +680,40 @@ static int coreaudio_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }

-static void *coreaudio_audio_init(Audiodev *dev)
+static CoreaudioConf glob_conf = {
+    .buffer_frames = 512,
+    .nbuffers = 4,
+};
+
+static void *coreaudio_audio_init (void)
 {
-    return dev;
+    CoreaudioConf *conf = g_malloc(sizeof(CoreaudioConf));
+    *conf = glob_conf;
+
+    return conf;
 }

 static void coreaudio_audio_fini (void *opaque)
 {
+    g_free(opaque);
 }

+static struct audio_option coreaudio_options[] = {
+    {
+        .name  = "BUFFER_SIZE",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.buffer_frames,
+        .descr = "Size of the buffer in frames"
+    },
+    {
+        .name  = "BUFFER_COUNT",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.nbuffers,
+        .descr = "Number of buffers"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops coreaudio_pcm_ops = {
    .init_out = coreaudio_init_out,
    .fini_out = coreaudio_fini_out,
@@ -699,6 +725,7 @@ static struct audio_pcm_ops coreaudio_pcm_ops = {
 static struct audio_driver coreaudio_audio_driver = {
    .name           = "coreaudio",
    .descr          = "CoreAudio http://developer.apple.com/audio/coreaudio.html",
+    .options        = coreaudio_options,
    .init           = coreaudio_audio_init,
    .fini           = coreaudio_audio_fini,
    .pcm_ops        = &coreaudio_pcm_ops,
--- a/audio/dsound_template.h
+++ b/audio/dsound_template.h
@@ -167,18 +167,17 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
    dsound *s = drv_opaque;
    WAVEFORMATEX wfx;
    struct audsettings obt_as;
+    DSoundConf *conf = &s->conf;
 #ifdef DSBTYPE_IN
    const char *typ = "ADC";
    DSoundVoiceIn *ds = (DSoundVoiceIn *) hw;
    DSCBUFFERDESC bd;
    DSCBCAPS bc;
-    AudiodevPerDirectionOptions *pdo = s->dev->u.dsound.in;
 #else
    const char *typ = "DAC";
    DSoundVoiceOut *ds = (DSoundVoiceOut *) hw;
    DSBUFFERDESC bd;
    DSBCAPS bc;
-    AudiodevPerDirectionOptions *pdo = s->dev->u.dsound.out;
 #endif

    if (!s->FIELD2) {
@@ -194,8 +193,8 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
    memset (&bd, 0, sizeof (bd));
    bd.dwSize = sizeof (bd);
    bd.lpwfxFormat = &wfx;
-    bd.dwBufferBytes = audio_buffer_bytes(pdo, as, 92880);
 #ifdef DSBTYPE_IN
+    bd.dwBufferBytes = conf->bufsize_in;
    hr = IDirectSoundCapture_CreateCaptureBuffer (
        s->dsound_capture,
        &bd,
@@ -204,6 +203,7 @@ static int dsound_init_out(HWVoiceOut *hw, struct audsettings *as,
        );
 #else
    bd.dwFlags = DSBCAPS_STICKYFOCUS | DSBCAPS_GETCURRENTPOSITION2;
+    bd.dwBufferBytes = conf->bufsize_out;
    hr = IDirectSound_CreateSoundBuffer (
        s->dsound,
        &bd,
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -32,7 +32,6 @@

 #define AUDIO_CAP "dsound"
 #include "audio_int.h"
-#include "qemu/host-utils.h"

 #include <windows.h>
 #include <mmsystem.h>
@@ -43,11 +42,17 @@

 /* #define DEBUG_DSOUND */

+typedef struct {
+    int bufsize_in;
+    int bufsize_out;
+    int latency_millis;
+} DSoundConf;
+
 typedef struct {
    LPDIRECTSOUND dsound;
    LPDIRECTSOUNDCAPTURE dsound_capture;
    struct audsettings settings;
-    Audiodev *dev;
+    DSoundConf conf;
 } dsound;

 typedef struct {
@@ -243,9 +248,9 @@ static void GCC_FMT_ATTR (3, 4) dsound_logerr2 (
    dsound_log_hresult (hr);
 }

-static uint64_t usecs_to_bytes(struct audio_pcm_info *info, uint32_t usecs)
+static DWORD millis_to_bytes (struct audio_pcm_info *info, DWORD millis)
 {
-    return muldiv64(usecs, info->bytes_per_second, 1000000);
+    return (millis * info->bytes_per_second) / 1000;
 }

 #ifdef DEBUG_DSOUND
@@ -473,7 +478,7 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
    LPVOID p1, p2;
    int bufsize;
    dsound *s = ds->s;
-    AudiodevDsoundOptions *dso = &s->dev->u.dsound;
+    DSoundConf *conf = &s->conf;

    if (!dsb) {
        dolog ("Attempt to run empty with playback buffer\n");
@@ -496,14 +501,14 @@ static int dsound_run_out (HWVoiceOut *hw, int live)
    len = live << hwshift;

    if (ds->first_time) {
-        if (dso->latency) {
+        if (conf->latency_millis) {
            DWORD cur_blat;

            cur_blat = audio_ring_dist (wpos, ppos, bufsize);
            ds->first_time = 0;
            old_pos = wpos;
            old_pos +=
-                usecs_to_bytes(&hw->info, dso->latency) - cur_blat;
+                millis_to_bytes (&hw->info, conf->latency_millis) - cur_blat;
            old_pos %= bufsize;
            old_pos &= ~hw->info.align;
        }
@@ -742,6 +747,12 @@ static int dsound_run_in (HWVoiceIn *hw)
    return decr;
 }

+static DSoundConf glob_conf = {
+    .bufsize_in         = 16384,
+    .bufsize_out        = 16384,
+    .latency_millis     = 10
+};
+
 static void dsound_audio_fini (void *opaque)
 {
    HRESULT hr;
@@ -772,22 +783,13 @@ static void dsound_audio_fini (void *opaque)
    g_free(s);
 }

-static void *dsound_audio_init(Audiodev *dev)
+static void *dsound_audio_init (void)
 {
    int err;
    HRESULT hr;
    dsound *s = g_malloc0(sizeof(dsound));
-    AudiodevDsoundOptions *dso;
-
-    assert(dev->driver == AUDIODEV_DRIVER_DSOUND);
-    s->dev = dev;
-    dso = &dev->u.dsound;
-
-    if (!dso->has_latency) {
-        dso->has_latency = true;
-        dso->latency = 10000; /* 10 ms */
-    }

+    s->conf = glob_conf;
    hr = CoInitialize (NULL);
    if (FAILED (hr)) {
        dsound_logerr (hr, "Could not initialize COM\n");
@@ -852,6 +854,28 @@ static void *dsound_audio_init(Audiodev *dev)
    return s;
 }

+static struct audio_option dsound_options[] = {
+    {
+        .name  = "LATENCY_MILLIS",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.latency_millis,
+        .descr = "(undocumented)"
+    },
+    {
+        .name  = "BUFSIZE_OUT",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.bufsize_out,
+        .descr = "(undocumented)"
+    },
+    {
+        .name  = "BUFSIZE_IN",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.bufsize_in,
+        .descr = "(undocumented)"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops dsound_pcm_ops = {
    .init_out = dsound_init_out,
    .fini_out = dsound_fini_out,
@@ -869,6 +893,7 @@ static struct audio_pcm_ops dsound_pcm_ops = {
 static struct audio_driver dsound_audio_driver = {
    .name           = "dsound",
    .descr          = "DirectSound http://wikipedia.org/wiki/DirectSound",
+    .options        = dsound_options,
    .init           = dsound_audio_init,
    .fini           = dsound_audio_fini,
    .pcm_ops        = &dsound_pcm_ops,
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -136,7 +136,7 @@ static int no_ctl_in (HWVoiceIn *hw, int cmd, ...)
    return 0;
 }

-static void *no_audio_init(Audiodev *dev)
+static void *no_audio_init (void)
 {
    return &no_audio_init;
 }
@@ -163,6 +163,7 @@ static struct audio_pcm_ops no_pcm_ops = {
 static struct audio_driver no_audio_driver = {
    .name           = "none",
    .descr          = "Timer based audio emulation",
+    .options        = NULL,
    .init           = no_audio_init,
    .fini           = no_audio_fini,
    .pcm_ops        = &no_pcm_ops,
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -37,6 +37,16 @@
 #define USE_DSP_POLICY
 #endif

+typedef struct OSSConf {
+    int try_mmap;
+    int nfrags;
+    int fragsize;
+    const char *devpath_out;
+    const char *devpath_in;
+    int exclusive;
+    int policy;
+} OSSConf;
+
 typedef struct OSSVoiceOut {
    HWVoiceOut hw;
    void *pcm_buf;
@@ -46,7 +56,7 @@ typedef struct OSSVoiceOut {
    int fragsize;
    int mmapped;
    int pending;
-    Audiodev *dev;
+    OSSConf *conf;
 } OSSVoiceOut;

 typedef struct OSSVoiceIn {
@@ -55,12 +65,12 @@ typedef struct OSSVoiceIn {
    int fd;
    int nfrags;
    int fragsize;
-    Audiodev *dev;
+    OSSConf *conf;
 } OSSVoiceIn;

 struct oss_params {
    int freq;
-    int fmt;
+    audfmt_e fmt;
    int nchannels;
    int nfrags;
    int fragsize;
@@ -138,16 +148,16 @@ static int oss_write (SWVoiceOut *sw, void *buf, int len)
    return audio_pcm_sw_write (sw, buf, len);
 }

-static int aud_to_ossfmt (AudioFormat fmt, int endianness)
+static int aud_to_ossfmt (audfmt_e fmt, int endianness)
 {
    switch (fmt) {
-    case AUDIO_FORMAT_S8:
+    case AUD_FMT_S8:
        return AFMT_S8;

-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_U8:
        return AFMT_U8;

-    case AUDIO_FORMAT_S16:
+    case AUD_FMT_S16:
        if (endianness) {
            return AFMT_S16_BE;
        }
@@ -155,7 +165,7 @@ static int aud_to_ossfmt (AudioFormat fmt, int endianness)
            return AFMT_S16_LE;
        }

-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_U16:
        if (endianness) {
            return AFMT_U16_BE;
        }
@@ -172,37 +182,37 @@ static int aud_to_ossfmt (AudioFormat fmt, int endianness)
    }
 }

-static int oss_to_audfmt (int ossfmt, AudioFormat *fmt, int *endianness)
+static int oss_to_audfmt (int ossfmt, audfmt_e *fmt, int *endianness)
 {
    switch (ossfmt) {
    case AFMT_S8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S8;
+        *fmt = AUD_FMT_S8;
        break;

    case AFMT_U8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U8;
+        *fmt = AUD_FMT_U8;
        break;

    case AFMT_S16_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case AFMT_U16_LE:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    case AFMT_S16_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case AFMT_U16_BE:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    default:
@@ -252,25 +262,19 @@ static int oss_get_version (int fd, int *version, const char *typ)
 }
 #endif

-static int oss_open(int in, struct oss_params *req, audsettings *as,
-                    struct oss_params *obt, int *pfd, Audiodev *dev)
+static int oss_open (int in, struct oss_params *req,
+                     struct oss_params *obt, int *pfd, OSSConf* conf)
 {
-    AudiodevOssOptions *oopts = &dev->u.oss;
-    AudiodevOssPerDirectionOptions *opdo = in ? oopts->in : oopts->out;
    int fd;
-    int oflags = (oopts->has_exclusive && oopts->exclusive) ? O_EXCL : 0;
+    int oflags = conf->exclusive ? O_EXCL : 0;
    audio_buf_info abinfo;
    int fmt, freq, nchannels;
    int setfragment = 1;
-    const char *dspname = opdo->has_dev ? opdo->dev : "/dev/dsp";
+    const char *dspname = in ? conf->devpath_in : conf->devpath_out;
    const char *typ = in ? "ADC" : "DAC";
-#ifdef USE_DSP_POLICY
-    int policy = oopts->has_dsp_policy ? oopts->dsp_policy : 5;
-#endif

    /* Kludge needed to have working mmap on Linux */
-    oflags |= (oopts->has_try_mmap && oopts->try_mmap) ?
-        O_RDWR : (in ? O_RDONLY : O_WRONLY);
+    oflags |= conf->try_mmap ? O_RDWR : (in ? O_RDONLY : O_WRONLY);

    fd = open (dspname, oflags | O_NONBLOCK);
    if (-1 == fd) {
@@ -281,9 +285,6 @@ static int oss_open(int in, struct oss_params *req, audsettings *as,
    freq = req->freq;
    nchannels = req->nchannels;
    fmt = req->fmt;
-    req->nfrags = opdo->has_buffer_count ? opdo->buffer_count : 4;
-    req->fragsize = audio_buffer_bytes(
-        qapi_AudiodevOssPerDirectionOptions_base(opdo), as, 23220);

    if (ioctl (fd, SNDCTL_DSP_SAMPLESIZE, &fmt)) {
        oss_logerr2 (errno, typ, "Failed to set sample size %d\n", req->fmt);
@@ -307,18 +308,18 @@ static int oss_open(int in, struct oss_params *req, audsettings *as,
    }

 #ifdef USE_DSP_POLICY
-    if (policy >= 0) {
+    if (conf->policy >= 0) {
        int version;

        if (!oss_get_version (fd, &version, typ)) {
            trace_oss_version(version);

            if (version >= 0x040000) {
-                int policy2 = policy;
-                if (ioctl(fd, SNDCTL_DSP_POLICY, &policy2)) {
+                int policy = conf->policy;
+                if (ioctl (fd, SNDCTL_DSP_POLICY, &policy)) {
                    oss_logerr2 (errno, typ,
                                 "Failed to set timing policy to %d\n",
-                                 policy);
+                                 conf->policy);
                    goto err;
                }
                setfragment = 0;
@@ -499,18 +500,19 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    int endianness;
    int err;
    int fd;
-    AudioFormat effective_fmt;
+    audfmt_e effective_fmt;
    struct audsettings obt_as;
-    Audiodev *dev = drv_opaque;
-    AudiodevOssOptions *oopts = &dev->u.oss;
+    OSSConf *conf = drv_opaque;

    oss->fd = -1;

    req.fmt = aud_to_ossfmt (as->fmt, as->endianness);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
+    req.fragsize = conf->fragsize;
+    req.nfrags = conf->nfrags;

-    if (oss_open(0, &req, as, &obt, &fd, dev)) {
+    if (oss_open (0, &req, &obt, &fd, conf)) {
        return -1;
    }

@@ -537,7 +539,7 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    hw->samples = (obt.nfrags * obt.fragsize) >> hw->info.shift;

    oss->mmapped = 0;
-    if (oopts->has_try_mmap && oopts->try_mmap) {
+    if (conf->try_mmap) {
        oss->pcm_buf = mmap (
            NULL,
            hw->samples << hw->info.shift,
@@ -595,7 +597,7 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
    }

    oss->fd = fd;
-    oss->dev = dev;
+    oss->conf = conf;
    return 0;
 }

@@ -603,12 +605,16 @@ static int oss_ctl_out (HWVoiceOut *hw, int cmd, ...)
 {
    int trig;
    OSSVoiceOut *oss = (OSSVoiceOut *) hw;
-    AudiodevOssPerDirectionOptions *opdo = oss->dev->u.oss.out;

    switch (cmd) {
    case VOICE_ENABLE:
        {
-            bool poll_mode = opdo->try_poll;
+            va_list ap;
+            int poll_mode;
+
+            va_start (ap, cmd);
+            poll_mode = va_arg (ap, int);
+            va_end (ap);

            ldebug ("enabling voice\n");
            if (poll_mode) {
@@ -661,16 +667,18 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    int endianness;
    int err;
    int fd;
-    AudioFormat effective_fmt;
+    audfmt_e effective_fmt;
    struct audsettings obt_as;
-    Audiodev *dev = drv_opaque;
+    OSSConf *conf = drv_opaque;

    oss->fd = -1;

    req.fmt = aud_to_ossfmt (as->fmt, as->endianness);
    req.freq = as->freq;
    req.nchannels = as->nchannels;
-    if (oss_open(1, &req, as, &obt, &fd, dev)) {
+    req.fragsize = conf->fragsize;
+    req.nfrags = conf->nfrags;
+    if (oss_open (1, &req, &obt, &fd, conf)) {
        return -1;
    }

@@ -704,7 +712,7 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }

    oss->fd = fd;
-    oss->dev = dev;
+    oss->conf = conf;
    return 0;
 }

@@ -795,12 +803,16 @@ static int oss_read (SWVoiceIn *sw, void *buf, int size)
 static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
 {
    OSSVoiceIn *oss = (OSSVoiceIn *) hw;
-    AudiodevOssPerDirectionOptions *opdo = oss->dev->u.oss.out;

    switch (cmd) {
    case VOICE_ENABLE:
        {
-            bool poll_mode = opdo->try_poll;
+            va_list ap;
+            int poll_mode;
+
+            va_start (ap, cmd);
+            poll_mode = va_arg (ap, int);
+            va_end (ap);

            if (poll_mode) {
                oss_poll_in (hw);
@@ -820,36 +832,82 @@ static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
    return 0;
 }

-static void oss_init_per_direction(AudiodevOssPerDirectionOptions *opdo)
+static OSSConf glob_conf = {
+    .try_mmap = 0,
+    .nfrags = 4,
+    .fragsize = 4096,
+    .devpath_out = "/dev/dsp",
+    .devpath_in = "/dev/dsp",
+    .exclusive = 0,
+    .policy = 5
+};
+
+static void *oss_audio_init (void)
 {
-    if (!opdo->has_try_poll) {
-        opdo->try_poll = true;
-        opdo->has_try_poll = true;
-    }
-}
+    OSSConf *conf = g_malloc(sizeof(OSSConf));
+    *conf = glob_conf;

-static void *oss_audio_init(Audiodev *dev)
-{
-    AudiodevOssOptions *oopts;
-    assert(dev->driver == AUDIODEV_DRIVER_OSS);
-
-    oopts = &dev->u.oss;
-    oss_init_per_direction(oopts->in);
-    oss_init_per_direction(oopts->out);
-
-    if (access(oopts->in->has_dev ? oopts->in->dev : "/dev/dsp",
-               R_OK | W_OK) < 0 ||
-        access(oopts->out->has_dev ? oopts->out->dev : "/dev/dsp",
-               R_OK | W_OK) < 0) {
+    if (access(conf->devpath_in, R_OK | W_OK) < 0 ||
+        access(conf->devpath_out, R_OK | W_OK) < 0) {
+        g_free(conf);
        return NULL;
    }
-    return dev;
+    return conf;
 }

 static void oss_audio_fini (void *opaque)
 {
+    g_free(opaque);
 }

+static struct audio_option oss_options[] = {
+    {
+        .name  = "FRAGSIZE",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.fragsize,
+        .descr = "Fragment size in bytes"
+    },
+    {
+        .name  = "NFRAGS",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.nfrags,
+        .descr = "Number of fragments"
+    },
+    {
+        .name  = "MMAP",
+        .tag   = AUD_OPT_BOOL,
+        .valp  = &glob_conf.try_mmap,
+        .descr = "Try using memory mapped access"
+    },
+    {
+        .name  = "DAC_DEV",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.devpath_out,
+        .descr = "Path to DAC device"
+    },
+    {
+        .name  = "ADC_DEV",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.devpath_in,
+        .descr = "Path to ADC device"
+    },
+    {
+        .name  = "EXCLUSIVE",
+        .tag   = AUD_OPT_BOOL,
+        .valp  = &glob_conf.exclusive,
+        .descr = "Open device in exclusive mode (vmix won't work)"
+    },
+#ifdef USE_DSP_POLICY
+    {
+        .name  = "POLICY",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.policy,
+        .descr = "Set the timing policy of the device, -1 to use fragment mode",
+    },
+#endif
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops oss_pcm_ops = {
    .init_out = oss_init_out,
    .fini_out = oss_fini_out,
@@ -867,6 +925,7 @@ static struct audio_pcm_ops oss_pcm_ops = {
 static struct audio_driver oss_audio_driver = {
    .name           = "oss",
    .descr          = "OSS http://www.opensound.com",
+    .options        = oss_options,
    .init           = oss_audio_init,
    .fini           = oss_audio_fini,
    .pcm_ops        = &oss_pcm_ops,
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -2,7 +2,6 @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "audio.h"
-#include "qapi/opts-visitor.h"

 #include <pulse/pulseaudio.h>

@@ -11,7 +10,14 @@
 #include "audio_pt_int.h"

 typedef struct {
-    Audiodev *dev;
+    int samples;
+    char *server;
+    char *sink;
+    char *source;
+} PAConf;
+
+typedef struct {
+    PAConf conf;
    pa_threaded_mainloop *mainloop;
    pa_context *context;
 } paaudio;
@@ -26,7 +32,6 @@ typedef struct {
    void *pcm_buf;
    struct audio_pt pt;
    paaudio *g;
-    int samples;
 } PAVoiceOut;

 typedef struct {
@@ -41,7 +46,6 @@ typedef struct {
    const void *read_data;
    size_t read_index, read_length;
    paaudio *g;
-    int samples;
 } PAVoiceIn;

 static void qpa_audio_fini(void *opaque);
@@ -223,7 +227,7 @@ static void *qpa_thread_out (void *arg)
            }
        }

-        decr = to_mix = audio_MIN(pa->live, pa->samples >> 5);
+        decr = to_mix = audio_MIN(pa->live, pa->g->conf.samples >> 5);
        rpos = pa->rpos;

        if (audio_pt_unlock(&pa->pt, __func__)) {
@@ -315,7 +319,7 @@ static void *qpa_thread_in (void *arg)
            }
        }

-        incr = to_grab = audio_MIN(pa->dead, pa->samples >> 5);
+        incr = to_grab = audio_MIN(pa->dead, pa->g->conf.samples >> 5);
        wpos = pa->wpos;

        if (audio_pt_unlock(&pa->pt, __func__)) {
@@ -381,21 +385,21 @@ static int qpa_read (SWVoiceIn *sw, void *buf, int len)
    return audio_pcm_sw_read (sw, buf, len);
 }

-static pa_sample_format_t audfmt_to_pa (AudioFormat afmt, int endianness)
+static pa_sample_format_t audfmt_to_pa (audfmt_e afmt, int endianness)
 {
    int format;

    switch (afmt) {
-    case AUDIO_FORMAT_S8:
-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_S8:
+    case AUD_FMT_U8:
        format = PA_SAMPLE_U8;
        break;
-    case AUDIO_FORMAT_S16:
-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_S16:
+    case AUD_FMT_U16:
        format = endianness ? PA_SAMPLE_S16BE : PA_SAMPLE_S16LE;
        break;
-    case AUDIO_FORMAT_S32:
-    case AUDIO_FORMAT_U32:
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
        format = endianness ? PA_SAMPLE_S32BE : PA_SAMPLE_S32LE;
        break;
    default:
@@ -406,26 +410,26 @@ static pa_sample_format_t audfmt_to_pa (AudioFormat afmt, int endianness)
    return format;
 }

-static AudioFormat pa_to_audfmt (pa_sample_format_t fmt, int *endianness)
+static audfmt_e pa_to_audfmt (pa_sample_format_t fmt, int *endianness)
 {
    switch (fmt) {
    case PA_SAMPLE_U8:
-        return AUDIO_FORMAT_U8;
+        return AUD_FMT_U8;
    case PA_SAMPLE_S16BE:
        *endianness = 1;
-        return AUDIO_FORMAT_S16;
+        return AUD_FMT_S16;
    case PA_SAMPLE_S16LE:
        *endianness = 0;
-        return AUDIO_FORMAT_S16;
+        return AUD_FMT_S16;
    case PA_SAMPLE_S32BE:
        *endianness = 1;
-        return AUDIO_FORMAT_S32;
+        return AUD_FMT_S32;
    case PA_SAMPLE_S32LE:
        *endianness = 0;
-        return AUDIO_FORMAT_S32;
+        return AUD_FMT_S32;
    default:
        dolog ("Internal logic error: Bad pa_sample_format %d\n", fmt);
-        return AUDIO_FORMAT_U8;
+        return AUD_FMT_U8;
    }
 }

@@ -542,15 +546,17 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
    struct audsettings obt_as = *as;
    PAVoiceOut *pa = (PAVoiceOut *) hw;
    paaudio *g = pa->g = drv_opaque;
-    AudiodevPaOptions *popts = &g->dev->u.pa;
-    AudiodevPaPerDirectionOptions *ppdo = popts->out;

    ss.format = audfmt_to_pa (as->fmt, as->endianness);
    ss.channels = as->nchannels;
    ss.rate = as->freq;

-    ba.tlength = pa_usec_to_bytes(ppdo->latency, &ss);
-    ba.minreq = -1;
+    /*
+     * qemu audio tick runs at 100 Hz (by default), so processing
+     * data chunks worth 10 ms of sound should be a good fit.
+     */
+    ba.tlength = pa_usec_to_bytes (10 * 1000, &ss);
+    ba.minreq = pa_usec_to_bytes (5 * 1000, &ss);
    ba.maxlength = -1;
    ba.prebuf = -1;

@@ -560,7 +566,7 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
        g,
        "qemu",
        PA_STREAM_PLAYBACK,
-        ppdo->has_name ? ppdo->name : NULL,
+        g->conf.sink,
        &ss,
        NULL,                   /* channel map */
        &ba,                    /* buffering attributes */
@@ -572,9 +578,7 @@ static int qpa_init_out(HWVoiceOut *hw, struct audsettings *as,
    }

    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = pa->samples = audio_buffer_samples(
-        qapi_AudiodevPaPerDirectionOptions_base(ppdo),
-        &obt_as, ppdo->buffer_length);
+    hw->samples = g->conf.samples;
    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
    pa->rpos = hw->rpos;
    if (!pa->pcm_buf) {
@@ -605,32 +609,24 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 {
    int error;
    pa_sample_spec ss;
-    pa_buffer_attr ba;
    struct audsettings obt_as = *as;
    PAVoiceIn *pa = (PAVoiceIn *) hw;
    paaudio *g = pa->g = drv_opaque;
-    AudiodevPaOptions *popts = &g->dev->u.pa;
-    AudiodevPaPerDirectionOptions *ppdo = popts->in;

    ss.format = audfmt_to_pa (as->fmt, as->endianness);
    ss.channels = as->nchannels;
    ss.rate = as->freq;

-    ba.fragsize = pa_usec_to_bytes(ppdo->latency, &ss);
-    ba.maxlength = -1;
-    ba.minreq = -1;
-    ba.prebuf = -1;
-
    obt_as.fmt = pa_to_audfmt (ss.format, &obt_as.endianness);

    pa->stream = qpa_simple_new (
        g,
        "qemu",
        PA_STREAM_RECORD,
-        ppdo->has_name ? ppdo->name : NULL,
+        g->conf.source,
        &ss,
        NULL,                   /* channel map */
-        &ba,                    /* buffering attributes */
+        NULL,                   /* buffering attributes */
        &error
        );
    if (!pa->stream) {
@@ -639,9 +635,7 @@ static int qpa_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    }

    audio_pcm_init_info (&hw->info, &obt_as);
-    hw->samples = pa->samples = audio_buffer_samples(
-        qapi_AudiodevPaPerDirectionOptions_base(ppdo),
-        &obt_as, ppdo->buffer_length);
+    hw->samples = g->conf.samples;
    pa->pcm_buf = audio_calloc(__func__, hw->samples, 1 << hw->info.shift);
    pa->wpos = hw->wpos;
    if (!pa->pcm_buf) {
@@ -813,54 +807,15 @@ static int qpa_ctl_in (HWVoiceIn *hw, int cmd, ...)
    return 0;
 }

-static int qpa_validate_per_direction_opts(Audiodev *dev,
-                                           AudiodevPaPerDirectionOptions *pdo)
+/* common */
+static PAConf glob_conf = {
+    .samples = 4096,
+};
+
+static void *qpa_audio_init (void)
 {
-    if (!pdo->has_buffer_length) {
-        pdo->has_buffer_length = true;
-        pdo->buffer_length = 46440;
-    }
-    if (!pdo->has_latency) {
-        pdo->has_latency = true;
-        pdo->latency = 15000;
-    }
-    return 1;
-}
-
-static void *qpa_audio_init(Audiodev *dev)
-{
-    paaudio *g;
-    AudiodevPaOptions *popts = &dev->u.pa;
-    const char *server;
-
-    if (!popts->has_server) {
-        char pidfile[64];
-        char *runtime;
-        struct stat st;
-
-        runtime = getenv("XDG_RUNTIME_DIR");
-        if (!runtime) {
-            return NULL;
-        }
-        snprintf(pidfile, sizeof(pidfile), "%s/pulse/pid", runtime);
-        if (stat(pidfile, &st) != 0) {
-            return NULL;
-        }
-    }
-
-    assert(dev->driver == AUDIODEV_DRIVER_PA);
-
-    g = g_malloc(sizeof(paaudio));
-    server = popts->has_server ? popts->server : NULL;
-
-    if (!qpa_validate_per_direction_opts(dev, popts->in)) {
-        goto fail;
-    }
-    if (!qpa_validate_per_direction_opts(dev, popts->out)) {
-        goto fail;
-    }
-
-    g->dev = dev;
+    paaudio *g = g_malloc(sizeof(paaudio));
+    g->conf = glob_conf;
    g->mainloop = NULL;
    g->context = NULL;

@@ -870,14 +825,14 @@ static void *qpa_audio_init(Audiodev *dev)
    }

    g->context = pa_context_new (pa_threaded_mainloop_get_api (g->mainloop),
-                                 server);
+                                 g->conf.server);
    if (!g->context) {
        goto fail;
    }

    pa_context_set_state_callback (g->context, context_state_cb, g);

-    if (pa_context_connect(g->context, server, 0, NULL) < 0) {
+    if (pa_context_connect (g->context, g->conf.server, 0, NULL) < 0) {
        qpa_logerr (pa_context_errno (g->context),
                    "pa_context_connect() failed\n");
        goto fail;
@@ -940,6 +895,34 @@ static void qpa_audio_fini (void *opaque)
    g_free(g);
 }

+struct audio_option qpa_options[] = {
+    {
+        .name  = "SAMPLES",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.samples,
+        .descr = "buffer size in samples"
+    },
+    {
+        .name  = "SERVER",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.server,
+        .descr = "server address"
+    },
+    {
+        .name  = "SINK",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.sink,
+        .descr = "sink device name"
+    },
+    {
+        .name  = "SOURCE",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.source,
+        .descr = "source device name"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops qpa_pcm_ops = {
    .init_out = qpa_init_out,
    .fini_out = qpa_fini_out,
@@ -957,6 +940,7 @@ static struct audio_pcm_ops qpa_pcm_ops = {
 static struct audio_driver pa_audio_driver = {
    .name           = "pa",
    .descr          = "http://www.pulseaudio.org/",
+    .options        = qpa_options,
    .init           = qpa_audio_init,
    .fini           = qpa_audio_fini,
    .pcm_ops        = &qpa_pcm_ops,
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -38,17 +38,31 @@
 #define AUDIO_CAP "sdl"
 #include "audio_int.h"

+#define USE_SEMAPHORE (SDL_MAJOR_VERSION < 2)
+
 typedef struct SDLVoiceOut {
    HWVoiceOut hw;
    int live;
+#if USE_SEMAPHORE
+    int rpos;
+#endif
    int decr;
 } SDLVoiceOut;

+static struct {
+    int nb_samples;
+} conf = {
+    .nb_samples = 1024
+};
+
 static struct SDLAudioState {
    int exit;
+#if USE_SEMAPHORE
+    SDL_mutex *mutex;
+    SDL_sem *sem;
+#endif
    int initialized;
    bool driver_created;
-    Audiodev *dev;
 } glob_sdl;
 typedef struct SDLAudioState SDLAudioState;

@@ -63,19 +77,79 @@ static void GCC_FMT_ATTR (1, 2) sdl_logerr (const char *fmt, ...)
    AUD_log (AUDIO_CAP, "Reason: %s\n", SDL_GetError ());
 }

-static int aud_to_sdlfmt (AudioFormat fmt)
+static int sdl_lock (SDLAudioState *s, const char *forfn)
+{
+#if USE_SEMAPHORE
+    if (SDL_LockMutex (s->mutex)) {
+        sdl_logerr ("SDL_LockMutex for %s failed\n", forfn);
+        return -1;
+    }
+#else
+    SDL_LockAudio();
+#endif
+
+    return 0;
+}
+
+static int sdl_unlock (SDLAudioState *s, const char *forfn)
+{
+#if USE_SEMAPHORE
+    if (SDL_UnlockMutex (s->mutex)) {
+        sdl_logerr ("SDL_UnlockMutex for %s failed\n", forfn);
+        return -1;
+    }
+#else
+    SDL_UnlockAudio();
+#endif
+
+    return 0;
+}
+
+static int sdl_post (SDLAudioState *s, const char *forfn)
+{
+#if USE_SEMAPHORE
+    if (SDL_SemPost (s->sem)) {
+        sdl_logerr ("SDL_SemPost for %s failed\n", forfn);
+        return -1;
+    }
+#endif
+
+    return 0;
+}
+
+#if USE_SEMAPHORE
+static int sdl_wait (SDLAudioState *s, const char *forfn)
+{
+    if (SDL_SemWait (s->sem)) {
+        sdl_logerr ("SDL_SemWait for %s failed\n", forfn);
+        return -1;
+    }
+    return 0;
+}
+#endif
+
+static int sdl_unlock_and_post (SDLAudioState *s, const char *forfn)
+{
+    if (sdl_unlock (s, forfn)) {
+        return -1;
+    }
+
+    return sdl_post (s, forfn);
+}
+
+static int aud_to_sdlfmt (audfmt_e fmt)
 {
    switch (fmt) {
-    case AUDIO_FORMAT_S8:
+    case AUD_FMT_S8:
        return AUDIO_S8;

-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_U8:
        return AUDIO_U8;

-    case AUDIO_FORMAT_S16:
+    case AUD_FMT_S16:
        return AUDIO_S16LSB;

-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_U16:
        return AUDIO_U16LSB;

    default:
@@ -87,37 +161,37 @@ static int aud_to_sdlfmt (AudioFormat fmt)
    }
 }

-static int sdl_to_audfmt(int sdlfmt, AudioFormat *fmt, int *endianness)
+static int sdl_to_audfmt(int sdlfmt, audfmt_e *fmt, int *endianness)
 {
    switch (sdlfmt) {
    case AUDIO_S8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S8;
+        *fmt = AUD_FMT_S8;
        break;

    case AUDIO_U8:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U8;
+        *fmt = AUD_FMT_U8;
        break;

    case AUDIO_S16LSB:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case AUDIO_U16LSB:
        *endianness = 0;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    case AUDIO_S16MSB:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_S16;
+        *fmt = AUD_FMT_S16;
        break;

    case AUDIO_U16MSB:
        *endianness = 1;
-        *fmt = AUDIO_FORMAT_U16;
+        *fmt = AUD_FMT_U16;
        break;

    default:
@@ -169,9 +243,9 @@ static int sdl_open (SDL_AudioSpec *req, SDL_AudioSpec *obt)
 static void sdl_close (SDLAudioState *s)
 {
    if (s->initialized) {
-        SDL_LockAudio();
+        sdl_lock (s, "sdl_close");
        s->exit = 1;
-        SDL_UnlockAudio();
+        sdl_unlock_and_post (s, "sdl_close");
        SDL_PauseAudio (1);
        SDL_CloseAudio ();
        s->initialized = 0;
@@ -184,36 +258,76 @@ static void sdl_callback (void *opaque, Uint8 *buf, int len)
    SDLAudioState *s = &glob_sdl;
    HWVoiceOut *hw = &sdl->hw;
    int samples = len >> hw->info.shift;
-    int to_mix, decr;

