Update version for 2.7.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
ide: Fix memory leak in ide_register_restart_cb()
2016-12-23 09:38:06 -06:00 · 2016-12-21 10:49:48 -06:00 · 2016-12-21 10:08:19 -06:00 · 2016-12-21 09:59:57 -06:00 · 2016-12-21 09:27:59 -06:00 · 2016-12-20 19:33:05 -06:00
1285 changed files with 33958 additions and 73528 deletions
@@ -39,7 +39,9 @@
 /qmp-introspect.[ch]
 /qmp-marshal.c
 /qemu-doc.html
+/qemu-tech.html
 /qemu-doc.info
+/qemu-tech.info
 /qemu-img
 /qemu-nbd
 /qemu-options.def
@@ -51,9 +53,7 @@
 /qemu-bridge-helper
 /qemu-monitor.texi
 /qemu-monitor-info.texi
-/qemu-version.h
-/qemu-version.h.tmp
-/module_block.h
+/qmp-commands.txt
 /vscclient
 /fsdev/virtfs-proxy-helper
 *.[1-9]
@@ -31,6 +31,3 @@
 [submodule "roms/u-boot"]
 	path = roms/u-boot
 	url = git://git.qemu-project.org/u-boot.git
-[submodule "roms/skiboot"]
-	path = roms/skiboot
-	url = git://git.qemu.org/skiboot.git
@@ -9,7 +9,6 @@ cache: ccache
 addons:
  apt:
    packages:
-      # Build dependencies
      - libaio-dev
      - libattr1-dev
      - libbrlapi-dev
@@ -90,7 +89,6 @@ matrix:
    - env: CONFIG=""
      os: osx
      compiler: clang
-    # Plain Trusty Build
    - env: CONFIG=""
      sudo: required
      addons:
@@ -101,46 +99,3 @@ matrix:
        - sudo apt-get build-dep -qq qemu
        - wget -O - http://people.linaro.org/~alex.bennee/qemu-submodule-git-seed.tar.xz | tar -xvJ
        - git submodule update --init --recursive
-    # Using newer GCC with sanitizers
-    - addons:
-        apt:
-          sources:
-            # PPAs for newer toolchains
-            - ubuntu-toolchain-r-test
-          packages:
-            # Extra toolchains
-            - gcc-5
-            - g++-5
-            # Build dependencies
-            - libaio-dev
-            - libattr1-dev
-            - libbrlapi-dev
-            - libcap-ng-dev
-            - libgnutls-dev
-            - libgtk-3-dev
-            - libiscsi-dev
-            - liblttng-ust-dev
-            - libnfs-dev
-            - libncurses5-dev
-            - libnss3-dev
-            - libpixman-1-dev
-            - libpng12-dev
-            - librados-dev
-            - libsdl1.2-dev
-            - libseccomp-dev
-            - libspice-protocol-dev
-            - libspice-server-dev
-            - libssh2-1-dev
-            - liburcu-dev
-            - libusb-1.0-0-dev
-            - libvte-2.90-dev
-            - sparse
-            - uuid-dev
-      language: generic
-      compiler: none
-      env:
-        - COMPILER_NAME=gcc CXX=g++-5 CC=gcc-5
-        - CONFIG="--cc=gcc-5 --cxx=g++-5 --disable-pie --disable-linux-user --with-coroutine=gthread"
-        - TEST_CMD=""
-      before_script:
-        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || cat config.log
@@ -9,7 +9,7 @@ patches before submitting.
 Of course, the most important aspect in any coding style is whitespace.
 Crusty old coders who have trouble spotting the glasses on their noses
 can tell the difference between a tab and eight spaces from a distance
-of approximately fifteen parsecs.  Many a flamewar has been fought and
+of approximately fifteen parsecs.  Many a flamewar have been fought and
 lost on this issue.

 QEMU indents are four spaces.  Tabs are never used, except in Makefiles
@@ -63,17 +63,6 @@ W: http://wiki.qemu.org/SecurityProcess
 M: Michael S. Tsirkin <mst@redhat.com>
 L: secalert@redhat.com

-Trivial patches
---------------
-Trivial patches
-M: Michael Tokarev <mjt@tls.msk.ru>
-M: Laurent Vivier <laurent@vivier.eu>
-S: Maintained
-L: qemu-trivial@nongnu.org
-K: ^Subject:.*(?i)trivial
-T: git git://git.corpit.ru/qemu.git trivial-patches
-T: git git://github.com/vivier/qemu.git trivial-patches
-
 Guest CPU cores (TCG):
 ----------------------
 Overall
@@ -94,7 +83,6 @@ F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/helper*.h
 F: include/exec/tb-hash.h
-F: include/sysemu/cpus.h

 FPU emulation
 M: Aurelien Jarno <aurelien@aurel32.net>
@@ -118,7 +106,6 @@ S: Maintained
 F: target-arm/
 F: hw/arm/
 F: hw/cpu/a*mpcore.c
-F: include/hw/cpu/a*mpcore.h
 F: disas/arm.c
 F: disas/arm-a64.cc
 F: disas/libvixl/
@@ -128,7 +115,6 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: target-cris/
 F: hw/cris/
-F: include/hw/cris/
 F: tests/tcg/cris/
 F: disas/cris.c

@@ -145,10 +131,9 @@ F: include/hw/lm32/
 F: tests/tcg/lm32/

 M68K
-M: Laurent Vivier <laurent@vivier.eu>
-S: Maintained
+S: Orphan
 F: target-m68k/
-F: disas/m68k.c
+F: hw/m68k/

 MicroBlaze
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -159,17 +144,10 @@ F: disas/microblaze.c

 MIPS
 M: Aurelien Jarno <aurelien@aurel32.net>
-M: Yongbok Kim <yongbok.kim@imgtec.com>
+M: Leon Alrae <leon.alrae@imgtec.com>
 S: Maintained
 F: target-mips/
 F: hw/mips/
-F: hw/misc/mips_*
-F: hw/intc/mips_gic.c
-F: hw/timer/mips_gictimer.c
-F: include/hw/mips/
-F: include/hw/misc/mips_*
-F: include/hw/intc/mips_gic.h
-F: include/hw/timer/mips_gictimer.h
 F: tests/tcg/mips/
 F: disas/mips.c

@@ -178,8 +156,6 @@ M: Anthony Green <green@moxielogic.com>
 S: Maintained
 F: target-moxie/
 F: disas/moxie.c
-F: hw/moxie/
-F: default-configs/moxie-softmmu.mak

 OpenRISC
 M: Jia Liu <proljc@gmail.com>
@@ -195,7 +171,6 @@ L: qemu-ppc@nongnu.org
 S: Maintained
 F: target-ppc/
 F: hw/ppc/
-F: include/hw/ppc/
 F: disas/ppc.c

 S390
@@ -212,7 +187,6 @@ S: Odd Fixes
 F: target-sh4/
 F: hw/sh4/
 F: disas/sh4.c
-F: include/hw/sh4/

 SPARC
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
@@ -228,7 +202,6 @@ M: Guan Xuetao <gxt@mprc.pku.edu.cn>
 S: Maintained
 F: target-unicore32/
 F: hw/unicore32/
-F: include/hw/unicore32/

 X86
 M: Paolo Bonzini <pbonzini@redhat.com>
@@ -252,7 +225,6 @@ M: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
 S: Maintained
 F: target-tricore/
 F: hw/tricore/
-F: include/hw/tricore/

 Guest CPU Cores (KVM):
 ----------------------
@@ -342,9 +314,6 @@ L: qemu-devel@nongnu.org
 M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
 F: *win32*
-F: */*win32*
-F: include/*/*win32*
-X: qga/*win32*
 F: qemu.nsi

 ARM Machines
@@ -421,7 +390,6 @@ M: Peter Chubb <peter.chubb@nicta.com.au>
 L: qemu-arm@nongnu.org
 S: Odd fixes
 F: hw/*/imx*
-F: include/hw/*/imx*
 F: hw/arm/kzm.c
 F: include/hw/arm/fsl-imx31.h

@@ -430,7 +398,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/integratorcp.c
-F: hw/misc/arm_integrator_debug.c

 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
@@ -455,7 +422,6 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/realview*
-F: hw/cpu/realview_mpcore.c
 F: hw/intc/realview_gic.c
 F: include/hw/intc/realview_gic.h

@@ -468,7 +434,6 @@ F: hw/arm/spitz.c
 F: hw/arm/tosa.c
 F: hw/arm/z2.c
 F: hw/*/pxa2xx*
-F: hw/misc/mst_fpga.c
 F: include/hw/arm/pxa.h

 Stellaris
@@ -490,8 +455,8 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xilinx_*
 F: hw/*/cadence_*
-F: hw/misc/zynq*
-F: include/hw/misc/zynq*
+F: hw/misc/zynq_slcr.c
+F: include/hw/xilinx.h
 X: hw/ssi/xilinx_*

 Xilinx ZynqMP
@@ -500,7 +465,7 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
-F: include/hw/*/xlnx*.h
+F: include/hw/*/xlnx*.c

 ARM ACPI Subsystem
 M: Shannon Zhao <zhaoshenglong@huawei.com>
@@ -510,21 +475,6 @@ S: Maintained
 F: hw/arm/virt-acpi-build.c
 F: include/hw/arm/virt-acpi-build.h

-STM32F205
-M: Alistair Francis <alistair@alistair23.me>
-S: Maintained
-F: hw/arm/stm32f205_soc.c
-F: hw/misc/stm32f2xx_syscfg.c
-F: hw/char/stm32f2xx_usart.c
-F: hw/timer/stm32f2xx_timer.c
-F: hw/adc/*
-F: hw/ssi/stm32f2xx_spi.c
-
-Netduino 2
-M: Alistair Francis <alistair@alistair23.me>
-S: Maintained
-F: hw/arm/netduino2.c
-
 CRIS Machines
 -------------
 Axis Dev88
@@ -550,7 +500,6 @@ M68K Machines
 an5206
 S: Orphan
 F: hw/m68k/an5206.c
-F: hw/m68k/mcf5206.c

 dummy_m68k
 S: Orphan
@@ -559,9 +508,6 @@ F: hw/m68k/dummy_m68k.c
 mcf5208
 S: Orphan
 F: hw/m68k/mcf5208.c
-F: hw/m68k/mcf_intc.c
-F: hw/char/mcf_uart.c
-F: hw/net/mcf_fec.c

 MicroBlaze Machines
 -------------------
@@ -625,9 +571,6 @@ L: qemu-ppc@nongnu.org
 S: Supported
 F: hw/ppc/e500.[hc]
 F: hw/ppc/e500plat.c
-F: include/hw/ppc/ppc_e500.h
-F: include/hw/pci-host/ppce500.h
-F: pc-bios/u-boot.e500

 mpc8544ds
 M: Alexander Graf <agraf@suse.de>
@@ -645,8 +588,6 @@ F: hw/ppc/mac_newworld.c
 F: hw/pci-host/uninorth.c
 F: hw/pci-bridge/dec.[hc]
 F: hw/misc/macio/
-F: include/hw/ppc/mac_dbdma.h
-F: hw/nvram/mac_nvram.c

 Old World
 M: Alexander Graf <agraf@suse.de>
@@ -655,7 +596,6 @@ S: Maintained
 F: hw/ppc/mac_oldworld.c
 F: hw/pci-host/grackle.c
 F: hw/misc/macio/
-F: hw/intc/heathrow_pic.c

 PReP
 L: qemu-devel@nongnu.org
@@ -664,7 +604,6 @@ S: Odd Fixes
 F: hw/ppc/prep.c
 F: hw/pci-host/prep.[hc]
 F: hw/isa/pc87312.[hc]
-F: pc-bios/ppc_rom.bin

 sPAPR
 M: David Gibson <david@gibson.dropbear.id.au>
@@ -676,15 +615,6 @@ F: include/hw/*/spapr*
 F: hw/*/xics*
 F: include/hw/*/xics*
 F: pc-bios/spapr-rtas/*
-F: pc-bios/spapr-rtas.bin
-F: pc-bios/slof.bin
-F: pc-bios/skiboot.lid
-F: docs/specs/ppc-spapr-hcalls.txt
-F: docs/specs/ppc-spapr-hotplug.txt
-F: tests/spapr*
-F: tests/libqos/*spapr*
-F: tests/rtas*
-F: tests/libqos/rtas*

 virtex_ml507
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -698,40 +628,31 @@ R2D
 M: Magnus Damm <magnus.damm@gmail.com>
 S: Maintained
 F: hw/sh4/r2d.c
-F: hw/intc/sh_intc.c
-F: hw/timer/sh_timer.c

 Shix
 M: Magnus Damm <magnus.damm@gmail.com>
-S: Odd Fixes
+S: Orphan
 F: hw/sh4/shix.c

 SPARC Machines
 --------------
 Sun4m
+M: Blue Swirl <blauwirbel@gmail.com>
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 S: Maintained
 F: hw/sparc/sun4m.c
-F: hw/dma/sparc32_dma.c
-F: hw/dma/sun4m_iommu.c
-F: hw/misc/eccmemctl.c
-F: hw/misc/slavio_misc.c
-F: include/hw/sparc/sparc32_dma.h
-F: include/hw/sparc/sun4m.h
-F: pc-bios/openbios-sparc32

 Sun4u
+M: Blue Swirl <blauwirbel@gmail.com>
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 S: Maintained
 F: hw/sparc64/sun4u.c
-F: pc-bios/openbios-sparc64

 Leon3
 M: Fabien Chouteau <chouteau@adacore.com>
 S: Maintained
 F: hw/sparc/leon3.c
 F: hw/*/grlib*
-F: include/hw/sparc/grlib.h

 S390 Machines
 -------------
@@ -745,9 +666,6 @@ F: hw/s390x/
 F: include/hw/s390x/
 F: pc-bios/s390-ccw/
 F: hw/watchdog/wdt_diag288.c
-F: include/hw/watchdog/wdt_diag288.h
-F: pc-bios/s390-ccw.img
-F: default-configs/s390x-softmmu.mak
 T: git git://github.com/cohuck/qemu.git s390-next
 T: git git://github.com/borntraeger/qemu.git s390-next

@@ -777,7 +695,7 @@ F: hw/i2c/smbus_ich9.c
 F: hw/acpi/piix4.c
 F: hw/acpi/ich9.c
 F: include/hw/acpi/ich9.h
-F: include/hw/acpi/piix4.h
+F: include/hw/acpi/piix.h
 F: hw/misc/sga.c

 PC Chipset
@@ -797,10 +715,6 @@ F: hw/misc/pc-testdev.c
 F: hw/timer/hpet*
 F: hw/timer/i8254*
 F: hw/timer/mc146818rtc*
-F: include/hw/i2c/pm_smbus.h
-F: include/hw/timer/hpet.h
-F: include/hw/timer/i8254*
-F: include/hw/timer/mc146818rtc*

 Machine core
 M: Eduardo Habkost <ehabkost@redhat.com>
@@ -834,7 +748,6 @@ M: John Snow <jsnow@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: include/hw/ide.h
-F: include/hw/ide/
 F: hw/ide/
 F: hw/block/block.c
 F: hw/block/cdrom.c
@@ -884,15 +797,16 @@ F: hw/mem/*
 F: hw/acpi/*
 F: hw/smbios/*
 F: hw/i386/acpi-build.[hc]
+F: hw/i386/*dsl
 F: hw/arm/virt-acpi-build.c
 F: include/hw/arm/virt-acpi-build.h
+F: scripts/acpi*py

 ppc4xx
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/ppc4*.c
-F: include/hw/ppc/ppc4xx.h

 ppce500
 M: Alexander Graf <agraf@suse.de>
@@ -912,15 +826,13 @@ Network devices
 M: Jason Wang <jasowang@redhat.com>
 S: Odd Fixes
 F: hw/net/
-F: tests/virtio-net-test.c
 T: git git://github.com/jasowang/qemu.git net

 SCSI
 M: Paolo Bonzini <pbonzini@redhat.com>
 S: Supported
-F: include/hw/scsi/*
+F: include/hw/scsi*
 F: hw/scsi/*
-F: tests/virtio-scsi-test.c
 T: git git://github.com/bonzini/qemu.git scsi-next

 LSI53C895A
@@ -971,11 +883,8 @@ virtio
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: hw/*/virtio*
-F: hw/virtio/Makefile.objs
-F: hw/virtio/trace-events
 F: net/vhost-user.c
 F: include/hw/virtio/
-F: tests/virtio-balloon-test.c

 virtio-9p
 M: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
@@ -993,7 +902,7 @@ L: qemu-block@nongnu.org
 S: Supported
 F: hw/block/virtio-blk.c
 F: hw/block/dataplane/*
-F: tests/virtio-blk-test.c
+F: hw/virtio/dataplane/*
 T: git git://github.com/stefanha/qemu.git block

 virtio-ccw
@@ -1016,8 +925,6 @@ S: Supported
 F: hw/char/virtio-serial-bus.c
 F: hw/char/virtio-console.c
 F: include/hw/virtio/virtio-serial.h
-F: tests/virtio-console-test.c
-F: tests/virtio-serial-test.c

 virtio-rng
 M: Amit Shah <amit.shah@redhat.com>
@@ -1026,14 +933,6 @@ F: hw/virtio/virtio-rng.c
 F: include/hw/virtio/virtio-rng.h
 F: include/sysemu/rng*.h
 F: backends/rng*.c
-F: tests/virtio-rng-test.c
-
-virtio-crypto
-M: Gonglei <arei.gonglei@huawei.com>
-S: Supported
-F: hw/virtio/virtio-crypto.c
-F: hw/virtio/virtio-crypto-pci.c
-F: include/hw/virtio/virtio-crypto.h

 nvme
 M: Keith Busch <keith.busch@intel.com>
@@ -1067,8 +966,6 @@ Rocker
 M: Jiri Pirko <jiri@resnulli.us>
 S: Maintained
 F: hw/net/rocker/
-F: tests/rocker/
-F: docs/specs/rocker.txt

 NVDIMM
 M: Xiao Guangrong <guangrong.xiao@linux.intel.com>
@@ -1087,19 +984,6 @@ M: Dmitry Fleytman <dmitry@daynix.com>
 S: Maintained
 F: hw/net/e1000e*

-Generic Loader
-M: Alistair Francis <alistair.francis@xilinx.com>
-S: Maintained
-F: hw/core/generic-loader.c
-F: include/hw/core/generic-loader.h
-
-CHRP NVRAM
-M: Thomas Huth <thuth@redhat.com>
-S: Maintained
-F: hw/nvram/chrp_nvram.c
-F: include/hw/nvram/chrp_nvram.h
-F: tests/prom-env-test.c
-
 Subsystems
 ----------
 Audio
@@ -1107,7 +991,6 @@ M: Gerd Hoffmann <kraxel@redhat.com>
 S: Maintained
 F: audio/
 F: hw/audio/
-F: include/hw/audio/
 F: tests/ac97-test.c
 F: tests/es1370-test.c
 F: tests/intel-hda-test.c
@@ -1158,20 +1041,6 @@ F: block/qapi.c
 F: qapi/block*.json
 T: git git://repo.or.cz/qemu/armbru.git block-next

-Dirty Bitmaps
-M: Fam Zheng <famz@redhat.com>
-M: John Snow <jsnow@redhat.com>
-L: qemu-block@nongnu.org
-S: Supported
-F: util/hbitmap.c
-F: block/dirty-bitmap.c
-F: include/qemu/hbitmap.h
-F: include/block/dirty-bitmap.h
-F: tests/test-hbitmap.c
-F: docs/bitmaps.md
-T: git git://github.com/famz/qemu.git bitmaps
-T: git git://github.com/jnsnow/qemu.git bitmaps
-
 Character device backends
 M: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
@@ -1195,6 +1064,12 @@ S: Supported
 F: qom/cpu.c
 F: include/qom/cpu.h

+ICC Bus
+M: Igor Mammedov <imammedo@redhat.com>
+S: Supported
+F: include/hw/cpu/icc_bus.h
+F: hw/cpu/icc_bus.c
+
 Device Tree
 M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alexander Graf <agraf@suse.de>
@@ -1256,12 +1131,12 @@ F: qemu-timer.c
 F: vl.c

 Human Monitor (HMP)
-M: Dr. David Alan Gilbert <dgilbert@redhat.com>
+M: Luiz Capitulino <lcapitulino@redhat.com>
 S: Maintained
 F: monitor.c
-F: hmp.[ch]
-F: hmp-commands*.hx
-F: include/monitor/hmp-target.h
+F: hmp.c
+F: hmp-commands.hx
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp

 Network device backends
 M: Jason Wang <jasowang@redhat.com>
@@ -1301,12 +1176,6 @@ S: Maintained
 F: backends/hostmem*.c
 F: include/sysemu/hostmem.h

-Cryptodev Backends
-M: Gonglei <arei.gonglei@huawei.com>
-S: Maintained
-F: include/sysemu/cryptodev*.h
-F: backends/cryptodev*.c
-
 QAPI
 M: Markus Armbruster <armbru@redhat.com>
 M: Michael Roth <mdroth@linux.vnet.ibm.com>
@@ -1332,8 +1201,8 @@ F: qapi/*.json
 T: git git://repo.or.cz/qemu/armbru.git qapi-next

 QObject
-M: Markus Armbruster <armbru@redhat.com>
-S: Supported
+M: Luiz Capitulino <lcapitulino@redhat.com>
+S: Maintained
 F: qobject/
 F: include/qapi/qmp/
 X: include/qapi/qmp/dispatch.h
@@ -1343,7 +1212,7 @@ F: tests/check-qint.c
 F: tests/check-qjson.c
 F: tests/check-qlist.c
 F: tests/check-qstring.c
-T: git git://repo.or.cz/qemu/armbru.git qapi-next
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp

 QEMU Guest Agent
 M: Michael Roth <mdroth@linux.vnet.ibm.com>
@@ -1368,6 +1237,7 @@ M: Markus Armbruster <armbru@redhat.com>
 S: Supported
 F: qmp.c
 F: monitor.c
+F: qmp-commands.hx
 F: docs/*qmp-*
 F: scripts/qmp/
 T: git git://repo.or.cz/qemu/armbru.git qapi-next
@@ -1387,11 +1257,6 @@ F: net/slirp.c
 F: include/net/slirp.h
 T: git git://git.kiszka.org/qemu.git queues/slirp

-Stubs
-M: Paolo Bonzini <pbonzini@redhat.com>
-S: Maintained
-F: stubs/
-
 Tracing
 M: Stefan Hajnoczi <stefanha@redhat.com>
 S: Maintained
@@ -1465,30 +1330,6 @@ F: include/qemu/throttle.h
 F: util/throttle.c
 L: qemu-block@nongnu.org

-UUID
-M: Fam Zheng <famz@redhat.com>
-S: Supported
-F: util/uuid.c
-F: include/qemu/uuid.h
-F: tests/test-uuid.c
-
-COLO Framework
-M: zhanghailiang <zhang.zhanghailiang@huawei.com>
-S: Maintained
-F: migration/colo*
-F: include/migration/colo.h
-F: include/migration/failover.h
-F: docs/COLO-FT.txt
-
-COLO Proxy
-M: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-M: Li Zhijian <lizhijian@cn.fujitsu.com>
-S: Supported
-F: docs/colo-proxy.txt
-F: net/colo*
-F: net/filter-rewriter.c
-F: net/filter-mirror.c
-
 Usermode Emulation
 ------------------
 Overall
@@ -1500,13 +1341,11 @@ F: user-exec.c
 BSD user
 S: Orphan
 F: bsd-user/
-F: default-configs/*-bsd-user.mak

 Linux user
 M: Riku Voipio <riku.voipio@iki.fi>
 S: Maintained
 F: linux-user/
-F: default-configs/*-linux-user.mak

 Tiny Code Generator (TCG)
 -------------------------
@@ -1550,8 +1389,8 @@ F: tcg/mips/
 F: disas/mips.c

 PPC
-M: Richard Henderson <rth@twiddle.net>
-S: Odd Fixes
+M: Vassili Karpov (malc) <av1474@comtv.ru>
+S: Maintained
 F: tcg/ppc/
 F: disas/ppc.c

@@ -1574,6 +1413,28 @@ F: tcg/tci/
 F: tci.c
 F: disas/tci.c

+Stable branches
+---------------
+Stable 1.0
+L: qemu-stable@nongnu.org
+T: git git://git.qemu-project.org/qemu-stable-1.0.git
+S: Orphan
+
+Stable 0.15
+L: qemu-stable@nongnu.org
+T: git git://git.qemu-project.org/qemu-stable-0.15.git
+S: Orphan
+
+Stable 0.14
+L: qemu-stable@nongnu.org
+T: git git://git.qemu-project.org/qemu-stable-0.14.git
+S: Orphan
+
+Stable 0.10
+L: qemu-stable@nongnu.org
+T: git git://git.qemu-project.org/qemu-stable-0.10.git
+S: Orphan
+
 Block drivers
 -------------
 VMDK
@@ -1719,7 +1580,7 @@ M: Kevin Wolf <kwolf@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
 F: block/linux-aio.c
-F: include/block/raw-aio.h
+F: block/raw-aio.h
 F: block/raw-posix.c
 F: block/raw-win32.c
 F: block/raw_bsd.c
@@ -1763,15 +1624,6 @@ L: qemu-block@nongnu.org
 S: Supported
 F: tests/image-fuzzer/

-Replication
-M: Wen Congyang <wency@cn.fujitsu.com>
-M: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
-S: Supported
-F: replication*
-F: block/replication.c
-F: tests/test-replication.c
-F: docs/block-replication.txt
-
 Build and test automation
 -------------------------
 M: Alex Bennée <alex.bennee@linaro.org>
@@ -56,6 +56,9 @@ GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c qapi-event.c
 GENERATED_HEADERS += qmp-introspect.h
 GENERATED_SOURCES += qmp-introspect.c

+GENERATED_HEADERS += trace/generated-events.h
+GENERATED_SOURCES += trace/generated-events.c
+
 GENERATED_HEADERS += trace/generated-tracers.h
 ifeq ($(findstring dtrace,$(TRACE_BACKENDS)),dtrace)
 GENERATED_HEADERS += trace/generated-tracers-dtrace.h
@@ -73,8 +76,6 @@ GENERATED_HEADERS += trace/generated-ust-provider.h
 GENERATED_SOURCES += trace/generated-ust.c
 endif

-GENERATED_HEADERS += module_block.h
-
 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
 Makefile: ;
@@ -90,7 +91,8 @@ LIBS+=-lz $(LIBS_TOOLS)
 HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF)

 ifdef BUILD_DOCS
-DOCS=qemu-doc.html qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
+DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
+DOCS+=qmp-commands.txt
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
@@ -104,20 +106,20 @@ SUBDIR_DEVICES_MAK_DEP=$(patsubst %, %-config-devices.mak.d, $(TARGET_DIRS))

 ifeq ($(SUBDIR_DEVICES_MAK),)
 config-all-devices.mak:
-	$(call quiet-command,echo '# no devices' > $@,"GEN","$@")
+	$(call quiet-command,echo '# no devices' > $@,"  GEN   $@")
 else
 config-all-devices.mak: $(SUBDIR_DEVICES_MAK)
 	$(call quiet-command, sed -n \
             's|^\([^=]*\)=\(.*\)$$|\1:=$$(findstring y,$$(\1)\2)|p' \
             $(SUBDIR_DEVICES_MAK) | sort -u > $@, \
-             "GEN","$@")
+             "  GEN   $@")
 endif

 -include $(SUBDIR_DEVICES_MAK_DEP)

 %/config-devices.mak: default-configs/%.mak $(SRC_PATH)/scripts/make_device_config.sh
 	$(call quiet-command, \
-            $(SHELL) $(SRC_PATH)/scripts/make_device_config.sh $< $*-config-devices.mak.d $@ > $@.tmp,"GEN","$@.tmp")
+            $(SHELL) $(SRC_PATH)/scripts/make_device_config.sh $< $*-config-devices.mak.d $@ > $@.tmp, "  GEN   $@.tmp")
 	$(call quiet-command, if test -f $@; then \
 	  if cmp -s $@.old $@; then \
 	    mv $@.tmp $@; \
@@ -134,7 +136,7 @@ endif
 	 else \
 	  mv $@.tmp $@; \
 	  cp -p $@ $@.old; \
-	 fi,"GEN","$@");
+	 fi, "  GEN   $@");

 defconfig:
 	rm -f config-all-devices.mak $(SUBDIR_DEVICES_MAK)
@@ -188,7 +190,7 @@ qemu-version.h: FORCE
 config-host.h: config-host.h-timestamp
 config-host.h-timestamp: config-host.mak
 qemu-options.def: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

 SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 SOFTMMU_SUBDIR_RULES=$(filter %-softmmu,$(SUBDIR_RULES))
@@ -232,9 +234,9 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))
 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)

 $(BUILD_DIR)/version.o: $(SRC_PATH)/version.rc config-host.h | $(BUILD_DIR)/version.lo
-	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"RC","version.o")
+	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"  RC    version.o")
 $(BUILD_DIR)/version.lo: $(SRC_PATH)/version.rc config-host.h
-	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"RC","version.lo")
+	$(call quiet-command,$(WINDRES) -I$(BUILD_DIR) -o $@ $<,"  RC    version.lo")

 Makefile: $(version-obj-y) $(version-lobj-y)

@@ -244,6 +246,9 @@ Makefile: $(version-obj-y) $(version-lobj-y)
 libqemustub.a: $(stub-obj-y)
 libqemuutil.a: $(util-obj-y)

+block-modules = $(foreach o,$(block-obj-m),"$(basename $(subst /,-,$o))",) NULL
+util/module.o-cflags = -D'CONFIG_BLOCK_MODULES=$(block-modules)'
+
 ######################################################################

 qemu-img.o: qemu-img-cmds.h
@@ -258,7 +263,7 @@ fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/9p-marshal
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $@")

 qemu-ga$(EXESUF): LIBS = $(LIBS_QGA)
 qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated
@@ -271,17 +276,17 @@ qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
-		"GEN","$@")
+		"  GEN   $@")
 qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
-		"GEN","$@")
+		"  GEN   $@")
 qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
 $(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
 		$(gen-out-type) -o qga/qapi-generated -p "qga-" $<, \
-		"GEN","$@")
+		"  GEN   $@")

 qapi-modules = $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/qapi/common.json \
               $(SRC_PATH)/qapi/block.json $(SRC_PATH)/qapi/block-core.json \
@@ -293,27 +298,27 @@ qapi-types.c qapi-types.h :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py \
 		$(gen-out-type) -o "." -b $<, \
-		"GEN","$@")
+		"  GEN   $@")
 qapi-visit.c qapi-visit.h :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py \
 		$(gen-out-type) -o "." -b $<, \
-		"GEN","$@")
+		"  GEN   $@")
 qapi-event.c qapi-event.h :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-event.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-event.py \
 		$(gen-out-type) -o "." $<, \
-		"GEN","$@")
+		"  GEN   $@")
 qmp-commands.h qmp-marshal.c :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py \
-		$(gen-out-type) -o "." $<, \
-		"GEN","$@")
+		$(gen-out-type) -o "." -m $<, \
+		"  GEN   $@")
 qmp-introspect.h qmp-introspect.c :\
 $(qapi-modules) $(SRC_PATH)/scripts/qapi-introspect.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-introspect.py \
 		$(gen-out-type) -o "." $<, \
-		"GEN","$@")
+		"  GEN   $@")

 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)
@@ -332,7 +337,7 @@ $(QEMU_GA_MSI): config-host.mak

 $(QEMU_GA_MSI):  $(SRC_PATH)/qga/installer/qemu-ga.wxs
 	$(call quiet-command,QEMU_GA_VERSION="$(QEMU_GA_VERSION)" QEMU_GA_MANUFACTURER="$(QEMU_GA_MANUFACTURER)" QEMU_GA_DISTRO="$(QEMU_GA_DISTRO)" BUILD_DIR="$(BUILD_DIR)" \
-	wixl -o $@ $(QEMU_GA_MSI_ARCH) $(QEMU_GA_MSI_WITH_VSS) $(QEMU_GA_MSI_MINGW_DLL_PATH) $<,"WIXL","$@")
+	wixl -o $@ $(QEMU_GA_MSI_ARCH) $(QEMU_GA_MSI_WITH_VSS) $(QEMU_GA_MSI_MINGW_DLL_PATH) $<, "  WIXL  $@")
 else
 msi:
 	@echo "MSI build not configured or dependency resolution failed (reconfigure with --enable-guest-agent-msi option)"
@@ -348,11 +353,6 @@ ivshmem-client$(EXESUF): $(ivshmem-client-obj-y) libqemuutil.a libqemustub.a
 ivshmem-server$(EXESUF): $(ivshmem-server-obj-y) libqemuutil.a libqemustub.a
 	$(call LINK, $^)

-module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
-	$(call quiet-command,$(PYTHON) $< $@ \
-	$(addprefix $(SRC_PATH)/,$(patsubst %.mo,%.c,$(block-obj-m))), \
-	"GEN","$@")
-
 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
@@ -395,6 +395,7 @@ distclean: clean
 	rm -f qemu-doc.vr
 	rm -f config.log
 	rm -f linux-headers/asm
+	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
        done
@@ -421,7 +422,7 @@ qemu-icon.bmp qemu_logo_no_text.svg \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin \
 s390-ccw.img \
-spapr-rtas.bin slof.bin skiboot.lid \
+spapr-rtas.bin slof.bin \
 palcode-clipper \
 u-boot.e500
 else
@@ -430,8 +431,8 @@ endif

 install-doc: $(DOCS)
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) qemu-doc.html "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) $(SRC_PATH)/docs/qmp-commands.txt "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) qmp-commands.txt "$(DESTDIR)$(qemu_docdir)"
 ifdef CONFIG_POSIX
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
@@ -517,13 +518,13 @@ ui/shader/%-vert.h: $(SRC_PATH)/ui/shader/%.vert $(SRC_PATH)/scripts/shaderinclu
 	@mkdir -p $(dir $@)
 	$(call quiet-command,\
 		perl $(SRC_PATH)/scripts/shaderinclude.pl $< > $@,\
-		"VERT","$@")
+		"  VERT  $@")

 ui/shader/%-frag.h: $(SRC_PATH)/ui/shader/%.frag $(SRC_PATH)/scripts/shaderinclude.pl
 	@mkdir -p $(dir $@)
 	$(call quiet-command,\
 		perl $(SRC_PATH)/scripts/shaderinclude.pl $< > $@,\
-		"FRAG","$@")
+		"  FRAG  $@")

 ui/console-gl.o: $(SRC_PATH)/ui/console-gl.c \
 	ui/shader/texture-blit-vert.h ui/shader/texture-blit-frag.h
@@ -533,65 +534,68 @@ MAKEINFO=makeinfo
 MAKEINFOFLAGS=--no-headers --no-split --number-sections
 TEXIFLAG=$(if $(V),,--quiet)
 %.dvi: %.texi
-	$(call quiet-command,texi2dvi $(TEXIFLAG) -I . $<,"GEN","$@")
+	$(call quiet-command,texi2dvi $(TEXIFLAG) -I . $<,"  GEN   $@")

 %.html: %.texi
 	$(call quiet-command,LC_ALL=C $(MAKEINFO) $(MAKEINFOFLAGS) --html $< -o $@, \
-	"GEN","$@")
+	"  GEN   $@")

 %.info: %.texi
-	$(call quiet-command,$(MAKEINFO) $< -o $@,"GEN","$@")
+	$(call quiet-command,$(MAKEINFO) $< -o $@,"  GEN   $@")

 %.pdf: %.texi
-	$(call quiet-command,texi2pdf $(TEXIFLAG) -I . $<,"GEN","$@")
+	$(call quiet-command,texi2pdf $(TEXIFLAG) -I . $<,"  GEN   $@")

 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")

 qemu-monitor.texi: $(SRC_PATH)/hmp-commands.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")

 qemu-monitor-info.texi: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")
+
+qmp-commands.txt: $(SRC_PATH)/qmp-commands.hx $(SRC_PATH)/scripts/hxtool
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -q < $< > $@,"  GEN   $@")

 qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"  GEN   $@")

 qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu.pod && \
 	  $(POD2MAN) --section=1 --center=" " --release=" " qemu.pod > $@, \
-	  "GEN","$@")
+	  "  GEN   $@")
 qemu.1: qemu-option-trace.texi

 qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-img.pod && \
 	  $(POD2MAN) --section=1 --center=" " --release=" " qemu-img.pod > $@, \
-	  "GEN","$@")
+	  "  GEN   $@")

 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< fsdev/virtfs-proxy-helper.pod && \
 	  $(POD2MAN) --section=1 --center=" " --release=" " fsdev/virtfs-proxy-helper.pod > $@, \
-	  "GEN","$@")
+	  "  GEN   $@")

 qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-nbd.pod && \
 	  $(POD2MAN) --section=8 --center=" " --release=" " qemu-nbd.pod > $@, \
-	  "GEN","$@")
+	  "  GEN   $@")

 qemu-ga.8: qemu-ga.texi
 	$(call quiet-command, \
 	  perl -Ww -- $(SRC_PATH)/scripts/texi2pod.pl $< qemu-ga.pod && \
 	  $(POD2MAN) --section=8 --center=" " --release=" " qemu-ga.pod > $@, \
-	  "GEN","$@")
+	  "  GEN   $@")

-dvi: qemu-doc.dvi
-html: qemu-doc.html
-info: qemu-doc.info
-pdf: qemu-doc.pdf
+dvi: qemu-doc.dvi qemu-tech.dvi
+html: qemu-doc.html qemu-tech.html
+info: qemu-doc.info qemu-tech.info
+pdf: qemu-doc.pdf qemu-tech.pdf

 qemu-doc.dvi qemu-doc.html qemu-doc.info qemu-doc.pdf: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
@@ -665,40 +669,3 @@ endif
 -include $(wildcard *.d tests/*.d)

 include $(SRC_PATH)/tests/docker/Makefile.include
-
-.PHONY: help
-help:
-	@echo  'Generic targets:'
-	@echo  '  all             - Build all'
-	@echo  '  dir/file.o      - Build specified target only'
-	@echo  '  install         - Install QEMU, documentation and tools'
-	@echo  '  ctags/TAGS      - Generate tags file for editors'
-	@echo  '  cscope          - Generate cscope index'
-	@echo  ''
-	@$(if $(TARGET_DIRS), \
-		echo 'Architecture specific targets:'; \
-		$(foreach t, $(TARGET_DIRS), \
-		printf "  %-30s - Build for %s\\n" $(patsubst %,subdir-%,$(t)) $(t);) \
-		echo '')
-	@echo  'Cleaning targets:'
-	@echo  '  clean           - Remove most generated files but keep the config'
-	@echo  '  distclean       - Remove all generated files'
-	@echo  '  dist            - Build a distributable tarball'
-	@echo  ''
-	@echo  'Test targets:'
-	@echo  '  check           - Run all tests (check-help for details)'
-	@echo  '  docker          - Help about targets running tests inside Docker containers'
-	@echo  ''
-	@echo  'Documentation targets:'
-	@echo  '  dvi html info pdf'
-	@echo  '                  - Build documentation in specified format'
-	@echo  ''
-ifdef CONFIG_WIN32
-	@echo  'Windows targets:'
-	@echo  '  installer       - Build NSIS-based installer for QEMU'
-ifdef QEMU_GA_MSI_ENABLED
-	@echo  '  msi             - Build MSI-based installer for qemu-ga'
-endif
-	@echo  ''
-endif
-	@echo  '  make V=0|1 [targets] 0 => quiet build (default), 1 => verbose build'
@@ -15,7 +15,6 @@ block-obj-$(CONFIG_POSIX) += aio-posix.o
 block-obj-$(CONFIG_WIN32) += aio-win32.o
 block-obj-y += block/
 block-obj-y += qemu-io-cmds.o
-block-obj-$(CONFIG_REPLICATION) += replication.o

 block-obj-m = block/

@@ -89,7 +88,7 @@ endif

 #######################################################################
 # Target-independent parts used in system and user emulation
-common-obj-y += cpus-common.o
+common-obj-y += tcg-runtime.o
 common-obj-y += hw/
 common-obj-y += qom/
 common-obj-y += disas/
@@ -142,7 +141,6 @@ trace-events-y += hw/dma/trace-events
 trace-events-y += hw/sparc/trace-events
 trace-events-y += hw/sd/trace-events
 trace-events-y += hw/isa/trace-events
-trace-events-y += hw/mem/trace-events
 trace-events-y += hw/i386/trace-events
 trace-events-y += hw/9pfs/trace-events
 trace-events-y += hw/ppc/trace-events
@@ -155,11 +153,9 @@ trace-events-y += hw/alpha/trace-events
 trace-events-y += ui/trace-events
 trace-events-y += audio/trace-events
 trace-events-y += net/trace-events
-trace-events-y += target-arm/trace-events
 trace-events-y += target-i386/trace-events
 trace-events-y += target-sparc/trace-events
 trace-events-y += target-s390x/trace-events
 trace-events-y += target-ppc/trace-events
 trace-events-y += qom/trace-events
 trace-events-y += linux-user/trace-events
-trace-events-y += qapi/trace-events
@@ -26,7 +26,7 @@ ifneq (,$(findstring -mwindows,$(libs_softmmu)))
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
 $(QEMU_PROG): $(QEMU_PROGW)
-	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"GEN","$(TARGET_DIR)$(QEMU_PROG)")
+	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
 QEMU_PROG_BUILD = $(QEMU_PROGW)
 else
 QEMU_PROG_BUILD = $(QEMU_PROG)
@@ -55,7 +55,7 @@ $(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
-		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp-installed")
+		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG).stp-installed")

 $(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
@@ -64,14 +64,14 @@ $(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all
 		--binary=$(realpath .)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
-		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp")
+		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG).stp")

 $(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--format=simpletrace-stap \
 		--backends=$(TRACE_BACKENDS) \
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
-		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")
+		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")

 else
 stap:
@@ -94,7 +94,6 @@ obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
 obj-y += fpu/softfloat.o
 obj-y += target-$(TARGET_BASE_ARCH)/
 obj-y += disas.o
-obj-y += tcg-runtime.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
 obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o

@@ -157,7 +156,7 @@ else
 obj-y += hw/$(TARGET_BASE_ARCH)/
 endif

-GENERATED_HEADERS += hmp-commands.h hmp-commands-info.h
+GENERATED_HEADERS += hmp-commands.h hmp-commands-info.h qmp-commands-old.h

 endif # CONFIG_SOFTMMU

@@ -197,23 +196,26 @@ $(QEMU_PROG_BUILD): config-devices.mak
 $(QEMU_PROG_BUILD): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
 	$(call LINK, $(filter-out %.mak, $^))
 ifdef CONFIG_DARWIN
-	$(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"REZ","$(TARGET_DIR)$@")
-	$(call quiet-command,SetFile -a C $@,"SETFILE","$(TARGET_DIR)$@")
+	$(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"  REZ   $(TARGET_DIR)$@")
+	$(call quiet-command,SetFile -a C $@,"  SETFILE $(TARGET_DIR)$@")
 endif

 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
-	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"GEN","$(TARGET_DIR)$@")
+	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")

 hmp-commands.h: $(SRC_PATH)/hmp-commands.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

 hmp-commands-info.h: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxtool
-	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")

-clean: clean-target
+qmp-commands-old.h: $(SRC_PATH)/qmp-commands.hx $(SRC_PATH)/scripts/hxtool
+	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
+
+clean:
 	rm -f *.a *~ $(PROGS)
 	rm -f $(shell find . -name '*.[od]')
-	rm -f hmp-commands.h gdbstub-xml.c
+	rm -f hmp-commands.h qmp-commands-old.h gdbstub-xml.c
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
 endif
@@ -42,6 +42,8 @@ of other UNIX targets. The simple steps to build QEMU are:
  ../configure
  make

+Complete details of the process for building and configuring QEMU for
+all supported host platforms can be found in the qemu-tech.html file.
 Additional information can also be found online via the QEMU website:

  http://qemu-project.org/Hosts/Linux
@@ -1 +1 @@
-2.8.1.1
+2.7.1
@@ -33,6 +33,7 @@
 #include "sysemu/qtest.h"
 #include "hw/xen/xen.h"
 #include "qom/object.h"
+#include "hw/boards.h"

 int tcg_tb_size;
 static bool tcg_allowed = true;
@@ -81,22 +81,29 @@ static void aio_epoll_update(AioContext *ctx, AioHandler *node, bool is_new)
 {
    struct epoll_event event;
    int r;
-    int ctl;

    if (!ctx->epoll_enabled) {
        return;
    }
    if (!node->pfd.events) {
-        ctl = EPOLL_CTL_DEL;
+        r = epoll_ctl(ctx->epollfd, EPOLL_CTL_DEL, node->pfd.fd, &event);
+        if (r) {
+            aio_epoll_disable(ctx);
+        }
    } else {
        event.data.ptr = node;
        event.events = epoll_events_from_pfd(node->pfd.events);
-        ctl = is_new ? EPOLL_CTL_ADD : EPOLL_CTL_MOD;
-    }
-
-    r = epoll_ctl(ctx->epollfd, ctl, node->pfd.fd, &event);
-    if (r) {
-        aio_epoll_disable(ctx);
+        if (is_new) {
+            r = epoll_ctl(ctx->epollfd, EPOLL_CTL_ADD, node->pfd.fd, &event);
+            if (r) {
+                aio_epoll_disable(ctx);
+            }
+        } else {
+            r = epoll_ctl(ctx->epollfd, EPOLL_CTL_MOD, node->pfd.fd, &event);
+            if (r) {
+                aio_epoll_disable(ctx);
+            }
+        }
    }
 }

@@ -210,23 +217,21 @@ void aio_set_fd_handler(AioContext *ctx,

    /* Are we deleting the fd handler? */
    if (!io_read && !io_write) {
-        if (node == NULL) {
-            return;
-        }
+        if (node) {
+            g_source_remove_poll(&ctx->source, &node->pfd);

-        g_source_remove_poll(&ctx->source, &node->pfd);
-
-        /* If the lock is held, just mark the node as deleted */
-        if (ctx->walking_handlers) {
-            node->deleted = 1;
-            node->pfd.revents = 0;
-        } else {
-            /* Otherwise, delete it for real.  We can't just mark it as
-             * deleted because deleted nodes are only cleaned up after
-             * releasing the walking_handlers lock.
-             */
-            QLIST_REMOVE(node, node);
-            deleted = true;
+            /* If the lock is held, just mark the node as deleted */
+            if (ctx->walking_handlers) {
+                node->deleted = 1;
+                node->pfd.revents = 0;
+            } else {
+                /* Otherwise, delete it for real.  We can't just mark it as
+                 * deleted because deleted nodes are only cleaned up after
+                 * releasing the walking_handlers lock.
+                 */
+                QLIST_REMOVE(node, node);
+                deleted = true;
+            }
        }
    } else {
        if (node == NULL) {
@@ -426,13 +431,11 @@ bool aio_poll(AioContext *ctx, bool blocking)
    assert(npfd == 0);

    /* fill pollfds */
-
-    if (!aio_epoll_enabled(ctx)) {
-        QLIST_FOREACH(node, &ctx->aio_handlers, node) {
-            if (!node->deleted && node->pfd.events
-                && aio_node_check(ctx, node->is_external)) {
-                add_pollfd(node);
-            }
+    QLIST_FOREACH(node, &ctx->aio_handlers, node) {
+        if (!node->deleted && node->pfd.events
+            && !aio_epoll_enabled(ctx)
+            && aio_node_check(ctx, node->is_external)) {
+            add_pollfd(node);
        }
    }

@@ -235,6 +235,25 @@ void audio_init(void)
    }
 }

+int qemu_uuid_parse(const char *str, uint8_t *uuid)
+{
+    int ret;
+
+    if (strlen(str) != 36) {
+        return -1;
+    }
+
+    ret = sscanf(str, UUID_FMT, &uuid[0], &uuid[1], &uuid[2], &uuid[3],
+                 &uuid[4], &uuid[5], &uuid[6], &uuid[7], &uuid[8], &uuid[9],
+                 &uuid[10], &uuid[11], &uuid[12], &uuid[13], &uuid[14],
+                 &uuid[15]);
+
+    if (ret != 16) {
+        return -1;
+    }
+    return 0;
+}
+
 void do_acpitable_option(const QemuOpts *opts)
 {
 #ifdef TARGET_I386
@@ -44,26 +44,6 @@ struct QEMUBH {
    bool deleted;
 };

-void aio_bh_schedule_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
-{
-    QEMUBH *bh;
-    bh = g_new(QEMUBH, 1);
-    *bh = (QEMUBH){
-        .ctx = ctx,
-        .cb = cb,
-        .opaque = opaque,
-    };
-    qemu_mutex_lock(&ctx->bh_lock);
-    bh->next = ctx->first_bh;
-    bh->scheduled = 1;
-    bh->deleted = 1;
-    /* Make sure that the members are ready before putting bh into list */
-    smp_wmb();
-    ctx->first_bh = bh;
-    qemu_mutex_unlock(&ctx->bh_lock);
-    aio_notify(ctx);
-}
-
 QEMUBH *aio_bh_new(AioContext *ctx, QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
@@ -106,9 +86,9 @@ int aio_bh_poll(AioContext *ctx)
         * thread sees the zero before bh->cb has run, and thus will call
         * aio_notify again if necessary.
         */
-        if (atomic_xchg(&bh->scheduled, 0)) {
-            /* Idle BHs don't count as progress */
-            if (!bh->idle) {
+        if (!bh->deleted && atomic_xchg(&bh->scheduled, 0)) {
+            /* Idle BHs and the notify BH don't count as progress */
+            if (!bh->idle && bh != ctx->notify_dummy_bh) {
                ret = 1;
            }
            bh->idle = 0;
@@ -124,7 +104,7 @@ int aio_bh_poll(AioContext *ctx)
        bhp = &ctx->first_bh;
        while (*bhp) {
            bh = *bhp;
-            if (bh->deleted && !bh->scheduled) {
+            if (bh->deleted) {
                *bhp = bh->next;
                g_free(bh);
            } else {
@@ -188,7 +168,7 @@ aio_compute_timeout(AioContext *ctx)
    QEMUBH *bh;

    for (bh = ctx->first_bh; bh; bh = bh->next) {
-        if (bh->scheduled) {
+        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
                 * every 10ms */
@@ -236,7 +216,7 @@ aio_ctx_check(GSource *source)
    aio_notify_accept(ctx);

    for (bh = ctx->first_bh; bh; bh = bh->next) {
-        if (bh->scheduled) {
+        if (!bh->deleted && bh->scheduled) {
            return true;
        }
    }
@@ -260,6 +240,7 @@ aio_ctx_finalize(GSource     *source)
 {
    AioContext *ctx = (AioContext *) source;

+    qemu_bh_delete(ctx->notify_dummy_bh);
    thread_pool_free(ctx->thread_pool);

 #ifdef CONFIG_LINUX_AIO
@@ -284,7 +265,7 @@ aio_ctx_finalize(GSource     *source)

    aio_set_event_notifier(ctx, &ctx->notifier, false, NULL);
    event_notifier_cleanup(&ctx->notifier);
-    qemu_rec_mutex_destroy(&ctx->lock);
+    rfifolock_destroy(&ctx->lock);
    qemu_mutex_destroy(&ctx->bh_lock);
    timerlistgroup_deinit(&ctx->tlg);
 }
@@ -345,6 +326,19 @@ static void aio_timerlist_notify(void *opaque)
    aio_notify(opaque);
 }

+static void aio_rfifolock_cb(void *opaque)
+{
+    AioContext *ctx = opaque;
+
+    /* Kick owner thread in case they are blocked in aio_poll() */
+    qemu_bh_schedule(ctx->notify_dummy_bh);
+}
+
+static void notify_dummy_bh(void *opaque)
+{
+    /* Do nothing, we were invoked just to force the event loop to iterate */
+}
+
 static void event_notifier_dummy_cb(EventNotifier *e)
 {
 }
@@ -372,9 +366,11 @@ AioContext *aio_context_new(Error **errp)
 #endif
    ctx->thread_pool = NULL;
    qemu_mutex_init(&ctx->bh_lock);
-    qemu_rec_mutex_init(&ctx->lock);
+    rfifolock_init(&ctx->lock, aio_rfifolock_cb, ctx);
    timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);

+    ctx->notify_dummy_bh = aio_bh_new(ctx, notify_dummy_bh, NULL);
+
    return ctx;
 fail:
    g_source_destroy(&ctx->source);
@@ -393,10 +389,10 @@ void aio_context_unref(AioContext *ctx)

 void aio_context_acquire(AioContext *ctx)
 {
-    qemu_rec_mutex_lock(&ctx->lock);
+    rfifolock_lock(&ctx->lock);
 }

 void aio_context_release(AioContext *ctx)
 {
-    qemu_rec_mutex_unlock(&ctx->lock);
+    rfifolock_unlock(&ctx->lock);
 }
@@ -1,215 +0,0 @@
-/*
- * Atomic helper templates
- * Included from tcg-runtime.c and cputlb.c.
- *
- * Copyright (c) 2016 Red Hat, Inc
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#if DATA_SIZE == 16
-# define SUFFIX     o
-# define DATA_TYPE  Int128
-# define BSWAP      bswap128
-#elif DATA_SIZE == 8
-# define SUFFIX     q
-# define DATA_TYPE  uint64_t
-# define BSWAP      bswap64
-#elif DATA_SIZE == 4
-# define SUFFIX     l
-# define DATA_TYPE  uint32_t
-# define BSWAP      bswap32
-#elif DATA_SIZE == 2
-# define SUFFIX     w
-# define DATA_TYPE  uint16_t
-# define BSWAP      bswap16
-#elif DATA_SIZE == 1
-# define SUFFIX     b
-# define DATA_TYPE  uint8_t
-# define BSWAP
-#else
-# error unsupported data size
-#endif
-
-#if DATA_SIZE >= 4
-# define ABI_TYPE  DATA_TYPE
-#else
-# define ABI_TYPE  uint32_t
-#endif
-
-/* Define host-endian atomic operations.  Note that END is used within
-   the ATOMIC_NAME macro, and redefined below.  */
-#if DATA_SIZE == 1
-# define END
-#elif defined(HOST_WORDS_BIGENDIAN)
-# define END  _be
-#else
-# define END  _le
-#endif
-
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
-                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    return atomic_cmpxchg__nocheck(haddr, cmpv, newv);
-}
-
-#if DATA_SIZE >= 16
-ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
-{
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
-    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
-    return val;
-}
-
-void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
-                     ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
-}
-#else
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
-                           ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    return atomic_xchg__nocheck(haddr, val);
-}
-
-#define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
-{                                                                   \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-    return atomic_##X(haddr, val);                                  \
-}                                                                   \
-
-GEN_ATOMIC_HELPER(fetch_add)
-GEN_ATOMIC_HELPER(fetch_and)
-GEN_ATOMIC_HELPER(fetch_or)
-GEN_ATOMIC_HELPER(fetch_xor)
-GEN_ATOMIC_HELPER(add_fetch)
-GEN_ATOMIC_HELPER(and_fetch)
-GEN_ATOMIC_HELPER(or_fetch)
-GEN_ATOMIC_HELPER(xor_fetch)
-
-#undef GEN_ATOMIC_HELPER
-#endif /* DATA SIZE >= 16 */
-
-#undef END
-
-#if DATA_SIZE > 1
-
-/* Define reverse-host-endian atomic operations.  Note that END is used
-   within the ATOMIC_NAME macro.  */
-#ifdef HOST_WORDS_BIGENDIAN
-# define END  _le
-#else
-# define END  _be
-#endif
-
-ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
-                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    return BSWAP(atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv)));
-}
-
-#if DATA_SIZE >= 16
-ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
-{
-    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
-    __atomic_load(haddr, &val, __ATOMIC_RELAXED);
-    return BSWAP(val);
-}
-
-void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
-                     ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    val = BSWAP(val);
-    __atomic_store(haddr, &val, __ATOMIC_RELAXED);
-}
-#else
-ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
-                           ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    return BSWAP(atomic_xchg__nocheck(haddr, BSWAP(val)));
-}
-
-#define GEN_ATOMIC_HELPER(X)                                        \
-ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
-{                                                                   \
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-    return BSWAP(atomic_##X(haddr, BSWAP(val)));                    \
-}
-
-GEN_ATOMIC_HELPER(fetch_and)
-GEN_ATOMIC_HELPER(fetch_or)
-GEN_ATOMIC_HELPER(fetch_xor)
-GEN_ATOMIC_HELPER(and_fetch)
-GEN_ATOMIC_HELPER(or_fetch)
-GEN_ATOMIC_HELPER(xor_fetch)
-
-#undef GEN_ATOMIC_HELPER
-
-/* Note that for addition, we need to use a separate cmpxchg loop instead
-   of bswaps for the reverse-host-endian helpers.  */
-ABI_TYPE ATOMIC_NAME(fetch_add)(CPUArchState *env, target_ulong addr,
-                         ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ldo, ldn, ret, sto;
-
-    ldo = atomic_read__nocheck(haddr);
-    while (1) {
-        ret = BSWAP(ldo);
-        sto = BSWAP(ret + val);
-        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
-        if (ldn == ldo) {
-            return ret;
-        }
-        ldo = ldn;
-    }
-}
-
-ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
-                         ABI_TYPE val EXTRA_ARGS)
-{
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ldo, ldn, ret, sto;
-
-    ldo = atomic_read__nocheck(haddr);
-    while (1) {
-        ret = BSWAP(ldo) + val;
-        sto = BSWAP(ret);
-        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
-        if (ldn == ldo) {
-            return ret;
-        }
-        ldo = ldn;
-    }
-}
-#endif /* DATA_SIZE >= 16 */
-
-#undef END
-#endif /* DATA_SIZE > 1 */
-
-#undef BSWAP
-#undef ABI_TYPE
-#undef DATA_TYPE
-#undef SUFFIX
-#undef DATA_SIZE
@@ -9,6 +9,3 @@ common-obj-$(CONFIG_TPM) += tpm.o

 common-obj-y += hostmem.o hostmem-ram.o
 common-obj-$(CONFIG_LINUX) += hostmem-file.o
-
-common-obj-y += cryptodev.o
-common-obj-y += cryptodev-builtin.o
@@ -1,7 +1,7 @@
 /*
 * QEMU Baum Braille Device
 *
- * Copyright (c) 2008, 2010-2011, 2016 Samuel Thibault
+ * Copyright (c) 2008 Samuel Thibault
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
@@ -92,7 +92,6 @@ typedef struct {
    brlapi_handle_t *brlapi;
    int brlapi_fd;
    unsigned int x, y;
-    bool deferred_init;

    uint8_t in_buf[BUF_SIZE];
    uint8_t in_buf_used;
@@ -103,11 +102,8 @@ typedef struct {
 } BaumDriverState;

 /* Let's assume NABCC by default */
-enum way {
-    DOTS2ASCII,
-    ASCII2DOTS
-};
-static const uint8_t nabcc_translation[2][256] = {
+static const uint8_t nabcc_translation[256] = {
+    [0] = ' ',
 #ifndef BRLAPI_DOTS
 #define BRLAPI_DOTS(d1,d2,d3,d4,d5,d6,d7,d8) \
    ((d1?BRLAPI_DOT1:0)|\
@@ -119,154 +115,107 @@ static const uint8_t nabcc_translation[2][256] = {
     (d7?BRLAPI_DOT7:0)|\
     (d8?BRLAPI_DOT8:0))
 #endif
-#define DO(dots, ascii) \
-    [DOTS2ASCII][dots] = ascii, \
-    [ASCII2DOTS][ascii] = dots
-    DO(0, ' '),
-    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 0, 0, 0), 'a'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 0, 0, 0), 'b'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 0, 0, 0), 'c'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 0, 0, 0), 'd'),
-    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 0, 0, 0), 'e'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 0, 0, 0), 'f'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 0, 0, 0), 'g'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 0, 0, 0), 'h'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 0, 0, 0), 'i'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 0, 0, 0), 'j'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 0, 0, 0), 'k'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 0, 0, 0), 'l'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 0, 0, 0), 'm'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 0, 0, 0), 'n'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 0, 0, 0), 'o'),
-    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 0, 0, 0), 'p'),
-    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 0, 0, 0), 'q'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 0, 0, 0), 'r'),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 0, 0, 0), 's'),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 0, 0, 0), 't'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 1, 0, 0), 'u'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 1, 0, 0), 'v'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 1, 0, 0), 'w'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 1, 0, 0), 'x'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 1, 0, 0), 'y'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 1, 0, 0), 'z'),
+    [BRLAPI_DOTS(1,0,0,0,0,0,0,0)] = 'a',
+    [BRLAPI_DOTS(1,1,0,0,0,0,0,0)] = 'b',
+    [BRLAPI_DOTS(1,0,0,1,0,0,0,0)] = 'c',
+    [BRLAPI_DOTS(1,0,0,1,1,0,0,0)] = 'd',
+    [BRLAPI_DOTS(1,0,0,0,1,0,0,0)] = 'e',
+    [BRLAPI_DOTS(1,1,0,1,0,0,0,0)] = 'f',
+    [BRLAPI_DOTS(1,1,0,1,1,0,0,0)] = 'g',
+    [BRLAPI_DOTS(1,1,0,0,1,0,0,0)] = 'h',
+    [BRLAPI_DOTS(0,1,0,1,0,0,0,0)] = 'i',
+    [BRLAPI_DOTS(0,1,0,1,1,0,0,0)] = 'j',
+    [BRLAPI_DOTS(1,0,1,0,0,0,0,0)] = 'k',
+    [BRLAPI_DOTS(1,1,1,0,0,0,0,0)] = 'l',
+    [BRLAPI_DOTS(1,0,1,1,0,0,0,0)] = 'm',
+    [BRLAPI_DOTS(1,0,1,1,1,0,0,0)] = 'n',
+    [BRLAPI_DOTS(1,0,1,0,1,0,0,0)] = 'o',
+    [BRLAPI_DOTS(1,1,1,1,0,0,0,0)] = 'p',
+    [BRLAPI_DOTS(1,1,1,1,1,0,0,0)] = 'q',
+    [BRLAPI_DOTS(1,1,1,0,1,0,0,0)] = 'r',
+    [BRLAPI_DOTS(0,1,1,1,0,0,0,0)] = 's',
+    [BRLAPI_DOTS(0,1,1,1,1,0,0,0)] = 't',
+    [BRLAPI_DOTS(1,0,1,0,0,1,0,0)] = 'u',
+    [BRLAPI_DOTS(1,1,1,0,0,1,0,0)] = 'v',
+    [BRLAPI_DOTS(0,1,0,1,1,1,0,0)] = 'w',
+    [BRLAPI_DOTS(1,0,1,1,0,1,0,0)] = 'x',
+    [BRLAPI_DOTS(1,0,1,1,1,1,0,0)] = 'y',
+    [BRLAPI_DOTS(1,0,1,0,1,1,0,0)] = 'z',

-    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 0, 1, 0), 'A'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 0, 1, 0), 'B'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 0, 1, 0), 'C'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 0, 1, 0), 'D'),
-    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 0, 1, 0), 'E'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 0, 1, 0), 'F'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 0, 1, 0), 'G'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 0, 1, 0), 'H'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 0, 1, 0), 'I'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 0, 1, 0), 'J'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 0, 1, 0), 'K'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 0, 1, 0), 'L'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 0, 1, 0), 'M'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 0, 1, 0), 'N'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 0, 1, 0), 'O'),
-    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 0, 1, 0), 'P'),
-    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 0, 1, 0), 'Q'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 0, 1, 0), 'R'),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 0, 1, 0), 'S'),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 0, 1, 0), 'T'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 0, 1, 1, 0), 'U'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 0, 1, 1, 0), 'V'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 1, 1, 1, 0), 'W'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 0, 1, 1, 0), 'X'),
-    DO(BRLAPI_DOTS(1, 0, 1, 1, 1, 1, 1, 0), 'Y'),
-    DO(BRLAPI_DOTS(1, 0, 1, 0, 1, 1, 1, 0), 'Z'),
+    [BRLAPI_DOTS(1,0,0,0,0,0,1,0)] = 'A',
+    [BRLAPI_DOTS(1,1,0,0,0,0,1,0)] = 'B',
+    [BRLAPI_DOTS(1,0,0,1,0,0,1,0)] = 'C',
+    [BRLAPI_DOTS(1,0,0,1,1,0,1,0)] = 'D',
+    [BRLAPI_DOTS(1,0,0,0,1,0,1,0)] = 'E',
+    [BRLAPI_DOTS(1,1,0,1,0,0,1,0)] = 'F',
+    [BRLAPI_DOTS(1,1,0,1,1,0,1,0)] = 'G',
+    [BRLAPI_DOTS(1,1,0,0,1,0,1,0)] = 'H',
+    [BRLAPI_DOTS(0,1,0,1,0,0,1,0)] = 'I',
+    [BRLAPI_DOTS(0,1,0,1,1,0,1,0)] = 'J',
+    [BRLAPI_DOTS(1,0,1,0,0,0,1,0)] = 'K',
+    [BRLAPI_DOTS(1,1,1,0,0,0,1,0)] = 'L',
+    [BRLAPI_DOTS(1,0,1,1,0,0,1,0)] = 'M',
+    [BRLAPI_DOTS(1,0,1,1,1,0,1,0)] = 'N',
+    [BRLAPI_DOTS(1,0,1,0,1,0,1,0)] = 'O',
+    [BRLAPI_DOTS(1,1,1,1,0,0,1,0)] = 'P',
+    [BRLAPI_DOTS(1,1,1,1,1,0,1,0)] = 'Q',
+    [BRLAPI_DOTS(1,1,1,0,1,0,1,0)] = 'R',
+    [BRLAPI_DOTS(0,1,1,1,0,0,1,0)] = 'S',
+    [BRLAPI_DOTS(0,1,1,1,1,0,1,0)] = 'T',
+    [BRLAPI_DOTS(1,0,1,0,0,1,1,0)] = 'U',
+    [BRLAPI_DOTS(1,1,1,0,0,1,1,0)] = 'V',
+    [BRLAPI_DOTS(0,1,0,1,1,1,1,0)] = 'W',
+    [BRLAPI_DOTS(1,0,1,1,0,1,1,0)] = 'X',
+    [BRLAPI_DOTS(1,0,1,1,1,1,1,0)] = 'Y',
+    [BRLAPI_DOTS(1,0,1,0,1,1,1,0)] = 'Z',

-    DO(BRLAPI_DOTS(0, 0, 1, 0, 1, 1, 0, 0), '0'),
-    DO(BRLAPI_DOTS(0, 1, 0, 0, 0, 0, 0, 0), '1'),
-    DO(BRLAPI_DOTS(0, 1, 1, 0, 0, 0, 0, 0), '2'),
-    DO(BRLAPI_DOTS(0, 1, 0, 0, 1, 0, 0, 0), '3'),
-    DO(BRLAPI_DOTS(0, 1, 0, 0, 1, 1, 0, 0), '4'),
-    DO(BRLAPI_DOTS(0, 1, 0, 0, 0, 1, 0, 0), '5'),
-    DO(BRLAPI_DOTS(0, 1, 1, 0, 1, 0, 0, 0), '6'),
-    DO(BRLAPI_DOTS(0, 1, 1, 0, 1, 1, 0, 0), '7'),
-    DO(BRLAPI_DOTS(0, 1, 1, 0, 0, 1, 0, 0), '8'),
-    DO(BRLAPI_DOTS(0, 0, 1, 0, 1, 0, 0, 0), '9'),
+    [BRLAPI_DOTS(0,0,1,0,1,1,0,0)] = '0',
+    [BRLAPI_DOTS(0,1,0,0,0,0,0,0)] = '1',
+    [BRLAPI_DOTS(0,1,1,0,0,0,0,0)] = '2',
+    [BRLAPI_DOTS(0,1,0,0,1,0,0,0)] = '3',
+    [BRLAPI_DOTS(0,1,0,0,1,1,0,0)] = '4',
+    [BRLAPI_DOTS(0,1,0,0,0,1,0,0)] = '5',
+    [BRLAPI_DOTS(0,1,1,0,1,0,0,0)] = '6',
+    [BRLAPI_DOTS(0,1,1,0,1,1,0,0)] = '7',
+    [BRLAPI_DOTS(0,1,1,0,0,1,0,0)] = '8',
+    [BRLAPI_DOTS(0,0,1,0,1,0,0,0)] = '9',

-    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 1, 0, 0), '.'),
-    DO(BRLAPI_DOTS(0, 0, 1, 1, 0, 1, 0, 0), '+'),
-    DO(BRLAPI_DOTS(0, 0, 1, 0, 0, 1, 0, 0), '-'),
-    DO(BRLAPI_DOTS(1, 0, 0, 0, 0, 1, 0, 0), '*'),
-    DO(BRLAPI_DOTS(0, 0, 1, 1, 0, 0, 0, 0), '/'),
-    DO(BRLAPI_DOTS(1, 1, 1, 0, 1, 1, 0, 0), '('),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 1, 1, 0, 0), ')'),
+    [BRLAPI_DOTS(0,0,0,1,0,1,0,0)] = '.',
+    [BRLAPI_DOTS(0,0,1,1,0,1,0,0)] = '+',
+    [BRLAPI_DOTS(0,0,1,0,0,1,0,0)] = '-',
+    [BRLAPI_DOTS(1,0,0,0,0,1,0,0)] = '*',
+    [BRLAPI_DOTS(0,0,1,1,0,0,0,0)] = '/',
+    [BRLAPI_DOTS(1,1,1,0,1,1,0,0)] = '(',
+    [BRLAPI_DOTS(0,1,1,1,1,1,0,0)] = ')',

-    DO(BRLAPI_DOTS(1, 1, 1, 1, 0, 1, 0, 0), '&'),
-    DO(BRLAPI_DOTS(0, 0, 1, 1, 1, 1, 0, 0), '#'),
+    [BRLAPI_DOTS(1,1,1,1,0,1,0,0)] = '&',
+    [BRLAPI_DOTS(0,0,1,1,1,1,0,0)] = '#',

-    DO(BRLAPI_DOTS(0, 0, 0, 0, 0, 1, 0, 0), ','),
-    DO(BRLAPI_DOTS(0, 0, 0, 0, 1, 1, 0, 0), ';'),
-    DO(BRLAPI_DOTS(1, 0, 0, 0, 1, 1, 0, 0), ':'),
-    DO(BRLAPI_DOTS(0, 1, 1, 1, 0, 1, 0, 0), '!'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 1, 1, 0, 0), '?'),
-    DO(BRLAPI_DOTS(0, 0, 0, 0, 1, 0, 0, 0), '"'),
-    DO(BRLAPI_DOTS(0, 0, 1, 0, 0, 0, 0, 0), '\''),
-    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 0, 0, 0), '`'),
-    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 0, 1, 0), '^'),
-    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 0, 0, 0), '~'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 1, 1, 0), '['),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 1, 1, 0), ']'),
-    DO(BRLAPI_DOTS(0, 1, 0, 1, 0, 1, 0, 0), '{'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 1, 1, 0, 0), '}'),
-    DO(BRLAPI_DOTS(1, 1, 1, 1, 1, 1, 0, 0), '='),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 0, 1, 0, 0), '<'),
-    DO(BRLAPI_DOTS(0, 0, 1, 1, 1, 0, 0, 0), '>'),
-    DO(BRLAPI_DOTS(1, 1, 0, 1, 0, 1, 0, 0), '$'),
-    DO(BRLAPI_DOTS(1, 0, 0, 1, 0, 1, 0, 0), '%'),
-    DO(BRLAPI_DOTS(0, 0, 0, 1, 0, 0, 1, 0), '@'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 1, 0, 0), '|'),
-    DO(BRLAPI_DOTS(1, 1, 0, 0, 1, 1, 1, 0), '\\'),
-    DO(BRLAPI_DOTS(0, 0, 0, 1, 1, 1, 0, 0), '_'),
+    [BRLAPI_DOTS(0,0,0,0,0,1,0,0)] = ',',
+    [BRLAPI_DOTS(0,0,0,0,1,1,0,0)] = ';',
+    [BRLAPI_DOTS(1,0,0,0,1,1,0,0)] = ':',
+    [BRLAPI_DOTS(0,1,1,1,0,1,0,0)] = '!',
+    [BRLAPI_DOTS(1,0,0,1,1,1,0,0)] = '?',
+    [BRLAPI_DOTS(0,0,0,0,1,0,0,0)] = '"',
+    [BRLAPI_DOTS(0,0,1,0,0,0,0,0)] ='\'',
+    [BRLAPI_DOTS(0,0,0,1,0,0,0,0)] = '`',
+    [BRLAPI_DOTS(0,0,0,1,1,0,1,0)] = '^',
+    [BRLAPI_DOTS(0,0,0,1,1,0,0,0)] = '~',
+    [BRLAPI_DOTS(0,1,0,1,0,1,1,0)] = '[',
+    [BRLAPI_DOTS(1,1,0,1,1,1,1,0)] = ']',
+    [BRLAPI_DOTS(0,1,0,1,0,1,0,0)] = '{',
+    [BRLAPI_DOTS(1,1,0,1,1,1,0,0)] = '}',
+    [BRLAPI_DOTS(1,1,1,1,1,1,0,0)] = '=',
+    [BRLAPI_DOTS(1,1,0,0,0,1,0,0)] = '<',
+    [BRLAPI_DOTS(0,0,1,1,1,0,0,0)] = '>',
+    [BRLAPI_DOTS(1,1,0,1,0,1,0,0)] = '$',
+    [BRLAPI_DOTS(1,0,0,1,0,1,0,0)] = '%',
+    [BRLAPI_DOTS(0,0,0,1,0,0,1,0)] = '@',
+    [BRLAPI_DOTS(1,1,0,0,1,1,0,0)] = '|',
+    [BRLAPI_DOTS(1,1,0,0,1,1,1,0)] ='\\',
+    [BRLAPI_DOTS(0,0,0,1,1,1,0,0)] = '_',
 };

-/* The guest OS has started discussing with us, finish initializing BrlAPI */
-static int baum_deferred_init(BaumDriverState *baum)
-{
-#if defined(CONFIG_SDL)
-#if SDL_COMPILEDVERSION < SDL_VERSIONNUM(2, 0, 0)
-    SDL_SysWMinfo info;
-#endif
-#endif
-    int tty;
-
-    if (baum->deferred_init) {
-        return 1;
-    }
-
-    if (brlapi__getDisplaySize(baum->brlapi, &baum->x, &baum->y) == -1) {
-        brlapi_perror("baum: brlapi__getDisplaySize");
-        return 0;
-    }
-
-#if defined(CONFIG_SDL)
-#if SDL_COMPILEDVERSION < SDL_VERSIONNUM(2, 0, 0)
-    memset(&info, 0, sizeof(info));
-    SDL_VERSION(&info.version);
-    if (SDL_GetWMInfo(&info)) {
-        tty = info.info.x11.wmwindow;
-    } else {
-#endif
-#endif
-        tty = BRLAPI_TTY_DEFAULT;
-#if defined(CONFIG_SDL)
-#if SDL_COMPILEDVERSION < SDL_VERSIONNUM(2, 0, 0)
-    }
-#endif
-#endif
-
-    if (brlapi__enterTtyMode(baum->brlapi, tty, NULL) == -1) {
-        brlapi_perror("baum: brlapi__enterTtyMode");
-        return 0;
-    }
-    baum->deferred_init = 1;
-    return 1;
-}
-
 /* The serial port can receive more of our data */
 static void baum_accept_input(struct CharDriverState *chr)
 {
@@ -397,10 +346,8 @@ static int baum_eat_packet(BaumDriverState *baum, const uint8_t *buf, int len)
                cursor = i + 1;
                c &= ~(BRLAPI_DOT7|BRLAPI_DOT8);
            }
-            c = nabcc_translation[DOTS2ASCII][c];
-            if (!c) {
+            if (!(c = nabcc_translation[c]))
                c = '?';
-            }
            text[i] = c;
        }
        timer_del(baum->cellCount_timer);
@@ -493,8 +440,6 @@ static int baum_write(CharDriverState *chr, const uint8_t *buf, int len)
        return 0;
    if (!baum->brlapi)
        return len;
-    if (!baum_deferred_init(baum))
-        return len;

    while (len) {
        /* Complete our buffer as much as possible */
@@ -531,13 +476,6 @@ static void baum_send_key(BaumDriverState *baum, uint8_t type, uint8_t value) {
    baum_write_packet(baum, packet, sizeof(packet));
 }

-static void baum_send_key2(BaumDriverState *baum, uint8_t type, uint8_t value,
-                           uint8_t value2) {
-    uint8_t packet[] = { type, value, value2 };
-    DPRINTF("writing key %x %x\n", type, value);
-    baum_write_packet(baum, packet, sizeof(packet));
-}
-
 /* We got some data on the BrlAPI socket */
 static void baum_chr_read(void *opaque)
 {
@@ -546,8 +484,6 @@ static void baum_chr_read(void *opaque)
    int ret;
    if (!baum->brlapi)
        return;
-    if (!baum_deferred_init(baum))
-        return;
    while ((ret = brlapi__readKey(baum->brlapi, 0, &code)) == 1) {
        DPRINTF("got key %"BRLAPI_PRIxKEYCODE"\n", code);
        /* Emulate */
@@ -604,17 +540,7 @@ static void baum_chr_read(void *opaque)
            }
            break;
        case BRLAPI_KEY_TYPE_SYM:
-            {
-                brlapi_keyCode_t keysym = code & BRLAPI_KEY_CODE_MASK;
-                if (keysym < 0x100) {
-                    uint8_t dots = nabcc_translation[ASCII2DOTS][keysym];
-                    if (dots) {
-                        baum_send_key2(baum, BAUM_RSP_EntryKeys, 0, dots);
-                        baum_send_key2(baum, BAUM_RSP_EntryKeys, 0, 0);
-                    }
-                }
-                break;
-            }
+            break;
        }
    }
    if (ret == -1 && (brlapi_errno != BRLAPI_ERROR_LIBCERR || errno != EINTR)) {
@@ -625,7 +551,7 @@ static void baum_chr_read(void *opaque)
    }
 }

-static void baum_free(struct CharDriverState *chr)
+static void baum_close(struct CharDriverState *chr)
 {
    BaumDriverState *baum = chr->opaque;

@@ -640,13 +566,18 @@ static void baum_free(struct CharDriverState *chr)
 static CharDriverState *chr_baum_init(const char *id,
                                      ChardevBackend *backend,
                                      ChardevReturn *ret,
-                                      bool *be_opened,
                                      Error **errp)
 {
    ChardevCommon *common = backend->u.braille.data;
    BaumDriverState *baum;
    CharDriverState *chr;
    brlapi_handle_t *handle;
+#if defined(CONFIG_SDL)
+#if SDL_COMPILEDVERSION < SDL_VERSIONNUM(2, 0, 0)
+    SDL_SysWMinfo info;
+#endif
+#endif
+    int tty;

    chr = qemu_chr_alloc(common, errp);
    if (!chr) {
@@ -658,7 +589,7 @@ static CharDriverState *chr_baum_init(const char *id,
    chr->opaque = baum;
    chr->chr_write = baum_write;
    chr->chr_accept_input = baum_accept_input;
-    chr->chr_free = baum_free;
+    chr->chr_close = baum_close;

    handle = g_malloc0(brlapi_getHandleSize());
    baum->brlapi = handle;
@@ -669,14 +600,39 @@ static CharDriverState *chr_baum_init(const char *id,
                   brlapi_strerror(brlapi_error_location()));
        goto fail_handle;
    }
-    baum->deferred_init = 0;

    baum->cellCount_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, baum_cellCount_timer_cb, baum);

+    if (brlapi__getDisplaySize(handle, &baum->x, &baum->y) == -1) {
+        error_setg(errp, "brlapi__getDisplaySize: %s",
+                   brlapi_strerror(brlapi_error_location()));
+        goto fail;
+    }
+
+#if defined(CONFIG_SDL)
+#if SDL_COMPILEDVERSION < SDL_VERSIONNUM(2, 0, 0)
+    memset(&info, 0, sizeof(info));
+    SDL_VERSION(&info.version);
+    if (SDL_GetWMInfo(&info))
+        tty = info.info.x11.wmwindow;
+    else
+#endif
+#endif
+        tty = BRLAPI_TTY_DEFAULT;
+
+    if (brlapi__enterTtyMode(handle, tty, NULL) == -1) {
+        error_setg(errp, "brlapi__enterTtyMode: %s",
+                   brlapi_strerror(brlapi_error_location()));
+        goto fail;
+    }
+
    qemu_set_fd_handler(baum->brlapi_fd, baum_chr_read, NULL, baum);

    return chr;

+fail:
+    timer_free(baum->cellCount_timer);
+    brlapi__closeConnection(handle);
 fail_handle:
    g_free(handle);
    g_free(chr);
@@ -1,361 +0,0 @@
-/*
- * QEMU Cryptodev backend for QEMU cipher APIs
- *
- * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
- *
- * Authors:
- *    Gonglei <arei.gonglei@huawei.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "sysemu/cryptodev.h"
-#include "hw/boards.h"
-#include "qapi/error.h"
-#include "standard-headers/linux/virtio_crypto.h"
-#include "crypto/cipher.h"
-
-
-/**
- * @TYPE_CRYPTODEV_BACKEND_BUILTIN:
- * name of backend that uses QEMU cipher API
- */
-#define TYPE_CRYPTODEV_BACKEND_BUILTIN "cryptodev-backend-builtin"
-
-#define CRYPTODEV_BACKEND_BUILTIN(obj) \
-    OBJECT_CHECK(CryptoDevBackendBuiltin, \
-                 (obj), TYPE_CRYPTODEV_BACKEND_BUILTIN)
-
-typedef struct CryptoDevBackendBuiltin
-                         CryptoDevBackendBuiltin;
-
-typedef struct CryptoDevBackendBuiltinSession {
-    QCryptoCipher *cipher;
-    uint8_t direction; /* encryption or decryption */
-    uint8_t type; /* cipher? hash? aead? */
-    QTAILQ_ENTRY(CryptoDevBackendBuiltinSession) next;
-} CryptoDevBackendBuiltinSession;
-
-/* Max number of symmetric sessions */
-#define MAX_NUM_SESSIONS 256
-
-#define CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN    512
-#define CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN  64
-
-struct CryptoDevBackendBuiltin {
-    CryptoDevBackend parent_obj;
-
-    CryptoDevBackendBuiltinSession *sessions[MAX_NUM_SESSIONS];
-};
-
-static void cryptodev_builtin_init(
-             CryptoDevBackend *backend, Error **errp)
-{
-    /* Only support one queue */
-    int queues = backend->conf.peers.queues;
-    CryptoDevBackendClient *cc;
-
-    if (queues != 1) {
-        error_setg(errp,
-                  "Only support one queue in cryptdov-builtin backend");
-        return;
-    }
-
-    cc = cryptodev_backend_new_client(
-              "cryptodev-builtin", NULL);
-    cc->info_str = g_strdup_printf("cryptodev-builtin0");
-    cc->queue_index = 0;
-    backend->conf.peers.ccs[0] = cc;
-
-    backend->conf.crypto_services =
-                         1u << VIRTIO_CRYPTO_SERVICE_CIPHER |
-                         1u << VIRTIO_CRYPTO_SERVICE_HASH |
-                         1u << VIRTIO_CRYPTO_SERVICE_MAC;
-    backend->conf.cipher_algo_l = 1u << VIRTIO_CRYPTO_CIPHER_AES_CBC;
-    backend->conf.hash_algo = 1u << VIRTIO_CRYPTO_HASH_SHA1;
-    /*
-     * Set the Maximum length of crypto request.
-     * Why this value? Just avoid to overflow when
-     * memory allocation for each crypto request.
-     */
-    backend->conf.max_size = LONG_MAX - sizeof(CryptoDevBackendSymOpInfo);
-    backend->conf.max_cipher_key_len = CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN;
-    backend->conf.max_auth_key_len = CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN;
-}
-
-static int
-cryptodev_builtin_get_unused_session_index(
-                 CryptoDevBackendBuiltin *builtin)
-{
-    size_t i;
-
-    for (i = 0; i < MAX_NUM_SESSIONS; i++) {
-        if (builtin->sessions[i] == NULL) {
-            return i;
-        }
-    }
-
-    return -1;
-}
-
-static int
-cryptodev_builtin_get_aes_algo(uint32_t key_len, Error **errp)
-{
-    int algo;
-
-    if (key_len == 128 / 8) {
-        algo = QCRYPTO_CIPHER_ALG_AES_128;
-    } else if (key_len == 192 / 8) {
-        algo = QCRYPTO_CIPHER_ALG_AES_192;
-    } else if (key_len == 256 / 8) {
-        algo = QCRYPTO_CIPHER_ALG_AES_256;
-    } else {
-        error_setg(errp, "Unsupported key length :%u", key_len);
-        return -1;
-    }
-
-    return algo;
-}
-
-static int cryptodev_builtin_create_cipher_session(
-                    CryptoDevBackendBuiltin *builtin,
-                    CryptoDevBackendSymSessionInfo *sess_info,
-                    Error **errp)
-{
-    int algo;
-    int mode;
-    QCryptoCipher *cipher;
-    int index;
-    CryptoDevBackendBuiltinSession *sess;
-
-    if (sess_info->op_type != VIRTIO_CRYPTO_SYM_OP_CIPHER) {
-        error_setg(errp, "Unsupported optype :%u", sess_info->op_type);
-        return -1;
-    }
-
-    index = cryptodev_builtin_get_unused_session_index(builtin);
-    if (index < 0) {
-        error_setg(errp, "Total number of sessions created exceeds %u",
-                  MAX_NUM_SESSIONS);
-        return -1;
-    }
-
-    switch (sess_info->cipher_alg) {
-    case VIRTIO_CRYPTO_CIPHER_AES_ECB:
-        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
-                                                          errp);
-        if (algo < 0)  {
-            return -1;
-        }
-        mode = QCRYPTO_CIPHER_MODE_ECB;
-        break;
-    case VIRTIO_CRYPTO_CIPHER_AES_CBC:
-        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
-                                                          errp);
-        if (algo < 0)  {
-            return -1;
-        }
-        mode = QCRYPTO_CIPHER_MODE_CBC;
-        break;
-    case VIRTIO_CRYPTO_CIPHER_AES_CTR:
-        algo = cryptodev_builtin_get_aes_algo(sess_info->key_len,
-                                                          errp);
-        if (algo < 0)  {
-            return -1;
-        }
-        mode = QCRYPTO_CIPHER_MODE_CTR;
-        break;
-    case VIRTIO_CRYPTO_CIPHER_DES_ECB:
-        algo = QCRYPTO_CIPHER_ALG_DES_RFB;
-        mode = QCRYPTO_CIPHER_MODE_ECB;
-        break;
-    default:
-        error_setg(errp, "Unsupported cipher alg :%u",
-                   sess_info->cipher_alg);
-        return -1;
-    }
-
-    cipher = qcrypto_cipher_new(algo, mode,
-                               sess_info->cipher_key,
-                               sess_info->key_len,
-                               errp);
-    if (!cipher) {
-        return -1;
-    }
-
-    sess = g_new0(CryptoDevBackendBuiltinSession, 1);
-    sess->cipher = cipher;
-    sess->direction = sess_info->direction;
-    sess->type = sess_info->op_type;
-
-    builtin->sessions[index] = sess;
-
-    return index;
-}
-
-static int64_t cryptodev_builtin_sym_create_session(
-           CryptoDevBackend *backend,
-           CryptoDevBackendSymSessionInfo *sess_info,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendBuiltin *builtin =
-                      CRYPTODEV_BACKEND_BUILTIN(backend);
-    int64_t session_id = -1;
-    int ret;
-
-    switch (sess_info->op_code) {
-    case VIRTIO_CRYPTO_CIPHER_CREATE_SESSION:
-        ret = cryptodev_builtin_create_cipher_session(
-                           builtin, sess_info, errp);
-        if (ret < 0) {
-            return ret;
-        } else {
-            session_id = ret;
-        }
-        break;
-    case VIRTIO_CRYPTO_HASH_CREATE_SESSION:
-    case VIRTIO_CRYPTO_MAC_CREATE_SESSION:
-    default:
-        error_setg(errp, "Unsupported opcode :%" PRIu32 "",
-                   sess_info->op_code);
-        return -1;
-    }
-
-    return session_id;
-}
-
-static int cryptodev_builtin_sym_close_session(
-           CryptoDevBackend *backend,
-           uint64_t session_id,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendBuiltin *builtin =
-                      CRYPTODEV_BACKEND_BUILTIN(backend);
-
-    if (session_id >= MAX_NUM_SESSIONS ||
-              builtin->sessions[session_id] == NULL) {
-        error_setg(errp, "Cannot find a valid session id: %" PRIu64 "",
-                      session_id);
-        return -1;
-    }
-
-    qcrypto_cipher_free(builtin->sessions[session_id]->cipher);
-    g_free(builtin->sessions[session_id]);
-    builtin->sessions[session_id] = NULL;
-    return 0;
-}
-
-static int cryptodev_builtin_sym_operation(
-                 CryptoDevBackend *backend,
-                 CryptoDevBackendSymOpInfo *op_info,
-                 uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendBuiltin *builtin =
-                      CRYPTODEV_BACKEND_BUILTIN(backend);
-    CryptoDevBackendBuiltinSession *sess;
-    int ret;
-
-    if (op_info->session_id >= MAX_NUM_SESSIONS ||
-              builtin->sessions[op_info->session_id] == NULL) {
-        error_setg(errp, "Cannot find a valid session id: %" PRIu64 "",
-                   op_info->session_id);
-        return -VIRTIO_CRYPTO_INVSESS;
-    }
-
-    if (op_info->op_type == VIRTIO_CRYPTO_SYM_OP_ALGORITHM_CHAINING) {
-        error_setg(errp,
-               "Algorithm chain is unsupported for cryptdoev-builtin");
-        return -VIRTIO_CRYPTO_NOTSUPP;
-    }
-
-    sess = builtin->sessions[op_info->session_id];
-
-    ret = qcrypto_cipher_setiv(sess->cipher, op_info->iv,
-                               op_info->iv_len, errp);
-    if (ret < 0) {
-        return -VIRTIO_CRYPTO_ERR;
-    }
-
-    if (sess->direction == VIRTIO_CRYPTO_OP_ENCRYPT) {
-        ret = qcrypto_cipher_encrypt(sess->cipher, op_info->src,
-                                     op_info->dst, op_info->src_len, errp);
-        if (ret < 0) {
-            return -VIRTIO_CRYPTO_ERR;
-        }
-    } else {
-        ret = qcrypto_cipher_decrypt(sess->cipher, op_info->src,
-                                     op_info->dst, op_info->src_len, errp);
-        if (ret < 0) {
-            return -VIRTIO_CRYPTO_ERR;
-        }
-    }
-    return VIRTIO_CRYPTO_OK;
-}
-
-static void cryptodev_builtin_cleanup(
-             CryptoDevBackend *backend,
-             Error **errp)
-{
-    CryptoDevBackendBuiltin *builtin =
-                      CRYPTODEV_BACKEND_BUILTIN(backend);
-    size_t i;
-    int queues = backend->conf.peers.queues;
-    CryptoDevBackendClient *cc;
-
-    for (i = 0; i < MAX_NUM_SESSIONS; i++) {
-        if (builtin->sessions[i] != NULL) {
-            cryptodev_builtin_sym_close_session(
-                    backend, i, 0, errp);
-        }
-    }
-
-    assert(queues == 1);
-
-    for (i = 0; i < queues; i++) {
-        cc = backend->conf.peers.ccs[i];
-        if (cc) {
-            cryptodev_backend_free_client(cc);
-            backend->conf.peers.ccs[i] = NULL;
-        }
-    }
-}
-
-static void
-cryptodev_builtin_class_init(ObjectClass *oc, void *data)
-{
-    CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_CLASS(oc);
-
-    bc->init = cryptodev_builtin_init;
-    bc->cleanup = cryptodev_builtin_cleanup;
-    bc->create_session = cryptodev_builtin_sym_create_session;
-    bc->close_session = cryptodev_builtin_sym_close_session;
-    bc->do_sym_op = cryptodev_builtin_sym_operation;
-}
-
-static const TypeInfo cryptodev_builtin_info = {
-    .name = TYPE_CRYPTODEV_BACKEND_BUILTIN,
-    .parent = TYPE_CRYPTODEV_BACKEND,
-    .class_init = cryptodev_builtin_class_init,
-    .instance_size = sizeof(CryptoDevBackendBuiltin),
-};
-
-static void
-cryptodev_builtin_register_types(void)
-{
-    type_register_static(&cryptodev_builtin_info);
-}
-
-type_init(cryptodev_builtin_register_types);
@@ -1,245 +0,0 @@
-/*
- * QEMU Crypto Device Implementation
- *
- * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
- *
- * Authors:
- *    Gonglei <arei.gonglei@huawei.com>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "qemu/osdep.h"
-#include "sysemu/cryptodev.h"
-#include "hw/boards.h"
-#include "qapi/error.h"
-#include "qapi/visitor.h"
-#include "qapi-types.h"
-#include "qapi-visit.h"
-#include "qemu/config-file.h"
-#include "qom/object_interfaces.h"
-#include "hw/virtio/virtio-crypto.h"
-
-
-static QTAILQ_HEAD(, CryptoDevBackendClient) crypto_clients;
-
-
-CryptoDevBackendClient *
-cryptodev_backend_new_client(const char *model,
-                                    const char *name)
-{
-    CryptoDevBackendClient *cc;
-
-    cc = g_malloc0(sizeof(CryptoDevBackendClient));
-    cc->model = g_strdup(model);
-    if (name) {
-        cc->name = g_strdup(name);
-    }
-
-    QTAILQ_INSERT_TAIL(&crypto_clients, cc, next);
-
-    return cc;
-}
-
-void cryptodev_backend_free_client(
-                  CryptoDevBackendClient *cc)
-{
-    QTAILQ_REMOVE(&crypto_clients, cc, next);
-    g_free(cc->name);
-    g_free(cc->model);
-    g_free(cc->info_str);
-    g_free(cc);
-}
-
-void cryptodev_backend_cleanup(
-             CryptoDevBackend *backend,
-             Error **errp)
-{
-    CryptoDevBackendClass *bc =
-                  CRYPTODEV_BACKEND_GET_CLASS(backend);
-
-    if (bc->cleanup) {
-        bc->cleanup(backend, errp);
-    }
-
-    backend->ready = false;
-}
-
-int64_t cryptodev_backend_sym_create_session(
-           CryptoDevBackend *backend,
-           CryptoDevBackendSymSessionInfo *sess_info,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendClass *bc =
-                      CRYPTODEV_BACKEND_GET_CLASS(backend);
-
-    if (bc->create_session) {
-        return bc->create_session(backend, sess_info, queue_index, errp);
-    }
-
-    return -1;
-}
-
-int cryptodev_backend_sym_close_session(
-           CryptoDevBackend *backend,
-           uint64_t session_id,
-           uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendClass *bc =
-                      CRYPTODEV_BACKEND_GET_CLASS(backend);
-
-    if (bc->close_session) {
-        return bc->close_session(backend, session_id, queue_index, errp);
-    }
-
-    return -1;
-}
-
-static int cryptodev_backend_sym_operation(
-                 CryptoDevBackend *backend,
-                 CryptoDevBackendSymOpInfo *op_info,
-                 uint32_t queue_index, Error **errp)
-{
-    CryptoDevBackendClass *bc =
-                      CRYPTODEV_BACKEND_GET_CLASS(backend);
-
-    if (bc->do_sym_op) {
-        return bc->do_sym_op(backend, op_info, queue_index, errp);
-    }
-
-    return -VIRTIO_CRYPTO_ERR;
-}
-
-int cryptodev_backend_crypto_operation(
-                 CryptoDevBackend *backend,
-                 void *opaque,
-                 uint32_t queue_index, Error **errp)
-{
-    VirtIOCryptoReq *req = opaque;
-
-    if (req->flags == CRYPTODEV_BACKEND_ALG_SYM) {
-        CryptoDevBackendSymOpInfo *op_info;
-        op_info = req->u.sym_op_info;
-
-        return cryptodev_backend_sym_operation(backend,
-                         op_info, queue_index, errp);
-    } else {
-        error_setg(errp, "Unsupported cryptodev alg type: %" PRIu32 "",
-                   req->flags);
-       return -VIRTIO_CRYPTO_NOTSUPP;
-    }
-
-    return -VIRTIO_CRYPTO_ERR;
-}
-
-static void
-cryptodev_backend_get_queues(Object *obj, Visitor *v, const char *name,
-                             void *opaque, Error **errp)
-{
-    CryptoDevBackend *backend = CRYPTODEV_BACKEND(obj);
-    uint32_t value = backend->conf.peers.queues;
-
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void
-cryptodev_backend_set_queues(Object *obj, Visitor *v, const char *name,
-                             void *opaque, Error **errp)
-{
-    CryptoDevBackend *backend = CRYPTODEV_BACKEND(obj);
-    Error *local_err = NULL;
-    uint32_t value;
-
-    visit_type_uint32(v, name, &value, &local_err);
-    if (local_err) {
-        goto out;
-    }
-    if (!value) {
-        error_setg(&local_err, "Property '%s.%s' doesn't take value '%"
-                   PRIu32 "'", object_get_typename(obj), name, value);
-        goto out;
-    }
-    backend->conf.peers.queues = value;
-out:
-    error_propagate(errp, local_err);
-}
-
-static void
-cryptodev_backend_complete(UserCreatable *uc, Error **errp)
-{
-    CryptoDevBackend *backend = CRYPTODEV_BACKEND(uc);
-    CryptoDevBackendClass *bc = CRYPTODEV_BACKEND_GET_CLASS(uc);
-    Error *local_err = NULL;
-
-    if (bc->init) {
-        bc->init(backend, &local_err);
-        if (local_err) {
-            goto out;
-        }
-    }
-    backend->ready = true;
-    return;
-
-out:
-    backend->ready = false;
-    error_propagate(errp, local_err);
-}
-
-static void cryptodev_backend_instance_init(Object *obj)
-{
-    object_property_add(obj, "queues", "int",
-                          cryptodev_backend_get_queues,
-                          cryptodev_backend_set_queues,
-                          NULL, NULL, NULL);
-    /* Initialize devices' queues property to 1 */
-    object_property_set_int(obj, 1, "queues", NULL);
-}
-
-static void cryptodev_backend_finalize(Object *obj)
-{
-
-}
-
-static void
-cryptodev_backend_class_init(ObjectClass *oc, void *data)
-{
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-
-    ucc->complete = cryptodev_backend_complete;
-
-    QTAILQ_INIT(&crypto_clients);
-}
-
-static const TypeInfo cryptodev_backend_info = {
-    .name = TYPE_CRYPTODEV_BACKEND,
-    .parent = TYPE_OBJECT,
-    .instance_size = sizeof(CryptoDevBackend),
-    .instance_init = cryptodev_backend_instance_init,
-    .instance_finalize = cryptodev_backend_finalize,
-    .class_size = sizeof(CryptoDevBackendClass),
-    .class_init = cryptodev_backend_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        { TYPE_USER_CREATABLE },
-        { }
-    }
-};
-
-static void
-cryptodev_backend_register_types(void)
-{
-    type_register_static(&cryptodev_backend_info);
-}
-
-type_init(cryptodev_backend_register_types);
@@ -64,6 +64,14 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 #endif
 }

+static void
+file_backend_class_init(ObjectClass *oc, void *data)
+{
+    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
+
+    bc->alloc = file_backend_memory_alloc;
+}
+
 static char *get_mem_path(Object *o, Error **errp)
 {
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);
@@ -104,18 +112,13 @@ static void file_memory_backend_set_share(Object *o, bool value, Error **errp)
 }

 static void
-file_backend_class_init(ObjectClass *oc, void *data)
+file_backend_instance_init(Object *o)
 {
-    HostMemoryBackendClass *bc = MEMORY_BACKEND_CLASS(oc);
-
-    bc->alloc = file_backend_memory_alloc;
-
-    object_class_property_add_bool(oc, "share",
-        file_memory_backend_get_share, file_memory_backend_set_share,
-        &error_abort);
-    object_class_property_add_str(oc, "mem-path",
-        get_mem_path, set_mem_path,
-        &error_abort);
+    object_property_add_bool(o, "share",
+                        file_memory_backend_get_share,
+                        file_memory_backend_set_share, NULL);
+    object_property_add_str(o, "mem-path", get_mem_path,
+                            set_mem_path, NULL);
 }

 static void file_backend_instance_finalize(Object *o)
@@ -129,6 +132,7 @@ static const TypeInfo file_backend_info = {
    .name = TYPE_MEMORY_BACKEND_FILE,
    .parent = TYPE_MEMORY_BACKEND,
    .class_init = file_backend_class_init,
+    .instance_init = file_backend_instance_init,
    .instance_finalize = file_backend_instance_finalize,
    .instance_size = sizeof(HostMemoryBackendFile),
 };
@@ -241,6 +241,26 @@ static void host_memory_backend_init(Object *obj)
    backend->merge = machine_mem_merge(machine);
    backend->dump = machine_dump_guest_core(machine);
    backend->prealloc = mem_prealloc;
+
+    object_property_add_bool(obj, "merge",
+                        host_memory_backend_get_merge,
+                        host_memory_backend_set_merge, NULL);
+    object_property_add_bool(obj, "dump",
+                        host_memory_backend_get_dump,
+                        host_memory_backend_set_dump, NULL);
+    object_property_add_bool(obj, "prealloc",
+                        host_memory_backend_get_prealloc,
+                        host_memory_backend_set_prealloc, NULL);
+    object_property_add(obj, "size", "int",
+                        host_memory_backend_get_size,
+                        host_memory_backend_set_size, NULL, NULL, NULL);
+    object_property_add(obj, "host-nodes", "int",
+                        host_memory_backend_get_host_nodes,
+                        host_memory_backend_set_host_nodes, NULL, NULL, NULL);
+    object_property_add_enum(obj, "policy", "HostMemPolicy",
+                             HostMemPolicy_lookup,
+                             host_memory_backend_get_policy,
+                             host_memory_backend_set_policy, NULL);
 }

 MemoryRegion *
@@ -355,28 +375,6 @@ host_memory_backend_class_init(ObjectClass *oc, void *data)

    ucc->complete = host_memory_backend_memory_complete;
    ucc->can_be_deleted = host_memory_backend_can_be_deleted;
-
-    object_class_property_add_bool(oc, "merge",
-        host_memory_backend_get_merge,
-        host_memory_backend_set_merge, &error_abort);
-    object_class_property_add_bool(oc, "dump",
-        host_memory_backend_get_dump,
-        host_memory_backend_set_dump, &error_abort);
-    object_class_property_add_bool(oc, "prealloc",
-        host_memory_backend_get_prealloc,
-        host_memory_backend_set_prealloc, &error_abort);
-    object_class_property_add(oc, "size", "int",
-        host_memory_backend_get_size,
-        host_memory_backend_set_size,
-        NULL, NULL, &error_abort);
-    object_class_property_add(oc, "host-nodes", "int",
-        host_memory_backend_get_host_nodes,
-        host_memory_backend_set_host_nodes,
-        NULL, NULL, &error_abort);
-    object_class_property_add_enum(oc, "policy", "HostMemPolicy",
-        HostMemPolicy_lookup,
-        host_memory_backend_get_policy,
-        host_memory_backend_set_policy, &error_abort);
 }

 static const TypeInfo host_memory_backend_info = {
@@ -133,7 +133,7 @@ static int msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, int
    return len;
 }

-static void msmouse_chr_free(struct CharDriverState *chr)
+static void msmouse_chr_close (struct CharDriverState *chr)
 {
    MouseState *mouse = chr->opaque;

@@ -151,7 +151,6 @@ static QemuInputHandler msmouse_handler = {
 static CharDriverState *qemu_chr_open_msmouse(const char *id,
                                              ChardevBackend *backend,
                                              ChardevReturn *ret,
-                                              bool *be_opened,
                                              Error **errp)
 {
    ChardevCommon *common = backend->u.msmouse.data;
@@ -163,9 +162,9 @@ static CharDriverState *qemu_chr_open_msmouse(const char *id,
        return NULL;
    }
    chr->chr_write = msmouse_chr_write;
-    chr->chr_free = msmouse_chr_free;
+    chr->chr_close = msmouse_chr_close;
    chr->chr_accept_input = msmouse_chr_accept_input;
-    *be_opened = false;
+    chr->explicit_be_open = true;

    mouse = g_new0(MouseState, 1);
    mouse->hs = qemu_input_handler_register((DeviceState *)mouse,
@@ -15,6 +15,7 @@
 #include "sysemu/char.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
+#include "hw/qdev.h" /* just for DEFINE_PROP_CHR */

 #define TYPE_RNG_EGD "rng-egd"
 #define RNG_EGD(obj) OBJECT_CHECK(RngEgd, (obj), TYPE_RNG_EGD)
@@ -23,7 +24,7 @@ typedef struct RngEgd
 {
    RngBackend parent;

-    CharBackend chr;
+    CharDriverState *chr;
    char *chr_name;
 } RngEgd;

@@ -40,9 +41,7 @@ static void rng_egd_request_entropy(RngBackend *b, RngRequest *req)
        header[0] = 0x02;
        header[1] = len;

-        /* XXX this blocks entire thread. Rewrite to use
-         * qemu_chr_fe_write and background I/O callbacks */
-        qemu_chr_fe_write_all(&s->chr, header, sizeof(header));
+        qemu_chr_fe_write(s->chr, header, sizeof(header));

        size -= len;
    }
@@ -86,7 +85,6 @@ static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
 static void rng_egd_opened(RngBackend *b, Error **errp)
 {
    RngEgd *s = RNG_EGD(b);
-    CharDriverState *chr;

    if (s->chr_name == NULL) {
        error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
@@ -94,19 +92,21 @@ static void rng_egd_opened(RngBackend *b, Error **errp)
        return;
    }

-    chr = qemu_chr_find(s->chr_name);
-    if (chr == NULL) {
+    s->chr = qemu_chr_find(s->chr_name);
+    if (s->chr == NULL) {
        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
                  "Device '%s' not found", s->chr_name);
        return;
    }
-    if (!qemu_chr_fe_init(&s->chr, chr, errp)) {
+
+    if (qemu_chr_fe_claim(s->chr) != 0) {
+        error_setg(errp, QERR_DEVICE_IN_USE, s->chr_name);
        return;
    }

    /* FIXME we should resubmit pending requests when the CDS reconnects. */
-    qemu_chr_fe_set_handlers(&s->chr, rng_egd_chr_can_read,
-                             rng_egd_chr_read, NULL, s, NULL, true);
+    qemu_chr_add_handlers(s->chr, rng_egd_chr_can_read, rng_egd_chr_read,
+                          NULL, s);
 }

 static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
@@ -125,10 +125,9 @@ static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
 static char *rng_egd_get_chardev(Object *obj, Error **errp)
 {
    RngEgd *s = RNG_EGD(obj);
-    CharDriverState *chr = qemu_chr_fe_get_driver(&s->chr);

-    if (chr && chr->label) {
-        return g_strdup(chr->label);
+    if (s->chr && s->chr->label) {
+        return g_strdup(s->chr->label);
    }

    return NULL;
@@ -145,7 +144,11 @@ static void rng_egd_finalize(Object *obj)
 {
    RngEgd *s = RNG_EGD(obj);

-    qemu_chr_fe_deinit(&s->chr);
+    if (s->chr) {
+        qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL);
+        qemu_chr_fe_release(s->chr);
+    }
+
    g_free(s->chr_name);
 }

@@ -102,7 +102,7 @@ static int testdev_write(CharDriverState *chr, const uint8_t *buf, int len)
    return orig_len;
 }

-static void testdev_free(struct CharDriverState *chr)
+static void testdev_close(struct CharDriverState *chr)
 {
    TestdevCharState *testdev = chr->opaque;

@@ -112,7 +112,6 @@ static void testdev_free(struct CharDriverState *chr)
 static CharDriverState *chr_testdev_init(const char *id,
                                         ChardevBackend *backend,
                                         ChardevReturn *ret,
-                                         bool *be_opened,
                                         Error **errp)
 {
    TestdevCharState *testdev;
@@ -123,7 +122,7 @@ static CharDriverState *chr_testdev_init(const char *id,

    chr->opaque = testdev;
    chr->chr_write = testdev_write;
-    chr->chr_free = testdev_free;
+    chr->chr_close = testdev_close;

    return chr;
 }
@@ -25,9 +25,7 @@
 #include "trace.h"
 #include "block/block_int.h"
 #include "block/blockjob.h"
-#include "block/nbd.h"
 #include "qemu/error-report.h"
-#include "module_block.h"
 #include "qemu/module.h"
 #include "qapi/qmp/qerror.h"
 #include "qapi/qmp/qbool.h"
@@ -42,7 +40,6 @@
 #include "qapi-event.h"
 #include "qemu/cutils.h"
 #include "qemu/id.h"
-#include "qapi/util.h"

 #ifdef CONFIG_BSD
 #include <sys/ioctl.h>
@@ -244,40 +241,17 @@ BlockDriverState *bdrv_new(void)
    return bs;
 }

-static BlockDriver *bdrv_do_find_format(const char *format_name)
+BlockDriver *bdrv_find_format(const char *format_name)
 {
    BlockDriver *drv1;
-
    QLIST_FOREACH(drv1, &bdrv_drivers, list) {
        if (!strcmp(drv1->format_name, format_name)) {
            return drv1;
        }
    }
-
    return NULL;
 }

-BlockDriver *bdrv_find_format(const char *format_name)
-{
-    BlockDriver *drv1;
-    int i;
-
-    drv1 = bdrv_do_find_format(format_name);
-    if (drv1) {
-        return drv1;
-    }
-
-    /* The driver isn't registered, maybe we need to load a module */
-    for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
-        if (!strcmp(block_driver_modules[i].format_name, format_name)) {
-            block_module_load_one(block_driver_modules[i].library_name);
-            break;
-        }
-    }
-
-    return bdrv_do_find_format(format_name);
-}
-
 static int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
 {
    static const char *whitelist_rw[] = {
@@ -486,19 +460,6 @@ static BlockDriver *find_hdev_driver(const char *filename)
    return drv;
 }

-static BlockDriver *bdrv_do_find_protocol(const char *protocol)
-{
-    BlockDriver *drv1;
-
-    QLIST_FOREACH(drv1, &bdrv_drivers, list) {
-        if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
-            return drv1;
-        }
-    }
-
-    return NULL;
-}
-
 BlockDriver *bdrv_find_protocol(const char *filename,
                                bool allow_protocol_prefix,
                                Error **errp)
@@ -507,7 +468,6 @@ BlockDriver *bdrv_find_protocol(const char *filename,
    char protocol[128];
    int len;
    const char *p;
-    int i;

    /* TODO Drivers without bdrv_file_open must be specified explicitly */

@@ -534,25 +494,15 @@ BlockDriver *bdrv_find_protocol(const char *filename,
        len = sizeof(protocol) - 1;
    memcpy(protocol, filename, len);
    protocol[len] = '\0';
-
-    drv1 = bdrv_do_find_protocol(protocol);
-    if (drv1) {
-        return drv1;
-    }
-
-    for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
-        if (block_driver_modules[i].protocol_name &&
-            !strcmp(block_driver_modules[i].protocol_name, protocol)) {
-            block_module_load_one(block_driver_modules[i].library_name);
-            break;
+    QLIST_FOREACH(drv1, &bdrv_drivers, list) {
+        if (drv1->protocol_name &&
+            !strcmp(drv1->protocol_name, protocol)) {
+            return drv1;
        }
    }

-    drv1 = bdrv_do_find_protocol(protocol);
-    if (!drv1) {
-        error_setg(errp, "Unknown protocol '%s'", protocol);
-    }
-    return drv1;
+    error_setg(errp, "Unknown protocol '%s'", protocol);
+    return NULL;
 }

 /*
@@ -734,9 +684,6 @@ static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
    qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
    qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");

-    /* Copy the read-only option from the parent */
-    qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
-
    /* aio=native doesn't work for cache.direct=off, so disable it for the
     * temporary snapshot */
    *child_flags &= ~BDRV_O_NATIVE_AIO;
@@ -759,13 +706,10 @@ static void bdrv_inherited_options(int *child_flags, QDict *child_options,
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);

-    /* Inherit the read-only option from the parent if it's not set */
-    qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
-
    /* Our block drivers take care to send flushes and respect unmap policy,
     * so we can default to enable both on lower layers regardless of the
     * corresponding parent options. */
-    qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
+    flags |= BDRV_O_UNMAP;

    /* Clear flags that only apply to the top layer */
    flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ |
@@ -815,8 +759,7 @@ static void bdrv_backing_options(int *child_flags, QDict *child_options,
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);

    /* backing files always opened read-only */
-    qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
-    flags &= ~BDRV_O_COPY_ON_READ;
+    flags &= ~(BDRV_O_RDWR | BDRV_O_COPY_ON_READ);

    /* snapshot=on is handled on the top layer */
    flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_TEMPORARY);
@@ -863,14 +806,6 @@ static void update_flags_from_options(int *flags, QemuOpts *opts)
    if (qemu_opt_get_bool(opts, BDRV_OPT_CACHE_DIRECT, false)) {
        *flags |= BDRV_O_NOCACHE;
    }
-
-    *flags &= ~BDRV_O_RDWR;
-
-    assert(qemu_opt_find(opts, BDRV_OPT_READ_ONLY));
-    if (!qemu_opt_get_bool(opts, BDRV_OPT_READ_ONLY, false)) {
-        *flags |= BDRV_O_RDWR;
-    }
-
 }

 static void update_options_from_flags(QDict *options, int flags)
@@ -883,10 +818,6 @@ static void update_options_from_flags(QDict *options, int flags)
        qdict_put(options, BDRV_OPT_CACHE_NO_FLUSH,
                  qbool_from_bool(flags & BDRV_O_NO_FLUSH));
    }
-    if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
-        qdict_put(options, BDRV_OPT_READ_ONLY,
-                  qbool_from_bool(!(flags & BDRV_O_RDWR)));
-    }
 }

 static void bdrv_assign_node_name(BlockDriverState *bs,
@@ -926,7 +857,7 @@ out:
    g_free(gen_node_name);
 }

-QemuOptsList bdrv_runtime_opts = {
+static QemuOptsList bdrv_runtime_opts = {
    .name = "bdrv_common",
    .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
    .desc = {
@@ -950,21 +881,6 @@ QemuOptsList bdrv_runtime_opts = {
            .type = QEMU_OPT_BOOL,
            .help = "Ignore flush requests",
        },
-        {
-            .name = BDRV_OPT_READ_ONLY,
-            .type = QEMU_OPT_BOOL,
-            .help = "Node is opened in read-only mode",
-        },
-        {
-            .name = "detect-zeroes",
-            .type = QEMU_OPT_STRING,
-            .help = "try to optimize zero writes (off, on, unmap)",
-        },
-        {
-            .name = "discard",
-            .type = QEMU_OPT_STRING,
-            .help = "discard operation (ignore/off, unmap/on)",
-        },
        { /* end of list */ }
    },
 };
@@ -981,8 +897,6 @@ static int bdrv_open_common(BlockDriverState *bs, BdrvChild *file,
    const char *filename;
    const char *driver_name = NULL;
    const char *node_name = NULL;
-    const char *discard;
-    const char *detect_zeroes;
    QemuOpts *opts;
    BlockDriver *drv;
    Error *local_err = NULL;
@@ -998,8 +912,6 @@ static int bdrv_open_common(BlockDriverState *bs, BdrvChild *file,
        goto fail_opts;
    }