-    if (s->exit || !sdl->live) {
+    if (s->exit) {
        return;
    }

-    /* dolog ("in callback samples=%d live=%d\n", samples, sdl->live); */
+    while (samples) {
+        int to_mix, decr;

-    to_mix = audio_MIN(samples, sdl->live);
-    decr = to_mix;
-    while (to_mix) {
-        int chunk = audio_MIN(to_mix, hw->samples - hw->rpos);
-        struct st_sample *src = hw->mix_buf + hw->rpos;
+        /* dolog ("in callback samples=%d\n", samples); */
+#if USE_SEMAPHORE
+        sdl_wait (s, "sdl_callback");
+        if (s->exit) {
+            return;
+        }

-        /* dolog ("in callback to_mix %d, chunk %d\n", to_mix, chunk); */
-        hw->clip(buf, src, chunk);
-        hw->rpos = (hw->rpos + chunk) % hw->samples;
-        to_mix -= chunk;
-        buf += chunk << hw->info.shift;
+        if (sdl_lock (s, "sdl_callback")) {
+            return;
+        }
+
+        if (audio_bug(__func__, sdl->live < 0 || sdl->live > hw->samples)) {
+            dolog ("sdl->live=%d hw->samples=%d\n",
+                   sdl->live, hw->samples);
+            return;
+        }
+
+        if (!sdl->live) {
+            goto again;
+        }
+#else
+        if (s->exit || !sdl->live) {
+            break;
+        }
+#endif
+
+        /* dolog ("in callback live=%d\n", live); */
+        to_mix = audio_MIN (samples, sdl->live);
+        decr = to_mix;
+        while (to_mix) {
+            int chunk = audio_MIN (to_mix, hw->samples - hw->rpos);
+            struct st_sample *src = hw->mix_buf + hw->rpos;
+
+            /* dolog ("in callback to_mix %d, chunk %d\n", to_mix, chunk); */
+            hw->clip (buf, src, chunk);
+#if USE_SEMAPHORE
+            sdl->rpos = (sdl->rpos + chunk) % hw->samples;
+#else
+            hw->rpos = (hw->rpos + chunk) % hw->samples;
+#endif
+            to_mix -= chunk;
+            buf += chunk << hw->info.shift;
+        }
+        samples -= decr;
+        sdl->live -= decr;
+        sdl->decr += decr;
+
+#if USE_SEMAPHORE
+    again:
+        if (sdl_unlock (s, "sdl_callback")) {
+            return;
+        }
+#endif
    }
-    samples -= decr;
-    sdl->live -= decr;
-    sdl->decr += decr;
-
    /* dolog ("done len=%d\n", len); */

+#if (SDL_MAJOR_VERSION >= 2)
    /* SDL2 does not clear the remaining buffer for us, so do it on our own */
    if (samples) {
        memset(buf, 0, samples << hw->info.shift);
    }
+#endif
 }

 static int sdl_write_out (SWVoiceOut *sw, void *buf, int len)
@@ -225,8 +339,11 @@ static int sdl_run_out (HWVoiceOut *hw, int live)
 {
    int decr;
    SDLVoiceOut *sdl = (SDLVoiceOut *) hw;
+    SDLAudioState *s = &glob_sdl;

-    SDL_LockAudio();
+    if (sdl_lock (s, "sdl_run_out")) {
+        return 0;
+    }

    if (sdl->decr > live) {
        ldebug ("sdl->decr %d live %d sdl->live %d\n",
@@ -238,10 +355,19 @@ static int sdl_run_out (HWVoiceOut *hw, int live)
    decr = audio_MIN (sdl->decr, live);
    sdl->decr -= decr;

+#if USE_SEMAPHORE
+    sdl->live = live - decr;
+    hw->rpos = sdl->rpos;
+#else
    sdl->live = live;
+#endif

-    SDL_UnlockAudio();
-
+    if (sdl->live > 0) {
+        sdl_unlock_and_post (s, "sdl_run_out");
+    }
+    else {
+        sdl_unlock (s, "sdl_run_out");
+    }
    return decr;
 }

@@ -260,13 +386,13 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
    SDL_AudioSpec req, obt;
    int endianness;
    int err;
-    AudioFormat effective_fmt;
+    audfmt_e effective_fmt;
    struct audsettings obt_as;

    req.freq = as->freq;
    req.format = aud_to_sdlfmt (as->fmt);
    req.channels = as->nchannels;
-    req.samples = audio_buffer_samples(s->dev->u.sdl.out, as, 11610);
+    req.samples = conf.nb_samples;
    req.callback = sdl_callback;
    req.userdata = sdl;

@@ -310,7 +436,7 @@ static int sdl_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }

-static void *sdl_audio_init(Audiodev *dev)
+static void *sdl_audio_init (void)
 {
    SDLAudioState *s = &glob_sdl;
    if (s->driver_created) {
@@ -323,8 +449,24 @@ static void *sdl_audio_init(Audiodev *dev)
        return NULL;
    }

+#if USE_SEMAPHORE
+    s->mutex = SDL_CreateMutex ();
+    if (!s->mutex) {
+        sdl_logerr ("Failed to create SDL mutex\n");
+        SDL_QuitSubSystem (SDL_INIT_AUDIO);
+        return NULL;
+    }
+
+    s->sem = SDL_CreateSemaphore (0);
+    if (!s->sem) {
+        sdl_logerr ("Failed to create SDL semaphore\n");
+        SDL_DestroyMutex (s->mutex);
+        SDL_QuitSubSystem (SDL_INIT_AUDIO);
+        return NULL;
+    }
+#endif
+
    s->driver_created = true;
-    s->dev = dev;
    return s;
 }

@@ -332,11 +474,24 @@ static void sdl_audio_fini (void *opaque)
 {
    SDLAudioState *s = opaque;
    sdl_close (s);
+#if USE_SEMAPHORE
+    SDL_DestroySemaphore (s->sem);
+    SDL_DestroyMutex (s->mutex);
+#endif
    SDL_QuitSubSystem (SDL_INIT_AUDIO);
    s->driver_created = false;
-    s->dev = NULL;
 }

+static struct audio_option sdl_options[] = {
+    {
+        .name  = "SAMPLES",
+        .tag   = AUD_OPT_INT,
+        .valp  = &conf.nb_samples,
+        .descr = "Size of SDL buffer in samples"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops sdl_pcm_ops = {
    .init_out = sdl_init_out,
    .fini_out = sdl_fini_out,
@@ -348,6 +503,7 @@ static struct audio_pcm_ops sdl_pcm_ops = {
 static struct audio_driver sdl_audio_driver = {
    .name           = "sdl",
    .descr          = "SDL http://www.libsdl.org",
+    .options        = sdl_options,
    .init           = sdl_audio_init,
    .fini           = sdl_audio_fini,
    .pcm_ops        = &sdl_pcm_ops,
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -77,7 +77,7 @@ static const SpiceRecordInterface record_sif = {
    .base.minor_version = SPICE_INTERFACE_RECORD_MINOR,
 };

-static void *spice_audio_init(Audiodev *dev)
+static void *spice_audio_init (void)
 {
    if (!using_spice) {
        return NULL;
@@ -130,7 +130,7 @@ static int line_out_init(HWVoiceOut *hw, struct audsettings *as,
    settings.freq       = SPICE_INTERFACE_PLAYBACK_FREQ;
 #endif
    settings.nchannels  = SPICE_INTERFACE_PLAYBACK_CHAN;
-    settings.fmt        = AUDIO_FORMAT_S16;
+    settings.fmt        = AUD_FMT_S16;
    settings.endianness = AUDIO_HOST_ENDIANNESS;

    audio_pcm_init_info (&hw->info, &settings);
@@ -258,7 +258,7 @@ static int line_in_init(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
    settings.freq       = SPICE_INTERFACE_RECORD_FREQ;
 #endif
    settings.nchannels  = SPICE_INTERFACE_RECORD_CHAN;
-    settings.fmt        = AUDIO_FORMAT_S16;
+    settings.fmt        = AUD_FMT_S16;
    settings.endianness = AUDIO_HOST_ENDIANNESS;

    audio_pcm_init_info (&hw->info, &settings);
@@ -373,6 +373,10 @@ static int line_in_ctl (HWVoiceIn *hw, int cmd, ...)
    return 0;
 }

+static struct audio_option audio_options[] = {
+    { /* end of list */ },
+};
+
 static struct audio_pcm_ops audio_callbacks = {
    .init_out = line_out_init,
    .fini_out = line_out_fini,
@@ -390,6 +394,7 @@ static struct audio_pcm_ops audio_callbacks = {
 static struct audio_driver spice_audio_driver = {
    .name           = "spice",
    .descr          = "spice audio driver",
+    .options        = audio_options,
    .init           = spice_audio_init,
    .fini           = spice_audio_fini,
    .pcm_ops        = &audio_callbacks,
--- a/audio/trace-events
+++ b/audio/trace-events
@@ -1,6 +1,6 @@
 # See docs/devel/tracing.txt for syntax documentation.

-# alsaaudio.c
+# audio/alsaaudio.c
 alsa_revents(int revents) "revents = %d"
 alsa_pollout(int i, int fd) "i = %d fd = %d"
 alsa_set_handler(int events, int index, int fd, int err) "events=0x%x index=%d fd=%d err=%d"
@@ -12,11 +12,11 @@ alsa_resume_out(void) "Resuming suspended output stream"
 alsa_resume_in(void) "Resuming suspended input stream"
 alsa_no_frames(int state) "No frames available and ALSA state is %d"

-# ossaudio.c
+# audio/ossaudio.c
 oss_version(int version) "OSS version = 0x%x"
 oss_invalid_available_size(int size, int bufsize) "Invalid available size, size=%d bufsize=%d"

-# audio.c
+# audio/audio.c
 audio_timer_start(int interval) "interval %d ms"
 audio_timer_stop(void) ""
 audio_timer_delayed(int interval) "interval %d ms"
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -24,7 +24,6 @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/timer.h"
-#include "qapi/opts-visitor.h"
 #include "audio.h"

 #define AUDIO_CAP "wav"
@@ -38,6 +37,11 @@ typedef struct WAVVoiceOut {
    int total_samples;
 } WAVVoiceOut;

+typedef struct {
+    struct audsettings settings;
+    const char *wav_path;
+} WAVConf;
+
 static int wav_run_out (HWVoiceOut *hw, int live)
 {
    WAVVoiceOut *wav = (WAVVoiceOut *) hw;
@@ -108,30 +112,25 @@ static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
        0x02, 0x00, 0x44, 0xac, 0x00, 0x00, 0x10, 0xb1, 0x02, 0x00, 0x04,
        0x00, 0x10, 0x00, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x00, 0x00
    };
-    Audiodev *dev = drv_opaque;
-    AudiodevWavOptions *wopts = &dev->u.wav;
-    struct audsettings wav_as = audiodev_to_audsettings(dev->u.wav.out);
-    const char *wav_path = wopts->has_path ? wopts->path : "qemu.wav";
+    WAVConf *conf = drv_opaque;
+    struct audsettings wav_as = conf->settings;

    stereo = wav_as.nchannels == 2;
    switch (wav_as.fmt) {
-    case AUDIO_FORMAT_S8:
-    case AUDIO_FORMAT_U8:
+    case AUD_FMT_S8:
+    case AUD_FMT_U8:
        bits16 = 0;
        break;

-    case AUDIO_FORMAT_S16:
-    case AUDIO_FORMAT_U16:
+    case AUD_FMT_S16:
+    case AUD_FMT_U16:
        bits16 = 1;
        break;

-    case AUDIO_FORMAT_S32:
-    case AUDIO_FORMAT_U32:
+    case AUD_FMT_S32:
+    case AUD_FMT_U32:
        dolog ("WAVE files can not handle 32bit formats\n");
        return -1;
-
-    default:
-        abort();
    }

    hdr[34] = bits16 ? 0x10 : 0x08;
@@ -152,10 +151,10 @@ static int wav_init_out(HWVoiceOut *hw, struct audsettings *as,
    le_store (hdr + 28, hw->info.freq << (bits16 + stereo), 4);
    le_store (hdr + 32, 1 << (bits16 + stereo), 2);

-    wav->f = fopen(wav_path, "wb");
+    wav->f = fopen (conf->wav_path, "wb");
    if (!wav->f) {
        dolog ("Failed to open wave file `%s'\nReason: %s\n",
-               wav_path, strerror(errno));
+               conf->wav_path, strerror (errno));
        g_free (wav->pcm_buf);
        wav->pcm_buf = NULL;
        return -1;
@@ -223,17 +222,54 @@ static int wav_ctl_out (HWVoiceOut *hw, int cmd, ...)
    return 0;
 }

-static void *wav_audio_init(Audiodev *dev)
+static WAVConf glob_conf = {
+    .settings.freq      = 44100,
+    .settings.nchannels = 2,
+    .settings.fmt       = AUD_FMT_S16,
+    .wav_path           = "qemu.wav"
+};
+
+static void *wav_audio_init (void)
 {
-    assert(dev->driver == AUDIODEV_DRIVER_WAV);
-    return dev;
+    WAVConf *conf = g_malloc(sizeof(WAVConf));
+    *conf = glob_conf;
+    return conf;
 }

 static void wav_audio_fini (void *opaque)
 {
    ldebug ("wav_fini");
+    g_free(opaque);
 }

+static struct audio_option wav_options[] = {
+    {
+        .name  = "FREQUENCY",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.settings.freq,
+        .descr = "Frequency"
+    },
+    {
+        .name  = "FORMAT",
+        .tag   = AUD_OPT_FMT,
+        .valp  = &glob_conf.settings.fmt,
+        .descr = "Format"
+    },
+    {
+        .name  = "DAC_FIXED_CHANNELS",
+        .tag   = AUD_OPT_INT,
+        .valp  = &glob_conf.settings.nchannels,
+        .descr = "Number of channels (1 - mono, 2 - stereo)"
+    },
+    {
+        .name  = "PATH",
+        .tag   = AUD_OPT_STR,
+        .valp  = &glob_conf.wav_path,
+        .descr = "Path to wave file"
+    },
+    { /* End of list */ }
+};
+
 static struct audio_pcm_ops wav_pcm_ops = {
    .init_out = wav_init_out,
    .fini_out = wav_fini_out,
@@ -245,6 +281,7 @@ static struct audio_pcm_ops wav_pcm_ops = {
 static struct audio_driver wav_audio_driver = {
    .name           = "wav",
    .descr          = "WAV renderer http://wikipedia.org/wiki/WAV",
+    .options        = wav_options,
    .init           = wav_audio_init,
    .fini           = wav_audio_fini,
    .pcm_ops        = &wav_pcm_ops,
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -38,29 +38,30 @@ static void wav_destroy (void *opaque)
    uint8_t dlen[4];
    uint32_t datalen = wav->bytes;
    uint32_t rifflen = datalen + 36;
+    Monitor *mon = cur_mon;

    if (wav->f) {
        le_store (rlen, rifflen, 4);
        le_store (dlen, datalen, 4);

        if (fseek (wav->f, 4, SEEK_SET)) {
-            error_report("wav_destroy: rlen fseek failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: rlen fseek failed\nReason: %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fwrite (rlen, 4, 1, wav->f) != 1) {
-            error_report("wav_destroy: rlen fwrite failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: rlen fwrite failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fseek (wav->f, 32, SEEK_CUR)) {
-            error_report("wav_destroy: dlen fseek failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: dlen fseek failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
        if (fwrite (dlen, 1, 4, wav->f) != 4) {
-            error_report("wav_destroy: dlen fwrite failed: %s",
-                         strerror(errno));
+            monitor_printf (mon, "wav_destroy: dlen fwrite failed\nReason %s\n",
+                            strerror (errno));
            goto doclose;
        }
    doclose:
@@ -77,7 +78,8 @@ static void wav_capture (void *opaque, void *buf, int size)
    WAVState *wav = opaque;

    if (fwrite (buf, size, 1, wav->f) != 1) {
-        error_report("wav_capture: fwrite error: %s", strerror(errno));
+        monitor_printf (cur_mon, "wav_capture: fwrite error\nReason: %s",
+                        strerror (errno));
    }
    wav->bytes += size;
 }
@@ -108,6 +110,7 @@ static struct capture_ops wav_capture_ops = {
 int wav_start_capture (CaptureState *s, const char *path, int freq,
                       int bits, int nchannels)
 {
+    Monitor *mon = cur_mon;
    WAVState *wav;
    uint8_t hdr[] = {
        0x52, 0x49, 0x46, 0x46, 0x00, 0x00, 0x00, 0x00, 0x57, 0x41, 0x56,
@@ -121,13 +124,13 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    CaptureVoiceOut *cap;

    if (bits != 8 && bits != 16) {
-        error_report("incorrect bit count %d, must be 8 or 16", bits);
+        monitor_printf (mon, "incorrect bit count %d, must be 8 or 16\n", bits);
        return -1;
    }

    if (nchannels != 1 && nchannels != 2) {
-        error_report("incorrect channel count %d, must be 1 or 2",
-                     nchannels);
+        monitor_printf (mon, "incorrect channel count %d, must be 1 or 2\n",
+                        nchannels);
        return -1;
    }

@@ -136,7 +139,7 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,

    as.freq = freq;
    as.nchannels = 1 << stereo;
-    as.fmt = bits16 ? AUDIO_FORMAT_S16 : AUDIO_FORMAT_U8;
+    as.fmt = bits16 ? AUD_FMT_S16 : AUD_FMT_U8;
    as.endianness = 0;

    ops.notify = wav_notify;
@@ -155,8 +158,8 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,

    wav->f = fopen (path, "wb");
    if (!wav->f) {
-        error_report("Failed to open wave file `%s': %s",
-                     path, strerror(errno));
+        monitor_printf (mon, "Failed to open wave file `%s'\nReason: %s\n",
+                        path, strerror (errno));
        g_free (wav);
        return -1;
    }
@@ -167,13 +170,14 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
    wav->freq = freq;

    if (fwrite (hdr, sizeof (hdr), 1, wav->f) != 1) {
-        error_report("Failed to write header: %s", strerror(errno));
+        monitor_printf (mon, "Failed to write header\nReason: %s\n",
+                        strerror (errno));
        goto error_free;
    }

    cap = AUD_add_capture (&as, &ops, wav);
    if (!cap) {
-        error_report("Failed to add audio capture");
+        monitor_printf (mon, "Failed to add audio capture\n");
        goto error_free;
    }

@@ -185,7 +189,8 @@ int wav_start_capture (CaptureState *s, const char *path, int freq,
 error_free:
    g_free (wav->path);
    if (fclose (wav->f)) {
-        error_report("Failed to close wave file: %s", strerror(errno));
+        monitor_printf (mon, "Failed to close wave file\nReason: %s\n",
+                        strerror (errno));
    }
    g_free (wav);
    return -1;
--- a/authz/Makefile.objs
+++ b/authz/Makefile.objs
@@ -1,7 +0,0 @@
-authz-obj-y += base.o
-authz-obj-y += simple.o
-authz-obj-y += list.o
-authz-obj-y += listfile.o
-authz-obj-$(CONFIG_AUTH_PAM) += pamacct.o
-
-pamacct.o-libs = -lpam
--- a/authz/base.c
+++ b/authz/base.c
@@ -1,82 +0,0 @@
-/*
- * QEMU authorization framework base class
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/base.h"
-#include "authz/trace.h"
-
-bool qauthz_is_allowed(QAuthZ *authz,
-                       const char *identity,
-                       Error **errp)
-{
-    QAuthZClass *cls = QAUTHZ_GET_CLASS(authz);
-    bool allowed;
-
-    allowed = cls->is_allowed(authz, identity, errp);
-    trace_qauthz_is_allowed(authz, identity, allowed);
-
-    return allowed;
-}
-
-
-bool qauthz_is_allowed_by_id(const char *authzid,
-                             const char *identity,
-                             Error **errp)
-{
-    QAuthZ *authz;
-    Object *obj;
-    Object *container;
-
-    container = object_get_objects_root();
-    obj = object_resolve_path_component(container,
-                                        authzid);
-    if (!obj) {
-        error_setg(errp, "Cannot find QAuthZ object ID %s",
-                   authzid);
-        return false;
-    }
-
-    if (!object_dynamic_cast(obj, TYPE_QAUTHZ)) {
-        error_setg(errp, "Object '%s' is not a QAuthZ subclass",
-                   authzid);
-        return false;
-    }
-
-    authz = QAUTHZ(obj);
-
-    return qauthz_is_allowed(authz, identity, errp);
-}
-
-
-static const TypeInfo authz_info = {
-    .parent = TYPE_OBJECT,
-    .name = TYPE_QAUTHZ,
-    .instance_size = sizeof(QAuthZ),
-    .class_size = sizeof(QAuthZClass),
-    .abstract = true,
-};
-
-static void qauthz_register_types(void)
-{
-    type_register_static(&authz_info);
-}
-
-type_init(qauthz_register_types)
-
--- a/authz/list.c
+++ b/authz/list.c
@@ -1,271 +0,0 @@
-/*
- * QEMU access control list authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/list.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-#include "qapi/qapi-visit-authz.h"
-
-static bool qauthz_list_is_allowed(QAuthZ *authz,
-                                   const char *identity,
-                                   Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(authz);
-    QAuthZListRuleList *rules = lauthz->rules;
-
-    while (rules) {
-        QAuthZListRule *rule = rules->value;
-        QAuthZListFormat format = rule->has_format ? rule->format :
-            QAUTHZ_LIST_FORMAT_EXACT;
-
-        trace_qauthz_list_check_rule(authz, rule->match, identity,
-                                     format, rule->policy);
-        switch (format) {
-        case QAUTHZ_LIST_FORMAT_EXACT:
-            if (g_str_equal(rule->match, identity)) {
-                return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
-            }
-            break;
-        case QAUTHZ_LIST_FORMAT_GLOB:
-            if (g_pattern_match_simple(rule->match, identity)) {
-                return rule->policy == QAUTHZ_LIST_POLICY_ALLOW;
-            }
-            break;
-        default:
-            g_warn_if_reached();
-            return false;
-        }
-        rules = rules->next;
-    }
-
-    trace_qauthz_list_default_policy(authz, identity, lauthz->policy);
-    return lauthz->policy == QAUTHZ_LIST_POLICY_ALLOW;
-}
-
-
-static void
-qauthz_list_prop_set_policy(Object *obj,
-                            int value,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    lauthz->policy = value;
-}
-
-
-static int
-qauthz_list_prop_get_policy(Object *obj,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    return lauthz->policy;
-}
-
-
-static void
-qauthz_list_prop_get_rules(Object *obj, Visitor *v, const char *name,
-                           void *opaque, Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    visit_type_QAuthZListRuleList(v, name, &lauthz->rules, errp);
-}
-
-static void
-qauthz_list_prop_set_rules(Object *obj, Visitor *v, const char *name,
-                           void *opaque, Error **errp)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-    QAuthZListRuleList *oldrules;
-
-    oldrules = lauthz->rules;
-    visit_type_QAuthZListRuleList(v, name, &lauthz->rules, errp);
-
-    qapi_free_QAuthZListRuleList(oldrules);
-}
-
-
-static void
-qauthz_list_finalize(Object *obj)
-{
-    QAuthZList *lauthz = QAUTHZ_LIST(obj);
-
-    qapi_free_QAuthZListRuleList(lauthz->rules);
-}
-
-
-static void
-qauthz_list_class_init(ObjectClass *oc, void *data)
-{
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    object_class_property_add_enum(oc, "policy",
-                                   "QAuthZListPolicy",
-                                   &QAuthZListPolicy_lookup,
-                                   qauthz_list_prop_get_policy,
-                                   qauthz_list_prop_set_policy,
-                                   NULL);
-
-    object_class_property_add(oc, "rules", "QAuthZListRule",
-                              qauthz_list_prop_get_rules,
-                              qauthz_list_prop_set_rules,
-                              NULL, NULL, NULL);
-
-    authz->is_allowed = qauthz_list_is_allowed;
-}
-
-
-QAuthZList *qauthz_list_new(const char *id,
-                            QAuthZListPolicy policy,
-                            Error **errp)
-{
-    return QAUTHZ_LIST(
-        object_new_with_props(TYPE_QAUTHZ_LIST,
-                              object_get_objects_root(),
-                              id, errp,
-                              "policy", QAuthZListPolicy_str(policy),
-                              NULL));
-}
-
-ssize_t qauthz_list_append_rule(QAuthZList *auth,
-                                const char *match,
-                                QAuthZListPolicy policy,
-                                QAuthZListFormat format,
-                                Error **errp)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *tmp;
-    size_t i = 0;
-
-    rule = g_new0(QAuthZListRule, 1);
-    rule->policy = policy;
-    rule->match = g_strdup(match);
-    rule->format = format;
-    rule->has_format = true;
-
-    tmp = g_new0(QAuthZListRuleList, 1);
-    tmp->value = rule;
-
-    rules = auth->rules;
-    if (rules) {
-        while (rules->next) {
-            i++;
-            rules = rules->next;
-        }
-        rules->next = tmp;
-        return i + 1;
-    } else {
-        auth->rules = tmp;
-        return 0;
-    }
-}
-
-
-ssize_t qauthz_list_insert_rule(QAuthZList *auth,
-                                const char *match,
-                                QAuthZListPolicy policy,
-                                QAuthZListFormat format,
-                                size_t index,
-                                Error **errp)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *tmp;
-    size_t i = 0;
-
-    rule = g_new0(QAuthZListRule, 1);
-    rule->policy = policy;
-    rule->match = g_strdup(match);
-    rule->format = format;
-    rule->has_format = true;
-
-    tmp = g_new0(QAuthZListRuleList, 1);
-    tmp->value = rule;
-
-    rules = auth->rules;
-    if (rules && index > 0) {
-        while (rules->next && i < (index - 1)) {
-            i++;
-            rules = rules->next;
-        }
-        tmp->next = rules->next;
-        rules->next = tmp;
-        return i + 1;
-    } else {
-        tmp->next = auth->rules;
-        auth->rules = tmp;
-        return 0;
-    }
-}
-
-
-ssize_t qauthz_list_delete_rule(QAuthZList *auth, const char *match)
-{
-    QAuthZListRule *rule;
-    QAuthZListRuleList *rules, *prev;
-    size_t i = 0;
-
-    prev = NULL;
-    rules = auth->rules;
-    while (rules) {
-        rule = rules->value;
-        if (g_str_equal(rule->match, match)) {
-            if (prev) {
-                prev->next = rules->next;
-            } else {
-                auth->rules = rules->next;
-            }
-            rules->next = NULL;
-            qapi_free_QAuthZListRuleList(rules);
-            return i;
-        }
-        prev = rules;
-        rules = rules->next;
-        i++;
-    }
-
-    return -1;
-}
-
-
-static const TypeInfo qauthz_list_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_LIST,
-    .instance_size = sizeof(QAuthZList),
-    .instance_finalize = qauthz_list_finalize,
-    .class_size = sizeof(QAuthZListClass),
-    .class_init = qauthz_list_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_list_register_types(void)
-{
-    type_register_static(&qauthz_list_info);
-}
-
-
-type_init(qauthz_list_register_types);
--- a/authz/listfile.c
+++ b/authz/listfile.c
@@ -1,283 +0,0 @@
-/*
- * QEMU access control list file authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/listfile.h"
-#include "authz/trace.h"
-#include "qemu/error-report.h"
-#include "qemu/main-loop.h"
-#include "qemu/sockets.h"
-#include "qemu/filemonitor.h"
-#include "qom/object_interfaces.h"
-#include "qapi/qapi-visit-authz.h"
-#include "qapi/qmp/qjson.h"
-#include "qapi/qmp/qobject.h"
-#include "qapi/qmp/qerror.h"
-#include "qapi/qobject-input-visitor.h"
-
-
-static bool
-qauthz_list_file_is_allowed(QAuthZ *authz,
-                            const char *identity,
-                            Error **errp)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(authz);
-    if (fauthz->list) {
-        return qauthz_is_allowed(fauthz->list, identity, errp);
-    }
-
-    return false;
-}
-
-
-static QAuthZ *
-qauthz_list_file_load(QAuthZListFile *fauthz, Error **errp)
-{
-    GError *err = NULL;
-    gchar *content = NULL;
-    gsize len;
-    QObject *obj = NULL;
-    QDict *pdict;
-    Visitor *v = NULL;
-    QAuthZ *ret = NULL;
-
-    trace_qauthz_list_file_load(fauthz, fauthz->filename);
-    if (!g_file_get_contents(fauthz->filename, &content, &len, &err)) {
-        error_setg(errp, "Unable to read '%s': %s",
-                   fauthz->filename, err->message);
-        goto cleanup;
-    }
-
-    obj = qobject_from_json(content, errp);
-    if (!obj) {
-        goto cleanup;
-    }
-
-    pdict = qobject_to(QDict, obj);
-    if (!pdict) {
-        error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "obj", "dict");
-        goto cleanup;
-    }
-
-    v = qobject_input_visitor_new(obj);
-
-    ret = (QAuthZ *)user_creatable_add_type(TYPE_QAUTHZ_LIST,
-                                            NULL, pdict, v, errp);
-
- cleanup:
-    visit_free(v);
-    qobject_unref(obj);
-    if (err) {
-        g_error_free(err);
-    }
-    g_free(content);
-    return ret;
-}
-
-
-static void
-qauthz_list_file_event(int wd G_GNUC_UNUSED,
-                       QFileMonitorEvent ev G_GNUC_UNUSED,
-                       const char *name G_GNUC_UNUSED,
-                       void *opaque)
-{
-    QAuthZListFile *fauthz = opaque;
-    Error *err = NULL;
-
-    if (ev != QFILE_MONITOR_EVENT_MODIFIED &&
-        ev != QFILE_MONITOR_EVENT_CREATED) {
-        return;
-    }
-
-    object_unref(OBJECT(fauthz->list));
-    fauthz->list = qauthz_list_file_load(fauthz, &err);
-    trace_qauthz_list_file_refresh(fauthz,
-                                   fauthz->filename, fauthz->list ? 1 : 0);
-    if (!fauthz->list) {
-        error_report_err(err);
-    }
-}
-
-static void
-qauthz_list_file_complete(UserCreatable *uc, Error **errp)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(uc);
-    gchar *dir = NULL, *file = NULL;
-
-    fauthz->list = qauthz_list_file_load(fauthz, errp);
-
-    if (!fauthz->refresh) {
-        return;
-    }
-
-    fauthz->file_monitor = qemu_file_monitor_new(errp);
-    if (!fauthz->file_monitor) {
-        return;
-    }
-
-    dir = g_path_get_dirname(fauthz->filename);
-    if (g_str_equal(dir, ".")) {
-        error_setg(errp, "Filename must be an absolute path");
-        goto cleanup;
-    }
-    file = g_path_get_basename(fauthz->filename);
-    if (g_str_equal(file, ".")) {
-        error_setg(errp, "Path has no trailing filename component");
-        goto cleanup;
-    }
-
-    fauthz->file_watch = qemu_file_monitor_add_watch(
-        fauthz->file_monitor, dir, file,
-        qauthz_list_file_event, fauthz, errp);
-    if (fauthz->file_watch < 0) {
-        goto cleanup;
-    }
-
- cleanup:
-    g_free(file);
-    g_free(dir);
-}
-
-
-static void
-qauthz_list_file_prop_set_filename(Object *obj,
-                                   const char *value,
-                                   Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    g_free(fauthz->filename);
-    fauthz->filename = g_strdup(value);
-}
-
-
-static char *
-qauthz_list_file_prop_get_filename(Object *obj,
-                                   Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    return g_strdup(fauthz->filename);
-}
-
-
-static void
-qauthz_list_file_prop_set_refresh(Object *obj,
-                                  bool value,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    fauthz->refresh = value;
-}
-
-
-static bool
-qauthz_list_file_prop_get_refresh(Object *obj,
-                                  Error **errp G_GNUC_UNUSED)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    return fauthz->refresh;
-}
-
-
-static void
-qauthz_list_file_finalize(Object *obj)
-{
-    QAuthZListFile *fauthz = QAUTHZ_LIST_FILE(obj);
-
-    object_unref(OBJECT(fauthz->list));
-    g_free(fauthz->filename);
-    qemu_file_monitor_free(fauthz->file_monitor);
-}
-
-
-static void
-qauthz_list_file_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    ucc->complete = qauthz_list_file_complete;
-
-    object_class_property_add_str(oc, "filename",
-                                  qauthz_list_file_prop_get_filename,
-                                  qauthz_list_file_prop_set_filename,
-                                  NULL);
-    object_class_property_add_bool(oc, "refresh",
-                                   qauthz_list_file_prop_get_refresh,
-                                   qauthz_list_file_prop_set_refresh,
-                                   NULL);
-
-    authz->is_allowed = qauthz_list_file_is_allowed;
-}
-
-
-static void
-qauthz_list_file_init(Object *obj)
-{
-    QAuthZListFile *authz = QAUTHZ_LIST_FILE(obj);
-
-    authz->file_watch = -1;
-#ifdef CONFIG_INOTIFY1
-    authz->refresh = TRUE;
-#endif
-}
-
-
-QAuthZListFile *qauthz_list_file_new(const char *id,
-                                     const char *filename,
-                                     bool refresh,
-                                     Error **errp)
-{
-    return QAUTHZ_LIST_FILE(
-        object_new_with_props(TYPE_QAUTHZ_LIST_FILE,
-                              object_get_objects_root(),
-                              id, errp,
-                              "filename", filename,
-                              "refresh", refresh ? "yes" : "no",
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_list_file_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_LIST_FILE,
-    .instance_init = qauthz_list_file_init,
-    .instance_size = sizeof(QAuthZListFile),
-    .instance_finalize = qauthz_list_file_finalize,
-    .class_size = sizeof(QAuthZListFileClass),
-    .class_init = qauthz_list_file_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_list_file_register_types(void)
-{
-    type_register_static(&qauthz_list_file_info);
-}
-
-
-type_init(qauthz_list_file_register_types);
--- a/authz/pamacct.c
+++ b/authz/pamacct.c
@@ -1,148 +0,0 @@
-/*
- * QEMU PAM authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/pamacct.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-
-#include <security/pam_appl.h>
-
-
-static bool qauthz_pam_is_allowed(QAuthZ *authz,
-                                  const char *identity,
-                                  Error **errp)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(authz);
-    const struct pam_conv pam_conversation = { 0 };
-    pam_handle_t *pamh = NULL;
-    int ret;
-
-    trace_qauthz_pam_check(authz, identity, pauthz->service);
-    ret = pam_start(pauthz->service,
-                    identity,
-                    &pam_conversation,
-                    &pamh);
-    if (ret != PAM_SUCCESS) {
-        error_setg(errp, "Unable to start PAM transaction: %s",
-                   pam_strerror(NULL, ret));
-        return false;
-    }
-
-    ret = pam_acct_mgmt(pamh, PAM_SILENT);
-    pam_end(pamh, ret);
-    if (ret != PAM_SUCCESS) {
-        error_setg(errp, "Unable to authorize user '%s': %s",
-                   identity, pam_strerror(pamh, ret));
-        return false;
-    }
-
-    return true;
-}
-
-
-static void
-qauthz_pam_prop_set_service(Object *obj,
-                            const char *service,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    g_free(pauthz->service);
-    pauthz->service = g_strdup(service);
-}
-
-
-static char *
-qauthz_pam_prop_get_service(Object *obj,
-                            Error **errp G_GNUC_UNUSED)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    return g_strdup(pauthz->service);
-}
-
-
-static void
-qauthz_pam_complete(UserCreatable *uc, Error **errp)
-{
-}
-
-
-static void
-qauthz_pam_finalize(Object *obj)
-{
-    QAuthZPAM *pauthz = QAUTHZ_PAM(obj);
-
-    g_free(pauthz->service);
-}
-
-
-static void
-qauthz_pam_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    ucc->complete = qauthz_pam_complete;
-    authz->is_allowed = qauthz_pam_is_allowed;
-
-    object_class_property_add_str(oc, "service",
-                                  qauthz_pam_prop_get_service,
-                                  qauthz_pam_prop_set_service,
-                                  NULL);
-}
-
-
-QAuthZPAM *qauthz_pam_new(const char *id,
-                          const char *service,
-                          Error **errp)
-{
-    return QAUTHZ_PAM(
-        object_new_with_props(TYPE_QAUTHZ_PAM,
-                              object_get_objects_root(),
-                              id, errp,
-                              "service", service,
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_pam_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_PAM,
-    .instance_size = sizeof(QAuthZPAM),
-    .instance_finalize = qauthz_pam_finalize,
-    .class_size = sizeof(QAuthZPAMClass),
-    .class_init = qauthz_pam_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_pam_register_types(void)
-{
-    type_register_static(&qauthz_pam_info);
-}
-
-
-type_init(qauthz_pam_register_types);
--- a/authz/simple.c
+++ b/authz/simple.c
@@ -1,115 +0,0 @@
-/*
- * QEMU simple authorization driver
- *
- * Copyright (c) 2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "authz/simple.h"
-#include "authz/trace.h"
-#include "qom/object_interfaces.h"
-
-static bool qauthz_simple_is_allowed(QAuthZ *authz,
-                                     const char *identity,
-                                     Error **errp)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(authz);
-
-    trace_qauthz_simple_is_allowed(authz, sauthz->identity, identity);
-    return g_str_equal(identity, sauthz->identity);
-}
-
-static void
-qauthz_simple_prop_set_identity(Object *obj,
-                                const char *value,
-                                Error **errp G_GNUC_UNUSED)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    g_free(sauthz->identity);
-    sauthz->identity = g_strdup(value);
-}
-
-
-static char *
-qauthz_simple_prop_get_identity(Object *obj,
-                                Error **errp G_GNUC_UNUSED)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    return g_strdup(sauthz->identity);
-}
-
-
-static void
-qauthz_simple_finalize(Object *obj)
-{
-    QAuthZSimple *sauthz = QAUTHZ_SIMPLE(obj);
-
-    g_free(sauthz->identity);
-}
-
-
-static void
-qauthz_simple_class_init(ObjectClass *oc, void *data)
-{
-    QAuthZClass *authz = QAUTHZ_CLASS(oc);
-
-    authz->is_allowed = qauthz_simple_is_allowed;
-
-    object_class_property_add_str(oc, "identity",
-                                  qauthz_simple_prop_get_identity,
-                                  qauthz_simple_prop_set_identity,
-                                  NULL);
-}
-
-
-QAuthZSimple *qauthz_simple_new(const char *id,
-                                const char *identity,
-                                Error **errp)
-{
-    return QAUTHZ_SIMPLE(
-        object_new_with_props(TYPE_QAUTHZ_SIMPLE,
-                              object_get_objects_root(),
-                              id, errp,
-                              "identity", identity,
-                              NULL));
-}
-
-
-static const TypeInfo qauthz_simple_info = {
-    .parent = TYPE_QAUTHZ,
-    .name = TYPE_QAUTHZ_SIMPLE,
-    .instance_size = sizeof(QAuthZSimple),
-    .instance_finalize = qauthz_simple_finalize,
-    .class_size = sizeof(QAuthZSimpleClass),
-    .class_init = qauthz_simple_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-
-static void
-qauthz_simple_register_types(void)
-{
-    type_register_static(&qauthz_simple_info);
-}
-
-
-type_init(qauthz_simple_register_types);
--- a/authz/trace-events
+++ b/authz/trace-events
@@ -1,18 +0,0 @@
-# See docs/devel/tracing.txt for syntax documentation.
-
-# base.c
-qauthz_is_allowed(void *authz, const char *identity, bool allowed) "AuthZ %p check identity=%s allowed=%d"
-
-# simple.c
-qauthz_simple_is_allowed(void *authz, const char *wantidentity, const char *gotidentity) "AuthZ simple %p check want identity=%s got identity=%s"
-
-# list.c
-qauthz_list_check_rule(void *authz, const char *identity, const char *rule, int format, int policy) "AuthZ list %p check rule=%s identity=%s format=%d policy=%d"
-qauthz_list_default_policy(void *authz, const char *identity, int policy) "AuthZ list %p default identity=%s policy=%d"
-
-# listfile.c
-qauthz_list_file_load(void *authz, const char *filename) "AuthZ file %p load filename=%s"
-qauthz_list_file_refresh(void *authz, const char *filename, int success) "AuthZ file %p load filename=%s success=%d"
-
-# pamacct.c
-qauthz_pam_check(void *authz, const char *identity, const char *service) "AuthZ PAM %p identity=%s service=%s"
--- a/backends/Makefile.objs
+++ b/backends/Makefile.objs
@@ -9,9 +9,10 @@ common-obj-$(CONFIG_POSIX) += hostmem-file.o
 common-obj-y += cryptodev.o
 common-obj-y += cryptodev-builtin.o