-    update_flags_from_options(&bs->open_flags, opts);
-
    driver_name = qemu_opt_get(opts, "driver");
    drv = bdrv_find_format(driver_name);
    assert(drv != NULL);
@@ -1051,41 +963,6 @@ static int bdrv_open_common(BlockDriverState *bs, BdrvChild *file,
        }
    }

-    discard = qemu_opt_get(opts, "discard");
-    if (discard != NULL) {
-        if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
-            error_setg(errp, "Invalid discard option");
-            ret = -EINVAL;
-            goto fail_opts;
-        }
-    }
-
-    detect_zeroes = qemu_opt_get(opts, "detect-zeroes");
-    if (detect_zeroes) {
-        BlockdevDetectZeroesOptions value =
-            qapi_enum_parse(BlockdevDetectZeroesOptions_lookup,
-                            detect_zeroes,
-                            BLOCKDEV_DETECT_ZEROES_OPTIONS__MAX,
-                            BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF,
-                            &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-            goto fail_opts;
-        }
-
-        if (value == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
-            !(bs->open_flags & BDRV_O_UNMAP))
-        {
-            error_setg(errp, "setting detect-zeroes to unmap is not allowed "
-                             "without setting discard operation to unmap");
-            ret = -EINVAL;
-            goto fail_opts;
-        }
-
-        bs->detect_zeroes = value;
-    }
-
    if (filename != NULL) {
        pstrcpy(bs->filename, sizeof(bs->filename), filename);
    } else {
@@ -1096,6 +973,9 @@ static int bdrv_open_common(BlockDriverState *bs, BdrvChild *file,
    bs->drv = drv;
    bs->opaque = g_malloc0(drv->instance_size);

+    /* Apply cache mode options */
+    update_flags_from_options(&bs->open_flags, opts);
+
    /* Open the image, either directly or using a protocol */
    open_flags = bdrv_open_flags(bs, bs->open_flags);
    if (drv->bdrv_file_open) {
@@ -1428,28 +1308,9 @@ void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd)
            backing_hd->drv ? backing_hd->drv->format_name : "");

    bdrv_op_block_all(backing_hd, bs->backing_blocker);
-    /* Otherwise we won't be able to commit or stream */
+    /* Otherwise we won't be able to commit due to check in bdrv_commit */
    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
                    bs->backing_blocker);
-    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
-                    bs->backing_blocker);
-    /*
-     * We do backup in 3 ways:
-     * 1. drive backup
-     *    The target bs is new opened, and the source is top BDS
-     * 2. blockdev backup
-     *    Both the source and the target are top BDSes.
-     * 3. internal backup(used for block replication)
-     *    Both the source and the target are backing file
-     *
-     * In case 1 and 2, neither the source nor the target is the backing file.
-     * In case 3, we will block the top BDS, so there is only one block job
-     * for the top BDS and its backing chain.
-     */
-    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
-                    bs->backing_blocker);
-    bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
-                    bs->backing_blocker);
 out:
    bdrv_refresh_limits(bs, NULL);
 }
@@ -1748,25 +1609,6 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
        goto fail;
    }

-    /* Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
-     * FIXME: we're parsing the QDict to avoid having to create a
-     * QemuOpts just for this, but neither option is optimal. */
-    if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
-        !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
-        flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
-    } else {
-        flags &= ~BDRV_O_RDWR;
-    }
-
-    if (flags & BDRV_O_SNAPSHOT) {
-        snapshot_options = qdict_new();
-        bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
-                                   flags, options);
-        /* Let bdrv_backing_options() override "read-only" */
-        qdict_del(options, BDRV_OPT_READ_ONLY);
-        bdrv_backing_options(&flags, options, flags, options);
-    }
-
    bs->open_flags = flags;
    bs->options = options;
    options = qdict_clone_shallow(options);
@@ -1791,6 +1633,18 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,

    /* Open image file without format layer */
    if ((flags & BDRV_O_PROTOCOL) == 0) {
+        if (flags & BDRV_O_RDWR) {
+            flags |= BDRV_O_ALLOW_RDWR;
+        }
+        if (flags & BDRV_O_SNAPSHOT) {
+            snapshot_options = qdict_new();
+            bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
+                                       flags, options);
+            bdrv_backing_options(&flags, options, flags, options);
+        }
+
+        bs->open_flags = flags;
+
        file = bdrv_open_child(filename, options, "file", bs,
                               &child_file, true, &local_err);
        if (local_err) {
@@ -1975,13 +1829,6 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
        options = qdict_new();
    }

-    /* Check if this BlockDriverState is already in the queue */
-    QSIMPLEQ_FOREACH(bs_entry, bs_queue, entry) {
-        if (bs == bs_entry->state.bs) {
-            break;
-        }
-    }
-
    /*
     * Precedence of options:
     * 1. Explicitly passed in options (highest)
@@ -2002,11 +1849,7 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
    }

    /* Old explicitly set values (don't overwrite by inherited value) */
-    if (bs_entry) {
-        old_options = qdict_clone_shallow(bs_entry->state.explicit_options);
-    } else {
-        old_options = qdict_clone_shallow(bs->explicit_options);
-    }
+    old_options = qdict_clone_shallow(bs->explicit_options);
    bdrv_join_options(bs, options, old_options);
    QDECREF(old_options);

@@ -2045,13 +1888,8 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
                                child->role, options, flags);
    }

-    if (!bs_entry) {
-        bs_entry = g_new0(BlockReopenQueueEntry, 1);
-        QSIMPLEQ_INSERT_TAIL(bs_queue, bs_entry, entry);
-    } else {
-        QDECREF(bs_entry->state.options);
-        QDECREF(bs_entry->state.explicit_options);
-    }
+    bs_entry = g_new0(BlockReopenQueueEntry, 1);
+    QSIMPLEQ_INSERT_TAIL(bs_queue, bs_entry, entry);

    bs_entry->state.bs = bs;
    bs_entry->state.options = options;
@@ -2084,7 +1922,7 @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
 * to all devices.
 *
 */
-int bdrv_reopen_multiple(AioContext *ctx, BlockReopenQueue *bs_queue, Error **errp)
+int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 {
    int ret = -1;
    BlockReopenQueueEntry *bs_entry, *next;
@@ -2092,9 +1930,7 @@ int bdrv_reopen_multiple(AioContext *ctx, BlockReopenQueue *bs_queue, Error **er

    assert(bs_queue != NULL);

-    aio_context_release(ctx);
-    bdrv_drain_all_begin();
-    aio_context_acquire(ctx);
+    bdrv_drain_all();

    QSIMPLEQ_FOREACH(bs_entry, bs_queue, entry) {
        if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, &local_err)) {
@@ -2124,9 +1960,6 @@ cleanup:
        g_free(bs_entry);
    }
    g_free(bs_queue);
-
-    bdrv_drain_all_end();
-
    return ret;
 }

@@ -2138,7 +1971,7 @@ int bdrv_reopen(BlockDriverState *bs, int bdrv_flags, Error **errp)
    Error *local_err = NULL;
    BlockReopenQueue *queue = bdrv_reopen_queue(NULL, bs, NULL, bdrv_flags);

-    ret = bdrv_reopen_multiple(bdrv_get_aio_context(bs), queue, &local_err);
+    ret = bdrv_reopen_multiple(queue, &local_err);
    if (local_err != NULL) {
        error_propagate(errp, local_err);
    }
@@ -2373,7 +2206,6 @@ static void bdrv_close(BlockDriverState *bs)
 void bdrv_close_all(void)
 {
    block_job_cancel_sync_all();
-    nbd_export_close_all();

    /* Drop references from requests still in flight, such as canceled block
     * jobs whose AIO context has not been polled yet */
@@ -2796,7 +2628,7 @@ const char *bdrv_get_format_name(BlockDriverState *bs)

 static int qsort_strcmp(const void *a, const void *b)
 {
-    return strcmp(*(char *const *)a, *(char *const *)b);
+    return strcmp(a, b);
 }

 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
@@ -2822,24 +2654,6 @@ void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
        }
    }

-    for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); i++) {
-        const char *format_name = block_driver_modules[i].format_name;
-
-        if (format_name) {
-            bool found = false;
-            int j = count;
-
-            while (formats && j && !found) {
-                found = !strcmp(formats[--j], format_name);
-            }
-
-            if (!found) {
-                formats = g_renew(const char *, formats, count + 1);
-                formats[count++] = format_name;
-            }
-        }
-    }
-
    qsort(formats, count, sizeof(formats[0]), qsort_strcmp);

    for (i = 0; i < count; i++) {
@@ -3132,6 +2946,11 @@ bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
    return false;
 }

+int bdrv_is_snapshot(BlockDriverState *bs)
+{
+    return !!(bs->open_flags & BDRV_O_SNAPSHOT);
+}
+
 /* backing_file can either be relative, or absolute, or a protocol.  If it is
 * relative, it must be relative to the chain.  So, passing in bs->filename
 * from a BDS as backing_file should not be done, as that may be relative to
@@ -3385,10 +3204,17 @@ int bdrv_media_changed(BlockDriverState *bs)
 void bdrv_eject(BlockDriverState *bs, bool eject_flag)
 {
    BlockDriver *drv = bs->drv;
+    const char *device_name;

    if (drv && drv->bdrv_eject) {
        drv->bdrv_eject(bs, eject_flag);
    }
+
+    device_name = bdrv_get_device_name(bs);
+    if (device_name[0] != '\0') {
+        qapi_event_send_device_tray_moved(device_name,
+                                          eject_flag, &error_abort);
+    }
 }

 /**
@@ -1,8 +1,8 @@
-block-obj-y += raw_bsd.o qcow.o vdi.o vmdk.o cloop.o bochs.o vpc.o vvfat.o dmg.o
+block-obj-y += raw_bsd.o qcow.o vdi.o vmdk.o cloop.o bochs.o vpc.o vvfat.o
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
 block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
-block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
+block-obj-$(CONFIG_VHDX) += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += quorum.o
 block-obj-y += parallels.o blkdebug.o blkverify.o blkreplay.o
 block-obj-y += block-backend.o snapshot.o qapi.o
@@ -22,14 +22,12 @@ block-obj-$(CONFIG_ARCHIPELAGO) += archipelago.o
 block-obj-$(CONFIG_LIBSSH2) += ssh.o
 block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
-block-obj-y += backup.o
-block-obj-$(CONFIG_REPLICATION) += replication.o

 block-obj-y += crypto.o

 common-obj-y += stream.o
+common-obj-y += backup.o

-nfs.o-libs         := $(LIBNFS_LIBS)
 iscsi.o-cflags     := $(LIBISCSI_CFLAGS)
 iscsi.o-libs       := $(LIBISCSI_LIBS)
 curl.o-cflags      := $(CURL_CFLAGS)
@@ -41,7 +39,7 @@ gluster.o-libs     := $(GLUSTERFS_LIBS)
 ssh.o-cflags       := $(LIBSSH2_CFLAGS)
 ssh.o-libs         := $(LIBSSH2_LIBS)
 archipelago.o-libs := $(ARCHIPELAGO_LIBS)
-block-obj-$(if $(CONFIG_BZIP2),m,n) += dmg-bz2.o
-dmg-bz2.o-libs     := $(BZIP2_LIBS)
+block-obj-m        += dmg.o
+dmg.o-libs         := $(BZIP2_LIBS)
 qcow.o-libs        := -lz
 linux-aio.o-libs   := -laio
@@ -87,6 +87,7 @@ typedef enum {

 typedef struct ArchipelagoAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    struct BDRVArchipelagoState *s;
    QEMUIOVector *qiov;
    ARCHIPCmd cmd;
@@ -153,10 +154,11 @@ static void archipelago_finish_aiocb(AIORequestData *reqdata)
    } else if (reqdata->aio_cb->ret == reqdata->segreq->total) {
        reqdata->aio_cb->ret = 0;
    }
-    aio_bh_schedule_oneshot(
+    reqdata->aio_cb->bh = aio_bh_new(
                        bdrv_get_aio_context(reqdata->aio_cb->common.bs),
                        qemu_archipelago_complete_aio, reqdata
                        );
+    qemu_bh_schedule(reqdata->aio_cb->bh);
 }

 static int wait_reply(struct xseg *xseg, xport srcport, struct xseg_port *port,
@@ -311,6 +313,7 @@ static void qemu_archipelago_complete_aio(void *opaque)
    AIORequestData *reqdata = (AIORequestData *) opaque;
    ArchipelagoAIOCB *aio_cb = (ArchipelagoAIOCB *) reqdata->aio_cb;

+    qemu_bh_delete(aio_cb->bh);
    aio_cb->common.cb(aio_cb->common.opaque, aio_cb->ret);
    aio_cb->status = 0;

@@ -16,8 +16,7 @@
 #include "trace.h"
 #include "block/block.h"
 #include "block/block_int.h"
-#include "block/blockjob_int.h"
-#include "block/block_backup.h"
+#include "block/blockjob.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
@@ -28,6 +27,13 @@
 #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)
 #define SLICE_TIME 100000000ULL /* ns */

+typedef struct CowRequest {
+    int64_t start;
+    int64_t end;
+    QLIST_ENTRY(CowRequest) list;
+    CoQueue wait_queue; /* coroutines blocked on this request */
+} CowRequest;
+
 typedef struct BackupBlockJob {
    BlockJob common;
    BlockBackend *target;
@@ -41,7 +47,6 @@ typedef struct BackupBlockJob {
    uint64_t sectors_read;
    unsigned long *done_bitmap;
    int64_t cluster_size;
-    bool compress;
    NotifierWithReturn before_write;
    QLIST_HEAD(, CowRequest) inflight_reqs;
 } BackupBlockJob;
@@ -149,8 +154,7 @@ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
                                       bounce_qiov.size, BDRV_REQ_MAY_UNMAP);
        } else {
            ret = blk_co_pwritev(job->target, start * job->cluster_size,
-                                 bounce_qiov.size, &bounce_qiov,
-                                 job->compress ? BDRV_REQ_WRITE_COMPRESSED : 0);
+                                 bounce_qiov.size, &bounce_qiov, 0);
        }
        if (ret < 0) {
            trace_backup_do_cow_write_fail(job, start, ret);
@@ -242,14 +246,6 @@ static void backup_abort(BlockJob *job)
    }
 }

-static void backup_clean(BlockJob *job)
-{
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
-    assert(s->target);
-    blk_unref(s->target);
-    s->target = NULL;
-}
-
 static void backup_attached_aio_context(BlockJob *job, AioContext *aio_context)
 {
    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
@@ -257,71 +253,14 @@ static void backup_attached_aio_context(BlockJob *job, AioContext *aio_context)
    blk_set_aio_context(s->target, aio_context);
 }

-void backup_do_checkpoint(BlockJob *job, Error **errp)
-{
-    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
-    int64_t len;
-
-    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
-
-    if (backup_job->sync_mode != MIRROR_SYNC_MODE_NONE) {
-        error_setg(errp, "The backup job only supports block checkpoint in"
-                   " sync=none mode");
-        return;
-    }
-
-    len = DIV_ROUND_UP(backup_job->common.len, backup_job->cluster_size);
-    bitmap_zero(backup_job->done_bitmap, len);
-}
-
-void backup_wait_for_overlapping_requests(BlockJob *job, int64_t sector_num,
-                                          int nb_sectors)
-{
-    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
-    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
-    int64_t start, end;
-
-    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
-
-    start = sector_num / sectors_per_cluster;
-    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
-    wait_for_overlapping_requests(backup_job, start, end);
-}
-
-void backup_cow_request_begin(CowRequest *req, BlockJob *job,
-                              int64_t sector_num,
-                              int nb_sectors)
-{
-    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
-    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
-    int64_t start, end;
-
-    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);
-
-    start = sector_num / sectors_per_cluster;
-    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
-    cow_request_begin(req, backup_job, start, end);
-}
-
-void backup_cow_request_end(CowRequest *req)
-{
-    cow_request_end(req);
-}
-
-static void backup_drain(BlockJob *job)
-{
-    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
-
-    /* Need to keep a reference in case blk_drain triggers execution
-     * of backup_complete...
-     */
-    if (s->target) {
-        BlockBackend *target = s->target;
-        blk_ref(target);
-        blk_drain(target);
-        blk_unref(target);
-    }
-}
+static const BlockJobDriver backup_job_driver = {
+    .instance_size          = sizeof(BackupBlockJob),
+    .job_type               = BLOCK_JOB_TYPE_BACKUP,
+    .set_speed              = backup_set_speed,
+    .commit                 = backup_commit,
+    .abort                  = backup_abort,
+    .attached_aio_context   = backup_attached_aio_context,
+};

 static BlockErrorAction backup_error_action(BackupBlockJob *job,
                                            bool read, int error)
@@ -341,8 +280,11 @@ typedef struct {

 static void backup_complete(BlockJob *job, void *opaque)
 {
+    BackupBlockJob *s = container_of(job, BackupBlockJob, common);
    BackupCompleteData *data = opaque;

+    blk_unref(s->target);
+
    block_job_completed(job, data->ret);
    g_free(data);
 }
@@ -383,14 +325,14 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
    int64_t end;
    int64_t last_cluster = -1;
    int64_t sectors_per_cluster = cluster_size_sectors(job);
-    BdrvDirtyBitmapIter *dbi;
+    HBitmapIter hbi;

    granularity = bdrv_dirty_bitmap_granularity(job->sync_bitmap);
    clusters_per_iter = MAX((granularity / job->cluster_size), 1);
-    dbi = bdrv_dirty_iter_new(job->sync_bitmap, 0);
+    bdrv_dirty_iter_init(job->sync_bitmap, &hbi);

    /* Find the next dirty sector(s) */
-    while ((sector = bdrv_dirty_iter_next(dbi)) != -1) {
+    while ((sector = hbitmap_iter_next(&hbi)) != -1) {
        cluster = sector / sectors_per_cluster;

        /* Fake progress updates for any clusters we skipped */
@@ -402,7 +344,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
        for (end = cluster + clusters_per_iter; cluster < end; cluster++) {
            do {
                if (yield_and_check(job)) {
-                    goto out;
+                    return ret;
                }
                ret = backup_do_cow(job, cluster * sectors_per_cluster,
                                    sectors_per_cluster, &error_is_read,
@@ -410,7 +352,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
                if ((ret < 0) &&
                    backup_error_action(job, error_is_read, -ret) ==
                    BLOCK_ERROR_ACTION_REPORT) {
-                    goto out;
+                    return ret;
                }
            } while (ret < 0);
        }
@@ -418,7 +360,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
        /* If the bitmap granularity is smaller than the backup granularity,
         * we need to advance the iterator pointer to the next cluster. */
        if (granularity < job->cluster_size) {
-            bdrv_set_dirty_iter(dbi, cluster * sectors_per_cluster);
+            bdrv_set_dirty_iter(&hbi, cluster * sectors_per_cluster);
        }

        last_cluster = cluster - 1;
@@ -430,8 +372,6 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
        job->common.offset += ((end - last_cluster - 1) * job->cluster_size);
    }

-out:
-    bdrv_dirty_iter_free(dbi);
    return ret;
 }

@@ -440,6 +380,7 @@ static void coroutine_fn backup_run(void *opaque)
    BackupBlockJob *job = opaque;
    BackupCompleteData *data;
    BlockDriverState *bs = blk_bs(job->common.blk);
+    BlockBackend *target = job->target;
    int64_t start, end;
    int64_t sectors_per_cluster = cluster_size_sectors(job);
    int ret = 0;
@@ -526,30 +467,18 @@ static void coroutine_fn backup_run(void *opaque)
    qemu_co_rwlock_unlock(&job->flush_rwlock);
    g_free(job->done_bitmap);

+    bdrv_op_unblock_all(blk_bs(target), job->common.blocker);
+
    data = g_malloc(sizeof(*data));
    data->ret = ret;
    block_job_defer_to_main_loop(&job->common, backup_complete, data);
 }

-static const BlockJobDriver backup_job_driver = {
-    .instance_size          = sizeof(BackupBlockJob),
-    .job_type               = BLOCK_JOB_TYPE_BACKUP,
-    .start                  = backup_run,
-    .set_speed              = backup_set_speed,
-    .commit                 = backup_commit,
-    .abort                  = backup_abort,
-    .clean                  = backup_clean,
-    .attached_aio_context   = backup_attached_aio_context,
-    .drain                  = backup_drain,
-};
-
-BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+void backup_start(const char *job_id, BlockDriverState *bs,
                  BlockDriverState *target, int64_t speed,
                  MirrorSyncMode sync_mode, BdrvDirtyBitmap *sync_bitmap,
-                  bool compress,
                  BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
-                  int creation_flags,
                  BlockCompletionFunc *cb, void *opaque,
                  BlockJobTxn *txn, Error **errp)
 {
@@ -563,52 +492,46 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,

    if (bs == target) {
        error_setg(errp, "Source and target cannot be the same");
-        return NULL;
+        return;
    }

    if (!bdrv_is_inserted(bs)) {
        error_setg(errp, "Device is not inserted: %s",
                   bdrv_get_device_name(bs));
-        return NULL;
+        return;
    }

    if (!bdrv_is_inserted(target)) {
        error_setg(errp, "Device is not inserted: %s",
                   bdrv_get_device_name(target));
-        return NULL;
-    }
-
-    if (compress && target->drv->bdrv_co_pwritev_compressed == NULL) {
-        error_setg(errp, "Compression is not supported for this drive %s",
-                   bdrv_get_device_name(target));
-        return NULL;
+        return;
    }

    if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
-        return NULL;
+        return;
    }

    if (bdrv_op_is_blocked(target, BLOCK_OP_TYPE_BACKUP_TARGET, errp)) {
-        return NULL;
+        return;
    }

    if (sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
        if (!sync_bitmap) {
            error_setg(errp, "must provide a valid bitmap name for "
                             "\"incremental\" sync mode");
-            return NULL;
+            return;
        }

        /* Create a new bitmap, and freeze/disable this one. */
        if (bdrv_dirty_bitmap_create_successor(bs, sync_bitmap, errp) < 0) {
-            return NULL;
+            return;
        }
    } else if (sync_bitmap) {
        error_setg(errp,
                   "a sync_bitmap was provided to backup_run, "
                   "but received an incompatible sync_mode (%s)",
                   MirrorSyncMode_lookup[sync_mode]);
-        return NULL;
+        return;
    }

    len = bdrv_getlength(bs);
@@ -619,7 +542,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
    }

    job = block_job_create(job_id, &backup_job_driver, bs, speed,
-                           creation_flags, cb, opaque, errp);
+                           cb, opaque, errp);
    if (!job) {
        goto error;
    }
@@ -632,7 +555,6 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
    job->sync_mode = sync_mode;
    job->sync_bitmap = sync_mode == MIRROR_SYNC_MODE_INCREMENTAL ?
                       sync_bitmap : NULL;
-    job->compress = compress;

    /* If there is no backing file on the target, we cannot rely on COW if our
     * backup cluster size is smaller than the target cluster size. Even for
@@ -652,20 +574,19 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
        job->cluster_size = MAX(BACKUP_CLUSTER_SIZE_DEFAULT, bdi.cluster_size);
    }

-    block_job_add_bdrv(&job->common, target);
+    bdrv_op_block_all(target, job->common.blocker);
    job->common.len = len;
+    job->common.co = qemu_coroutine_create(backup_run, job);
    block_job_txn_add_job(txn, &job->common);
-
-    return &job->common;
+    qemu_coroutine_enter(job->common.co);
+    return;

 error:
    if (sync_bitmap) {
        bdrv_reclaim_dirty_bitmap(bs, sync_bitmap, NULL);
    }
    if (job) {
-        backup_clean(&job->common);
+        blk_unref(job->target);
        block_job_unref(&job->common);
    }
-
-    return NULL;
 }
@@ -49,6 +49,7 @@ typedef struct BDRVBlkdebugState {

 typedef struct BlkdebugAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    int ret;
 } BlkdebugAIOCB;

@@ -409,6 +410,7 @@ out:
 static void error_callback_bh(void *opaque)
 {
    struct BlkdebugAIOCB *acb = opaque;
+    qemu_bh_delete(acb->bh);
    acb->common.cb(acb->common.opaque, acb->ret);
    qemu_aio_unref(acb);
 }
@@ -419,6 +421,7 @@ static BlockAIOCB *inject_error(BlockDriverState *bs,
    BDRVBlkdebugState *s = bs->opaque;
    int error = rule->options.inject.error;
    struct BlkdebugAIOCB *acb;
+    QEMUBH *bh;
    bool immediately = rule->options.inject.immediately;

    if (rule->options.inject.once) {
@@ -433,7 +436,9 @@ static BlockAIOCB *inject_error(BlockDriverState *bs,
    acb = qemu_aio_get(&blkdebug_aiocb_info, bs, cb, opaque);
    acb->ret = -error;

-    aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), error_callback_bh, acb);
+    bh = aio_bh_new(bdrv_get_aio_context(bs), error_callback_bh, acb);
+    acb->bh = bh;
+    qemu_bh_schedule(bh);

    return &acb->common;
 }
@@ -20,6 +20,11 @@ typedef struct Request {
    QEMUBH *bh;
 } Request;

+/* Next request id.
+   This counter is global, because requests from different
+   block devices should not get overlapping ids. */
+static uint64_t request_id;
+
 static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
@@ -79,7 +84,7 @@ static void block_request_create(uint64_t reqid, BlockDriverState *bs,
 static int coroutine_fn blkreplay_co_preadv(BlockDriverState *bs,
    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    uint64_t reqid = blkreplay_next_id();
+    uint64_t reqid = request_id++;
    int ret = bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
@@ -90,7 +95,7 @@ static int coroutine_fn blkreplay_co_preadv(BlockDriverState *bs,
 static int coroutine_fn blkreplay_co_pwritev(BlockDriverState *bs,
    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    uint64_t reqid = blkreplay_next_id();
+    uint64_t reqid = request_id++;
    int ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
@@ -101,7 +106,7 @@ static int coroutine_fn blkreplay_co_pwritev(BlockDriverState *bs,
 static int coroutine_fn blkreplay_co_pwrite_zeroes(BlockDriverState *bs,
    int64_t offset, int count, BdrvRequestFlags flags)
 {
-    uint64_t reqid = blkreplay_next_id();
+    uint64_t reqid = request_id++;
    int ret = bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
@@ -112,7 +117,7 @@ static int coroutine_fn blkreplay_co_pwrite_zeroes(BlockDriverState *bs,
 static int coroutine_fn blkreplay_co_pdiscard(BlockDriverState *bs,
                                              int64_t offset, int count)
 {
-    uint64_t reqid = blkreplay_next_id();
+    uint64_t reqid = request_id++;
    int ret = bdrv_co_pdiscard(bs->file->bs, offset, count);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
@@ -122,7 +127,7 @@ static int coroutine_fn blkreplay_co_pdiscard(BlockDriverState *bs,

 static int coroutine_fn blkreplay_co_flush(BlockDriverState *bs)
 {
-    uint64_t reqid = blkreplay_next_id();
+    uint64_t reqid = request_id++;
    int ret = bdrv_co_flush(bs->file->bs);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();
@@ -22,6 +22,7 @@ typedef struct {
 typedef struct BlkverifyAIOCB BlkverifyAIOCB;
 struct BlkverifyAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;

    /* Request metadata */
    bool is_write;
@@ -174,6 +175,7 @@ static BlkverifyAIOCB *blkverify_aio_get(BlockDriverState *bs, bool is_write,
 {
    BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aiocb_info, bs, cb, opaque);

+    acb->bh = NULL;
    acb->is_write = is_write;
    acb->sector_num = sector_num;
    acb->nb_sectors = nb_sectors;
@@ -189,6 +191,7 @@ static void blkverify_aio_bh(void *opaque)
 {
    BlkverifyAIOCB *acb = opaque;

+    qemu_bh_delete(acb->bh);
    if (acb->buf) {
        qemu_iovec_destroy(&acb->raw_qiov);
        qemu_vfree(acb->buf);
@@ -215,8 +218,9 @@ static void blkverify_aio_cb(void *opaque, int ret)
            acb->verify(acb);
        }

-        aio_bh_schedule_oneshot(bdrv_get_aio_context(acb->common.bs),
-                                blkverify_aio_bh, acb);
+        acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
+                             blkverify_aio_bh, acb);
+        qemu_bh_schedule(acb->bh);
        break;
    }
 }
@@ -38,7 +38,6 @@ struct BlockBackend {
    BlockBackendPublic public;

    void *dev;                  /* attached device model, if any */
-    bool legacy_dev;            /* true if dev is not a DeviceState */
    /* TODO change to DeviceState when all users are qdevified */
    const BlockDevOps *dev_ops;
    void *dev_opaque;
@@ -66,6 +65,7 @@ struct BlockBackend {

 typedef struct BlockBackendAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    BlockBackend *blk;
    int ret;
 } BlockBackendAIOCB;
@@ -409,22 +409,6 @@ bool bdrv_has_blk(BlockDriverState *bs)
    return bdrv_first_blk(bs) != NULL;
 }

-/*
- * Returns true if @bs has only BlockBackends as parents.
- */
-bool bdrv_is_root_node(BlockDriverState *bs)
-{
-    BdrvChild *c;
-
-    QLIST_FOREACH(c, &bs->parents, next_parent) {
-        if (c->role != &child_root) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
 /*
 * Return @blk's DriveInfo if any, else null.
 */
@@ -507,38 +491,32 @@ void blk_insert_bs(BlockBackend *blk, BlockDriverState *bs)
    }
 }

-static int blk_do_attach_dev(BlockBackend *blk, void *dev)
+/*
+ * Attach device model @dev to @blk.
+ * Return 0 on success, -EBUSY when a device model is attached already.
+ */
+int blk_attach_dev(BlockBackend *blk, void *dev)
+/* TODO change to DeviceState *dev when all users are qdevified */
 {
    if (blk->dev) {
        return -EBUSY;
    }
    blk_ref(blk);
    blk->dev = dev;
-    blk->legacy_dev = false;
    blk_iostatus_reset(blk);
    return 0;
 }

-/*
- * Attach device model @dev to @blk.
- * Return 0 on success, -EBUSY when a device model is attached already.
- */
-int blk_attach_dev(BlockBackend *blk, DeviceState *dev)
-{
-    return blk_do_attach_dev(blk, dev);
-}
-
 /*
 * Attach device model @dev to @blk.
 * @blk must not have a device model attached already.
 * TODO qdevified devices don't use this, remove when devices are qdevified
 */
-void blk_attach_dev_legacy(BlockBackend *blk, void *dev)
+void blk_attach_dev_nofail(BlockBackend *blk, void *dev)
 {
-    if (blk_do_attach_dev(blk, dev) < 0) {
+    if (blk_attach_dev(blk, dev) < 0) {
        abort();
    }
-    blk->legacy_dev = true;
 }

 /*
@@ -565,42 +543,6 @@ void *blk_get_attached_dev(BlockBackend *blk)
    return blk->dev;
 }

-/* Return the qdev ID, or if no ID is assigned the QOM path, of the block
- * device attached to the BlockBackend. */
-static char *blk_get_attached_dev_id(BlockBackend *blk)
-{
-    DeviceState *dev;
-
-    assert(!blk->legacy_dev);
-    dev = blk->dev;
-
-    if (!dev) {
-        return g_strdup("");
-    } else if (dev->id) {
-        return g_strdup(dev->id);
-    }
-    return object_get_canonical_path(OBJECT(dev));
-}
-
-/*
- * Return the BlockBackend which has the device model @dev attached if it
- * exists, else null.
- *
- * @dev must not be null.
- */
-BlockBackend *blk_by_dev(void *dev)
-{
-    BlockBackend *blk = NULL;
-
-    assert(dev != NULL);
-    while ((blk = blk_all_next(blk)) != NULL) {
-        if (blk->dev == dev) {
-            return blk;
-        }
-    }
-    return NULL;
-}
-
 /*
 * Set @blk's device model callbacks to @ops.
 * @opaque is the opaque argument to pass to the callbacks.
@@ -609,11 +551,6 @@ BlockBackend *blk_by_dev(void *dev)
 void blk_set_dev_ops(BlockBackend *blk, const BlockDevOps *ops,
                     void *opaque)
 {
-    /* All drivers that use blk_set_dev_ops() are qdevified and we want to keep
-     * it that way, so we can assume blk->dev is a DeviceState if blk->dev_ops
-     * is set. */
-    assert(!blk->legacy_dev);
-
    blk->dev_ops = ops;
    blk->dev_opaque = opaque;
 }
@@ -629,17 +566,13 @@ void blk_dev_change_media_cb(BlockBackend *blk, bool load)
    if (blk->dev_ops && blk->dev_ops->change_media_cb) {
        bool tray_was_open, tray_is_open;

-        assert(!blk->legacy_dev);
-
        tray_was_open = blk_dev_is_tray_open(blk);
        blk->dev_ops->change_media_cb(blk->dev_opaque, load);
        tray_is_open = blk_dev_is_tray_open(blk);

        if (tray_was_open != tray_is_open) {
-            char *id = blk_get_attached_dev_id(blk);
-            qapi_event_send_device_tray_moved(blk_name(blk), id, tray_is_open,
+            qapi_event_send_device_tray_moved(blk_name(blk), tray_is_open,
                                              &error_abort);
-            g_free(id);
        }
    }
 }
@@ -794,30 +727,40 @@ static int blk_check_byte_request(BlockBackend *blk, int64_t offset,
    return 0;
 }

+static int blk_check_request(BlockBackend *blk, int64_t sector_num,
+                             int nb_sectors)
+{
+    if (sector_num < 0 || sector_num > INT64_MAX / BDRV_SECTOR_SIZE) {
+        return -EIO;
+    }
+
+    if (nb_sectors < 0 || nb_sectors > INT_MAX / BDRV_SECTOR_SIZE) {
+        return -EIO;
+    }
+
+    return blk_check_byte_request(blk, sector_num * BDRV_SECTOR_SIZE,
+                                  nb_sectors * BDRV_SECTOR_SIZE);
+}
+
 int coroutine_fn blk_co_preadv(BlockBackend *blk, int64_t offset,
                               unsigned int bytes, QEMUIOVector *qiov,
                               BdrvRequestFlags flags)
 {
    int ret;
-    BlockDriverState *bs = blk_bs(blk);

-    trace_blk_co_preadv(blk, bs, offset, bytes, flags);
+    trace_blk_co_preadv(blk, blk_bs(blk), offset, bytes, flags);

    ret = blk_check_byte_request(blk, offset, bytes);
    if (ret < 0) {
        return ret;
    }

-    bdrv_inc_in_flight(bs);
-
    /* throttling disk I/O */
    if (blk->public.throttle_state) {
        throttle_group_co_io_limits_intercept(blk, bytes, false);
    }

-    ret = bdrv_co_preadv(blk->root, offset, bytes, qiov, flags);
-    bdrv_dec_in_flight(bs);
-    return ret;
+    return bdrv_co_preadv(blk->root, offset, bytes, qiov, flags);
 }

 int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
@@ -825,17 +768,14 @@ int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
                                BdrvRequestFlags flags)
 {
    int ret;
-    BlockDriverState *bs = blk_bs(blk);

-    trace_blk_co_pwritev(blk, bs, offset, bytes, flags);
+    trace_blk_co_pwritev(blk, blk_bs(blk), offset, bytes, flags);

    ret = blk_check_byte_request(blk, offset, bytes);
    if (ret < 0) {
        return ret;
    }

-    bdrv_inc_in_flight(bs);
-
    /* throttling disk I/O */
    if (blk->public.throttle_state) {
        throttle_group_co_io_limits_intercept(blk, bytes, true);
@@ -845,9 +785,7 @@ int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
        flags |= BDRV_REQ_FUA;
    }

-    ret = bdrv_co_pwritev(blk->root, offset, bytes, qiov, flags);
-    bdrv_dec_in_flight(bs);
-    return ret;
+    return bdrv_co_pwritev(blk->root, offset, bytes, qiov, flags);
 }

 typedef struct BlkRwCo {
@@ -878,6 +816,7 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
                   int64_t bytes, CoroutineEntry co_entry,
                   BdrvRequestFlags flags)
 {
+    AioContext *aio_context;
    QEMUIOVector qiov;
    struct iovec iov;
    Coroutine *co;
@@ -899,7 +838,11 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,

    co = qemu_coroutine_create(co_entry, &rwco);
    qemu_coroutine_enter(co);
-    BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
+
+    aio_context = blk_get_aio_context(blk);
+    while (rwco.ret == NOT_DONE) {
+        aio_poll(aio_context, true);
+    }

    return rwco.ret;
 }
@@ -935,8 +878,7 @@ int blk_make_zero(BlockBackend *blk, BdrvRequestFlags flags)
 static void error_callback_bh(void *opaque)
 {
    struct BlockBackendAIOCB *acb = opaque;
-
-    bdrv_dec_in_flight(acb->common.bs);
+    qemu_bh_delete(acb->bh);
    acb->common.cb(acb->common.opaque, acb->ret);
    qemu_aio_unref(acb);
 }
@@ -946,13 +888,16 @@ BlockAIOCB *blk_abort_aio_request(BlockBackend *blk,
                                  void *opaque, int ret)
 {
    struct BlockBackendAIOCB *acb;
+    QEMUBH *bh;

-    bdrv_inc_in_flight(blk_bs(blk));
    acb = blk_aio_get(&block_backend_aiocb_info, blk, cb, opaque);
    acb->blk = blk;
    acb->ret = ret;

-    aio_bh_schedule_oneshot(blk_get_aio_context(blk), error_callback_bh, acb);
+    bh = aio_bh_new(blk_get_aio_context(blk), error_callback_bh, acb);
+    acb->bh = bh;
+    qemu_bh_schedule(bh);
+
    return &acb->common;
 }

@@ -961,6 +906,7 @@ typedef struct BlkAioEmAIOCB {
    BlkRwCo rwco;
    int bytes;
    bool has_returned;
+    QEMUBH* bh;
 } BlkAioEmAIOCB;

 static const AIOCBInfo blk_aio_em_aiocb_info = {
@@ -969,8 +915,11 @@ static const AIOCBInfo blk_aio_em_aiocb_info = {

 static void blk_aio_complete(BlkAioEmAIOCB *acb)
 {
+    if (acb->bh) {
+        assert(acb->has_returned);
+        qemu_bh_delete(acb->bh);
+    }
    if (acb->has_returned) {
-        bdrv_dec_in_flight(acb->common.bs);
        acb->common.cb(acb->common.opaque, acb->rwco.ret);
        qemu_aio_unref(acb);
    }
@@ -978,10 +927,7 @@ static void blk_aio_complete(BlkAioEmAIOCB *acb)

 static void blk_aio_complete_bh(void *opaque)
 {
-    BlkAioEmAIOCB *acb = opaque;
-
-    assert(acb->has_returned);
-    blk_aio_complete(acb);
+    blk_aio_complete(opaque);
 }

 static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
@@ -992,7 +938,6 @@ static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
    BlkAioEmAIOCB *acb;
    Coroutine *co;

-    bdrv_inc_in_flight(blk_bs(blk));
    acb = blk_aio_get(&blk_aio_em_aiocb_info, blk, cb, opaque);
    acb->rwco = (BlkRwCo) {
        .blk    = blk,
@@ -1002,6 +947,7 @@ static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,
        .ret    = NOT_DONE,
    };
    acb->bytes = bytes;
+    acb->bh = NULL;
    acb->has_returned = false;

    co = qemu_coroutine_create(co_entry, acb);
@@ -1009,8 +955,8 @@ static BlockAIOCB *blk_aio_prwv(BlockBackend *blk, int64_t offset, int bytes,

    acb->has_returned = true;
    if (acb->rwco.ret != NOT_DONE) {
-        aio_bh_schedule_oneshot(blk_get_aio_context(blk),
-                                blk_aio_complete_bh, acb);
+        acb->bh = aio_bh_new(blk_get_aio_context(blk), blk_aio_complete_bh, acb);
+        qemu_bh_schedule(acb->bh);
    }

    return &acb->common;
@@ -1109,36 +1055,26 @@ BlockAIOCB *blk_aio_pwritev(BlockBackend *blk, int64_t offset,
                        blk_aio_write_entry, flags, cb, opaque);
 }

-static void blk_aio_flush_entry(void *opaque)
-{
-    BlkAioEmAIOCB *acb = opaque;
-    BlkRwCo *rwco = &acb->rwco;
-
-    rwco->ret = blk_co_flush(rwco->blk);
-    blk_aio_complete(acb);
-}
-
 BlockAIOCB *blk_aio_flush(BlockBackend *blk,
                          BlockCompletionFunc *cb, void *opaque)
 {
-    return blk_aio_prwv(blk, 0, 0, NULL, blk_aio_flush_entry, 0, cb, opaque);
-}
+    if (!blk_is_available(blk)) {
+        return blk_abort_aio_request(blk, cb, opaque, -ENOMEDIUM);
+    }

-static void blk_aio_pdiscard_entry(void *opaque)
-{
-    BlkAioEmAIOCB *acb = opaque;
-    BlkRwCo *rwco = &acb->rwco;
-
-    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, acb->bytes);
-    blk_aio_complete(acb);
+    return bdrv_aio_flush(blk_bs(blk), cb, opaque);
 }

 BlockAIOCB *blk_aio_pdiscard(BlockBackend *blk,
                             int64_t offset, int count,
                             BlockCompletionFunc *cb, void *opaque)
 {
-    return blk_aio_prwv(blk, offset, count, NULL, blk_aio_pdiscard_entry, 0,
-                        cb, opaque);
+    int ret = blk_check_byte_request(blk, offset, count);
+    if (ret < 0) {
+        return blk_abort_aio_request(blk, cb, opaque, ret);
+    }
+
+    return bdrv_aio_pdiscard(blk_bs(blk), offset, count, cb, opaque);
 }

 void blk_aio_cancel(BlockAIOCB *acb)
@@ -1151,50 +1087,23 @@ void blk_aio_cancel_async(BlockAIOCB *acb)
    bdrv_aio_cancel_async(acb);
 }

-int blk_co_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
+int blk_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
 {
    if (!blk_is_available(blk)) {
        return -ENOMEDIUM;
    }

-    return bdrv_co_ioctl(blk_bs(blk), req, buf);
-}
-
-static void blk_ioctl_entry(void *opaque)
-{
-    BlkRwCo *rwco = opaque;
-    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,
-                             rwco->qiov->iov[0].iov_base);
-}
-
-int blk_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
-{
-    return blk_prw(blk, req, buf, 0, blk_ioctl_entry, 0);
-}
-
-static void blk_aio_ioctl_entry(void *opaque)
-{
-    BlkAioEmAIOCB *acb = opaque;
-    BlkRwCo *rwco = &acb->rwco;
-
-    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,
-                             rwco->qiov->iov[0].iov_base);
-    blk_aio_complete(acb);
+    return bdrv_ioctl(blk_bs(blk), req, buf);
 }

 BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
                          BlockCompletionFunc *cb, void *opaque)
 {
-    QEMUIOVector qiov;
-    struct iovec iov;
+    if (!blk_is_available(blk)) {
+        return blk_abort_aio_request(blk, cb, opaque, -ENOMEDIUM);
+    }

-    iov = (struct iovec) {
-        .iov_base = buf,
-        .iov_len = 0,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
-
-    return blk_aio_prwv(blk, req, 0, &qiov, blk_aio_ioctl_entry, 0, cb, opaque);
+    return bdrv_aio_ioctl(blk_bs(blk), req, buf, cb, opaque);
 }

 int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int count)
@@ -1216,15 +1125,13 @@ int blk_co_flush(BlockBackend *blk)
    return bdrv_co_flush(blk_bs(blk));
 }

-static void blk_flush_entry(void *opaque)
-{
-    BlkRwCo *rwco = opaque;
-    rwco->ret = blk_co_flush(rwco->blk);
-}
-
 int blk_flush(BlockBackend *blk)
 {
-    return blk_prw(blk, 0, NULL, 0, blk_flush_entry, 0);
+    if (!blk_is_available(blk)) {
+        return -ENOMEDIUM;
+    }
+
+    return bdrv_flush(blk_bs(blk));
 }

 void blk_drain(BlockBackend *blk)
@@ -1279,9 +1186,8 @@ static void send_qmp_error_event(BlockBackend *blk,
    IoOperationType optype;

    optype = is_read ? IO_OPERATION_TYPE_READ : IO_OPERATION_TYPE_WRITE;
-    qapi_event_send_block_io_error(blk_name(blk),
-                                   bdrv_get_node_name(blk_bs(blk)), optype,
-                                   action, blk_iostatus_is_enabled(blk),
+    qapi_event_send_block_io_error(blk_name(blk), optype, action,
+                                   blk_iostatus_is_enabled(blk),
                                   error == ENOSPC, strerror(error),
                                   &error_abort);
 }
@@ -1386,10 +1292,6 @@ void blk_lock_medium(BlockBackend *blk, bool locked)
 void blk_eject(BlockBackend *blk, bool eject_flag)
 {
    BlockDriverState *bs = blk_bs(blk);
-    char *id;
-
-    /* blk_eject is only called by qdevified devices */
-    assert(!blk->legacy_dev);

    if (bs) {
        bdrv_eject(bs, eject_flag);
@@ -1397,10 +1299,8 @@ void blk_eject(BlockBackend *blk, bool eject_flag)

    /* Whether or not we ejected on the backend,
     * the frontend experienced a tray event. */
-    id = blk_get_attached_dev_id(blk);
-    qapi_event_send_device_tray_moved(blk_name(blk), id,
+    qapi_event_send_device_tray_moved(blk_name(blk),
                                      eject_flag, &error_abort);
-    g_free(id);
 }

 int blk_get_flags(BlockBackend *blk)
@@ -1589,11 +1489,15 @@ int coroutine_fn blk_co_pwrite_zeroes(BlockBackend *blk, int64_t offset,
                          flags | BDRV_REQ_ZERO_WRITE);
 }

-int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
-                          int count)
+int blk_write_compressed(BlockBackend *blk, int64_t sector_num,
+                         const uint8_t *buf, int nb_sectors)
 {
-    return blk_prw(blk, offset, (void *) buf, count, blk_write_entry,
-                   BDRV_REQ_WRITE_COMPRESSED);
+    int ret = blk_check_request(blk, sector_num, nb_sectors);
+    if (ret < 0) {
+        return ret;
+    }
+
+    return bdrv_write_compressed(blk_bs(blk), sector_num, buf, nb_sectors);
 }

 int blk_truncate(BlockBackend *blk, int64_t offset)
@@ -1605,15 +1509,14 @@ int blk_truncate(BlockBackend *blk, int64_t offset)
    return bdrv_truncate(blk_bs(blk), offset);
 }

-static void blk_pdiscard_entry(void *opaque)
-{
-    BlkRwCo *rwco = opaque;
-    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, rwco->qiov->size);
-}
-
 int blk_pdiscard(BlockBackend *blk, int64_t offset, int count)
 {
-    return blk_prw(blk, offset, NULL, count, blk_pdiscard_entry, 0);
+    int ret = blk_check_byte_request(blk, offset, count);
+    if (ret < 0) {
+        return ret;
+    }
+
+    return bdrv_pdiscard(blk_bs(blk), offset, count);
 }

 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
@@ -1678,12 +1581,13 @@ void blk_update_root_state(BlockBackend *blk)
 }

 /*
- * Returns the detect-zeroes setting to be used for bdrv_open() of a
- * BlockDriverState which is supposed to inherit the root state.
+ * Applies the information in the root state to the given BlockDriverState. This
+ * does not include the flags which have to be specified for bdrv_open(), use
+ * blk_get_open_flags_from_root_state() to inquire them.
 */
-bool blk_get_detect_zeroes_from_root_state(BlockBackend *blk)
+void blk_apply_root_state(BlockBackend *blk, BlockDriverState *bs)
 {
-    return blk->root_state.detect_zeroes;
+    bs->detect_zeroes = blk->root_state.detect_zeroes;
 }

 /*
@@ -15,7 +15,7 @@
 #include "qemu/osdep.h"
 #include "trace.h"
 #include "block/block_int.h"
-#include "block/blockjob_int.h"
+#include "block/blockjob.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
@@ -83,7 +83,7 @@ static void commit_complete(BlockJob *job, void *opaque)
    BlockDriverState *active = s->active;
    BlockDriverState *top = blk_bs(s->top);
    BlockDriverState *base = blk_bs(s->base);
-    BlockDriverState *overlay_bs = bdrv_find_overlay(active, top);
+    BlockDriverState *overlay_bs;
    int ret = data->ret;

    if (!block_job_is_cancelled(&s->common) && ret == 0) {
@@ -97,6 +97,7 @@ static void commit_complete(BlockJob *job, void *opaque)
    if (s->base_flags != bdrv_get_flags(base)) {
        bdrv_reopen(base, s->base_flags, NULL);
    }
+    overlay_bs = bdrv_find_overlay(active, top);
    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
    }
@@ -205,19 +206,17 @@ static const BlockJobDriver commit_job_driver = {
    .instance_size = sizeof(CommitBlockJob),
    .job_type      = BLOCK_JOB_TYPE_COMMIT,
    .set_speed     = commit_set_speed,
-    .start         = commit_run,
 };

 void commit_start(const char *job_id, BlockDriverState *bs,
                  BlockDriverState *base, BlockDriverState *top, int64_t speed,
-                  BlockdevOnError on_error, const char *backing_file_str,
-                  Error **errp)
+                  BlockdevOnError on_error, BlockCompletionFunc *cb,
+                  void *opaque, const char *backing_file_str, Error **errp)
 {
    CommitBlockJob *s;
    BlockReopenQueue *reopen_queue = NULL;
    int orig_overlay_flags;
    int orig_base_flags;
-    BlockDriverState *iter;
    BlockDriverState *overlay_bs;
    Error *local_err = NULL;

@@ -235,7 +234,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    }

    s = block_job_create(job_id, &commit_job_driver, bs, speed,
-                         BLOCK_JOB_DEFAULT, NULL, NULL, errp);
+                         cb, opaque, errp);
    if (!s) {
        return;
    }
@@ -244,16 +243,16 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    orig_overlay_flags = bdrv_get_flags(overlay_bs);

    /* convert base & overlay_bs to r/w, if necessary */
-    if (!(orig_base_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, base, NULL,
-                                         orig_base_flags | BDRV_O_RDWR);
-    }
    if (!(orig_overlay_flags & BDRV_O_RDWR)) {
        reopen_queue = bdrv_reopen_queue(reopen_queue, overlay_bs, NULL,
                                         orig_overlay_flags | BDRV_O_RDWR);
    }
+    if (!(orig_base_flags & BDRV_O_RDWR)) {
+        reopen_queue = bdrv_reopen_queue(reopen_queue, base, NULL,
+                                         orig_base_flags | BDRV_O_RDWR);
+    }
    if (reopen_queue) {
-        bdrv_reopen_multiple(bdrv_get_aio_context(bs), reopen_queue, &local_err);
+        bdrv_reopen_multiple(reopen_queue, &local_err);
        if (local_err != NULL) {
            error_propagate(errp, local_err);
            block_job_unref(&s->common);
@@ -262,19 +261,6 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    }


-    /* Block all nodes between top and base, because they will
-     * disappear from the chain after this operation. */
-    assert(bdrv_chain_contains(top, base));
-    for (iter = top; iter != backing_bs(base); iter = backing_bs(iter)) {
-        block_job_add_bdrv(&s->common, iter);
-    }
-    /* overlay_bs must be blocked because it needs to be modified to
-     * update the backing image string, but if it's the root node then
-     * don't block it again */
-    if (bs != overlay_bs) {
-        block_job_add_bdrv(&s->common, overlay_bs);
-    }
-
    s->base = blk_new();
    blk_insert_bs(s->base, base);

@@ -289,9 +275,10 @@ void commit_start(const char *job_id, BlockDriverState *bs,
    s->backing_file_str = g_strdup(backing_file_str);

    s->on_error = on_error;
+    s->common.co = qemu_coroutine_create(commit_run, s);

-    trace_commit_start(bs, base, top, s);
-    block_job_start(&s->common);
+    trace_commit_start(bs, base, top, s, s->common.co, opaque);
+    qemu_coroutine_enter(s->common.co);
 }


@@ -33,7 +33,6 @@
 #define BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG "ivgen-alg"
 #define BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG "ivgen-hash-alg"
 #define BLOCK_CRYPTO_OPT_LUKS_HASH_ALG "hash-alg"
-#define BLOCK_CRYPTO_OPT_LUKS_ITER_TIME "iter-time"

 typedef struct BlockCrypto BlockCrypto;

@@ -184,11 +183,6 @@ static QemuOptsList block_crypto_create_opts_luks = {
            .type = QEMU_OPT_STRING,
            .help = "Name of encryption hash algorithm",
        },
-        {
-            .name = BLOCK_CRYPTO_OPT_LUKS_ITER_TIME,
-            .type = QEMU_OPT_NUMBER,
-            .help = "Time to spend in PBKDF in milliseconds",
-        },
        { /* end of list */ }
    },
 };
@@ -68,7 +68,8 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 #endif

 #define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
-                   CURLPROTO_FTP | CURLPROTO_FTPS)
+                   CURLPROTO_FTP | CURLPROTO_FTPS | \
+                   CURLPROTO_TFTP)

 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
@@ -94,6 +95,7 @@ struct BDRVCURLState;

 typedef struct CURLAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    QEMUIOVector *qiov;

    int64_t sector_num;
@@ -724,28 +726,11 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s);
    if (curl_easy_perform(state->curl))
        goto out;
-    if (curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d)) {
+    curl_easy_getinfo(state->curl, CURLINFO_CONTENT_LENGTH_DOWNLOAD, &d);
+    if (d)
+        s->len = (size_t)d;
+    else if(!s->len)
        goto out;
-    }
-    /* Prior CURL 7.19.4 return value of 0 could mean that the file size is not
-     * know or the size is zero. From 7.19.4 CURL returns -1 if size is not
-     * known and zero if it is realy zero-length file. */
-#if LIBCURL_VERSION_NUM >= 0x071304
-    if (d < 0) {
-        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
-                "Server didn't report file size.");
-        goto out;
-    }
-#else
-    if (d <= 0) {
-        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
-                "Unknown file size or zero-length file.");
-        goto out;
-    }
-#endif
-
-    s->len = (size_t)d;
-
    if ((!strncasecmp(s->url, "http://", strlen("http://"))
        || !strncasecmp(s->url, "https://", strlen("https://")))
        && !s->accept_range) {
@@ -788,6 +773,9 @@ static void curl_readv_bh_cb(void *p)
    CURLAIOCB *acb = p;
    BDRVCURLState *s = acb->common.bs->opaque;

+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
+
    size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
    size_t end;

@@ -851,7 +839,8 @@ static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
    acb->sector_num = sector_num;
    acb->nb_sectors = nb_sectors;

-    aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), curl_readv_bh_cb, acb);
+    acb->bh = aio_bh_new(bdrv_get_aio_context(bs), curl_readv_bh_cb, acb);
+    qemu_bh_schedule(acb->bh);
    return &acb->common;
 }

@@ -936,12 +925,29 @@ static BlockDriver bdrv_ftps = {
    .bdrv_attach_aio_context    = curl_attach_aio_context,
 };

+static BlockDriver bdrv_tftp = {
+    .format_name                = "tftp",
+    .protocol_name              = "tftp",
+
+    .instance_size              = sizeof(BDRVCURLState),
+    .bdrv_parse_filename        = curl_parse_filename,
+    .bdrv_file_open             = curl_open,
+    .bdrv_close                 = curl_close,
+    .bdrv_getlength             = curl_getlength,
+
+    .bdrv_aio_readv             = curl_aio_readv,
+
+    .bdrv_detach_aio_context    = curl_detach_aio_context,
+    .bdrv_attach_aio_context    = curl_attach_aio_context,
+};
+
 static void curl_block_init(void)
 {
    bdrv_register(&bdrv_http);
    bdrv_register(&bdrv_https);
    bdrv_register(&bdrv_ftp);
    bdrv_register(&bdrv_ftps);
+    bdrv_register(&bdrv_tftp);
 }

 block_init(curl_block_init);
@@ -38,20 +38,13 @@
 */
 struct BdrvDirtyBitmap {
    HBitmap *bitmap;            /* Dirty sector bitmap implementation */
-    HBitmap *meta;              /* Meta dirty bitmap */
    BdrvDirtyBitmap *successor; /* Anonymous child; implies frozen status */
    char *name;                 /* Optional non-empty unique ID */
    int64_t size;               /* Size of the bitmap (Number of sectors) */
    bool disabled;              /* Bitmap is read-only */
-    int active_iterators;       /* How many iterators are active */
    QLIST_ENTRY(BdrvDirtyBitmap) list;
 };

-struct BdrvDirtyBitmapIter {
-    HBitmapIter hbi;
-    BdrvDirtyBitmap *bitmap;
-};
-
 BdrvDirtyBitmap *bdrv_find_dirty_bitmap(BlockDriverState *bs, const char *name)
 {
    BdrvDirtyBitmap *bm;
@@ -104,66 +97,6 @@ BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
    return bitmap;
 }