-ifeq ($(CONFIG_VIRTIO_CRYPTO),y)
+ifeq ($(CONFIG_VIRTIO),y)
 common-obj-y += cryptodev-vhost.o
-common-obj-$(CONFIG_VHOST_CRYPTO) += cryptodev-vhost-user.o
+common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_LINUX)) += \
+    cryptodev-vhost-user.o
 endif

 common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -47,7 +47,7 @@
 typedef struct CryptoDevBackendVhostUser {
    CryptoDevBackend parent_obj;

-    VhostUserState vhost_user;
+    VhostUserState *vhost_user;
    CharBackend chr;
    char *chr_name;
    bool opened;
@@ -104,7 +104,7 @@ cryptodev_vhost_user_start(int queues,
            continue;
        }

-        options.opaque = &s->vhost_user;
+        options.opaque = s->vhost_user;
        options.backend_type = VHOST_BACKEND_TYPE_USER;
        options.cc = b->conf.peers.ccs[i];
        s->vhost_crypto[i] = cryptodev_vhost_init(&options);
@@ -182,6 +182,7 @@ static void cryptodev_vhost_user_init(
    size_t i;
    Error *local_err = NULL;
    Chardev *chr;
+    VhostUserState *user;
    CryptoDevBackendClient *cc;
    CryptoDevBackendVhostUser *s =
                      CRYPTODEV_BACKEND_VHOST_USER(backend);
@@ -212,10 +213,15 @@ static void cryptodev_vhost_user_init(
        }
    }

-    if (!vhost_user_init(&s->vhost_user, &s->chr, errp)) {
+    user = vhost_user_init();
+    if (!user) {
+        error_setg(errp, "Failed to init vhost_user");
        return;
    }

+    user->chr = &s->chr;
+    s->vhost_user = user;
+
    qemu_chr_fe_set_handlers(&s->chr, NULL, NULL,
                     cryptodev_vhost_user_event, NULL, s, NULL, true);

@@ -301,7 +307,11 @@ static void cryptodev_vhost_user_cleanup(
        }
    }

-    vhost_user_cleanup(&s->vhost_user);
+    if (s->vhost_user) {
+        vhost_user_cleanup(s->vhost_user);
+        g_free(s->vhost_user);
+        s->vhost_user = NULL;
+    }
 }

 static void cryptodev_vhost_user_set_chardev(Object *obj,
--- a/backends/hostmem-file.c
+++ b/backends/hostmem-file.c
@@ -41,12 +41,10 @@ struct HostMemoryBackendFile {
 static void
 file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
-#ifndef CONFIG_POSIX
-    error_setg(errp, "backend '%s' not supported on this host",
-               object_get_typename(OBJECT(backend)));
-#else
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(backend);
-    gchar *name;
+#ifdef CONFIG_POSIX
+    gchar *path;
+#endif

    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
@@ -56,38 +54,18 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
        error_setg(errp, "mem-path property not set");
        return;
    }
-
-    /*
-     * Verify pmem file size since starting a guest with an incorrect size
-     * leads to confusing failures inside the guest.
-     */
-    if (fb->is_pmem) {
-        Error *local_err = NULL;
-        uint64_t size;
-
-        size = qemu_get_pmem_size(fb->mem_path, &local_err);
-        if (!size) {
-            error_propagate(errp, local_err);
-            return;
-        }
-
-        if (backend->size > size) {
-            error_setg(errp, "size property %" PRIu64 " is larger than "
-                       "pmem file \"%s\" size %" PRIu64, backend->size,
-                       fb->mem_path, size);
-            return;
-        }
-    }
-
+#ifndef CONFIG_POSIX
+    error_setg(errp, "-mem-path not supported on this host");
+#else
    backend->force_prealloc = mem_prealloc;
-    name = host_memory_backend_get_name(backend);
+    path = object_get_canonical_path(OBJECT(backend));
    memory_region_init_ram_from_file(&backend->mr, OBJECT(backend),
-                                     name,
+                                     path,
                                     backend->size, fb->align,
                                     (backend->share ? RAM_SHARED : 0) |
                                     (fb->is_pmem ? RAM_PMEM : 0),
                                     fb->mem_path, errp);
-    g_free(name);
+    g_free(path);
 #endif
 }

@@ -104,8 +82,7 @@ static void set_mem_path(Object *o, const char *str, Error **errp)
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(errp, "cannot change property 'mem-path' of %s",
-                   object_get_typename(o));
+        error_setg(errp, "cannot change property value");
        return;
    }
    g_free(fb->mem_path);
@@ -143,8 +120,7 @@ static void file_memory_backend_set_align(Object *o, Visitor *v,
    uint64_t val;

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(&local_err, "cannot change property '%s' of %s",
-                   name, object_get_typename(o));
+        error_setg(&local_err, "cannot change property value");
        goto out;
    }

@@ -169,20 +145,26 @@ static void file_memory_backend_set_pmem(Object *o, bool value, Error **errp)
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

    if (host_memory_backend_mr_inited(backend)) {
+        char *path = object_get_canonical_path_component(o);

-        error_setg(errp, "cannot change property 'pmem' of %s.",
-                   object_get_typename(o));
+        error_setg(errp, "cannot change property 'pmem' of %s '%s'",
+                   object_get_typename(o),
+                   path);
+        g_free(path);
        return;
    }

 #ifndef CONFIG_LIBPMEM
    if (value) {
        Error *local_err = NULL;
+        char *path = object_get_canonical_path_component(o);

        error_setg(&local_err,
                   "Lack of libpmem support while setting the 'pmem=on'"
-                   " of %s. We can't ensure data persistence.",
-                   object_get_typename(o));
+                   " of %s '%s'. We can't ensure data persistence.",
+                   object_get_typename(o),
+                   path);
+        g_free(path);
        error_propagate(errp, local_err);
        return;
    }
--- a/backends/hostmem-memfd.c
+++ b/backends/hostmem-memfd.c
@@ -53,7 +53,7 @@ memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
        return;
    }

-    name = host_memory_backend_get_name(backend);
+    name = object_get_canonical_path(OBJECT(backend));
    memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
                                   name, backend->size,
                                   backend->share, fd, errp);
@@ -154,13 +154,15 @@ memfd_backend_class_init(ObjectClass *oc, void *data)
                                              "Huge pages size (ex: 2M, 1G)",
                                              &error_abort);
    }
-    object_class_property_add_bool(oc, "seal",
-                                   memfd_backend_get_seal,
-                                   memfd_backend_set_seal,
-                                   &error_abort);
-    object_class_property_set_description(oc, "seal",
-                                          "Seal growing & shrinking",
-                                          &error_abort);
+    if (qemu_memfd_check(MFD_ALLOW_SEALING)) {
+        object_class_property_add_bool(oc, "seal",
+                                       memfd_backend_get_seal,
+                                       memfd_backend_set_seal,
+                                       &error_abort);
+        object_class_property_set_description(oc, "seal",
+                                              "Seal growing & shrinking",
+                                              &error_abort);
+    }
 }

 static const TypeInfo memfd_backend_info = {
@@ -173,7 +175,7 @@ static const TypeInfo memfd_backend_info = {

 static void register_types(void)
 {
-    if (qemu_memfd_check(MFD_ALLOW_SEALING)) {
+    if (qemu_memfd_check(0)) {
        type_register_static(&memfd_backend_info);
    }
 }
--- a/backends/hostmem-ram.c
+++ b/backends/hostmem-ram.c
@@ -16,20 +16,21 @@

 #define TYPE_MEMORY_BACKEND_RAM "memory-backend-ram"

+
 static void
 ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 {
-    char *name;
+    char *path;

    if (!backend->size) {
        error_setg(errp, "can't create backend with size 0");
        return;
    }

-    name = host_memory_backend_get_name(backend);
-    memory_region_init_ram_shared_nomigrate(&backend->mr, OBJECT(backend), name,
+    path = object_get_canonical_path_component(OBJECT(backend));
+    memory_region_init_ram_shared_nomigrate(&backend->mr, OBJECT(backend), path,
                           backend->size, backend->share, errp);
-    g_free(name);
+    g_free(path);
 }

 static void
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -28,16 +28,6 @@ QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_BIND != MPOL_BIND);
 QEMU_BUILD_BUG_ON(HOST_MEM_POLICY_INTERLEAVE != MPOL_INTERLEAVE);
 #endif

-char *
-host_memory_backend_get_name(HostMemoryBackend *backend)
-{
-    if (!backend->use_canonical_path) {
-        return object_get_canonical_path_component(OBJECT(backend));
-    }
-
-    return object_get_canonical_path(OBJECT(backend));
-}
-
 static void
 host_memory_backend_get_size(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
@@ -57,8 +47,7 @@ host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
    uint64_t value;

    if (host_memory_backend_mr_inited(backend)) {
-        error_setg(&local_err, "cannot change property %s of %s ",
-                   name, object_get_typename(obj));
+        error_setg(&local_err, "cannot change property value");
        goto out;
    }

@@ -67,9 +56,8 @@ host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
        goto out;
    }
    if (!value) {
-        error_setg(&local_err,
-                   "property '%s' of %s doesn't take value '%" PRIu64 "'",
-                   name, object_get_typename(obj), value);
+        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
+                   PRIu64 "'", object_get_typename(obj), name, value);
        goto out;
    }
    backend->size = value;
@@ -88,7 +76,7 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,

    value = find_first_bit(backend->host_nodes, MAX_NODES);
    if (value == MAX_NODES) {
-        goto ret;
+        return;
    }

    *node = g_malloc0(sizeof(**node));
@@ -106,7 +94,6 @@ host_memory_backend_get_host_nodes(Object *obj, Visitor *v, const char *name,
        node = &(*node)->next;
    } while (true);

-ret:
    visit_type_uint16List(v, name, &host_nodes, errp);
 }

@@ -116,23 +103,14 @@ host_memory_backend_set_host_nodes(Object *obj, Visitor *v, const char *name,
 {
 #ifdef CONFIG_NUMA
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-    uint16List *l, *host_nodes = NULL;
+    uint16List *l = NULL;

-    visit_type_uint16List(v, name, &host_nodes, errp);
+    visit_type_uint16List(v, name, &l, errp);

-    for (l = host_nodes; l; l = l->next) {
-        if (l->value >= MAX_NODES) {
-            error_setg(errp, "Invalid host-nodes value: %d", l->value);
-            goto out;
-        }
-    }
-
-    for (l = host_nodes; l; l = l->next) {
+    while (l) {
        bitmap_set(backend->host_nodes, l->value, 1);
+        l = l->next;
    }
-
-out:
-    qapi_free_uint16List(host_nodes);
 #else
    error_setg(errp, "NUMA node binding are not supported by this QEMU");
 #endif
@@ -260,11 +238,6 @@ static void host_memory_backend_init(Object *obj)
    backend->prealloc = mem_prealloc;
 }

-static void host_memory_backend_post_init(Object *obj)
-{
-    object_apply_compat_props(obj);
-}
-
 bool host_memory_backend_mr_inited(HostMemoryBackend *backend)
 {
    /*
@@ -413,23 +386,6 @@ static void host_memory_backend_set_share(Object *o, bool value, Error **errp)
    backend->share = value;
 }

-static bool
-host_memory_backend_get_use_canonical_path(Object *obj, Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    return backend->use_canonical_path;
-}
-
-static void
-host_memory_backend_set_use_canonical_path(Object *obj, bool value,
-                                           Error **errp)
-{
-    HostMemoryBackend *backend = MEMORY_BACKEND(obj);
-
-    backend->use_canonical_path = value;
-}
-
 static void
 host_memory_backend_class_init(ObjectClass *oc, void *data)
 {
@@ -476,9 +432,6 @@ host_memory_backend_class_init(ObjectClass *oc, void *data)
        &error_abort);
    object_class_property_set_description(oc, "share",
        "Mark the memory as private to QEMU or shared", &error_abort);
-    object_class_property_add_bool(oc, "x-use-canonical-path-for-ramblock-id",
-        host_memory_backend_get_use_canonical_path,
-        host_memory_backend_set_use_canonical_path, &error_abort);
 }

 static const TypeInfo host_memory_backend_info = {
@@ -489,7 +442,6 @@ static const TypeInfo host_memory_backend_info = {
    .class_init = host_memory_backend_class_init,
    .instance_size = sizeof(HostMemoryBackend),
    .instance_init = host_memory_backend_init,
-    .instance_post_init = host_memory_backend_post_init,
    .interfaces = (InterfaceInfo[]) {
        { TYPE_USER_CREATABLE },
        { }
--- a/block.c
+++ b/block.c
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -57,8 +57,6 @@ ssh.o-libs         := $(LIBSSH2_LIBS)
 block-obj-dmg-bz2-$(CONFIG_BZIP2) += dmg-bz2.o
 block-obj-$(if $(CONFIG_DMG),m,n) += $(block-obj-dmg-bz2-y)
 dmg-bz2.o-libs     := $(BZIP2_LIBS)
-block-obj-$(if $(CONFIG_LZFSE),m,n) += dmg-lzfse.o
-dmg-lzfse.o-libs   := $(LZFSE_LIBS)
 qcow.o-libs        := -lz
 linux-aio.o-libs   := -laio
 parallels.o-cflags := $(LIBXML2_CFLAGS)
--- a/block/backup.c
+++ b/block/backup.c
@@ -28,13 +28,6 @@

 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)

-typedef struct CowRequest {
-    int64_t start_byte;
-    int64_t end_byte;
-    QLIST_ENTRY(CowRequest) list;
-    CoQueue wait_queue; /* coroutines blocked on this request */
-} CowRequest;
-
 typedef struct BackupBlockJob {
    BlockJob common;
    BlockBackend *target;
@@ -107,6 +100,7 @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
                                                      void **bounce_buffer)
 {
    int ret;
+    struct iovec iov;
    QEMUIOVector qiov;
    BlockBackend *blk = job->common.blk;
    int nbytes;
@@ -118,7 +112,9 @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
    if (!*bounce_buffer) {
        *bounce_buffer = blk_blockalign(blk, job->cluster_size);
    }
-    qemu_iovec_init_buf(&qiov, *bounce_buffer, nbytes);
+    iov.iov_base = *bounce_buffer;
+    iov.iov_len = nbytes;
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = blk_co_preadv(blk, start, qiov.size, &qiov, read_flags);
    if (ret < 0) {
@@ -326,6 +322,37 @@ void backup_do_checkpoint(BlockJob *job, Error **errp)
    hbitmap_set(backup_job->copy_bitmap, 0, len);
 }

+void backup_wait_for_overlapping_requests(BlockJob *job, int64_t offset,
+                                          uint64_t bytes)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t start, end;
+
+    assert(block_job_driver(job) == &backup_job_driver);
+
+    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
+    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    wait_for_overlapping_requests(backup_job, start, end);
+}
+
+void backup_cow_request_begin(CowRequest *req, BlockJob *job,
+                              int64_t offset, uint64_t bytes)
+{
+    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t start, end;
+
+    assert(block_job_driver(job) == &backup_job_driver);
+
+    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
+    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    cow_request_begin(req, backup_job, start, end);
+}
+
+void backup_cow_request_end(CowRequest *req)
+{
+    cow_request_end(req);
+}
+
 static void backup_drain(BlockJob *job)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
@@ -382,7 +409,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
    HBitmapIter hbi;

    hbitmap_iter_init(&hbi, job->copy_bitmap, 0);
-    while ((cluster = hbitmap_iter_next(&hbi)) != -1) {
+    while ((cluster = hbitmap_iter_next(&hbi, true)) != -1) {
        do {
            if (yield_and_check(job)) {
                return 0;
@@ -419,8 +446,7 @@ static void backup_incremental_init_copy_bitmap(BackupBlockJob *job)
            break;
        }

-        offset = bdrv_dirty_bitmap_next_zero(job->sync_bitmap, offset,
-                                             UINT64_MAX);
+        offset = bdrv_dirty_bitmap_next_zero(job->sync_bitmap, offset);
        if (offset == -1) {
            hbitmap_set(job->copy_bitmap, cluster, end - cluster);
            break;
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -401,7 +401,7 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
        (BDRV_REQ_FUA & bs->file->bs->supported_write_flags);
    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
-        ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
+        ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP) &
            bs->file->bs->supported_zero_flags);
    ret = -EINVAL;

@@ -811,37 +811,51 @@ static int64_t blkdebug_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

-static void blkdebug_refresh_filename(BlockDriverState *bs)
+static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkdebugState *s = bs->opaque;
+    QDict *opts;
    const QDictEntry *e;
-    int ret;
+    bool force_json = false;

-    if (!bs->file->bs->exact_filename[0]) {
-        return;
-    }
-
-    for (e = qdict_first(bs->full_open_options); e;
-         e = qdict_next(bs->full_open_options, e))
-    {
-        /* Real child options are under "image", but "x-image" may
-         * contain a filename */
+    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
        if (strcmp(qdict_entry_key(e), "config") &&
-            strcmp(qdict_entry_key(e), "image") &&
-            strcmp(qdict_entry_key(e), "x-image") &&
-            strcmp(qdict_entry_key(e), "driver"))
+            strcmp(qdict_entry_key(e), "x-image"))
        {
-            return;
+            force_json = true;
+            break;
        }
    }

-    ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                   "blkdebug:%s:%s",
-                   s->config_file ?: "", bs->file->bs->exact_filename);
-    if (ret >= sizeof(bs->exact_filename)) {
-        /* An overflow makes the filename unusable, so do not report any */
-        bs->exact_filename[0] = 0;
+    if (force_json && !bs->file->bs->full_open_options) {
+        /* The config file cannot be recreated, so creating a plain filename
+         * is impossible */
+        return;
    }
+
+    if (!force_json && bs->file->bs->exact_filename[0]) {
+        int ret = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                           "blkdebug:%s:%s", s->config_file ?: "",
+                           bs->file->bs->exact_filename);
+        if (ret >= sizeof(bs->exact_filename)) {
+            /* An overflow makes the filename unusable, so do not report any */
+            bs->exact_filename[0] = 0;
+        }
+    }
+
+    opts = qdict_new();
+    qdict_put_str(opts, "driver", "blkdebug");
+
+    qdict_put(opts, "image", qobject_ref(bs->file->bs->full_open_options));
+
+    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
+        if (strcmp(qdict_entry_key(e), "x-image")) {
+            qdict_put_obj(opts, qdict_entry_key(e),
+                          qobject_ref(qdict_entry_value(e)));
+        }
+    }
+
+    bs->full_open_options = opts;
 }

 static void blkdebug_refresh_limits(BlockDriverState *bs, Error **errp)
@@ -874,20 +888,6 @@ static int blkdebug_reopen_prepare(BDRVReopenState *reopen_state,
    return 0;
 }

-static const char *const blkdebug_strong_runtime_opts[] = {
-    "config",
-    "inject-error.",
-    "set-state.",
-    "align",
-    "max-transfer",
-    "opt-write-zero",
-    "max-write-zero",
-    "opt-discard",
-    "max-discard",
-
-    NULL
-};
-
 static BlockDriver bdrv_blkdebug = {
    .format_name            = "blkdebug",
    .protocol_name          = "blkdebug",
@@ -917,8 +917,6 @@ static BlockDriver bdrv_blkdebug = {
                                = blkdebug_debug_remove_breakpoint,
    .bdrv_debug_resume          = blkdebug_debug_resume,
    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
-
-    .strong_runtime_opts        = blkdebug_strong_runtime_opts,
 };

 static void bdrv_blkdebug_init(void)
--- a/block/blklogwrites.c
+++ b/block/blklogwrites.c
@@ -280,6 +280,31 @@ static int64_t blk_log_writes_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

+static void blk_log_writes_refresh_filename(BlockDriverState *bs,
+                                            QDict *options)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+
+    /* bs->file->bs has already been refreshed */
+    bdrv_refresh_filename(s->log_file->bs);
+
+    if (bs->file->bs->full_open_options
+        && s->log_file->bs->full_open_options)
+    {
+        QDict *opts = qdict_new();
+        qdict_put_str(opts, "driver", "blklogwrites");
+
+        qobject_ref(bs->file->bs->full_open_options);
+        qdict_put_obj(opts, "file", QOBJECT(bs->file->bs->full_open_options));
+        qobject_ref(s->log_file->bs->full_open_options);
+        qdict_put_obj(opts, "log",
+                      QOBJECT(s->log_file->bs->full_open_options));
+        qdict_put_int(opts, "log-sector-size", s->sectorsize);
+
+        bs->full_open_options = opts;
+    }
+}
+
 static void blk_log_writes_child_perm(BlockDriverState *bs, BdrvChild *c,
                                      const BdrvChildRole *role,
                                      BlockReopenQueue *ro_q,
@@ -496,13 +521,6 @@ blk_log_writes_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
                                 LOG_DISCARD_FLAG, false);
 }

-static const char *const blk_log_writes_strong_runtime_opts[] = {
-    "log-append",
-    "log-sector-size",
-
-    NULL
-};
-
 static BlockDriver bdrv_blk_log_writes = {
    .format_name            = "blklogwrites",
    .instance_size          = sizeof(BDRVBlkLogWritesState),
@@ -510,6 +528,7 @@ static BlockDriver bdrv_blk_log_writes = {
    .bdrv_open              = blk_log_writes_open,
    .bdrv_close             = blk_log_writes_close,
    .bdrv_getlength         = blk_log_writes_getlength,
+    .bdrv_refresh_filename  = blk_log_writes_refresh_filename,
    .bdrv_child_perm        = blk_log_writes_child_perm,
    .bdrv_refresh_limits    = blk_log_writes_refresh_limits,

@@ -521,7 +540,6 @@ static BlockDriver bdrv_blk_log_writes = {
    .bdrv_co_block_status   = bdrv_co_block_status_from_file,

    .is_filter              = true,
-    .strong_runtime_opts    = blk_log_writes_strong_runtime_opts,
 };

 static void bdrv_blk_log_writes_init(void)
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -281,10 +281,27 @@ static bool blkverify_recurse_is_first_non_filter(BlockDriverState *bs,
    return bdrv_recurse_is_first_non_filter(s->test_file->bs, candidate);
 }

-static void blkverify_refresh_filename(BlockDriverState *bs)
+static void blkverify_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVBlkverifyState *s = bs->opaque;

+    /* bs->file->bs has already been refreshed */
+    bdrv_refresh_filename(s->test_file->bs);
+
+    if (bs->file->bs->full_open_options
+        && s->test_file->bs->full_open_options)
+    {
+        QDict *opts = qdict_new();
+        qdict_put_str(opts, "driver", "blkverify");
+
+        qdict_put(opts, "raw",
+                  qobject_ref(bs->file->bs->full_open_options));
+        qdict_put(opts, "test",
+                  qobject_ref(s->test_file->bs->full_open_options));
+
+        bs->full_open_options = opts;
+    }
+
    if (bs->file->bs->exact_filename[0]
        && s->test_file->bs->exact_filename[0])
    {
@@ -299,15 +316,6 @@ static void blkverify_refresh_filename(BlockDriverState *bs)
    }
 }

-static char *blkverify_dirname(BlockDriverState *bs, Error **errp)
-{
-    /* In general, there are two BDSs with different dirnames below this one;
-     * so there is no unique dirname we could return (unless both are equal by
-     * chance). Therefore, to be consistent, just always return NULL. */
-    error_setg(errp, "Cannot generate a base directory for blkverify nodes");
-    return NULL;
-}
-
 static BlockDriver bdrv_blkverify = {
    .format_name                      = "blkverify",
    .protocol_name                    = "blkverify",
@@ -319,7 +327,6 @@ static BlockDriver bdrv_blkverify = {
    .bdrv_child_perm                  = bdrv_filter_default_perms,
    .bdrv_getlength                   = blkverify_getlength,
    .bdrv_refresh_filename            = blkverify_refresh_filename,
-    .bdrv_dirname                     = blkverify_dirname,

    .bdrv_co_preadv                   = blkverify_co_preadv,
    .bdrv_co_pwritev                  = blkverify_co_pwritev,
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -47,7 +47,9 @@ struct BlockBackend {
    QTAILQ_ENTRY(BlockBackend) monitor_link; /* for monitor_block_backends */
    BlockBackendPublic public;

-    DeviceState *dev;           /* attached device model, if any */
+    void *dev;                  /* attached device model, if any */
+    bool legacy_dev;            /* true if dev is not a DeviceState */
+    /* TODO change to DeviceState when all users are qdevified */
    const BlockDevOps *dev_ops;
    void *dev_opaque;

@@ -834,11 +836,7 @@ void blk_get_perm(BlockBackend *blk, uint64_t *perm, uint64_t *shared_perm)
    *shared_perm = blk->shared_perm;
 }

-/*
- * Attach device model @dev to @blk.
- * Return 0 on success, -EBUSY when a device model is attached already.
- */
-int blk_attach_dev(BlockBackend *blk, DeviceState *dev)
+static int blk_do_attach_dev(BlockBackend *blk, void *dev)
 {
    if (blk->dev) {
        return -EBUSY;
@@ -853,16 +851,40 @@ int blk_attach_dev(BlockBackend *blk, DeviceState *dev)

    blk_ref(blk);
    blk->dev = dev;
+    blk->legacy_dev = false;
    blk_iostatus_reset(blk);

    return 0;
 }

+/*
+ * Attach device model @dev to @blk.
+ * Return 0 on success, -EBUSY when a device model is attached already.
+ */
+int blk_attach_dev(BlockBackend *blk, DeviceState *dev)
+{
+    return blk_do_attach_dev(blk, dev);
+}
+
+/*
+ * Attach device model @dev to @blk.
+ * @blk must not have a device model attached already.
+ * TODO qdevified devices don't use this, remove when devices are qdevified
+ */
+void blk_attach_dev_legacy(BlockBackend *blk, void *dev)
+{
+    if (blk_do_attach_dev(blk, dev) < 0) {
+        abort();
+    }
+    blk->legacy_dev = true;
+}
+
 /*
 * Detach device model @dev from @blk.
 * @dev must be currently attached to @blk.
 */
-void blk_detach_dev(BlockBackend *blk, DeviceState *dev)
+void blk_detach_dev(BlockBackend *blk, void *dev)
+/* TODO change to DeviceState *dev when all users are qdevified */
 {
    assert(blk->dev == dev);
    blk->dev = NULL;
@@ -876,7 +898,8 @@ void blk_detach_dev(BlockBackend *blk, DeviceState *dev)
 /*
 * Return the device model attached to @blk if any, else null.
 */
-DeviceState *blk_get_attached_dev(BlockBackend *blk)
+void *blk_get_attached_dev(BlockBackend *blk)
+/* TODO change to return DeviceState * when all users are qdevified */
 {
    return blk->dev;
 }
@@ -885,7 +908,10 @@ DeviceState *blk_get_attached_dev(BlockBackend *blk)
 * device attached to the BlockBackend. */
 char *blk_get_attached_dev_id(BlockBackend *blk)
 {
-    DeviceState *dev = blk->dev;
+    DeviceState *dev;
+
+    assert(!blk->legacy_dev);
+    dev = blk->dev;

    if (!dev) {
        return g_strdup("");
@@ -923,6 +949,11 @@ BlockBackend *blk_by_dev(void *dev)
 void blk_set_dev_ops(BlockBackend *blk, const BlockDevOps *ops,
                     void *opaque)
 {
+    /* All drivers that use blk_set_dev_ops() are qdevified and we want to keep
+     * it that way, so we can assume blk->dev, if present, is a DeviceState if
+     * blk->dev_ops is set. Non-device users may use dev_ops without device. */
+    assert(!blk->legacy_dev);
+
    blk->dev_ops = ops;
    blk->dev_opaque = opaque;

@@ -948,6 +979,8 @@ void blk_dev_change_media_cb(BlockBackend *blk, bool load, Error **errp)
        bool tray_was_open, tray_is_open;
        Error *local_err = NULL;

+        assert(!blk->legacy_dev);
+
        tray_was_open = blk_dev_is_tray_open(blk);
        blk->dev_ops->change_media_cb(blk->dev_opaque, load, &local_err);
        if (local_err) {
@@ -1204,8 +1237,17 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
                   int64_t bytes, CoroutineEntry co_entry,
                   BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-    BlkRwCo rwco = {
+    QEMUIOVector qiov;
+    struct iovec iov;
+    BlkRwCo rwco;
+
+    iov = (struct iovec) {
+        .iov_base = buf,
+        .iov_len = bytes,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
+    rwco = (BlkRwCo) {
        .blk    = blk,
        .offset = offset,
        .iobuf  = &qiov,
@@ -1253,12 +1295,12 @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
    return bdrv_make_zero(blk->root, flags);
 }

-void blk_inc_in_flight(BlockBackend *blk)
+static void blk_inc_in_flight(BlockBackend *blk)
 {
    atomic_inc(&blk->in_flight);
 }

-void blk_dec_in_flight(BlockBackend *blk)
+static void blk_dec_in_flight(BlockBackend *blk)
 {
    atomic_dec(&blk->in_flight);
    aio_wait_kick();
@@ -1741,6 +1783,9 @@ void blk_eject(BlockBackend *blk, bool eject_flag)
    BlockDriverState *bs = blk_bs(blk);
    char *id;

+    /* blk_eject is only called by qdevified devices */
+    assert(!blk->legacy_dev);
+
    if (bs) {
        bdrv_eject(bs, eject_flag);
    }
@@ -2209,8 +2254,3 @@ int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
                              blk_out->root, off_out,
                              bytes, read_flags, write_flags);
 }
-
-const BdrvChild *blk_root(BlockBackend *blk)
-{
-    return blk->root;
-}
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -85,14 +85,14 @@ static int bochs_probe(const uint8_t *buf, int buf_size, const char *filename)
    const struct bochs_header *bochs = (const void *)buf;

    if (buf_size < HEADER_SIZE)
-        return 0;
+	return 0;

    if (!strcmp(bochs->magic, HEADER_MAGIC) &&
-        !strcmp(bochs->type, REDOLOG_TYPE) &&
-        !strcmp(bochs->subtype, GROWING_TYPE) &&
-        ((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
-        (le32_to_cpu(bochs->version) == HEADER_V1)))
-        return 100;
+	!strcmp(bochs->type, REDOLOG_TYPE) &&
+	!strcmp(bochs->subtype, GROWING_TYPE) &&
+	((le32_to_cpu(bochs->version) == HEADER_VERSION) ||
+	(le32_to_cpu(bochs->version) == HEADER_V1)))
+	return 100;

    return 0;
 }
@@ -125,8 +125,8 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
    if (strcmp(bochs.magic, HEADER_MAGIC) ||
        strcmp(bochs.type, REDOLOG_TYPE) ||
        strcmp(bochs.subtype, GROWING_TYPE) ||
-        ((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
-        (le32_to_cpu(bochs.version) != HEADER_V1))) {
+	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
+	(le32_to_cpu(bochs.version) != HEADER_V1))) {
        error_setg(errp, "Image not in Bochs format");
        return -EINVAL;
    }
@@ -158,7 +158,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
    }

    for (i = 0; i < s->catalog_size; i++)
-        le32_to_cpus(&s->catalog_bitmap[i]);
+	le32_to_cpus(&s->catalog_bitmap[i]);

    s->data_offset = le32_to_cpu(bochs.header) + (s->catalog_size * 4);

@@ -217,7 +217,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    extent_offset = (offset % s->extent_size) / 512;

    if (s->catalog_bitmap[extent_index] == 0xffffffff) {
-        return 0; /* not allocated */
+	return 0; /* not allocated */
    }

    bitmap_offset = s->data_offset +
@@ -232,7 +232,7 @@ static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
    }

    if (!((bitmap_entry >> (extent_offset % 8)) & 1)) {
-        return 0; /* not allocated */
+	return 0; /* not allocated */
    }

    return bitmap_offset + (512 * (s->bitmap_blocks + extent_offset));
--- a/block/commit.c
+++ b/block/commit.c
@@ -38,8 +38,7 @@ typedef struct CommitBlockJob {
    BlockBackend *base;
    BlockDriverState *base_bs;
    BlockdevOnError on_error;
-    bool base_read_only;
-    bool chain_frozen;
+    int base_flags;
    char *backing_file_str;
 } CommitBlockJob;

@@ -48,9 +47,14 @@ static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
                                        void *buf)
 {
    int ret = 0;
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = buf,
+        .iov_len = bytes,
+    };

    assert(bytes < SIZE_MAX);
+    qemu_iovec_init_external(&qiov, &iov, 1);

    ret = blk_co_preadv(bs, offset, qiov.size, &qiov, 0);
    if (ret < 0) {
@@ -69,9 +73,6 @@ static int commit_prepare(Job *job)
 {
    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);

-    bdrv_unfreeze_backing_chain(s->commit_top_bs, s->base_bs);
-    s->chain_frozen = false;
-
    /* Remove base node parent that still uses BLK_PERM_WRITE/RESIZE before
     * the normal backing chain can be restored. */
    blk_unref(s->base);
@@ -88,10 +89,6 @@ static void commit_abort(Job *job)
    CommitBlockJob *s = container_of(job, CommitBlockJob, common.job);
    BlockDriverState *top_bs = blk_bs(s->top);

-    if (s->chain_frozen) {
-        bdrv_unfreeze_backing_chain(s->commit_top_bs, s->base_bs);
-    }
-
    /* Make sure commit_top_bs and top stay around until bdrv_replace_node() */
    bdrv_ref(top_bs);
    bdrv_ref(s->commit_top_bs);
@@ -127,8 +124,8 @@ static void commit_clean(Job *job)
    /* restore base open flags here if appropriate (e.g., change the base back
     * to r/o). These reopens do not need to be atomic, since we won't abort
     * even on failure here */
-    if (s->base_read_only) {
-        bdrv_reopen_set_read_only(s->base_bs, true, NULL);
+    if (s->base_flags != bdrv_get_flags(s->base_bs)) {
+        bdrv_reopen(s->base_bs, s->base_flags, NULL);
    }

    g_free(s->backing_file_str);
@@ -233,8 +230,9 @@ static int coroutine_fn bdrv_commit_top_preadv(BlockDriverState *bs,
    return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
 }

-static void bdrv_commit_top_refresh_filename(BlockDriverState *bs)
+static void bdrv_commit_top_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
+    bdrv_refresh_filename(bs->backing->bs);
    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
            bs->backing->bs->filename);
 }
@@ -266,6 +264,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
                  const char *filter_node_name, Error **errp)
 {
    CommitBlockJob *s;
+    int orig_base_flags;
    BlockDriverState *iter;
    BlockDriverState *commit_top_bs = NULL;
    Error *local_err = NULL;
@@ -284,9 +283,11 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    }

    /* convert base to r/w, if necessary */
-    s->base_read_only = bdrv_is_read_only(base);
-    if (s->base_read_only) {
-        if (bdrv_reopen_set_read_only(base, false, errp) != 0) {
+    orig_base_flags = bdrv_get_flags(base);
+    if (!(orig_base_flags & BDRV_O_RDWR)) {
+        bdrv_reopen(base, orig_base_flags | BDRV_O_RDWR, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
            goto fail;
        }
    }
@@ -338,11 +339,6 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        }
    }

-    if (bdrv_freeze_backing_chain(commit_top_bs, base, errp) < 0) {
-        goto fail;
-    }
-    s->chain_frozen = true;
-
    ret = block_job_add_bdrv(&s->common, "base", base, 0, BLK_PERM_ALL, errp);
    if (ret < 0) {
        goto fail;
@@ -367,6 +363,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

+    s->base_flags = orig_base_flags;
    s->backing_file_str = g_strdup(backing_file_str);
    s->on_error = on_error;

@@ -375,21 +372,16 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    return;

 fail:
-    if (s->chain_frozen) {
-        bdrv_unfreeze_backing_chain(commit_top_bs, base);
-    }
    if (s->base) {
        blk_unref(s->base);
    }
    if (s->top) {
        blk_unref(s->top);
    }
-    job_early_fail(&s->common.job);
-    /* commit_top_bs has to be replaced after deleting the block job,
-     * otherwise this would fail because of lack of permissions. */
    if (commit_top_bs) {
        bdrv_replace_node(commit_top_bs, top, &error_abort);
    }
+    job_early_fail(&s->common.job);
 }


@@ -403,7 +395,7 @@ int bdrv_commit(BlockDriverState *bs)
    BlockDriverState *commit_top_bs = NULL;
    BlockDriver *drv = bs->drv;
    int64_t offset, length, backing_length;
-    int ro;
+    int ro, open_flags;
    int64_t n;
    int ret = 0;
    uint8_t *buf = NULL;
@@ -422,9 +414,10 @@ int bdrv_commit(BlockDriverState *bs)
    }

    ro = bs->backing->bs->read_only;
+    open_flags =  bs->backing->bs->open_flags;

    if (ro) {
-        if (bdrv_reopen_set_read_only(bs->backing->bs, false, NULL)) {
+        if (bdrv_reopen(bs->backing->bs, open_flags | BDRV_O_RDWR, NULL)) {
            return -EACCES;
        }
    }
@@ -534,7 +527,7 @@ ro_cleanup:

    if (ro) {
        /* ignoring error return here */
-        bdrv_reopen_set_read_only(bs->backing->bs, true, NULL);
+        bdrv_reopen(bs->backing->bs, open_flags & ~BDRV_O_RDWR, NULL);
    }

    return ret;
--- a/block/copy-on-read.c
+++ b/block/copy-on-read.c
@@ -34,11 +34,12 @@ static int cor_open(BlockDriverState *bs, QDict *options, int flags,
    }

    bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED |
-        (BDRV_REQ_FUA & bs->file->bs->supported_write_flags);
+                                (BDRV_REQ_FUA &
+                                    bs->file->bs->supported_write_flags);

    bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
-        ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK) &
-            bs->file->bs->supported_zero_flags);
+                               ((BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP) &
+                                    bs->file->bs->supported_zero_flags);

    return 0;
 }
@@ -133,7 +134,7 @@ static bool cor_recurse_is_first_non_filter(BlockDriverState *bs,
 }


-static BlockDriver bdrv_copy_on_read = {
+BlockDriver bdrv_copy_on_read = {
    .format_name                        = "copy-on-read",

    .bdrv_open                          = cor_open,
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -229,7 +229,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
                                       block_crypto_read_func,
                                       bs,
                                       cflags,
-                                       1,
                                       errp);

    if (!crypto->block) {
@@ -594,17 +593,20 @@ static int block_crypto_get_info_luks(BlockDriverState *bs,
 }

 static ImageInfoSpecific *
-block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp)
+block_crypto_get_specific_info_luks(BlockDriverState *bs)
 {
    BlockCrypto *crypto = bs->opaque;
    ImageInfoSpecific *spec_info;
    QCryptoBlockInfo *info;

-    info = qcrypto_block_get_info(crypto->block, errp);
+    info = qcrypto_block_get_info(crypto->block, NULL);
    if (!info) {
        return NULL;
    }
-    assert(info->format == Q_CRYPTO_BLOCK_FORMAT_LUKS);
+    if (info->format != Q_CRYPTO_BLOCK_FORMAT_LUKS) {
+        qapi_free_QCryptoBlockInfo(info);
+        return NULL;
+    }

    spec_info = g_new(ImageInfoSpecific, 1);
    spec_info->type = IMAGE_INFO_SPECIFIC_KIND_LUKS;
@@ -619,13 +621,7 @@ block_crypto_get_specific_info_luks(BlockDriverState *bs, Error **errp)
    return spec_info;
 }

-static const char *const block_crypto_strong_runtime_opts[] = {
-    BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
-
-    NULL
-};
-
-static BlockDriver bdrv_crypto_luks = {
+BlockDriver bdrv_crypto_luks = {
    .format_name        = "luks",
    .instance_size      = sizeof(BlockCrypto),
    .bdrv_probe         = block_crypto_probe_luks,
@@ -646,8 +642,6 @@ static BlockDriver bdrv_crypto_luks = {
    .bdrv_getlength     = block_crypto_getlength,
    .bdrv_get_info      = block_crypto_get_info_luks,
    .bdrv_get_specific_info = block_crypto_get_specific_info_luks,
-
-    .strong_runtime_opts = block_crypto_strong_runtime_opts,
 };

 static void block_crypto_init(void)
--- a/block/curl.c
+++ b/block/curl.c
@@ -32,10 +32,22 @@
 #include "crypto/secret.h"
 #include <curl/curl.h>
 #include "qemu/cutils.h"
-#include "trace.h"

+// #define DEBUG_CURL
 // #define DEBUG_VERBOSE

+#ifdef DEBUG_CURL
+#define DEBUG_CURL_PRINT 1
+#else
+#define DEBUG_CURL_PRINT 0
+#endif
+#define DPRINTF(fmt, ...)                                            \
+    do {                                                             \
+        if (DEBUG_CURL_PRINT) {                                      \
+            fprintf(stderr, fmt, ## __VA_ARGS__);                    \
+        }                                                            \
+    } while (0)
+
 #if LIBCURL_VERSION_NUM >= 0x071000
 /* The multi interface timer callback was introduced in 7.16.0 */
 #define NEED_CURL_TIMER_CALLBACK
@@ -61,6 +73,8 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,

 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
+#define READ_AHEAD_DEFAULT (256 * 1024)
+#define CURL_TIMEOUT_DEFAULT 5
 #define CURL_TIMEOUT_MAX 10000

 #define CURL_BLOCK_OPT_URL       "url"
@@ -74,10 +88,6 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 #define CURL_BLOCK_OPT_PROXY_USERNAME "proxy-username"
 #define CURL_BLOCK_OPT_PROXY_PASSWORD_SECRET "proxy-password-secret"

-#define CURL_BLOCK_OPT_READAHEAD_DEFAULT (256 * 1024)
-#define CURL_BLOCK_OPT_SSLVERIFY_DEFAULT true
-#define CURL_BLOCK_OPT_TIMEOUT_DEFAULT 5
-
 struct BDRVCURLState;

 static bool libcurl_initialized;
@@ -144,7 +154,7 @@ static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
 {
    BDRVCURLState *s = opaque;

-    trace_curl_timer_cb(timeout_ms);
+    DPRINTF("CURL: timer callback timeout_ms %ld\n", timeout_ms);
    if (timeout_ms == -1) {
        timer_del(&s->timer);
    } else {
@@ -183,7 +193,7 @@ static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
    }
    socket = NULL;

-    trace_curl_sock_cb(action, (int)fd);
+    DPRINTF("CURL (AIO): Sock action %d on fd %d\n", action, (int)fd);
    switch (action) {
        case CURL_POLL_IN:
            aio_set_fd_handler(s->aio_context, fd, false,
@@ -228,7 +238,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
    size_t realsize = size * nmemb;
    int i;

-    trace_curl_read_cb(realsize);
+    DPRINTF("CURL: Just reading %zd bytes\n", realsize);

    if (!s || !s->orig_buf) {
        goto read_end;
@@ -698,7 +708,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    s->readahead_size = qemu_opt_get_size(opts, CURL_BLOCK_OPT_READAHEAD,
-                                          CURL_BLOCK_OPT_READAHEAD_DEFAULT);
+                                          READ_AHEAD_DEFAULT);
    if ((s->readahead_size & 0x1ff) != 0) {
        error_setg(errp, "HTTP_READAHEAD_SIZE %zd is not a multiple of 512",
                   s->readahead_size);
@@ -706,14 +716,13 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    s->timeout = qemu_opt_get_number(opts, CURL_BLOCK_OPT_TIMEOUT,
-                                     CURL_BLOCK_OPT_TIMEOUT_DEFAULT);
+                                     CURL_TIMEOUT_DEFAULT);
    if (s->timeout > CURL_TIMEOUT_MAX) {
        error_setg(errp, "timeout parameter is too large or negative");
        goto out_noclean;
    }

-    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY,
-                                     CURL_BLOCK_OPT_SSLVERIFY_DEFAULT);
+    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY, true);

    cookie = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE);
    cookie_secret = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE_SECRET);
@@ -768,7 +777,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
        }
    }

-    trace_curl_open(file);
+    DPRINTF("CURL: Opening %s\n", file);
    qemu_co_queue_init(&s->free_state_waitq);
    s->aio_context = bdrv_get_aio_context(bs);
    s->url = g_strdup(file);
@@ -821,7 +830,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
                "Server does not support 'range' (byte ranges).");
        goto out;
    }
-    trace_curl_open_size(s->len);
+    DPRINTF("CURL: Size = %" PRIu64 "\n", s->len);

    qemu_mutex_lock(&s->mutex);
    curl_clean_state(state);
@@ -899,7 +908,8 @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
    state->acb[0] = acb;

    snprintf(state->range, 127, "%" PRIu64 "-%" PRIu64, start, end);
-    trace_curl_setup_preadv(acb->bytes, start, state->range);
+    DPRINTF("CURL (AIO): Reading %" PRIu64 " at %" PRIu64 " (%s)\n",
+            acb->bytes, start, state->range);
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
@@ -933,7 +943,7 @@ static void curl_close(BlockDriverState *bs)
 {
    BDRVCURLState *s = bs->opaque;

-    trace_curl_close();
+    DPRINTF("CURL: Close\n");
    curl_detach_aio_context(bs);
    qemu_mutex_destroy(&s->mutex);

@@ -950,36 +960,6 @@ static int64_t curl_getlength(BlockDriverState *bs)
    return s->len;
 }

-static void curl_refresh_filename(BlockDriverState *bs)
-{
-    BDRVCURLState *s = bs->opaque;
-
-    /* "readahead" and "timeout" do not change the guest-visible data,
-     * so ignore them */
-    if (s->sslverify != CURL_BLOCK_OPT_SSLVERIFY_DEFAULT ||
-        s->cookie || s->username || s->password || s->proxyusername ||
-        s->proxypassword)
-    {
-        return;
-    }
-
-    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), s->url);
-}
-
-
-static const char *const curl_strong_runtime_opts[] = {
-    CURL_BLOCK_OPT_URL,
-    CURL_BLOCK_OPT_SSLVERIFY,
-    CURL_BLOCK_OPT_COOKIE,
-    CURL_BLOCK_OPT_COOKIE_SECRET,
-    CURL_BLOCK_OPT_USERNAME,
-    CURL_BLOCK_OPT_PASSWORD_SECRET,
-    CURL_BLOCK_OPT_PROXY_USERNAME,
-    CURL_BLOCK_OPT_PROXY_PASSWORD_SECRET,
-
-    NULL
-};
-
 static BlockDriver bdrv_http = {
    .format_name                = "http",
    .protocol_name              = "http",
@@ -994,9 +974,6 @@ static BlockDriver bdrv_http = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_https = {
@@ -1013,9 +990,6 @@ static BlockDriver bdrv_https = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_ftp = {
@@ -1032,9 +1006,6 @@ static BlockDriver bdrv_ftp = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static BlockDriver bdrv_ftps = {
@@ -1051,9 +1022,6 @@ static BlockDriver bdrv_ftps = {

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
-
-    .bdrv_refresh_filename      = curl_refresh_filename,
-    .strong_runtime_opts        = curl_strong_runtime_opts,
 };

 static void curl_block_init(void)
--- a/block/dirty-bitmap.c
+++ b/block/dirty-bitmap.c
@@ -28,12 +28,21 @@
 #include "block/block_int.h"
 #include "block/blockjob.h"

+/**
+ * A BdrvDirtyBitmap can be in three possible states:
+ * (1) successor is NULL and disabled is false: full r/w mode
+ * (2) successor is NULL and disabled is true: read only mode ("disabled")
+ * (3) successor is set: frozen mode.
+ *     A frozen bitmap cannot be renamed, deleted, anonymized, cleared, set,
+ *     or enabled. A frozen bitmap can only abdicate() or reclaim().
+ */
 struct BdrvDirtyBitmap {
    QemuMutex *mutex;
    HBitmap *bitmap;            /* Dirty bitmap implementation */
    HBitmap *meta;              /* Meta dirty bitmap */
-    bool busy;                  /* Bitmap is busy, it can't be used via QMP */
-    BdrvDirtyBitmap *successor; /* Anonymous child, if any. */
+    bool qmp_locked;            /* Bitmap is locked, it can't be modified
+                                   through QMP */
+    BdrvDirtyBitmap *successor; /* Anonymous child; implies frozen status */
    char *name;                 /* Optional non-empty unique ID */
    int64_t size;               /* Size of the bitmap, in bytes */
    bool disabled;              /* Bitmap is disabled. It ignores all writes to
@@ -46,9 +55,6 @@ struct BdrvDirtyBitmap {
                                   and this bitmap must remain unchanged while
                                   this flag is set. */
    bool persistent;            /* bitmap must be saved to owner disk image */
-    bool inconsistent;          /* bitmap is persistent, but inconsistent.
-                                   It cannot be used at all in any way, except
-                                   a QMP user can remove it. */
    bool migration;             /* Bitmap is selected for migration, it should
                                   not be stored on the next inactivation
                                   (persistent flag doesn't matter until next
@@ -169,58 +175,41 @@ const char *bdrv_dirty_bitmap_name(const BdrvDirtyBitmap *bitmap)
 }

 /* Called with BQL taken.  */
-bool bdrv_dirty_bitmap_has_successor(BdrvDirtyBitmap *bitmap)
+bool bdrv_dirty_bitmap_frozen(BdrvDirtyBitmap *bitmap)
 {
    return bitmap->successor;
 }

-static bool bdrv_dirty_bitmap_busy(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->busy;
+/* Both conditions disallow user-modification via QMP. */
+bool bdrv_dirty_bitmap_user_locked(BdrvDirtyBitmap *bitmap) {
+    return bdrv_dirty_bitmap_frozen(bitmap) ||
+           bdrv_dirty_bitmap_qmp_locked(bitmap);
 }

-void bdrv_dirty_bitmap_set_busy(BdrvDirtyBitmap *bitmap, bool busy)
+void bdrv_dirty_bitmap_set_qmp_locked(BdrvDirtyBitmap *bitmap, bool qmp_locked)
 {
    qemu_mutex_lock(bitmap->mutex);
-    bitmap->busy = busy;
+    bitmap->qmp_locked = qmp_locked;
    qemu_mutex_unlock(bitmap->mutex);
 }

+bool bdrv_dirty_bitmap_qmp_locked(BdrvDirtyBitmap *bitmap)
+{
+    return bitmap->qmp_locked;
+}
+
 /* Called with BQL taken.  */
 bool bdrv_dirty_bitmap_enabled(BdrvDirtyBitmap *bitmap)
 {
-    return !bitmap->disabled;
+    return !(bitmap->disabled || bitmap->successor);
 }

-/**
- * bdrv_dirty_bitmap_status: This API is now deprecated.
- * Called with BQL taken.
- *
- * A BdrvDirtyBitmap can be in four possible user-visible states:
- * (1) Active:   successor is NULL, and disabled is false: full r/w mode
- * (2) Disabled: successor is NULL, and disabled is true: qualified r/w mode,
- *               guest writes are dropped, but monitor writes are possible,
- *               through commands like merge and clear.
- * (3) Frozen:   successor is not NULL.
- *               A frozen bitmap cannot be renamed, deleted, cleared, set,
- *               enabled, merged to, etc. A frozen bitmap can only abdicate()
- *               or reclaim().
- *               In this state, the anonymous successor bitmap may be either
- *               Active and recording writes from the guest (e.g. backup jobs),
- *               or it can be Disabled and not recording writes.
- * (4) Locked:   Whether Active or Disabled, the user cannot modify this bitmap
- *               in any way from the monitor.
- * (5) Inconsistent: This is a persistent bitmap whose "in use" bit is set, and
- *                   is unusable by QEMU. It can be deleted to remove it from
- *                   the qcow2.
- */
+/* Called with BQL taken.  */
 DirtyBitmapStatus bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap)
 {
-    if (bdrv_dirty_bitmap_inconsistent(bitmap)) {
-        return DIRTY_BITMAP_STATUS_INCONSISTENT;
-    } else if (bdrv_dirty_bitmap_has_successor(bitmap)) {
+    if (bdrv_dirty_bitmap_frozen(bitmap)) {
        return DIRTY_BITMAP_STATUS_FROZEN;
-    } else if (bdrv_dirty_bitmap_busy(bitmap)) {
+    } else if (bdrv_dirty_bitmap_qmp_locked(bitmap)) {
        return DIRTY_BITMAP_STATUS_LOCKED;
    } else if (!bdrv_dirty_bitmap_enabled(bitmap)) {
        return DIRTY_BITMAP_STATUS_DISABLED;
@@ -229,44 +218,9 @@ DirtyBitmapStatus bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap)
    }
 }

-/* Called with BQL taken.  */
-static bool bdrv_dirty_bitmap_recording(BdrvDirtyBitmap *bitmap)
-{
-    return !bitmap->disabled || (bitmap->successor &&
-                                 !bitmap->successor->disabled);
-}
-
-int bdrv_dirty_bitmap_check(const BdrvDirtyBitmap *bitmap, uint32_t flags,
-                            Error **errp)
-{
-    if ((flags & BDRV_BITMAP_BUSY) && bdrv_dirty_bitmap_busy(bitmap)) {
-        error_setg(errp, "Bitmap '%s' is currently in use by another"
-                   " operation and cannot be used", bitmap->name);
-        return -1;
-    }
-
-    if ((flags & BDRV_BITMAP_RO) && bdrv_dirty_bitmap_readonly(bitmap)) {
-        error_setg(errp, "Bitmap '%s' is readonly and cannot be modified",
-                   bitmap->name);
-        return -1;
-    }
-
-    if ((flags & BDRV_BITMAP_INCONSISTENT) &&
-        bdrv_dirty_bitmap_inconsistent(bitmap)) {
-        error_setg(errp, "Bitmap '%s' is inconsistent and cannot be used",
-                   bitmap->name);
-        error_append_hint(errp, "Try block-dirty-bitmap-remove to delete"
-                          " this bitmap from disk");
-        return -1;
-    }
-
-    return 0;
-}
-
 /**
 * Create a successor bitmap destined to replace this bitmap after an operation.
- * Requires that the bitmap is not marked busy and has no successor.
- * The successor will be enabled if the parent bitmap was.
+ * Requires that the bitmap is not frozen and has no successor.
 * Called with BQL taken.
 */
 int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,
@@ -275,14 +229,12 @@ int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,
    uint64_t granularity;
    BdrvDirtyBitmap *child;

-    if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_BUSY, errp)) {
-        return -1;
-    }
-    if (bdrv_dirty_bitmap_has_successor(bitmap)) {
-        error_setg(errp, "Cannot create a successor for a bitmap that already "
-                   "has one");
+    if (bdrv_dirty_bitmap_frozen(bitmap)) {
+        error_setg(errp, "Cannot create a successor for a bitmap that is "
+                   "currently frozen");
        return -1;
    }
+    assert(!bitmap->successor);

    /* Create an anonymous successor */
    granularity = bdrv_dirty_bitmap_granularity(bitmap);
@@ -293,16 +245,15 @@ int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,

    /* Successor will be on or off based on our current state. */
    child->disabled = bitmap->disabled;
-    bitmap->disabled = true;

-    /* Install the successor and mark the parent as busy */
+    /* Install the successor and freeze the parent */
    bitmap->successor = child;
-    bitmap->busy = true;
    return 0;
 }

 void bdrv_enable_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap)
 {
+    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    bitmap->disabled = false;
 }

@@ -319,8 +270,7 @@ void bdrv_dirty_bitmap_enable_successor(BdrvDirtyBitmap *bitmap)
 static void bdrv_release_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap)
 {
    assert(!bitmap->active_iterators);
-    assert(!bdrv_dirty_bitmap_busy(bitmap));
-    assert(!bdrv_dirty_bitmap_has_successor(bitmap));
+    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    assert(!bitmap->meta);
    QLIST_REMOVE(bitmap, list);
    hbitmap_free(bitmap->bitmap);
@@ -352,7 +302,6 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
    bitmap->successor = NULL;
    successor->persistent = bitmap->persistent;
    bitmap->persistent = false;
-    bitmap->busy = false;
    bdrv_release_dirty_bitmap(bs, bitmap);

    return successor;
@@ -361,8 +310,7 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
 /**
 * In cases of failure where we can no longer safely delete the parent,
 * we may wish to re-join the parent and child/successor.
- * The merged parent will be marked as not busy.
- * The marged parent will be enabled if and only if the successor was enabled.
+ * The merged parent will be un-frozen, but not explicitly re-enabled.
 * Called within bdrv_dirty_bitmap_lock..unlock and with BQL taken.
 */
 BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BlockDriverState *bs,
@@ -380,9 +328,6 @@ BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap_locked(BlockDriverState *bs,
        error_setg(errp, "Merging of parent and successor bitmap failed");
        return NULL;
    }
-
-    parent->disabled = successor->disabled;
-    parent->busy = false;
    bdrv_release_dirty_bitmap_locked(successor);
    parent->successor = NULL;

@@ -413,8 +358,7 @@ void bdrv_dirty_bitmap_truncate(BlockDriverState *bs, int64_t bytes)

    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {
-        assert(!bdrv_dirty_bitmap_busy(bitmap));
-        assert(!bdrv_dirty_bitmap_has_successor(bitmap));
+        assert(!bdrv_dirty_bitmap_frozen(bitmap));
        assert(!bitmap->active_iterators);
        hbitmap_truncate(bitmap->bitmap, bytes);
        bitmap->size = bytes;
@@ -432,7 +376,7 @@ void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)

 /**
 * Release all named dirty bitmaps attached to a BDS (for use in bdrv_close()).
- * There must not be any busy bitmaps attached.
+ * There must not be any frozen bitmaps attached.
 * This function does not remove persistent bitmaps from the storage.
 * Called with BQL taken.
 */
@@ -469,6 +413,7 @@ void bdrv_remove_persistent_dirty_bitmap(BlockDriverState *bs,
 void bdrv_disable_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
    bdrv_dirty_bitmap_lock(bitmap);
+    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    bitmap->disabled = true;
    bdrv_dirty_bitmap_unlock(bitmap);
 }
@@ -495,11 +440,6 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
        info->has_name = !!bm->name;
        info->name = g_strdup(bm->name);
        info->status = bdrv_dirty_bitmap_status(bm);
-        info->recording = bdrv_dirty_bitmap_recording(bm);
-        info->busy = bdrv_dirty_bitmap_busy(bm);
-        info->persistent = bm->persistent;
-        info->has_inconsistent = bm->inconsistent;
-        info->inconsistent = bm->inconsistent;
        entry->value = info;
        *plist = entry;
        plist = &entry->next;
@@ -575,13 +515,69 @@ void bdrv_dirty_iter_free(BdrvDirtyBitmapIter *iter)

 int64_t bdrv_dirty_iter_next(BdrvDirtyBitmapIter *iter)
 {
-    return hbitmap_iter_next(&iter->hbi);
+    return hbitmap_iter_next(&iter->hbi, true);
+}
+
+/**
+ * Return the next consecutively dirty area in the dirty bitmap
+ * belonging to the given iterator @iter.
+ *
+ * @max_offset: Maximum value that may be returned for
+ *              *offset + *bytes
+ * @offset:     Will contain the start offset of the next dirty area
+ * @bytes:      Will contain the length of the next dirty area
+ *
+ * Returns: True if a dirty area could be found before max_offset
+ *          (which means that *offset and *bytes then contain valid
+ *          values), false otherwise.
+ *
+ * Note that @iter is never advanced if false is returned.  If an area
+ * is found (which means that true is returned), it will be advanced
+ * past that area.
+ */
+bool bdrv_dirty_iter_next_area(BdrvDirtyBitmapIter *iter, uint64_t max_offset,
+                               uint64_t *offset, int *bytes)
+{
+    uint32_t granularity = bdrv_dirty_bitmap_granularity(iter->bitmap);
+    uint64_t gran_max_offset;
+    int64_t ret;
+    int size;
+
+    if (max_offset == iter->bitmap->size) {
+        /* If max_offset points to the image end, round it up by the
+         * bitmap granularity */
+        gran_max_offset = ROUND_UP(max_offset, granularity);
+    } else {
+        gran_max_offset = max_offset;
+    }
+
+    ret = hbitmap_iter_next(&iter->hbi, false);
+    if (ret < 0 || ret + granularity > gran_max_offset) {
+        return false;
+    }
+
+    *offset = ret;
+    size = 0;
+
+    assert(granularity <= INT_MAX);
+
+    do {
+        /* Advance iterator */
+        ret = hbitmap_iter_next(&iter->hbi, true);
+        size += granularity;
+    } while (ret + granularity <= gran_max_offset &&
+             hbitmap_iter_next(&iter->hbi, false) == ret + granularity &&
+             size <= INT_MAX - granularity);
+
+    *bytes = MIN(size, max_offset - *offset);
+    return true;
 }

 /* Called within bdrv_dirty_bitmap_lock..unlock */
 void bdrv_set_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
                                  int64_t offset, int64_t bytes)
 {
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    hbitmap_set(bitmap->bitmap, offset, bytes);
 }
@@ -598,6 +594,7 @@ void bdrv_set_dirty_bitmap(BdrvDirtyBitmap *bitmap,
 void bdrv_reset_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
                                    int64_t offset, int64_t bytes)
 {
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    hbitmap_reset(bitmap->bitmap, offset, bytes);
 }
@@ -628,6 +625,7 @@ void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
 void bdrv_restore_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *backup)
 {
    HBitmap *tmp = bitmap->bitmap;
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    bitmap->bitmap = backup;
    hbitmap_free(tmp);
@@ -740,23 +738,13 @@ bool bdrv_has_readonly_bitmaps(BlockDriverState *bs)
 }

 /* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_persistence(BdrvDirtyBitmap *bitmap, bool persistent)
+void bdrv_dirty_bitmap_set_persistance(BdrvDirtyBitmap *bitmap, bool persistent)
 {
    qemu_mutex_lock(bitmap->mutex);
    bitmap->persistent = persistent;
    qemu_mutex_unlock(bitmap->mutex);
 }

-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_inconsistent(BdrvDirtyBitmap *bitmap)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    assert(bitmap->persistent == true);
-    bitmap->inconsistent = true;
-    bitmap->disabled = true;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
 /* Called with BQL taken. */
 void bdrv_dirty_bitmap_set_migration(BdrvDirtyBitmap *bitmap, bool migration)
 {
@@ -765,16 +753,11 @@ void bdrv_dirty_bitmap_set_migration(BdrvDirtyBitmap *bitmap, bool migration)
    qemu_mutex_unlock(bitmap->mutex);
 }

-bool bdrv_dirty_bitmap_get_persistence(BdrvDirtyBitmap *bitmap)
+bool bdrv_dirty_bitmap_get_persistance(BdrvDirtyBitmap *bitmap)
 {
    return bitmap->persistent && !bitmap->migration;
 }

-bool bdrv_dirty_bitmap_inconsistent(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->inconsistent;
-}
-
 bool bdrv_has_changed_persistent_bitmaps(BlockDriverState *bs)
 {
    BdrvDirtyBitmap *bm;
@@ -799,16 +782,9 @@ char *bdrv_dirty_bitmap_sha256(const BdrvDirtyBitmap *bitmap, Error **errp)
    return hbitmap_sha256(bitmap->bitmap, errp);
 }

-int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, uint64_t offset,
-                                    uint64_t bytes)
+int64_t bdrv_dirty_bitmap_next_zero(BdrvDirtyBitmap *bitmap, uint64_t offset)
 {
-    return hbitmap_next_zero(bitmap->bitmap, offset, bytes);
-}
-
-bool bdrv_dirty_bitmap_next_dirty_area(BdrvDirtyBitmap *bitmap,
-                                       uint64_t *offset, uint64_t *bytes)
-{
-    return hbitmap_next_dirty_area(bitmap->bitmap, offset, bytes);
+    return hbitmap_next_zero(bitmap->bitmap, offset);
 }

 void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,
@@ -821,11 +797,15 @@ void bdrv_merge_dirty_bitmap(BdrvDirtyBitmap *dest, const BdrvDirtyBitmap *src,

    qemu_mutex_lock(dest->mutex);

-    if (bdrv_dirty_bitmap_check(dest, BDRV_BITMAP_DEFAULT, errp)) {
+    if (bdrv_dirty_bitmap_user_locked(dest)) {
+        error_setg(errp, "Bitmap '%s' is currently in use by another"
+        " operation and cannot be modified", dest->name);
        goto out;
    }