-/* bdrv_create_meta_dirty_bitmap
- *
- * Create a meta dirty bitmap that tracks the changes of bits in @bitmap. I.e.
- * when a dirty status bit in @bitmap is changed (either from reset to set or
- * the other way around), its respective meta dirty bitmap bit will be marked
- * dirty as well.
- *
- * @bitmap: the block dirty bitmap for which to create a meta dirty bitmap.
- * @chunk_size: how many bytes of bitmap data does each bit in the meta bitmap
- * track.
- */
-void bdrv_create_meta_dirty_bitmap(BdrvDirtyBitmap *bitmap,
-                                   int chunk_size)
-{
-    assert(!bitmap->meta);
-    bitmap->meta = hbitmap_create_meta(bitmap->bitmap,
-                                       chunk_size * BITS_PER_BYTE);
-}
-
-void bdrv_release_meta_dirty_bitmap(BdrvDirtyBitmap *bitmap)
-{
-    assert(bitmap->meta);
-    hbitmap_free_meta(bitmap->bitmap);
-    bitmap->meta = NULL;
-}
-
-int bdrv_dirty_bitmap_get_meta(BlockDriverState *bs,
-                               BdrvDirtyBitmap *bitmap, int64_t sector,
-                               int nb_sectors)
-{
-    uint64_t i;
-    int sectors_per_bit = 1 << hbitmap_granularity(bitmap->meta);
-
-    /* To optimize: we can make hbitmap to internally check the range in a
-     * coarse level, or at least do it word by word. */
-    for (i = sector; i < sector + nb_sectors; i += sectors_per_bit) {
-        if (hbitmap_get(bitmap->meta, i)) {
-            return true;
-        }
-    }
-    return false;
-}
-
-void bdrv_dirty_bitmap_reset_meta(BlockDriverState *bs,
-                                  BdrvDirtyBitmap *bitmap, int64_t sector,
-                                  int nb_sectors)
-{
-    hbitmap_reset(bitmap->meta, sector, nb_sectors);
-}
-
-int64_t bdrv_dirty_bitmap_size(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->size;
-}
-
-const char *bdrv_dirty_bitmap_name(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->name;
-}
-
 bool bdrv_dirty_bitmap_frozen(BdrvDirtyBitmap *bitmap)
 {
    return bitmap->successor;
@@ -279,7 +212,6 @@ void bdrv_dirty_bitmap_truncate(BlockDriverState *bs)

    QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {
        assert(!bdrv_dirty_bitmap_frozen(bitmap));
-        assert(!bitmap->active_iterators);
        hbitmap_truncate(bitmap->bitmap, size);
        bitmap->size = size;
    }
@@ -292,9 +224,7 @@ static void bdrv_do_release_matching_dirty_bitmap(BlockDriverState *bs,
    BdrvDirtyBitmap *bm, *next;
    QLIST_FOREACH_SAFE(bm, &bs->dirty_bitmaps, list, next) {
        if ((!bitmap || bm == bitmap) && (!only_named || bm->name)) {
-            assert(!bm->active_iterators);
            assert(!bdrv_dirty_bitmap_frozen(bm));
-            assert(!bm->meta);
            QLIST_REMOVE(bm, list);
            hbitmap_free(bm->bitmap);
            g_free(bm->name);
@@ -305,9 +235,6 @@ static void bdrv_do_release_matching_dirty_bitmap(BlockDriverState *bs,
            }
        }
    }
-    if (bitmap) {
-        abort();
-    }
 }

 void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)
@@ -393,43 +320,9 @@ uint32_t bdrv_dirty_bitmap_granularity(BdrvDirtyBitmap *bitmap)
    return BDRV_SECTOR_SIZE << hbitmap_granularity(bitmap->bitmap);
 }

-uint32_t bdrv_dirty_bitmap_meta_granularity(BdrvDirtyBitmap *bitmap)
+void bdrv_dirty_iter_init(BdrvDirtyBitmap *bitmap, HBitmapIter *hbi)
 {
-    return BDRV_SECTOR_SIZE << hbitmap_granularity(bitmap->meta);
-}
-
-BdrvDirtyBitmapIter *bdrv_dirty_iter_new(BdrvDirtyBitmap *bitmap,
-                                         uint64_t first_sector)
-{
-    BdrvDirtyBitmapIter *iter = g_new(BdrvDirtyBitmapIter, 1);
-    hbitmap_iter_init(&iter->hbi, bitmap->bitmap, first_sector);
-    iter->bitmap = bitmap;
-    bitmap->active_iterators++;
-    return iter;
-}
-
-BdrvDirtyBitmapIter *bdrv_dirty_meta_iter_new(BdrvDirtyBitmap *bitmap)
-{
-    BdrvDirtyBitmapIter *iter = g_new(BdrvDirtyBitmapIter, 1);
-    hbitmap_iter_init(&iter->hbi, bitmap->meta, 0);
-    iter->bitmap = bitmap;
-    bitmap->active_iterators++;
-    return iter;
-}
-
-void bdrv_dirty_iter_free(BdrvDirtyBitmapIter *iter)
-{
-    if (!iter) {
-        return;
-    }
-    assert(iter->bitmap->active_iterators > 0);
-    iter->bitmap->active_iterators--;
-    g_free(iter);
-}
-
-int64_t bdrv_dirty_iter_next(BdrvDirtyBitmapIter *iter)
-{
-    return hbitmap_iter_next(&iter->hbi);
+    hbitmap_iter_init(hbi, bitmap->bitmap, 0);
 }

 void bdrv_set_dirty_bitmap(BdrvDirtyBitmap *bitmap,
@@ -467,43 +360,6 @@ void bdrv_undo_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *in)
    hbitmap_free(tmp);
 }

-uint64_t bdrv_dirty_bitmap_serialization_size(const BdrvDirtyBitmap *bitmap,
-                                              uint64_t start, uint64_t count)
-{
-    return hbitmap_serialization_size(bitmap->bitmap, start, count);
-}
-
-uint64_t bdrv_dirty_bitmap_serialization_align(const BdrvDirtyBitmap *bitmap)
-{
-    return hbitmap_serialization_granularity(bitmap->bitmap);
-}
-
-void bdrv_dirty_bitmap_serialize_part(const BdrvDirtyBitmap *bitmap,
-                                      uint8_t *buf, uint64_t start,
-                                      uint64_t count)
-{
-    hbitmap_serialize_part(bitmap->bitmap, buf, start, count);
-}
-
-void bdrv_dirty_bitmap_deserialize_part(BdrvDirtyBitmap *bitmap,
-                                        uint8_t *buf, uint64_t start,
-                                        uint64_t count, bool finish)
-{
-    hbitmap_deserialize_part(bitmap->bitmap, buf, start, count, finish);
-}
-
-void bdrv_dirty_bitmap_deserialize_zeroes(BdrvDirtyBitmap *bitmap,
-                                          uint64_t start, uint64_t count,
-                                          bool finish)
-{
-    hbitmap_deserialize_zeroes(bitmap->bitmap, start, count, finish);
-}
-
-void bdrv_dirty_bitmap_deserialize_finish(BdrvDirtyBitmap *bitmap)
-{
-    hbitmap_deserialize_finish(bitmap->bitmap);
-}
-
 void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
                    int64_t nr_sectors)
 {
@@ -517,19 +373,15 @@ void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
 }

 /**
- * Advance a BdrvDirtyBitmapIter to an arbitrary offset.
+ * Advance an HBitmapIter to an arbitrary offset.
 */
-void bdrv_set_dirty_iter(BdrvDirtyBitmapIter *iter, int64_t sector_num)
+void bdrv_set_dirty_iter(HBitmapIter *hbi, int64_t offset)
 {
-    hbitmap_iter_init(&iter->hbi, iter->hbi.hb, sector_num);
+    assert(hbi->hb);
+    hbitmap_iter_init(hbi, hbi->hb, offset);
 }

 int64_t bdrv_get_dirty_count(BdrvDirtyBitmap *bitmap)
 {
    return hbitmap_count(bitmap->bitmap);
 }
-
-int64_t bdrv_get_meta_dirty_count(BdrvDirtyBitmap *bitmap)
-{
-    return hbitmap_count(bitmap->meta);
-}
@@ -1,61 +0,0 @@
-/*
- * DMG bzip2 uncompression
- *
- * Copyright (c) 2004 Johannes E. Schindelin
- * Copyright (c) 2016 Red Hat, Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "dmg.h"
-#include <bzlib.h>
-
-static int dmg_uncompress_bz2_do(char *next_in, unsigned int avail_in,
-                                 char *next_out, unsigned int avail_out)
-{
-    int ret;
-    uint64_t total_out;
-    bz_stream bzstream = {};
-
-    ret = BZ2_bzDecompressInit(&bzstream, 0, 0);
-    if (ret != BZ_OK) {
-        return -1;
-    }
-    bzstream.next_in = next_in;
-    bzstream.avail_in = avail_in;
-    bzstream.next_out = next_out;
-    bzstream.avail_out = avail_out;
-    ret = BZ2_bzDecompress(&bzstream);
-    total_out = ((uint64_t)bzstream.total_out_hi32 << 32) +
-                bzstream.total_out_lo32;
-    BZ2_bzDecompressEnd(&bzstream);
-    if (ret != BZ_STREAM_END ||
-        total_out != avail_out) {
-        return -1;
-    }
-    return 0;
-}
-
-__attribute__((constructor))
-static void dmg_bz2_init(void)
-{
-    assert(!dmg_uncompress_bz2);
-    dmg_uncompress_bz2 = dmg_uncompress_bz2_do;
-}
@@ -28,10 +28,10 @@
 #include "qemu/bswap.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
-#include "dmg.h"
-
-int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
-                          char *next_out, unsigned int avail_out);
+#include <zlib.h>
+#ifdef CONFIG_BZIP2
+#include <bzlib.h>
+#endif

 enum {
    /* Limit chunk sizes to prevent unreasonable amounts of memory being used
@@ -41,6 +41,31 @@ enum {
    DMG_SECTORCOUNTS_MAX = DMG_LENGTHS_MAX / 512,
 };

+typedef struct BDRVDMGState {
+    CoMutex lock;
+    /* each chunk contains a certain number of sectors,
+     * offsets[i] is the offset in the .dmg file,
+     * lengths[i] is the length of the compressed chunk,
+     * sectors[i] is the sector beginning at offsets[i],
+     * sectorcounts[i] is the number of sectors in that chunk,
+     * the sectors array is ordered
+     * 0<=i<n_chunks */
+
+    uint32_t n_chunks;
+    uint32_t* types;
+    uint64_t* offsets;
+    uint64_t* lengths;
+    uint64_t* sectors;
+    uint64_t* sectorcounts;
+    uint32_t current_chunk;
+    uint8_t *compressed_chunk;
+    uint8_t *uncompressed_chunk;
+    z_stream zstream;
+#ifdef CONFIG_BZIP2
+    bz_stream bzstream;
+#endif
+} BDRVDMGState;
+
 static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
 {
    int len;
@@ -185,9 +210,10 @@ static bool dmg_is_known_block_type(uint32_t entry_type)
    case 0x00000001:    /* uncompressed */
    case 0x00000002:    /* zeroes */
    case 0x80000005:    /* zlib */
-        return true;
+#ifdef CONFIG_BZIP2
    case 0x80000006:    /* bzip2 */
-        return !!dmg_uncompress_bz2;
+#endif
+        return true;
    default:
        return false;
    }
@@ -413,7 +439,6 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
    int64_t offset;
    int ret;

-    block_module_load_one("dmg-bz2");
    bs->read_only = true;

    s->n_chunks = 0;
@@ -562,6 +587,9 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
    if (!is_sector_in_chunk(s, s->current_chunk, sector_num)) {
        int ret;
        uint32_t chunk = search_chunk(s, sector_num);
+#ifdef CONFIG_BZIP2
+        uint64_t total_out;
+#endif

        if (chunk >= s->n_chunks) {
            return -1;
@@ -592,10 +620,8 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return -1;
            }
            break; }
+#ifdef CONFIG_BZIP2
        case 0x80000006: /* bzip2 compressed */
-            if (!dmg_uncompress_bz2) {
-                break;
-            }
            /* we need to buffer, because only the chunk as whole can be
             * inflated. */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
@@ -604,15 +630,24 @@ static inline int dmg_read_chunk(BlockDriverState *bs, uint64_t sector_num)
                return -1;
            }

-            ret = dmg_uncompress_bz2((char *)s->compressed_chunk,
-                                     (unsigned int) s->lengths[chunk],
-                                     (char *)s->uncompressed_chunk,
-                                     (unsigned int)
-                                         (512 * s->sectorcounts[chunk]));
-            if (ret < 0) {
-                return ret;
+            ret = BZ2_bzDecompressInit(&s->bzstream, 0, 0);
+            if (ret != BZ_OK) {
+                return -1;
+            }
+            s->bzstream.next_in = (char *)s->compressed_chunk;
+            s->bzstream.avail_in = (unsigned int) s->lengths[chunk];
+            s->bzstream.next_out = (char *)s->uncompressed_chunk;
+            s->bzstream.avail_out = (unsigned int) 512 * s->sectorcounts[chunk];
+            ret = BZ2_bzDecompress(&s->bzstream);
+            total_out = ((uint64_t)s->bzstream.total_out_hi32 << 32) +
+                        s->bzstream.total_out_lo32;
+            BZ2_bzDecompressEnd(&s->bzstream);
+            if (ret != BZ_STREAM_END ||
+                total_out != 512 * s->sectorcounts[chunk]) {
+                return -1;
            }
            break;
+#endif /* CONFIG_BZIP2 */
        case 1: /* copy */
            ret = bdrv_pread(bs->file, s->offsets[chunk],
                             s->uncompressed_chunk, s->lengths[chunk]);
@@ -1,59 +0,0 @@
-/*
- * Header for DMG driver
- *
- * Copyright (c) 2004-2006 Fabrice Bellard
- * Copyright (c) 2016 Red hat, Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#ifndef BLOCK_DMG_H
-#define BLOCK_DMG_H
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "block/block_int.h"
-#include <zlib.h>
-
-typedef struct BDRVDMGState {
-    CoMutex lock;
-    /* each chunk contains a certain number of sectors,
-     * offsets[i] is the offset in the .dmg file,
-     * lengths[i] is the length of the compressed chunk,
-     * sectors[i] is the sector beginning at offsets[i],
-     * sectorcounts[i] is the number of sectors in that chunk,
-     * the sectors array is ordered
-     * 0<=i<n_chunks */
-
-    uint32_t n_chunks;
-    uint32_t *types;
-    uint64_t *offsets;
-    uint64_t *lengths;
-    uint64_t *sectors;
-    uint64_t *sectorcounts;
-    uint32_t current_chunk;
-    uint8_t *compressed_chunk;
-    uint8_t *uncompressed_chunk;
-    z_stream zstream;
-} BDRVDMGState;
-
-extern int (*dmg_uncompress_bz2)(char *next_in, unsigned int avail_in,
-                                 char *next_out, unsigned int avail_out);
-
-#endif
@@ -14,7 +14,6 @@
 #include "qapi/qmp/qerror.h"
 #include "qemu/uri.h"
 #include "qemu/error-report.h"
-#include "qemu/cutils.h"

 #define GLUSTER_OPT_FILENAME        "filename"
 #define GLUSTER_OPT_VOLUME          "volume"
@@ -31,14 +30,13 @@
 #define GLUSTER_DEFAULT_PORT        24007
 #define GLUSTER_DEBUG_DEFAULT       4
 #define GLUSTER_DEBUG_MAX           9
-#define GLUSTER_OPT_LOGFILE         "logfile"
-#define GLUSTER_LOGFILE_DEFAULT     "-" /* handled in libgfapi as /dev/stderr */

 #define GERR_INDEX_HINT "hint: check in 'server' array index '%d'\n"

 typedef struct GlusterAIOCB {
    int64_t size;
    int ret;
+    QEMUBH *bh;
    Coroutine *coroutine;
    AioContext *aio_context;
 } GlusterAIOCB;
@@ -46,9 +44,8 @@ typedef struct GlusterAIOCB {
 typedef struct BDRVGlusterState {
    struct glfs *glfs;
    struct glfs_fd *fd;
-    char *logfile;
    bool supports_seek_data;
-    int debug;
+    int debug_level;
 } BDRVGlusterState;

 typedef struct BDRVGlusterReopenState {
@@ -57,19 +54,6 @@ typedef struct BDRVGlusterReopenState {
 } BDRVGlusterReopenState;


-typedef struct GlfsPreopened {
-    char *volume;
-    glfs_t *fs;
-    int ref;
-} GlfsPreopened;
-
-typedef struct ListElement {
-    QLIST_ENTRY(ListElement) list;
-    GlfsPreopened saved;
-} ListElement;
-
-static QLIST_HEAD(glfs_list, ListElement) glfs_list;
-
 static QemuOptsList qemu_gluster_create_opts = {
    .name = "qemu-gluster-create-opts",
    .head = QTAILQ_HEAD_INITIALIZER(qemu_gluster_create_opts.head),
@@ -89,11 +73,6 @@ static QemuOptsList qemu_gluster_create_opts = {
            .type = QEMU_OPT_NUMBER,
            .help = "Gluster log level, valid range is 0-9",
        },
-        {
-            .name = GLUSTER_OPT_LOGFILE,
-            .type = QEMU_OPT_STRING,
-            .help = "Logfile path of libgfapi",
-        },
        { /* end of list */ }
    }
 };
@@ -112,11 +91,6 @@ static QemuOptsList runtime_opts = {
            .type = QEMU_OPT_NUMBER,
            .help = "Gluster log level, valid range is 0-9",
        },
-        {
-            .name = GLUSTER_OPT_LOGFILE,
-            .type = QEMU_OPT_STRING,
-            .help = "Logfile path of libgfapi",
-        },
        { /* end of list */ }
    },
 };
@@ -186,7 +160,7 @@ static QemuOptsList runtime_tcp_opts = {
        },
        {
            .name = GLUSTER_OPT_PORT,
-            .type = QEMU_OPT_STRING,
+            .type = QEMU_OPT_NUMBER,
            .help = "port number on which glusterd is listening (default 24007)",
        },
        {
@@ -208,58 +182,6 @@ static QemuOptsList runtime_tcp_opts = {
    },
 };

-static void glfs_set_preopened(const char *volume, glfs_t *fs)
-{
-    ListElement *entry = NULL;
-
-    entry = g_new(ListElement, 1);
-
-    entry->saved.volume = g_strdup(volume);
-
-    entry->saved.fs = fs;
-    entry->saved.ref = 1;
-
-    QLIST_INSERT_HEAD(&glfs_list, entry, list);
-}
-
-static glfs_t *glfs_find_preopened(const char *volume)
-{
-    ListElement *entry = NULL;
-
-     QLIST_FOREACH(entry, &glfs_list, list) {
-        if (strcmp(entry->saved.volume, volume) == 0) {
-            entry->saved.ref++;
-            return entry->saved.fs;
-        }
-     }
-
-    return NULL;
-}
-
-static void glfs_clear_preopened(glfs_t *fs)
-{
-    ListElement *entry = NULL;
-    ListElement *next;
-
-    if (fs == NULL) {
-        return;
-    }
-
-    QLIST_FOREACH_SAFE(entry, &glfs_list, list, next) {
-        if (entry->saved.fs == fs) {
-            if (--entry->saved.ref) {
-                return;
-            }
-
-            QLIST_REMOVE(entry, list);
-
-            glfs_fini(entry->saved.fs);
-            g_free(entry->saved.volume);
-            g_free(entry);
-        }
-    }
-}
-
 static int parse_volume_options(BlockdevOptionsGluster *gconf, char *path)
 {
    char *p, *q;
@@ -396,37 +318,22 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
    int ret;
    int old_errno;
    GlusterServerList *server;
-    unsigned long long port;
-
-    glfs = glfs_find_preopened(gconf->volume);
-    if (glfs) {
-        return glfs;
-    }

    glfs = glfs_new(gconf->volume);
    if (!glfs) {
        goto out;
    }

-    glfs_set_preopened(gconf->volume, glfs);
-
    for (server = gconf->server; server; server = server->next) {
        if (server->value->type  == GLUSTER_TRANSPORT_UNIX) {
            ret = glfs_set_volfile_server(glfs,
                                   GlusterTransport_lookup[server->value->type],
                                   server->value->u.q_unix.path, 0);
        } else {
-            if (parse_uint_full(server->value->u.tcp.port, &port, 10) < 0 ||
-                port > 65535) {
-                error_setg(errp, "'%s' is not a valid port number",
-                           server->value->u.tcp.port);
-                errno = EINVAL;
-                goto out;
-            }
            ret = glfs_set_volfile_server(glfs,
                                   GlusterTransport_lookup[server->value->type],
                                   server->value->u.tcp.host,
-                                   (int)port);
+                                   atoi(server->value->u.tcp.port));
        }

        if (ret < 0) {
@@ -434,7 +341,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
        }
    }

-    ret = glfs_set_logging(glfs, gconf->logfile, gconf->debug);
+    ret = glfs_set_logging(glfs, "-", gconf->debug_level);
    if (ret < 0) {
        goto out;
    }
@@ -468,7 +375,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
 out:
    if (glfs) {
        old_errno = errno;
-        glfs_clear_preopened(glfs);
+        glfs_fini(glfs);
        errno = old_errno;
    }
    return NULL;
@@ -669,9 +576,7 @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
        if (ret < 0) {
            error_setg(errp, "invalid URI");
            error_append_hint(errp, "Usage: file=gluster[+transport]://"
-                                    "[host[:port]]volume/path[?socket=...]"
-                                    "[,file.debug=N]"
-                                    "[,file.logfile=/path/filename.log]\n");
+                                    "[host[:port]]/volume/path[?socket=...]\n");
            errno = -ret;
            return NULL;
        }
@@ -681,9 +586,7 @@ static struct glfs *qemu_gluster_init(BlockdevOptionsGluster *gconf,
            error_append_hint(errp, "Usage: "
                             "-drive driver=qcow2,file.driver=gluster,"
                             "file.volume=testvol,file.path=/path/a.qcow2"
-                             "[,file.debug=9]"
-                             "[,file.logfile=/path/filename.log],"
-                             "file.server.0.type=tcp,"
+                             "[,file.debug=9],file.server.0.type=tcp,"
                             "file.server.0.host=1.2.3.4,"
                             "file.server.0.port=24007,"
                             "file.server.1.transport=unix,"
@@ -702,6 +605,8 @@ static void qemu_gluster_complete_aio(void *opaque)
 {
    GlusterAIOCB *acb = (GlusterAIOCB *)opaque;

+    qemu_bh_delete(acb->bh);
+    acb->bh = NULL;
    qemu_coroutine_enter(acb->coroutine);
 }

@@ -720,7 +625,8 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
        acb->ret = -EIO; /* Partial read/write - fail it */
    }

-    aio_bh_schedule_oneshot(acb->aio_context, qemu_gluster_complete_aio, acb);
+    acb->bh = aio_bh_new(acb->aio_context, qemu_gluster_complete_aio, acb);
+    qemu_bh_schedule(acb->bh);
 }

 static void qemu_gluster_parse_flags(int bdrv_flags, int *open_flags)
@@ -749,10 +655,7 @@ static void qemu_gluster_parse_flags(int bdrv_flags, int *open_flags)
 */
 static bool qemu_gluster_test_seek(struct glfs_fd *fd)
 {
-    off_t ret = 0;
-
-#if defined SEEK_HOLE && defined SEEK_DATA
-    off_t eof;
+    off_t ret, eof;

    eof = glfs_lseek(fd, 0, SEEK_END);
    if (eof < 0) {
@@ -762,8 +665,6 @@ static bool qemu_gluster_test_seek(struct glfs_fd *fd)

    /* this should always fail with ENXIO if SEEK_DATA is supported */
    ret = glfs_lseek(fd, eof, SEEK_DATA);
-#endif
-
    return (ret < 0) && (errno == ENXIO);
 }

@@ -776,7 +677,7 @@ static int qemu_gluster_open(BlockDriverState *bs,  QDict *options,
    BlockdevOptionsGluster *gconf = NULL;
    QemuOpts *opts;
    Error *local_err = NULL;
-    const char *filename, *logfile;
+    const char *filename;

    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
@@ -788,24 +689,17 @@ static int qemu_gluster_open(BlockDriverState *bs,  QDict *options,

    filename = qemu_opt_get(opts, GLUSTER_OPT_FILENAME);

-    s->debug = qemu_opt_get_number(opts, GLUSTER_OPT_DEBUG,
-                                   GLUSTER_DEBUG_DEFAULT);
-    if (s->debug < 0) {
-        s->debug = 0;
-    } else if (s->debug > GLUSTER_DEBUG_MAX) {
-        s->debug = GLUSTER_DEBUG_MAX;
+    s->debug_level = qemu_opt_get_number(opts, GLUSTER_OPT_DEBUG,
+                                         GLUSTER_DEBUG_DEFAULT);
+    if (s->debug_level < 0) {
+        s->debug_level = 0;
+    } else if (s->debug_level > GLUSTER_DEBUG_MAX) {
+        s->debug_level = GLUSTER_DEBUG_MAX;
    }

    gconf = g_new0(BlockdevOptionsGluster, 1);
-    gconf->debug = s->debug;
-    gconf->has_debug = true;
-
-    logfile = qemu_opt_get(opts, GLUSTER_OPT_LOGFILE);
-    s->logfile = g_strdup(logfile ? logfile : GLUSTER_LOGFILE_DEFAULT);
-
-    gconf->logfile = g_strdup(s->logfile);
-    gconf->has_logfile = true;
-
+    gconf->debug_level = s->debug_level;
+    gconf->has_debug_level = true;
    s->glfs = qemu_gluster_init(gconf, filename, options, errp);
    if (!s->glfs) {
        ret = -errno;
@@ -844,13 +738,12 @@ out:
    if (!ret) {
        return ret;
    }
-    g_free(s->logfile);
    if (s->fd) {
        glfs_close(s->fd);
    }
-
-    glfs_clear_preopened(s->glfs);
-
+    if (s->glfs) {
+        glfs_fini(s->glfs);
+    }
    return ret;
 }

@@ -874,10 +767,8 @@ static int qemu_gluster_reopen_prepare(BDRVReopenState *state,
    qemu_gluster_parse_flags(state->flags, &open_flags);

    gconf = g_new0(BlockdevOptionsGluster, 1);
-    gconf->debug = s->debug;
-    gconf->has_debug = true;
-    gconf->logfile = g_strdup(s->logfile);
-    gconf->has_logfile = true;
+    gconf->debug_level = s->debug_level;
+    gconf->has_debug_level = true;
    reop_s->glfs = qemu_gluster_init(gconf, state->bs->filename, NULL, errp);
    if (reop_s->glfs == NULL) {
        ret = -errno;
@@ -917,8 +808,9 @@ static void qemu_gluster_reopen_commit(BDRVReopenState *state)
    if (s->fd) {
        glfs_close(s->fd);
    }
-
-    glfs_clear_preopened(s->glfs);
+    if (s->glfs) {
+        glfs_fini(s->glfs);
+    }

    /* use the newly opened image / connection */
    s->fd         = reop_s->fd;
@@ -943,7 +835,9 @@ static void qemu_gluster_reopen_abort(BDRVReopenState *state)
        glfs_close(reop_s->fd);
    }

-    glfs_clear_preopened(reop_s->glfs);
+    if (reop_s->glfs) {
+        glfs_fini(reop_s->glfs);
+    }

    g_free(state->opaque);
    state->opaque = NULL;
@@ -1011,20 +905,14 @@ static int qemu_gluster_create(const char *filename,
    char *tmp = NULL;

    gconf = g_new0(BlockdevOptionsGluster, 1);
-    gconf->debug = qemu_opt_get_number_del(opts, GLUSTER_OPT_DEBUG,
-                                           GLUSTER_DEBUG_DEFAULT);
-    if (gconf->debug < 0) {
-        gconf->debug = 0;
-    } else if (gconf->debug > GLUSTER_DEBUG_MAX) {
-        gconf->debug = GLUSTER_DEBUG_MAX;
+    gconf->debug_level = qemu_opt_get_number_del(opts, GLUSTER_OPT_DEBUG,
+                                                 GLUSTER_DEBUG_DEFAULT);
+    if (gconf->debug_level < 0) {
+        gconf->debug_level = 0;
+    } else if (gconf->debug_level > GLUSTER_DEBUG_MAX) {
+        gconf->debug_level = GLUSTER_DEBUG_MAX;
    }
-    gconf->has_debug = true;
-
-    gconf->logfile = qemu_opt_get_del(opts, GLUSTER_OPT_LOGFILE);
-    if (!gconf->logfile) {
-        gconf->logfile = g_strdup(GLUSTER_LOGFILE_DEFAULT);
-    }
-    gconf->has_logfile = true;
+    gconf->has_debug_level = true;

    glfs = qemu_gluster_init(gconf, filename, NULL, errp);
    if (!glfs) {
@@ -1067,7 +955,9 @@ static int qemu_gluster_create(const char *filename,
 out:
    g_free(tmp);
    qapi_free_BlockdevOptionsGluster(gconf);
-    glfs_clear_preopened(glfs);
+    if (glfs) {
+        glfs_fini(glfs);
+    }
    return ret;
 }

@@ -1135,12 +1025,11 @@ static void qemu_gluster_close(BlockDriverState *bs)
 {
    BDRVGlusterState *s = bs->opaque;

-    g_free(s->logfile);
    if (s->fd) {
        glfs_close(s->fd);
        s->fd = NULL;
    }
-    glfs_clear_preopened(s->glfs);
+    glfs_fini(s->glfs);
 }

 static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
@@ -1259,14 +1148,12 @@ static int find_allocation(BlockDriverState *bs, off_t start,
                           off_t *data, off_t *hole)
 {
    BDRVGlusterState *s = bs->opaque;
+    off_t offs;

    if (!s->supports_seek_data) {
-        goto exit;
+        return -ENOTSUP;
    }

-#if defined SEEK_HOLE && defined SEEK_DATA
-    off_t offs;
-
    /*
     * SEEK_DATA cases:
     * D1. offs == start: start is in data
@@ -1330,10 +1217,6 @@ static int find_allocation(BlockDriverState *bs, off_t start,

    /* D1 and H1 */
    return -EBUSY;
-#endif
-
-exit:
-    return -ENOTSUP;
 }

 /*
@@ -143,7 +143,7 @@ bool bdrv_requests_pending(BlockDriverState *bs)
 {
    BdrvChild *child;

-    if (atomic_read(&bs->in_flight)) {
+    if (!QLIST_EMPTY(&bs->tracked_requests)) {
        return true;
    }

@@ -156,38 +156,43 @@ bool bdrv_requests_pending(BlockDriverState *bs)
    return false;
 }

-static bool bdrv_drain_recurse(BlockDriverState *bs)
+static void bdrv_drain_recurse(BlockDriverState *bs)
 {
    BdrvChild *child;
-    bool waited;
-
-    waited = BDRV_POLL_WHILE(bs, atomic_read(&bs->in_flight) > 0);

    if (bs->drv && bs->drv->bdrv_drain) {
        bs->drv->bdrv_drain(bs);
    }
-
    QLIST_FOREACH(child, &bs->children, next) {
-        waited |= bdrv_drain_recurse(child->bs);
+        bdrv_drain_recurse(child->bs);
    }
-
-    return waited;
 }

 typedef struct {
    Coroutine *co;
    BlockDriverState *bs;
+    QEMUBH *bh;
    bool done;
 } BdrvCoDrainData;

+static void bdrv_drain_poll(BlockDriverState *bs)
+{
+    bool busy = true;
+
+    while (busy) {
+        /* Keep iterating */
+        busy = bdrv_requests_pending(bs);
+        busy |= aio_poll(bdrv_get_aio_context(bs), busy);
+    }
+}
+
 static void bdrv_co_drain_bh_cb(void *opaque)
 {
    BdrvCoDrainData *data = opaque;
    Coroutine *co = data->co;
-    BlockDriverState *bs = data->bs;

-    bdrv_dec_in_flight(bs);
-    bdrv_drained_begin(bs);
+    qemu_bh_delete(data->bh);
+    bdrv_drain_poll(data->bs);
    data->done = true;
    qemu_coroutine_enter(co);
 }
@@ -205,10 +210,9 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs)
        .co = qemu_coroutine_self(),
        .bs = bs,
        .done = false,
+        .bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_drain_bh_cb, &data),
    };
-    bdrv_inc_in_flight(bs);
-    aio_bh_schedule_oneshot(bdrv_get_aio_context(bs),
-                            bdrv_co_drain_bh_cb, &data);
+    qemu_bh_schedule(data.bh);

    qemu_coroutine_yield();
    /* If we are resumed from some other event (such as an aio completion or a
@@ -218,11 +222,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs)

 void bdrv_drained_begin(BlockDriverState *bs)
 {
-    if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs);
-        return;
-    }
-
    if (!bs->quiesce_counter++) {
        aio_disable_external(bdrv_get_aio_context(bs));
        bdrv_parent_drained_begin(bs);
@@ -230,6 +229,11 @@ void bdrv_drained_begin(BlockDriverState *bs)

    bdrv_io_unplugged_begin(bs);
    bdrv_drain_recurse(bs);
+    if (qemu_in_coroutine()) {
+        bdrv_co_yield_to_drain(bs);
+    } else {
+        bdrv_drain_poll(bs);
+    }
    bdrv_io_unplugged_end(bs);
 }

@@ -273,17 +277,11 @@ void bdrv_drain(BlockDriverState *bs)
 *
 * This function does not flush data to disk, use bdrv_flush_all() for that
 * after calling this function.
- *
- * This pauses all block jobs and disables external clients. It must
- * be paired with bdrv_drain_all_end().
- *
- * NOTE: no new block jobs or BlockDriverStates can be created between
- * the bdrv_drain_all_begin() and bdrv_drain_all_end() calls.
 */
-void bdrv_drain_all_begin(void)
+void bdrv_drain_all(void)
 {
    /* Always run first iteration so any pending completion BHs run */
-    bool waited = true;
+    bool busy = true;
    BlockDriverState *bs;
    BdrvNextIterator it;
    BlockJob *job = NULL;
@@ -303,7 +301,7 @@ void bdrv_drain_all_begin(void)
        aio_context_acquire(aio_context);
        bdrv_parent_drained_begin(bs);
        bdrv_io_unplugged_begin(bs);
-        aio_disable_external(aio_context);
+        bdrv_drain_recurse(bs);
        aio_context_release(aio_context);

        if (!g_slist_find(aio_ctxs, aio_context)) {
@@ -317,8 +315,8 @@ void bdrv_drain_all_begin(void)
     * request completion.  Therefore we must keep looping until there was no
     * more activity rather than simply draining each device independently.
     */
-    while (waited) {
-        waited = false;
+    while (busy) {
+        busy = false;

        for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
            AioContext *aio_context = ctx->data;
@@ -326,32 +324,28 @@ void bdrv_drain_all_begin(void)
            aio_context_acquire(aio_context);
            for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
                if (aio_context == bdrv_get_aio_context(bs)) {
-                    waited |= bdrv_drain_recurse(bs);
+                    if (bdrv_requests_pending(bs)) {
+                        busy = true;
+                        aio_poll(aio_context, busy);
+                    }
                }
            }
+            busy |= aio_poll(aio_context, false);
            aio_context_release(aio_context);
        }
    }

-    g_slist_free(aio_ctxs);
-}
-
-void bdrv_drain_all_end(void)
-{
-    BlockDriverState *bs;
-    BdrvNextIterator it;
-    BlockJob *job = NULL;
-
    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
        AioContext *aio_context = bdrv_get_aio_context(bs);

        aio_context_acquire(aio_context);
-        aio_enable_external(aio_context);
        bdrv_io_unplugged_end(bs);
        bdrv_parent_drained_end(bs);
        aio_context_release(aio_context);
    }
+    g_slist_free(aio_ctxs);

+    job = NULL;
    while ((job = block_job_next(job))) {
        AioContext *aio_context = blk_get_aio_context(job->blk);

@@ -361,12 +355,6 @@ void bdrv_drain_all_end(void)
    }
 }

-void bdrv_drain_all(void)
-{
-    bdrv_drain_all_begin();
-    bdrv_drain_all_end();
-}
-
 /**
 * Remove an active request from the tracked requests list
 *
@@ -490,28 +478,6 @@ static bool tracked_request_overlaps(BdrvTrackedRequest *req,
    return true;
 }

-void bdrv_inc_in_flight(BlockDriverState *bs)
-{
-    atomic_inc(&bs->in_flight);
-}
-
-static void dummy_bh_cb(void *opaque)
-{
-}
-
-void bdrv_wakeup(BlockDriverState *bs)
-{
-    if (bs->wakeup) {
-        aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
-    }
-}
-
-void bdrv_dec_in_flight(BlockDriverState *bs)
-{
-    atomic_dec(&bs->in_flight);
-    bdrv_wakeup(bs);
-}
-
 static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
 {
    BlockDriverState *bs = self->bs;
@@ -574,6 +540,17 @@ static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
    return 0;
 }

+static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,
+                              int nb_sectors)
+{
+    if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
+        return -EIO;
+    }
+
+    return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,
+                                   nb_sectors * BDRV_SECTOR_SIZE);
+}
+
 typedef struct RwCo {
    BdrvChild *child;
    int64_t offset;
@@ -619,9 +596,13 @@ static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
        /* Fast-path if already in coroutine context */
        bdrv_rw_co_entry(&rwco);
    } else {
+        AioContext *aio_context = bdrv_get_aio_context(child->bs);
+
        co = qemu_coroutine_create(bdrv_rw_co_entry, &rwco);
        qemu_coroutine_enter(co);
-        BDRV_POLL_WHILE(child->bs, rwco.ret == NOT_DONE);
+        while (rwco.ret == NOT_DONE) {
+            aio_poll(aio_context, true);
+        }
    }
    return rwco.ret;
 }
@@ -916,19 +897,6 @@ emulate_flags:
    return ret;
 }

-static int coroutine_fn
-bdrv_driver_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-                               uint64_t bytes, QEMUIOVector *qiov)
-{
-    BlockDriver *drv = bs->drv;
-
-    if (!drv->bdrv_co_pwritev_compressed) {
-        return -ENOTSUP;
-    }
-
-    return drv->bdrv_co_pwritev_compressed(bs, offset, bytes, qiov);
-}
-
 static int coroutine_fn bdrv_co_do_copy_on_readv(BlockDriverState *bs,
        int64_t offset, unsigned int bytes, QEMUIOVector *qiov)
 {
@@ -1129,8 +1097,6 @@ int coroutine_fn bdrv_co_preadv(BdrvChild *child,
        return ret;
    }

-    bdrv_inc_in_flight(bs);
-
    /* Don't do copy-on-read if we read data before write operation */
    if (bs->copy_on_read && !(flags & BDRV_REQ_NO_SERIALISING)) {
        flags |= BDRV_REQ_COPY_ON_READ;
@@ -1166,7 +1132,6 @@ int coroutine_fn bdrv_co_preadv(BdrvChild *child,
                              use_local_qiov ? &local_qiov : qiov,
                              flags);
    tracked_request_end(&req);
-    bdrv_dec_in_flight(bs);

    if (use_local_qiov) {
        qemu_iovec_destroy(&local_qiov);
@@ -1353,8 +1318,6 @@ static int coroutine_fn bdrv_aligned_pwritev(BlockDriverState *bs,
    } else if (flags & BDRV_REQ_ZERO_WRITE) {
        bdrv_debug_event(bs, BLKDBG_PWRITEV_ZERO);
        ret = bdrv_co_do_pwrite_zeroes(bs, offset, bytes, flags);
-    } else if (flags & BDRV_REQ_WRITE_COMPRESSED) {
-        ret = bdrv_driver_pwritev_compressed(bs, offset, bytes, qiov);
    } else if (bytes <= max_transfer) {
        bdrv_debug_event(bs, BLKDBG_PWRITEV);
        ret = bdrv_driver_pwritev(bs, offset, bytes, qiov, flags);
@@ -1518,7 +1481,6 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
        return ret;
    }

-    bdrv_inc_in_flight(bs);
    /*
     * Align write if necessary by performing a read-modify-write cycle.
     * Pad qiov with the read parts and be sure to have a tracked request not
@@ -1620,7 +1582,6 @@ fail:
    qemu_vfree(tail_buf);
 out:
    tracked_request_end(&req);
-    bdrv_dec_in_flight(bs);
    return ret;
 }

@@ -1745,19 +1706,17 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
    }

    *file = NULL;
-    bdrv_inc_in_flight(bs);
    ret = bs->drv->bdrv_co_get_block_status(bs, sector_num, nb_sectors, pnum,
                                            file);
    if (ret < 0) {
        *pnum = 0;
-        goto out;
+        return ret;
    }

    if (ret & BDRV_BLOCK_RAW) {
        assert(ret & BDRV_BLOCK_OFFSET_VALID);
-        ret = bdrv_get_block_status(bs->file->bs, ret >> BDRV_SECTOR_BITS,
-                                    *pnum, pnum, file);
-        goto out;
+        return bdrv_get_block_status(bs->file->bs, ret >> BDRV_SECTOR_BITS,
+                                     *pnum, pnum, file);
    }

    if (ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ZERO)) {
@@ -1799,8 +1758,6 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
        }
    }

-out:
-    bdrv_dec_in_flight(bs);
    return ret;
 }

@@ -1866,10 +1823,14 @@ int64_t bdrv_get_block_status_above(BlockDriverState *bs,
        /* Fast-path if already in coroutine context */
        bdrv_get_block_status_above_co_entry(&data);
    } else {
+        AioContext *aio_context = bdrv_get_aio_context(bs);
+
        co = qemu_coroutine_create(bdrv_get_block_status_above_co_entry,
                                   &data);
        qemu_coroutine_enter(co);
-        BDRV_POLL_WHILE(bs, !data.done);
+        while (!data.done) {
+            aio_poll(aio_context, true);
+        }
    }
    return data.ret;
 }
@@ -1946,6 +1907,28 @@ int bdrv_is_allocated_above(BlockDriverState *top,
    return 0;
 }

+int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                          const uint8_t *buf, int nb_sectors)
+{
+    BlockDriver *drv = bs->drv;
+    int ret;
+
+    if (!drv) {
+        return -ENOMEDIUM;
+    }
+    if (!drv->bdrv_write_compressed) {
+        return -ENOTSUP;
+    }
+    ret = bdrv_check_request(bs, sector_num, nb_sectors);
+    if (ret < 0) {
+        return ret;
+    }
+
+    assert(QLIST_EMPTY(&bs->dirty_bitmaps));
+
+    return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+}
+
 typedef struct BdrvVmstateCo {
    BlockDriverState    *bs;
    QEMUIOVector        *qiov;
@@ -2133,6 +2116,7 @@ typedef struct BlockAIOCBCoroutine {
    bool is_write;
    bool need_bh;
    bool *done;
+    QEMUBH* bh;
 } BlockAIOCBCoroutine;

 static const AIOCBInfo bdrv_em_co_aiocb_info = {
@@ -2142,7 +2126,6 @@ static const AIOCBInfo bdrv_em_co_aiocb_info = {
 static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
 {
    if (!acb->need_bh) {
-        bdrv_dec_in_flight(acb->common.bs);
        acb->common.cb(acb->common.opaque, acb->req.error);
        qemu_aio_unref(acb);
    }
@@ -2153,6 +2136,7 @@ static void bdrv_co_em_bh(void *opaque)
    BlockAIOCBCoroutine *acb = opaque;

    assert(!acb->need_bh);
+    qemu_bh_delete(acb->bh);
    bdrv_co_complete(acb);
 }

@@ -2162,7 +2146,8 @@ static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
    if (acb->req.error != -EINPROGRESS) {
        BlockDriverState *bs = acb->common.bs;

-        aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);
+        acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);
+        qemu_bh_schedule(acb->bh);
    }
 }

@@ -2193,9 +2178,6 @@ static BlockAIOCB *bdrv_co_aio_prw_vector(BdrvChild *child,
    Coroutine *co;
    BlockAIOCBCoroutine *acb;

-    /* Matched by bdrv_co_complete's bdrv_dec_in_flight.  */
-    bdrv_inc_in_flight(child->bs);
-
    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, child->bs, cb, opaque);
    acb->child = child;
    acb->need_bh = true;
@@ -2229,9 +2211,6 @@ BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
    Coroutine *co;
    BlockAIOCBCoroutine *acb;

-    /* Matched by bdrv_co_complete's bdrv_dec_in_flight.  */
-    bdrv_inc_in_flight(bs);
-
    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
    acb->need_bh = true;
    acb->req.error = -EINPROGRESS;
@@ -2243,6 +2222,35 @@ BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
    return &acb->common;
 }

+static void coroutine_fn bdrv_aio_pdiscard_co_entry(void *opaque)
+{
+    BlockAIOCBCoroutine *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+
+    acb->req.error = bdrv_co_pdiscard(bs, acb->req.offset, acb->req.bytes);
+    bdrv_co_complete(acb);
+}
+
+BlockAIOCB *bdrv_aio_pdiscard(BlockDriverState *bs, int64_t offset, int count,
+                              BlockCompletionFunc *cb, void *opaque)
+{
+    Coroutine *co;
+    BlockAIOCBCoroutine *acb;
+
+    trace_bdrv_aio_pdiscard(bs, offset, count, opaque);
+
+    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
+    acb->need_bh = true;
+    acb->req.error = -EINPROGRESS;
+    acb->req.offset = offset;
+    acb->req.bytes = count;
+    co = qemu_coroutine_create(bdrv_aio_pdiscard_co_entry, acb);
+    qemu_coroutine_enter(co);
+
+    bdrv_co_maybe_schedule_bh(acb);
+    return &acb->common;
+}
+
 void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
                   BlockCompletionFunc *cb, void *opaque)
 {
@@ -2291,22 +2299,23 @@ static void coroutine_fn bdrv_flush_co_entry(void *opaque)
 int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
 {
    int ret;
+    BdrvTrackedRequest req;

    if (!bs || !bdrv_is_inserted(bs) || bdrv_is_read_only(bs) ||
        bdrv_is_sg(bs)) {
        return 0;
    }

-    bdrv_inc_in_flight(bs);
+    tracked_request_begin(&req, bs, 0, 0, BDRV_TRACKED_FLUSH);

    int current_gen = bs->write_gen;

    /* Wait until any previous flushes are completed */
-    while (bs->active_flush_req) {
+    while (bs->active_flush_req != NULL) {
        qemu_co_queue_wait(&bs->flush_queue);
    }

-    bs->active_flush_req = true;
+    bs->active_flush_req = &req;

    /* Write back all layers by calling one driver function */
    if (bs->drv->bdrv_co_flush) {
@@ -2378,11 +2387,11 @@ out:
    if (ret == 0) {
        bs->flushed_gen = current_gen;
    }
-    bs->active_flush_req = false;
+    bs->active_flush_req = NULL;
    /* Return value is ignored - it's ok if wait queue is empty */
    qemu_co_queue_next(&bs->flush_queue);

-    bdrv_dec_in_flight(bs);
+    tracked_request_end(&req);
    return ret;
 }

@@ -2398,9 +2407,13 @@ int bdrv_flush(BlockDriverState *bs)
        /* Fast-path if already in coroutine context */
        bdrv_flush_co_entry(&flush_co);
    } else {
+        AioContext *aio_context = bdrv_get_aio_context(bs);
+
        co = qemu_coroutine_create(bdrv_flush_co_entry, &flush_co);
        qemu_coroutine_enter(co);
-        BDRV_POLL_WHILE(bs, flush_co.ret == NOT_DONE);
+        while (flush_co.ret == NOT_DONE) {
+            aio_poll(aio_context, true);
+        }
    }

    return flush_co.ret;
@@ -2457,7 +2470,6 @@ int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
    head = offset % align;
    tail = (offset + count) % align;

-    bdrv_inc_in_flight(bs);
    tracked_request_begin(&req, bs, offset, count, BDRV_TRACKED_DISCARD);

    ret = notifier_with_return_list_notify(&bs->before_write_notifiers, &req);
@@ -2527,7 +2539,6 @@ out:
    bdrv_set_dirty(bs, req.offset >> BDRV_SECTOR_BITS,
                   req.bytes >> BDRV_SECTOR_BITS);
    tracked_request_end(&req);
-    bdrv_dec_in_flight(bs);
    return ret;
 }

@@ -2545,43 +2556,108 @@ int bdrv_pdiscard(BlockDriverState *bs, int64_t offset, int count)
        /* Fast-path if already in coroutine context */
        bdrv_pdiscard_co_entry(&rwco);
    } else {
+        AioContext *aio_context = bdrv_get_aio_context(bs);
+
        co = qemu_coroutine_create(bdrv_pdiscard_co_entry, &rwco);
        qemu_coroutine_enter(co);
-        BDRV_POLL_WHILE(bs, rwco.ret == NOT_DONE);
+        while (rwco.ret == NOT_DONE) {
+            aio_poll(aio_context, true);
+        }
    }

    return rwco.ret;
 }

-int bdrv_co_ioctl(BlockDriverState *bs, int req, void *buf)
+static int bdrv_co_do_ioctl(BlockDriverState *bs, int req, void *buf)
 {
    BlockDriver *drv = bs->drv;
+    BdrvTrackedRequest tracked_req;
    CoroutineIOCompletion co = {
        .coroutine = qemu_coroutine_self(),
    };
    BlockAIOCB *acb;

-    bdrv_inc_in_flight(bs);
-    if (!drv || (!drv->bdrv_aio_ioctl && !drv->bdrv_co_ioctl)) {
+    tracked_request_begin(&tracked_req, bs, 0, 0, BDRV_TRACKED_IOCTL);
+    if (!drv || !drv->bdrv_aio_ioctl) {
        co.ret = -ENOTSUP;
        goto out;
    }

-    if (drv->bdrv_co_ioctl) {
-        co.ret = drv->bdrv_co_ioctl(bs, req, buf);
-    } else {
-        acb = drv->bdrv_aio_ioctl(bs, req, buf, bdrv_co_io_em_complete, &co);
-        if (!acb) {
-            co.ret = -ENOTSUP;
-            goto out;
-        }
-        qemu_coroutine_yield();
+    acb = drv->bdrv_aio_ioctl(bs, req, buf, bdrv_co_io_em_complete, &co);
+    if (!acb) {
+        co.ret = -ENOTSUP;
+        goto out;
    }
+    qemu_coroutine_yield();
 out:
-    bdrv_dec_in_flight(bs);
+    tracked_request_end(&tracked_req);
    return co.ret;
 }

+typedef struct {
+    BlockDriverState *bs;
+    int req;
+    void *buf;
+    int ret;
+} BdrvIoctlCoData;
+
+static void coroutine_fn bdrv_co_ioctl_entry(void *opaque)
+{
+    BdrvIoctlCoData *data = opaque;
+    data->ret = bdrv_co_do_ioctl(data->bs, data->req, data->buf);
+}
+
+/* needed for generic scsi interface */
+int bdrv_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+{
+    BdrvIoctlCoData data = {
+        .bs = bs,
+        .req = req,
+        .buf = buf,
+        .ret = -EINPROGRESS,
+    };
+
+    if (qemu_in_coroutine()) {
+        /* Fast-path if already in coroutine context */
+        bdrv_co_ioctl_entry(&data);
+    } else {
+        Coroutine *co = qemu_coroutine_create(bdrv_co_ioctl_entry, &data);
+
+        qemu_coroutine_enter(co);
+        while (data.ret == -EINPROGRESS) {
+            aio_poll(bdrv_get_aio_context(bs), true);
+        }
+    }
+    return data.ret;
+}
+
+static void coroutine_fn bdrv_co_aio_ioctl_entry(void *opaque)
+{
+    BlockAIOCBCoroutine *acb = opaque;
+    acb->req.error = bdrv_co_do_ioctl(acb->common.bs,
+                                      acb->req.req, acb->req.buf);
+    bdrv_co_complete(acb);
+}
+
+BlockAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
+        unsigned long int req, void *buf,
+        BlockCompletionFunc *cb, void *opaque)
+{
+    BlockAIOCBCoroutine *acb = qemu_aio_get(&bdrv_em_co_aiocb_info,
+                                            bs, cb, opaque);
+    Coroutine *co;
+
+    acb->need_bh = true;
+    acb->req.error = -EINPROGRESS;
+    acb->req.req = req;
+    acb->req.buf = buf;
+    co = qemu_coroutine_create(bdrv_co_aio_ioctl_entry, acb);
+    qemu_coroutine_enter(co);
+
+    bdrv_co_maybe_schedule_bh(acb);
+    return &acb->common;
+}
+
 void *qemu_blockalign(BlockDriverState *bs, size_t size)
 {
    return qemu_memalign(bdrv_opt_mem_align(bs), size);
@@ -36,7 +36,7 @@
 #include "block/block_int.h"
 #include "block/scsi.h"
 #include "qemu/iov.h"
-#include "qemu/uuid.h"
+#include "sysemu/sysemu.h"
 #include "qmp-commands.h"
 #include "qapi/qmp/qstring.h"
 #include "crypto/secret.h"
@@ -95,6 +95,7 @@ typedef struct IscsiTask {
    int do_retry;
    struct scsi_task *task;
    Coroutine *co;
+    QEMUBH *bh;
    IscsiLun *iscsilun;
    QEMUTimer retry_timer;
    int err_code;
@@ -166,6 +167,7 @@ static void iscsi_co_generic_bh_cb(void *opaque)
 {
    struct IscsiTask *iTask = opaque;
    iTask->complete = 1;
+    qemu_bh_delete(iTask->bh);
    qemu_coroutine_enter(iTask->co);
 }

@@ -202,10 +204,6 @@ static inline unsigned exp_random(double mean)
 #define SCSI_SENSE_ASCQ_PARAMETER_LIST_LENGTH_ERROR        0x1a00
 #endif

-#ifndef LIBISCSI_API_VERSION
-#define LIBISCSI_API_VERSION 20130701
-#endif
-
 static int iscsi_translate_sense(struct scsi_sense *sense)
 {
    int ret;
@@ -301,8 +299,9 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,

 out:
    if (iTask->co) {
-        aio_bh_schedule_oneshot(iTask->iscsilun->aio_context,
-                                 iscsi_co_generic_bh_cb, iTask);
+        iTask->bh = aio_bh_new(iTask->iscsilun->aio_context,
+                               iscsi_co_generic_bh_cb, iTask);
+        qemu_bh_schedule(iTask->bh);
    } else {
        iTask->complete = 1;
    }
@@ -498,18 +497,14 @@ iscsi_allocmap_update(IscsiLun *iscsilun, int64_t sector_num,
    if (allocated) {
        bitmap_set(iscsilun->allocmap, cl_num_expanded, nb_cls_expanded);
    } else {
-        if (nb_cls_shrunk > 0) {
-            bitmap_clear(iscsilun->allocmap, cl_num_shrunk, nb_cls_shrunk);
-        }
+        bitmap_clear(iscsilun->allocmap, cl_num_shrunk, nb_cls_shrunk);
    }

    if (iscsilun->allocmap_valid == NULL) {
        return;
    }
    if (valid) {
-        if (nb_cls_shrunk > 0) {
-            bitmap_set(iscsilun->allocmap_valid, cl_num_shrunk, nb_cls_shrunk);
-        }
+        bitmap_set(iscsilun->allocmap_valid, cl_num_shrunk, nb_cls_shrunk);
    } else {
        bitmap_clear(iscsilun->allocmap_valid, cl_num_expanded,
                     nb_cls_expanded);
@@ -600,20 +595,6 @@ iscsi_co_writev_flags(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
    iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
    if (iscsilun->use_16_for_rw) {
-#if LIBISCSI_API_VERSION >= (20160603)
-        iTask.task = iscsi_write16_iov_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                            NULL, num_sectors * iscsilun->block_size,
-                                            iscsilun->block_size, 0, 0, fua, 0, 0,
-                                            iscsi_co_generic_cb, &iTask,
-                                            (struct scsi_iovec *)iov->iov, iov->niov);
-    } else {
-        iTask.task = iscsi_write10_iov_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                            NULL, num_sectors * iscsilun->block_size,
-                                            iscsilun->block_size, 0, 0, fua, 0, 0,
-                                            iscsi_co_generic_cb, &iTask,
-                                            (struct scsi_iovec *)iov->iov, iov->niov);
-    }
-#else
        iTask.task = iscsi_write16_task(iscsilun->iscsi, iscsilun->lun, lba,
                                        NULL, num_sectors * iscsilun->block_size,
                                        iscsilun->block_size, 0, 0, fua, 0, 0,
@@ -624,14 +605,11 @@ retry:
                                        iscsilun->block_size, 0, 0, fua, 0, 0,
                                        iscsi_co_generic_cb, &iTask);
    }
-#endif
    if (iTask.task == NULL) {
        return -ENOMEM;
    }
-#if LIBISCSI_API_VERSION < (20160603)
    scsi_task_set_iov_out(iTask.task, (struct scsi_iovec *) iov->iov,
                          iov->niov);
-#endif
    while (!iTask.complete) {
        iscsi_set_events(iscsilun);
        qemu_coroutine_yield();
@@ -814,21 +792,6 @@ static int coroutine_fn iscsi_co_readv(BlockDriverState *bs,
    iscsi_co_init_iscsitask(iscsilun, &iTask);
 retry:
    if (iscsilun->use_16_for_rw) {
-#if LIBISCSI_API_VERSION >= (20160603)
-        iTask.task = iscsi_read16_iov_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                           num_sectors * iscsilun->block_size,
-                                           iscsilun->block_size, 0, 0, 0, 0, 0,
-                                           iscsi_co_generic_cb, &iTask,
-                                           (struct scsi_iovec *)iov->iov, iov->niov);
-    } else {
-        iTask.task = iscsi_read10_iov_task(iscsilun->iscsi, iscsilun->lun, lba,
-                                           num_sectors * iscsilun->block_size,
-                                           iscsilun->block_size,
-                                           0, 0, 0, 0, 0,
-                                           iscsi_co_generic_cb, &iTask,
-                                           (struct scsi_iovec *)iov->iov, iov->niov);
-    }
-#else
        iTask.task = iscsi_read16_task(iscsilun->iscsi, iscsilun->lun, lba,
                                       num_sectors * iscsilun->block_size,
                                       iscsilun->block_size, 0, 0, 0, 0, 0,
@@ -840,13 +803,11 @@ retry:
                                       0, 0, 0, 0, 0,
                                       iscsi_co_generic_cb, &iTask);
    }
-#endif
    if (iTask.task == NULL) {
        return -ENOMEM;
    }
-#if LIBISCSI_API_VERSION < (20160603)
    scsi_task_set_iov_in(iTask.task, (struct scsi_iovec *) iov->iov, iov->niov);
-#endif
+
    while (!iTask.complete) {
        iscsi_set_events(iscsilun);
        qemu_coroutine_yield();
@@ -1650,13 +1611,7 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
        ret = -ENOMEM;
        goto out;
    }
-#if LIBISCSI_API_VERSION >= (20160603)
-    if (iscsi_init_transport(iscsi, iscsi_url->transport)) {
-        error_setg(errp, ("Error initializing transport."));
-        ret = -EINVAL;
-        goto out;
-    }
-#endif
+
    if (iscsi_set_targetname(iscsi, iscsi_url->target)) {
        error_setg(errp, "iSCSI: Failed to set target name.");
        ret = -EINVAL;
@@ -1699,7 +1654,7 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,