-    if (bdrv_dirty_bitmap_check(src, BDRV_BITMAP_ALLOW_RO, errp)) {
+    if (bdrv_dirty_bitmap_readonly(dest)) {
+        error_setg(errp, "Bitmap '%s' is readonly and cannot be modified",
+                   dest->name);
        goto out;
    }

--- a/block/dmg-lzfse.c
+++ b/block/dmg-lzfse.c
@@ -1,49 +0,0 @@
-/*
- * DMG lzfse uncompression
- *
- * Copyright (c) 2018 Julio Cesar Faracco
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "dmg.h"
-#include <lzfse.h>
-
-static int dmg_uncompress_lzfse_do(char *next_in, unsigned int avail_in,
-                                   char *next_out, unsigned int avail_out)
-{
-    size_t out_size = lzfse_decode_buffer((uint8_t *) next_out, avail_out,
-                                          (uint8_t *) next_in, avail_in,
-                                          NULL);
-
-    /* We need to decode the single chunk only. */
-    /* So, out_size == avail_out is not an error here. */
-    if (out_size > 0) {
-        return out_size;
-    }
-    return -1;
-}
-
-__attribute__((constructor))
-static void dmg_lzfse_init(void)
-{
-    assert(!dmg_uncompress_lzfse);
-    dmg_uncompress_lzfse = dmg_uncompress_lzfse_do;
-}
--- a/block/dmg.c
+++ b/block/dmg.c
@@ -33,9 +33,6 @@
 int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
                          char *next_out, unsigned int avail_out);

-int (*dmg_uncompress_lzfse)(char *next_in, unsigned int avail_in,
-                            char *next_out, unsigned int avail_out);
-
 enum {
    /* Limit chunk sizes to prevent unreasonable amounts of memory being used
     * or truncating when converting to 32-bit types
@@ -44,19 +41,6 @@ enum {
    DMG_SECTORCOUNTS_MAX = DMG_LENGTHS_MAX / 512,
 };

-enum {
-    /* DMG Block Type */
-    UDZE = 0, /* Zeroes */
-    UDRW,     /* RAW type */
-    UDIG,     /* Ignore */
-    UDCO = 0x80000004,
-    UDZO,
-    UDBZ,
-    ULFO,
-    UDCM = 0x7ffffffe, /* Comments */
-    UDLE = 0xffffffff  /* Last Entry */
-};
-
 static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    int len;
@@ -121,17 +105,15 @@ static void update_max_chunk_size(BDRVDMGState *s, uint32_t chunk,
    uint32_t uncompressed_sectors = 0;

    switch (s->types[chunk]) {
-    case UDZO: /* zlib compressed */
-    case UDBZ: /* bzip2 compressed */
-    case ULFO: /* lzfse compressed */
+    case 0x80000005: /* zlib compressed */
+    case 0x80000006: /* bzip2 compressed */
        compressed_size = s->lengths[chunk];
        uncompressed_sectors = s->sectorcounts[chunk];
        break;
-    case UDRW: /* copy */
+    case 1: /* copy */
        uncompressed_sectors = DIV_ROUND_UP(s->lengths[chunk], 512);
        break;
-    case UDZE: /* zero */
-    case UDIG: /* ignore */
+    case 2: /* zero */
        /* as the all-zeroes block may be large, it is treated specially: the
         * sector is not copied from a large buffer, a simple memset is used
         * instead. Therefore uncompressed_sectors does not need to be set. */
@@ -200,15 +182,12 @@ typedef struct DmgHeaderState {
 static bool dmg_is_known_block_type(uint32_t entry_type)
 {
    switch (entry_type) {
-    case UDZE:    /* zeros */
-    case UDRW:    /* uncompressed */
-    case UDIG:    /* ignore */
-    case UDZO:    /* zlib */
+    case 0x00000001:    /* uncompressed */
+    case 0x00000002:    /* zeroes */
+    case 0x80000005:    /* zlib */
        return true;
-    case UDBZ:    /* bzip2 */
+    case 0x80000006:    /* bzip2 */
        return !!dmg_uncompress_bz2;
-    case ULFO:    /* lzfse */
-        return !!dmg_uncompress_lzfse;
    default:
        return false;
    }
@@ -267,10 +246,9 @@ static int dmg_read_mish_block(BDRVDMGState *s, DmgHeaderState *ds,
        /* sector count */
        s->sectorcounts[i] = buff_read_uint64(buffer, offset + 0x10);

-        /* all-zeroes sector (type UDZE and UDIG) does not need to be
-         * "uncompressed" and can therefore be unbounded. */
-        if (s->types[i] != UDZE && s->types[i] != UDIG
-            && s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
+        /* all-zeroes sector (type 2) does not need to be "uncompressed" and can
+         * therefore be unbounded. */
+        if (s->types[i] != 2 && s->sectorcounts[i] > DMG_SECTORCOUNTS_MAX) {
            error_report("sector count %" PRIu64 " for chunk %" PRIu32
                         " is larger than max (%u)",
                         s->sectorcounts[i], i, DMG_SECTORCOUNTS_MAX);
@@ -447,7 +425,6 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    }

    block_module_load_one("dmg-bz2");
-    block_module_load_one("dmg-lzfse");

    s->n_chunks = 0;
    s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL;
@@ -575,20 +552,16 @@ static inline uint32_t search_chunk(BDRVDMGState *s, uint64_t sector_num)
 {
    /* binary search */
    uint32_t chunk1 = 0, chunk2 = s->n_chunks, chunk3;
-    while (chunk1 <= chunk2) {
+    while (chunk1 != chunk2) {
        chunk3 = (chunk1 + chunk2) / 2;
        if (s->sectors[chunk3] > sector_num) {
-            if (chunk3 == 0) {
-                goto err;
-            }
-            chunk2 = chunk3 - 1;
+            chunk2 = chunk3;
        } else if (s->sectors[chunk3] + s->sectorcounts[chunk3] > sector_num) {
            return chunk3;
        } else {
-            chunk1 = chunk3 + 1;
+            chunk1 = chunk3;
        }
    }
-err:
    return s->n_chunks; /* error */
 }

@@ -606,7 +579,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)

        s->current_chunk = s->n_chunks;
        switch (s->types[chunk]) { /* block entry type */
-        case UDZO: { /* zlib compressed */
+        case 0x80000005: { /* zlib compressed */
            /* we need to buffer, because only the chunk as whole can be
             * inflated. */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
@@ -629,7 +602,7 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return -1;
            }
            break; }
-        case UDBZ: /* bzip2 compressed */
+        case 0x80000006: /* bzip2 compressed */
            if (!dmg_uncompress_bz2) {
                break;
            }
@@ -650,36 +623,14 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return ret;
            }
            break;
-        case ULFO:
-            if (!dmg_uncompress_lzfse) {
-                break;
-            }
-            /* we need to buffer, because only the chunk as whole can be
-             * inflated. */
-            ret = bdrv_pread(bs->file, s->offsets[chunk],
-                             s->compressed_chunk, s->lengths[chunk]);
-            if (ret != s->lengths[chunk]) {
-                return -1;
-            }
-
-            ret = dmg_uncompress_lzfse((char *)s->compressed_chunk,
-                                       (unsigned int) s->lengths[chunk],
-                                       (char *)s->uncompressed_chunk,
-                                       (unsigned int)
-                                           (512 * s->sectorcounts[chunk]));
-            if (ret < 0) {
-                return ret;
-            }
-            break;
-        case UDRW: /* copy */
+        case 1: /* copy */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->uncompressed_chunk, s->lengths[chunk]);
            if (ret != s->lengths[chunk]) {
                return -1;
            }
            break;
-        case UDZE: /* zeros */
-        case UDIG: /* ignore */
+        case 2: /* zero */
            /* see dmg_read, it is treated specially. No buffer needs to be
             * pre-filled, the zeroes can be set directly. */
            break;
@@ -714,8 +665,7 @@ dmg_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
        /* Special case: current chunk is all zeroes. Do not perform a memcpy as
         * s->uncompressed_chunk may be too small to cover the large all-zeroes
         * section. dmg_read_chunk is called to find s->current_chunk */
-        if (s->types[s->current_chunk] == UDZE
-            || s->types[s->current_chunk] == UDIG) { /* all zeroes block entry */
+        if (s->types[s->current_chunk] == 2) { /* all zeroes block entry */
            qemu_iovec_memset(qiov, i * 512, 0, 512);
            continue;
        }
--- a/block/dmg.h
+++ b/block/dmg.h
@@ -55,7 +55,4 @@ typedef struct BDRVDMGState {
 extern int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
                                 char *next_out, unsigned int avail_out);

-extern int (*dmg_uncompress_lzfse)(char *next_in, unsigned int avail_in,
-                                   char *next_out, unsigned int avail_out);
-
 #endif
--- a/block/file-posix.c
+++ b/block/file-posix.c
--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -176,7 +176,7 @@ int qemu_ftruncate64(int fd, int64_t length)
    BOOL res;

    if ((GetVersion() & 0x80000000UL) && (length >> 32) != 0)
-        return -1;
+	return -1;

    h = (HANDLE)_get_osfhandle(fd);

@@ -184,13 +184,13 @@ int qemu_ftruncate64(int fd, int64_t length)
    li.HighPart = 0;
    li.LowPart = SetFilePointer (h, 0, &li.HighPart, FILE_CURRENT);
    if (li.LowPart == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        return -1;
+	return -1;
    }

    high = length >> 32;
    dw = SetFilePointer(h, (DWORD) length, &high, FILE_BEGIN);
    if (dw == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        return -1;
+	return -1;
    }
    res = SetEndOfFile(h);

@@ -203,7 +203,7 @@ static int set_sparse(int fd)
 {
    DWORD returned;
    return (int) DeviceIoControl((HANDLE)_get_osfhandle(fd), FSCTL_SET_SPARSE,
-                                 NULL, 0, NULL, 0, &returned, NULL);
+				 NULL, 0, NULL, 0, &returned, NULL);
 }

 static void raw_detach_aio_context(BlockDriverState *bs)
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -76,7 +76,7 @@ typedef struct ListElement {
    GlfsPreopened saved;
 } ListElement;

-static QLIST_HEAD(, ListElement) glfs_list;
+static QLIST_HEAD(glfs_list, ListElement) glfs_list;

 static QemuOptsList qemu_gluster_create_opts = {
    .name = "qemu-gluster-create-opts",
@@ -1503,21 +1503,6 @@ static int coroutine_fn qemu_gluster_co_block_status(BlockDriverState *bs,
 }


-static const char *const gluster_strong_open_opts[] = {
-    GLUSTER_OPT_VOLUME,
-    GLUSTER_OPT_PATH,
-    GLUSTER_OPT_TYPE,
-    GLUSTER_OPT_SERVER_PATTERN,
-    GLUSTER_OPT_HOST,
-    GLUSTER_OPT_PORT,
-    GLUSTER_OPT_TO,
-    GLUSTER_OPT_IPV4,
-    GLUSTER_OPT_IPV6,
-    GLUSTER_OPT_SOCKET,
-
-    NULL
-};
-
 static BlockDriver bdrv_gluster = {
    .format_name                  = "gluster",
    .protocol_name                = "gluster",
@@ -1545,7 +1530,6 @@ static BlockDriver bdrv_gluster = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static BlockDriver bdrv_gluster_tcp = {
@@ -1575,7 +1559,6 @@ static BlockDriver bdrv_gluster_tcp = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static BlockDriver bdrv_gluster_unix = {
@@ -1605,7 +1588,6 @@ static BlockDriver bdrv_gluster_unix = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 /* rdma is deprecated (actually never supported for volfile fetch).
@@ -1641,7 +1623,6 @@ static BlockDriver bdrv_gluster_rdma = {
 #endif
    .bdrv_co_block_status         = qemu_gluster_co_block_status,
    .create_opts                  = &qemu_gluster_create_opts,
-    .strong_runtime_opts          = gluster_strong_open_opts,
 };

 static void bdrv_gluster_init(void)
--- a/block/io.c
+++ b/block/io.c
@@ -843,13 +843,17 @@ static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
 static int bdrv_rw_co(BdrvChild *child, int64_t sector_num, uint8_t *buf,
                      int nb_sectors, bool is_write, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf,
-                                            nb_sectors * BDRV_SECTOR_SIZE);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = (void *)buf,
+        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
+    };

    if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_prwv_co(child, sector_num << BDRV_SECTOR_BITS,
                        &qiov, is_write, flags);
 }
@@ -876,8 +880,13 @@ int bdrv_write(BdrvChild *child, int64_t sector_num,
 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
                       int bytes, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = NULL,
+        .iov_len = bytes,
+    };

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_prwv_co(child, offset, &qiov, true,
                        BDRV_REQ_ZERO_WRITE | flags);
 }
@@ -909,6 +918,8 @@ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
        }
        ret = bdrv_block_status(bs, offset, bytes, &bytes, NULL, NULL);
        if (ret < 0) {
+            error_report("error getting block status at offset %" PRId64 ": %s",
+                         offset, strerror(-ret));
            return ret;
        }
        if (ret & BDRV_BLOCK_ZERO) {
@@ -917,6 +928,8 @@ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
        }
        ret = bdrv_pwrite_zeroes(child, offset, bytes, flags);
        if (ret < 0) {
+            error_report("error writing zeroes at offset %" PRId64 ": %s",
+                         offset, strerror(-ret));
            return ret;
        }
        offset += bytes;
@@ -937,12 +950,17 @@ int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)

 int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base = (void *)buf,
+        .iov_len = bytes,
+    };

    if (bytes < 0) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_preadv(child, offset, &qiov);
 }

@@ -960,12 +978,17 @@ int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)

 int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = (void *) buf,
+        .iov_len    = bytes,
+    };

    if (bytes < 0) {
        return -EINVAL;
    }

+    qemu_iovec_init_external(&qiov, &iov, 1);
    return bdrv_pwritev(child, offset, &qiov);
 }

@@ -1015,7 +1038,6 @@ static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
    unsigned int nb_sectors;

    assert(!(flags & ~BDRV_REQ_MASK));
-    assert(!(flags & BDRV_REQ_NO_FALLBACK));

    if (!drv) {
        return -ENOMEDIUM;
@@ -1062,7 +1084,6 @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
    int ret;

    assert(!(flags & ~BDRV_REQ_MASK));
-    assert(!(flags & BDRV_REQ_NO_FALLBACK));

    if (!drv) {
        return -ENOMEDIUM;
@@ -1144,6 +1165,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
    void *bounce_buffer;

    BlockDriver *drv = bs->drv;
+    struct iovec iov;
    QEMUIOVector local_qiov;
    int64_t cluster_offset;
    int64_t cluster_bytes;
@@ -1208,8 +1230,9 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,

        if (ret <= 0) {
            /* Must copy-on-read; use the bounce buffer */
-            pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
-            qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
+            iov.iov_base = bounce_buffer;
+            iov.iov_len = pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
+            qemu_iovec_init_external(&local_qiov, &iov, 1);

            ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
                                     &local_qiov, 0);
@@ -1454,7 +1477,7 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
 {
    BlockDriver *drv = bs->drv;
    QEMUIOVector qiov;
-    void *buf = NULL;
+    struct iovec iov = {0};
    int ret = 0;
    bool need_flush = false;
    int head = 0;
@@ -1469,10 +1492,6 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
        return -ENOMEDIUM;
    }

-    if ((flags & ~bs->supported_zero_flags) & BDRV_REQ_NO_FALLBACK) {
-        return -ENOTSUP;
-    }
-
    assert(alignment % bs->bl.request_alignment == 0);
    head = offset % alignment;
    tail = (offset + bytes) % alignment;
@@ -1516,7 +1535,7 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
            assert(!bs->supported_zero_flags);
        }

-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
+        if (ret == -ENOTSUP) {
            /* Fall back to bounce buffer if write zeroes is unsupported */
            BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;

@@ -1528,14 +1547,16 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
                need_flush = true;
            }
            num = MIN(num, max_transfer);
-            if (buf == NULL) {
-                buf = qemu_try_blockalign0(bs, num);
-                if (buf == NULL) {
+            iov.iov_len = num;
+            if (iov.iov_base == NULL) {
+                iov.iov_base = qemu_try_blockalign(bs, num);
+                if (iov.iov_base == NULL) {
                    ret = -ENOMEM;
                    goto fail;
                }
+                memset(iov.iov_base, 0, num);
            }
-            qemu_iovec_init_buf(&qiov, buf, num);
+            qemu_iovec_init_external(&qiov, &iov, 1);

            ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);

@@ -1543,8 +1564,8 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
             * all future requests.
             */
            if (num < max_transfer) {
-                qemu_vfree(buf);
-                buf = NULL;
+                qemu_vfree(iov.iov_base);
+                iov.iov_base = NULL;
            }
        }

@@ -1556,7 +1577,7 @@ fail:
    if (ret == 0 && need_flush) {
        ret = bdrv_co_flush(bs);
    }
-    qemu_vfree(buf);
+    qemu_vfree(iov.iov_base);
    return ret;
 }

@@ -1742,6 +1763,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
    BlockDriverState *bs = child->bs;
    uint8_t *buf = NULL;
    QEMUIOVector local_qiov;
+    struct iovec iov;
    uint64_t align = bs->bl.request_alignment;
    unsigned int head_padding_bytes, tail_padding_bytes;
    int ret = 0;
@@ -1753,7 +1775,11 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
    assert(flags & BDRV_REQ_ZERO_WRITE);
    if (head_padding_bytes || tail_padding_bytes) {
        buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&local_qiov, buf, align);
+        iov = (struct iovec) {
+            .iov_base   = buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&local_qiov, &iov, 1);
    }
    if (head_padding_bytes) {
        uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
@@ -1859,12 +1885,17 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,

    if (offset & (align - 1)) {
        QEMUIOVector head_qiov;
+        struct iovec head_iov;

        mark_request_serialising(&req, align);
        wait_serialising_requests(&req);

        head_buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&head_qiov, head_buf, align);
+        head_iov = (struct iovec) {
+            .iov_base   = head_buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&head_qiov, &head_iov, 1);

        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
        ret = bdrv_aligned_preadv(child, &req, offset & ~(align - 1), align,
@@ -1893,6 +1924,7 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,

    if ((offset + bytes) & (align - 1)) {
        QEMUIOVector tail_qiov;
+        struct iovec tail_iov;
        size_t tail_bytes;
        bool waited;

@@ -1901,7 +1933,11 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
        assert(!waited || !use_local_qiov);

        tail_buf = qemu_blockalign(bs, align);
-        qemu_iovec_init_buf(&tail_qiov, tail_buf, align);
+        tail_iov = (struct iovec) {
+            .iov_base   = tail_buf,
+            .iov_len    = align,
+        };
+        qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);

        bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
        ret = bdrv_aligned_preadv(child, &req, (offset + bytes) & ~(align - 1),
@@ -2432,9 +2468,15 @@ bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
                      int64_t pos, int size)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = (void *) buf,
+        .iov_len    = size,
+    };
    int ret;

+    qemu_iovec_init_external(&qiov, &iov, 1);
+
    ret = bdrv_writev_vmstate(bs, &qiov, pos);
    if (ret < 0) {
        return ret;
@@ -2451,9 +2493,14 @@ int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
+    QEMUIOVector qiov;
+    struct iovec iov = {
+        .iov_base   = buf,
+        .iov_len    = size,
+    };
    int ret;

+    qemu_iovec_init_external(&qiov, &iov, 1);
    ret = bdrv_readv_vmstate(bs, &qiov, pos);
    if (ret < 0) {
        return ret;
@@ -2955,10 +3002,6 @@ static int coroutine_fn bdrv_co_copy_range_internal(
    BdrvTrackedRequest req;
    int ret;

-    /* TODO We can support BDRV_REQ_NO_FALLBACK here */
-    assert(!(read_flags & BDRV_REQ_NO_FALLBACK));
-    assert(!(write_flags & BDRV_REQ_NO_FALLBACK));
-
    if (!dst || !dst->bs) {
        return -ENOMEDIUM;
    }
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -49,9 +49,7 @@
 /* Conflict between scsi/utils.h and libiscsi! :( */
 #define SCSI_XFER_NONE ISCSI_XFER_NONE
 #include <iscsi/iscsi.h>
-#define inline __attribute__((gnu_inline))  /* required for libiscsi v1.9.0 */
 #include <iscsi/scsi-lowlevel.h>
-#undef inline
 #undef SCSI_XFER_NONE
 QEMU_BUILD_BUG_ON((int)SCSI_XFER_NONE != (int)ISCSI_XFER_NONE);

@@ -119,6 +117,7 @@ typedef struct IscsiAIOCB {
    QEMUBH *bh;
    IscsiLun *iscsilun;
    struct scsi_task *task;
+    uint8_t *buf;
    int status;
    int64_t sector_num;
    int nb_sectors;
@@ -126,7 +125,6 @@ typedef struct IscsiAIOCB {
 #ifdef __linux__
    sg_io_hdr_t *ioh;
 #endif
-    bool cancelled;
 } IscsiAIOCB;

 /* libiscsi uses time_t so its enough to process events every second */
@@ -145,8 +143,6 @@ static const unsigned iscsi_retry_times[] = {8, 32, 128, 512, 2048, 8192, 32768}
 * unallocated. */
 #define ISCSI_CHECKALLOC_THRES 64

-#ifdef __linux__
-
 static void
 iscsi_bh_cb(void *p)
 {
@@ -154,6 +150,9 @@ iscsi_bh_cb(void *p)

    qemu_bh_delete(acb->bh);

+    g_free(acb->buf);
+    acb->buf = NULL;
+
    acb->common.cb(acb->common.opaque, acb->status);

    if (acb->task != NULL) {
@@ -174,8 +173,6 @@ iscsi_schedule_bh(IscsiAIOCB *acb)
    qemu_bh_schedule(acb->bh);
 }

-#endif
-
 static void iscsi_co_generic_bh_cb(void *opaque)
 {
    struct IscsiTask *iTask = opaque;
@@ -294,22 +291,14 @@ static void iscsi_co_init_iscsitask(IscsiLun *iscsilun, struct IscsiTask *iTask)
    };
 }

-#ifdef __linux__
-
-/* Called (via iscsi_service) with QemuMutex held. */
 static void
 iscsi_abort_task_cb(struct iscsi_context *iscsi, int status, void *command_data,
                    void *private_data)
 {
    IscsiAIOCB *acb = private_data;

-    /* If the command callback hasn't been called yet, drop the task */
-    if (!acb->bh) {
-        /* Call iscsi_aio_ioctl_cb() with SCSI_STATUS_CANCELLED */
-        iscsi_scsi_cancel_task(iscsi, acb->task);
-    }
-
-    qemu_aio_unref(acb); /* acquired in iscsi_aio_cancel() */
+    acb->status = -ECANCELED;
+    iscsi_schedule_bh(acb);
 }

 static void
@@ -318,25 +307,14 @@ iscsi_aio_cancel(BlockAIOCB *blockacb)
    IscsiAIOCB *acb = (IscsiAIOCB *)blockacb;
    IscsiLun *iscsilun = acb->iscsilun;

-    qemu_mutex_lock(&iscsilun->mutex);
-
-    /* If it was cancelled or completed already, our work is done here */
-    if (acb->cancelled || acb->status != -EINPROGRESS) {
-        qemu_mutex_unlock(&iscsilun->mutex);
+    if (acb->status != -EINPROGRESS) {
        return;
    }

-    acb->cancelled = true;
-
-    qemu_aio_ref(acb); /* released in iscsi_abort_task_cb() */
-
    /* send a task mgmt call to the target to cancel the task on the target */
-    if (iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
-                                         iscsi_abort_task_cb, acb) < 0) {
-        qemu_aio_unref(acb); /* since iscsi_abort_task_cb() won't be called */
-    }
+    iscsi_task_mgmt_abort_task_async(iscsilun->iscsi, acb->task,
+                                     iscsi_abort_task_cb, acb);

-    qemu_mutex_unlock(&iscsilun->mutex);
 }

 static const AIOCBInfo iscsi_aiocb_info = {
@@ -344,7 +322,6 @@ static const AIOCBInfo iscsi_aiocb_info = {
    .cancel_async       = iscsi_aio_cancel,
 };

-#endif

 static void iscsi_process_read(void *arg);
 static void iscsi_process_write(void *arg);
@@ -371,8 +348,6 @@ static void iscsi_timed_check_events(void *opaque)
 {
    IscsiLun *iscsilun = opaque;

-    qemu_mutex_lock(&iscsilun->mutex);
-
    /* check for timed out requests */
    iscsi_service(iscsilun->iscsi, 0);

@@ -385,8 +360,6 @@ static void iscsi_timed_check_events(void *opaque)
     * to return to service once this situation changes. */
    iscsi_set_events(iscsilun);

-    qemu_mutex_unlock(&iscsilun->mutex);
-
    timer_mod(iscsilun->event_timer,
              qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + EVENT_INTERVAL);
 }
@@ -960,13 +933,8 @@ iscsi_aio_ioctl_cb(struct iscsi_context *iscsi, int status,
 {
    IscsiAIOCB *acb = opaque;

-    if (status == SCSI_STATUS_CANCELLED) {
-        if (!acb->bh) {
-            acb->status = -ECANCELED;
-            iscsi_schedule_bh(acb);
-        }
-        return;
-    }
+    g_free(acb->buf);
+    acb->buf = NULL;

    acb->status = 0;
    if (status < 0) {
@@ -1042,8 +1010,8 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
    acb->iscsilun = iscsilun;
    acb->bh          = NULL;
    acb->status      = -EINPROGRESS;
+    acb->buf         = NULL;
    acb->ioh         = buf;
-    acb->cancelled   = false;

    if (req != SG_IO) {
        iscsi_ioctl_handle_emulated(acb, req, buf);
@@ -2455,20 +2423,6 @@ static QemuOptsList iscsi_create_opts = {
    }
 };

-static const char *const iscsi_strong_runtime_opts[] = {
-    "transport",
-    "portal",
-    "target",
-    "user",
-    "password",
-    "password-secret",
-    "lun",
-    "initiator-name",
-    "header-digest",
-
-    NULL
-};
-
 static BlockDriver bdrv_iscsi = {
    .format_name     = "iscsi",
    .protocol_name   = "iscsi",
@@ -2503,8 +2457,6 @@ static BlockDriver bdrv_iscsi = {

    .bdrv_detach_aio_context = iscsi_detach_aio_context,
    .bdrv_attach_aio_context = iscsi_attach_aio_context,
-
-    .strong_runtime_opts = iscsi_strong_runtime_opts,
 };

 #if LIBISCSI_API_VERSION >= (20160603)
@@ -2542,8 +2494,6 @@ static BlockDriver bdrv_iser = {

    .bdrv_detach_aio_context = iscsi_detach_aio_context,
    .bdrv_attach_aio_context = iscsi_attach_aio_context,
-
-    .strong_runtime_opts = iscsi_strong_runtime_opts,
 };
 #endif

--- a/block/linux-aio.c
+++ b/block/linux-aio.c
@@ -384,10 +384,10 @@ static int laio_do_submit(int fd, struct qemu_laiocb *laiocb, off_t offset,
    switch (type) {
    case QEMU_AIO_WRITE:
        io_prep_pwritev(iocbs, fd, qiov->iov, qiov->niov, offset);
-        break;
+	break;
    case QEMU_AIO_READ:
        io_prep_preadv(iocbs, fd, qiov->iov, qiov->niov, offset);
-        break;
+	break;
    /* Currently Linux kernel does not support other operations */
    default:
        fprintf(stderr, "%s: invalid AIO request type 0x%x.\n",
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -72,7 +72,7 @@ typedef struct MirrorBlockJob {
    unsigned long *in_flight_bitmap;
    int in_flight;
    int64_t bytes_in_flight;
-    QTAILQ_HEAD(, MirrorOp) ops_in_flight;
+    QTAILQ_HEAD(MirrorOpList, MirrorOp) ops_in_flight;
    int ret;
    bool unmap;
    int target_cluster_size;
@@ -80,7 +80,6 @@ typedef struct MirrorBlockJob {
    bool initial_zeroing_ongoing;
    int in_active_write_counter;
    bool prepared;
-    bool in_drain;
 } MirrorBlockJob;

 typedef struct MirrorBDSOpaque {
@@ -278,8 +277,7 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
    return ret;
 }

-static inline void coroutine_fn
-mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
+static inline void mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
 {
    MirrorOp *op;

@@ -297,8 +295,7 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
    abort();
 }

-static inline void coroutine_fn
-mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
+static inline void mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 {
    /* Only non-active operations use up in-flight slots */
    mirror_wait_for_any_operation(s, false);
@@ -601,7 +598,7 @@ static void mirror_free_init(MirrorBlockJob *s)
 * mirror_resume() because mirror_run() will begin iterating again
 * when the job is resumed.
 */
-static void coroutine_fn mirror_wait_for_all_io(MirrorBlockJob *s)
+static void mirror_wait_for_all_io(MirrorBlockJob *s)
 {
    while (s->in_flight > 0) {
        mirror_wait_for_free_in_flight_slot(s);
@@ -631,10 +628,6 @@ static int mirror_exit_common(Job *job)
    }
    s->prepared = true;

-    if (bdrv_chain_contains(src, target_bs)) {
-        bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
-    }
-
    bdrv_release_dirty_bitmap(src, s->dirty_bitmap);

    /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
@@ -676,15 +669,13 @@ static int mirror_exit_common(Job *job)

    if (s->should_complete && !abort) {
        BlockDriverState *to_replace = s->to_replace ?: src;
-        bool ro = bdrv_is_read_only(to_replace);

-        if (ro != bdrv_is_read_only(target_bs)) {
-            bdrv_reopen_set_read_only(target_bs, ro, NULL);
+        if (bdrv_get_flags(target_bs) != bdrv_get_flags(to_replace)) {
+            bdrv_reopen(target_bs, bdrv_get_flags(to_replace), NULL);
        }

        /* The mirror job has no requests in flight any more, but we need to
         * drain potential other users of the BDS before changing the graph. */
-        assert(s->in_drain);
        bdrv_drained_begin(target_bs);
        bdrv_replace_node(to_replace, target_bs, &local_err);
        bdrv_drained_end(target_bs);
@@ -723,7 +714,6 @@ static int mirror_exit_common(Job *job)
    bs_opaque->job = NULL;

    bdrv_drained_end(src);
-    s->in_drain = false;
    bdrv_unref(mirror_top_bs);
    bdrv_unref(src);

@@ -741,7 +731,7 @@ static void mirror_abort(Job *job)
    assert(ret == 0);
 }

-static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
+static void mirror_throttle(MirrorBlockJob *s)
 {
    int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);

@@ -1007,12 +997,10 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
             */
            trace_mirror_before_drain(s, cnt);

-            s->in_drain = true;
            bdrv_drained_begin(bs);
            cnt = bdrv_get_dirty_count(s->dirty_bitmap);
            if (cnt > 0 || mirror_flush(s) < 0) {
                bdrv_drained_end(bs);
-                s->in_drain = false;
                continue;
            }

@@ -1060,7 +1048,6 @@ immediate_exit:
    bdrv_dirty_iter_free(s->dbi);

    if (need_drain) {
-        s->in_drain = true;
        bdrv_drained_begin(bs);
    }

@@ -1119,7 +1106,7 @@ static void mirror_complete(Job *job, Error **errp)
    job_enter(job);
 }

-static void coroutine_fn mirror_pause(Job *job)
+static void mirror_pause(Job *job)
 {
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common.job);

@@ -1129,16 +1116,6 @@ static void coroutine_fn mirror_pause(Job *job)
 static bool mirror_drained_poll(BlockJob *job)
 {
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    /* If the job isn't paused nor cancelled, we can't be sure that it won't
-     * issue more requests. We make an exception if we've reached this point
-     * from one of our own drain sections, to avoid a deadlock waiting for
-     * ourselves.
-     */
-    if (!s->common.job.paused && !s->common.job.cancelled && !s->in_drain) {
-        return true;
-    }
-
    return !!s->in_flight;
 }

@@ -1200,28 +1177,29 @@ static const BlockJobDriver commit_active_job_driver = {
    .drain                  = mirror_drain,
 };

-static void coroutine_fn
-do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
-                     uint64_t offset, uint64_t bytes,
-                     QEMUIOVector *qiov, int flags)
+static void do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
+                                 uint64_t offset, uint64_t bytes,
+                                 QEMUIOVector *qiov, int flags)
 {
+    BdrvDirtyBitmapIter *iter;
    QEMUIOVector target_qiov;
-    uint64_t dirty_offset = offset;
-    uint64_t dirty_bytes;
+    uint64_t dirty_offset;
+    int dirty_bytes;

    if (qiov) {
        qemu_iovec_init(&target_qiov, qiov->niov);
    }

+    iter = bdrv_dirty_iter_new(job->dirty_bitmap);
+    bdrv_set_dirty_iter(iter, offset);
+
    while (true) {
        bool valid_area;
        int ret;

        bdrv_dirty_bitmap_lock(job->dirty_bitmap);
-        dirty_bytes = MIN(offset + bytes - dirty_offset, INT_MAX);
-        valid_area = bdrv_dirty_bitmap_next_dirty_area(job->dirty_bitmap,
-                                                       &dirty_offset,
-                                                       &dirty_bytes);
+        valid_area = bdrv_dirty_iter_next_area(iter, offset + bytes,
+                                               &dirty_offset, &dirty_bytes);
        if (!valid_area) {
            bdrv_dirty_bitmap_unlock(job->dirty_bitmap);
            break;
@@ -1277,10 +1255,9 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
                break;
            }
        }
-
-        dirty_offset += dirty_bytes;
    }

+    bdrv_dirty_iter_free(iter);
    if (qiov) {
        qemu_iovec_destroy(&target_qiov);
    }
@@ -1451,13 +1428,14 @@ static int coroutine_fn bdrv_mirror_top_pdiscard(BlockDriverState *bs,
                                    NULL, 0);
 }

-static void bdrv_mirror_top_refresh_filename(BlockDriverState *bs)
+static void bdrv_mirror_top_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
    if (bs->backing == NULL) {
        /* we can be here after failed bdrv_attach_child in
         * bdrv_set_backing_hd */
        return;
    }
+    bdrv_refresh_filename(bs->backing->bs);
    pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
            bs->backing->bs->filename);
 }
@@ -1548,8 +1526,7 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
    }
    mirror_top_bs->total_sectors = bs->total_sectors;
    mirror_top_bs->supported_write_flags = BDRV_REQ_WRITE_UNCHANGED;
-    mirror_top_bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED |
-                                          BDRV_REQ_NO_FALLBACK;
+    mirror_top_bs->supported_zero_flags = BDRV_REQ_WRITE_UNCHANGED;
    bs_opaque = g_new0(MirrorBDSOpaque, 1);
    mirror_top_bs->opaque = bs_opaque;
    bdrv_set_aio_context(mirror_top_bs, bdrv_get_aio_context(bs));
@@ -1632,14 +1609,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
        goto fail;
    }

-    ret = block_job_add_bdrv(&s->common, "source", bs, 0,
-                             BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
-                             BLK_PERM_CONSISTENT_READ,
-                             errp);
-    if (ret < 0) {
-        goto fail;
-    }
-
    /* Required permissions are already taken with blk_new() */
    block_job_add_bdrv(&s->common, "target", target, 0, BLK_PERM_ALL,
                       &error_abort);
@@ -1660,10 +1629,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
                goto fail;
            }
        }
-
-        if (bdrv_freeze_backing_chain(mirror_top_bs, target, errp) < 0) {
-            goto fail;
-        }
    }