    /* timeout handling is broken in libiscsi before 1.15.0 */
    timeout = parse_timeout(iscsi_url->target);
-#if LIBISCSI_API_VERSION >= 20150621
+#if defined(LIBISCSI_API_VERSION) && LIBISCSI_API_VERSION >= 20150621
    iscsi_set_timeout(iscsi, timeout);
 #else
    if (timeout) {
@@ -2060,48 +2015,45 @@ static BlockDriver bdrv_iscsi = {
    .bdrv_attach_aio_context = iscsi_attach_aio_context,
 };

-#if LIBISCSI_API_VERSION >= (20160603)
-static BlockDriver bdrv_iser = {
-    .format_name     = "iser",
-    .protocol_name   = "iser",
-
-    .instance_size   = sizeof(IscsiLun),
-    .bdrv_needs_filename = true,
-    .bdrv_file_open  = iscsi_open,
-    .bdrv_close      = iscsi_close,
-    .bdrv_create     = iscsi_create,
-    .create_opts     = &iscsi_create_opts,
-    .bdrv_reopen_prepare   = iscsi_reopen_prepare,
-    .bdrv_reopen_commit    = iscsi_reopen_commit,
-    .bdrv_invalidate_cache = iscsi_invalidate_cache,
-
-    .bdrv_getlength  = iscsi_getlength,
-    .bdrv_get_info   = iscsi_get_info,
-    .bdrv_truncate   = iscsi_truncate,
-    .bdrv_refresh_limits = iscsi_refresh_limits,
-
-    .bdrv_co_get_block_status = iscsi_co_get_block_status,
-    .bdrv_co_pdiscard      = iscsi_co_pdiscard,
-    .bdrv_co_pwrite_zeroes = iscsi_co_pwrite_zeroes,
-    .bdrv_co_readv         = iscsi_co_readv,
-    .bdrv_co_writev_flags  = iscsi_co_writev_flags,
-    .bdrv_co_flush_to_disk = iscsi_co_flush,
-
-#ifdef __linux__
-    .bdrv_aio_ioctl   = iscsi_aio_ioctl,
-#endif
-
-    .bdrv_detach_aio_context = iscsi_detach_aio_context,
-    .bdrv_attach_aio_context = iscsi_attach_aio_context,
+static QemuOptsList qemu_iscsi_opts = {
+    .name = "iscsi",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_iscsi_opts.head),
+    .desc = {
+        {
+            .name = "user",
+            .type = QEMU_OPT_STRING,
+            .help = "username for CHAP authentication to target",
+        },{
+            .name = "password",
+            .type = QEMU_OPT_STRING,
+            .help = "password for CHAP authentication to target",
+        },{
+            .name = "password-secret",
+            .type = QEMU_OPT_STRING,
+            .help = "ID of the secret providing password for CHAP "
+                    "authentication to target",
+        },{
+            .name = "header-digest",
+            .type = QEMU_OPT_STRING,
+            .help = "HeaderDigest setting. "
+                    "{CRC32C|CRC32C-NONE|NONE-CRC32C|NONE}",
+        },{
+            .name = "initiator-name",
+            .type = QEMU_OPT_STRING,
+            .help = "Initiator iqn name to use when connecting",
+        },{
+            .name = "timeout",
+            .type = QEMU_OPT_NUMBER,
+            .help = "Request timeout in seconds (default 0 = no timeout)",
+        },
+        { /* end of list */ }
+    },
 };
-#endif

 static void iscsi_block_init(void)
 {
    bdrv_register(&bdrv_iscsi);
-#if LIBISCSI_API_VERSION >= (20160603)
-    bdrv_register(&bdrv_iser);
-#endif
+    qemu_add_opts(&qemu_iscsi_opts);
 }

 block_init(iscsi_block_init);
@@ -59,6 +59,7 @@ struct LinuxAioState {

    /* I/O completion processing */
    QEMUBH *completion_bh;
+    struct io_event events[MAX_EVENTS];
    int event_idx;
    int event_max;
 };
@@ -94,156 +95,64 @@ static void qemu_laio_process_completion(struct qemu_laiocb *laiocb)

    laiocb->ret = ret;
    if (laiocb->co) {
-        /* If the coroutine is already entered it must be in ioq_submit() and
-         * will notice laio->ret has been filled in when it eventually runs
-         * later.  Coroutines cannot be entered recursively so avoid doing
-         * that!
-         */
-        if (!qemu_coroutine_entered(laiocb->co)) {
-            qemu_coroutine_enter(laiocb->co);
-        }
+        qemu_coroutine_enter(laiocb->co);
    } else {
        laiocb->common.cb(laiocb->common.opaque, ret);
        qemu_aio_unref(laiocb);
    }
 }

-/**
- * aio_ring buffer which is shared between userspace and kernel.
- *
- * This copied from linux/fs/aio.c, common header does not exist
- * but AIO exists for ages so we assume ABI is stable.
- */
-struct aio_ring {
-    unsigned    id;    /* kernel internal index number */
-    unsigned    nr;    /* number of io_events */
-    unsigned    head;  /* Written to by userland or by kernel. */
-    unsigned    tail;
-
-    unsigned    magic;
-    unsigned    compat_features;
-    unsigned    incompat_features;
-    unsigned    header_length;  /* size of aio_ring */
-
-    struct io_event io_events[0];
-};
-
-/**
- * io_getevents_peek:
- * @ctx: AIO context
- * @events: pointer on events array, output value
-
- * Returns the number of completed events and sets a pointer
- * on events array.  This function does not update the internal
- * ring buffer, only reads head and tail.  When @events has been
- * processed io_getevents_commit() must be called.
- */
-static inline unsigned int io_getevents_peek(io_context_t ctx,
-                                             struct io_event **events)
-{
-    struct aio_ring *ring = (struct aio_ring *)ctx;
-    unsigned int head = ring->head, tail = ring->tail;
-    unsigned int nr;
-
-    nr = tail >= head ? tail - head : ring->nr - head;
-    *events = ring->io_events + head;
-    /* To avoid speculative loads of s->events[i] before observing tail.
-       Paired with smp_wmb() inside linux/fs/aio.c: aio_complete(). */
-    smp_rmb();
-
-    return nr;
-}
-
-/**
- * io_getevents_commit:
- * @ctx: AIO context
- * @nr: the number of events on which head should be advanced
- *
- * Advances head of a ring buffer.
- */
-static inline void io_getevents_commit(io_context_t ctx, unsigned int nr)
-{
-    struct aio_ring *ring = (struct aio_ring *)ctx;
-
-    if (nr) {
-        ring->head = (ring->head + nr) % ring->nr;
-    }
-}
-
-/**
- * io_getevents_advance_and_peek:
- * @ctx: AIO context
- * @events: pointer on events array, output value
- * @nr: the number of events on which head should be advanced
- *
- * Advances head of a ring buffer and returns number of elements left.
- */
-static inline unsigned int
-io_getevents_advance_and_peek(io_context_t ctx,
-                              struct io_event **events,
-                              unsigned int nr)
-{
-    io_getevents_commit(ctx, nr);
-    return io_getevents_peek(ctx, events);
-}
-
-/**
- * qemu_laio_process_completions:
- * @s: AIO state
- *
- * Fetches completed I/O requests and invokes their callbacks.
+/* The completion BH fetches completed I/O requests and invokes their
+ * callbacks.
 *
 * The function is somewhat tricky because it supports nested event loops, for
 * example when a request callback invokes aio_poll().  In order to do this,
- * indices are kept in LinuxAioState.  Function schedules BH completion so it
- * can be called again in a nested event loop.  When there are no events left
- * to complete the BH is being canceled.
+ * the completion events array and index are kept in LinuxAioState.  The BH
+ * reschedules itself as long as there are completions pending so it will
+ * either be called again in a nested event loop or will be called after all
+ * events have been completed.  When there are no events left to complete, the
+ * BH returns without rescheduling.
 */
-static void qemu_laio_process_completions(LinuxAioState *s)
-{
-    struct io_event *events;
-
-    /* Reschedule so nested event loops see currently pending completions */
-    qemu_bh_schedule(s->completion_bh);
-
-    while ((s->event_max = io_getevents_advance_and_peek(s->ctx, &events,
-                                                         s->event_idx))) {
-        for (s->event_idx = 0; s->event_idx < s->event_max; ) {
-            struct iocb *iocb = events[s->event_idx].obj;
-            struct qemu_laiocb *laiocb =
-                container_of(iocb, struct qemu_laiocb, iocb);
-
-            laiocb->ret = io_event_ret(&events[s->event_idx]);
-
-            /* Change counters one-by-one because we can be nested. */
-            s->io_q.in_flight--;
-            s->event_idx++;
-            qemu_laio_process_completion(laiocb);
-        }
-    }
-
-    qemu_bh_cancel(s->completion_bh);
-
-    /* If we are nested we have to notify the level above that we are done
-     * by setting event_max to zero, upper level will then jump out of it's
-     * own `for` loop.  If we are the last all counters droped to zero. */
-    s->event_max = 0;
-    s->event_idx = 0;
-}
-
-static void qemu_laio_process_completions_and_submit(LinuxAioState *s)
-{
-    qemu_laio_process_completions(s);
-    if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
-        ioq_submit(s);
-    }
-}
-
 static void qemu_laio_completion_bh(void *opaque)
 {
    LinuxAioState *s = opaque;

-    qemu_laio_process_completions_and_submit(s);
+    /* Fetch more completion events when empty */
+    if (s->event_idx == s->event_max) {
+        do {
+            struct timespec ts = { 0 };
+            s->event_max = io_getevents(s->ctx, MAX_EVENTS, MAX_EVENTS,
+                                        s->events, &ts);
+        } while (s->event_max == -EINTR);
+
+        s->event_idx = 0;
+        if (s->event_max <= 0) {
+            s->event_max = 0;
+            return; /* no more events */
+        }
+        s->io_q.in_flight -= s->event_max;
+    }
+
+    /* Reschedule so nested event loops see currently pending completions */
+    qemu_bh_schedule(s->completion_bh);
+
+    /* Process completion events */
+    while (s->event_idx < s->event_max) {
+        struct iocb *iocb = s->events[s->event_idx].obj;
+        struct qemu_laiocb *laiocb =
+                container_of(iocb, struct qemu_laiocb, iocb);
+
+        laiocb->ret = io_event_ret(&s->events[s->event_idx]);
+        s->event_idx++;
+
+        qemu_laio_process_completion(laiocb);
+    }
+
+    if (!s->io_q.plugged && !QSIMPLEQ_EMPTY(&s->io_q.pending)) {
+        ioq_submit(s);
+    }
+
+    qemu_bh_cancel(s->completion_bh);
 }

 static void qemu_laio_completion_cb(EventNotifier *e)
@@ -251,7 +160,7 @@ static void qemu_laio_completion_cb(EventNotifier *e)
    LinuxAioState *s = container_of(e, LinuxAioState, e);

    if (event_notifier_test_and_clear(&s->e)) {
-        qemu_laio_process_completions_and_submit(s);
+        qemu_laio_completion_bh(s);
    }
 }

@@ -327,19 +236,6 @@ static void ioq_submit(LinuxAioState *s)
        QSIMPLEQ_SPLIT_AFTER(&s->io_q.pending, aiocb, next, &completed);
    } while (ret == len && !QSIMPLEQ_EMPTY(&s->io_q.pending));
    s->io_q.blocked = (s->io_q.in_queue > 0);
-
-    if (s->io_q.in_flight) {
-        /* We can try to complete something just right away if there are
-         * still requests in-flight. */
-        qemu_laio_process_completions(s);
-        /*
-         * Even we have completed everything (in_flight == 0), the queue can
-         * have still pended requests (in_queue > 0).  We do not attempt to
-         * repeat submission to avoid IO hang.  The reason is simple: s->e is
-         * still set and completion callback will be called shortly and all
-         * pended requests will be submitted from there.
-         */
-    }
 }

 void laio_io_plug(BlockDriverState *bs, LinuxAioState *s)
@@ -397,7 +293,6 @@ int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
        .co         = qemu_coroutine_self(),
        .nbytes     = qiov->size,
        .ctx        = s,
-        .ret        = -EINPROGRESS,
        .is_read    = (type == QEMU_AIO_READ),
        .qiov       = qiov,
    };
@@ -407,9 +302,7 @@ int coroutine_fn laio_co_submit(BlockDriverState *bs, LinuxAioState *s, int fd,
        return ret;
    }

-    if (laiocb.ret == -EINPROGRESS) {
-        qemu_coroutine_yield();
-    }
+    qemu_coroutine_yield();
    return laiocb.ret;
 }

@@ -13,7 +13,7 @@

 #include "qemu/osdep.h"
 #include "trace.h"
-#include "block/blockjob_int.h"
+#include "block/blockjob.h"
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qapi/error.h"
@@ -55,7 +55,7 @@ typedef struct MirrorBlockJob {
    int64_t bdev_length;
    unsigned long *cow_bitmap;
    BdrvDirtyBitmap *dirty_bitmap;
-    BdrvDirtyBitmapIter *dbi;
+    HBitmapIter hbi;
    uint8_t *buf;
    QSIMPLEQ_HEAD(, MirrorBuffer) buf_free;
    int buf_free_count;
@@ -330,10 +330,10 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
    int max_io_sectors = MAX((s->buf_size >> BDRV_SECTOR_BITS) / MAX_IN_FLIGHT,
                             MAX_IO_SECTORS);

-    sector_num = bdrv_dirty_iter_next(s->dbi);
+    sector_num = hbitmap_iter_next(&s->hbi);
    if (sector_num < 0) {
-        bdrv_set_dirty_iter(s->dbi, 0);
-        sector_num = bdrv_dirty_iter_next(s->dbi);
+        bdrv_dirty_iter_init(s->dirty_bitmap, &s->hbi);
+        sector_num = hbitmap_iter_next(&s->hbi);
        trace_mirror_restart_iter(s, bdrv_get_dirty_count(s->dirty_bitmap));
        assert(sector_num >= 0);
    }
@@ -349,7 +349,7 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
    /* Find the number of consective dirty chunks following the first dirty
     * one, and wait for in flight requests in them. */
    while (nb_chunks * sectors_per_chunk < (s->buf_size >> BDRV_SECTOR_BITS)) {
-        int64_t next_dirty;
+        int64_t hbitmap_next;
        int64_t next_sector = sector_num + nb_chunks * sectors_per_chunk;
        int64_t next_chunk = next_sector / sectors_per_chunk;
        if (next_sector >= end ||
@@ -360,13 +360,13 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
            break;
        }

-        next_dirty = bdrv_dirty_iter_next(s->dbi);
-        if (next_dirty > next_sector || next_dirty < 0) {
+        hbitmap_next = hbitmap_iter_next(&s->hbi);
+        if (hbitmap_next > next_sector || hbitmap_next < 0) {
            /* The bitmap iterator's cache is stale, refresh it */
-            bdrv_set_dirty_iter(s->dbi, next_sector);
-            next_dirty = bdrv_dirty_iter_next(s->dbi);
+            bdrv_set_dirty_iter(&s->hbi, next_sector);
+            hbitmap_next = hbitmap_iter_next(&s->hbi);
        }
-        assert(next_dirty == next_sector);
+        assert(hbitmap_next == next_sector);
        nb_chunks++;
    }

@@ -469,11 +469,7 @@ static void mirror_free_init(MirrorBlockJob *s)
    }
 }

-/* This is also used for the .pause callback. There is no matching
- * mirror_resume() because mirror_run() will begin iterating again
- * when the job is resumed.
- */
-static void mirror_wait_for_all_io(MirrorBlockJob *s)
+static void mirror_drain(MirrorBlockJob *s)
 {
    while (s->in_flight > 0) {
        mirror_wait_for_io(s);
@@ -530,8 +526,8 @@ static void mirror_exit(BlockJob *job, void *opaque)
        aio_context_release(replace_aio_context);
    }
    g_free(s->replaces);
+    bdrv_op_unblock_all(target_bs, s->common.blocker);
    blk_unref(s->target);
-    s->target = NULL;
    block_job_completed(&s->common, data->ret);
    g_free(data);
    bdrv_drained_end(src);
@@ -586,7 +582,7 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
            sector_num += nb_sectors;
        }

-        mirror_wait_for_all_io(s);
+        mirror_drain(s);
    }

    /* First part, loop on the sectors and initialize the dirty bitmap.  */
@@ -615,27 +611,12 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
    return 0;
 }

-/* Called when going out of the streaming phase to flush the bulk of the
- * data to the medium, or just before completing.
- */
-static int mirror_flush(MirrorBlockJob *s)
-{
-    int ret = blk_flush(s->target);
-    if (ret < 0) {
-        if (mirror_error_action(s, false, -ret) == BLOCK_ERROR_ACTION_REPORT) {
-            s->ret = ret;
-        }
-    }
-    return ret;
-}
-
 static void coroutine_fn mirror_run(void *opaque)
 {
    MirrorBlockJob *s = opaque;
    MirrorExitData *data;
    BlockDriverState *bs = blk_bs(s->common.blk);
    BlockDriverState *target_bs = blk_bs(s->target);
-    bool need_drain = true;
    int64_t length;
    BlockDriverInfo bdi;
    char backing_filename[2]; /* we only need 2 characters because we are only
@@ -698,8 +679,7 @@ static void coroutine_fn mirror_run(void *opaque)
        }
    }

-    assert(!s->dbi);
-    s->dbi = bdrv_dirty_iter_new(s->dirty_bitmap, 0);
+    bdrv_dirty_iter_init(s->dirty_bitmap, &s->hbi);
    for (;;) {
        uint64_t delay_ns = 0;
        int64_t cnt, delta;
@@ -741,23 +721,27 @@ static void coroutine_fn mirror_run(void *opaque)
        should_complete = false;
        if (s->in_flight == 0 && cnt == 0) {
            trace_mirror_before_flush(s);
-            if (!s->synced) {
-                if (mirror_flush(s) < 0) {
-                    /* Go check s->ret.  */
-                    continue;
+            ret = blk_flush(s->target);
+            if (ret < 0) {
+                if (mirror_error_action(s, false, -ret) ==
+                    BLOCK_ERROR_ACTION_REPORT) {
+                    goto immediate_exit;
                }
+            } else {
                /* We're out of the streaming phase.  From now on, if the job
                 * is cancelled we will actually complete all pending I/O and
                 * report completion.  This way, block-job-cancel will leave
                 * the target in a consistent state.
                 */
-                block_job_event_ready(&s->common);
-                s->synced = true;
-            }
+                if (!s->synced) {
+                    block_job_event_ready(&s->common);
+                    s->synced = true;
+                }

-            should_complete = s->should_complete ||
-                block_job_is_cancelled(&s->common);
-            cnt = bdrv_get_dirty_count(s->dirty_bitmap);
+                should_complete = s->should_complete ||
+                    block_job_is_cancelled(&s->common);
+                cnt = bdrv_get_dirty_count(s->dirty_bitmap);
+            }
        }

        if (cnt == 0 && should_complete) {
@@ -767,26 +751,11 @@ static void coroutine_fn mirror_run(void *opaque)
             * source has dirty data to copy!
             *
             * Note that I/O can be submitted by the guest while
-             * mirror_populate runs, so pause it now.  Before deciding
-             * whether to switch to target check one last time if I/O has
-             * come in the meanwhile, and if not flush the data to disk.
+             * mirror_populate runs.
             */
            trace_mirror_before_drain(s, cnt);
-
-            bdrv_drained_begin(bs);
+            bdrv_co_drain(bs);
            cnt = bdrv_get_dirty_count(s->dirty_bitmap);
-            if (cnt > 0 || mirror_flush(s) < 0) {
-                bdrv_drained_end(bs);
-                continue;
-            }
-
-            /* The two disks are in sync.  Exit and report successful
-             * completion.
-             */
-            assert(QLIST_EMPTY(&bs->tracked_requests));
-            s->common.cancelled = false;
-            need_drain = false;
-            break;
        }

        ret = 0;
@@ -799,6 +768,13 @@ static void coroutine_fn mirror_run(void *opaque)
        } else if (!should_complete) {
            delay_ns = (s->in_flight == 0 && cnt == 0 ? SLICE_TIME : 0);
            block_job_sleep_ns(&s->common, QEMU_CLOCK_REALTIME, delay_ns);
+        } else if (cnt == 0) {
+            /* The two disks are in sync.  Exit and report successful
+             * completion.
+             */
+            assert(QLIST_EMPTY(&bs->tracked_requests));
+            s->common.cancelled = false;
+            break;
        }
        s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
    }
@@ -810,23 +786,20 @@ immediate_exit:
         * the target is a copy of the source.
         */
        assert(ret < 0 || (!s->synced && block_job_is_cancelled(&s->common)));
-        assert(need_drain);
-        mirror_wait_for_all_io(s);
+        mirror_drain(s);
    }

    assert(s->in_flight == 0);
    qemu_vfree(s->buf);
    g_free(s->cow_bitmap);
    g_free(s->in_flight_bitmap);
-    bdrv_dirty_iter_free(s->dbi);
    bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);

    data = g_malloc(sizeof(*data));
    data->ret = ret;
-
-    if (need_drain) {
-        bdrv_drained_begin(bs);
-    }
+    /* Before we switch to target in mirror_exit, make sure data doesn't
+     * change. */
+    bdrv_drained_begin(bs);
    block_job_defer_to_main_loop(&s->common, mirror_exit, data);
 }

@@ -897,11 +870,14 @@ static void mirror_complete(BlockJob *job, Error **errp)
    block_job_enter(&s->common);
 }

-static void mirror_pause(BlockJob *job)
+/* There is no matching mirror_resume() because mirror_run() will begin
+ * iterating again when the job is resumed.
+ */
+static void coroutine_fn mirror_pause(BlockJob *job)
 {
    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);

-    mirror_wait_for_all_io(s);
+    mirror_drain(s);
 }

 static void mirror_attached_aio_context(BlockJob *job, AioContext *new_context)
@@ -911,47 +887,28 @@ static void mirror_attached_aio_context(BlockJob *job, AioContext *new_context)
    blk_set_aio_context(s->target, new_context);
 }

-static void mirror_drain(BlockJob *job)
-{
-    MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
-
-    /* Need to keep a reference in case blk_drain triggers execution
-     * of mirror_complete...
-     */
-    if (s->target) {
-        BlockBackend *target = s->target;
-        blk_ref(target);
-        blk_drain(target);
-        blk_unref(target);
-    }
-}
-
 static const BlockJobDriver mirror_job_driver = {
    .instance_size          = sizeof(MirrorBlockJob),
    .job_type               = BLOCK_JOB_TYPE_MIRROR,
    .set_speed              = mirror_set_speed,
-    .start                  = mirror_run,
    .complete               = mirror_complete,
    .pause                  = mirror_pause,
    .attached_aio_context   = mirror_attached_aio_context,
-    .drain                  = mirror_drain,
 };

 static const BlockJobDriver commit_active_job_driver = {
    .instance_size          = sizeof(MirrorBlockJob),
    .job_type               = BLOCK_JOB_TYPE_COMMIT,
    .set_speed              = mirror_set_speed,
-    .start                  = mirror_run,
    .complete               = mirror_complete,
    .pause                  = mirror_pause,
    .attached_aio_context   = mirror_attached_aio_context,
-    .drain                  = mirror_drain,
 };

 static void mirror_start_job(const char *job_id, BlockDriverState *bs,
-                             int creation_flags, BlockDriverState *target,
-                             const char *replaces, int64_t speed,
-                             uint32_t granularity, int64_t buf_size,
+                             BlockDriverState *target, const char *replaces,
+                             int64_t speed, uint32_t granularity,
+                             int64_t buf_size,
                             BlockMirrorBackingMode backing_mode,
                             BlockdevOnError on_source_error,
                             BlockdevOnError on_target_error,
@@ -959,8 +916,7 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
                             BlockCompletionFunc *cb,
                             void *opaque, Error **errp,
                             const BlockJobDriver *driver,
-                             bool is_none_mode, BlockDriverState *base,
-                             bool auto_complete)
+                             bool is_none_mode, BlockDriverState *base)
 {
    MirrorBlockJob *s;

@@ -979,8 +935,7 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
        buf_size = DEFAULT_MIRROR_BUF_SIZE;
    }

-    s = block_job_create(job_id, driver, bs, speed, creation_flags,
-                         cb, opaque, errp);
+    s = block_job_create(job_id, driver, bs, speed, cb, opaque, errp);
    if (!s) {
        return;
    }
@@ -997,9 +952,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
    s->granularity = granularity;
    s->buf_size = ROUND_UP(buf_size, granularity);
    s->unmap = unmap;
-    if (auto_complete) {
-        s->should_complete = true;
-    }

    s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, NULL, errp);
    if (!s->dirty_bitmap) {
@@ -1009,18 +961,11 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
        return;
    }

-    block_job_add_bdrv(&s->common, target);
-    /* In commit_active_start() all intermediate nodes disappear, so
-     * any jobs in them must be blocked */
-    if (bdrv_chain_contains(bs, target)) {
-        BlockDriverState *iter;
-        for (iter = backing_bs(bs); iter != target; iter = backing_bs(iter)) {
-            block_job_add_bdrv(&s->common, iter);
-        }
-    }
+    bdrv_op_block_all(target, s->common.blocker);

-    trace_mirror_start(bs, s, opaque);
-    block_job_start(&s->common);
+    s->common.co = qemu_coroutine_create(mirror_run, s);
+    trace_mirror_start(bs, s, s->common.co, opaque);
+    qemu_coroutine_enter(s->common.co);
 }

 void mirror_start(const char *job_id, BlockDriverState *bs,
@@ -1029,7 +974,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                  MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
                  BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
-                  bool unmap, Error **errp)
+                  bool unmap,
+                  BlockCompletionFunc *cb,
+                  void *opaque, Error **errp)
 {
    bool is_none_mode;
    BlockDriverState *base;
@@ -1040,17 +987,17 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
    }
    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
    base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;
-    mirror_start_job(job_id, bs, BLOCK_JOB_DEFAULT, target, replaces,
+    mirror_start_job(job_id, bs, target, replaces,
                     speed, granularity, buf_size, backing_mode,
-                     on_source_error, on_target_error, unmap, NULL, NULL, errp,
-                     &mirror_job_driver, is_none_mode, base, false);
+                     on_source_error, on_target_error, unmap, cb, opaque, errp,
+                     &mirror_job_driver, is_none_mode, base);
 }

 void commit_active_start(const char *job_id, BlockDriverState *bs,
-                         BlockDriverState *base, int creation_flags,
-                         int64_t speed, BlockdevOnError on_error,
-                         BlockCompletionFunc *cb, void *opaque, Error **errp,
-                         bool auto_complete)
+                         BlockDriverState *base, int64_t speed,
+                         BlockdevOnError on_error,
+                         BlockCompletionFunc *cb,
+                         void *opaque, Error **errp)
 {
    int64_t length, base_length;
    int orig_base_flags;
@@ -1088,10 +1035,10 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,
        }
    }

-    mirror_start_job(job_id, bs, creation_flags, base, NULL, speed, 0, 0,
+    mirror_start_job(job_id, bs, base, NULL, speed, 0, 0,
                     MIRROR_LEAVE_BACKING_CHAIN,
-                     on_error, on_error, true, cb, opaque, &local_err,
-                     &commit_active_job_driver, false, base, auto_complete);
+                     on_error, on_error, false, cb, opaque, &local_err,
+                     &commit_active_job_driver, false, base);
    if (local_err) {
        error_propagate(errp, local_err);
        goto error_restore_flags;
@@ -1,7 +1,6 @@
 /*
 * QEMU Block driver for  NBD
 *
- * Copyright (C) 2016 Red Hat, Inc.
 * Copyright (C) 2008 Bull S.A.S.
 *     Author: Laurent Vivier <Laurent.Vivier@bull.net>
 *
@@ -33,7 +32,7 @@
 #define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
 #define INDEX_TO_HANDLE(bs, index)  ((index)  ^ ((uint64_t)(intptr_t)bs))

-static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
+static void nbd_recv_coroutines_enter_all(NbdClientSession *s)
 {
    int i;

@@ -46,7 +45,7 @@ static void nbd_recv_coroutines_enter_all(NBDClientSession *s)

 static void nbd_teardown_connection(BlockDriverState *bs)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
+    NbdClientSession *client = nbd_get_client_session(bs);

    if (!client->ioc) { /* Already closed */
        return;
@@ -68,7 +67,7 @@ static void nbd_teardown_connection(BlockDriverState *bs)
 static void nbd_reply_ready(void *opaque)
 {
    BlockDriverState *bs = opaque;
-    NBDClientSession *s = nbd_get_client_session(bs);
+    NbdClientSession *s = nbd_get_client_session(bs);
    uint64_t i;
    int ret;

@@ -116,10 +115,10 @@ static void nbd_restart_write(void *opaque)
 }

 static int nbd_co_send_request(BlockDriverState *bs,
-                               NBDRequest *request,
+                               struct nbd_request *request,
                               QEMUIOVector *qiov)
 {
-    NBDClientSession *s = nbd_get_client_session(bs);
+    NbdClientSession *s = nbd_get_client_session(bs);
    AioContext *aio_context;
    int rc, ret, i;

@@ -167,9 +166,9 @@ static int nbd_co_send_request(BlockDriverState *bs,
    return rc;
 }

-static void nbd_co_receive_reply(NBDClientSession *s,
-                                 NBDRequest *request,
-                                 NBDReply *reply,
+static void nbd_co_receive_reply(NbdClientSession *s,
+                                 struct nbd_request *request,
+                                 struct nbd_reply *reply,
                                 QEMUIOVector *qiov)
 {
    int ret;
@@ -195,13 +194,13 @@ static void nbd_co_receive_reply(NBDClientSession *s,
    }
 }

-static void nbd_coroutine_start(NBDClientSession *s,
-                                NBDRequest *request)
+static void nbd_coroutine_start(NbdClientSession *s,
+   struct nbd_request *request)
 {
    /* Poor man semaphore.  The free_sema is locked when no other request
     * can be accepted, and unlocked after receiving one reply.  */
-    if (s->in_flight == MAX_NBD_REQUESTS) {
-        qemu_co_queue_wait(&s->free_sema);
+    if (s->in_flight >= MAX_NBD_REQUESTS - 1) {
+        qemu_co_mutex_lock(&s->free_sema);
        assert(s->in_flight < MAX_NBD_REQUESTS);
    }
    s->in_flight++;
@@ -209,26 +208,26 @@ static void nbd_coroutine_start(NBDClientSession *s,
    /* s->recv_coroutine[i] is set as soon as we get the send_lock.  */
 }

-static void nbd_coroutine_end(NBDClientSession *s,
-                              NBDRequest *request)
+static void nbd_coroutine_end(NbdClientSession *s,
+    struct nbd_request *request)
 {
    int i = HANDLE_TO_INDEX(s, request->handle);
    s->recv_coroutine[i] = NULL;
    if (s->in_flight-- == MAX_NBD_REQUESTS) {
-        qemu_co_queue_next(&s->free_sema);
+        qemu_co_mutex_unlock(&s->free_sema);
    }
 }

 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = {
+    NbdClientSession *client = nbd_get_client_session(bs);
+    struct nbd_request request = {
        .type = NBD_CMD_READ,
        .from = offset,
        .len = bytes,
    };
-    NBDReply reply;
+    struct nbd_reply reply;
    ssize_t ret;

    assert(bytes <= NBD_MAX_BUFFER_SIZE);
@@ -248,18 +247,18 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
                          uint64_t bytes, QEMUIOVector *qiov, int flags)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = {
+    NbdClientSession *client = nbd_get_client_session(bs);
+    struct nbd_request request = {
        .type = NBD_CMD_WRITE,
        .from = offset,
        .len = bytes,
    };
-    NBDReply reply;
+    struct nbd_reply reply;
    ssize_t ret;

    if (flags & BDRV_REQ_FUA) {
        assert(client->nbdflags & NBD_FLAG_SEND_FUA);
-        request.flags |= NBD_CMD_FLAG_FUA;
+        request.type |= NBD_CMD_FLAG_FUA;
    }

    assert(bytes <= NBD_MAX_BUFFER_SIZE);
@@ -275,46 +274,11 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
    return -reply.error;
 }

-int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-                                int count, BdrvRequestFlags flags)
-{
-    ssize_t ret;
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = {
-        .type = NBD_CMD_WRITE_ZEROES,
-        .from = offset,
-        .len = count,
-    };
-    NBDReply reply;
-
-    if (!(client->nbdflags & NBD_FLAG_SEND_WRITE_ZEROES)) {
-        return -ENOTSUP;
-    }
-
-    if (flags & BDRV_REQ_FUA) {
-        assert(client->nbdflags & NBD_FLAG_SEND_FUA);
-        request.flags |= NBD_CMD_FLAG_FUA;
-    }
-    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
-        request.flags |= NBD_CMD_FLAG_NO_HOLE;
-    }
-
-    nbd_coroutine_start(client, &request);
-    ret = nbd_co_send_request(bs, &request, NULL);
-    if (ret < 0) {
-        reply.error = -ret;
-    } else {
-        nbd_co_receive_reply(client, &request, &reply, NULL);
-    }
-    nbd_coroutine_end(client, &request);
-    return -reply.error;
-}
-
 int nbd_client_co_flush(BlockDriverState *bs)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = { .type = NBD_CMD_FLUSH };
-    NBDReply reply;
+    NbdClientSession *client = nbd_get_client_session(bs);
+    struct nbd_request request = { .type = NBD_CMD_FLUSH };
+    struct nbd_reply reply;
    ssize_t ret;

    if (!(client->nbdflags & NBD_FLAG_SEND_FLUSH)) {
@@ -337,13 +301,13 @@ int nbd_client_co_flush(BlockDriverState *bs)

 int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = {
+    NbdClientSession *client = nbd_get_client_session(bs);
+    struct nbd_request request = {
        .type = NBD_CMD_TRIM,
        .from = offset,
        .len = count,
    };
-    NBDReply reply;
+    struct nbd_reply reply;
    ssize_t ret;

    if (!(client->nbdflags & NBD_FLAG_SEND_TRIM)) {
@@ -378,8 +342,12 @@ void nbd_client_attach_aio_context(BlockDriverState *bs,

 void nbd_client_close(BlockDriverState *bs)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
-    NBDRequest request = { .type = NBD_CMD_DISC };
+    NbdClientSession *client = nbd_get_client_session(bs);
+    struct nbd_request request = {
+        .type = NBD_CMD_DISC,
+        .from = 0,
+        .len = 0
+    };

    if (client->ioc == NULL) {
        return;
@@ -397,7 +365,7 @@ int nbd_client_init(BlockDriverState *bs,
                    const char *hostname,
                    Error **errp)
 {
-    NBDClientSession *client = nbd_get_client_session(bs);
+    NbdClientSession *client = nbd_get_client_session(bs);
    int ret;

    /* NBD handshake */
@@ -415,14 +383,10 @@ int nbd_client_init(BlockDriverState *bs,
    }
    if (client->nbdflags & NBD_FLAG_SEND_FUA) {
        bs->supported_write_flags = BDRV_REQ_FUA;
-        bs->supported_zero_flags |= BDRV_REQ_FUA;
-    }
-    if (client->nbdflags & NBD_FLAG_SEND_WRITE_ZEROES) {
-        bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
    }

    qemu_co_mutex_init(&client->send_mutex);
-    qemu_co_queue_init(&client->free_sema);
+    qemu_co_mutex_init(&client->free_sema);
    client->sioc = sioc;
    object_ref(OBJECT(client->sioc));

@@ -17,24 +17,24 @@

 #define MAX_NBD_REQUESTS    16

-typedef struct NBDClientSession {
+typedef struct NbdClientSession {
    QIOChannelSocket *sioc; /* The master data channel */
    QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
    uint16_t nbdflags;
    off_t size;

    CoMutex send_mutex;
-    CoQueue free_sema;
+    CoMutex free_sema;
    Coroutine *send_coroutine;
    int in_flight;

    Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
-    NBDReply reply;
+    struct nbd_reply reply;

    bool is_unix;
-} NBDClientSession;
+} NbdClientSession;

-NBDClientSession *nbd_get_client_session(BlockDriverState *bs);
+NbdClientSession *nbd_get_client_session(BlockDriverState *bs);

 int nbd_client_init(BlockDriverState *bs,
                    QIOChannelSocket *sock,
@@ -48,8 +48,6 @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count);
 int nbd_client_co_flush(BlockDriverState *bs);
 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
                          uint64_t bytes, QEMUIOVector *qiov, int flags);
-int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-                                int count, BdrvRequestFlags flags);
 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags);

@@ -32,9 +32,6 @@
 #include "qemu/uri.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
-#include "qapi-visit.h"
-#include "qapi/qobject-input-visitor.h"
-#include "qapi/qobject-output-visitor.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qint.h"
@@ -44,11 +41,10 @@
 #define EN_OPTSTR ":exportname="

 typedef struct BDRVNBDState {
-    NBDClientSession client;
+    NbdClientSession client;

    /* For nbd_refresh_filename() */
-    SocketAddress *saddr;
-    char *export, *tlscredsid;
+    char *path, *host, *port, *export, *tlscredsid;
 } BDRVNBDState;

 static int nbd_parse_uri(const char *filename, QDict *options)
@@ -94,13 +90,9 @@ static int nbd_parse_uri(const char *filename, QDict *options)
            ret = -EINVAL;
            goto out;
        }
-        qdict_put(options, "server.type", qstring_from_str("unix"));
-        qdict_put(options, "server.data.path",
-                  qstring_from_str(qp->p[0].value));
+        qdict_put(options, "path", qstring_from_str(qp->p[0].value));
    } else {
        QString *host;
-        char *port_str;
-
        /* nbd[+tcp]://host[:port]/export */
        if (!uri->server) {
            ret = -EINVAL;
@@ -115,12 +107,12 @@ static int nbd_parse_uri(const char *filename, QDict *options)
            host = qstring_from_str(uri->server);
        }

-        qdict_put(options, "server.type", qstring_from_str("inet"));
-        qdict_put(options, "server.data.host", host);
-
-        port_str = g_strdup_printf("%d", uri->port ?: NBD_DEFAULT_PORT);
-        qdict_put(options, "server.data.port", qstring_from_str(port_str));
-        g_free(port_str);
+        qdict_put(options, "host", host);
+        if (uri->port) {
+            char* port_str = g_strdup_printf("%d", uri->port);
+            qdict_put(options, "port", qstring_from_str(port_str));
+            g_free(port_str);
+        }
    }

 out:
@@ -131,26 +123,6 @@ out:
    return ret;
 }

-static bool nbd_has_filename_options_conflict(QDict *options, Error **errp)
-{
-    const QDictEntry *e;
-
-    for (e = qdict_first(options); e; e = qdict_next(options, e)) {
-        if (!strcmp(e->key, "host") ||
-            !strcmp(e->key, "port") ||
-            !strcmp(e->key, "path") ||
-            !strcmp(e->key, "export") ||
-            strstart(e->key, "server.", NULL))
-        {
-            error_setg(errp, "Option '%s' cannot be used with a file name",
-                       e->key);
-            return true;
-        }
-    }
-
-    return false;
-}
-
 static void nbd_parse_filename(const char *filename, QDict *options,
                               Error **errp)
 {
@@ -159,7 +131,12 @@ static void nbd_parse_filename(const char *filename, QDict *options,
    const char *host_spec;
    const char *unixpath;

-    if (nbd_has_filename_options_conflict(options, errp)) {
+    if (qdict_haskey(options, "host")
+        || qdict_haskey(options, "port")
+        || qdict_haskey(options, "path"))
+    {
+        error_setg(errp, "host/port/path and a file name may not be specified "
+                         "at the same time");
        return;
    }

@@ -196,8 +173,7 @@ static void nbd_parse_filename(const char *filename, QDict *options,

    /* are we a UNIX or TCP socket? */
    if (strstart(host_spec, "unix:", &unixpath)) {
-        qdict_put(options, "server.type", qstring_from_str("unix"));
-        qdict_put(options, "server.data.path", qstring_from_str(unixpath));
+        qdict_put(options, "path", qstring_from_str(unixpath));
    } else {
        InetSocketAddress *addr = NULL;

@@ -206,9 +182,8 @@ static void nbd_parse_filename(const char *filename, QDict *options,
            goto out;
        }

-        qdict_put(options, "server.type", qstring_from_str("inet"));
-        qdict_put(options, "server.data.host", qstring_from_str(addr->host));
-        qdict_put(options, "server.data.port", qstring_from_str(addr->port));
+        qdict_put(options, "host", qstring_from_str(addr->host));
+        qdict_put(options, "port", qstring_from_str(addr->port));
        qapi_free_InetSocketAddress(addr);
    }

@@ -216,85 +191,51 @@ out:
    g_free(file);
 }

-static bool nbd_process_legacy_socket_options(QDict *output_options,
-                                              QemuOpts *legacy_opts,
-                                              Error **errp)
+static SocketAddress *nbd_config(BDRVNBDState *s, QemuOpts *opts, Error **errp)
 {
-    const char *path = qemu_opt_get(legacy_opts, "path");
-    const char *host = qemu_opt_get(legacy_opts, "host");
-    const char *port = qemu_opt_get(legacy_opts, "port");
-    const QDictEntry *e;
+    SocketAddress *saddr;

-    if (!path && !host && !port) {
-        return true;
-    }
+    s->path = g_strdup(qemu_opt_get(opts, "path"));
+    s->host = g_strdup(qemu_opt_get(opts, "host"));

-    for (e = qdict_first(output_options); e; e = qdict_next(output_options, e))
-    {
-        if (strstart(e->key, "server.", NULL)) {
-            error_setg(errp, "Cannot use 'server' and path/host/port at the "
-                       "same time");
-            return false;
+    if (!s->path == !s->host) {
+        if (s->path) {
+            error_setg(errp, "path and host may not be used at the same time.");
+        } else {
+            error_setg(errp, "one of path and host must be specified.");
        }
+        return NULL;
    }

-    if (path && host) {
-        error_setg(errp, "path and host may not be used at the same time");
-        return false;
-    } else if (path) {
-        if (port) {
-            error_setg(errp, "port may not be used without host");
-            return false;
+    saddr = g_new0(SocketAddress, 1);
+
+    if (s->path) {
+        UnixSocketAddress *q_unix;
+        saddr->type = SOCKET_ADDRESS_KIND_UNIX;
+        q_unix = saddr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
+        q_unix->path = g_strdup(s->path);
+    } else {
+        InetSocketAddress *inet;
+
+        s->port = g_strdup(qemu_opt_get(opts, "port"));
+
+        saddr->type = SOCKET_ADDRESS_KIND_INET;
+        inet = saddr->u.inet.data = g_new0(InetSocketAddress, 1);
+        inet->host = g_strdup(s->host);
+        inet->port = g_strdup(s->port);
+        if (!inet->port) {
+            inet->port = g_strdup_printf("%d", NBD_DEFAULT_PORT);
        }
-
-        qdict_put(output_options, "server.type", qstring_from_str("unix"));
-        qdict_put(output_options, "server.data.path", qstring_from_str(path));
-    } else if (host) {
-        qdict_put(output_options, "server.type", qstring_from_str("inet"));
-        qdict_put(output_options, "server.data.host", qstring_from_str(host));
-        qdict_put(output_options, "server.data.port",
-                  qstring_from_str(port ?: stringify(NBD_DEFAULT_PORT)));
-    }
-
-    return true;
-}
-
-static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options, Error **errp)
-{
-    SocketAddress *saddr = NULL;
-    QDict *addr = NULL;
-    QObject *crumpled_addr = NULL;
-    Visitor *iv = NULL;
-    Error *local_err = NULL;
-
-    qdict_extract_subqdict(options, &addr, "server.");
-    if (!qdict_size(addr)) {
-        error_setg(errp, "NBD server address missing");
-        goto done;
-    }
-
-    crumpled_addr = qdict_crumple(addr, errp);
-    if (!crumpled_addr) {
-        goto done;
-    }
-
-    iv = qobject_input_visitor_new(crumpled_addr, true);
-    visit_type_SocketAddress(iv, NULL, &saddr, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        goto done;
    }

    s->client.is_unix = saddr->type == SOCKET_ADDRESS_KIND_UNIX;

-done:
-    QDECREF(addr);
-    qobject_decref(crumpled_addr);
-    visit_free(iv);
+    s->export = g_strdup(qemu_opt_get(opts, "export"));
+
    return saddr;
 }

-NBDClientSession *nbd_get_client_session(BlockDriverState *bs)
+NbdClientSession *nbd_get_client_session(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;
    return &s->client;
@@ -307,7 +248,6 @@ static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
    Error *local_err = NULL;

    sioc = qio_channel_socket_new();
-    qio_channel_set_name(QIO_CHANNEL(sioc), "nbd-client");

    qio_channel_socket_connect_sync(sioc,
                                    saddr,
@@ -392,6 +332,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
    QemuOpts *opts = NULL;
    Error *local_err = NULL;
    QIOChannelSocket *sioc = NULL;
+    SocketAddress *saddr = NULL;
    QCryptoTLSCreds *tlscreds = NULL;
    const char *hostname = NULL;
    int ret = -EINVAL;
@@ -403,19 +344,12 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        goto error;
    }

-    /* Translate @host, @port, and @path to a SocketAddress */
-    if (!nbd_process_legacy_socket_options(options, opts, errp)) {
-        goto error;
-    }
-
    /* Pop the config into our state object. Exit if invalid. */
-    s->saddr = nbd_config(s, options, errp);
-    if (!s->saddr) {
+    saddr = nbd_config(s, opts, errp);
+    if (!saddr) {
        goto error;
    }

-    s->export = g_strdup(qemu_opt_get(opts, "export"));
-
    s->tlscredsid = g_strdup(qemu_opt_get(opts, "tls-creds"));
    if (s->tlscredsid) {
        tlscreds = nbd_get_tls_creds(s->tlscredsid, errp);
@@ -423,17 +357,17 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
            goto error;
        }

-        if (s->saddr->type != SOCKET_ADDRESS_KIND_INET) {
+        if (saddr->type != SOCKET_ADDRESS_KIND_INET) {
            error_setg(errp, "TLS only supported over IP sockets");
            goto error;
        }
-        hostname = s->saddr->u.inet.data->host;
+        hostname = saddr->u.inet.data->host;
    }

    /* establish TCP connection, return error if it fails
     * TODO: Configurable retry-until-timeout behaviour.
     */
-    sioc = nbd_establish_connection(s->saddr, errp);
+    sioc = nbd_establish_connection(saddr, errp);
    if (!sioc) {
        ret = -ECONNREFUSED;
        goto error;
@@ -450,10 +384,13 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        object_unref(OBJECT(tlscreds));
    }
    if (ret < 0) {
-        qapi_free_SocketAddress(s->saddr);
+        g_free(s->path);
+        g_free(s->host);
+        g_free(s->port);
        g_free(s->export);
        g_free(s->tlscredsid);
    }
+    qapi_free_SocketAddress(saddr);
    qemu_opts_del(opts);
    return ret;
 }
@@ -466,7 +403,6 @@ static int nbd_co_flush(BlockDriverState *bs)
 static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)
 {
    bs->bl.max_pdiscard = NBD_MAX_BUFFER_SIZE;
-    bs->bl.max_pwrite_zeroes = NBD_MAX_BUFFER_SIZE;
    bs->bl.max_transfer = NBD_MAX_BUFFER_SIZE;
 }

@@ -476,7 +412,9 @@ static void nbd_close(BlockDriverState *bs)

    nbd_client_close(bs);

-    qapi_free_SocketAddress(s->saddr);
+    g_free(s->path);
+    g_free(s->host);
+    g_free(s->port);
    g_free(s->export);
    g_free(s->tlscredsid);
 }
@@ -503,52 +441,45 @@ static void nbd_refresh_filename(BlockDriverState *bs, QDict *options)
 {
    BDRVNBDState *s = bs->opaque;
    QDict *opts = qdict_new();
-    QObject *saddr_qdict;
-    Visitor *ov;
-    const char *host = NULL, *port = NULL, *path = NULL;

-    if (s->saddr->type == SOCKET_ADDRESS_KIND_INET) {
-        const InetSocketAddress *inet = s->saddr->u.inet.data;
-        if (!inet->has_ipv4 && !inet->has_ipv6 && !inet->has_to) {
-            host = inet->host;
-            port = inet->port;
-        }
-    } else if (s->saddr->type == SOCKET_ADDRESS_KIND_UNIX) {
-        path = s->saddr->u.q_unix.data->path;
+    qdict_put_obj(opts, "driver", QOBJECT(qstring_from_str("nbd")));
+
+    if (s->path && s->export) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd+unix:///%s?socket=%s", s->export, s->path);
+    } else if (s->path && !s->export) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd+unix://?socket=%s", s->path);
+    } else if (!s->path && s->export && s->port) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd://%s:%s/%s", s->host, s->port, s->export);
+    } else if (!s->path && s->export && !s->port) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd://%s/%s", s->host, s->export);
+    } else if (!s->path && !s->export && s->port) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd://%s:%s", s->host, s->port);
+    } else if (!s->path && !s->export && !s->port) {
+        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+                 "nbd://%s", s->host);
    }

-    qdict_put(opts, "driver", qstring_from_str("nbd"));
-
-    if (path && s->export) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nbd+unix:///%s?socket=%s", s->export, path);
-    } else if (path && !s->export) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nbd+unix://?socket=%s", path);
-    } else if (host && s->export) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nbd://%s:%s/%s", host, port, s->export);
-    } else if (host && !s->export) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nbd://%s:%s", host, port);
+    if (s->path) {
+        qdict_put_obj(opts, "path", QOBJECT(qstring_from_str(s->path)));
+    } else if (s->port) {
+        qdict_put_obj(opts, "host", QOBJECT(qstring_from_str(s->host)));
+        qdict_put_obj(opts, "port", QOBJECT(qstring_from_str(s->port)));
+    } else {
+        qdict_put_obj(opts, "host", QOBJECT(qstring_from_str(s->host)));
    }
-
-    ov = qobject_output_visitor_new(&saddr_qdict);
-    visit_type_SocketAddress(ov, NULL, &s->saddr, &error_abort);
-    visit_complete(ov, &saddr_qdict);
-    visit_free(ov);
-    assert(qobject_type(saddr_qdict) == QTYPE_QDICT);
-
-    qdict_put_obj(opts, "server", saddr_qdict);
-
    if (s->export) {
-        qdict_put(opts, "export", qstring_from_str(s->export));
+        qdict_put_obj(opts, "export", QOBJECT(qstring_from_str(s->export)));
    }
    if (s->tlscredsid) {
-        qdict_put(opts, "tls-creds", qstring_from_str(s->tlscredsid));
+        qdict_put_obj(opts, "tls-creds",
+                      QOBJECT(qstring_from_str(s->tlscredsid)));
    }

-    qdict_flatten(opts);
    bs->full_open_options = opts;
 }

@@ -560,7 +491,6 @@ static BlockDriver bdrv_nbd = {
    .bdrv_file_open             = nbd_open,
    .bdrv_co_preadv             = nbd_client_co_preadv,
    .bdrv_co_pwritev            = nbd_client_co_pwritev,
-    .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
    .bdrv_close                 = nbd_close,
    .bdrv_co_flush_to_os        = nbd_co_flush,
    .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
@@ -579,7 +509,6 @@ static BlockDriver bdrv_nbd_tcp = {
    .bdrv_file_open             = nbd_open,
    .bdrv_co_preadv             = nbd_client_co_preadv,
    .bdrv_co_pwritev            = nbd_client_co_pwritev,
-    .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
    .bdrv_close                 = nbd_close,
    .bdrv_co_flush_to_os        = nbd_co_flush,
    .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
@@ -598,7 +527,6 @@ static BlockDriver bdrv_nbd_unix = {
    .bdrv_file_open             = nbd_open,
    .bdrv_co_preadv             = nbd_client_co_preadv,
    .bdrv_co_pwritev            = nbd_client_co_pwritev,
-    .bdrv_co_pwrite_zeroes      = nbd_client_co_pwrite_zeroes,
    .bdrv_close                 = nbd_close,
    .bdrv_co_flush_to_os        = nbd_co_flush,
    .bdrv_co_pdiscard           = nbd_client_co_pdiscard,
@@ -35,15 +35,8 @@
 #include "qemu/uri.h"
 #include "qemu/cutils.h"
 #include "sysemu/sysemu.h"
-#include "qapi/qmp/qdict.h"
-#include "qapi/qmp/qint.h"
-#include "qapi/qmp/qstring.h"
-#include "qapi-visit.h"
-#include "qapi/qobject-input-visitor.h"
-#include "qapi/qobject-output-visitor.h"
 #include <nfsc/libnfs.h>

-
 #define QEMU_NFS_MAX_READAHEAD_SIZE 1048576
 #define QEMU_NFS_MAX_PAGECACHE_SIZE (8388608 / NFS_BLKSIZE)
 #define QEMU_NFS_MAX_DEBUG_LEVEL 2
@@ -56,138 +49,18 @@ typedef struct NFSClient {
    AioContext *aio_context;
    blkcnt_t st_blocks;
    bool cache_used;
-    NFSServer *server;
-    char *path;
-    int64_t uid, gid, tcp_syncnt, readahead, pagecache, debug;
 } NFSClient;

 typedef struct NFSRPC {
-    BlockDriverState *bs;
    int ret;
    int complete;
    QEMUIOVector *iov;
    struct stat *st;
    Coroutine *co;
+    QEMUBH *bh;
    NFSClient *client;
 } NFSRPC;

-static int nfs_parse_uri(const char *filename, QDict *options, Error **errp)
-{
-    URI *uri = NULL;
-    QueryParams *qp = NULL;
-    int ret = -EINVAL, i;
-
-    uri = uri_parse(filename);
-    if (!uri) {
-        error_setg(errp, "Invalid URI specified");
-        goto out;
-    }
-    if (strcmp(uri->scheme, "nfs") != 0) {
-        error_setg(errp, "URI scheme must be 'nfs'");
-        goto out;
-    }
-
-    if (!uri->server) {
-        error_setg(errp, "missing hostname in URI");
-        goto out;
-    }
-
-    if (!uri->path) {
-        error_setg(errp, "missing file path in URI");
-        goto out;
-    }
-
-    qp = query_params_parse(uri->query);
-    if (!qp) {
-        error_setg(errp, "could not parse query parameters");
-        goto out;
-    }
-
-    qdict_put(options, "server.host", qstring_from_str(uri->server));
-    qdict_put(options, "server.type", qstring_from_str("inet"));
-    qdict_put(options, "path", qstring_from_str(uri->path));
-
-    for (i = 0; i < qp->n; i++) {
-        unsigned long long val;
-        if (!qp->p[i].value) {
-            error_setg(errp, "Value for NFS parameter expected: %s",
-                       qp->p[i].name);
-            goto out;
-        }
-        if (parse_uint_full(qp->p[i].value, &val, 0)) {
-            error_setg(errp, "Illegal value for NFS parameter: %s",
-                       qp->p[i].name);
-            goto out;
-        }
-        if (!strcmp(qp->p[i].name, "uid")) {
-            qdict_put(options, "user",
-                      qstring_from_str(qp->p[i].value));
-        } else if (!strcmp(qp->p[i].name, "gid")) {
-            qdict_put(options, "group",
-                      qstring_from_str(qp->p[i].value));
-        } else if (!strcmp(qp->p[i].name, "tcp-syncnt")) {
-            qdict_put(options, "tcp-syn-count",
-                      qstring_from_str(qp->p[i].value));
-        } else if (!strcmp(qp->p[i].name, "readahead")) {
-            qdict_put(options, "readahead-size",
-                      qstring_from_str(qp->p[i].value));
-        } else if (!strcmp(qp->p[i].name, "pagecache")) {
-            qdict_put(options, "page-cache-size",
-                      qstring_from_str(qp->p[i].value));
-        } else if (!strcmp(qp->p[i].name, "debug")) {
-            qdict_put(options, "debug",
-                      qstring_from_str(qp->p[i].value));
-        } else {
-            error_setg(errp, "Unknown NFS parameter name: %s",
-                       qp->p[i].name);
-            goto out;
-        }
-    }
-    ret = 0;
-out:
-    if (qp) {
-        query_params_free(qp);
-    }
-    if (uri) {
-        uri_free(uri);
-    }
-    return ret;
-}
-
-static bool nfs_has_filename_options_conflict(QDict *options, Error **errp)
-{
-    const QDictEntry *qe;
-
-    for (qe = qdict_first(options); qe; qe = qdict_next(options, qe)) {
-        if (!strcmp(qe->key, "host") ||
-            !strcmp(qe->key, "path") ||
-            !strcmp(qe->key, "user") ||
-            !strcmp(qe->key, "group") ||
-            !strcmp(qe->key, "tcp-syn-count") ||
-            !strcmp(qe->key, "readahead-size") ||
-            !strcmp(qe->key, "page-cache-size") ||
-            !strcmp(qe->key, "debug") ||
-            strstart(qe->key, "server.", NULL))
-        {
-            error_setg(errp, "Option %s cannot be used with a filename",
-                       qe->key);
-            return true;
-        }
-    }
-
-    return false;
-}
-
-static void nfs_parse_filename(const char *filename, QDict *options,
-                               Error **errp)
-{
-    if (nfs_has_filename_options_conflict(options, errp)) {
-        return;
-    }
-
-    nfs_parse_uri(filename, options, errp);
-}
-
 static void nfs_process_read(void *arg);
 static void nfs_process_write(void *arg);

@@ -218,12 +91,11 @@ static void nfs_process_write(void *arg)
    nfs_set_events(client);
 }

-static void nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
+static void nfs_co_init_task(NFSClient *client, NFSRPC *task)
 {
    *task = (NFSRPC) {
        .co             = qemu_coroutine_self(),
-        .bs             = bs,
-        .client         = bs->opaque,
+        .client         = client,
    };
 }

@@ -231,6 +103,7 @@ static void nfs_co_generic_bh_cb(void *opaque)
 {
    NFSRPC *task = opaque;
    task->complete = 1;
+    qemu_bh_delete(task->bh);
    qemu_coroutine_enter(task->co);
 }

@@ -240,7 +113,6 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
 {
    NFSRPC *task = private_data;
    task->ret = ret;
-    assert(!task->st);
    if (task->ret > 0 && task->iov) {
        if (task->ret <= task->iov->size) {
            qemu_iovec_from_buf(task->iov, 0, data, task->ret);
@@ -248,11 +120,19 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
            task->ret = -EIO;
        }
    }
+    if (task->ret == 0 && task->st) {
+        memcpy(task->st, data, sizeof(struct stat));
+    }
    if (task->ret < 0) {
        error_report("NFS Error: %s", nfs_get_error(nfs));
    }
-    aio_bh_schedule_oneshot(task->client->aio_context,
-                            nfs_co_generic_bh_cb, task);
+    if (task->co) {
+        task->bh = aio_bh_new(task->client->aio_context,
+                              nfs_co_generic_bh_cb, task);
+        qemu_bh_schedule(task->bh);
+    } else {
+        task->complete = 1;
+    }
 }

 static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
@@ -262,7 +142,7 @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
    NFSClient *client = bs->opaque;
    NFSRPC task;

-    nfs_co_init_task(bs, &task);
+    nfs_co_init_task(client, &task);
    task.iov = iov;

    if (nfs_pread_async(client->context, client->fh,
@@ -272,8 +152,8 @@ static int coroutine_fn nfs_co_readv(BlockDriverState *bs,
        return -ENOMEM;
    }

-    nfs_set_events(client);
    while (!task.complete) {
+        nfs_set_events(client);
        qemu_coroutine_yield();
    }

@@ -297,7 +177,7 @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
    NFSRPC task;
    char *buf = NULL;

-    nfs_co_init_task(bs, &task);
+    nfs_co_init_task(client, &task);

    buf = g_try_malloc(nb_sectors * BDRV_SECTOR_SIZE);
    if (nb_sectors && buf == NULL) {
@@ -314,8 +194,8 @@ static int coroutine_fn nfs_co_writev(BlockDriverState *bs,
        return -ENOMEM;
    }

-    nfs_set_events(client);
    while (!task.complete) {
+        nfs_set_events(client);
        qemu_coroutine_yield();
    }

@@ -333,59 +213,30 @@ static int coroutine_fn nfs_co_flush(BlockDriverState *bs)
    NFSClient *client = bs->opaque;
    NFSRPC task;

-    nfs_co_init_task(bs, &task);
+    nfs_co_init_task(client, &task);

    if (nfs_fsync_async(client->context, client->fh, nfs_co_generic_cb,
                        &task) != 0) {
        return -ENOMEM;
    }

-    nfs_set_events(client);
    while (!task.complete) {
+        nfs_set_events(client);
        qemu_coroutine_yield();
    }

    return task.ret;
 }

+/* TODO Convert to fine grained options */
 static QemuOptsList runtime_opts = {
    .name = "nfs",
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
    .desc = {
        {
-            .name = "path",
+            .name = "filename",
            .type = QEMU_OPT_STRING,
-            .help = "Path of the image on the host",
-        },
-        {
-            .name = "user",
-            .type = QEMU_OPT_NUMBER,
-            .help = "UID value to use when talking to the server",
-        },
-        {
-            .name = "group",
-            .type = QEMU_OPT_NUMBER,
-            .help = "GID value to use when talking to the server",
-        },
-        {
-            .name = "tcp-syn-count",
-            .type = QEMU_OPT_NUMBER,
-            .help = "Number of SYNs to send during the session establish",
-        },
-        {
-            .name = "readahead-size",
-            .type = QEMU_OPT_NUMBER,
-            .help = "Set the readahead size in bytes",
-        },
-        {
-            .name = "page-cache-size",
-            .type = QEMU_OPT_NUMBER,
-            .help = "Set the pagecache size in bytes",
-        },
-        {
-            .name = "debug",
-            .type = QEMU_OPT_NUMBER,
-            .help = "Set the NFS debug level (max 2)",
+            .help = "URL to the NFS file",
        },
        { /* end of list */ }
    },
@@ -428,65 +279,25 @@ static void nfs_file_close(BlockDriverState *bs)
    nfs_client_close(client);
 }

-static NFSServer *nfs_config(QDict *options, Error **errp)
-{
-    NFSServer *server = NULL;
-    QDict *addr = NULL;
-    QObject *crumpled_addr = NULL;
-    Visitor *iv = NULL;
-    Error *local_error = NULL;
-
-    qdict_extract_subqdict(options, &addr, "server.");
-    if (!qdict_size(addr)) {
-        error_setg(errp, "NFS server address missing");
-        goto out;
-    }
-
-    crumpled_addr = qdict_crumple(addr, errp);
-    if (!crumpled_addr) {
-        goto out;
-    }
-
-    iv = qobject_input_visitor_new(crumpled_addr, true);
-    visit_type_NFSServer(iv, NULL, &server, &local_error);
-    if (local_error) {
-        error_propagate(errp, local_error);
-        goto out;
-    }
-
-out:
-    QDECREF(addr);
-    qobject_decref(crumpled_addr);
-    visit_free(iv);
-    return server;
-}
-
-
-static int64_t nfs_client_open(NFSClient *client, QDict *options,
+static int64_t nfs_client_open(NFSClient *client, const char *filename,
                               int flags, Error **errp, int open_flags)
 {
-    int ret = -EINVAL;
-    QemuOpts *opts = NULL;
-    Error *local_err = NULL;
+    int ret = -EINVAL, i;
    struct stat st;
+    URI *uri;
+    QueryParams *qp = NULL;
    char *file = NULL, *strp = NULL;

-    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
+    uri = uri_parse(filename);
+    if (!uri) {
+        error_setg(errp, "Invalid URL specified");
        goto fail;
    }
-
-    client->path = g_strdup(qemu_opt_get(opts, "path"));
-    if (!client->path) {
-        ret = -EINVAL;
-        error_setg(errp, "No path was specified");
+    if (!uri->server) {
+        error_setg(errp, "Invalid URL specified");
        goto fail;
    }
-
-    strp = strrchr(client->path, '/');
+    strp = strrchr(uri->path, '/');
    if (strp == NULL) {
        error_setg(errp, "Invalid URL specified");
        goto fail;
@@ -494,89 +305,85 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options,
    file = g_strdup(strp);
    *strp = 0;

-    /* Pop the config into our state object, Exit if invalid */
-    client->server = nfs_config(options, errp);
-    if (!client->server) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
    client->context = nfs_init_context();
    if (client->context == NULL) {
        error_setg(errp, "Failed to init NFS context");
        goto fail;
    }

-    if (qemu_opt_get(opts, "user")) {
-        client->uid = qemu_opt_get_number(opts, "user", 0);
-        nfs_set_uid(client->context, client->uid);
-    }
-
-    if (qemu_opt_get(opts, "group")) {
-        client->gid = qemu_opt_get_number(opts, "group", 0);
-        nfs_set_gid(client->context, client->gid);
-    }
-
-    if (qemu_opt_get(opts, "tcp-syn-count")) {
-        client->tcp_syncnt = qemu_opt_get_number(opts, "tcp-syn-count", 0);
-        nfs_set_tcp_syncnt(client->context, client->tcp_syncnt);
-    }
-
+    qp = query_params_parse(uri->query);
+    for (i = 0; i < qp->n; i++) {
+        unsigned long long val;
+        if (!qp->p[i].value) {
+            error_setg(errp, "Value for NFS parameter expected: %s",
+                       qp->p[i].name);
+            goto fail;
+        }
+        if (parse_uint_full(qp->p[i].value, &val, 0)) {
+            error_setg(errp, "Illegal value for NFS parameter: %s",
+                       qp->p[i].name);
+            goto fail;
+        }
+        if (!strcmp(qp->p[i].name, "uid")) {
+            nfs_set_uid(client->context, val);
+        } else if (!strcmp(qp->p[i].name, "gid")) {
+            nfs_set_gid(client->context, val);
+        } else if (!strcmp(qp->p[i].name, "tcp-syncnt")) {
+            nfs_set_tcp_syncnt(client->context, val);
 #ifdef LIBNFS_FEATURE_READAHEAD
-    if (qemu_opt_get(opts, "readahead-size")) {
-        if (open_flags & BDRV_O_NOCACHE) {
-            error_setg(errp, "Cannot enable NFS readahead "
-                             "if cache.direct = on");
-            goto fail;
-        }
-        client->readahead = qemu_opt_get_number(opts, "readahead-size", 0);
-        if (client->readahead > QEMU_NFS_MAX_READAHEAD_SIZE) {
-            error_report("NFS Warning: Truncating NFS readahead "
-                         "size to %d", QEMU_NFS_MAX_READAHEAD_SIZE);
-            client->readahead = QEMU_NFS_MAX_READAHEAD_SIZE;
-        }
-        nfs_set_readahead(client->context, client->readahead);
+        } else if (!strcmp(qp->p[i].name, "readahead")) {
+            if (open_flags & BDRV_O_NOCACHE) {
+                error_setg(errp, "Cannot enable NFS readahead "
+                                 "if cache.direct = on");
+                goto fail;
+            }
+            if (val > QEMU_NFS_MAX_READAHEAD_SIZE) {
+                error_report("NFS Warning: Truncating NFS readahead"
+                             " size to %d", QEMU_NFS_MAX_READAHEAD_SIZE);
+                val = QEMU_NFS_MAX_READAHEAD_SIZE;
+            }
+            nfs_set_readahead(client->context, val);
 #ifdef LIBNFS_FEATURE_PAGECACHE
-        nfs_set_pagecache_ttl(client->context, 0);
+            nfs_set_pagecache_ttl(client->context, 0);
 #endif
-        client->cache_used = true;
-    }
+            client->cache_used = true;
 #endif
-
 #ifdef LIBNFS_FEATURE_PAGECACHE
-    if (qemu_opt_get(opts, "page-cache-size")) {
-        if (open_flags & BDRV_O_NOCACHE) {
-            error_setg(errp, "Cannot enable NFS pagecache "
-                             "if cache.direct = on");
-            goto fail;
-        }
-        client->pagecache = qemu_opt_get_number(opts, "page-cache-size", 0);
-        if (client->pagecache > QEMU_NFS_MAX_PAGECACHE_SIZE) {
-            error_report("NFS Warning: Truncating NFS pagecache "
-                         "size to %d pages", QEMU_NFS_MAX_PAGECACHE_SIZE);
-            client->pagecache = QEMU_NFS_MAX_PAGECACHE_SIZE;
-        }
-        nfs_set_pagecache(client->context, client->pagecache);
-        nfs_set_pagecache_ttl(client->context, 0);
-        client->cache_used = true;
-    }
+            nfs_set_pagecache_ttl(client->context, 0);
+        } else if (!strcmp(qp->p[i].name, "pagecache")) {
+            if (open_flags & BDRV_O_NOCACHE) {
+                error_setg(errp, "Cannot enable NFS pagecache "
+                                 "if cache.direct = on");
+                goto fail;
+            }
+            if (val > QEMU_NFS_MAX_PAGECACHE_SIZE) {
+                error_report("NFS Warning: Truncating NFS pagecache"
+                             " size to %d pages", QEMU_NFS_MAX_PAGECACHE_SIZE);
+                val = QEMU_NFS_MAX_PAGECACHE_SIZE;
+            }
+            nfs_set_pagecache(client->context, val);
+            nfs_set_pagecache_ttl(client->context, 0);
+            client->cache_used = true;
 #endif
-
 #ifdef LIBNFS_FEATURE_DEBUG
-    if (qemu_opt_get(opts, "debug")) {
-        client->debug = qemu_opt_get_number(opts, "debug", 0);
-        /* limit the maximum debug level to avoid potential flooding
-         * of our log files. */
-        if (client->debug > QEMU_NFS_MAX_DEBUG_LEVEL) {
-            error_report("NFS Warning: Limiting NFS debug level "
-                         "to %d", QEMU_NFS_MAX_DEBUG_LEVEL);
-            client->debug = QEMU_NFS_MAX_DEBUG_LEVEL;
-        }
-        nfs_set_debug(client->context, client->debug);
-    }
+        } else if (!strcmp(qp->p[i].name, "debug")) {
+            /* limit the maximum debug level to avoid potential flooding
+             * of our log files. */
+            if (val > QEMU_NFS_MAX_DEBUG_LEVEL) {
+                error_report("NFS Warning: Limiting NFS debug level"
+                             " to %d", QEMU_NFS_MAX_DEBUG_LEVEL);
+                val = QEMU_NFS_MAX_DEBUG_LEVEL;
+            }
+            nfs_set_debug(client->context, val);
 #endif
+        } else {
+            error_setg(errp, "Unknown NFS parameter name: %s",
+                       qp->p[i].name);
+            goto fail;
+        }
+    }

-    ret = nfs_mount(client->context, client->server->host, client->path);
+    ret = nfs_mount(client->context, uri->server, uri->path);
    if (ret < 0) {
        error_setg(errp, "Failed to mount nfs share: %s",
                   nfs_get_error(client->context));
@@ -609,13 +416,14 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options,
    ret = DIV_ROUND_UP(st.st_size, BDRV_SECTOR_SIZE);
    client->st_blocks = st.st_blocks;
    client->has_zero_init = S_ISREG(st.st_mode);
-    *strp = '/';
    goto out;
-
 fail:
    nfs_client_close(client);
 out:
-    qemu_opts_del(opts);
+    if (qp) {
+        query_params_free(qp);
+    }
+    uri_free(uri);
    g_free(file);
    return ret;
 }
@@ -624,17 +432,28 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp) {
    NFSClient *client = bs->opaque;
    int64_t ret;
+    QemuOpts *opts;
+    Error *local_err = NULL;

    client->aio_context = bdrv_get_aio_context(bs);

-    ret = nfs_client_open(client, options,
+    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        ret = -EINVAL;
+        goto out;
+    }
+    ret = nfs_client_open(client, qemu_opt_get(opts, "filename"),
                          (flags & BDRV_O_RDWR) ? O_RDWR : O_RDONLY,
                          errp, bs->open_flags);
    if (ret < 0) {
-        return ret;
+        goto out;
    }
    bs->total_sectors = ret;
    ret = 0;
+out:
+    qemu_opts_del(opts);
    return ret;
 }

@@ -656,7 +475,6 @@ static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
    int ret = 0;
    int64_t total_size = 0;
    NFSClient *client = g_new0(NFSClient, 1);
-    QDict *options = NULL;

    client->aio_context = qemu_get_aio_context();

@@ -664,20 +482,13 @@ static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                          BDRV_SECTOR_SIZE);

-    options = qdict_new();
-    ret = nfs_parse_uri(url, options, errp);
-    if (ret < 0) {
-        goto out;
-    }
-
-    ret = nfs_client_open(client, options, O_CREAT, errp, 0);
+    ret = nfs_client_open(client, url, O_CREAT, errp, 0);
    if (ret < 0) {
        goto out;
    }
    ret = nfs_ftruncate(client->context, client->fh, total_size);
    nfs_client_close(client);
 out:
-    QDECREF(options);
    g_free(client);
    return ret;
 }
@@ -688,22 +499,6 @@ static int nfs_has_zero_init(BlockDriverState *bs)
    return client->has_zero_init;
 }

-static void
-nfs_get_allocated_file_size_cb(int ret, struct nfs_context *nfs, void *data,
-                               void *private_data)
-{
-    NFSRPC *task = private_data;
-    task->ret = ret;
-    if (task->ret == 0) {
-        memcpy(task->st, data, sizeof(struct stat));
-    }
-    if (task->ret < 0) {
-        error_report("NFS Error: %s", nfs_get_error(nfs));
-    }
-    task->complete = 1;
-    bdrv_wakeup(task->bs);
-}
-
 static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
 {
    NFSClient *client = bs->opaque;
@@ -715,15 +510,16 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
        return client->st_blocks * 512;
    }

-    task.bs = bs;
    task.st = &st;
-    if (nfs_fstat_async(client->context, client->fh, nfs_get_allocated_file_size_cb,
+    if (nfs_fstat_async(client->context, client->fh, nfs_co_generic_cb,
                        &task) != 0) {
        return -ENOMEM;
    }

-    nfs_set_events(client);
-    BDRV_POLL_WHILE(bs, !task.complete);
+    while (!task.complete) {
+        nfs_set_events(client);
+        aio_poll(client->aio_context, true);
+    }

    return (task.ret < 0 ? task.ret : st.st_blocks * 512);
 }
@@ -768,67 +564,6 @@ static int nfs_reopen_prepare(BDRVReopenState *state,
    return 0;
 }

-static void nfs_refresh_filename(BlockDriverState *bs, QDict *options)
-{
-    NFSClient *client = bs->opaque;
-    QDict *opts = qdict_new();
-    QObject *server_qdict;
-    Visitor *ov;
-
-    qdict_put(opts, "driver", qstring_from_str("nfs"));
-
-    if (client->uid && !client->gid) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nfs://%s%s?uid=%" PRId64, client->server->host, client->path,
-                 client->uid);
-    } else if (!client->uid && client->gid) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nfs://%s%s?gid=%" PRId64, client->server->host, client->path,
-                 client->gid);
-    } else if (client->uid && client->gid) {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nfs://%s%s?uid=%" PRId64 "&gid=%" PRId64,
-                 client->server->host, client->path, client->uid, client->gid);
-    } else {
-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-                 "nfs://%s%s", client->server->host, client->path);
-    }
-
-    ov = qobject_output_visitor_new(&server_qdict);
-    visit_type_NFSServer(ov, NULL, &client->server, &error_abort);
-    visit_complete(ov, &server_qdict);
-    assert(qobject_type(server_qdict) == QTYPE_QDICT);
-
-    qdict_put_obj(opts, "server", server_qdict);
-    qdict_put(opts, "path", qstring_from_str(client->path));
-
-    if (client->uid) {
-        qdict_put(opts, "user", qint_from_int(client->uid));
-    }
-    if (client->gid) {
-        qdict_put(opts, "group", qint_from_int(client->gid));
-    }
-    if (client->tcp_syncnt) {
-        qdict_put(opts, "tcp-syn-cnt",
-                  qint_from_int(client->tcp_syncnt));
-    }
-    if (client->readahead) {
-        qdict_put(opts, "readahead-size",
-                  qint_from_int(client->readahead));
-    }
-    if (client->pagecache) {
-        qdict_put(opts, "page-cache-size",
-                  qint_from_int(client->pagecache));
-    }
-    if (client->debug) {
-        qdict_put(opts, "debug", qint_from_int(client->debug));
-    }
-
-    visit_free(ov);
-    qdict_flatten(opts);
-    bs->full_open_options = opts;
-}
-
 #ifdef LIBNFS_FEATURE_PAGECACHE
 static void nfs_invalidate_cache(BlockDriverState *bs,
                                 Error **errp)
@@ -843,7 +578,7 @@ static BlockDriver bdrv_nfs = {
    .protocol_name                  = "nfs",

    .instance_size                  = sizeof(NFSClient),
-    .bdrv_parse_filename            = nfs_parse_filename,
+    .bdrv_needs_filename            = true,
    .create_opts                    = &nfs_create_opts,

    .bdrv_has_zero_init             = nfs_has_zero_init,
@@ -861,7 +596,6 @@ static BlockDriver bdrv_nfs = {

    .bdrv_detach_aio_context        = nfs_detach_aio_context,
    .bdrv_attach_aio_context        = nfs_attach_aio_context,
-    .bdrv_refresh_filename          = nfs_refresh_filename,

 #ifdef LIBNFS_FEATURE_PAGECACHE
    .bdrv_invalidate_cache          = nfs_invalidate_cache,
@@ -124,6 +124,7 @@ static coroutine_fn int null_co_flush(BlockDriverState *bs)

 typedef struct {
    BlockAIOCB common;
+    QEMUBH *bh;
    QEMUTimer timer;
 } NullAIOCB;

@@ -135,6 +136,7 @@ static void null_bh_cb(void *opaque)
 {
    NullAIOCB *acb = opaque;
    acb->common.cb(acb->common.opaque, 0);
+    qemu_bh_delete(acb->bh);
    qemu_aio_unref(acb);
 }

@@ -162,7 +164,8 @@ static inline BlockAIOCB *null_aio_common(BlockDriverState *bs,
        timer_mod_ns(&acb->timer,
                     qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + s->latency_ns);
    } else {
-        aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), null_bh_cb, acb);
+        acb->bh = aio_bh_new(bdrv_get_aio_context(bs), null_bh_cb, acb);
+        qemu_bh_schedule(acb->bh);
    }
    return &acb->common;
 }
@@ -29,7 +29,7 @@
 #include "block/write-threshold.h"
 #include "qmp-commands.h"
 #include "qapi-visit.h"
-#include "qapi/qobject-output-visitor.h"
+#include "qapi/qmp-output-visitor.h"
 #include "qapi/qmp/types.h"
 #include "sysemu/block-backend.h"
 #include "qemu/cutils.h"
@@ -691,14 +691,13 @@ void bdrv_image_info_specific_dump(fprintf_function func_fprintf, void *f,
                                   ImageInfoSpecific *info_spec)
 {
    QObject *obj, *data;
-    Visitor *v = qobject_output_visitor_new(&obj);
+    Visitor *v = qmp_output_visitor_new(&obj);

    visit_type_ImageInfoSpecific(v, NULL, &info_spec, &error_abort);
    visit_complete(v, &obj);
    assert(qobject_type(obj) == QTYPE_QDICT);
    data = qdict_get(qobject_to_qdict(obj), "data");
    dump_qobject(func_fprintf, f, 1, data);
-    qobject_decref(obj);
    visit_free(v);
 }

@@ -153,8 +153,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
        ret = -EINVAL;
        goto fail;
    }
-    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128,
-                                 QCRYPTO_CIPHER_MODE_CBC)) {
+    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128)) {
        error_setg(errp, "AES cipher not available");
        ret = -EINVAL;
        goto fail;
@@ -914,32 +913,75 @@ static int qcow_make_empty(BlockDriverState *bs)
    return 0;
 }

+typedef struct QcowWriteCo {
+    BlockDriverState *bs;
+    int64_t sector_num;
+    const uint8_t *buf;
+    int nb_sectors;
+    int ret;
+} QcowWriteCo;
+
+static void qcow_write_co_entry(void *opaque)
+{
+    QcowWriteCo *co = opaque;
+    QEMUIOVector qiov;
+
+    struct iovec iov = (struct iovec) {
+        .iov_base   = (uint8_t*) co->buf,
+        .iov_len    = co->nb_sectors * BDRV_SECTOR_SIZE,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
+    co->ret = qcow_co_writev(co->bs, co->sector_num, co->nb_sectors, &qiov);
+}
+
+/* Wrapper for non-coroutine contexts */
+static int qcow_write(BlockDriverState *bs, int64_t sector_num,
+                      const uint8_t *buf, int nb_sectors)
+{
+    Coroutine *co;
+    AioContext *aio_context = bdrv_get_aio_context(bs);
+    QcowWriteCo data = {
+        .bs         = bs,
+        .sector_num = sector_num,
+        .buf        = buf,
+        .nb_sectors = nb_sectors,
+        .ret        = -EINPROGRESS,
+    };
+    co = qemu_coroutine_create(qcow_write_co_entry, &data);
+    qemu_coroutine_enter(co);
+    while (data.ret == -EINPROGRESS) {
+        aio_poll(aio_context, true);
+    }
+    return data.ret;
+}
+
 /* XXX: put compressed sectors first, then all the cluster aligned
   tables to avoid losing bytes in alignment */
-static coroutine_fn int
-qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-                           uint64_t bytes, QEMUIOVector *qiov)
+static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                                 const uint8_t *buf, int nb_sectors)
 {
    BDRVQcowState *s = bs->opaque;
-    QEMUIOVector hd_qiov;
-    struct iovec iov;
    z_stream strm;
    int ret, out_len;
-    uint8_t *buf, *out_buf;
+    uint8_t *out_buf;
    uint64_t cluster_offset;

-    buf = qemu_blockalign(bs, s->cluster_size);
-    if (bytes != s->cluster_size) {
-        if (bytes > s->cluster_size ||
-            offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
-        {
-            qemu_vfree(buf);
-            return -EINVAL;
-        }
+    if (nb_sectors != s->cluster_sectors) {
+        ret = -EINVAL;
+
        /* Zero-pad last write if image size is not cluster aligned */
-        memset(buf + bytes, 0, s->cluster_size - bytes);
+        if (sector_num + nb_sectors == bs->total_sectors &&
+            nb_sectors < s->cluster_sectors) {
+            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
+            memset(pad_buf, 0, s->cluster_size);
+            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
+            ret = qcow_write_compressed(bs, sector_num,
+                                        pad_buf, s->cluster_sectors);
+            qemu_vfree(pad_buf);
+        }
+        return ret;
    }
-    qemu_iovec_to_buf(qiov, 0, buf, qiov->size);

    out_buf = g_malloc(s->cluster_size);

@@ -970,35 +1012,27 @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = qcow_co_writev(bs, offset >> BDRV_SECTOR_BITS,
-                             bytes >> BDRV_SECTOR_BITS, qiov);
+        ret = qcow_write(bs, sector_num, buf, s->cluster_sectors);
        if (ret < 0) {
            goto fail;
        }
-        goto success;
-    }
-    qemu_co_mutex_lock(&s->lock);
-    cluster_offset = get_cluster_offset(bs, offset, 2, out_len, 0, 0);
-    qemu_co_mutex_unlock(&s->lock);
-    if (cluster_offset == 0) {
-        ret = -EIO;
-        goto fail;
-    }
-    cluster_offset &= s->cluster_offset_mask;
+    } else {
+        cluster_offset = get_cluster_offset(bs, sector_num << 9, 2,
+                                            out_len, 0, 0);
+        if (cluster_offset == 0) {
+            ret = -EIO;
+            goto fail;
+        }

-    iov = (struct iovec) {
-        .iov_base   = out_buf,
-        .iov_len    = out_len,
-    };
-    qemu_iovec_init_external(&hd_qiov, &iov, 1);
-    ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
-    if (ret < 0) {
-        goto fail;
+        cluster_offset &= s->cluster_offset_mask;
+        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
+        if (ret < 0) {
+            goto fail;
+        }
    }
-success:
+
    ret = 0;
 fail:
-    qemu_vfree(buf);
    g_free(out_buf);
    return ret;
 }
@@ -1051,7 +1085,7 @@ static BlockDriver bdrv_qcow = {

    .bdrv_set_key           = qcow_set_key,
    .bdrv_make_empty        = qcow_make_empty,
-    .bdrv_co_pwritev_compressed = qcow_co_pwritev_compressed,
+    .bdrv_write_compressed  = qcow_write_compressed,
    .bdrv_get_info          = qcow_get_info,

    .create_opts            = &qcow_create_opts,
@@ -22,6 +22,7 @@
 * THE SOFTWARE.
 */

+/* Needed for CONFIG_MADVISE */
 #include "qemu/osdep.h"
 #include "block/block_int.h"
 #include "qemu-common.h"
@@ -65,8 +66,7 @@ static inline int qcow2_cache_get_table_idx(BlockDriverState *bs,
 static void qcow2_cache_table_release(BlockDriverState *bs, Qcow2Cache *c,
                                      int i, int num_tables)
 {
-/* Using MADV_DONTNEED to discard memory is a Linux-specific feature */
-#ifdef CONFIG_LINUX
+#if QEMU_MADV_DONTNEED != QEMU_MADV_INVALID
    BDRVQcow2State *s = bs->opaque;
    void *t = qcow2_cache_get_table_addr(bs, c, i);
    int align = getpagesize();
@@ -74,7 +74,7 @@ static void qcow2_cache_table_release(BlockDriverState *bs, Qcow2Cache *c,
    size_t offset = QEMU_ALIGN_UP((uintptr_t) t, align) - (uintptr_t) t;
    size_t length = QEMU_ALIGN_DOWN(mem_size - offset, align);
    if (length > 0) {
-        madvise((uint8_t *) t + offset, length, MADV_DONTNEED);
+        qemu_madvise((uint8_t *) t + offset, length, QEMU_MADV_DONTNEED);
    }
 #endif
 }
@@ -83,9 +83,7 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
    }
    memset(new_l1_table, 0, align_offset(new_l1_size2, 512));

-    if (s->l1_size) {
-        memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));
-    }
+    memcpy(new_l1_table, s->l1_table, s->l1_size * sizeof(uint64_t));

    /* write new table (align to cluster) */
    BLKDBG_EVENT(bs->file, BLKDBG_L1_GROW_ALLOC_TABLE);
@@ -1558,7 +1556,7 @@ fail:
 * clusters.
 */
 static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
-                          uint64_t nb_clusters, int flags)
+                          uint64_t nb_clusters)
 {
    BDRVQcow2State *s = bs->opaque;
    uint64_t *l2_table;
@@ -1582,7 +1580,7 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,

        /* Update L2 entries */
        qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table);
-        if (old_offset & QCOW_OFLAG_COMPRESSED || flags & BDRV_REQ_MAY_UNMAP) {
+        if (old_offset & QCOW_OFLAG_COMPRESSED) {
            l2_table[l2_index + i] = cpu_to_be64(QCOW_OFLAG_ZERO);
            qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
        } else {
@@ -1595,8 +1593,7 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
    return nb_clusters;
 }

-int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors,
-                        int flags)
+int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors)
 {
    BDRVQcow2State *s = bs->opaque;
    uint64_t nb_clusters;
@@ -1613,7 +1610,7 @@ int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors,
    s->cache_discards = true;

    while (nb_clusters > 0) {
-        ret = zero_single_l2(bs, offset, nb_clusters, flags);
+        ret = zero_single_l2(bs, offset, nb_clusters);
        if (ret < 0) {
            goto fail;
        }
@@ -668,14 +668,6 @@ static int qcow2_update_options_prepare(BlockDriverState *bs,
    r->cache_clean_interval =
        qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
                            s->cache_clean_interval);
-#ifndef CONFIG_LINUX
-    if (r->cache_clean_interval != 0) {
-        error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
-                   " not supported on this host");
-        ret = -EINVAL;
-        goto fail;
-    }
-#endif
    if (r->cache_clean_interval > UINT_MAX) {
        error_setg(errp, "Cache clean interval too big");
        ret = -EINVAL;
@@ -967,8 +959,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
        ret = -EINVAL;
        goto fail;
    }
-    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128,
-                                 QCRYPTO_CIPHER_MODE_CBC)) {
+    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128)) {
        error_setg(errp, "AES cipher not available");
        ret = -EINVAL;
        goto fail;
@@ -1163,7 +1154,6 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,

    /* Initialise locks */
    qemu_co_mutex_init(&s->lock);
-    bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP;

    /* Repair image if dirty */
    if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
@@ -1815,10 +1805,7 @@ static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
        .magic  = cpu_to_be32(magic),
        .len    = cpu_to_be32(len),
    };
-
-    if (len) {
-        memcpy(buf + sizeof(QCowExtension), s, len);
-    }
+    memcpy(buf + sizeof(QCowExtension), s, len);

    return ext_len;
 }
@@ -2487,7 +2474,7 @@ static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
    trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, count);

    /* Whatever is left can use real zero clusters */
-    ret = qcow2_zero_clusters(bs, offset, count >> BDRV_SECTOR_BITS, flags);
+    ret = qcow2_zero_clusters(bs, offset, count >> BDRV_SECTOR_BITS);
    qemu_co_mutex_unlock(&s->lock);

    return ret;
@@ -2552,39 +2539,84 @@ static int qcow2_truncate(BlockDriverState *bs, int64_t offset)
    return 0;
 }

+typedef struct Qcow2WriteCo {
+    BlockDriverState *bs;
+    int64_t sector_num;
+    const uint8_t *buf;
+    int nb_sectors;
+    int ret;
+} Qcow2WriteCo;
+
+static void qcow2_write_co_entry(void *opaque)
+{
+    Qcow2WriteCo *co = opaque;
+    QEMUIOVector qiov;
+    uint64_t offset = co->sector_num * BDRV_SECTOR_SIZE;
+    uint64_t bytes = co->nb_sectors * BDRV_SECTOR_SIZE;
+
+    struct iovec iov = (struct iovec) {
+        .iov_base   = (uint8_t*) co->buf,
+        .iov_len    = bytes,
+    };
+    qemu_iovec_init_external(&qiov, &iov, 1);
+
+    co->ret = qcow2_co_pwritev(co->bs, offset, bytes, &qiov, 0);
+}
+
+/* Wrapper for non-coroutine contexts */
+static int qcow2_write(BlockDriverState *bs, int64_t sector_num,
+                       const uint8_t *buf, int nb_sectors)
+{
+    Coroutine *co;
+    AioContext *aio_context = bdrv_get_aio_context(bs);
+    Qcow2WriteCo data = {
+        .bs         = bs,
+        .sector_num = sector_num,
+        .buf        = buf,
+        .nb_sectors = nb_sectors,
+        .ret        = -EINPROGRESS,
+    };
+    co = qemu_coroutine_create(qcow2_write_co_entry, &data);
+    qemu_coroutine_enter(co);
+    while (data.ret == -EINPROGRESS) {
+        aio_poll(aio_context, true);
+    }
+    return data.ret;
+}
+
 /* XXX: put compressed sectors first, then all the cluster aligned
   tables to avoid losing bytes in alignment */
-static coroutine_fn int
-qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-                            uint64_t bytes, QEMUIOVector *qiov)
+static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
+                                  const uint8_t *buf, int nb_sectors)
 {
    BDRVQcow2State *s = bs->opaque;
-    QEMUIOVector hd_qiov;
-    struct iovec iov;
    z_stream strm;
    int ret, out_len;
-    uint8_t *buf, *out_buf;
+    uint8_t *out_buf;
    uint64_t cluster_offset;

-    if (bytes == 0) {
+    if (nb_sectors == 0) {
        /* align end of file to a sector boundary to ease reading with
           sector based I/Os */
        cluster_offset = bdrv_getlength(bs->file->bs);
        return bdrv_truncate(bs->file->bs, cluster_offset);
    }

-    buf = qemu_blockalign(bs, s->cluster_size);
-    if (bytes != s->cluster_size) {
-        if (bytes > s->cluster_size ||
-            offset + bytes != bs->total_sectors << BDRV_SECTOR_BITS)
-        {
-            qemu_vfree(buf);
-            return -EINVAL;
-        }
+    if (nb_sectors != s->cluster_sectors) {
+        ret = -EINVAL;
+
        /* Zero-pad last write if image size is not cluster aligned */
-        memset(buf + bytes, 0, s->cluster_size - bytes);
+        if (sector_num + nb_sectors == bs->total_sectors &&
+            nb_sectors < s->cluster_sectors) {
+            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
+            memset(pad_buf, 0, s->cluster_size);
+            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
+            ret = qcow2_write_compressed(bs, sector_num,
+                                         pad_buf, s->cluster_sectors);
+            qemu_vfree(pad_buf);
+        }
+        return ret;
    }
-    qemu_iovec_to_buf(qiov, 0, buf, bytes);

    out_buf = g_malloc(s->cluster_size);

@@ -2615,44 +2647,33 @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,

    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
        /* could not compress: write normal cluster */
-        ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
+        ret = qcow2_write(bs, sector_num, buf, s->cluster_sectors);
+        if (ret < 0) {
+            goto fail;
+        }
+    } else {
+        cluster_offset = qcow2_alloc_compressed_cluster_offset(bs,
+            sector_num << 9, out_len);
+        if (!cluster_offset) {
+            ret = -EIO;
+            goto fail;
+        }
+        cluster_offset &= s->cluster_offset_mask;
+
+        ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
+        ret = bdrv_pwrite(bs->file, cluster_offset, out_buf, out_len);
        if (ret < 0) {
            goto fail;
        }
-        goto success;
    }

-    qemu_co_mutex_lock(&s->lock);
-    cluster_offset =
-        qcow2_alloc_compressed_cluster_offset(bs, offset, out_len);
-    if (!cluster_offset) {
-        qemu_co_mutex_unlock(&s->lock);
-        ret = -EIO;
-        goto fail;
-    }
-    cluster_offset &= s->cluster_offset_mask;
-
-    ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len);
-    qemu_co_mutex_unlock(&s->lock);
-    if (ret < 0) {
-        goto fail;
-    }
-
-    iov = (struct iovec) {
-        .iov_base   = out_buf,
-        .iov_len    = out_len,
-    };
-    qemu_iovec_init_external(&hd_qiov, &iov, 1);
-
-    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
-    ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
-    if (ret < 0) {
-        goto fail;
-    }
-success:
    ret = 0;
 fail:
-    qemu_vfree(buf);
    g_free(out_buf);
    return ret;
 }
@@ -2808,8 +2829,7 @@ static int qcow2_make_empty(BlockDriverState *bs)
 {
    BDRVQcow2State *s = bs->opaque;
    uint64_t start_sector;
-    int sector_step = (QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size) /
-                       BDRV_SECTOR_SIZE);
+    int sector_step = INT_MAX / BDRV_SECTOR_SIZE;
    int l1_clusters, ret = 0;

    l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
@@ -3398,7 +3418,7 @@ BlockDriver bdrv_qcow2 = {
    .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
    .bdrv_co_pdiscard       = qcow2_co_pdiscard,
    .bdrv_truncate          = qcow2_truncate,
-    .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
+    .bdrv_write_compressed  = qcow2_write_compressed,
    .bdrv_make_empty        = qcow2_make_empty,

    .bdrv_snapshot_create   = qcow2_snapshot_create,
@@ -473,6 +473,8 @@ static inline uint64_t refcount_diff(uint64_t r1, uint64_t r2)
    return r1 > r2 ? r1 - r2 : r2 - r1;
 }

+// FIXME Need qcow2_ prefix to global functions
+
 /* qcow2.c functions */
 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors);
@@ -528,6 +530,7 @@ int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
 int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
                        bool exact_size);
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
+void qcow2_l2_cache_reset(BlockDriverState *bs);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
                          uint8_t *out_buf, const uint8_t *in_buf,
@@ -545,8 +548,7 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m);
 int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
    int nb_sectors, enum qcow2_discard_type type, bool full_discard);
-int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors,
-                        int flags);
+int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors);

 int qcow2_expand_zero_clusters(BlockDriverState *bs,
                               BlockDriverAmendStatusCB *status_cb,
@@ -174,7 +174,9 @@ int qed_read_l1_table_sync(BDRVQEDState *s)

    qed_read_table(s, s->header.l1_table_offset,
                   s->l1_table, qed_sync_cb, &ret);
-    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+    while (ret == -EINPROGRESS) {
+        aio_poll(bdrv_get_aio_context(s->bs), true);
+    }

    return ret;
 }
@@ -193,7 +195,9 @@ int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,
    int ret = -EINPROGRESS;

    qed_write_l1_table(s, index, n, qed_sync_cb, &ret);
-    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+    while (ret == -EINPROGRESS) {
+        aio_poll(bdrv_get_aio_context(s->bs), true);
+    }

    return ret;
 }
@@ -264,7 +268,9 @@ int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request, uint64_t offset
    int ret = -EINPROGRESS;

    qed_read_l2_table(s, request, offset, qed_sync_cb, &ret);
-    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+    while (ret == -EINPROGRESS) {
+        aio_poll(bdrv_get_aio_context(s->bs), true);
+    }

    return ret;
 }
@@ -284,7 +290,9 @@ int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
    int ret = -EINPROGRESS;

    qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);
-    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+    while (ret == -EINPROGRESS) {
+        aio_poll(bdrv_get_aio_context(s->bs), true);
+    }

    return ret;
 }
@@ -336,7 +336,7 @@ static void qed_need_check_timer_cb(void *opaque)
    qed_plug_allocating_write_reqs(s);

    /* Ensure writes are on disk before clearing flag */
-    bdrv_aio_flush(s->bs->file->bs, qed_clear_need_check, s);
+    bdrv_aio_flush(s->bs, qed_clear_need_check, s);
 }

 static void qed_start_need_check_timer(BDRVQEDState *s)
@@ -378,19 +378,6 @@ static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
    }
 }

-static void bdrv_qed_drain(BlockDriverState *bs)
-{
-    BDRVQEDState *s = bs->opaque;
-
-    /* Fire the timer immediately in order to start doing I/O as soon as the
-     * header is flushed.
-     */
-    if (s->need_check_timer && timer_pending(s->need_check_timer)) {
-        qed_cancel_need_check_timer(s);
-        qed_need_check_timer_cb(s);
-    }
-}
-
 static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp)
 {
@@ -922,6 +909,7 @@ static void qed_aio_complete_bh(void *opaque)
    void *user_opaque = acb->common.opaque;
    int ret = acb->bh_ret;

+    qemu_bh_delete(acb->bh);
    qemu_aio_unref(acb);

    /* Invoke callback */
@@ -946,8 +934,9 @@ static void qed_aio_complete(QEDAIOCB *acb, int ret)

    /* Arrange for a bh to invoke the completion function */
    acb->bh_ret = ret;
-    aio_bh_schedule_oneshot(bdrv_get_aio_context(acb->common.bs),
-                            qed_aio_complete_bh, acb);
+    acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
+                         qed_aio_complete_bh, acb);
+    qemu_bh_schedule(acb->bh);

    /* Start next allocating write request waiting behind this one.  Note that
     * requests enqueue themselves when they first hit an unallocated cluster
@@ -1681,7 +1670,6 @@ static BlockDriver bdrv_qed = {
    .bdrv_check               = bdrv_qed_check,
    .bdrv_detach_aio_context  = bdrv_qed_detach_aio_context,
    .bdrv_attach_aio_context  = bdrv_qed_attach_aio_context,
-    .bdrv_drain               = bdrv_qed_drain,
 };

 static void bdrv_qed_init(void)
@@ -130,6 +130,7 @@ enum {

 typedef struct QEDAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    int bh_ret;                     /* final return status for completion bh */
    QSIMPLEQ_ENTRY(QEDAIOCB) next;  /* next request */
    int flags;                      /* QED_AIOCB_* bits ORed together */
@@ -130,7 +130,7 @@ struct QuorumAIOCB {

    bool is_read;
    int vote_ret;
-    int children_read;          /* how many children have been read from */
+    int child_iter;             /* which child to read in fifo pattern */
 };

 static bool quorum_vote(QuorumAIOCB *acb);
@@ -156,7 +156,22 @@ static AIOCBInfo quorum_aiocb_info = {

 static void quorum_aio_finalize(QuorumAIOCB *acb)
 {
-    acb->common.cb(acb->common.opaque, acb->vote_ret);
+    int i, ret = 0;
+
+    if (acb->vote_ret) {
+        ret = acb->vote_ret;
+    }
+
+    acb->common.cb(acb->common.opaque, ret);
+
+    if (acb->is_read) {
+        /* on the quorum case acb->child_iter == s->num_children - 1 */
+        for (i = 0; i <= acb->child_iter; i++) {
+            qemu_vfree(acb->qcrs[i].buf);
+            qemu_iovec_destroy(&acb->qcrs[i].qiov);
+        }
+    }
+
    g_free(acb->qcrs);
    qemu_aio_unref(acb);
 }
@@ -268,52 +283,39 @@ static void quorum_copy_qiov(QEMUIOVector *dest, QEMUIOVector *source)
    }
 }

-static void quorum_report_bad_acb(QuorumChildRequest *sacb, int ret)
-{
-    QuorumAIOCB *acb = sacb->parent;
-    QuorumOpType type = acb->is_read ? QUORUM_OP_TYPE_READ : QUORUM_OP_TYPE_WRITE;
-    quorum_report_bad(type, acb->sector_num, acb->nb_sectors,
-                      sacb->aiocb->bs->node_name, ret);
-}
-
-static void quorum_fifo_aio_cb(void *opaque, int ret)
-{
-    QuorumChildRequest *sacb = opaque;
-    QuorumAIOCB *acb = sacb->parent;
-    BDRVQuorumState *s = acb->common.bs->opaque;
-
-    assert(acb->is_read && s->read_pattern == QUORUM_READ_PATTERN_FIFO);
-
-    if (ret < 0) {
-        quorum_report_bad_acb(sacb, ret);
-
-        /* We try to read next child in FIFO order if we fail to read */
-        if (acb->children_read < s->num_children) {
-            read_fifo_child(acb);
-            return;
-        }
-    }
-
-    acb->vote_ret = ret;
-
-    /* FIXME: rewrite failed children if acb->children_read > 1? */
-    quorum_aio_finalize(acb);
-}
-
 static void quorum_aio_cb(void *opaque, int ret)
 {
    QuorumChildRequest *sacb = opaque;
    QuorumAIOCB *acb = sacb->parent;
    BDRVQuorumState *s = acb->common.bs->opaque;
    bool rewrite = false;
-    int i;

-    sacb->ret = ret;
    if (ret == 0) {
        acb->success_count++;
    } else {
-        quorum_report_bad_acb(sacb, ret);
+        QuorumOpType type;
+        type = acb->is_read ? QUORUM_OP_TYPE_READ : QUORUM_OP_TYPE_WRITE;
+        quorum_report_bad(type, acb->sector_num, acb->nb_sectors,
+                          sacb->aiocb->bs->node_name, ret);
    }
+
+    if (acb->is_read && s->read_pattern == QUORUM_READ_PATTERN_FIFO) {
+        /* We try to read next child in FIFO order if we fail to read */
+        if (ret < 0 && (acb->child_iter + 1) < s->num_children) {
+            acb->child_iter++;
+            read_fifo_child(acb);
+            return;
+        }
+
+        if (ret == 0) {
+            quorum_copy_qiov(acb->qiov, &acb->qcrs[acb->child_iter].qiov);
+        }
+        acb->vote_ret = ret;
+        quorum_aio_finalize(acb);
+        return;
+    }
+
+    sacb->ret = ret;
    acb->count++;
    assert(acb->count <= s->num_children);
    assert(acb->success_count <= s->num_children);
@@ -324,10 +326,6 @@ static void quorum_aio_cb(void *opaque, int ret)
    /* Do the vote on read */
    if (acb->is_read) {
        rewrite = quorum_vote(acb);
-        for (i = 0; i < s->num_children; i++) {
-            qemu_vfree(acb->qcrs[i].buf);
-            qemu_iovec_destroy(&acb->qcrs[i].qiov);
-        }
    } else {
        quorum_has_too_much_io_failed(acb);
    }
@@ -655,7 +653,6 @@ static BlockAIOCB *read_quorum_children(QuorumAIOCB *acb)
    BDRVQuorumState *s = acb->common.bs->opaque;
    int i;

-    acb->children_read = s->num_children;
    for (i = 0; i < s->num_children; i++) {
        acb->qcrs[i].buf = qemu_blockalign(s->children[i]->bs, acb->qiov->size);
        qemu_iovec_init(&acb->qcrs[i].qiov, acb->qiov->niov);
@@ -674,11 +671,16 @@ static BlockAIOCB *read_quorum_children(QuorumAIOCB *acb)
 static BlockAIOCB *read_fifo_child(QuorumAIOCB *acb)
 {
    BDRVQuorumState *s = acb->common.bs->opaque;
-    int n = acb->children_read++;

-    acb->qcrs[n].aiocb = bdrv_aio_readv(s->children[n], acb->sector_num,
-                                        acb->qiov, acb->nb_sectors,
-                                        quorum_fifo_aio_cb, &acb->qcrs[n]);
+    acb->qcrs[acb->child_iter].buf =
+        qemu_blockalign(s->children[acb->child_iter]->bs, acb->qiov->size);
+    qemu_iovec_init(&acb->qcrs[acb->child_iter].qiov, acb->qiov->niov);
+    qemu_iovec_clone(&acb->qcrs[acb->child_iter].qiov, acb->qiov,
+                     acb->qcrs[acb->child_iter].buf);
+    acb->qcrs[acb->child_iter].aiocb =
+        bdrv_aio_readv(s->children[acb->child_iter], acb->sector_num,
+                       &acb->qcrs[acb->child_iter].qiov, acb->nb_sectors,
+                       quorum_aio_cb, &acb->qcrs[acb->child_iter]);

    return &acb->common;
 }
@@ -694,12 +696,13 @@ static BlockAIOCB *quorum_aio_readv(BlockDriverState *bs,
    QuorumAIOCB *acb = quorum_aio_get(s, bs, qiov, sector_num,
                                      nb_sectors, cb, opaque);
    acb->is_read = true;
-    acb->children_read = 0;

    if (s->read_pattern == QUORUM_READ_PATTERN_QUORUM) {
+        acb->child_iter = s->num_children - 1;
        return read_quorum_children(acb);
    }

+    acb->child_iter = 0;
    return read_fifo_child(acb);
 }

@@ -143,7 +143,6 @@ typedef struct BDRVRawState {
    bool has_discard:1;
    bool has_write_zeroes:1;
    bool discard_zeroes:1;
-    bool use_linux_aio:1;
    bool has_fallocate;
    bool needs_alignment;
 } BDRVRawState;
@@ -368,6 +367,18 @@ static void raw_parse_flags(int bdrv_flags, int *open_flags)
    }
 }

+#ifdef CONFIG_LINUX_AIO
+static bool raw_use_aio(int bdrv_flags)
+{
+    /*
+     * Currently Linux do AIO only for files opened with O_DIRECT
+     * specified so check NOCACHE flag too
+     */
+    return (bdrv_flags & (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO)) ==
+                         (BDRV_O_NOCACHE|BDRV_O_NATIVE_AIO);
+}
+#endif
+
 static void raw_parse_filename(const char *filename, QDict *options,
                               Error **errp)
 {
@@ -388,11 +399,6 @@ static QemuOptsList raw_runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "File name of the image",
        },
-        {
-            .name = "aio",
-            .type = QEMU_OPT_STRING,
-            .help = "host AIO implementation (threads, native)",
-        },
        { /* end of list */ }
    },
 };
@@ -404,7 +410,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    QemuOpts *opts;
    Error *local_err = NULL;
    const char *filename = NULL;
-    BlockdevAioOptions aio, aio_default;
    int fd, ret;
    struct stat st;

@@ -424,18 +429,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
        goto fail;
    }

-    aio_default = (bdrv_flags & BDRV_O_NATIVE_AIO)
-                  ? BLOCKDEV_AIO_OPTIONS_NATIVE
-                  : BLOCKDEV_AIO_OPTIONS_THREADS;
-    aio = qapi_enum_parse(BlockdevAioOptions_lookup, qemu_opt_get(opts, "aio"),
-                          BLOCKDEV_AIO_OPTIONS__MAX, aio_default, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-    s->use_linux_aio = (aio == BLOCKDEV_AIO_OPTIONS_NATIVE);
-
    s->open_flags = open_flags;
    raw_parse_flags(bdrv_flags, &s->open_flags);

@@ -443,7 +436,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    fd = qemu_open(filename, s->open_flags, 0644);
    if (fd < 0) {
        ret = -errno;
-        error_setg_errno(errp, errno, "Could not open '%s'", filename);
        if (ret == -EROFS) {
            ret = -EACCES;
        }
@@ -452,15 +444,14 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    s->fd = fd;

 #ifdef CONFIG_LINUX_AIO
-     /* Currently Linux does AIO only for files opened with O_DIRECT */
-    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
+    if (!raw_use_aio(bdrv_flags) && (bdrv_flags & BDRV_O_NATIVE_AIO)) {
        error_setg(errp, "aio=native was specified, but it requires "
                         "cache.direct=on, which was not specified.");
        ret = -EINVAL;
        goto fail;
    }
 #else
-    if (s->use_linux_aio) {
+    if (bdrv_flags & BDRV_O_NATIVE_AIO) {
        error_setg(errp, "aio=native was specified, but is not supported "
                         "in this build.");
        ret = -EINVAL;
@@ -542,7 +533,7 @@ static int raw_reopen_prepare(BDRVReopenState *state,
                              BlockReopenQueue *queue, Error **errp)
 {
    BDRVRawState *s;
-    BDRVRawReopenState *rs;
+    BDRVRawReopenState *raw_s;
    int ret = 0;
    Error *local_err = NULL;

@@ -552,15 +543,15 @@ static int raw_reopen_prepare(BDRVReopenState *state,
    s = state->bs->opaque;

    state->opaque = g_new0(BDRVRawReopenState, 1);
-    rs = state->opaque;
+    raw_s = state->opaque;

    if (s->type == FTYPE_CD) {
-        rs->open_flags |= O_NONBLOCK;
+        raw_s->open_flags |= O_NONBLOCK;
    }

-    raw_parse_flags(state->flags, &rs->open_flags);
+    raw_parse_flags(state->flags, &raw_s->open_flags);

-    rs->fd = -1;
+    raw_s->fd = -1;

    int fcntl_flags = O_APPEND | O_NONBLOCK;
 #ifdef O_NOATIME
@@ -569,35 +560,35 @@ static int raw_reopen_prepare(BDRVReopenState *state,

 #ifdef O_ASYNC
    /* Not all operating systems have O_ASYNC, and those that don't
-     * will not let us track the state into rs->open_flags (typically
+     * will not let us track the state into raw_s->open_flags (typically
     * you achieve the same effect with an ioctl, for example I_SETSIG
     * on Solaris). But we do not use O_ASYNC, so that's fine.
     */
    assert((s->open_flags & O_ASYNC) == 0);
 #endif

-    if ((rs->open_flags & ~fcntl_flags) == (s->open_flags & ~fcntl_flags)) {
+    if ((raw_s->open_flags & ~fcntl_flags) == (s->open_flags & ~fcntl_flags)) {
        /* dup the original fd */
-        rs->fd = qemu_dup(s->fd);
-        if (rs->fd >= 0) {
-            ret = fcntl_setfl(rs->fd, rs->open_flags);
+        raw_s->fd = qemu_dup(s->fd);
+        if (raw_s->fd >= 0) {
+            ret = fcntl_setfl(raw_s->fd, raw_s->open_flags);
            if (ret) {
-                qemu_close(rs->fd);
-                rs->fd = -1;
+                qemu_close(raw_s->fd);
+                raw_s->fd = -1;
            }
        }
    }

    /* If we cannot use fcntl, or fcntl failed, fall back to qemu_open() */
-    if (rs->fd == -1) {
+    if (raw_s->fd == -1) {
        const char *normalized_filename = state->bs->filename;
        ret = raw_normalize_devicepath(&normalized_filename);
        if (ret < 0) {
            error_setg_errno(errp, -ret, "Could not normalize device path");
        } else {
-            assert(!(rs->open_flags & O_CREAT));
-            rs->fd = qemu_open(normalized_filename, rs->open_flags);
-            if (rs->fd == -1) {
+            assert(!(raw_s->open_flags & O_CREAT));
+            raw_s->fd = qemu_open(normalized_filename, raw_s->open_flags);
+            if (raw_s->fd == -1) {
                error_setg_errno(errp, errno, "Could not reopen file");
                ret = -1;
            }
@@ -606,11 +597,11 @@ static int raw_reopen_prepare(BDRVReopenState *state,

    /* Fail already reopen_prepare() if we can't get a working O_DIRECT
     * alignment with the new fd. */
-    if (rs->fd != -1) {
-        raw_probe_alignment(state->bs, rs->fd, &local_err);
+    if (raw_s->fd != -1) {
+        raw_probe_alignment(state->bs, raw_s->fd, &local_err);
        if (local_err) {
-            qemu_close(rs->fd);
-            rs->fd = -1;
+            qemu_close(raw_s->fd);
+            raw_s->fd = -1;
            error_propagate(errp, local_err);
            ret = -EINVAL;
        }
@@ -621,13 +612,13 @@ static int raw_reopen_prepare(BDRVReopenState *state,

 static void raw_reopen_commit(BDRVReopenState *state)
 {
-    BDRVRawReopenState *rs = state->opaque;
+    BDRVRawReopenState *raw_s = state->opaque;
    BDRVRawState *s = state->bs->opaque;