    QTAILQ_INIT(&s->ops_in_flight);
@@ -1681,9 +1646,6 @@ fail:
        g_free(s->replaces);
        blk_unref(s->target);
        bs_opaque->job = NULL;
-        if (s->dirty_bitmap) {
-            bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);
-        }
        job_early_fail(&s->common.job);
    }

@@ -1727,15 +1689,13 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
                         BlockCompletionFunc *cb, void *opaque,
                         bool auto_complete, Error **errp)
 {
-    bool base_read_only;
+    int orig_base_flags;
    Error *local_err = NULL;

-    base_read_only = bdrv_is_read_only(base);
+    orig_base_flags = bdrv_get_flags(base);

-    if (base_read_only) {
-        if (bdrv_reopen_set_read_only(base, false, errp) < 0) {
-            return;
-        }
+    if (bdrv_reopen(base, bs->open_flags, errp)) {
+        return;
    }

    mirror_start_job(job_id, bs, creation_flags, base, NULL, speed, 0, 0,
@@ -1754,8 +1714,6 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
 error_restore_flags:
    /* ignore error and errp for bdrv_reopen, because we want to propagate
     * the original error */
-    if (base_read_only) {
-        bdrv_reopen_set_read_only(base, true, NULL);
-    }
+    bdrv_reopen(base, orig_base_flags, NULL);
    return;
 }
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -28,8 +28,6 @@
 */

 #include "qemu/osdep.h"
-
-#include "trace.h"
 #include "qapi/error.h"
 #include "nbd-client.h"

@@ -53,13 +51,15 @@ static void nbd_teardown_connection(BlockDriverState *bs)
 {
    NBDClientSession *client = nbd_get_client_session(bs);

-    assert(client->ioc);
+    if (!client->ioc) { /* Already closed */
+        return;
+    }

    /* finish any pending coroutines */
    qio_channel_shutdown(client->ioc,
                         QIO_CHANNEL_SHUTDOWN_BOTH,
                         NULL);
-    BDRV_POLL_WHILE(bs, client->connection_co);
+    BDRV_POLL_WHILE(bs, client->read_reply_co);

    nbd_client_detach_aio_context(bs);
    object_unref(OBJECT(client->sioc));
@@ -68,7 +68,7 @@ static void nbd_teardown_connection(BlockDriverState *bs)
    client->ioc = NULL;
 }

-static coroutine_fn void nbd_connection_entry(void *opaque)
+static coroutine_fn void nbd_read_reply_entry(void *opaque)
 {
    NBDClientSession *s = opaque;
    uint64_t i;
@@ -76,21 +76,10 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
    Error *local_err = NULL;

    while (!s->quit) {
-        /*
-         * The NBD client can only really be considered idle when it has
-         * yielded from qio_channel_readv_all_eof(), waiting for data. This is
-         * the point where the additional scheduled coroutine entry happens
-         * after nbd_client_attach_aio_context().
-         *
-         * Therefore we keep an additional in_flight reference all the time and
-         * only drop it temporarily here.
-         */
        assert(s->reply.handle == 0);
-        ret = nbd_receive_reply(s->bs, s->ioc, &s->reply, &local_err);
-
+        ret = nbd_receive_reply(s->ioc, &s->reply, &local_err);
        if (local_err) {
-            trace_nbd_read_reply_entry_fail(ret, error_get_pretty(local_err));
-            error_free(local_err);
+            error_report_err(local_err);
        }
        if (ret <= 0) {
            break;
@@ -110,14 +99,14 @@ static coroutine_fn void nbd_connection_entry(void *opaque)
        }

        /* We're woken up again by the request itself.  Note that there
-         * is no race between yielding and reentering connection_co.  This
+         * is no race between yielding and reentering read_reply_co.  This
         * is because:
         *
         * - if the request runs on the same AioContext, it is only
         *   entered after we yield
         *
         * - if the request runs on a different AioContext, reentering
-         *   connection_co happens through a bottom half, which can only
+         *   read_reply_co happens through a bottom half, which can only
         *   run after we yield.
         */
        aio_co_wake(s->requests[i].coroutine);
@@ -126,9 +115,7 @@ static coroutine_fn void nbd_connection_entry(void *opaque)

    s->quit = true;
    nbd_recv_coroutines_wake_all(s);
-    bdrv_dec_in_flight(s->bs);
-
-    s->connection_co = NULL;
+    s->read_reply_co = NULL;
    aio_wait_kick();
 }

@@ -164,7 +151,10 @@ static int nbd_co_send_request(BlockDriverState *bs,
        rc = -EIO;
        goto err;
    }
-    assert(s->ioc);
+    if (!s->ioc) {
+        rc = -EPIPE;
+        goto err;
+    }

    if (qiov) {
        qio_channel_set_cork(s->ioc, true);
@@ -257,11 +247,11 @@ static int nbd_parse_blockstatus_payload(NBDClientSession *client,
    }

    context_id = payload_advance32(&payload);
-    if (client->info.context_id != context_id) {
+    if (client->info.meta_base_allocation_id != context_id) {
        error_setg(errp, "Protocol error: unexpected context id %d for "
                         "NBD_REPLY_TYPE_BLOCK_STATUS, when negotiated context "
                         "id is %d", context_id,
-                         client->info.context_id);
+                         client->info.meta_base_allocation_id);
        return -EINVAL;
    }

@@ -345,9 +335,10 @@ static int nbd_co_receive_offset_data_payload(NBDClientSession *s,
        return -EINVAL;
    }

-    if (nbd_read64(s->ioc, &offset, "OFFSET_DATA offset", errp) < 0) {
+    if (nbd_read(s->ioc, &offset, sizeof(offset), errp) < 0) {
        return -EIO;
    }
+    be64_to_cpus(&offset);

    data_size = chunk->length - sizeof(offset);
    assert(data_size);
@@ -394,7 +385,7 @@ static coroutine_fn int nbd_co_receive_structured_payload(
    }

    *payload = g_new(char, len);
-    ret = nbd_read(s->ioc, *payload, len, "structured payload", errp);
+    ret = nbd_read(s->ioc, *payload, len, errp);
    if (ret < 0) {
        g_free(*payload);
        *payload = NULL;
@@ -432,15 +423,14 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
    }
    *request_ret = 0;

-    /* Wait until we're woken up by nbd_connection_entry.  */
+    /* Wait until we're woken up by nbd_read_reply_entry.  */
    s->requests[i].receiving = true;
    qemu_coroutine_yield();
    s->requests[i].receiving = false;
-    if (s->quit) {
+    if (!s->ioc || s->quit) {
        error_setg(errp, "Connection closed");
        return -EIO;
    }
-    assert(s->ioc);

    assert(s->reply.handle == handle);

@@ -507,29 +497,30 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
 }

 /* nbd_co_receive_one_chunk
- * Read reply, wake up connection_co and set s->quit if needed.
+ * Read reply, wake up read_reply_co and set s->quit if needed.
 * Return value is a fatal error code or normal nbd reply error code
 */
 static coroutine_fn int nbd_co_receive_one_chunk(
        NBDClientSession *s, uint64_t handle, bool only_structured,
-        int *request_ret, QEMUIOVector *qiov, NBDReply *reply, void **payload,
-        Error **errp)
+        QEMUIOVector *qiov, NBDReply *reply, void **payload, Error **errp)
 {
+    int request_ret;
    int ret = nbd_co_do_receive_one_chunk(s, handle, only_structured,
-                                          request_ret, qiov, payload, errp);
+                                          &request_ret, qiov, payload, errp);

    if (ret < 0) {
        s->quit = true;
    } else {
-        /* For assert at loop start in nbd_connection_entry */
+        /* For assert at loop start in nbd_read_reply_entry */
        if (reply) {
            *reply = s->reply;
        }
        s->reply.handle = 0;
+        ret = request_ret;
    }

-    if (s->connection_co) {
-        aio_co_wake(s->connection_co);
+    if (s->read_reply_co) {
+        aio_co_wake(s->read_reply_co);
    }

    return ret;
@@ -537,17 +528,22 @@ static coroutine_fn int nbd_co_receive_one_chunk(

 typedef struct NBDReplyChunkIter {
    int ret;
-    int request_ret;
+    bool fatal;
    Error *err;
    bool done, only_structured;
 } NBDReplyChunkIter;

-static void nbd_iter_channel_error(NBDReplyChunkIter *iter,
-                                   int ret, Error **local_err)
+static void nbd_iter_error(NBDReplyChunkIter *iter, bool fatal,
+                           int ret, Error **local_err)
 {
    assert(ret < 0);

-    if (!iter->ret) {
+    if ((fatal && !iter->fatal) || iter->ret == 0) {
+        if (iter->ret != 0) {
+            error_free(iter->err);
+            iter->err = NULL;
+        }
+        iter->fatal = fatal;
        iter->ret = ret;
        error_propagate(&iter->err, *local_err);
    } else {
@@ -557,15 +553,6 @@ static void nbd_iter_channel_error(NBDReplyChunkIter *iter,
    *local_err = NULL;
 }

-static void nbd_iter_request_error(NBDReplyChunkIter *iter, int ret)
-{
-    assert(ret < 0);
-
-    if (!iter->request_ret) {
-        iter->request_ret = ret;
-    }
-}
-
 /* NBD_FOREACH_REPLY_CHUNK
 */
 #define NBD_FOREACH_REPLY_CHUNK(s, iter, handle, structured, \
@@ -581,13 +568,13 @@ static bool nbd_reply_chunk_iter_receive(NBDClientSession *s,
                                         QEMUIOVector *qiov, NBDReply *reply,
                                         void **payload)
 {
-    int ret, request_ret;
+    int ret;
    NBDReply local_reply;
    NBDStructuredReplyChunk *chunk;
    Error *local_err = NULL;
    if (s->quit) {
        error_setg(&local_err, "Connection closed");
-        nbd_iter_channel_error(iter, -EIO, &local_err);
+        nbd_iter_error(iter, true, -EIO, &local_err);
        goto break_loop;
    }

@@ -601,16 +588,14 @@ static bool nbd_reply_chunk_iter_receive(NBDClientSession *s,
    }

    ret = nbd_co_receive_one_chunk(s, handle, iter->only_structured,
-                                   &request_ret, qiov, reply, payload,
-                                   &local_err);
+                                   qiov, reply, payload, &local_err);
    if (ret < 0) {
-        nbd_iter_channel_error(iter, ret, &local_err);
-    } else if (request_ret < 0) {
-        nbd_iter_request_error(iter, request_ret);
+        /* If it is a fatal error s->quit is set by nbd_co_receive_one_chunk */
+        nbd_iter_error(iter, s->quit, ret, &local_err);
    }

    /* Do not execute the body of NBD_FOREACH_REPLY_CHUNK for simple reply. */
-    if (nbd_reply_is_simple(reply) || s->quit) {
+    if (nbd_reply_is_simple(&s->reply) || s->quit) {
        goto break_loop;
    }

@@ -643,7 +628,7 @@ break_loop:
 }

 static int nbd_co_receive_return_code(NBDClientSession *s, uint64_t handle,
-                                      int *request_ret, Error **errp)
+                                      Error **errp)
 {
    NBDReplyChunkIter iter;

@@ -652,13 +637,12 @@ static int nbd_co_receive_return_code(NBDClientSession *s, uint64_t handle,
    }

    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                                        uint64_t offset, QEMUIOVector *qiov,
-                                        int *request_ret, Error **errp)
+                                        Error **errp)
 {
    NBDReplyChunkIter iter;
    NBDReply reply;
@@ -683,7 +667,7 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                                                offset, qiov, &local_err);
            if (ret < 0) {
                s->quit = true;
-                nbd_iter_channel_error(&iter, ret, &local_err);
+                nbd_iter_error(&iter, true, ret, &local_err);
            }
            break;
        default:
@@ -693,7 +677,7 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
                error_setg(&local_err,
                           "Unexpected reply type: %d (%s) for CMD_READ",
                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
        }

@@ -702,14 +686,12 @@ static int nbd_co_receive_cmdread_reply(NBDClientSession *s, uint64_t handle,
    }

    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                                            uint64_t handle, uint64_t length,
-                                            NBDExtent *extent,
-                                            int *request_ret, Error **errp)
+                                            NBDExtent *extent, Error **errp)
 {
    NBDReplyChunkIter iter;
    NBDReply reply;
@@ -731,7 +713,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
            if (received) {
                s->quit = true;
                error_setg(&local_err, "Several BLOCK_STATUS chunks in reply");
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
            received = true;

@@ -740,7 +722,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                                                &local_err);
            if (ret < 0) {
                s->quit = true;
-                nbd_iter_channel_error(&iter, ret, &local_err);
+                nbd_iter_error(&iter, true, ret, &local_err);
            }
            break;
        default:
@@ -750,7 +732,7 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
                           "Unexpected reply type: %d (%s) "
                           "for CMD_BLOCK_STATUS",
                           chunk->type, nbd_reply_type_lookup(chunk->type));
-                nbd_iter_channel_error(&iter, -EINVAL, &local_err);
+                nbd_iter_error(&iter, true, -EINVAL, &local_err);
            }
        }

@@ -765,16 +747,14 @@ static int nbd_co_receive_blockstatus_reply(NBDClientSession *s,
            iter.ret = -EIO;
        }
    }
-
    error_propagate(errp, iter.err);
-    *request_ret = iter.request_ret;
    return iter.ret;
 }

 static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
                          QEMUIOVector *write_qiov)
 {
-    int ret, request_ret;
+    int ret;
    Error *local_err = NULL;
    NBDClientSession *client = nbd_get_client_session(bs);

@@ -790,22 +770,17 @@ static int nbd_co_request(BlockDriverState *bs, NBDRequest *request,
        return ret;
    }

-    ret = nbd_co_receive_return_code(client, request->handle,
-                                     &request_ret, &local_err);
+    ret = nbd_co_receive_return_code(client, request->handle, &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request->from, request->len, request->handle,
-                                  request->flags, request->type,
-                                  nbd_cmd_lookup(request->type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    return ret ? ret : request_ret;
+    return ret;
 }

 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    int ret, request_ret;
+    int ret;
    Error *local_err = NULL;
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
@@ -826,15 +801,11 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
    }

    ret = nbd_co_receive_cmdread_reply(client, request.handle, offset, qiov,
-                                       &request_ret, &local_err);
+                                       &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    return ret ? ret : request_ret;
+    return ret;
 }

 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
@@ -928,7 +899,7 @@ int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
                                            int64_t *pnum, int64_t *map,
                                            BlockDriverState **file)
 {
-    int ret, request_ret;
+    int64_t ret;
    NBDExtent extent = { 0 };
    NBDClientSession *client = nbd_get_client_session(bs);
    Error *local_err = NULL;
@@ -953,16 +924,12 @@ int coroutine_fn nbd_client_co_block_status(BlockDriverState *bs,
    }

    ret = nbd_co_receive_blockstatus_reply(client, request.handle, bytes,
-                                           &extent, &request_ret, &local_err);
+                                           &extent, &local_err);
    if (local_err) {
-        trace_nbd_co_request_fail(request.from, request.len, request.handle,
-                                  request.flags, request.type,
-                                  nbd_cmd_lookup(request.type),
-                                  ret, error_get_pretty(local_err));
-        error_free(local_err);
+        error_report_err(local_err);
    }
-    if (ret < 0 || request_ret < 0) {
-        return ret ? ret : request_ret;
+    if (ret < 0) {
+        return ret;
    }

    assert(extent.length);
@@ -977,30 +944,12 @@ void nbd_client_detach_aio_context(BlockDriverState *bs)
    qio_channel_detach_aio_context(QIO_CHANNEL(client->ioc));
 }

-static void nbd_client_attach_aio_context_bh(void *opaque)
-{
-    BlockDriverState *bs = opaque;
-    NBDClientSession *client = nbd_get_client_session(bs);
-
-    /* The node is still drained, so we know the coroutine has yielded in
-     * nbd_read_eof(), the only place where bs->in_flight can reach 0, or it is
-     * entered for the first time. Both places are safe for entering the
-     * coroutine.*/
-    qemu_aio_coroutine_enter(bs->aio_context, client->connection_co);
-    bdrv_dec_in_flight(bs);
-}
-
 void nbd_client_attach_aio_context(BlockDriverState *bs,
                                   AioContext *new_context)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    qio_channel_attach_aio_context(QIO_CHANNEL(client->ioc), new_context);
-
-    bdrv_inc_in_flight(bs);
-
-    /* Need to wait here for the BH to run because the BH must run while the
-     * node is still drained. */
-    aio_wait_bh_oneshot(new_context, nbd_client_attach_aio_context_bh, bs);
+    aio_co_schedule(new_context, client->read_reply_co);
 }

 void nbd_client_close(BlockDriverState *bs)
@@ -1008,55 +957,26 @@ void nbd_client_close(BlockDriverState *bs)
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = { .type = NBD_CMD_DISC };

-    assert(client->ioc);
+    if (client->ioc == NULL) {
+        return;
+    }

    nbd_send_request(client->ioc, &request);

    nbd_teardown_connection(bs);
 }

-static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
-                                                  Error **errp)
-{
-    QIOChannelSocket *sioc;
-    Error *local_err = NULL;
-
-    sioc = qio_channel_socket_new();
-    qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");
-
-    qio_channel_socket_connect_sync(sioc, saddr, &local_err);
-    if (local_err) {
-        object_unref(OBJECT(sioc));
-        error_propagate(errp, local_err);
-        return NULL;
-    }
-
-    qio_channel_set_delay(QIO_CHANNEL(sioc), false);
-
-    return sioc;
-}
-
-static int nbd_client_connect(BlockDriverState *bs,
-                              SocketAddress *saddr,
-                              const char *export,
-                              QCryptoTLSCreds *tlscreds,
-                              const char *hostname,
-                              const char *x_dirty_bitmap,
-                              Error **errp)
+int nbd_client_init(BlockDriverState *bs,
+                    QIOChannelSocket *sioc,
+                    const char *export,
+                    QCryptoTLSCreds *tlscreds,
+                    const char *hostname,
+                    const char *x_dirty_bitmap,
+                    Error **errp)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    int ret;

-    /*
-     * establish TCP connection, return error if it fails
-     * TODO: Configurable retry-until-timeout behaviour.
-     */
-    QIOChannelSocket *sioc = nbd_establish_connection(saddr, errp);
-
-    if (!sioc) {
-        return -ECONNREFUSED;
-    }
-
    /* NBD handshake */
    logout("session init %s\n", export);
    qio_channel_set_blocking(QIO_CHANNEL(sioc), true, NULL);
@@ -1065,14 +985,12 @@ static int nbd_client_connect(BlockDriverState *bs,
    client->info.structured_reply = true;
    client->info.base_allocation = true;
    client->info.x_dirty_bitmap = g_strdup(x_dirty_bitmap);
-    client->info.name = g_strdup(export ?: "");
-    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), tlscreds, hostname,
+    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), export,
+                                tlscreds, hostname,
                                &client->ioc, &client->info, errp);
    g_free(client->info.x_dirty_bitmap);
-    g_free(client->info.name);
    if (ret < 0) {
        logout("Failed to negotiate with the NBD server\n");
-        object_unref(OBJECT(sioc));
        return ret;
    }
    if (x_dirty_bitmap && !client->info.base_allocation) {
@@ -1095,7 +1013,10 @@ static int nbd_client_connect(BlockDriverState *bs,
        bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
    }

+    qemu_co_mutex_init(&client->send_mutex);
+    qemu_co_queue_init(&client->free_sema);
    client->sioc = sioc;
+    object_ref(OBJECT(client->sioc));

    if (!client->ioc) {
        client->ioc = QIO_CHANNEL(sioc);
@@ -1105,8 +1026,7 @@ static int nbd_client_connect(BlockDriverState *bs,
    /* Now that we're connected, set the socket to be non-blocking and
     * kick the reply mechanism.  */
    qio_channel_set_blocking(QIO_CHANNEL(sioc), false, NULL);
-    client->connection_co = qemu_coroutine_create(nbd_connection_entry, client);
-    bdrv_inc_in_flight(bs);
+    client->read_reply_co = qemu_coroutine_create(nbd_read_reply_entry, client);
    nbd_client_attach_aio_context(bs, bdrv_get_aio_context(bs));

    logout("Established connection with NBD server\n");
@@ -1122,27 +1042,6 @@ static int nbd_client_connect(BlockDriverState *bs,
        NBDRequest request = { .type = NBD_CMD_DISC };

        nbd_send_request(client->ioc ?: QIO_CHANNEL(sioc), &request);
-
-        object_unref(OBJECT(sioc));
-
        return ret;
    }
 }
-
-int nbd_client_init(BlockDriverState *bs,
-                    SocketAddress *saddr,
-                    const char *export,
-                    QCryptoTLSCreds *tlscreds,
-                    const char *hostname,
-                    const char *x_dirty_bitmap,
-                    Error **errp)
-{
-    NBDClientSession *client = nbd_get_client_session(bs);
-
-    client->bs = bs;
-    qemu_co_mutex_init(&client->send_mutex);
-    qemu_co_queue_init(&client->free_sema);
-
-    return nbd_client_connect(bs, saddr, export, tlscreds, hostname,
-                              x_dirty_bitmap, errp);
-}
--- a/block/nbd-client.h
+++ b/block/nbd-client.h
@@ -20,7 +20,7 @@
 typedef struct {
    Coroutine *coroutine;
    uint64_t offset;        /* original offset of the request */
-    bool receiving;         /* waiting for connection_co? */
+    bool receiving;         /* waiting for read_reply_co? */
 } NBDClientRequest;

 typedef struct NBDClientSession {
@@ -30,19 +30,18 @@ typedef struct NBDClientSession {

    CoMutex send_mutex;
    CoQueue free_sema;
-    Coroutine *connection_co;
+    Coroutine *read_reply_co;
    int in_flight;

    NBDClientRequest requests[MAX_NBD_REQUESTS];
    NBDReply reply;
-    BlockDriverState *bs;
    bool quit;
 } NBDClientSession;

 NBDClientSession *nbd_get_client_session(BlockDriverState *bs);

 int nbd_client_init(BlockDriverState *bs,
-                    SocketAddress *saddr,
+                    QIOChannelSocket *sock,
                    const char *export_name,
                    QCryptoTLSCreds *tlscreds,
                    const char *hostname,
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -295,6 +295,30 @@ NBDClientSession *nbd_get_client_session(BlockDriverState *bs)
    return &s->client;
 }

+static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
+                                                  Error **errp)
+{
+    QIOChannelSocket *sioc;
+    Error *local_err = NULL;
+
+    sioc = qio_channel_socket_new();
+    qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");
+
+    qio_channel_socket_connect_sync(sioc,
+                                    saddr,
+                                    &local_err);
+    if (local_err) {
+        object_unref(OBJECT(sioc));
+        error_propagate(errp, local_err);
+        return NULL;
+    }
+
+    qio_channel_set_delay(QIO_CHANNEL(sioc), false);
+
+    return sioc;
+}
+
+
 static QCryptoTLSCreds *nbd_get_tls_creds(const char *id, Error **errp)
 {
    Object *obj;
@@ -370,6 +394,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
    BDRVNBDState *s = bs->opaque;
    QemuOpts *opts = NULL;
    Error *local_err = NULL;
+    QIOChannelSocket *sioc = NULL;
    QCryptoTLSCreds *tlscreds = NULL;
    const char *hostname = NULL;
    int ret = -EINVAL;
@@ -409,11 +434,22 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        hostname = s->saddr->u.inet.host;
    }

-    /* NBD handshake */
-    ret = nbd_client_init(bs, s->saddr, s->export, tlscreds, hostname,
-                          qemu_opt_get(opts, "x-dirty-bitmap"), errp);
+    /* establish TCP connection, return error if it fails
+     * TODO: Configurable retry-until-timeout behaviour.
+     */
+    sioc = nbd_establish_connection(s->saddr, errp);
+    if (!sioc) {
+        ret = -ECONNREFUSED;
+        goto error;
+    }

+    /* NBD handshake */
+    ret = nbd_client_init(bs, sioc, s->export, tlscreds, hostname,
+                          qemu_opt_get(opts, "x-dirty-bitmap"), errp);
 error:
+    if (sioc) {
+        object_unref(OBJECT(sioc));
+    }
    if (tlscreds) {
        object_unref(OBJECT(tlscreds));
    }
@@ -477,9 +513,12 @@ static void nbd_attach_aio_context(BlockDriverState *bs,
    nbd_client_attach_aio_context(bs, new_context);
 }

-static void nbd_refresh_filename(BlockDriverState *bs)
+static void nbd_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVNBDState *s = bs->opaque;
+    QDict *opts = qdict_new();
+    QObject *saddr_qdict;
+    Visitor *ov;
    const char *host = NULL, *port = NULL, *path = NULL;

    if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
@@ -492,6 +531,8 @@ static void nbd_refresh_filename(BlockDriverState *bs)
        path = s->saddr->u.q_unix.path;
    } /* else can't represent as pseudo-filename */

+    qdict_put_str(opts, "driver", "nbd");
+
    if (path && s->export) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nbd+unix:///%s?socket=%s", s->export, path);
@@ -505,29 +546,24 @@ static void nbd_refresh_filename(BlockDriverState *bs)
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nbd://%s:%s", host, port);
    }
+
+    ov = qobject_output_visitor_new(&saddr_qdict);
+    visit_type_SocketAddress(ov, NULL, &s->saddr, &error_abort);
+    visit_complete(ov, &saddr_qdict);
+    visit_free(ov);
+    qdict_put_obj(opts, "server", saddr_qdict);
+
+    if (s->export) {
+        qdict_put_str(opts, "export", s->export);
+    }
+    if (s->tlscredsid) {
+        qdict_put_str(opts, "tls-creds", s->tlscredsid);
+    }
+
+    qdict_flatten(opts);
+    bs->full_open_options = opts;
 }

-static char *nbd_dirname(BlockDriverState *bs, Error **errp)
-{
-    /* The generic bdrv_dirname() implementation is able to work out some
-     * directory name for NBD nodes, but that would be wrong. So far there is no
-     * specification for how "export paths" would work, so NBD does not have
-     * directory names. */
-    error_setg(errp, "Cannot generate a base directory for NBD nodes");
-    return NULL;
-}
-
-static const char *const nbd_strong_runtime_opts[] = {
-    "path",
-    "host",
-    "port",
-    "export",
-    "tls-creds",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_nbd = {
    .format_name                = "nbd",
    .protocol_name              = "nbd",
@@ -546,8 +582,6 @@ static BlockDriver bdrv_nbd = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static BlockDriver bdrv_nbd_tcp = {
@@ -568,8 +602,6 @@ static BlockDriver bdrv_nbd_tcp = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static BlockDriver bdrv_nbd_unix = {
@@ -590,8 +622,6 @@ static BlockDriver bdrv_nbd_unix = {
    .bdrv_attach_aio_context    = nbd_attach_aio_context,
    .bdrv_refresh_filename      = nbd_refresh_filename,
    .bdrv_co_block_status       = nbd_client_co_block_status,
-    .bdrv_dirname               = nbd_dirname,
-    .strong_runtime_opts        = nbd_strong_runtime_opts,
 };

 static void bdrv_nbd_init(void)
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -799,9 +799,14 @@ static int nfs_reopen_prepare(BDRVReopenState *state,
    return 0;
 }

-static void nfs_refresh_filename(BlockDriverState *bs)
+static void nfs_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    NFSClient *client = bs->opaque;
+    QDict *opts = qdict_new();
+    QObject *server_qdict;
+    Visitor *ov;
+
+    qdict_put_str(opts, "driver", "nfs");

    if (client->uid && !client->gid) {
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
@@ -819,20 +824,35 @@ static void nfs_refresh_filename(BlockDriverState *bs)
        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
                 "nfs://%s%s", client->server->host, client->path);
    }
-}

-static char *nfs_dirname(BlockDriverState *bs, Error **errp)
-{
-    NFSClient *client = bs->opaque;
+    ov = qobject_output_visitor_new(&server_qdict);
+    visit_type_NFSServer(ov, NULL, &client->server, &error_abort);
+    visit_complete(ov, &server_qdict);
+    qdict_put_obj(opts, "server", server_qdict);
+    qdict_put_str(opts, "path", client->path);

-    if (client->uid || client->gid) {
-        bdrv_refresh_filename(bs);
-        error_setg(errp, "Cannot generate a base directory for NFS node '%s'",
-                   bs->filename);
-        return NULL;
+    if (client->uid) {
+        qdict_put_int(opts, "user", client->uid);
+    }
+    if (client->gid) {
+        qdict_put_int(opts, "group", client->gid);
+    }
+    if (client->tcp_syncnt) {
+        qdict_put_int(opts, "tcp-syn-cnt", client->tcp_syncnt);
+    }
+    if (client->readahead) {
+        qdict_put_int(opts, "readahead-size", client->readahead);
+    }
+    if (client->pagecache) {
+        qdict_put_int(opts, "page-cache-size", client->pagecache);
+    }
+    if (client->debug) {
+        qdict_put_int(opts, "debug", client->debug);
    }

-    return g_strdup_printf("nfs://%s%s/", client->server->host, client->path);
+    visit_free(ov);
+    qdict_flatten(opts);
+    bs->full_open_options = opts;
 }

 #ifdef LIBNFS_FEATURE_PAGECACHE
@@ -844,15 +864,6 @@ static void coroutine_fn nfs_co_invalidate_cache(BlockDriverState *bs,
 }
 #endif

-static const char *nfs_strong_runtime_opts[] = {
-    "path",
-    "user",
-    "group",
-    "server.",
-
-    NULL
-};
-
 static BlockDriver bdrv_nfs = {
    .format_name                    = "nfs",
    .protocol_name                  = "nfs",
@@ -878,9 +889,6 @@ static BlockDriver bdrv_nfs = {
    .bdrv_detach_aio_context        = nfs_detach_aio_context,
    .bdrv_attach_aio_context        = nfs_attach_aio_context,
    .bdrv_refresh_filename          = nfs_refresh_filename,
-    .bdrv_dirname                   = nfs_dirname,
-
-    .strong_runtime_opts            = nfs_strong_runtime_opts,

 #ifdef LIBNFS_FEATURE_PAGECACHE
    .bdrv_co_invalidate_cache       = nfs_co_invalidate_cache,
--- a/block/null.c
+++ b/block/null.c
@@ -239,33 +239,19 @@ static int coroutine_fn null_co_block_status(BlockDriverState *bs,
    return ret;
 }

-static void null_refresh_filename(BlockDriverState *bs)
+static void null_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
-    const QDictEntry *e;
+    qdict_del(opts, "filename");

-    for (e = qdict_first(bs->full_open_options); e;
-         e = qdict_next(bs->full_open_options, e))
-    {
-        /* These options can be ignored */
-        if (strcmp(qdict_entry_key(e), "filename") &&
-            strcmp(qdict_entry_key(e), "driver") &&
-            strcmp(qdict_entry_key(e), NULL_OPT_LATENCY))
-        {
-            return;
-        }
+    if (!qdict_size(opts)) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
+                 bs->drv->format_name);
    }

-    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
-             bs->drv->format_name);
+    qdict_put_str(opts, "driver", bs->drv->format_name);
+    bs->full_open_options = qobject_ref(opts);
 }

-static const char *const null_strong_runtime_opts[] = {
-    BLOCK_OPT_SIZE,
-    NULL_OPT_ZEROES,
-
-    NULL
-};
-
 static BlockDriver bdrv_null_co = {
    .format_name            = "null-co",
    .protocol_name          = "null-co",
@@ -283,7 +269,6 @@ static BlockDriver bdrv_null_co = {
    .bdrv_co_block_status   = null_co_block_status,

    .bdrv_refresh_filename  = null_refresh_filename,
-    .strong_runtime_opts    = null_strong_runtime_opts,
 };

 static BlockDriver bdrv_null_aio = {
@@ -303,7 +288,6 @@ static BlockDriver bdrv_null_aio = {
    .bdrv_co_block_status   = null_co_block_status,

    .bdrv_refresh_filename  = null_refresh_filename,
-    .strong_runtime_opts    = null_strong_runtime_opts,
 };

 static void bdrv_null_init(void)
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -82,7 +82,7 @@ typedef volatile struct {
    uint8_t  reserved1[0xec0];
    uint8_t  cmd_set_specfic[0x100];
    uint32_t doorbells[];
-} NVMeRegs;
+} QEMU_PACKED NVMeRegs;

 QEMU_BUILD_BUG_ON(offsetof(NVMeRegs, doorbells) != 0x1000);

@@ -111,9 +111,6 @@ typedef struct {

    /* Total size of mapped qiov, accessed under dma_map_lock */
    int dma_map_count;
-
-    /* PCI address (required for nvme_refresh_filename()) */
-    char *device;
 } BDRVNVMeState;

 #define NVME_BLOCK_OPT_DEVICE "device"
@@ -560,7 +557,6 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,

    qemu_co_mutex_init(&s->dma_map_lock);
    qemu_co_queue_init(&s->dma_flush_queue);
-    s->device = g_strdup(device);
    s->nsid = namespace;
    s->aio_context = bdrv_get_aio_context(bs);
    ret = event_notifier_init(&s->irq_notifier, 0);
@@ -733,8 +729,6 @@ static void nvme_close(BlockDriverState *bs)
    event_notifier_cleanup(&s->irq_notifier);
    qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
    qemu_vfio_close(s->vfio);
-
-    g_free(s->device);
 }

 static int nvme_file_open(BlockDriverState *bs, QDict *options, int flags,
@@ -844,7 +838,7 @@ try_map:
        }

        for (j = 0; j < qiov->iov[i].iov_len / s->page_size; j++) {
-            pagelist[entries++] = cpu_to_le64(iova + j * s->page_size);
+            pagelist[entries++] = iova + j * s->page_size;
        }
        trace_nvme_cmd_map_qiov_iov(s, i, qiov->iov[i].iov_base,
                                    qiov->iov[i].iov_len / s->page_size);
@@ -857,16 +851,20 @@ try_map:
    case 0:
        abort();
    case 1:
-        cmd->prp1 = pagelist[0];
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
        cmd->prp2 = 0;
        break;
    case 2:
-        cmd->prp1 = pagelist[0];
-        cmd->prp2 = pagelist[1];
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
+        cmd->prp2 = cpu_to_le64(pagelist[1]);;
        break;
    default:
-        cmd->prp1 = pagelist[0];
-        cmd->prp2 = cpu_to_le64(req->prp_list_iova + sizeof(uint64_t));
+        cmd->prp1 = cpu_to_le64(pagelist[0]);
+        cmd->prp2 = cpu_to_le64(req->prp_list_iova);
+        for (i = 0; i < entries - 1; ++i) {
+            pagelist[i] = cpu_to_le64(pagelist[i + 1]);
+        }
+        pagelist[entries - 1] = 0;
        break;
    }
    trace_nvme_cmd_map_qiov(s, cmd, req, qiov, entries);
@@ -1059,12 +1057,17 @@ static int nvme_reopen_prepare(BDRVReopenState *reopen_state,
    return 0;
 }