-    s->open_flags = rs->open_flags;
+    s->open_flags = raw_s->open_flags;

    qemu_close(s->fd);
-    s->fd = rs->fd;
+    s->fd = raw_s->fd;

    g_free(state->opaque);
    state->opaque = NULL;
@@ -636,16 +627,16 @@ static void raw_reopen_commit(BDRVReopenState *state)

 static void raw_reopen_abort(BDRVReopenState *state)
 {
-    BDRVRawReopenState *rs = state->opaque;
+    BDRVRawReopenState *raw_s = state->opaque;

     /* nothing to do if NULL, we didn't get far enough */
-    if (rs == NULL) {
+    if (raw_s == NULL) {
        return;
    }

-    if (rs->fd >= 0) {
-        qemu_close(rs->fd);
-        rs->fd = -1;
+    if (raw_s->fd >= 0) {
+        qemu_close(raw_s->fd);
+        raw_s->fd = -1;
    }
    g_free(state->opaque);
    state->opaque = NULL;
@@ -1265,7 +1256,7 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
        if (!bdrv_qiov_is_aligned(bs, qiov)) {
            type |= QEMU_AIO_MISALIGNED;
 #ifdef CONFIG_LINUX_AIO
-        } else if (s->use_linux_aio) {
+        } else if (bs->open_flags & BDRV_O_NATIVE_AIO) {
            LinuxAioState *aio = aio_get_linux_aio(bdrv_get_aio_context(bs));
            assert(qiov->size == bytes);
            return laio_co_submit(bs, aio, s->fd, offset, qiov, type);
@@ -1294,8 +1285,7 @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
 static void raw_aio_plug(BlockDriverState *bs)
 {
 #ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-    if (s->use_linux_aio) {
+    if (bs->open_flags & BDRV_O_NATIVE_AIO) {
        LinuxAioState *aio = aio_get_linux_aio(bdrv_get_aio_context(bs));
        laio_io_plug(bs, aio);
    }
@@ -1305,8 +1295,7 @@ static void raw_aio_plug(BlockDriverState *bs)
 static void raw_aio_unplug(BlockDriverState *bs)
 {
 #ifdef CONFIG_LINUX_AIO
-    BDRVRawState *s = bs->opaque;
-    if (s->use_linux_aio) {
+    if (bs->open_flags & BDRV_O_NATIVE_AIO) {
        LinuxAioState *aio = aio_get_linux_aio(bdrv_get_aio_context(bs));
        laio_io_unplug(bs, aio);
    }
@@ -2069,23 +2058,13 @@ static bool hdev_is_sg(BlockDriverState *bs)

 #if defined(__linux__)

-    BDRVRawState *s = bs->opaque;
    struct stat st;
    struct sg_scsi_id scsiid;
    int sg_version;
-    int ret;

-    if (stat(bs->filename, &st) < 0 || !S_ISCHR(st.st_mode)) {
-        return false;
-    }
-
-    ret = ioctl(s->fd, SG_GET_VERSION_NUM, &sg_version);
-    if (ret < 0) {
-        return false;
-    }
-
-    ret = ioctl(s->fd, SG_GET_SCSI_ID, &scsiid);
-    if (ret >= 0) {
+    if (stat(bs->filename, &st) >= 0 && S_ISCHR(st.st_mode) &&
+        !bdrv_ioctl(bs, SG_GET_VERSION_NUM, &sg_version) &&
+        !bdrv_ioctl(bs, SG_GET_SCSI_ID, &scsiid)) {
        DPRINTF("SG device found: type=%d, version=%d\n",
            scsiid.scsi_type, sg_version);
        return true;
@@ -32,7 +32,6 @@
 #include "block/thread-pool.h"
 #include "qemu/iov.h"
 #include "qapi/qmp/qstring.h"
-#include "qapi/util.h"
 #include <windows.h>
 #include <winioctl.h>

@@ -253,8 +252,7 @@ static void raw_probe_alignment(BlockDriverState *bs, Error **errp)
    }
 }

-static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
-                            DWORD *overlapped)
+static void raw_parse_flags(int flags, int *access_flags, DWORD *overlapped)
 {
    assert(access_flags != NULL);
    assert(overlapped != NULL);
@@ -266,7 +264,7 @@ static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
    }

    *overlapped = FILE_ATTRIBUTE_NORMAL;
-    if (use_aio) {
+    if (flags & BDRV_O_NATIVE_AIO) {
        *overlapped |= FILE_FLAG_OVERLAPPED;
    }
    if (flags & BDRV_O_NOCACHE) {
@@ -294,35 +292,10 @@ static QemuOptsList raw_runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "File name of the image",
        },
-        {
-            .name = "aio",
-            .type = QEMU_OPT_STRING,
-            .help = "host AIO implementation (threads, native)",
-        },
        { /* end of list */ }
    },
 };

-static bool get_aio_option(QemuOpts *opts, int flags, Error **errp)
-{
-    BlockdevAioOptions aio, aio_default;
-
-    aio_default = (flags & BDRV_O_NATIVE_AIO) ? BLOCKDEV_AIO_OPTIONS_NATIVE
-                                              : BLOCKDEV_AIO_OPTIONS_THREADS;
-    aio = qapi_enum_parse(BlockdevAioOptions_lookup, qemu_opt_get(opts, "aio"),
-                          BLOCKDEV_AIO_OPTIONS__MAX, aio_default, errp);
-
-    switch (aio) {
-    case BLOCKDEV_AIO_OPTIONS_NATIVE:
-        return true;
-    case BLOCKDEV_AIO_OPTIONS_THREADS:
-        return false;
-    default:
-        error_setg(errp, "Invalid AIO option");
-    }
-    return false;
-}
-
 static int raw_open(BlockDriverState *bs, QDict *options, int flags,
                    Error **errp)
 {
@@ -332,7 +305,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
    QemuOpts *opts;
    Error *local_err = NULL;
    const char *filename;
-    bool use_aio;
    int ret;

    s->type = FTYPE_FILE;
@@ -347,14 +319,7 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,

    filename = qemu_opt_get(opts, "filename");

-    use_aio = get_aio_option(opts, flags, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    raw_parse_flags(flags, use_aio, &access_flags, &overlapped);
+    raw_parse_flags(flags, &access_flags, &overlapped);

    if (filename[0] && filename[1] == ':') {
        snprintf(s->drive_path, sizeof(s->drive_path), "%c:\\", filename[0]);
@@ -373,7 +338,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
    if (s->hfile == INVALID_HANDLE_VALUE) {
        int err = GetLastError();

-        error_setg_win32(errp, err, "Could not open '%s'", filename);
        if (err == ERROR_ACCESS_DENIED) {
            ret = -EACCES;
        } else {
@@ -382,7 +346,7 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    if (use_aio) {
+    if (flags & BDRV_O_NATIVE_AIO) {
        s->aio = win32_aio_init();
        if (s->aio == NULL) {
            CloseHandle(s->hfile);
@@ -683,7 +647,6 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags,

    Error *local_err = NULL;
    const char *filename;
-    bool use_aio;

    QemuOpts *opts = qemu_opts_create(&raw_runtime_opts, NULL, 0,
                                      &error_abort);
@@ -696,16 +659,6 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags,

    filename = qemu_opt_get(opts, "filename");

-    use_aio = get_aio_option(opts, flags, &local_err);
-    if (!local_err && use_aio) {
-        error_setg(&local_err, "AIO is not supported on Windows host devices");
-    }
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto done;
-    }
-
    if (strstart(filename, "/dev/cdrom", NULL)) {
        if (find_cdrom(device_name, sizeof(device_name)) < 0) {
            error_setg(errp, "Could not open CD-ROM drive");
@@ -724,7 +677,7 @@ static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
    }
    s->type = find_device_type(bs, filename);

-    raw_parse_flags(flags, use_aio, &access_flags, &overlapped);
+    raw_parse_flags(flags, &access_flags, &overlapped);

    create_flags = OPEN_EXISTING;

@@ -31,30 +31,6 @@
 #include "qapi/error.h"
 #include "qemu/option.h"

-typedef struct BDRVRawState {
-    uint64_t offset;
-    uint64_t size;
-    bool has_size;
-} BDRVRawState;
-
-static QemuOptsList raw_runtime_opts = {
-    .name = "raw",
-    .head = QTAILQ_HEAD_INITIALIZER(raw_runtime_opts.head),
-    .desc = {
-        {
-            .name = "offset",
-            .type = QEMU_OPT_SIZE,
-            .help = "offset in the disk where the image starts",
-        },
-        {
-            .name = "size",
-            .type = QEMU_OPT_SIZE,
-            .help = "virtual disk size",
-        },
-        { /* end of list */ }
-    },
-};
-
 static QemuOptsList raw_create_opts = {
    .name = "raw-create-opts",
    .head = QTAILQ_HEAD_INITIALIZER(raw_create_opts.head),
@@ -68,116 +44,16 @@ static QemuOptsList raw_create_opts = {
    }
 };

-static int raw_read_options(QDict *options, BlockDriverState *bs,
-    BDRVRawState *s, Error **errp)
-{
-    Error *local_err = NULL;
-    QemuOpts *opts = NULL;
-    int64_t real_size = 0;
-    int ret;
-
-    real_size = bdrv_getlength(bs->file->bs);
-    if (real_size < 0) {
-        error_setg_errno(errp, -real_size, "Could not get image size");
-        return real_size;
-    }
-
-    opts = qemu_opts_create(&raw_runtime_opts, NULL, 0, &error_abort);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto end;
-    }
-
-    s->offset = qemu_opt_get_size(opts, "offset", 0);
-    if (s->offset > real_size) {
-        error_setg(errp, "Offset (%" PRIu64 ") cannot be greater than "
-            "size of the containing file (%" PRId64 ")",
-            s->offset, real_size);
-        ret = -EINVAL;
-        goto end;
-    }
-
-    if (qemu_opt_find(opts, "size") != NULL) {
-        s->size = qemu_opt_get_size(opts, "size", 0);
-        s->has_size = true;
-    } else {
-        s->has_size = false;
-        s->size = real_size - s->offset;
-    }
-
-    /* Check size and offset */
-    if ((real_size - s->offset) < s->size) {
-        error_setg(errp, "The sum of offset (%" PRIu64 ") and size "
-            "(%" PRIu64 ") has to be smaller or equal to the "
-            " actual size of the containing file (%" PRId64 ")",
-            s->offset, s->size, real_size);
-        ret = -EINVAL;
-        goto end;
-    }
-
-    /* Make sure size is multiple of BDRV_SECTOR_SIZE to prevent rounding
-     * up and leaking out of the specified area. */
-    if (s->has_size && !QEMU_IS_ALIGNED(s->size, BDRV_SECTOR_SIZE)) {
-        error_setg(errp, "Specified size is not multiple of %llu",
-            BDRV_SECTOR_SIZE);
-        ret = -EINVAL;
-        goto end;
-    }
-
-    ret = 0;
-
-end:
-
-    qemu_opts_del(opts);
-
-    return ret;
-}
-
 static int raw_reopen_prepare(BDRVReopenState *reopen_state,
                              BlockReopenQueue *queue, Error **errp)
 {
-    assert(reopen_state != NULL);
-    assert(reopen_state->bs != NULL);
-
-    reopen_state->opaque = g_new0(BDRVRawState, 1);
-
-    return raw_read_options(
-        reopen_state->options,
-        reopen_state->bs,
-        reopen_state->opaque,
-        errp);
-}
-
-static void raw_reopen_commit(BDRVReopenState *state)
-{
-    BDRVRawState *new_s = state->opaque;
-    BDRVRawState *s = state->bs->opaque;
-
-    memcpy(s, new_s, sizeof(BDRVRawState));
-
-    g_free(state->opaque);
-    state->opaque = NULL;
-}
-
-static void raw_reopen_abort(BDRVReopenState *state)
-{
-    g_free(state->opaque);
-    state->opaque = NULL;
+    return 0;
 }

 static int coroutine_fn raw_co_preadv(BlockDriverState *bs, uint64_t offset,
                                      uint64_t bytes, QEMUIOVector *qiov,
                                      int flags)
 {
-    BDRVRawState *s = bs->opaque;
-
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
-    }
-    offset += s->offset;
-
    BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 }
@@ -186,23 +62,11 @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
                                       uint64_t bytes, QEMUIOVector *qiov,
                                       int flags)
 {
-    BDRVRawState *s = bs->opaque;
    void *buf = NULL;
    BlockDriver *drv;
    QEMUIOVector local_qiov;
    int ret;

-    if (s->has_size && (offset > s->size || bytes > (s->size - offset))) {
-        /* There's not enough space for the data. Don't write anything and just
-         * fail to prevent leaking out of the size specified in options. */
-        return -ENOSPC;
-    }
-
-    if (offset > UINT64_MAX - s->offset) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
    if (bs->probed && offset < BLOCK_PROBE_BUF_SIZE && bytes) {
        /* Handling partial writes would be a pain - so we just
         * require that guests have 512-byte request alignment if
@@ -237,8 +101,6 @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
        qiov = &local_qiov;
    }

-    offset += s->offset;
-
    BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
    ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);

@@ -255,10 +117,8 @@ static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
                                            int nb_sectors, int *pnum,
                                            BlockDriverState **file)
 {
-    BDRVRawState *s = bs->opaque;
    *pnum = nb_sectors;
    *file = bs->file->bs;
-    sector_num += s->offset / BDRV_SECTOR_SIZE;
    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |
           (sector_num << BDRV_SECTOR_BITS);
 }
@@ -267,49 +127,18 @@ static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,
                                             int64_t offset, int count,
                                             BdrvRequestFlags flags)
 {
-    BDRVRawState *s = bs->opaque;
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
-    }
-    offset += s->offset;
    return bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
 }

 static int coroutine_fn raw_co_pdiscard(BlockDriverState *bs,
                                        int64_t offset, int count)
 {
-    BDRVRawState *s = bs->opaque;
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
-    }
-    offset += s->offset;
    return bdrv_co_pdiscard(bs->file->bs, offset, count);
 }

 static int64_t raw_getlength(BlockDriverState *bs)
 {
-    int64_t len;
-    BDRVRawState *s = bs->opaque;
-
-    /* Update size. It should not change unless the file was externally
-     * modified. */
-    len = bdrv_getlength(bs->file->bs);
-    if (len < 0) {
-        return len;
-    }
-
-    if (len < s->offset) {
-        s->size = 0;
-    } else {
-        if (s->has_size) {
-            /* Try to honour the size */
-            s->size = MIN(s->size, len - s->offset);
-        } else {
-            s->size = len - s->offset;
-        }
-    }
-
-    return s->size;
+    return bdrv_getlength(bs->file->bs);
 }

 static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
@@ -329,18 +158,6 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)

 static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
-    BDRVRawState *s = bs->opaque;
-
-    if (s->has_size) {
-        return -ENOTSUP;
-    }
-
-    if (INT64_MAX - offset < s->offset) {
-        return -EINVAL;
-    }
-
-    s->size = offset;
-    offset += s->offset;
    return bdrv_truncate(bs->file->bs, offset);
 }

@@ -359,13 +176,12 @@ static void raw_lock_medium(BlockDriverState *bs, bool locked)
    bdrv_lock_medium(bs->file->bs, locked);
 }

-static int raw_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
+static BlockAIOCB *raw_aio_ioctl(BlockDriverState *bs,
+                                 unsigned long int req, void *buf,
+                                 BlockCompletionFunc *cb,
+                                 void *opaque)
 {
-    BDRVRawState *s = bs->opaque;
-    if (s->offset || s->has_size) {
-        return -ENOTSUP;
-    }
-    return bdrv_co_ioctl(bs->file->bs, req, buf);
+    return bdrv_aio_ioctl(bs->file->bs, req, buf, cb, opaque);
 }

 static int raw_has_zero_init(BlockDriverState *bs)
@@ -381,9 +197,6 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
 static int raw_open(BlockDriverState *bs, QDict *options, int flags,
                    Error **errp)
 {
-    BDRVRawState *s = bs->opaque;
-    int ret;
-
    bs->sg = bs->file->bs->sg;
    bs->supported_write_flags = BDRV_REQ_FUA &
        bs->file->bs->supported_write_flags;
@@ -401,16 +214,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
                bs->file->bs->filename);
    }

-    ret = raw_read_options(options, bs, s, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (bs->sg && (s->offset || s->has_size)) {
-        error_setg(errp, "Cannot use offset/size with SCSI generic devices");
-        return -EINVAL;
-    }
-
    return 0;
 }

@@ -428,37 +231,18 @@ static int raw_probe(const uint8_t *buf, int buf_size, const char *filename)

 static int raw_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
 {
-    BDRVRawState *s = bs->opaque;
-    int ret;
-
-    ret = bdrv_probe_blocksizes(bs->file->bs, bsz);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (!QEMU_IS_ALIGNED(s->offset, MAX(bsz->log, bsz->phys))) {
-        return -ENOTSUP;
-    }
-
-    return 0;
+    return bdrv_probe_blocksizes(bs->file->bs, bsz);
 }

 static int raw_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
 {
-    BDRVRawState *s = bs->opaque;
-    if (s->offset || s->has_size) {
-        return -ENOTSUP;
-    }
    return bdrv_probe_geometry(bs->file->bs, geo);
 }

 BlockDriver bdrv_raw = {
    .format_name          = "raw",
-    .instance_size        = sizeof(BDRVRawState),
    .bdrv_probe           = &raw_probe,
    .bdrv_reopen_prepare  = &raw_reopen_prepare,
-    .bdrv_reopen_commit   = &raw_reopen_commit,
-    .bdrv_reopen_abort    = &raw_reopen_abort,
    .bdrv_open            = &raw_open,
    .bdrv_close           = &raw_close,
    .bdrv_create          = &raw_create,
@@ -477,7 +261,7 @@ BlockDriver bdrv_raw = {
    .bdrv_media_changed   = &raw_media_changed,
    .bdrv_eject           = &raw_eject,
    .bdrv_lock_medium     = &raw_lock_medium,
-    .bdrv_co_ioctl        = &raw_co_ioctl,
+    .bdrv_aio_ioctl       = &raw_aio_ioctl,
    .create_opts          = &raw_create_opts,
    .bdrv_has_zero_init   = &raw_has_zero_init
 };
@@ -71,6 +71,7 @@ typedef enum {

 typedef struct RBDAIOCB {
    BlockAIOCB common;
+    QEMUBH *bh;
    int64_t ret;
    QEMUIOVector *qiov;
    char *bounce;
@@ -365,44 +366,45 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
        rados_conf_read_file(cluster, NULL);
    } else if (conf[0] != '\0' &&
               qemu_rbd_set_conf(cluster, conf, true, &local_err) < 0) {
+        rados_shutdown(cluster);
        error_propagate(errp, local_err);
-        ret = -EIO;
-        goto shutdown;
+        return -EIO;
    }

    if (conf[0] != '\0' &&
        qemu_rbd_set_conf(cluster, conf, false, &local_err) < 0) {
+        rados_shutdown(cluster);
        error_propagate(errp, local_err);
-        ret = -EIO;
-        goto shutdown;
+        return -EIO;
    }

    if (qemu_rbd_set_auth(cluster, secretid, errp) < 0) {
-        ret = -EIO;
-        goto shutdown;
+        rados_shutdown(cluster);
+        return -EIO;
    }

    ret = rados_connect(cluster);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "error connecting");
-        goto shutdown;
+        rados_shutdown(cluster);
+        return ret;
    }

    ret = rados_ioctx_create(cluster, pool, &io_ctx);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "error opening pool %s", pool);
-        goto shutdown;
+        rados_shutdown(cluster);
+        return ret;
    }

    ret = rbd_create(io_ctx, name, bytes, &obj_order);
+    rados_ioctx_destroy(io_ctx);
+    rados_shutdown(cluster);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "error rbd create");
+        return ret;
    }

-    rados_ioctx_destroy(io_ctx);
-
-shutdown:
-    rados_shutdown(cluster);
    return ret;
 }

@@ -600,6 +602,7 @@ static const AIOCBInfo rbd_aiocb_info = {
 static void rbd_finish_bh(void *opaque)
 {
    RADOSCB *rcb = opaque;
+    qemu_bh_delete(rcb->acb->bh);
    qemu_rbd_complete_aio(rcb);
 }

@@ -618,8 +621,9 @@ static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
    rcb->ret = rbd_aio_get_return_value(c);
    rbd_aio_release(c);

-    aio_bh_schedule_oneshot(bdrv_get_aio_context(acb->common.bs),
-                            rbd_finish_bh, rcb);
+    acb->bh = aio_bh_new(bdrv_get_aio_context(acb->common.bs),
+                         rbd_finish_bh, rcb);
+    qemu_bh_schedule(acb->bh);
 }

 static int rbd_aio_discard_wrapper(rbd_image_t image,
@@ -675,6 +679,7 @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
    acb->ret = 0;
    acb->error = 0;
    acb->s = s;
+    acb->bh = NULL;

    if (cmd == RBD_AIO_WRITE) {
        qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
@@ -1,673 +0,0 @@
-/*
- * Replication Block filter
- *
- * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
- * Copyright (c) 2016 Intel Corporation
- * Copyright (c) 2016 FUJITSU LIMITED
- *
- * Author:
- *   Wen Congyang <wency@cn.fujitsu.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "block/nbd.h"
-#include "block/blockjob.h"
-#include "block/block_int.h"
-#include "block/block_backup.h"
-#include "sysemu/block-backend.h"
-#include "qapi/error.h"
-#include "replication.h"
-
-typedef struct BDRVReplicationState {
-    ReplicationMode mode;
-    int replication_state;
-    BdrvChild *active_disk;
-    BdrvChild *hidden_disk;
-    BdrvChild *secondary_disk;
-    char *top_id;
-    ReplicationState *rs;
-    Error *blocker;
-    int orig_hidden_flags;
-    int orig_secondary_flags;
-    int error;
-} BDRVReplicationState;
-
-enum {
-    BLOCK_REPLICATION_NONE,             /* block replication is not started */
-    BLOCK_REPLICATION_RUNNING,          /* block replication is running */
-    BLOCK_REPLICATION_FAILOVER,         /* failover is running in background */
-    BLOCK_REPLICATION_FAILOVER_FAILED,  /* failover failed */
-    BLOCK_REPLICATION_DONE,             /* block replication is done */
-};
-
-static void replication_start(ReplicationState *rs, ReplicationMode mode,
-                              Error **errp);
-static void replication_do_checkpoint(ReplicationState *rs, Error **errp);
-static void replication_get_error(ReplicationState *rs, Error **errp);
-static void replication_stop(ReplicationState *rs, bool failover,
-                             Error **errp);
-
-#define REPLICATION_MODE        "mode"
-#define REPLICATION_TOP_ID      "top-id"
-static QemuOptsList replication_runtime_opts = {
-    .name = "replication",
-    .head = QTAILQ_HEAD_INITIALIZER(replication_runtime_opts.head),
-    .desc = {
-        {
-            .name = REPLICATION_MODE,
-            .type = QEMU_OPT_STRING,
-        },
-        {
-            .name = REPLICATION_TOP_ID,
-            .type = QEMU_OPT_STRING,
-        },
-        { /* end of list */ }
-    },
-};
-
-static ReplicationOps replication_ops = {
-    .start = replication_start,
-    .checkpoint = replication_do_checkpoint,
-    .get_error = replication_get_error,
-    .stop = replication_stop,
-};
-
-static int replication_open(BlockDriverState *bs, QDict *options,
-                            int flags, Error **errp)
-{
-    int ret;
-    BDRVReplicationState *s = bs->opaque;
-    Error *local_err = NULL;
-    QemuOpts *opts = NULL;
-    const char *mode;
-    const char *top_id;
-
-    ret = -EINVAL;
-    opts = qemu_opts_create(&replication_runtime_opts, NULL, 0, &error_abort);
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
-        goto fail;
-    }
-
-    mode = qemu_opt_get(opts, REPLICATION_MODE);
-    if (!mode) {
-        error_setg(&local_err, "Missing the option mode");
-        goto fail;
-    }
-
-    if (!strcmp(mode, "primary")) {
-        s->mode = REPLICATION_MODE_PRIMARY;
-        top_id = qemu_opt_get(opts, REPLICATION_TOP_ID);
-        if (top_id) {
-            error_setg(&local_err, "The primary side does not support option top-id");
-            goto fail;
-        }
-    } else if (!strcmp(mode, "secondary")) {
-        s->mode = REPLICATION_MODE_SECONDARY;
-        top_id = qemu_opt_get(opts, REPLICATION_TOP_ID);
-        s->top_id = g_strdup(top_id);
-        if (!s->top_id) {
-            error_setg(&local_err, "Missing the option top-id");
-            goto fail;
-        }
-    } else {
-        error_setg(&local_err,
-                   "The option mode's value should be primary or secondary");
-        goto fail;
-    }
-
-    s->rs = replication_new(bs, &replication_ops);
-
-    ret = 0;
-
-fail:
-    qemu_opts_del(opts);
-    error_propagate(errp, local_err);
-
-    return ret;
-}
-
-static void replication_close(BlockDriverState *bs)
-{
-    BDRVReplicationState *s = bs->opaque;
-
-    if (s->replication_state == BLOCK_REPLICATION_RUNNING) {
-        replication_stop(s->rs, false, NULL);
-    }
-    if (s->replication_state == BLOCK_REPLICATION_FAILOVER) {
-        block_job_cancel_sync(s->active_disk->bs->job);
-    }
-
-    if (s->mode == REPLICATION_MODE_SECONDARY) {
-        g_free(s->top_id);
-    }
-
-    replication_remove(s->rs);
-}
-
-static int64_t replication_getlength(BlockDriverState *bs)
-{
-    return bdrv_getlength(bs->file->bs);
-}
-
-static int replication_get_io_status(BDRVReplicationState *s)
-{
-    switch (s->replication_state) {
-    case BLOCK_REPLICATION_NONE:
-        return -EIO;
-    case BLOCK_REPLICATION_RUNNING:
-        return 0;
-    case BLOCK_REPLICATION_FAILOVER:
-        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 0;
-    case BLOCK_REPLICATION_FAILOVER_FAILED:
-        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 1;
-    case BLOCK_REPLICATION_DONE:
-        /*
-         * active commit job completes, and active disk and secondary_disk
-         * is swapped, so we can operate bs->file directly
-         */
-        return s->mode == REPLICATION_MODE_PRIMARY ? -EIO : 0;
-    default:
-        abort();
-    }
-}
-
-static int replication_return_value(BDRVReplicationState *s, int ret)
-{
-    if (s->mode == REPLICATION_MODE_SECONDARY) {
-        return ret;
-    }
-
-    if (ret < 0) {
-        s->error = ret;
-        ret = 0;
-    }
-
-    return ret;
-}
-
-static coroutine_fn int replication_co_readv(BlockDriverState *bs,
-                                             int64_t sector_num,
-                                             int remaining_sectors,
-                                             QEMUIOVector *qiov)
-{
-    BDRVReplicationState *s = bs->opaque;
-    BdrvChild *child = s->secondary_disk;
-    BlockJob *job = NULL;
-    CowRequest req;
-    int ret;
-
-    if (s->mode == REPLICATION_MODE_PRIMARY) {
-        /* We only use it to forward primary write requests */
-        return -EIO;
-    }
-
-    ret = replication_get_io_status(s);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (child && child->bs) {
-        job = child->bs->job;
-    }
-
-    if (job) {
-        backup_wait_for_overlapping_requests(child->bs->job, sector_num,
-                                             remaining_sectors);
-        backup_cow_request_begin(&req, child->bs->job, sector_num,
-                                 remaining_sectors);
-        ret = bdrv_co_readv(bs->file, sector_num, remaining_sectors,
-                            qiov);
-        backup_cow_request_end(&req);
-        goto out;
-    }
-
-    ret = bdrv_co_readv(bs->file, sector_num, remaining_sectors, qiov);
-out:
-    return replication_return_value(s, ret);
-}
-
-static coroutine_fn int replication_co_writev(BlockDriverState *bs,
-                                              int64_t sector_num,
-                                              int remaining_sectors,
-                                              QEMUIOVector *qiov)
-{
-    BDRVReplicationState *s = bs->opaque;
-    QEMUIOVector hd_qiov;
-    uint64_t bytes_done = 0;
-    BdrvChild *top = bs->file;
-    BdrvChild *base = s->secondary_disk;
-    BdrvChild *target;
-    int ret, n;
-
-    ret = replication_get_io_status(s);
-    if (ret < 0) {
-        goto out;
-    }
-
-    if (ret == 0) {
-        ret = bdrv_co_writev(top, sector_num,
-                             remaining_sectors, qiov);
-        return replication_return_value(s, ret);
-    }
-
-    /*
-     * Failover failed, only write to active disk if the sectors
-     * have already been allocated in active disk/hidden disk.
-     */
-    qemu_iovec_init(&hd_qiov, qiov->niov);
-    while (remaining_sectors > 0) {
-        ret = bdrv_is_allocated_above(top->bs, base->bs, sector_num,
-                                      remaining_sectors, &n);
-        if (ret < 0) {
-            goto out1;
-        }
-
-        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_concat(&hd_qiov, qiov, bytes_done, n * BDRV_SECTOR_SIZE);
-
-        target = ret ? top : base;
-        ret = bdrv_co_writev(target, sector_num, n, &hd_qiov);
-        if (ret < 0) {
-            goto out1;
-        }
-
-        remaining_sectors -= n;
-        sector_num += n;
-        bytes_done += n * BDRV_SECTOR_SIZE;
-    }
-
-out1:
-    qemu_iovec_destroy(&hd_qiov);
-out:
-    return ret;
-}
-
-static bool replication_recurse_is_first_non_filter(BlockDriverState *bs,
-                                                    BlockDriverState *candidate)
-{
-    return bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
-}
-
-static void secondary_do_checkpoint(BDRVReplicationState *s, Error **errp)
-{
-    Error *local_err = NULL;
-    int ret;
-
-    if (!s->secondary_disk->bs->job) {
-        error_setg(errp, "Backup job was cancelled unexpectedly");
-        return;
-    }
-
-    backup_do_checkpoint(s->secondary_disk->bs->job, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    ret = s->active_disk->bs->drv->bdrv_make_empty(s->active_disk->bs);
-    if (ret < 0) {
-        error_setg(errp, "Cannot make active disk empty");
-        return;
-    }
-
-    ret = s->hidden_disk->bs->drv->bdrv_make_empty(s->hidden_disk->bs);
-    if (ret < 0) {
-        error_setg(errp, "Cannot make hidden disk empty");
-        return;
-    }
-}
-
-static void reopen_backing_file(BlockDriverState *bs, bool writable,
-                                Error **errp)
-{
-    BDRVReplicationState *s = bs->opaque;
-    BlockReopenQueue *reopen_queue = NULL;
-    int orig_hidden_flags, orig_secondary_flags;
-    int new_hidden_flags, new_secondary_flags;
-    Error *local_err = NULL;
-
-    if (writable) {
-        orig_hidden_flags = s->orig_hidden_flags =
-                                bdrv_get_flags(s->hidden_disk->bs);
-        new_hidden_flags = (orig_hidden_flags | BDRV_O_RDWR) &
-                                                    ~BDRV_O_INACTIVE;
-        orig_secondary_flags = s->orig_secondary_flags =
-                                bdrv_get_flags(s->secondary_disk->bs);
-        new_secondary_flags = (orig_secondary_flags | BDRV_O_RDWR) &
-                                                     ~BDRV_O_INACTIVE;
-    } else {
-        orig_hidden_flags = (s->orig_hidden_flags | BDRV_O_RDWR) &
-                                                    ~BDRV_O_INACTIVE;
-        new_hidden_flags = s->orig_hidden_flags;
-        orig_secondary_flags = (s->orig_secondary_flags | BDRV_O_RDWR) &
-                                                    ~BDRV_O_INACTIVE;
-        new_secondary_flags = s->orig_secondary_flags;
-    }
-
-    if (orig_hidden_flags != new_hidden_flags) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, s->hidden_disk->bs, NULL,
-                                         new_hidden_flags);
-    }
-
-    if (!(orig_secondary_flags & BDRV_O_RDWR)) {
-        reopen_queue = bdrv_reopen_queue(reopen_queue, s->secondary_disk->bs,
-                                         NULL, new_secondary_flags);
-    }
-
-    if (reopen_queue) {
-        bdrv_reopen_multiple(bdrv_get_aio_context(bs),
-                             reopen_queue, &local_err);
-        error_propagate(errp, local_err);
-    }
-}
-
-static void backup_job_cleanup(BlockDriverState *bs)
-{
-    BDRVReplicationState *s = bs->opaque;
-    BlockDriverState *top_bs;
-
-    top_bs = bdrv_lookup_bs(s->top_id, s->top_id, NULL);
-    if (!top_bs) {
-        return;
-    }
-    bdrv_op_unblock_all(top_bs, s->blocker);
-    error_free(s->blocker);
-    reopen_backing_file(bs, false, NULL);
-}
-
-static void backup_job_completed(void *opaque, int ret)
-{
-    BlockDriverState *bs = opaque;
-    BDRVReplicationState *s = bs->opaque;
-
-    if (s->replication_state != BLOCK_REPLICATION_FAILOVER) {
-        /* The backup job is cancelled unexpectedly */
-        s->error = -EIO;
-    }
-
-    backup_job_cleanup(bs);
-}
-
-static bool check_top_bs(BlockDriverState *top_bs, BlockDriverState *bs)
-{
-    BdrvChild *child;
-
-    /* The bs itself is the top_bs */
-    if (top_bs == bs) {
-        return true;
-    }
-
-    /* Iterate over top_bs's children */
-    QLIST_FOREACH(child, &top_bs->children, next) {
-        if (child->bs == bs || check_top_bs(child->bs, bs)) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-static void replication_start(ReplicationState *rs, ReplicationMode mode,
-                              Error **errp)
-{
-    BlockDriverState *bs = rs->opaque;
-    BDRVReplicationState *s;
-    BlockDriverState *top_bs;
-    int64_t active_length, hidden_length, disk_length;
-    AioContext *aio_context;
-    Error *local_err = NULL;
-    BlockJob *job;
-
-    aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(aio_context);
-    s = bs->opaque;
-
-    if (s->replication_state != BLOCK_REPLICATION_NONE) {
-        error_setg(errp, "Block replication is running or done");
-        aio_context_release(aio_context);
-        return;
-    }
-
-    if (s->mode != mode) {
-        error_setg(errp, "The parameter mode's value is invalid, needs %d,"
-                   " but got %d", s->mode, mode);
-        aio_context_release(aio_context);
-        return;
-    }
-
-    switch (s->mode) {
-    case REPLICATION_MODE_PRIMARY:
-        break;
-    case REPLICATION_MODE_SECONDARY:
-        s->active_disk = bs->file;
-        if (!s->active_disk || !s->active_disk->bs ||
-                                    !s->active_disk->bs->backing) {
-            error_setg(errp, "Active disk doesn't have backing file");
-            aio_context_release(aio_context);
-            return;
-        }
-
-        s->hidden_disk = s->active_disk->bs->backing;
-        if (!s->hidden_disk->bs || !s->hidden_disk->bs->backing) {
-            error_setg(errp, "Hidden disk doesn't have backing file");
-            aio_context_release(aio_context);
-            return;
-        }
-
-        s->secondary_disk = s->hidden_disk->bs->backing;
-        if (!s->secondary_disk->bs || !bdrv_has_blk(s->secondary_disk->bs)) {
-            error_setg(errp, "The secondary disk doesn't have block backend");
-            aio_context_release(aio_context);
-            return;
-        }
-
-        /* verify the length */
-        active_length = bdrv_getlength(s->active_disk->bs);
-        hidden_length = bdrv_getlength(s->hidden_disk->bs);
-        disk_length = bdrv_getlength(s->secondary_disk->bs);
-        if (active_length < 0 || hidden_length < 0 || disk_length < 0 ||
-            active_length != hidden_length || hidden_length != disk_length) {
-            error_setg(errp, "Active disk, hidden disk, secondary disk's length"
-                       " are not the same");
-            aio_context_release(aio_context);
-            return;
-        }
-
-        if (!s->active_disk->bs->drv->bdrv_make_empty ||
-            !s->hidden_disk->bs->drv->bdrv_make_empty) {
-            error_setg(errp,
-                       "Active disk or hidden disk doesn't support make_empty");
-            aio_context_release(aio_context);
-            return;
-        }
-
-        /* reopen the backing file in r/w mode */
-        reopen_backing_file(bs, true, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            aio_context_release(aio_context);
-            return;
-        }
-
-        /* start backup job now */
-        error_setg(&s->blocker,
-                   "Block device is in use by internal backup job");
-
-        top_bs = bdrv_lookup_bs(s->top_id, s->top_id, NULL);
-        if (!top_bs || !bdrv_is_root_node(top_bs) ||
-            !check_top_bs(top_bs, bs)) {
-            error_setg(errp, "No top_bs or it is invalid");
-            reopen_backing_file(bs, false, NULL);
-            aio_context_release(aio_context);
-            return;
-        }
-        bdrv_op_block_all(top_bs, s->blocker);
-        bdrv_op_unblock(top_bs, BLOCK_OP_TYPE_DATAPLANE, s->blocker);
-
-        job = backup_job_create(NULL, s->secondary_disk->bs, s->hidden_disk->bs,
-                                0, MIRROR_SYNC_MODE_NONE, NULL, false,
-                                BLOCKDEV_ON_ERROR_REPORT,
-                                BLOCKDEV_ON_ERROR_REPORT, BLOCK_JOB_INTERNAL,
-                                backup_job_completed, bs, NULL, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            backup_job_cleanup(bs);
-            aio_context_release(aio_context);
-            return;
-        }
-        block_job_start(job);
-        break;
-    default:
-        aio_context_release(aio_context);
-        abort();
-    }
-
-    s->replication_state = BLOCK_REPLICATION_RUNNING;
-
-    if (s->mode == REPLICATION_MODE_SECONDARY) {
-        secondary_do_checkpoint(s, errp);
-    }
-
-    s->error = 0;
-    aio_context_release(aio_context);
-}
-
-static void replication_do_checkpoint(ReplicationState *rs, Error **errp)
-{
-    BlockDriverState *bs = rs->opaque;
-    BDRVReplicationState *s;
-    AioContext *aio_context;
-
-    aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(aio_context);
-    s = bs->opaque;
-
-    if (s->mode == REPLICATION_MODE_SECONDARY) {
-        secondary_do_checkpoint(s, errp);
-    }
-    aio_context_release(aio_context);
-}
-
-static void replication_get_error(ReplicationState *rs, Error **errp)
-{
-    BlockDriverState *bs = rs->opaque;
-    BDRVReplicationState *s;
-    AioContext *aio_context;
-
-    aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(aio_context);
-    s = bs->opaque;
-
-    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
-        error_setg(errp, "Block replication is not running");
-        aio_context_release(aio_context);
-        return;
-    }
-
-    if (s->error) {
-        error_setg(errp, "I/O error occurred");
-        aio_context_release(aio_context);
-        return;
-    }
-    aio_context_release(aio_context);
-}
-
-static void replication_done(void *opaque, int ret)
-{
-    BlockDriverState *bs = opaque;
-    BDRVReplicationState *s = bs->opaque;
-
-    if (ret == 0) {
-        s->replication_state = BLOCK_REPLICATION_DONE;
-
-        /* refresh top bs's filename */
-        bdrv_refresh_filename(bs);
-        s->active_disk = NULL;
-        s->secondary_disk = NULL;
-        s->hidden_disk = NULL;
-        s->error = 0;
-    } else {
-        s->replication_state = BLOCK_REPLICATION_FAILOVER_FAILED;
-        s->error = -EIO;
-    }
-}
-
-static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
-{
-    BlockDriverState *bs = rs->opaque;
-    BDRVReplicationState *s;
-    AioContext *aio_context;
-
-    aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(aio_context);
-    s = bs->opaque;
-
-    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
-        error_setg(errp, "Block replication is not running");
-        aio_context_release(aio_context);
-        return;
-    }
-
-    switch (s->mode) {
-    case REPLICATION_MODE_PRIMARY:
-        s->replication_state = BLOCK_REPLICATION_DONE;
-        s->error = 0;
-        break;
-    case REPLICATION_MODE_SECONDARY:
-        /*
-         * This BDS will be closed, and the job should be completed
-         * before the BDS is closed, because we will access hidden
-         * disk, secondary disk in backup_job_completed().
-         */
-        if (s->secondary_disk->bs->job) {
-            block_job_cancel_sync(s->secondary_disk->bs->job);
-        }
-
-        if (!failover) {
-            secondary_do_checkpoint(s, errp);
-            s->replication_state = BLOCK_REPLICATION_DONE;
-            aio_context_release(aio_context);
-            return;
-        }
-
-        s->replication_state = BLOCK_REPLICATION_FAILOVER;
-        commit_active_start(NULL, s->active_disk->bs, s->secondary_disk->bs,
-                            BLOCK_JOB_INTERNAL, 0, BLOCKDEV_ON_ERROR_REPORT,
-                            replication_done, bs, errp, true);
-        break;
-    default:
-        aio_context_release(aio_context);
-        abort();
-    }
-    aio_context_release(aio_context);
-}
-
-BlockDriver bdrv_replication = {
-    .format_name                = "replication",
-    .protocol_name              = "replication",
-    .instance_size              = sizeof(BDRVReplicationState),
-
-    .bdrv_open                  = replication_open,
-    .bdrv_close                 = replication_close,
-
-    .bdrv_getlength             = replication_getlength,
-    .bdrv_co_readv              = replication_co_readv,
-    .bdrv_co_writev             = replication_co_writev,
-
-    .is_filter                  = true,
-    .bdrv_recurse_is_first_non_filter = replication_recurse_is_first_non_filter,
-
-    .has_variable_length        = true,
-};
-
-static void bdrv_replication_init(void)
-{
-    bdrv_register(&bdrv_replication);
-}
-
-block_init(bdrv_replication_init);
@@ -641,7 +641,6 @@ static void restart_co_req(void *opaque)

 typedef struct SheepdogReqCo {
    int sockfd;
-    BlockDriverState *bs;
    AioContext *aio_context;
    SheepdogReq *hdr;
    void *data;
@@ -702,9 +701,6 @@ out:

    srco->ret = ret;
    srco->finished = true;
-    if (srco->bs) {
-        bdrv_wakeup(srco->bs);
-    }
 }

 /*
@@ -712,14 +708,13 @@ out:
 *
 * Return 0 on success, -errno in case of error.
 */
-static int do_req(int sockfd, BlockDriverState *bs, SheepdogReq *hdr,
+static int do_req(int sockfd, AioContext *aio_context, SheepdogReq *hdr,
                  void *data, unsigned int *wlen, unsigned int *rlen)
 {
    Coroutine *co;
    SheepdogReqCo srco = {
        .sockfd = sockfd,
-        .aio_context = bs ? bdrv_get_aio_context(bs) : qemu_get_aio_context(),
-        .bs = bs,
+        .aio_context = aio_context,
        .hdr = hdr,
        .data = data,
        .wlen = wlen,
@@ -732,14 +727,9 @@ static int do_req(int sockfd, BlockDriverState *bs, SheepdogReq *hdr,
        do_co_req(&srco);
    } else {
        co = qemu_coroutine_create(do_co_req, &srco);
-        if (bs) {
-            qemu_coroutine_enter(co);
-            BDRV_POLL_WHILE(bs, !srco.finished);
-        } else {
-            qemu_coroutine_enter(co);
-            while (!srco.finished) {
-                aio_poll(qemu_get_aio_context(), true);
-            }
+        qemu_coroutine_enter(co);
+        while (!srco.finished) {
+            aio_poll(aio_context, true);
        }
    }

@@ -1059,7 +1049,7 @@ static int parse_vdiname(BDRVSheepdogState *s, const char *filename,
    const char *host_spec, *vdi_spec;
    int nr_sep, ret;

-    strstart(filename, "sheepdog:", &filename);
+    strstart(filename, "sheepdog:", (const char **)&filename);
    p = q = g_strdup(filename);

    /* count the number of separators */
@@ -1135,7 +1125,7 @@ static int find_vdi_name(BDRVSheepdogState *s, const char *filename,
    hdr.snapid = snapid;
    hdr.flags = SD_FLAG_CMD_WRITE;

-    ret = do_req(fd, s->bs, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
    if (ret) {
        error_setg_errno(errp, -ret, "cannot get vdi info");
        goto out;
@@ -1250,7 +1240,7 @@ out:
    qemu_co_mutex_unlock(&s->lock);
 }

-static int read_write_object(int fd, BlockDriverState *bs, char *buf,
+static int read_write_object(int fd, AioContext *aio_context, char *buf,
                             uint64_t oid, uint8_t copies,
                             unsigned int datalen, uint64_t offset,
                             bool write, bool create, uint32_t cache_flags)
@@ -1284,7 +1274,7 @@ static int read_write_object(int fd, BlockDriverState *bs, char *buf,
    hdr.offset = offset;
    hdr.copies = copies;

-    ret = do_req(fd, bs, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
+    ret = do_req(fd, aio_context, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
    if (ret) {
        error_report("failed to send a request to the sheep");
        return ret;
@@ -1299,22 +1289,22 @@ static int read_write_object(int fd, BlockDriverState *bs, char *buf,
    }
 }

-static int read_object(int fd, BlockDriverState *bs, char *buf,
+static int read_object(int fd, AioContext *aio_context, char *buf,
                       uint64_t oid, uint8_t copies,
                       unsigned int datalen, uint64_t offset,
                       uint32_t cache_flags)
 {
-    return read_write_object(fd, bs, buf, oid, copies,
+    return read_write_object(fd, aio_context, buf, oid, copies,
                             datalen, offset, false,
                             false, cache_flags);
 }

-static int write_object(int fd, BlockDriverState *bs, char *buf,
+static int write_object(int fd, AioContext *aio_context, char *buf,
                        uint64_t oid, uint8_t copies,
                        unsigned int datalen, uint64_t offset, bool create,
                        uint32_t cache_flags)
 {
-    return read_write_object(fd, bs, buf, oid, copies,
+    return read_write_object(fd, aio_context, buf, oid, copies,
                             datalen, offset, true,
                             create, cache_flags);
 }
@@ -1341,7 +1331,7 @@ static int reload_inode(BDRVSheepdogState *s, uint32_t snapid, const char *tag)
        goto out;
    }

-    ret = read_object(fd, s->bs, (char *)inode, vid_to_vdi_oid(vid),
+    ret = read_object(fd, s->aio_context, (char *)inode, vid_to_vdi_oid(vid),
                      s->inode.nr_copies, SD_INODE_HEADER_SIZE, 0,
                      s->cache_flags);
    if (ret < 0) {
@@ -1499,7 +1489,7 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags,
    }

    buf = g_malloc(SD_INODE_SIZE);
-    ret = read_object(fd, s->bs, buf, vid_to_vdi_oid(vid),
+    ret = read_object(fd, s->aio_context, buf, vid_to_vdi_oid(vid),
                      0, SD_INODE_SIZE, 0, s->cache_flags);

    closesocket(fd);
@@ -1628,7 +1618,7 @@ static int do_sd_create(BDRVSheepdogState *s, uint32_t *vdi_id, int snapshot,
    hdr.copies = s->inode.nr_copies;
    hdr.block_size_shift = s->inode.block_size_shift;

-    ret = do_req(fd, NULL, (SheepdogReq *)&hdr, buf, &wlen, &rlen);
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr, buf, &wlen, &rlen);

    closesocket(fd);

@@ -1896,7 +1886,7 @@ static int sd_create(const char *filename, QemuOpts *opts,
        hdr.opcode = SD_OP_GET_CLUSTER_DEFAULT;
        hdr.proto_ver = SD_PROTO_VER;

-        ret = do_req(fd, NULL, (SheepdogReq *)&hdr,
+        ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr,
                     NULL, &wlen, &rlen);
        closesocket(fd);
        if (ret) {
@@ -1961,7 +1951,7 @@ static void sd_close(BlockDriverState *bs)
    hdr.data_length = wlen;
    hdr.flags = SD_FLAG_CMD_WRITE;

-    ret = do_req(fd, s->bs, (SheepdogReq *)&hdr,
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr,
                 s->name, &wlen, &rlen);

    closesocket(fd);
@@ -2010,7 +2000,7 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
    /* we don't need to update entire object */
    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
    s->inode.vdi_size = offset;
-    ret = write_object(fd, s->bs, (char *)&s->inode,
+    ret = write_object(fd, s->aio_context, (char *)&s->inode,
                       vid_to_vdi_oid(s->inode.vdi_id), s->inode.nr_copies,
                       datalen, 0, false, s->cache_flags);
    close(fd);
@@ -2080,7 +2070,7 @@ static bool sd_delete(BDRVSheepdogState *s)
        return false;
    }

-    ret = do_req(fd, s->bs, (SheepdogReq *)&hdr,
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr,
                 s->name, &wlen, &rlen);
    closesocket(fd);
    if (ret) {
@@ -2136,7 +2126,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
        goto out;
    }

-    ret = read_object(fd, s->bs, buf, vid_to_vdi_oid(vid),
+    ret = read_object(fd, s->aio_context, buf, vid_to_vdi_oid(vid),
                      s->inode.nr_copies, SD_INODE_SIZE, 0, s->cache_flags);

    closesocket(fd);
@@ -2421,7 +2411,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        goto cleanup;
    }

-    ret = write_object(fd, s->bs, (char *)&s->inode,
+    ret = write_object(fd, s->aio_context, (char *)&s->inode,
                       vid_to_vdi_oid(s->inode.vdi_id), s->inode.nr_copies,
                       datalen, 0, false, s->cache_flags);
    if (ret < 0) {
@@ -2436,7 +2426,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
        goto cleanup;
    }

-    ret = read_object(fd, s->bs, (char *)inode,
+    ret = read_object(fd, s->aio_context, (char *)inode,
                      vid_to_vdi_oid(new_vid), s->inode.nr_copies, datalen, 0,
                      s->cache_flags);

@@ -2538,7 +2528,7 @@ static bool remove_objects(BDRVSheepdogState *s)
            i++;
        }

-        ret = write_object(fd, s->bs,
+        ret = write_object(fd, s->aio_context,
                           (char *)&inode->data_vdi_id[start_idx],
                           vid_to_vdi_oid(s->inode.vdi_id), inode->nr_copies,
                           (i - start_idx) * sizeof(uint32_t),
@@ -2610,7 +2600,7 @@ static int sd_snapshot_delete(BlockDriverState *bs,
        return -1;
    }

-    ret = do_req(fd, s->bs, (SheepdogReq *)&hdr,
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&hdr,
                 buf, &wlen, &rlen);
    closesocket(fd);
    if (ret) {
@@ -2662,7 +2652,8 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
    req.opcode = SD_OP_READ_VDIS;
    req.data_length = max;

-    ret = do_req(fd, s->bs, &req, vdi_inuse, &wlen, &rlen);
+    ret = do_req(fd, s->aio_context, (SheepdogReq *)&req,
+                 vdi_inuse, &wlen, &rlen);

    closesocket(fd);
    if (ret) {
@@ -2688,7 +2679,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        }

        /* we don't need to read entire object */
-        ret = read_object(fd, s->bs, (char *)&inode,
+        ret = read_object(fd, s->aio_context, (char *)&inode,
                          vid_to_vdi_oid(vid),
                          0, SD_INODE_SIZE - sizeof(inode.data_vdi_id), 0,
                          s->cache_flags);
@@ -2754,11 +2745,11 @@ static int do_load_save_vmstate(BDRVSheepdogState *s, uint8_t *data,

        create = (offset == 0);
        if (load) {
-            ret = read_object(fd, s->bs, (char *)data, vmstate_oid,
+            ret = read_object(fd, s->aio_context, (char *)data, vmstate_oid,
                              s->inode.nr_copies, data_len, offset,
                              s->cache_flags);
        } else {
-            ret = write_object(fd, s->bs, (char *)data, vmstate_oid,
+            ret = write_object(fd, s->aio_context, (char *)data, vmstate_oid,
                               s->inode.nr_copies, data_len, offset, create,
                               s->cache_flags);
        }
@@ -30,14 +30,10 @@
 #include "block/block_int.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "qemu/cutils.h"
 #include "qemu/sockets.h"
 #include "qemu/uri.h"
-#include "qapi-visit.h"
 #include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
-#include "qapi/qobject-input-visitor.h"
-#include "qapi/qobject-output-visitor.h"

 /* DEBUG_SSH=1 enables the DPRINTF (debugging printf) statements in
 * this block driver code.
@@ -78,9 +74,8 @@ typedef struct BDRVSSHState {
     */
    LIBSSH2_SFTP_ATTRIBUTES attrs;

-    InetSocketAddress *inet;
-
    /* Used to warn if 'flush' is not supported. */
+    char *hostport;
    bool unsafe_flush_warning;
 } BDRVSSHState;

@@ -94,6 +89,7 @@ static void ssh_state_init(BDRVSSHState *s)

 static void ssh_state_free(BDRVSSHState *s)
 {
+    g_free(s->hostport);
    if (s->sftp_handle) {
        libssh2_sftp_close(s->sftp_handle);
    }
@@ -197,7 +193,6 @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
 {
    URI *uri = NULL;
    QueryParams *qp;
-    char *port_str;
    int i;

    uri = uri_parse(filename);
@@ -230,11 +225,11 @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
        qdict_put(options, "user", qstring_from_str(uri->user));
    }

-    qdict_put(options, "server.host", qstring_from_str(uri->server));
+    qdict_put(options, "host", qstring_from_str(uri->server));

-    port_str = g_strdup_printf("%d", uri->port ?: 22);
-    qdict_put(options, "server.port", qstring_from_str(port_str));
-    g_free(port_str);
+    if (uri->port) {
+        qdict_put(options, "port", qint_from_int(uri->port));
+    }

    qdict_put(options, "path", qstring_from_str(uri->path));

@@ -259,31 +254,15 @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
    return -EINVAL;
 }

-static bool ssh_has_filename_options_conflict(QDict *options, Error **errp)
-{
-    const QDictEntry *qe;
-
-    for (qe = qdict_first(options); qe; qe = qdict_next(options, qe)) {
-        if (!strcmp(qe->key, "host") ||
-            !strcmp(qe->key, "port") ||
-            !strcmp(qe->key, "path") ||
-            !strcmp(qe->key, "user") ||
-            !strcmp(qe->key, "host_key_check") ||
-            strstart(qe->key, "server.", NULL))
-        {
-            error_setg(errp, "Option '%s' cannot be used with a file name",
-                       qe->key);
-            return true;
-        }
-    }
-
-    return false;
-}
-
 static void ssh_parse_filename(const char *filename, QDict *options,
                               Error **errp)
 {
-    if (ssh_has_filename_options_conflict(options, errp)) {
+    if (qdict_haskey(options, "user") ||
+        qdict_haskey(options, "host") ||
+        qdict_haskey(options, "port") ||
+        qdict_haskey(options, "path") ||
+        qdict_haskey(options, "host_key_check")) {
+        error_setg(errp, "user, host, port, path, host_key_check cannot be used at the same time as a file option");
        return;
    }

@@ -561,68 +540,14 @@ static QemuOptsList ssh_runtime_opts = {
    },
 };

-static bool ssh_process_legacy_socket_options(QDict *output_opts,
-                                              QemuOpts *legacy_opts,
-                                              Error **errp)
-{
-    const char *host = qemu_opt_get(legacy_opts, "host");
-    const char *port = qemu_opt_get(legacy_opts, "port");
-
-    if (!host && port) {
-        error_setg(errp, "port may not be used without host");
-        return false;
-    }
-
-    if (host) {
-        qdict_put(output_opts, "server.host", qstring_from_str(host));
-        qdict_put(output_opts, "server.port",
-                  qstring_from_str(port ?: stringify(22)));
-    }
-
-    return true;
-}
-
-static InetSocketAddress *ssh_config(QDict *options, Error **errp)
-{
-    InetSocketAddress *inet = NULL;
-    QDict *addr = NULL;
-    QObject *crumpled_addr = NULL;
-    Visitor *iv = NULL;
-    Error *local_error = NULL;
-
-    qdict_extract_subqdict(options, &addr, "server.");
-    if (!qdict_size(addr)) {
-        error_setg(errp, "SSH server address missing");
-        goto out;
-    }
-
-    crumpled_addr = qdict_crumple(addr, errp);
-    if (!crumpled_addr) {
-        goto out;
-    }
-
-    iv = qobject_input_visitor_new(crumpled_addr, true);
-    visit_type_InetSocketAddress(iv, NULL, &inet, &local_error);
-    if (local_error) {
-        error_propagate(errp, local_error);
-        goto out;
-    }
-
-out:
-    QDECREF(addr);
-    qobject_decref(crumpled_addr);
-    visit_free(iv);
-    return inet;
-}
-
 static int connect_to_ssh(BDRVSSHState *s, QDict *options,
                          int ssh_flags, int creat_mode, Error **errp)
 {
    int r, ret;
    QemuOpts *opts = NULL;
    Error *local_err = NULL;
-    const char *user, *path, *host_key_check;
-    long port = 0;
+    const char *host, *user, *path, *host_key_check;
+    int port;

    opts = qemu_opts_create(&ssh_runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
@@ -632,11 +557,15 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
        goto err;
    }

-    if (!ssh_process_legacy_socket_options(options, opts, errp)) {
+    host = qemu_opt_get(opts, "host");
+    if (!host) {
        ret = -EINVAL;
+        error_setg(errp, "No hostname was specified");
        goto err;
    }