-static void nvme_refresh_filename(BlockDriverState *bs)
+static void nvme_refresh_filename(BlockDriverState *bs, QDict *opts)
 {
-    BDRVNVMeState *s = bs->opaque;
+    qdict_del(opts, "filename");

-    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "nvme://%s/%i",
-             s->device, s->nsid);
+    if (!qdict_size(opts)) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s://",
+                 bs->drv->format_name);
+    }
+
+    qdict_put_str(opts, "driver", bs->drv->format_name);
+    bs->full_open_options = qobject_ref(opts);
 }

 static void nvme_refresh_limits(BlockDriverState *bs, Error **errp)
@@ -1137,13 +1140,6 @@ static void nvme_unregister_buf(BlockDriverState *bs, void *host)
    qemu_vfio_dma_unmap(s->vfio, host);
 }

-static const char *const nvme_strong_runtime_opts[] = {
-    NVME_BLOCK_OPT_DEVICE,
-    NVME_BLOCK_OPT_NAMESPACE,
-
-    NULL
-};
-
 static BlockDriver bdrv_nvme = {
    .format_name              = "nvme",
    .protocol_name            = "nvme",
@@ -1161,7 +1157,6 @@ static BlockDriver bdrv_nvme = {

    .bdrv_refresh_filename    = nvme_refresh_filename,
    .bdrv_refresh_limits      = nvme_refresh_limits,
-    .strong_runtime_opts      = nvme_strong_runtime_opts,

    .bdrv_detach_aio_context  = nvme_detach_aio_context,
    .bdrv_attach_aio_context  = nvme_attach_aio_context,
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -220,20 +220,23 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
    if (bs->backing) {
        int64_t nb_cow_sectors = to_allocate * s->tracks;
        int64_t nb_cow_bytes = nb_cow_sectors << BDRV_SECTOR_BITS;
-        QEMUIOVector qiov =
-            QEMU_IOVEC_INIT_BUF(qiov, qemu_blockalign(bs, nb_cow_bytes),
-                                nb_cow_bytes);
+        QEMUIOVector qiov;
+        struct iovec iov = {
+            .iov_len = nb_cow_bytes,
+            .iov_base = qemu_blockalign(bs, nb_cow_bytes)
+        };
+        qemu_iovec_init_external(&qiov, &iov, 1);

        ret = bdrv_co_preadv(bs->backing, idx * s->tracks * BDRV_SECTOR_SIZE,
                             nb_cow_bytes, &qiov, 0);
        if (ret < 0) {
-            qemu_vfree(qemu_iovec_buf(&qiov));
+            qemu_vfree(iov.iov_base);
            return ret;
        }

        ret = bdrv_co_pwritev(bs->file, s->data_end * BDRV_SECTOR_SIZE,
                              nb_cow_bytes, &qiov, 0);
-        qemu_vfree(qemu_iovec_buf(&qiov));
+        qemu_vfree(iov.iov_base);
        if (ret < 0) {
            return ret;
        }
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -51,8 +51,6 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
        return NULL;
    }

-    bdrv_refresh_filename(bs);
-
    info = g_malloc0(sizeof(*info));
    info->file                   = g_strdup(bs->filename);
    info->ro                     = bs->read_only;
@@ -266,8 +264,6 @@ void bdrv_query_image_info(BlockDriverState *bs,
        goto out;
    }

-    bdrv_refresh_filename(bs);
-
    info = g_new0(ImageInfo, 1);
    info->filename        = g_strdup(bs->filename);
    info->format          = g_strdup(bdrv_get_format_name(bs));
@@ -286,20 +282,23 @@ void bdrv_query_image_info(BlockDriverState *bs,
        info->dirty_flag = bdi.is_dirty;
        info->has_dirty_flag = true;
    }
-    info->format_specific = bdrv_get_specific_info(bs, &err);
-    if (err) {
-        error_propagate(errp, err);
-        qapi_free_ImageInfo(info);
-        goto out;
-    }
+    info->format_specific     = bdrv_get_specific_info(bs);
    info->has_format_specific = info->format_specific != NULL;

    backing_filename = bs->backing_file;
    if (backing_filename[0] != '\0') {
-        char *backing_filename2;
+        char *backing_filename2 = g_malloc0(PATH_MAX);
        info->backing_filename = g_strdup(backing_filename);
        info->has_backing_filename = true;
-        backing_filename2 = bdrv_get_full_backing_filename(bs, NULL);
+        bdrv_get_full_backing_filename(bs, backing_filename2, PATH_MAX, &err);
+        if (err) {
+            /* Can't reconstruct the full backing filename, so we must omit
+             * this field and apply a Best Effort to this query. */
+            g_free(backing_filename2);
+            backing_filename2 = NULL;
+            error_free(err);
+            err = NULL;
+        }

        /* Always report the full_backing_filename if present, even if it's the
         * same as backing_filename. That they are same is useful info. */
@@ -493,14 +492,14 @@ static void bdrv_query_blk_stats(BlockDeviceStats *ds, BlockBackend *blk)
    }

    bdrv_latency_histogram_stats(&stats->latency_histogram[BLOCK_ACCT_READ],
-                                 &ds->has_rd_latency_histogram,
-                                 &ds->rd_latency_histogram);
+                                 &ds->has_x_rd_latency_histogram,
+                                 &ds->x_rd_latency_histogram);
    bdrv_latency_histogram_stats(&stats->latency_histogram[BLOCK_ACCT_WRITE],
-                                 &ds->has_wr_latency_histogram,
-                                 &ds->wr_latency_histogram);
+                                 &ds->has_x_wr_latency_histogram,
+                                 &ds->x_wr_latency_histogram);
    bdrv_latency_histogram_stats(&stats->latency_histogram[BLOCK_ACCT_FLUSH],
-                                 &ds->has_flush_latency_histogram,
-                                 &ds->flush_latency_histogram);
+                                 &ds->has_x_flush_latency_histogram,
+                                 &ds->x_flush_latency_histogram);
 }

 static BlockStats *bdrv_query_bds_stats(BlockDriverState *bs,
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -31,7 +31,6 @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/bswap.h"
-#include "qemu/cutils.h"
 #include <zlib.h>
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qstring.h"
@@ -214,7 +213,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
            }
            s->crypto = qcrypto_block_open(crypto_opts, "encrypt.",
-                                           NULL, NULL, cflags, 1, errp);
+                                           NULL, NULL, cflags, errp);
            if (!s->crypto) {
                ret = -EINVAL;
                goto fail;
@@ -296,13 +295,11 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
            goto fail;
        }
        ret = bdrv_pread(bs->file, header.backing_file_offset,
-                   bs->auto_backing_file, len);
+                   bs->backing_file, len);
        if (ret < 0) {
            goto fail;
        }
-        bs->auto_backing_file[len] = '\0';
-        pstrcpy(bs->backing_file, sizeof(bs->backing_file),
-                bs->auto_backing_file);
+        bs->backing_file[len] = '\0';
    }

    /* Disable migration when qcow images are used */
@@ -631,6 +628,7 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
    int offset_in_cluster;
    int ret = 0, n;
    uint64_t cluster_offset;
+    struct iovec hd_iov;
    QEMUIOVector hd_qiov;
    uint8_t *buf;
    void *orig_buf;
@@ -663,7 +661,9 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
        if (!cluster_offset) {
            if (bs->backing) {
                /* read from the base image */
-                qemu_iovec_init_buf(&hd_qiov, buf, n);
+                hd_iov.iov_base = (void *)buf;
+                hd_iov.iov_len = n;
+                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
                qemu_co_mutex_unlock(&s->lock);
                /* qcow2 emits this on bs->file instead of bs->backing */
                BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
@@ -688,7 +688,9 @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
                ret = -EIO;
                break;
            }
-            qemu_iovec_init_buf(&hd_qiov, buf, n);
+            hd_iov.iov_base = (void *)buf;
+            hd_iov.iov_len = n;
+            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
            qemu_co_mutex_unlock(&s->lock);
            BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
            ret = bdrv_co_preadv(bs->file, cluster_offset + offset_in_cluster,
@@ -731,6 +733,7 @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
    int offset_in_cluster;
    uint64_t cluster_offset;
    int ret = 0, n;
+    struct iovec hd_iov;
    QEMUIOVector hd_qiov;
    uint8_t *buf;
    void *orig_buf;
@@ -776,7 +779,9 @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
            }
        }

-        qemu_iovec_init_buf(&hd_qiov, buf, n);
+        hd_iov.iov_base = (void *)buf;
+        hd_iov.iov_len = n;
+        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
        qemu_co_mutex_unlock(&s->lock);
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
        ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
@@ -1057,6 +1062,7 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 {
    BDRVQcowState *s = bs->opaque;
    QEMUIOVector hd_qiov;
+    struct iovec iov;
    z_stream strm;
    int ret, out_len;
    uint8_t *buf, *out_buf;
@@ -1122,7 +1128,11 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
    }
    cluster_offset &= s->cluster_offset_mask;

-    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
+    iov = (struct iovec) {
+        .iov_base   = out_buf,
+        .iov_len    = out_len,
+    };
+    qemu_iovec_init_external(&hd_qiov, &iov, 1);
    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
    ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
    if (ret < 0) {
@@ -1173,12 +1183,6 @@ static QemuOptsList qcow_create_opts = {
    }
 };

-static const char *const qcow_strong_runtime_opts[] = {
-    "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
-
-    NULL
-};
-
 static BlockDriver bdrv_qcow = {
    .format_name	= "qcow",
    .instance_size	= sizeof(BDRVQcowState),
@@ -1202,7 +1206,6 @@ static BlockDriver bdrv_qcow = {
    .bdrv_get_info          = qcow_get_info,

    .create_opts            = &qcow_create_opts,
-    .strong_runtime_opts    = qcow_strong_runtime_opts,
 };

 static void bdrv_qcow_init(void)
--- a/block/qcow2-bitmap.c
+++ b/block/qcow2-bitmap.c
@@ -77,6 +77,8 @@ typedef struct Qcow2BitmapTable {
    uint32_t size; /* number of 64bit entries */
    QSIMPLEQ_ENTRY(Qcow2BitmapTable) entry;
 } Qcow2BitmapTable;
+typedef QSIMPLEQ_HEAD(Qcow2BitmapTableList, Qcow2BitmapTable)
+    Qcow2BitmapTableList;

 typedef struct Qcow2Bitmap {
    Qcow2BitmapTable table;
@@ -343,15 +345,9 @@ static BdrvDirtyBitmap *load_bitmap(BlockDriverState *bs,
    uint32_t granularity;
    BdrvDirtyBitmap *bitmap = NULL;

-    granularity = 1U << bm->granularity_bits;
-    bitmap = bdrv_create_dirty_bitmap(bs, granularity, bm->name, errp);
-    if (bitmap == NULL) {
-        goto fail;
-    }
-
    if (bm->flags & BME_FLAG_IN_USE) {
-        /* Data is unusable, skip loading it */
-        return bitmap;
+        error_setg(errp, "Bitmap '%s' is in use", bm->name);
+        goto fail;
    }

    ret = bitmap_table_load(bs, &bm->table, &bitmap_table);
@@ -362,6 +358,12 @@ static BdrvDirtyBitmap *load_bitmap(BlockDriverState *bs,
        goto fail;
    }

+    granularity = 1U << bm->granularity_bits;
+    bitmap = bdrv_create_dirty_bitmap(bs, granularity, bm->name, errp);
+    if (bitmap == NULL) {
+        goto fail;
+    }
+
    ret = load_bitmap_data(bs, bitmap_table, bm->table.size, bitmap);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Could not read bitmap '%s' from image",
@@ -462,25 +464,10 @@ static int check_dir_entry(BlockDriverState *bs, Qcow2BitmapDirEntry *entry)
        return len;
    }

-    if (phys_bitmap_bytes > BME_MAX_PHYS_SIZE) {
-        return -EINVAL;
-    }
+    fail = (phys_bitmap_bytes > BME_MAX_PHYS_SIZE) ||
+           (len > ((phys_bitmap_bytes * 8) << entry->granularity_bits));

-    if (!(entry->flags & BME_FLAG_IN_USE) &&
-        (len > ((phys_bitmap_bytes * 8) << entry->granularity_bits)))
-    {
-        /*
-         * We've loaded a valid bitmap (IN_USE not set) or we are going to
-         * store a valid bitmap, but the allocated bitmap table size is not
-         * enough to store this bitmap.
-         *
-         * Note, that it's OK to have an invalid bitmap with invalid size due
-         * to a bitmap that was not correctly saved after image resize.
-         */
-        return -EINVAL;
-    }
-
-    return 0;
+    return fail ? -EINVAL : 0;
 }

 static inline void bitmap_directory_to_be(uint8_t *dir, size_t size)
@@ -793,8 +780,7 @@ static int bitmap_list_store(BlockDriverState *bs, Qcow2BitmapList *bm_list,
     * directory in-place (actually, turn-off the extension), which is checked
     * in qcow2_check_metadata_overlap() */
    ret = qcow2_pre_write_overlap_check(
-            bs, in_place ? QCOW2_OL_BITMAP_DIRECTORY : 0, dir_offset, dir_size,
-            false);
+            bs, in_place ? QCOW2_OL_BITMAP_DIRECTORY : 0, dir_offset, dir_size);
    if (ret < 0) {
        goto fail;
    }
@@ -965,7 +951,6 @@ bool qcow2_load_dirty_bitmaps(BlockDriverState *bs, Error **errp)
    Qcow2Bitmap *bm;
    GSList *created_dirty_bitmaps = NULL;
    bool header_updated = false;
-    bool needs_update = false;

    if (s->nb_bitmaps == 0) {
        /* No bitmaps - nothing to do */
@@ -979,39 +964,35 @@ bool qcow2_load_dirty_bitmaps(BlockDriverState *bs, Error **errp)
    }

    QSIMPLEQ_FOREACH(bm, bm_list, entry) {
-        BdrvDirtyBitmap *bitmap = load_bitmap(bs, bm, errp);
-        if (bitmap == NULL) {
-            goto fail;
-        }
+        if (!(bm->flags & BME_FLAG_IN_USE)) {
+            BdrvDirtyBitmap *bitmap = load_bitmap(bs, bm, errp);
+            if (bitmap == NULL) {
+                goto fail;
+            }

-        bdrv_dirty_bitmap_set_persistence(bitmap, true);
-        if (bm->flags & BME_FLAG_IN_USE) {
-            bdrv_dirty_bitmap_set_inconsistent(bitmap);
-        } else {
-            /* NB: updated flags only get written if can_write(bs) is true. */
+            if (!(bm->flags & BME_FLAG_AUTO)) {
+                bdrv_disable_dirty_bitmap(bitmap);
+            }
+            bdrv_dirty_bitmap_set_persistance(bitmap, true);
            bm->flags |= BME_FLAG_IN_USE;
-            needs_update = true;
+            created_dirty_bitmaps =
+                    g_slist_append(created_dirty_bitmaps, bitmap);
        }
-        if (!(bm->flags & BME_FLAG_AUTO)) {
-            bdrv_disable_dirty_bitmap(bitmap);
-        }
-        created_dirty_bitmaps =
-            g_slist_append(created_dirty_bitmaps, bitmap);
    }

-    if (needs_update && can_write(bs)) {
-        /* in_use flags must be updated */
-        int ret = update_ext_header_and_dir_in_place(bs, bm_list);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "Can't update bitmap directory");
-            goto fail;
+    if (created_dirty_bitmaps != NULL) {
+        if (can_write(bs)) {
+            /* in_use flags must be updated */
+            int ret = update_ext_header_and_dir_in_place(bs, bm_list);
+            if (ret < 0) {
+                error_setg_errno(errp, -ret, "Can't update bitmap directory");
+                goto fail;
+            }
+            header_updated = true;
+        } else {
+            g_slist_foreach(created_dirty_bitmaps, set_readonly_helper,
+                            (gpointer)true);
        }
-        header_updated = true;
-    }
-
-    if (!can_write(bs)) {
-        g_slist_foreach(created_dirty_bitmaps, set_readonly_helper,
-                        (gpointer)true);
    }

    g_slist_free(created_dirty_bitmaps);
@@ -1027,82 +1008,6 @@ fail:
    return false;
 }

-
-static Qcow2BitmapInfoFlagsList *get_bitmap_info_flags(uint32_t flags)
-{
-    Qcow2BitmapInfoFlagsList *list = NULL;
-    Qcow2BitmapInfoFlagsList **plist = &list;
-    int i;
-
-    static const struct {
-        int bme;  /* Bitmap directory entry flags */
-        int info; /* The flags to report to the user */
-    } map[] = {
-        { BME_FLAG_IN_USE, QCOW2_BITMAP_INFO_FLAGS_IN_USE },
-        { BME_FLAG_AUTO,   QCOW2_BITMAP_INFO_FLAGS_AUTO },
-    };
-
-    int map_size = ARRAY_SIZE(map);
-
-    for (i = 0; i < map_size; ++i) {
-        if (flags & map[i].bme) {
-            Qcow2BitmapInfoFlagsList *entry =
-                g_new0(Qcow2BitmapInfoFlagsList, 1);
-            entry->value = map[i].info;
-            *plist = entry;
-            plist = &entry->next;
-            flags &= ~map[i].bme;
-        }
-    }
-    /* Check if the BME_* mapping above is complete */
-    assert(!flags);
-
-    return list;
-}
-
-/*
- * qcow2_get_bitmap_info_list()
- * Returns a list of QCOW2 bitmap details.
- * In case of no bitmaps, the function returns NULL and
- * the @errp parameter is not set.
- * When bitmap information can not be obtained, the function returns
- * NULL and the @errp parameter is set.
- */
-Qcow2BitmapInfoList *qcow2_get_bitmap_info_list(BlockDriverState *bs,
-                                                Error **errp)
-{
-    BDRVQcow2State *s = bs->opaque;
-    Qcow2BitmapList *bm_list;
-    Qcow2Bitmap *bm;
-    Qcow2BitmapInfoList *list = NULL;
-    Qcow2BitmapInfoList **plist = &list;
-
-    if (s->nb_bitmaps == 0) {
-        return NULL;
-    }
-
-    bm_list = bitmap_list_load(bs, s->bitmap_directory_offset,
-                               s->bitmap_directory_size, errp);
-    if (bm_list == NULL) {
-        return NULL;
-    }
-
-    QSIMPLEQ_FOREACH(bm, bm_list, entry) {
-        Qcow2BitmapInfo *info = g_new0(Qcow2BitmapInfo, 1);
-        Qcow2BitmapInfoList *obj = g_new0(Qcow2BitmapInfoList, 1);
-        info->granularity = 1U << bm->granularity_bits;
-        info->name = g_strdup(bm->name);
-        info->flags = get_bitmap_info_flags(bm->flags & ~BME_RESERVED_FLAGS);
-        obj->value = info;
-        *plist = obj;
-        plist = &obj->next;
-    }
-
-    bitmap_list_free(bm_list);
-
-    return list;
-}
-
 int qcow2_reopen_bitmaps_rw_hint(BlockDriverState *bs, bool *header_updated,
                                 Error **errp)
 {
@@ -1133,21 +1038,23 @@ int qcow2_reopen_bitmaps_rw_hint(BlockDriverState *bs, bool *header_updated,
    }

    QSIMPLEQ_FOREACH(bm, bm_list, entry) {
-        BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(bs, bm->name);
-        if (bitmap == NULL) {
-            continue;
-        }
+        if (!(bm->flags & BME_FLAG_IN_USE)) {
+            BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(bs, bm->name);
+            if (bitmap == NULL) {
+                continue;
+            }

-        if (!bdrv_dirty_bitmap_readonly(bitmap)) {
-            error_setg(errp, "Bitmap %s was loaded prior to rw-reopen, but was "
-                       "not marked as readonly. This is a bug, something went "
-                       "wrong. All of the bitmaps may be corrupted", bm->name);
-            ret = -EINVAL;
-            goto out;
-        }
+            if (!bdrv_dirty_bitmap_readonly(bitmap)) {
+                error_setg(errp, "Bitmap %s is not readonly but not marked"
+                                 "'IN_USE' in the image. Something went wrong,"
+                                 "all the bitmaps may be corrupted", bm->name);
+                ret = -EINVAL;
+                goto out;
+            }

-        bm->flags |= BME_FLAG_IN_USE;
-        ro_dirty_bitmaps = g_slist_append(ro_dirty_bitmaps, bitmap);
+            bm->flags |= BME_FLAG_IN_USE;
+            ro_dirty_bitmaps = g_slist_append(ro_dirty_bitmaps, bitmap);
+        }
    }

    if (ro_dirty_bitmaps != NULL) {
@@ -1175,52 +1082,6 @@ int qcow2_reopen_bitmaps_rw(BlockDriverState *bs, Error **errp)
    return qcow2_reopen_bitmaps_rw_hint(bs, NULL, errp);
 }

-/* Checks to see if it's safe to resize bitmaps */
-int qcow2_truncate_bitmaps_check(BlockDriverState *bs, Error **errp)
-{
-    BDRVQcow2State *s = bs->opaque;
-    Qcow2BitmapList *bm_list;
-    Qcow2Bitmap *bm;
-    int ret = 0;
-
-    if (s->nb_bitmaps == 0) {
-        return 0;
-    }
-
-    bm_list = bitmap_list_load(bs, s->bitmap_directory_offset,
-                               s->bitmap_directory_size, errp);
-    if (bm_list == NULL) {
-        return -EINVAL;
-    }
-
-    QSIMPLEQ_FOREACH(bm, bm_list, entry) {
-        BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(bs, bm->name);
-        if (bitmap == NULL) {
-            /*
-             * We rely on all bitmaps being in-memory to be able to resize them,
-             * Otherwise, we'd need to resize them on disk explicitly
-             */
-            error_setg(errp, "Cannot resize qcow2 with persistent bitmaps that "
-                       "were not loaded into memory");
-            ret = -ENOTSUP;
-            goto out;
-        }
-
-        /*
-         * The checks against readonly and busy are redundant, but certainly
-         * do no harm. checks against inconsistent are crucial:
-         */
-        if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_DEFAULT, errp)) {
-            ret = -ENOTSUP;
-            goto out;
-        }
-    }
-
-out:
-    bitmap_list_free(bm_list);
-    return ret;
-}
-
 /* store_bitmap_data()
 * Store bitmap to image, filling bitmap table accordingly.
 */
@@ -1289,7 +1150,7 @@ static uint64_t *store_bitmap_data(BlockDriverState *bs,
            memset(buf + write_size, 0, s->cluster_size - write_size);
        }

-        ret = qcow2_pre_write_overlap_check(bs, 0, off, s->cluster_size, false);
+        ret = qcow2_pre_write_overlap_check(bs, 0, off, s->cluster_size);
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Qcow2 overlap check failed");
            goto fail;
@@ -1357,7 +1218,7 @@ static int store_bitmap(BlockDriverState *bs, Qcow2Bitmap *bm, Error **errp)
    }

    ret = qcow2_pre_write_overlap_check(bs, 0, tb_offset,
-                                        tb_size * sizeof(tb[0]), false);
+                                        tb_size * sizeof(tb[0]));
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Qcow2 overlap check failed");
        goto fail;
@@ -1455,7 +1316,7 @@ void qcow2_store_persistent_dirty_bitmaps(BlockDriverState *bs, Error **errp)
    int ret;
    Qcow2BitmapList *bm_list;
    Qcow2Bitmap *bm;
-    QSIMPLEQ_HEAD(, Qcow2BitmapTable) drop_tables;
+    Qcow2BitmapTableList drop_tables;
    Qcow2BitmapTable *tb, *tb_next;

    if (!bdrv_has_changed_persistent_bitmaps(bs)) {
@@ -1488,9 +1349,9 @@ void qcow2_store_persistent_dirty_bitmaps(BlockDriverState *bs, Error **errp)
        uint32_t granularity = bdrv_dirty_bitmap_granularity(bitmap);
        Qcow2Bitmap *bm;

-        if (!bdrv_dirty_bitmap_get_persistence(bitmap) ||
-            bdrv_dirty_bitmap_readonly(bitmap) ||
-            bdrv_dirty_bitmap_inconsistent(bitmap)) {
+        if (!bdrv_dirty_bitmap_get_persistance(bitmap) ||
+            bdrv_dirty_bitmap_readonly(bitmap))
+        {
            continue;
        }

@@ -1606,7 +1467,7 @@ int qcow2_reopen_bitmaps_ro(BlockDriverState *bs, Error **errp)
    for (bitmap = bdrv_dirty_bitmap_next(bs, NULL); bitmap != NULL;
         bitmap = bdrv_dirty_bitmap_next(bs, bitmap))
    {
-        if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
+        if (bdrv_dirty_bitmap_get_persistance(bitmap)) {
            bdrv_dirty_bitmap_set_readonly(bitmap, true);
        }
    }
--- a/block/qcow2-cache.c
+++ b/block/qcow2-cache.c
@@ -205,13 +205,13 @@ static int qcow2_cache_entry_flush(BlockDriverState *bs, Qcow2Cache *c, int i)

    if (c == s->refcount_block_cache) {
        ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_REFCOUNT_BLOCK,
-                c->entries[i].offset, c->table_size, false);
+                c->entries[i].offset, c->table_size);
    } else if (c == s->l2_table_cache) {
        ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L2,
-                c->entries[i].offset, c->table_size, false);
+                c->entries[i].offset, c->table_size);
    } else {
        ret = qcow2_pre_write_overlap_check(bs, 0,
-                c->entries[i].offset, c->table_size, false);
+                c->entries[i].offset, c->table_size);
    }

    if (ret < 0) {
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -153,7 +153,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    /* the L1 position has not yet been updated, so these clusters must
     * indeed be completely free */
    ret = qcow2_pre_write_overlap_check(bs, 0, new_l1_table_offset,
-                                        new_l1_size2, false);
+                                        new_l1_size2);
    if (ret < 0) {
        goto fail;
    }
@@ -238,7 +238,7 @@ int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index)
    }

    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
-            s->l1_table_offset + 8 * l1_start_index, sizeof(buf), false);
+            s->l1_table_offset + 8 * l1_start_index, sizeof(buf));
    if (ret < 0) {
        return ret;
    }
@@ -285,9 +285,6 @@ static int l2_allocate(BlockDriverState *bs, int l1_index)
        goto fail;
    }

-    /* The offset must fit in the offset field of the L1 table entry */
-    assert((l2_offset & L1E_OFFSET_MASK) == l2_offset);
-
    /* If we're allocating the table at offset 0 then something is wrong */
    if (l2_offset == 0) {
        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
@@ -380,8 +377,8 @@ fail:
 * as contiguous. (This allows it, for example, to stop at the first compressed
 * cluster which may require a different handling)
 */
-static int count_contiguous_clusters(BlockDriverState *bs, int nb_clusters,
-        int cluster_size, uint64_t *l2_slice, uint64_t stop_flags)
+static int count_contiguous_clusters(int nb_clusters, int cluster_size,
+        uint64_t *l2_slice, uint64_t stop_flags)
 {
    int i;
    QCow2ClusterType first_cluster_type;
@@ -389,12 +386,12 @@ static int count_contiguous_clusters(BlockDriverState *bs, int nb_clusters,
    uint64_t first_entry = be64_to_cpu(l2_slice[0]);
    uint64_t offset = first_entry & mask;

-    first_cluster_type = qcow2_get_cluster_type(bs, first_entry);
-    if (first_cluster_type == QCOW2_CLUSTER_UNALLOCATED) {
+    if (!offset) {
        return 0;
    }

    /* must be allocated */
+    first_cluster_type = qcow2_get_cluster_type(first_entry);
    assert(first_cluster_type == QCOW2_CLUSTER_NORMAL ||
           first_cluster_type == QCOW2_CLUSTER_ZERO_ALLOC);

@@ -405,15 +402,14 @@ static int count_contiguous_clusters(BlockDriverState *bs, int nb_clusters,
        }
    }

-        return i;
+	return i;
 }

 /*
 * Checks how many consecutive unallocated clusters in a given L2
 * slice have the same cluster type.
 */
-static int count_contiguous_clusters_unallocated(BlockDriverState *bs,
-                                                 int nb_clusters,
+static int count_contiguous_clusters_unallocated(int nb_clusters,
                                                 uint64_t *l2_slice,
                                                 QCow2ClusterType wanted_type)
 {
@@ -423,7 +419,7 @@ static int count_contiguous_clusters_unallocated(BlockDriverState *bs,
           wanted_type == QCOW2_CLUSTER_UNALLOCATED);
    for (i = 0; i < nb_clusters; i++) {
        uint64_t entry = be64_to_cpu(l2_slice[i]);
-        QCow2ClusterType type = qcow2_get_cluster_type(bs, entry);
+        QCow2ClusterType type = qcow2_get_cluster_type(entry);

        if (type != wanted_type) {
            break;
@@ -490,7 +486,6 @@ static int coroutine_fn do_perform_cow_write(BlockDriverState *bs,
                                             unsigned offset_in_cluster,
                                             QEMUIOVector *qiov)
 {
-    BDRVQcow2State *s = bs->opaque;
    int ret;

    if (qiov->size == 0) {
@@ -498,13 +493,13 @@ static int coroutine_fn do_perform_cow_write(BlockDriverState *bs,
    }

    ret = qcow2_pre_write_overlap_check(bs, 0,
-            cluster_offset + offset_in_cluster, qiov->size, true);
+            cluster_offset + offset_in_cluster, qiov->size);
    if (ret < 0) {
        return ret;
    }

    BLKDBG_EVENT(bs->file, BLKDBG_COW_WRITE);
-    ret = bdrv_co_pwritev(s->data_file, cluster_offset + offset_in_cluster,
+    ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
                          qiov->size, qiov, 0);
    if (ret < 0) {
        return ret;
@@ -597,7 +592,7 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
     * true */
    assert(nb_clusters <= INT_MAX);

-    type = qcow2_get_cluster_type(bs, *cluster_offset);
+    type = qcow2_get_cluster_type(*cluster_offset);
    if (s->qcow_version < 3 && (type == QCOW2_CLUSTER_ZERO_PLAIN ||
                                type == QCOW2_CLUSTER_ZERO_ALLOC)) {
        qcow2_signal_corruption(bs, true, -1, -1, "Zero cluster entry found"
@@ -608,14 +603,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    }
    switch (type) {
    case QCOW2_CLUSTER_COMPRESSED:
-        if (has_data_file(bs)) {
-            qcow2_signal_corruption(bs, true, -1, -1, "Compressed cluster "
-                                    "entry found in image with external data "
-                                    "file (L2 offset: %#" PRIx64 ", L2 index: "
-                                    "%#x)", l2_offset, l2_index);
-            ret = -EIO;
-            goto fail;
-        }
        /* Compressed clusters can only be processed one by one */
        c = 1;
        *cluster_offset &= L2E_COMPRESSED_OFFSET_SIZE_MASK;
@@ -623,14 +610,14 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    case QCOW2_CLUSTER_ZERO_PLAIN:
    case QCOW2_CLUSTER_UNALLOCATED:
        /* how many empty clusters ? */
-        c = count_contiguous_clusters_unallocated(bs, nb_clusters,
+        c = count_contiguous_clusters_unallocated(nb_clusters,
                                                  &l2_slice[l2_index], type);
        *cluster_offset = 0;
        break;
    case QCOW2_CLUSTER_ZERO_ALLOC:
    case QCOW2_CLUSTER_NORMAL:
        /* how many allocated clusters ? */
-        c = count_contiguous_clusters(bs, nb_clusters, s->cluster_size,
+        c = count_contiguous_clusters(nb_clusters, s->cluster_size,
                                      &l2_slice[l2_index], QCOW_OFLAG_ZERO);
        *cluster_offset &= L2E_OFFSET_MASK;
        if (offset_into_cluster(s, *cluster_offset)) {
@@ -642,17 +629,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
            ret = -EIO;
            goto fail;
        }
-        if (has_data_file(bs) && *cluster_offset != offset - offset_in_cluster)
-        {
-            qcow2_signal_corruption(bs, true, -1, -1,
-                                    "External data file host cluster offset %#"
-                                    PRIx64 " does not match guest cluster "
-                                    "offset: %#" PRIx64
-                                    ", L2 index: %#x)", *cluster_offset,
-                                    offset - offset_in_cluster, l2_index);
-            ret = -EIO;
-            goto fail;
-        }
        break;
    default:
        abort();
@@ -756,16 +732,19 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,
 /*
 * alloc_compressed_cluster_offset
 *
- * For a given offset on the virtual disk, allocate a new compressed cluster
- * and put the host offset of the cluster into *host_offset. If a cluster is
- * already allocated at the offset, return an error.
+ * For a given offset of the disk image, return cluster offset in
+ * qcow2 file.
+ *
+ * If the offset is not found, allocate a new compressed cluster.
+ *
+ * Return the cluster offset if successful,
+ * Return 0, otherwise.
 *
- * Return 0 on success and -errno in error cases
 */
-int qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
-                                          uint64_t offset,
-                                          int compressed_size,
-                                          uint64_t *host_offset)
+
+uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
+                                               uint64_t offset,
+                                               int compressed_size)
 {
    BDRVQcow2State *s = bs->opaque;
    int l2_index, ret;
@@ -773,13 +752,9 @@ int qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    int64_t cluster_offset;
    int nb_csectors;

-    if (has_data_file(bs)) {
-        return 0;
-    }
-
    ret = get_cluster_table(bs, offset, &l2_slice, &l2_index);
    if (ret < 0) {
-        return ret;
+        return 0;
    }

    /* Compression can't overwrite anything. Fail if the cluster was already
@@ -787,13 +762,13 @@ int qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    cluster_offset = be64_to_cpu(l2_slice[l2_index]);
    if (cluster_offset & L2E_OFFSET_MASK) {
        qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
-        return -EIO;
+        return 0;
    }

    cluster_offset = qcow2_alloc_bytes(bs, compressed_size);
    if (cluster_offset < 0) {
        qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);
-        return cluster_offset;
+        return 0;
    }

    nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) -
@@ -811,8 +786,7 @@ int qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    l2_slice[l2_index] = cpu_to_be64(cluster_offset);
    qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);

-    *host_offset = cluster_offset & s->cluster_offset_mask;
-    return 0;
+    return cluster_offset;
 }

 static int perform_cow(BlockDriverState *bs, QCowL2Meta *m)
@@ -1036,14 +1010,14 @@ void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m)
 * write, but require COW to be performed (this includes yet unallocated space,
 * which must copy from the backing file)
 */
-static int count_cow_clusters(BlockDriverState *bs, int nb_clusters,
+static int count_cow_clusters(BDRVQcow2State *s, int nb_clusters,
    uint64_t *l2_slice, int l2_index)
 {
    int i;

    for (i = 0; i < nb_clusters; i++) {
        uint64_t l2_entry = be64_to_cpu(l2_slice[l2_index + i]);
-        QCow2ClusterType cluster_type = qcow2_get_cluster_type(bs, l2_entry);
+        QCow2ClusterType cluster_type = qcow2_get_cluster_type(l2_entry);

        switch(cluster_type) {
        case QCOW2_CLUSTER_NORMAL:
@@ -1131,9 +1105,9 @@ static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,

 /*
 * Checks how many already allocated clusters that don't require a copy on
- * write there are at the given guest_offset (up to *bytes). If *host_offset is
- * not INV_OFFSET, only physically contiguous clusters beginning at this host
- * offset are counted.
+ * write there are at the given guest_offset (up to *bytes). If
+ * *host_offset is not zero, only physically contiguous clusters beginning at
+ * this host offset are counted.
 *
 * Note that guest_offset may not be cluster aligned. In this case, the
 * returned *host_offset points to exact byte referenced by guest_offset and
@@ -1165,8 +1139,8 @@ static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,
    trace_qcow2_handle_copied(qemu_coroutine_self(), guest_offset, *host_offset,
                              *bytes);

-    assert(*host_offset == INV_OFFSET || offset_into_cluster(s, guest_offset)
-                                      == offset_into_cluster(s, *host_offset));
+    assert(*host_offset == 0 ||    offset_into_cluster(s, guest_offset)
+                                == offset_into_cluster(s, *host_offset));

    /*
     * Calculate the number of clusters to look for. We stop at L2 slice
@@ -1188,7 +1162,7 @@ static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,
    cluster_offset = be64_to_cpu(l2_slice[l2_index]);

    /* Check how many clusters are already allocated and don't need COW */
-    if (qcow2_get_cluster_type(bs, cluster_offset) == QCOW2_CLUSTER_NORMAL
+    if (qcow2_get_cluster_type(cluster_offset) == QCOW2_CLUSTER_NORMAL
        && (cluster_offset & QCOW_OFLAG_COPIED))
    {
        /* If a specific host_offset is required, check it */
@@ -1204,7 +1178,7 @@ static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,
            goto out;
        }

-        if (*host_offset != INV_OFFSET && !offset_matches) {
+        if (*host_offset != 0 && !offset_matches) {
            *bytes = 0;
            ret = 0;
            goto out;
@@ -1212,7 +1186,7 @@ static int handle_copied(BlockDriverState *bs, uint64_t guest_offset,

        /* We keep all QCOW_OFLAG_COPIED clusters */
        keep_clusters =
-            count_contiguous_clusters(bs, nb_clusters, s->cluster_size,
+            count_contiguous_clusters(nb_clusters, s->cluster_size,
                                      &l2_slice[l2_index],
                                      QCOW_OFLAG_COPIED | QCOW_OFLAG_ZERO);
        assert(keep_clusters <= nb_clusters);
@@ -1247,10 +1221,10 @@ out:
 * contain the number of clusters that have been allocated and are contiguous
 * in the image file.
 *
- * If *host_offset is not INV_OFFSET, it specifies the offset in the image file
- * at which the new clusters must start. *nb_clusters can be 0 on return in
- * this case if the cluster at host_offset is already in use. If *host_offset
- * is INV_OFFSET, the clusters can be allocated anywhere in the image file.
+ * If *host_offset is non-zero, it specifies the offset in the image file at
+ * which the new clusters must start. *nb_clusters can be 0 on return in this
+ * case if the cluster at host_offset is already in use. If *host_offset is
+ * zero, the clusters can be allocated anywhere in the image file.
 *
 * *host_offset is updated to contain the offset into the image file at which
 * the first allocated cluster starts.
@@ -1267,16 +1241,9 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
    trace_qcow2_do_alloc_clusters_offset(qemu_coroutine_self(), guest_offset,
                                         *host_offset, *nb_clusters);

-    if (has_data_file(bs)) {
-        assert(*host_offset == INV_OFFSET ||
-               *host_offset == start_of_cluster(s, guest_offset));
-        *host_offset = start_of_cluster(s, guest_offset);
-        return 0;
-    }
-
    /* Allocate new clusters */
    trace_qcow2_cluster_alloc_phys(qemu_coroutine_self());
-    if (*host_offset == INV_OFFSET) {
+    if (*host_offset == 0) {
        int64_t cluster_offset =
            qcow2_alloc_clusters(bs, *nb_clusters * s->cluster_size);
        if (cluster_offset < 0) {
@@ -1296,8 +1263,8 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,

 /*
 * Allocates new clusters for an area that either is yet unallocated or needs a
- * copy on write. If *host_offset is not INV_OFFSET, clusters are only
- * allocated if the new allocation can match the specified host offset.
+ * copy on write. If *host_offset is non-zero, clusters are only allocated if
+ * the new allocation can match the specified host offset.
 *
 * Note that guest_offset may not be cluster aligned. In this case, the
 * returned *host_offset points to exact byte referenced by guest_offset and
@@ -1325,7 +1292,7 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
    int ret;
    bool keep_old_clusters = false;

-    uint64_t alloc_cluster_offset = INV_OFFSET;
+    uint64_t alloc_cluster_offset = 0;

    trace_qcow2_handle_alloc(qemu_coroutine_self(), guest_offset, *host_offset,
                             *bytes);
@@ -1354,7 +1321,7 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
    if (entry & QCOW_OFLAG_COMPRESSED) {
        nb_clusters = 1;
    } else {
-        nb_clusters = count_cow_clusters(bs, nb_clusters, l2_slice, l2_index);
+        nb_clusters = count_cow_clusters(s, nb_clusters, l2_slice, l2_index);
    }

    /* This function is only called when there were no non-COW clusters, so if
@@ -1362,9 +1329,9 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
     * wrong with our code. */
    assert(nb_clusters > 0);

-    if (qcow2_get_cluster_type(bs, entry) == QCOW2_CLUSTER_ZERO_ALLOC &&
+    if (qcow2_get_cluster_type(entry) == QCOW2_CLUSTER_ZERO_ALLOC &&
        (entry & QCOW_OFLAG_COPIED) &&
-        (*host_offset == INV_OFFSET ||
+        (!*host_offset ||
         start_of_cluster(s, *host_offset) == (entry & L2E_OFFSET_MASK)))
    {
        int preallocated_nb_clusters;
@@ -1382,7 +1349,7 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
         * would be fine, too, but count_cow_clusters() above has limited
         * nb_clusters already to a range of COW clusters */
        preallocated_nb_clusters =
-            count_contiguous_clusters(bs, nb_clusters, s->cluster_size,
+            count_contiguous_clusters(nb_clusters, s->cluster_size,
                                      &l2_slice[l2_index], QCOW_OFLAG_COPIED);
        assert(preallocated_nb_clusters > 0);

@@ -1396,10 +1363,9 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,

    qcow2_cache_put(s->l2_table_cache, (void **) &l2_slice);

-    if (alloc_cluster_offset == INV_OFFSET) {
+    if (!alloc_cluster_offset) {
        /* Allocate, if necessary at a given offset in the image file */
-        alloc_cluster_offset = *host_offset == INV_OFFSET ? INV_OFFSET :
-                               start_of_cluster(s, *host_offset);
+        alloc_cluster_offset = start_of_cluster(s, *host_offset);
        ret = do_alloc_cluster_offset(bs, guest_offset, &alloc_cluster_offset,
                                      &nb_clusters);
        if (ret < 0) {
@@ -1412,7 +1378,16 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
            return 0;
        }

-        assert(alloc_cluster_offset != INV_OFFSET);
+        /* !*host_offset would overwrite the image header and is reserved for
+         * "no host offset preferred". If 0 was a valid host offset, it'd
+         * trigger the following overlap check; do that now to avoid having an
+         * invalid value in *host_offset. */
+        if (!alloc_cluster_offset) {
+            ret = qcow2_pre_write_overlap_check(bs, 0, alloc_cluster_offset,
+                                                nb_clusters * s->cluster_size);
+            assert(ret < 0);
+            goto fail;
+        }
    }

    /*
@@ -1504,14 +1479,14 @@ int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
 again:
    start = offset;
    remaining = *bytes;
-    cluster_offset = INV_OFFSET;
-    *host_offset = INV_OFFSET;
+    cluster_offset = 0;
+    *host_offset = 0;
    cur_bytes = 0;
    *m = NULL;

    while (true) {

-        if (*host_offset == INV_OFFSET && cluster_offset != INV_OFFSET) {
+        if (!*host_offset) {
            *host_offset = start_of_cluster(s, cluster_offset);
        }

@@ -1519,10 +1494,7 @@ again:

        start           += cur_bytes;
        remaining       -= cur_bytes;
-
-        if (cluster_offset != INV_OFFSET) {
-            cluster_offset += cur_bytes;
-        }
+        cluster_offset  += cur_bytes;

        if (remaining == 0) {
            break;
@@ -1594,11 +1566,81 @@ again:

    *bytes -= remaining;
    assert(*bytes > 0);
-    assert(*host_offset != INV_OFFSET);
+    assert(*host_offset != 0);

    return 0;
 }

+static int decompress_buffer(uint8_t *out_buf, int out_buf_size,
+                             const uint8_t *buf, int buf_size)
+{
+    z_stream strm1, *strm = &strm1;
+    int ret, out_len;
+
+    memset(strm, 0, sizeof(*strm));
+
+    strm->next_in = (uint8_t *)buf;
+    strm->avail_in = buf_size;
+    strm->next_out = out_buf;
+    strm->avail_out = out_buf_size;
+
+    ret = inflateInit2(strm, -12);
+    if (ret != Z_OK)
+        return -1;
+    ret = inflate(strm, Z_FINISH);
+    out_len = strm->next_out - out_buf;
+    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) ||
+        out_len != out_buf_size) {
+        inflateEnd(strm);
+        return -1;
+    }
+    inflateEnd(strm);
+    return 0;
+}
+
+int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset)
+{
+    BDRVQcow2State *s = bs->opaque;
+    int ret, csize, nb_csectors, sector_offset;
+    uint64_t coffset;
+
+    coffset = cluster_offset & s->cluster_offset_mask;
+    if (s->cluster_cache_offset != coffset) {
+        nb_csectors = ((cluster_offset >> s->csize_shift) & s->csize_mask) + 1;
+        sector_offset = coffset & 511;
+        csize = nb_csectors * 512 - sector_offset;
+
+        /* Allocate buffers on first decompress operation, most images are
+         * uncompressed and the memory overhead can be avoided.  The buffers
+         * are freed in .bdrv_close().
+         */
+        if (!s->cluster_data) {
+            /* one more sector for decompressed data alignment */
+            s->cluster_data = qemu_try_blockalign(bs->file->bs,
+                    QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size + 512);
+            if (!s->cluster_data) {
+                return -ENOMEM;
+            }
+        }
+        if (!s->cluster_cache) {
+            s->cluster_cache = g_malloc(s->cluster_size);
+        }
+
+        BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
+        ret = bdrv_read(bs->file, coffset >> 9, s->cluster_data,
+                        nb_csectors);
+        if (ret < 0) {
+            return ret;
+        }
+        if (decompress_buffer(s->cluster_cache, s->cluster_size,
+                              s->cluster_data + sector_offset, csize) < 0) {
+            return -EIO;
+        }
+        s->cluster_cache_offset = coffset;
+    }
+    return 0;
+}
+
 /*
 * This discards as many clusters of nb_clusters as possible at once (i.e.
 * all clusters in the same L2 slice) and returns the number of discarded
@@ -1641,7 +1683,7 @@ static int discard_in_l2_slice(BlockDriverState *bs, uint64_t offset,
         * If full_discard is true, the sector should not read back as zeroes,
         * but rather fall through to the backing file.
         */
-        switch (qcow2_get_cluster_type(bs, old_l2_entry)) {
+        switch (qcow2_get_cluster_type(old_l2_entry)) {
        case QCOW2_CLUSTER_UNALLOCATED:
            if (full_discard || !bs->backing) {
                continue;
@@ -1754,7 +1796,7 @@ static int zero_in_l2_slice(BlockDriverState *bs, uint64_t offset,
         * Minimize L2 changes if the cluster already reads back as
         * zeroes with correct allocation.
         */
-        cluster_type = qcow2_get_cluster_type(bs, old_offset);
+        cluster_type = qcow2_get_cluster_type(old_offset);
        if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN ||
            (cluster_type == QCOW2_CLUSTER_ZERO_ALLOC && !unmap)) {
            continue;
@@ -1783,16 +1825,6 @@ int qcow2_cluster_zeroize(BlockDriverState *bs, uint64_t offset,
    int64_t cleared;
    int ret;

-    /* If we have to stay in sync with an external data file, zero out
-     * s->data_file first. */
-    if (data_file_is_raw(bs)) {
-        assert(has_data_file(bs));
-        ret = bdrv_co_pwrite_zeroes(s->data_file, offset, bytes, flags);
-        if (ret < 0) {
-            return ret;
-        }
-    }
-
    /* Caller must pass aligned values, except at image end */
    assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
    assert(QEMU_IS_ALIGNED(end_offset, s->cluster_size) ||
@@ -1906,7 +1938,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                uint64_t l2_entry = be64_to_cpu(l2_slice[j]);
                int64_t offset = l2_entry & L2E_OFFSET_MASK;
                QCow2ClusterType cluster_type =
-                    qcow2_get_cluster_type(bs, l2_entry);
+                    qcow2_get_cluster_type(l2_entry);

                if (cluster_type != QCOW2_CLUSTER_ZERO_PLAIN &&
                    cluster_type != QCOW2_CLUSTER_ZERO_ALLOC) {
@@ -1960,7 +1992,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                }

                ret = qcow2_pre_write_overlap_check(bs, 0, offset,
-                                                    s->cluster_size, true);
+                                                    s->cluster_size);
                if (ret < 0) {
                    if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
                        qcow2_free_clusters(bs, offset, s->cluster_size,
@@ -1969,8 +2001,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                    goto fail;
                }

-                ret = bdrv_pwrite_zeroes(s->data_file, offset,
-                                         s->cluster_size, 0);
+                ret = bdrv_pwrite_zeroes(bs->file, offset, s->cluster_size, 0);
                if (ret < 0) {
                    if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
                        qcow2_free_clusters(bs, offset, s->cluster_size,
@@ -1997,7 +2028,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
                if (l2_dirty) {
                    ret = qcow2_pre_write_overlap_check(
                        bs, QCOW2_OL_INACTIVE_L2 | QCOW2_OL_ACTIVE_L2,
-                        slice_offset, slice_size2, false);
+                        slice_offset, slice_size2);
                    if (ret < 0) {
                        goto fail;
                    }
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -368,9 +368,6 @@ static int alloc_refcount_block(BlockDriverState *bs,
        return new_block;
    }

-    /* The offset must fit in the offset field of the refcount table entry */
-    assert((new_block & REFT_OFFSET_MASK) == new_block);
-
    /* If we're allocating the block at offset 0 then something is wrong */
    if (new_block == 0) {
        qcow2_signal_corruption(bs, true, -1, -1, "Preventing invalid "
@@ -1156,20 +1153,8 @@ void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
                             int nb_clusters, enum qcow2_discard_type type)
 {
    BDRVQcow2State *s = bs->opaque;
-    QCow2ClusterType ctype = qcow2_get_cluster_type(bs, l2_entry);

-    if (has_data_file(bs)) {
-        if (s->discard_passthrough[type] &&
-            (ctype == QCOW2_CLUSTER_NORMAL ||
-             ctype == QCOW2_CLUSTER_ZERO_ALLOC))
-        {
-            bdrv_pdiscard(s->data_file, l2_entry & L2E_OFFSET_MASK,
-                          nb_clusters << s->cluster_bits);
-        }
-        return;
-    }
-
-    switch (ctype) {
+    switch (qcow2_get_cluster_type(l2_entry)) {
    case QCOW2_CLUSTER_COMPRESSED:
        {
            int nb_csectors;
@@ -1312,7 +1297,7 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                    entry &= ~QCOW_OFLAG_COPIED;
                    offset = entry & L2E_OFFSET_MASK;

-                    switch (qcow2_get_cluster_type(bs, entry)) {
+                    switch (qcow2_get_cluster_type(entry)) {
                    case QCOW2_CLUSTER_COMPRESSED:
                        nb_csectors = ((entry >> s->csize_shift) &
                                       s->csize_mask) + 1;
@@ -1594,7 +1579,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
    for(i = 0; i < s->l2_size; i++) {
        l2_entry = be64_to_cpu(l2_table[i]);

-        switch (qcow2_get_cluster_type(bs, l2_entry)) {
+        switch (qcow2_get_cluster_type(l2_entry)) {
        case QCOW2_CLUSTER_COMPRESSED:
            /* Compressed clusters don't have QCOW_OFLAG_COPIED */
            if (l2_entry & QCOW_OFLAG_COPIED) {
@@ -1605,13 +1590,6 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
                res->corruptions++;
            }

-            if (has_data_file(bs)) {
-                fprintf(stderr, "ERROR compressed cluster %d with data file, "
-                        "entry=0x%" PRIx64 "\n", i, l2_entry);
-                res->corruptions++;
-                break;
-            }
-
            /* Mark cluster as used */
            nb_csectors = ((l2_entry >> s->csize_shift) &
                           s->csize_mask) + 1;
@@ -1652,7 +1630,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,

            /* Correct offsets are cluster aligned */
            if (offset_into_cluster(s, offset)) {
-                if (qcow2_get_cluster_type(bs, l2_entry) ==
+                if (qcow2_get_cluster_type(l2_entry) ==
                    QCOW2_CLUSTER_ZERO_ALLOC)
                {
                    fprintf(stderr, "%s offset=%" PRIx64 ": Preallocated zero "
@@ -1668,7 +1646,7 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
                        l2_table[i] = cpu_to_be64(l2_entry);
                        ret = qcow2_pre_write_overlap_check(bs,
                                QCOW2_OL_ACTIVE_L2 | QCOW2_OL_INACTIVE_L2,
-                                l2e_offset, sizeof(uint64_t), false);
+                                l2e_offset, sizeof(uint64_t));
                        if (ret < 0) {
                            fprintf(stderr, "ERROR: Overlap check failed\n");
                            res->check_errors++;
@@ -1702,13 +1680,11 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            }

            /* Mark cluster as used */
-            if (!has_data_file(bs)) {
-                ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table,
-                                               refcount_table_size,
-                                               offset, s->cluster_size);
-                if (ret < 0) {
-                    goto fail;
-                }
+            ret = qcow2_inc_refcounts_imrt(bs, res,
+                                           refcount_table, refcount_table_size,
+                                           offset, s->cluster_size);
+            if (ret < 0) {
+                goto fail;
            }
            break;
        }
@@ -1889,20 +1865,16 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
        for (j = 0; j < s->l2_size; j++) {
            uint64_t l2_entry = be64_to_cpu(l2_table[j]);
            uint64_t data_offset = l2_entry & L2E_OFFSET_MASK;
-            QCow2ClusterType cluster_type = qcow2_get_cluster_type(bs, l2_entry);
+            QCow2ClusterType cluster_type = qcow2_get_cluster_type(l2_entry);

            if (cluster_type == QCOW2_CLUSTER_NORMAL ||
                cluster_type == QCOW2_CLUSTER_ZERO_ALLOC) {
-                if (has_data_file(bs)) {
-                    refcount = 1;
-                } else {
-                    ret = qcow2_get_refcount(bs,
-                                             data_offset >> s->cluster_bits,
-                                             &refcount);
-                    if (ret < 0) {
-                        /* don't print message nor increment check_errors */
-                        continue;
-                    }
+                ret = qcow2_get_refcount(bs,
+                                         data_offset >> s->cluster_bits,
+                                         &refcount);
+                if (ret < 0) {
+                    /* don't print message nor increment check_errors */
+                    continue;
                }
                if ((refcount == 1) != ((l2_entry & QCOW_OFLAG_COPIED) != 0)) {
                    fprintf(stderr, "%s OFLAG_COPIED data cluster: "
@@ -1923,8 +1895,7 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,

        if (l2_dirty) {
            ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L2,
-                                                l2_offset, s->cluster_size,
-                                                false);
+                                                l2_offset, s->cluster_size);
            if (ret < 0) {
                fprintf(stderr, "ERROR: Could not write L2 table; metadata "
                        "overlap check failed: %s\n", strerror(-ret));
@@ -2096,12 +2067,6 @@ static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    }

    /* snapshots */
-    if (has_data_file(bs) && s->nb_snapshots) {
-        fprintf(stderr, "ERROR %d snapshots in image with data file\n",
-                s->nb_snapshots);
-        res->corruptions++;
-    }
-
    for (i = 0; i < s->nb_snapshots; i++) {
        sn = s->snapshots + i;
        if (offset_into_cluster(s, sn->l1_table_offset)) {
@@ -2398,7 +2363,7 @@ write_refblocks:
        }

        ret = qcow2_pre_write_overlap_check(bs, 0, refblock_offset,
-                                            s->cluster_size, false);
+                                            s->cluster_size);
        if (ret < 0) {
            fprintf(stderr, "ERROR writing refblock: %s\n", strerror(-ret));
            goto fail;
@@ -2449,8 +2414,7 @@ write_refblocks:
    }

    ret = qcow2_pre_write_overlap_check(bs, 0, reftable_offset,
-                                        reftable_size * sizeof(uint64_t),
-                                        false);
+                                        reftable_size * sizeof(uint64_t));
    if (ret < 0) {
        fprintf(stderr, "ERROR writing reftable: %s\n", strerror(-ret));
        goto fail;
@@ -2784,15 +2748,10 @@ QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR != ARRAY_SIZE(metadata_ol_names));
 * overlaps; or a negative value (-errno) on error.
 */
 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
-                                  int64_t size, bool data_file)
+                                  int64_t size)
 {
-    int ret;
+    int ret = qcow2_check_metadata_overlap(bs, ign, offset, size);

-    if (data_file && has_data_file(bs)) {
-        return 0;
-    }
-
-    ret = qcow2_check_metadata_overlap(bs, ign, offset, size);
    if (ret < 0) {
        return ret;
    } else if (ret > 0) {
@@ -2893,8 +2852,7 @@ static int flush_refblock(BlockDriverState *bs, uint64_t **reftable,
    if (reftable_index < *reftable_size && (*reftable)[reftable_index]) {
        offset = (*reftable)[reftable_index];

-        ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size,
-                                            false);
+        ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size);
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Overlap check failed");
            return ret;
@@ -3160,8 +3118,7 @@ int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,

    /* Write the new reftable */
    ret = qcow2_pre_write_overlap_check(bs, 0, new_reftable_offset,
-                                        new_reftable_size * sizeof(uint64_t),
-                                        false);
+                                        new_reftable_size * sizeof(uint64_t));
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Overlap check failed");
        goto done;
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -184,7 +184,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)

    /* The snapshot list position has not yet been updated, so these clusters
     * must indeed be completely free */
-    ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size, false);
+    ret = qcow2_pre_write_overlap_check(bs, 0, offset, snapshots_size);
    if (ret < 0) {
        goto fail;
    }
@@ -353,15 +353,16 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        return -EFBIG;
    }

-    if (has_data_file(bs)) {
-        return -ENOTSUP;
-    }
-
    memset(sn, 0, sizeof(*sn));

    /* Generate an ID */
    find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str));

+    /* Check that the ID is unique */
+    if (find_snapshot_by_id_and_name(bs, sn_info->id_str, NULL) >= 0) {
+        return -EEXIST;
+    }
+
    /* Populate sn with passed data */
    sn->id_str = g_strdup(sn_info->id_str);
    sn->name = g_strdup(sn_info->name);
@@ -393,7 +394,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    }

    ret = qcow2_pre_write_overlap_check(bs, 0, sn->l1_table_offset,
-                                        s->l1_size * sizeof(uint64_t), false);
+                                        s->l1_size * sizeof(uint64_t));
    if (ret < 0) {
        goto fail;
    }
@@ -470,10 +471,6 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    int ret;
    uint64_t *sn_l1_table = NULL;

-    if (has_data_file(bs)) {
-        return -ENOTSUP;
-    }
-
    /* Search the snapshot */
    snapshot_index = find_snapshot_by_id_or_name(bs, snapshot_id);
    if (snapshot_index < 0) {
@@ -536,8 +533,7 @@ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)
    }

    ret = qcow2_pre_write_overlap_check(bs, QCOW2_OL_ACTIVE_L1,
-                                        s->l1_table_offset, cur_l1_bytes,
-                                        false);
+                                        s->l1_table_offset, cur_l1_bytes);
    if (ret < 0) {
        goto fail;
    }
@@ -607,10 +603,6 @@ int qcow2_snapshot_delete(BlockDriverState *bs,
    QCowSnapshot sn;
    int snapshot_index, ret;

-    if (has_data_file(bs)) {
-        return -ENOTSUP;
-    }
-
    /* Search the snapshot */
    snapshot_index = find_snapshot_by_id_and_name(bs, snapshot_id, name);
    if (snapshot_index < 0) {
@@ -682,9 +674,6 @@ int qcow2_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
    QCowSnapshot *sn;
    int i;

-    if (has_data_file(bs)) {
-        return -ENOTSUP;
-    }
    if (!s->nb_snapshots) {
        *psn_tab = NULL;
        return s->nb_snapshots;
--- a/block/qcow2.c
+++ b/block/qcow2.c
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -50,11 +50,11 @@

 /* 8 MB refcount table is enough for 2 PB images at 64k cluster size
 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_REFTABLE_SIZE (8 * MiB)
+#define QCOW_MAX_REFTABLE_SIZE S_8MiB

 /* 32 MB L1 table is enough for 2 PB images at 64k cluster size
 * (128 GB for 512 byte clusters, 2 EB for 2 MB clusters) */
-#define QCOW_MAX_L1_SIZE (32 * MiB)
+#define QCOW_MAX_L1_SIZE S_32MiB

 /* Allow for an average of 1k per snapshot table entry, should be plenty of
 * space for snapshot names and IDs */
@@ -81,17 +81,16 @@
 #define MIN_REFCOUNT_CACHE_SIZE 4 /* clusters */

 #ifdef CONFIG_LINUX
-#define DEFAULT_L2_CACHE_MAX_SIZE (32 * MiB)
+#define DEFAULT_L2_CACHE_MAX_SIZE S_32MiB
 #define DEFAULT_CACHE_CLEAN_INTERVAL 600  /* seconds */
 #else
-#define DEFAULT_L2_CACHE_MAX_SIZE (8 * MiB)
+#define DEFAULT_L2_CACHE_MAX_SIZE S_8MiB
 /* Cache clean interval is currently available only on Linux, so must be 0 */
 #define DEFAULT_CACHE_CLEAN_INTERVAL 0
 #endif

-#define DEFAULT_CLUSTER_SIZE 65536
+#define DEFAULT_CLUSTER_SIZE S_64KiB

-#define QCOW2_OPT_DATA_FILE "data-file"
 #define QCOW2_OPT_LAZY_REFCOUNTS "lazy-refcounts"
 #define QCOW2_OPT_DISCARD_REQUEST "pass-discard-request"
 #define QCOW2_OPT_DISCARD_SNAPSHOT "pass-discard-snapshot"
@@ -198,16 +197,13 @@ enum {

 /* Incompatible feature bits */
 enum {
-    QCOW2_INCOMPAT_DIRTY_BITNR      = 0,
-    QCOW2_INCOMPAT_CORRUPT_BITNR    = 1,
-    QCOW2_INCOMPAT_DATA_FILE_BITNR  = 2,
-    QCOW2_INCOMPAT_DIRTY            = 1 << QCOW2_INCOMPAT_DIRTY_BITNR,
-    QCOW2_INCOMPAT_CORRUPT          = 1 << QCOW2_INCOMPAT_CORRUPT_BITNR,
-    QCOW2_INCOMPAT_DATA_FILE        = 1 << QCOW2_INCOMPAT_DATA_FILE_BITNR,
+    QCOW2_INCOMPAT_DIRTY_BITNR   = 0,
+    QCOW2_INCOMPAT_CORRUPT_BITNR = 1,
+    QCOW2_INCOMPAT_DIRTY         = 1 << QCOW2_INCOMPAT_DIRTY_BITNR,
+    QCOW2_INCOMPAT_CORRUPT       = 1 << QCOW2_INCOMPAT_CORRUPT_BITNR,

-    QCOW2_INCOMPAT_MASK             = QCOW2_INCOMPAT_DIRTY
-                                    | QCOW2_INCOMPAT_CORRUPT
-                                    | QCOW2_INCOMPAT_DATA_FILE,
+    QCOW2_INCOMPAT_MASK          = QCOW2_INCOMPAT_DIRTY
+                                 | QCOW2_INCOMPAT_CORRUPT,
 };

 /* Compatible feature bits */
@@ -220,13 +216,10 @@ enum {

 /* Autoclear feature bits */
 enum {
-    QCOW2_AUTOCLEAR_BITMAPS_BITNR       = 0,
-    QCOW2_AUTOCLEAR_DATA_FILE_RAW_BITNR = 1,
-    QCOW2_AUTOCLEAR_BITMAPS             = 1 << QCOW2_AUTOCLEAR_BITMAPS_BITNR,
-    QCOW2_AUTOCLEAR_DATA_FILE_RAW       = 1 << QCOW2_AUTOCLEAR_DATA_FILE_RAW_BITNR,
+    QCOW2_AUTOCLEAR_BITMAPS_BITNR = 0,
+    QCOW2_AUTOCLEAR_BITMAPS       = 1 << QCOW2_AUTOCLEAR_BITMAPS_BITNR,

-    QCOW2_AUTOCLEAR_MASK                = QCOW2_AUTOCLEAR_BITMAPS
-                                        | QCOW2_AUTOCLEAR_DATA_FILE_RAW,
+    QCOW2_AUTOCLEAR_MASK          = QCOW2_AUTOCLEAR_BITMAPS,
 };

 enum qcow2_discard_type {
@@ -288,7 +281,7 @@ typedef struct BDRVQcow2State {
    uint8_t *cluster_cache;
    uint8_t *cluster_data;
    uint64_t cluster_cache_offset;
-    QLIST_HEAD(, QCowL2Meta) cluster_allocs;
+    QLIST_HEAD(QCowClusterAlloc, QCowL2Meta) cluster_allocs;

    uint64_t *refcount_table;
    uint64_t refcount_table_offset;
@@ -344,12 +337,9 @@ typedef struct BDRVQcow2State {
     * override) */
    char *image_backing_file;
    char *image_backing_format;
-    char *image_data_file;

    CoQueue compress_wait_queue;
    int nb_compress_threads;
-
-    BdrvChild *data_file;
 } BDRVQcow2State;

 typedef struct Qcow2COWRegion {
@@ -467,20 +457,6 @@ typedef enum QCow2MetadataOverlap {

 #define REFT_OFFSET_MASK 0xfffffffffffffe00ULL

-#define INV_OFFSET (-1ULL)
-
-static inline bool has_data_file(BlockDriverState *bs)
-{
-    BDRVQcow2State *s = bs->opaque;
-    return (s->data_file != bs->file);
-}
-
-static inline bool data_file_is_raw(BlockDriverState *bs)
-{
-    BDRVQcow2State *s = bs->opaque;
-    return !!(s->autoclear_features & QCOW2_AUTOCLEAR_DATA_FILE_RAW);
-}
-
 static inline int64_t start_of_cluster(BDRVQcow2State *s, int64_t offset)
 {
    return offset & ~(s->cluster_size - 1);
@@ -522,8 +498,7 @@ static inline int64_t qcow2_vm_state_offset(BDRVQcow2State *s)
    return (int64_t)s->l1_vm_state_index << (s->cluster_bits + s->l2_bits);
 }

-static inline QCow2ClusterType qcow2_get_cluster_type(BlockDriverState *bs,
-                                                      uint64_t l2_entry)
+static inline QCow2ClusterType qcow2_get_cluster_type(uint64_t l2_entry)
 {
    if (l2_entry & QCOW_OFLAG_COMPRESSED) {
        return QCOW2_CLUSTER_COMPRESSED;
@@ -533,15 +508,7 @@ static inline QCow2ClusterType qcow2_get_cluster_type(BlockDriverState *bs,
        }
        return QCOW2_CLUSTER_ZERO_PLAIN;
    } else if (!(l2_entry & L2E_OFFSET_MASK)) {
-        /* Offset 0 generally means unallocated, but it is ambiguous with
-         * external data files because 0 is a valid offset there. However, all
-         * clusters in external data files always have refcount 1, so we can
-         * rely on QCOW_OFLAG_COPIED to disambiguate. */
-        if (has_data_file(bs) && (l2_entry & QCOW_OFLAG_COPIED)) {
-            return QCOW2_CLUSTER_NORMAL;
-        } else {
-            return QCOW2_CLUSTER_UNALLOCATED;
-        }
+        return QCOW2_CLUSTER_UNALLOCATED;
    } else {
        return QCOW2_CLUSTER_NORMAL;
    }
@@ -632,7 +599,7 @@ void qcow2_process_discards(BlockDriverState *bs, int ret);
 int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
                                 int64_t size);
 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
-                                  int64_t size, bool data_file);
+                                  int64_t size);
 int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
                             void **refcount_table,
                             int64_t *refcount_table_size,
@@ -649,6 +616,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                        bool exact_size);
 int qcow2_shrink_l1_table(BlockDriverState *bs, uint64_t max_size);
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
+int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
                          uint8_t *buf, int nb_sectors, bool enc, Error **errp);

@@ -657,10 +625,9 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
                               unsigned int *bytes, uint64_t *host_offset,
                               QCowL2Meta **m);
-int qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
-                                          uint64_t offset,
-                                          int compressed_size,
-                                          uint64_t *host_offset);
+uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
+                                         uint64_t offset,
+                                         int compressed_size);

 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m);
 void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m);
@@ -718,12 +685,9 @@ int qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
                                  void **refcount_table,
                                  int64_t *refcount_table_size);
 bool qcow2_load_dirty_bitmaps(BlockDriverState *bs, Error **errp);
-Qcow2BitmapInfoList *qcow2_get_bitmap_info_list(BlockDriverState *bs,
-                                                Error **errp);
 int qcow2_reopen_bitmaps_rw_hint(BlockDriverState *bs, bool *header_updated,
                                 Error **errp);
 int qcow2_reopen_bitmaps_rw(BlockDriverState *bs, Error **errp);
-int qcow2_truncate_bitmaps_check(BlockDriverState *bs, Error **errp);
 void qcow2_store_persistent_dirty_bitmaps(BlockDriverState *bs, Error **errp);
 int qcow2_reopen_bitmaps_ro(BlockDriverState *bs, Error **errp);
 bool qcow2_can_store_new_dirty_bitmap(BlockDriverState *bs,
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -21,11 +21,16 @@
 /* Called with table_lock held.  */
 static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)
 {
-    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(
-        qiov, table->offsets, s->header.cluster_size * s->header.table_size);
+    QEMUIOVector qiov;
    int noffsets;
    int i, ret;

+    struct iovec iov = {
+        .iov_base = table->offsets,
+        .iov_len = s->header.cluster_size * s->header.table_size,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
    trace_qed_read_table(s, offset, table);

    qemu_co_mutex_unlock(&s->table_lock);
@@ -66,6 +71,7 @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
    unsigned int start, end, i;
    QEDTable *new_table;
+    struct iovec iov;
    QEMUIOVector qiov;
    size_t len_bytes;
    int ret;
@@ -79,7 +85,11 @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
    len_bytes = (end - start) * sizeof(uint64_t);

    new_table = qemu_blockalign(s->bs, len_bytes);
-    qemu_iovec_init_buf(&qiov, new_table->offsets, len_bytes);
+    iov = (struct iovec) {
+        .iov_base = new_table->offsets,
+        .iov_len = len_bytes,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);

    /* Byteswap table */
    for (i = start; i < end; i++) {
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.91
 .1.1