+    port = qemu_opt_get_number(opts, "port", 22);
+
    path = qemu_opt_get(opts, "path");
    if (!path) {
        ret = -EINVAL;
@@ -659,21 +588,12 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
        host_key_check = "yes";
    }

-    /* Pop the config into our state object, Exit if invalid */
-    s->inet = ssh_config(options, errp);
-    if (!s->inet) {
-        ret = -EINVAL;
-        goto err;
-    }
-
-    if (qemu_strtol(s->inet->port, NULL, 10, &port) < 0) {
-        error_setg(errp, "Use only numeric port value");
-        ret = -EINVAL;
-        goto err;
-    }
+    /* Construct the host:port name for inet_connect. */
+    g_free(s->hostport);
+    s->hostport = g_strdup_printf("%s:%d", host, port);

    /* Open the socket and connect. */
-    s->sock = inet_connect_saddr(s->inet, errp, NULL, NULL);
+    s->sock = inet_connect(s->hostport, errp);
    if (s->sock < 0) {
        ret = -EIO;
        goto err;
@@ -699,8 +619,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    }

    /* Check the remote host's key against known_hosts. */
-    ret = check_host_key(s, s->inet->host, port, host_key_check,
-                         errp);
+    ret = check_host_key(s, host, port, host_key_check, errp);
    if (ret < 0) {
        goto err;
    }
@@ -1121,7 +1040,7 @@ static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
 {
    if (!s->unsafe_flush_warning) {
        error_report("warning: ssh server %s does not support fsync",
-                     s->inet->host);
+                     s->hostport);
        if (what) {
            error_report("to support fsync, you need %s", what);
        }
@@ -14,7 +14,7 @@
 #include "qemu/osdep.h"
 #include "trace.h"
 #include "block/block_int.h"
-#include "block/blockjob_int.h"
+#include "block/blockjob.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/ratelimit.h"
@@ -37,7 +37,6 @@ typedef struct StreamBlockJob {
    BlockDriverState *base;
    BlockdevOnError on_error;
    char *backing_file_str;
-    int bs_flags;
 } StreamBlockJob;

 static int coroutine_fn stream_populate(BlockBackend *blk,
@@ -82,11 +81,6 @@ static void stream_complete(BlockJob *job, void *opaque)
        bdrv_set_backing_hd(bs, base);
    }

-    /* Reopen the image back in read-only mode if necessary */
-    if (s->bs_flags != bdrv_get_flags(bs)) {
-        bdrv_reopen(bs, s->bs_flags, NULL);
-    }
-
    g_free(s->backing_file_str);
    block_job_completed(&s->common, data->ret);
    g_free(data);
@@ -218,43 +212,26 @@ static const BlockJobDriver stream_job_driver = {
    .instance_size = sizeof(StreamBlockJob),
    .job_type      = BLOCK_JOB_TYPE_STREAM,
    .set_speed     = stream_set_speed,
-    .start         = stream_run,
 };

 void stream_start(const char *job_id, BlockDriverState *bs,
                  BlockDriverState *base, const char *backing_file_str,
-                  int64_t speed, BlockdevOnError on_error, Error **errp)
+                  int64_t speed, BlockdevOnError on_error,
+                  BlockCompletionFunc *cb, void *opaque, Error **errp)
 {
    StreamBlockJob *s;
-    BlockDriverState *iter;
-    int orig_bs_flags;

    s = block_job_create(job_id, &stream_job_driver, bs, speed,
-                         BLOCK_JOB_DEFAULT, NULL, NULL, errp);
+                         cb, opaque, errp);
    if (!s) {
        return;
    }

-    /* Make sure that the image is opened in read-write mode */
-    orig_bs_flags = bdrv_get_flags(bs);
-    if (!(orig_bs_flags & BDRV_O_RDWR)) {
-        if (bdrv_reopen(bs, orig_bs_flags | BDRV_O_RDWR, errp) != 0) {
-            block_job_unref(&s->common);
-            return;
-        }
-    }
-
-    /* Block all intermediate nodes between bs and base, because they
-     * will disappear from the chain after this operation */
-    for (iter = backing_bs(bs); iter && iter != base; iter = backing_bs(iter)) {
-        block_job_add_bdrv(&s->common, iter);
-    }
-
    s->base = base;
    s->backing_file_str = g_strdup(backing_file_str);
-    s->bs_flags = orig_bs_flags;

    s->on_error = on_error;
-    trace_stream_start(bs, base, s);
-    block_job_start(&s->common);
+    s->common.co = qemu_coroutine_create(stream_run, s);
+    trace_stream_start(bs, base, s, s->common.co, opaque);
+    qemu_coroutine_enter(s->common.co);
 }
@@ -9,6 +9,7 @@ blk_co_preadv(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags
 blk_co_pwritev(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags) "blk %p bs %p offset %"PRId64" bytes %u flags %x"

 # block/io.c
+bdrv_aio_pdiscard(void *bs, int64_t offset, int count, void *opaque) "bs %p offset %"PRId64" count %d opaque %p"
 bdrv_aio_flush(void *bs, void *opaque) "bs %p opaque %p"
 bdrv_aio_readv(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
 bdrv_aio_writev(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
@@ -19,14 +20,14 @@ bdrv_co_do_copy_on_readv(void *bs, int64_t offset, unsigned int bytes, int64_t c

 # block/stream.c
 stream_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
-stream_start(void *bs, void *base, void *s) "bs %p base %p s %p"
+stream_start(void *bs, void *base, void *s, void *co, void *opaque) "bs %p base %p s %p co %p opaque %p"

 # block/commit.c
 commit_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
-commit_start(void *bs, void *base, void *top, void *s) "bs %p base %p top %p s %p"
+commit_start(void *bs, void *base, void *top, void *s, void *co, void *opaque) "bs %p base %p top %p s %p co %p opaque %p"

 # block/mirror.c
-mirror_start(void *bs, void *s, void *opaque) "bs %p s %p opaque %p"
+mirror_start(void *bs, void *s, void *co, void *opaque) "bs %p s %p co %p opaque %p"
 mirror_restart_iter(void *s, int64_t cnt) "s %p dirty count %"PRId64
 mirror_before_flush(void *s) "s %p"
 mirror_before_drain(void *s, int64_t cnt) "s %p dirty count %"PRId64
@@ -51,6 +52,7 @@ qmp_block_job_cancel(void *job) "job %p"
 qmp_block_job_pause(void *job) "job %p"
 qmp_block_job_resume(void *job) "job %p"
 qmp_block_job_complete(void *job) "job %p"
+block_job_cb(void *bs, void *job, int ret) "bs %p job %p ret %d"
 qmp_block_stream(void *bs, void *job) "bs %p job %p"

 # block/raw-win32.c
@@ -58,7 +58,14 @@
 #include "migration/migration.h"
 #include "qemu/coroutine.h"
 #include "qemu/cutils.h"
-#include "qemu/uuid.h"
+
+#if defined(CONFIG_UUID)
+#include <uuid/uuid.h>
+#else
+/* TODO: move uuid emulation to some central place in QEMU. */
+#include "sysemu/sysemu.h"     /* UUID_FMT */
+typedef unsigned char uuid_t[16];
+#endif

 /* Code configuration options. */

@@ -133,6 +140,28 @@
 #define VDI_DISK_SIZE_MAX        ((uint64_t)VDI_BLOCKS_IN_IMAGE_MAX * \
                                  (uint64_t)DEFAULT_CLUSTER_SIZE)

+#if !defined(CONFIG_UUID)
+static inline void uuid_generate(uuid_t out)
+{
+    memset(out, 0, sizeof(uuid_t));
+}
+
+static inline int uuid_is_null(const uuid_t uu)
+{
+    uuid_t null_uuid = { 0 };
+    return memcmp(uu, null_uuid, sizeof(uuid_t)) == 0;
+}
+
+# if defined(CONFIG_VDI_DEBUG)
+static inline void uuid_unparse(const uuid_t uu, char *out)
+{
+    snprintf(out, 37, UUID_FMT,
+            uu[0], uu[1], uu[2], uu[3], uu[4], uu[5], uu[6], uu[7],
+            uu[8], uu[9], uu[10], uu[11], uu[12], uu[13], uu[14], uu[15]);
+}
+# endif
+#endif
+
 typedef struct {
    char text[0x40];
    uint32_t signature;
@@ -153,10 +182,10 @@ typedef struct {
    uint32_t block_extra;       /* unused here */
    uint32_t blocks_in_image;
    uint32_t blocks_allocated;
-    QemuUUID uuid_image;
-    QemuUUID uuid_last_snap;
-    QemuUUID uuid_link;
-    QemuUUID uuid_parent;
+    uuid_t uuid_image;
+    uuid_t uuid_last_snap;
+    uuid_t uuid_link;
+    uuid_t uuid_parent;
    uint64_t unused2[7];
 } QEMU_PACKED VdiHeader;

@@ -177,6 +206,16 @@ typedef struct {
    Error *migration_blocker;
 } BDRVVdiState;

+/* Change UUID from little endian (IPRT = VirtualBox format) to big endian
+ * format (network byte order, standard, see RFC 4122) and vice versa.
+ */
+static void uuid_convert(uuid_t uuid)
+{
+    bswap32s((uint32_t *)&uuid[0]);
+    bswap16s((uint16_t *)&uuid[4]);
+    bswap16s((uint16_t *)&uuid[6]);
+}
+
 static void vdi_header_to_cpu(VdiHeader *header)
 {
    le32_to_cpus(&header->signature);
@@ -195,10 +234,10 @@ static void vdi_header_to_cpu(VdiHeader *header)
    le32_to_cpus(&header->block_extra);
    le32_to_cpus(&header->blocks_in_image);
    le32_to_cpus(&header->blocks_allocated);
-    qemu_uuid_bswap(&header->uuid_image);
-    qemu_uuid_bswap(&header->uuid_last_snap);
-    qemu_uuid_bswap(&header->uuid_link);
-    qemu_uuid_bswap(&header->uuid_parent);
+    uuid_convert(header->uuid_image);
+    uuid_convert(header->uuid_last_snap);
+    uuid_convert(header->uuid_link);
+    uuid_convert(header->uuid_parent);
 }

 static void vdi_header_to_le(VdiHeader *header)
@@ -219,10 +258,10 @@ static void vdi_header_to_le(VdiHeader *header)
    cpu_to_le32s(&header->block_extra);
    cpu_to_le32s(&header->blocks_in_image);
    cpu_to_le32s(&header->blocks_allocated);
-    qemu_uuid_bswap(&header->uuid_image);
-    qemu_uuid_bswap(&header->uuid_last_snap);
-    qemu_uuid_bswap(&header->uuid_link);
-    qemu_uuid_bswap(&header->uuid_parent);
+    uuid_convert(header->uuid_image);
+    uuid_convert(header->uuid_last_snap);
+    uuid_convert(header->uuid_link);
+    uuid_convert(header->uuid_parent);
 }

 #if defined(CONFIG_VDI_DEBUG)
@@ -430,11 +469,11 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
                   (uint64_t)header.blocks_in_image * header.block_size);
        ret = -ENOTSUP;
        goto fail;
-    } else if (!qemu_uuid_is_null(&header.uuid_link)) {
+    } else if (!uuid_is_null(header.uuid_link)) {
        error_setg(errp, "unsupported VDI image (non-NULL link UUID)");
        ret = -ENOTSUP;
        goto fail;
-    } else if (!qemu_uuid_is_null(&header.uuid_parent)) {
+    } else if (!uuid_is_null(header.uuid_parent)) {
        error_setg(errp, "unsupported VDI image (non-NULL parent UUID)");
        ret = -ENOTSUP;
        goto fail;
@@ -782,8 +821,8 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
    if (image_type == VDI_TYPE_STATIC) {
        header.blocks_allocated = blocks;
    }
-    qemu_uuid_generate(&header.uuid_image);
-    qemu_uuid_generate(&header.uuid_last_snap);
+    uuid_generate(header.uuid_image);
+    uuid_generate(header.uuid_last_snap);
    /* There is no need to set header.uuid_link or header.uuid_parent here. */
 #if defined(CONFIG_VDI_DEBUG)
    vdi_header_print(&header);
@@ -21,6 +21,9 @@
 #include "qemu/bswap.h"
 #include "block/vhdx.h"

+#include <uuid/uuid.h>
+
+
 /*
 * All the VHDX formats on disk are little endian - the following
 * are helper import/export functions to correctly convert
@@ -25,7 +25,8 @@
 #include "qemu/bswap.h"
 #include "block/vhdx.h"
 #include "migration/migration.h"
-#include "qemu/uuid.h"
+
+#include <uuid/uuid.h>

 /* Options for VHDX creation */

@@ -212,11 +213,11 @@ bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset)
 */
 void vhdx_guid_generate(MSGUID *guid)
 {
-    QemuUUID uuid;
+    uuid_t uuid;
    assert(guid != NULL);

-    qemu_uuid_generate(&uuid);
-    memcpy(guid, &uuid, sizeof(MSGUID));
+    uuid_generate(uuid);
+    memcpy(guid, uuid, sizeof(MSGUID));
 }

 /* Check for region overlaps inside the VHDX image */
@@ -1354,8 +1354,8 @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
            goto out;
        }

-        data->lba = cpu_to_le64(offset >> BDRV_SECTOR_BITS);
-        data->size = cpu_to_le32(buf_len);
+        data->lba = offset >> BDRV_SECTOR_BITS;
+        data->size = buf_len;

        n_bytes = buf_len + sizeof(VmdkGrainMarker);
        iov = (struct iovec) {
@@ -1645,11 +1645,56 @@ vmdk_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    return ret;
 }

-static int coroutine_fn
-vmdk_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-                           uint64_t bytes, QEMUIOVector *qiov)
+typedef struct VmdkWriteCompressedCo {
+    BlockDriverState *bs;
+    int64_t sector_num;
+    const uint8_t *buf;
+    int nb_sectors;
+    int ret;
+} VmdkWriteCompressedCo;
+
+static void vmdk_co_write_compressed(void *opaque)
 {
-    return vmdk_co_pwritev(bs, offset, bytes, qiov, 0);
+    VmdkWriteCompressedCo *co = opaque;
+    QEMUIOVector local_qiov;
+    uint64_t offset = co->sector_num * BDRV_SECTOR_SIZE;
+    uint64_t bytes = co->nb_sectors * BDRV_SECTOR_SIZE;
+
+    struct iovec iov = (struct iovec) {
+        .iov_base   = (uint8_t*) co->buf,
+        .iov_len    = bytes,
+    };
+    qemu_iovec_init_external(&local_qiov, &iov, 1);
+
+    co->ret = vmdk_pwritev(co->bs, offset, bytes, &local_qiov, false, false);
+}
+
+static int vmdk_write_compressed(BlockDriverState *bs,
+                                 int64_t sector_num,
+                                 const uint8_t *buf,
+                                 int nb_sectors)
+{
+    BDRVVmdkState *s = bs->opaque;
+
+    if (s->num_extents == 1 && s->extents[0].compressed) {
+        Coroutine *co;
+        AioContext *aio_context = bdrv_get_aio_context(bs);
+        VmdkWriteCompressedCo data = {
+            .bs         = bs,
+            .sector_num = sector_num,
+            .buf        = buf,
+            .nb_sectors = nb_sectors,
+            .ret        = -EINPROGRESS,
+        };
+        co = qemu_coroutine_create(vmdk_co_write_compressed, &data);
+        qemu_coroutine_enter(co);
+        while (data.ret == -EINPROGRESS) {
+            aio_poll(aio_context, true);
+        }
+        return data.ret;
+    } else {
+        return -ENOTSUP;
+    }
 }

 static int coroutine_fn vmdk_co_pwrite_zeroes(BlockDriverState *bs,
@@ -2348,7 +2393,7 @@ static BlockDriver bdrv_vmdk = {
    .bdrv_reopen_prepare          = vmdk_reopen_prepare,
    .bdrv_co_preadv               = vmdk_co_preadv,
    .bdrv_co_pwritev              = vmdk_co_pwritev,
-    .bdrv_co_pwritev_compressed   = vmdk_co_pwritev_compressed,
+    .bdrv_write_compressed        = vmdk_write_compressed,
    .bdrv_co_pwrite_zeroes        = vmdk_co_pwrite_zeroes,
    .bdrv_close                   = vmdk_close,
    .bdrv_create                  = vmdk_create,
@@ -30,7 +30,9 @@
 #include "qemu/module.h"
 #include "migration/migration.h"
 #include "qemu/bswap.h"
-#include "qemu/uuid.h"
+#if defined(CONFIG_UUID)
+#include <uuid/uuid.h>
+#endif

 /**************************************************************/

@@ -87,7 +89,7 @@ typedef struct vhd_footer {
    uint32_t    checksum;

    /* UUID used to identify a parent hard disk (backing file) */
-    QemuUUID    uuid;
+    uint8_t     uuid[16];

    uint8_t     in_saved_state;
 } QEMU_PACKED VHDFooter;
@@ -978,7 +980,9 @@ static int vpc_create(const char *filename, QemuOpts *opts, Error **errp)

    footer->type = cpu_to_be32(disk_type);

-    qemu_uuid_generate(&footer->uuid);
+#if defined(CONFIG_UUID)
+    uuid_generate(footer->uuid);
+#endif

    footer->checksum = cpu_to_be32(vpc_checksum(buf, HEADER_SIZE));

@@ -2971,8 +2971,7 @@ static BlockDriver vvfat_write_target = {
 static void vvfat_qcow_options(int *child_flags, QDict *child_options,
                               int parent_flags, QDict *parent_options)
 {
-    qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "off");
-    *child_flags = BDRV_O_NO_FLUSH;
+    *child_flags = BDRV_O_RDWR | BDRV_O_NO_FLUSH;
 }

 static const BdrvChildRole child_vvfat_qcow = {
@@ -76,7 +76,8 @@ static int coroutine_fn before_write_notify(NotifierWithReturn *notifier,
 static void write_threshold_register_notifier(BlockDriverState *bs)
 {
    bs->write_threshold_notifier.notify = before_write_notify;
-    bdrv_add_before_write_notifier(bs, &bs->write_threshold_notifier);
+    notifier_with_return_list_add(&bs->before_write_notifiers,
+                                  &bs->write_threshold_notifier);
 }

 static void write_threshold_update(BlockDriverState *bs,
@@ -44,7 +44,6 @@ static gboolean nbd_accept(QIOChannel *ioc, GIOCondition condition,
        return TRUE;
    }

-    qio_channel_set_name(QIO_CHANNEL(cioc), "nbd-server");
    nbd_client_new(NULL, cioc,
                   nbd_server->tlscreds, NULL,
                   nbd_client_put);
@@ -112,8 +111,6 @@ void qmp_nbd_server_start(SocketAddress *addr,
    nbd_server = g_new0(NBDServerData, 1);
    nbd_server->watch = -1;
    nbd_server->listen_ioc = qio_channel_socket_new();
-    qio_channel_set_name(QIO_CHANNEL(nbd_server->listen_ioc),
-                         "nbd-listener");
    if (qio_channel_socket_listen_sync(
            nbd_server->listen_ioc, addr, errp) < 0) {
        goto error;
@@ -148,8 +145,7 @@ void qmp_nbd_server_start(SocketAddress *addr,
 void qmp_nbd_server_add(const char *device, bool has_writable, bool writable,
                        Error **errp)
 {
-    BlockDriverState *bs = NULL;
-    BlockBackend *on_eject_blk;
+    BlockBackend *blk;
    NBDExport *exp;

    if (!nbd_server) {
@@ -162,22 +158,26 @@ void qmp_nbd_server_add(const char *device, bool has_writable, bool writable,
        return;
    }

-    on_eject_blk = blk_by_name(device);
-
-    bs = bdrv_lookup_bs(device, device, errp);
-    if (!bs) {
+    blk = blk_by_name(device);
+    if (!blk) {
+        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
+                  "Device '%s' not found", device);
+        return;
+    }
+    if (!blk_is_inserted(blk)) {
+        error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
        return;
    }

    if (!has_writable) {
        writable = false;
    }
-    if (bdrv_is_read_only(bs)) {
+    if (blk_is_read_only(blk)) {
        writable = false;
    }

-    exp = nbd_export_new(bs, 0, -1, writable ? 0 : NBD_FLAG_READ_ONLY,
-                         NULL, false, on_eject_blk, errp);
+    exp = nbd_export_new(blk, 0, -1, writable ? 0 : NBD_FLAG_READ_ONLY, NULL,
+                         errp);
    if (!exp) {
        return;
    }
@@ -27,7 +27,7 @@
 #include "qemu-common.h"
 #include "trace.h"
 #include "block/block.h"
-#include "block/blockjob_int.h"
+#include "block/blockjob.h"
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qapi/qmp/qerror.h"
@@ -38,9 +38,6 @@
 #include "qemu/timer.h"
 #include "qapi-event.h"

-static void block_job_event_cancelled(BlockJob *job);
-static void block_job_event_completed(BlockJob *job, const char *msg);
-
 /* Transactional group of block jobs */
 struct BlockJobTxn {

@@ -69,7 +66,7 @@ BlockJob *block_job_get(const char *id)
    BlockJob *job;

    QLIST_FOREACH(job, &block_jobs, job_list) {
-        if (job->id && !strcmp(id, job->id)) {
+        if (!strcmp(id, job->id)) {
            return job;
        }
    }
@@ -77,6 +74,17 @@ BlockJob *block_job_get(const char *id)
    return NULL;
 }

+/* Normally the job runs in its BlockBackend's AioContext.  The exception is
+ * block_job_defer_to_main_loop() where it runs in the QEMU main loop.  Code
+ * that supports both cases uses this helper function.
+ */
+static AioContext *block_job_get_aio_context(BlockJob *job)
+{
+    return job->deferred_to_main_loop ?
+           qemu_get_aio_context() :
+           blk_get_aio_context(job->blk);
+}
+
 static void block_job_attached_aio_context(AioContext *new_context,
                                           void *opaque)
 {
@@ -89,17 +97,6 @@ static void block_job_attached_aio_context(AioContext *new_context,
    block_job_resume(job);
 }

-static void block_job_drain(BlockJob *job)
-{
-    /* If job is !job->busy this kicks it into the next pause point. */
-    block_job_enter(job);
-
-    blk_drain(job->blk);
-    if (job->driver->drain) {
-        job->driver->drain(job);
-    }
-}
-
 static void block_job_detach_aio_context(void *opaque)
 {
    BlockJob *job = opaque;
@@ -109,55 +106,42 @@ static void block_job_detach_aio_context(void *opaque)

    block_job_pause(job);

+    if (!job->paused) {
+        /* If job is !job->busy this kicks it into the next pause point. */
+        block_job_enter(job);
+    }
    while (!job->paused && !job->completed) {
-        block_job_drain(job);
+        aio_poll(block_job_get_aio_context(job), true);
    }

    block_job_unref(job);
 }

-void block_job_add_bdrv(BlockJob *job, BlockDriverState *bs)
-{
-    job->nodes = g_slist_prepend(job->nodes, bs);
-    bdrv_ref(bs);
-    bdrv_op_block_all(bs, job->blocker);
-}
-
 void *block_job_create(const char *job_id, const BlockJobDriver *driver,
-                       BlockDriverState *bs, int64_t speed, int flags,
+                       BlockDriverState *bs, int64_t speed,
                       BlockCompletionFunc *cb, void *opaque, Error **errp)
 {
    BlockBackend *blk;
    BlockJob *job;

+    assert(cb);
    if (bs->job) {
        error_setg(errp, QERR_DEVICE_IN_USE, bdrv_get_device_name(bs));
        return NULL;
    }

-    if (job_id == NULL && !(flags & BLOCK_JOB_INTERNAL)) {
+    if (job_id == NULL) {
        job_id = bdrv_get_device_name(bs);
-        if (!*job_id) {
-            error_setg(errp, "An explicit job ID is required for this node");
-            return NULL;
-        }
    }

-    if (job_id) {
-        if (flags & BLOCK_JOB_INTERNAL) {
-            error_setg(errp, "Cannot specify job ID for internal block job");
-            return NULL;
-        }
+    if (!id_wellformed(job_id)) {
+        error_setg(errp, "Invalid job ID '%s'", job_id);
+        return NULL;
+    }

-        if (!id_wellformed(job_id)) {
-            error_setg(errp, "Invalid job ID '%s'", job_id);
-            return NULL;
-        }
-
-        if (block_job_get(job_id)) {
-            error_setg(errp, "Job ID '%s' already in use", job_id);
-            return NULL;
-        }
+    if (block_job_get(job_id)) {
+        error_setg(errp, "Job ID '%s' already in use", job_id);
+        return NULL;
    }

    blk = blk_new();
@@ -166,7 +150,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
    job = g_malloc0(driver->instance_size);
    error_setg(&job->blocker, "block device is in use by block job: %s",
               BlockJobType_lookup[driver->job_type]);
-    block_job_add_bdrv(job, bs);
+    bdrv_op_block_all(bs, job->blocker);
    bdrv_op_unblock(bs, BLOCK_OP_TYPE_DATAPLANE, job->blocker);

    job->driver        = driver;
@@ -174,9 +158,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
    job->blk           = blk;
    job->cb            = cb;
    job->opaque        = opaque;
-    job->busy          = false;
-    job->paused        = true;
-    job->pause_count   = 1;
+    job->busy          = true;
    job->refcnt        = 1;
    bs->job = job;

@@ -199,28 +181,6 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
    return job;
 }

-bool block_job_is_internal(BlockJob *job)
-{
-    return (job->id == NULL);
-}
-
-static bool block_job_started(BlockJob *job)
-{
-    return job->co;
-}
-
-void block_job_start(BlockJob *job)
-{
-    assert(job && !block_job_started(job) && job->paused &&
-           !job->busy && job->driver->start);
-    job->co = qemu_coroutine_create(job->driver->start, job);
-    if (--job->pause_count == 0) {
-        job->paused = false;
-        job->busy = true;
-        qemu_coroutine_enter(job->co);
-    }
-}
-
 void block_job_ref(BlockJob *job)
 {
    ++job->refcnt;
@@ -229,15 +189,9 @@ void block_job_ref(BlockJob *job)
 void block_job_unref(BlockJob *job)
 {
    if (--job->refcnt == 0) {
-        GSList *l;
        BlockDriverState *bs = blk_bs(job->blk);
        bs->job = NULL;
-        for (l = job->nodes; l; l = l->next) {
-            bs = l->data;
-            bdrv_op_unblock_all(bs, job->blocker);
-            bdrv_unref(bs);
-        }
-        g_slist_free(job->nodes);
+        bdrv_op_unblock_all(bs, job->blocker);
        blk_remove_aio_context_notifier(job->blk,
                                        block_job_attached_aio_context,
                                        block_job_detach_aio_context, job);
@@ -260,29 +214,8 @@ static void block_job_completed_single(BlockJob *job)
            job->driver->abort(job);
        }
    }
-    if (job->driver->clean) {
-        job->driver->clean(job);
-    }
-
-    if (job->cb) {
-        job->cb(job->opaque, job->ret);
-    }
-
-    /* Emit events only if we actually started */
-    if (block_job_started(job)) {
-        if (block_job_is_cancelled(job)) {
-            block_job_event_cancelled(job);
-        } else {
-            const char *msg = NULL;
-            if (job->ret < 0) {
-                msg = strerror(-job->ret);
-            }
-            block_job_event_completed(job, msg);
-        }
-    }
-
+    job->cb(job->opaque, job->ret);
    if (job->txn) {
-        QLIST_REMOVE(job, txn_list);
        block_job_txn_unref(job->txn);
    }
    block_job_unref(job);
@@ -384,10 +317,7 @@ void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)

 void block_job_complete(BlockJob *job, Error **errp)
 {
-    /* Should not be reachable via external interface for internal jobs */
-    assert(job->id);
-    if (job->pause_count || job->cancelled ||
-        !block_job_started(job) || !job->driver->complete) {
+    if (job->pause_count || job->cancelled || !job->driver->complete) {
        error_setg(errp, "The active block job '%s' cannot be completed",
                   job->id);
        return;
@@ -401,26 +331,13 @@ void block_job_pause(BlockJob *job)
    job->pause_count++;
 }

-void block_job_user_pause(BlockJob *job)
-{
-    job->user_paused = true;
-    block_job_pause(job);
-}
-
 static bool block_job_should_pause(BlockJob *job)
 {
    return job->pause_count > 0;
 }

-bool block_job_user_paused(BlockJob *job)
-{
-    return job ? job->user_paused : 0;
-}
-
 void coroutine_fn block_job_pause_point(BlockJob *job)
 {
-    assert(job && block_job_started(job));
-
    if (!block_job_should_pause(job)) {
        return;
    }
@@ -455,14 +372,6 @@ void block_job_resume(BlockJob *job)
    block_job_enter(job);
 }

-void block_job_user_resume(BlockJob *job)
-{
-    if (job && job->user_paused && job->pause_count > 0) {
-        job->user_paused = false;
-        block_job_resume(job);
-    }
-}
-
 void block_job_enter(BlockJob *job)
 {
    if (job->co && !job->busy) {
@@ -472,13 +381,9 @@ void block_job_enter(BlockJob *job)

 void block_job_cancel(BlockJob *job)
 {
-    if (block_job_started(job)) {
-        job->cancelled = true;
-        block_job_iostatus_reset(job);
-        block_job_enter(job);
-    } else {
-        block_job_completed(job, -ECANCELED);
-    }
+    job->cancelled = true;
+    block_job_iostatus_reset(job);
+    block_job_enter(job);
 }

 bool block_job_is_cancelled(BlockJob *job)
@@ -504,21 +409,14 @@ static int block_job_finish_sync(BlockJob *job,
    assert(blk_bs(job->blk)->job == job);

    block_job_ref(job);
-
    finish(job, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        block_job_unref(job);
        return -EBUSY;
    }
-    /* block_job_drain calls block_job_enter, and it should be enough to
-     * induce progress until the job completes or moves to the main thread.
-    */
-    while (!job->deferred_to_main_loop && !job->completed) {
-        block_job_drain(job);
-    }
    while (!job->completed) {
-        aio_poll(qemu_get_aio_context(), true);
+        aio_poll(block_job_get_aio_context(job), true);
    }
    ret = (job->cancelled && job->ret == 0) ? -ECANCELED : job->ret;
    block_job_unref(job);
@@ -592,15 +490,9 @@ void block_job_yield(BlockJob *job)
    block_job_pause_point(job);
 }

-BlockJobInfo *block_job_query(BlockJob *job, Error **errp)
+BlockJobInfo *block_job_query(BlockJob *job)
 {
-    BlockJobInfo *info;
-
-    if (block_job_is_internal(job)) {
-        error_setg(errp, "Cannot query QEMU internal jobs");
-        return NULL;
-    }
-    info = g_new0(BlockJobInfo, 1);
+    BlockJobInfo *info = g_new0(BlockJobInfo, 1);
    info->type      = g_strdup(BlockJobType_lookup[job->driver->job_type]);
    info->device    = g_strdup(job->id);
    info->len       = job->len;
@@ -621,12 +513,8 @@ static void block_job_iostatus_set_err(BlockJob *job, int error)
    }
 }

-static void block_job_event_cancelled(BlockJob *job)
+void block_job_event_cancelled(BlockJob *job)
 {
-    if (block_job_is_internal(job)) {
-        return;
-    }
-
    qapi_event_send_block_job_cancelled(job->driver->job_type,
                                        job->id,
                                        job->len,
@@ -635,12 +523,8 @@ static void block_job_event_cancelled(BlockJob *job)
                                        &error_abort);
 }

-static void block_job_event_completed(BlockJob *job, const char *msg)
+void block_job_event_completed(BlockJob *job, const char *msg)
 {
-    if (block_job_is_internal(job)) {
-        return;
-    }
-
    qapi_event_send_block_job_completed(job->driver->job_type,
                                        job->id,
                                        job->len,
@@ -655,10 +539,6 @@ void block_job_event_ready(BlockJob *job)
 {
    job->ready = true;

-    if (block_job_is_internal(job)) {
-        return;
-    }
-
    qapi_event_send_block_job_ready(job->driver->job_type,
                                    job->id,
                                    job->len,
@@ -689,15 +569,14 @@ BlockErrorAction block_job_error_action(BlockJob *job, BlockdevOnError on_err,
    default:
        abort();
    }
-    if (!block_job_is_internal(job)) {
-        qapi_event_send_block_job_error(job->id,
-                                        is_read ? IO_OPERATION_TYPE_READ :
-                                        IO_OPERATION_TYPE_WRITE,
-                                        action, &error_abort);
-    }
+    qapi_event_send_block_job_error(job->id,
+                                    is_read ? IO_OPERATION_TYPE_READ :
+                                    IO_OPERATION_TYPE_WRITE,
+                                    action, &error_abort);
    if (action == BLOCK_ERROR_ACTION_STOP) {
        /* make the pause user visible, which will be resumed from QMP. */
-        block_job_user_pause(job);
+        job->user_paused = true;
+        block_job_pause(job);
        block_job_iostatus_set_err(job, error);
    }
    return action;
@@ -705,6 +584,7 @@ BlockErrorAction block_job_error_action(BlockJob *job, BlockdevOnError on_err,

 typedef struct {
    BlockJob *job;
+    QEMUBH *bh;
    AioContext *aio_context;
    BlockJobDeferToMainLoopFn *fn;
    void *opaque;
@@ -715,6 +595,8 @@ static void block_job_defer_to_main_loop_bh(void *opaque)
    BlockJobDeferToMainLoopData *data = opaque;
    AioContext *aio_context;

+    qemu_bh_delete(data->bh);
+
    /* Prevent race with block_job_defer_to_main_loop() */
    aio_context_acquire(data->aio_context);

@@ -738,13 +620,13 @@ void block_job_defer_to_main_loop(BlockJob *job,
 {
    BlockJobDeferToMainLoopData *data = g_malloc(sizeof(*data));
    data->job = job;
+    data->bh = qemu_bh_new(block_job_defer_to_main_loop_bh, data);
    data->aio_context = blk_get_aio_context(job->blk);
    data->fn = fn;
    data->opaque = opaque;
    job->deferred_to_main_loop = true;

-    aio_bh_schedule_oneshot(qemu_get_aio_context(),
-                            block_job_defer_to_main_loop_bh, data);
+    qemu_bh_schedule(data->bh);
 }

 BlockJobTxn *block_job_txn_new(void)
@@ -67,6 +67,23 @@ int cpu_get_pic_interrupt(CPUX86State *env)
 }
 #endif

+/* These are no-ops because we are not threadsafe.  */
+static inline void cpu_exec_start(CPUArchState *env)
+{
+}
+
+static inline void cpu_exec_end(CPUArchState *env)
+{
+}
+
+static inline void start_exclusive(void)
+{
+}
+
+static inline void end_exclusive(void)
+{
+}
+
 void fork_start(void)
 {
 }
@@ -78,6 +95,14 @@ void fork_end(int child)
    }
 }

+void cpu_list_lock(void)
+{
+}
+
+void cpu_list_unlock(void)
+{
+}
+
 #ifdef TARGET_I386
 /***********************************************************/
 /* CPUX86 core interface */
@@ -147,11 +172,7 @@ void cpu_loop(CPUX86State *env)
    //target_siginfo_t info;

    for(;;) {
-        cpu_exec_start(cs);
        trapnr = cpu_exec(cs);
-        cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
-
        switch(trapnr) {
        case 0x80:
            /* syscall from int $0x80 */
@@ -492,10 +513,7 @@ void cpu_loop(CPUSPARCState *env)
    //target_siginfo_t info;

    while (1) {
-        cpu_exec_start(cs);
        trapnr = cpu_exec(cs);
-        cpu_exec_end(cs);
-        process_queued_cpu_work(cs);

        switch (trapnr) {
 #ifndef TARGET_SPARC64
@@ -651,7 +669,7 @@ void cpu_loop(CPUSPARCState *env)
 static void usage(void)
 {
    printf("qemu-" TARGET_NAME " version " QEMU_VERSION QEMU_PKGVERSION
-           "\n" QEMU_COPYRIGHT "\n"
+           ", " QEMU_COPYRIGHT "\n"
           "usage: qemu-" TARGET_NAME " [options] program [arguments...]\n"
           "BSD CPU emulator (compiled for %s emulation)\n"
           "\n"
@@ -695,16 +713,6 @@ static void usage(void)

 THREAD CPUState *thread_cpu;

-bool qemu_cpu_is_self(CPUState *cpu)
-{
-    return thread_cpu == cpu;
-}
-
-void qemu_cpu_kick(CPUState *cpu)
-{
-    cpu_exit(cpu);
-}
-
 /* Assumes contents are already zeroed.  */
 void init_task_state(TaskState *ts)
 {
@@ -740,8 +748,6 @@ int main(int argc, char **argv)
    if (argc <= 1)
        usage();

-    module_call_init(MODULE_INIT_TRACE);
-    qemu_init_cpu_list();
    module_call_init(MODULE_INIT_QOM);

    if ((envlist = envlist_create()) == NULL) {
@@ -1127,6 +1133,7 @@ int main(int argc, char **argv)
        gdbserver_start (gdbstub_port);
        gdb_handlesig(cpu, 0);
    }
+    trace_init_vcpu_events();
    cpu_loop(env);
    /* never exits */
    return 0;
@@ -42,11 +42,6 @@ void mmap_unlock(void)
    }
 }

-bool have_mmap_lock(void)
-{
-    return mmap_lock_count > 0 ? true : false;
-}
-
 /* Grab lock to make sure things are in a consistent state after fork().  */
 void mmap_fork_start(void)
 {
@@ -212,6 +212,7 @@ sdlabi=""
 virtfs=""
 vnc="yes"
 sparse="no"
+uuid=""
 vde=""
 vnc_sasl=""
 vnc_jpeg=""
@@ -228,9 +229,7 @@ xfs=""

 vhost_net="no"
 vhost_scsi="no"
-vhost_vsock="no"
 kvm="no"
-colo="yes"
 rdma=""
 gprof="no"
 debug_tcg="no"
@@ -297,7 +296,6 @@ libiscsi=""
 libnfs=""
 coroutine=""
 coroutine_pool=""
-debug_stack_usage="no"
 seccomp=""
 glusterfs=""
 glusterfs_xlator_opt="no"
@@ -318,10 +316,10 @@ vte=""
 virglrenderer=""
 tpm="yes"
 libssh2=""
+vhdx=""
 numa=""
 tcmalloc="no"
 jemalloc="no"
-replication="yes"

 # parse CC options first
 for opt do
@@ -390,11 +388,7 @@ sdl2_config="${SDL2_CONFIG-${cross_prefix}sdl2-config}"
 ARFLAGS="${ARFLAGS-rv}"

 # default flags for all hosts
-# We use -fwrapv to tell the compiler that we require a C dialect where
-# left shift of signed integers is well defined and has the expected
-# 2s-complement style results. (Both clang and gcc agree that it
-# provides these semantics.)
-QEMU_CFLAGS="-fno-strict-aliasing -fno-common -fwrapv $QEMU_CFLAGS"
+QEMU_CFLAGS="-fno-strict-aliasing -fno-common $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wall -Wundef -Wwrite-strings -Wmissing-prototypes $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wstrict-prototypes -Wredundant-decls $QEMU_CFLAGS"
 QEMU_CFLAGS="-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE $QEMU_CFLAGS"
@@ -511,6 +505,8 @@ elif check_define __arm__ ; then
  cpu="arm"
 elif check_define __aarch64__ ; then
  cpu="aarch64"
+elif check_define __hppa__ ; then
+  cpu="hppa"
 else
  cpu=$(uname -m)
 fi
@@ -582,8 +578,6 @@ FreeBSD)
  audio_possible_drivers="oss sdl pa"
  # needed for kinfo_getvmmap(3) in libutil.h
  LIBS="-lutil $LIBS"
-  # needed for kinfo_getproc
-  libs_qga="-lutil $libs_qga"
  netmap=""  # enable netmap autodetect
  HOST_VARIANT_DIR="freebsd"
 ;;
@@ -680,7 +674,6 @@ Haiku)
  kvm="yes"
  vhost_net="yes"
  vhost_scsi="yes"
-  vhost_vsock="yes"
  QEMU_INCLUDES="-I\$(SRC_PATH)/linux-headers -I$(pwd)/linux-headers $QEMU_INCLUDES"
 ;;
 esac
@@ -889,6 +882,10 @@ for opt do
  ;;
  --disable-slirp) slirp="no"
  ;;
+  --disable-uuid) uuid="no"
+  ;;
+  --enable-uuid) uuid="yes"
+  ;;
  --disable-vde) vde="no"
  ;;
  --enable-vde) vde="yes"
@@ -921,10 +918,6 @@ for opt do
  ;;
  --enable-kvm) kvm="yes"
  ;;
-  --disable-colo) colo="no"
-  ;;
-  --enable-colo) colo="yes"
-  ;;
  --disable-tcg-interpreter) tcg_interpreter="no"
  ;;
  --enable-tcg-interpreter) tcg_interpreter="yes"
@@ -1012,8 +1005,6 @@ for opt do
  ;;
  --enable-coroutine-pool) coroutine_pool="yes"
  ;;
-  --enable-debug-stack-usage) debug_stack_usage="yes"
-  ;;
  --disable-docs) docs="no"
  ;;
  --enable-docs) docs="yes"
@@ -1026,10 +1017,6 @@ for opt do
  ;;
  --enable-vhost-scsi) vhost_scsi="yes"
  ;;
-  --disable-vhost-vsock) vhost_vsock="no"
-  ;;
-  --enable-vhost-vsock) vhost_vsock="yes"
-  ;;
  --disable-opengl) opengl="no"
  ;;
  --enable-opengl) opengl="yes"
@@ -1107,12 +1094,6 @@ for opt do
  --disable-virtio-blk-data-plane|--enable-virtio-blk-data-plane)
      echo "$0: $opt is obsolete, virtio-blk data-plane is always on" >&2
  ;;
-  --enable-vhdx|--disable-vhdx)
-      echo "$0: $opt is obsolete, VHDX driver is always built" >&2
-  ;;
-  --enable-uuid|--disable-uuid)
-      echo "$0: $opt is obsolete, UUID support is always built" >&2
-  ;;
  --disable-gtk) gtk="no"
  ;;
  --enable-gtk) gtk="yes"
@@ -1153,6 +1134,10 @@ for opt do
  ;;
  --enable-libssh2) libssh2="yes"
  ;;
+  --enable-vhdx) vhdx="yes"
+  ;;
+  --disable-vhdx) vhdx="no"
+  ;;
  --disable-numa) numa="no"
  ;;
  --enable-numa) numa="yes"
@@ -1165,10 +1150,6 @@ for opt do
  ;;
  --enable-jemalloc) jemalloc="yes"
  ;;
-  --disable-replication) replication="no"
-  ;;
-  --enable-replication) replication="yes"
-  ;;
  *)
      echo "ERROR: unknown option $opt"
      echo "Try '$0 --help' for more information"
@@ -1223,10 +1204,7 @@ case "$cpu" in
           cc_i386='$(CC) -m32'
           ;;
    x86_64)
-           # ??? Only extremely old AMD cpus do not have cmpxchg16b.
-           # If we truly care, we should simply detect this case at
-           # runtime and generate the fallback to serial emulation.
-           CPU_CFLAGS="-m64 -mcx16"
+           CPU_CFLAGS="-m64"
           LDFLAGS="-m64 $LDFLAGS"
           cc_i386='$(CC) -m32'
           ;;
@@ -1373,8 +1351,8 @@ disabled with --disable-FEATURE, default is enabled if available:
  fdt             fdt device tree
  bluez           bluez stack connectivity
  kvm             KVM acceleration support
-  colo            COarse-grain LOck-stepping VM for Non-stop Service
  rdma            RDMA-based migration support
+  uuid            uuid support
  vde             support for vde network
  netmap          support for netmap network
  linux-aio       Linux AIO support
@@ -1398,10 +1376,10 @@ disabled with --disable-FEATURE, default is enabled if available:
  archipelago     Archipelago backend
  tpm             TPM support
  libssh2         ssh block device support
+  vhdx            support for the Microsoft VHDX image format
  numa            libnuma support
  tcmalloc        tcmalloc support
  jemalloc        jemalloc support
-  replication     replication support

 NOTE: The object files are built at the place where configure is launched
 EOF
@@ -1736,19 +1714,6 @@ if test "$cocoa" = "yes"; then
    sdl=no
 fi

-# Some versions of Mac OS X incorrectly define SIZE_MAX
-cat > $TMPC << EOF
-#include <stdint.h>
-#include <stdio.h>
-int main(int argc, char *argv[]) {
-    return printf("%zu", SIZE_MAX);
-}
-EOF
-have_broken_size_max=no
-if ! compile_object -Werror ; then
-    have_broken_size_max=yes
-fi
-
 ##########################################
 # L2TPV3 probe

@@ -1823,19 +1788,28 @@ fi
 ##########################################
 # avx2 optimization requirement check

-cat > $TMPC << EOF
+
+if test "$static" = "no" ; then
+  cat > $TMPC << EOF
 #pragma GCC push_options
 #pragma GCC target("avx2")
 #include <cpuid.h>
 #include <immintrin.h>
+
 static int bar(void *a) {
-    __m256i x = *(__m256i *)a;
-    return _mm256_testz_si256(x, x);
+    return _mm256_movemask_epi8(_mm256_cmpeq_epi8(*(__m256i *)a, (__m256i){0}));
 }
-int main(int argc, char *argv[]) { return bar(argv[0]); }
+static void *bar_ifunc(void) {return (void*) bar;}
+int foo(void *a) __attribute__((ifunc("bar_ifunc")));
+int main(int argc, char *argv[]) { return foo(argv[0]);}
 EOF
-if compile_object "" ; then
-  avx2_opt="yes"
+  if compile_object "" ; then
+      if has readelf; then
+          if readelf --syms $TMPO 2>/dev/null |grep -q "IFUNC.*foo"; then
+              avx2_opt="yes"
+          fi
+      fi
+  fi
 fi

 #########################################
@@ -1979,61 +1953,6 @@ EOF
  # Xen unstable
  elif
      cat > $TMPC <<EOF &&
-/*
- * If we have stable libs the we don't want the libxc compat
- * layers, regardless of what CFLAGS we may have been given.
- *
- * Also, check if xengnttab_grant_copy_segment_t is defined and
- * grant copy operation is implemented.
- */
-#undef XC_WANT_COMPAT_EVTCHN_API
-#undef XC_WANT_COMPAT_GNTTAB_API
-#undef XC_WANT_COMPAT_MAP_FOREIGN_API
-#include <xenctrl.h>
-#include <xenstore.h>
-#include <xenevtchn.h>
-#include <xengnttab.h>
-#include <xenforeignmemory.h>
-#include <stdint.h>
-#include <xen/hvm/hvm_info_table.h>
-#if !defined(HVM_MAX_VCPUS)
-# error HVM_MAX_VCPUS not defined
-#endif
-int main(void) {
-  xc_interface *xc = NULL;
-  xenforeignmemory_handle *xfmem;
-  xenevtchn_handle *xe;
-  xengnttab_handle *xg;
-  xen_domain_handle_t handle;
-  xengnttab_grant_copy_segment_t* seg = NULL;
-
-  xs_daemon_open();
-
-  xc = xc_interface_open(0, 0, 0);
-  xc_hvm_set_mem_type(0, 0, HVMMEM_ram_ro, 0, 0);
-  xc_domain_add_to_physmap(0, 0, XENMAPSPACE_gmfn, 0, 0);
-  xc_hvm_inject_msi(xc, 0, 0xf0000000, 0x00000000);
-  xc_hvm_create_ioreq_server(xc, 0, HVM_IOREQSRV_BUFIOREQ_ATOMIC, NULL);
-  xc_domain_create(xc, 0, handle, 0, NULL, NULL);
-
-  xfmem = xenforeignmemory_open(0, 0);
-  xenforeignmemory_map(xfmem, 0, 0, 0, 0, 0);
-
-  xe = xenevtchn_open(0, 0);
-  xenevtchn_fd(xe);
-
-  xg = xengnttab_open(0, 0);
-  xengnttab_grant_copy(xg, 0, seg);
-
-  return 0;
-}
-EOF
-      compile_prog "" "$xen_libs $xen_stable_libs"
-    then
-    xen_ctrl_version=480
-    xen=yes
-  elif
-      cat > $TMPC <<EOF &&
 /*
 * If we have stable libs the we don't want the libxc compat
 * layers, regardless of what CFLAGS we may have been given.
@@ -2737,6 +2656,47 @@ if compile_prog "" "" ; then
   fnmatch="yes"
 fi

+##########################################
+# uuid_generate() probe, used for vdi block driver
+# Note that on some systems (notably MacOSX) no extra library
+# need be linked to get the uuid functions.
+if test "$uuid" != "no" ; then
+  uuid_libs="-luuid"
+  cat > $TMPC << EOF
+#include <uuid/uuid.h>
+int main(void)
+{
+    uuid_t my_uuid;
+    uuid_generate(my_uuid);
+    return 0;
+}
+EOF
+  if compile_prog "" "" ; then
+    uuid="yes"
+  elif compile_prog "" "$uuid_libs" ; then
+    uuid="yes"
+    libs_softmmu="$uuid_libs $libs_softmmu"
+    libs_tools="$uuid_libs $libs_tools"
+  else
+    if test "$uuid" = "yes" ; then
+      feature_not_found "uuid" "Install libuuid devel"
+    fi
+    uuid=no
+  fi
+fi
+
+if test "$vhdx" = "yes" ; then
+    if test "$uuid" = "no" ; then
+        error_exit "uuid required for VHDX support"
+    fi
+elif test "$vhdx" != "no" ; then
+    if test "$uuid" = "yes" ; then
+        vhdx=yes
+    else
+        vhdx=no
+    fi
+fi
+
 ##########################################
 # xfsctl() probe, used for raw-posix
 if test "$xfs" != "no" ; then
@@ -2925,41 +2885,25 @@ fi
 # curses probe
 if test "$curses" != "no" ; then
  if test "$mingw32" = "yes" ; then
-    curses_inc_list="$($pkg_config --cflags ncurses 2>/dev/null):"
-    curses_lib_list="$($pkg_config --libs ncurses 2>/dev/null):-lpdcurses"
+    curses_list="$($pkg_config --libs ncurses 2>/dev/null):-lpdcurses"
  else
-    curses_inc_list="$($pkg_config --cflags ncursesw 2>/dev/null):-I/usr/include/ncursesw:"
-    curses_lib_list="$($pkg_config --libs ncursesw 2>/dev/null):-lncursesw:-lcursesw"
+    curses_list="$($pkg_config --libs ncurses 2>/dev/null):-lncurses:-lcurses"
  fi
  curses_found=no
  cat > $TMPC << EOF
-#include <locale.h>
 #include <curses.h>
-#include <wchar.h>
 int main(void) {
  const char *s = curses_version();
-  wchar_t wch = L'w';
-  setlocale(LC_ALL, "");
  resize_term(0, 0);
-  addwstr(L"wide chars\n");
-  addnwstr(&wch, 1);
-  add_wch(WACS_DEGREE);
  return s != 0;
 }
 EOF
  IFS=:
-  for curses_inc in $curses_inc_list; do
-    IFS=:
-    for curses_lib in $curses_lib_list; do
-      unset IFS
-      if compile_prog "$curses_inc" "$curses_lib" ; then
-        curses_found=yes
-        QEMU_CFLAGS="$curses_inc $QEMU_CFLAGS"
-        libs_softmmu="$curses_lib $libs_softmmu"
-        break
-      fi
-    done
-    if test "$curses_found" = yes ; then
+  for curses_lib in $curses_list; do
+    unset IFS
+    if compile_prog "" "$curses_lib" ; then
+      curses_found=yes
+      libs_softmmu="$curses_lib $libs_softmmu"
      break
    fi
  done
@@ -3031,7 +2975,7 @@ for i in $glib_modules; do
    if $pkg_config --atleast-version=$glib_req_ver $i; then
        glib_cflags=$($pkg_config --cflags $i)
        glib_libs=$($pkg_config --libs $i)
-        QEMU_CFLAGS="$glib_cflags $QEMU_CFLAGS"
+        CFLAGS="$glib_cflags $CFLAGS"
        LIBS="$glib_libs $LIBS"
        libs_qga="$glib_libs $libs_qga"
    else
@@ -3065,7 +3009,7 @@ fi

 # g_test_trap_subprocess added in 2.38. Used by some tests.
 glib_subprocess=yes
-if test "$mingw32" = "yes" || ! $pkg_config --atleast-version=2.38 glib-2.0; then
+if ! $pkg_config --atleast-version=2.38 glib-2.0; then
    glib_subprocess=no
 fi

@@ -3938,36 +3882,6 @@ if compile_prog "" "" ; then
  setns=yes
 fi

-# clock_adjtime probe
-clock_adjtime=no
-cat > $TMPC <<EOF
-#include <time.h>
-
-int main(void)
-{
-    return clock_adjtime(0, 0);
-}
-EOF
-clock_adjtime=no
-if compile_prog "" "" ; then
-  clock_adjtime=yes
-fi
-
-# syncfs probe
-syncfs=no
-cat > $TMPC <<EOF
-#include <unistd.h>
-
-int main(void)
-{
-    return syncfs(0);
-}
-EOF
-syncfs=no
-if compile_prog "" "" ; then
-  syncfs=yes
-fi
-
 # Check if tools are available to build documentation.
 if test "$docs" != "no" ; then
  if has makeinfo && has pod2man; then
@@ -4156,7 +4070,7 @@ EOF
  if compile_prog "$vss_win32_include" "" ; then
    guest_agent_with_vss="yes"
    QEMU_CFLAGS="$QEMU_CFLAGS $vss_win32_include"
-    libs_qga="-lole32 -loleaut32 -lshlwapi -lstdc++ -Wl,--enable-stdcall-fixup $libs_qga"
+    libs_qga="-lole32 -loleaut32 -lshlwapi -luuid -lstdc++ -Wl,--enable-stdcall-fixup $libs_qga"
    qga_vss_provider="qga/vss-win32/qga-vss.dll qga/vss-win32/qga-vss.tlb"
  else
    if test "$vss_win32_sdk" != "" ; then
@@ -4277,18 +4191,6 @@ if compile_prog "" "" ; then
    posix_madvise=yes
 fi

-##########################################
-# check if we have posix_syslog
-
-posix_syslog=no
-cat > $TMPC << EOF
-#include <syslog.h>
-int main(void) { openlog("qemu", LOG_PID, LOG_DAEMON); syslog(LOG_INFO, "configure"); return 0; }
-EOF
-if compile_prog "" "" ; then
-    posix_syslog=yes
-fi
-
 ##########################################
 # check if trace backend exists

@@ -4305,11 +4207,11 @@ if have_backend "ust"; then
 #include <lttng/tracepoint.h>
 int main(void) { return 0; }
 EOF
-  if compile_prog "" "-Wl,--no-as-needed -ldl" ; then
+  if compile_prog "" "" ; then
    if $pkg_config lttng-ust --exists; then
      lttng_ust_libs=$($pkg_config --libs lttng-ust)
    else
-      lttng_ust_libs="-llttng-ust -ldl"
+      lttng_ust_libs="-llttng-ust"
    fi
    if $pkg_config liburcu-bp --exists; then
      urcu_bp_libs=$($pkg_config --libs liburcu-bp)
@@ -4404,17 +4306,6 @@ if test "$coroutine" = "gthread" -a "$coroutine_pool" = "yes"; then
  error_exit "'gthread' coroutine backend does not support pool (use --disable-coroutine-pool)"
 fi

-if test "$debug_stack_usage" = "yes"; then
-  if test "$cpu" = "ia64" -o "$cpu" = "hppa"; then
-    error_exit "stack usage debugging is not supported for $cpu"
-  fi
-  if test "$coroutine_pool" = "yes"; then
-    echo "WARN: disabling coroutine pool for stack usage debugging"
-    coroutine_pool=no
-  fi
-fi
-
-
 ##########################################
 # check if we have open_by_handle_at

@@ -4548,55 +4439,6 @@ if compile_prog "" "" ; then
    int128=yes
 fi

-#########################################
-# See if 128-bit atomic operations are supported.
-
-atomic128=no
-if test "$int128" = "yes"; then
-  cat > $TMPC << EOF
-int main(void)
-{
-  unsigned __int128 x = 0, y = 0;
-  y = __atomic_load_16(&x, 0);
-  __atomic_store_16(&x, y, 0);
-  __atomic_compare_exchange_16(&x, &y, x, 0, 0, 0);
-  return 0;
-}
-EOF
-  if compile_prog "" "" ; then
-    atomic128=yes
-  fi
-fi
-
-#########################################
-# See if 64-bit atomic operations are supported.
-# Note that without __atomic builtins, we can only
-# assume atomic loads/stores max at pointer size.
-
-cat > $TMPC << EOF
-#include <stdint.h>
-int main(void)
-{
-  uint64_t x = 0, y = 0;
-#ifdef __ATOMIC_RELAXED
-  y = __atomic_load_8(&x, 0);
-  __atomic_store_8(&x, y, 0);
-  __atomic_compare_exchange_8(&x, &y, x, 0, 0, 0);
-  __atomic_exchange_8(&x, y, 0);
-  __atomic_fetch_add_8(&x, y, 0);
-#else
-  typedef char is_host64[sizeof(void *) >= sizeof(uint64_t) ? 1 : -1];
-  __sync_lock_test_and_set(&x, y);
-  __sync_val_compare_and_swap(&x, y, 0);
-  __sync_fetch_and_add(&x, y);
-#endif
-  return 0;
-}
-EOF
-if compile_prog "" "" ; then
-  atomic64=yes
-fi
-
 ########################################
 # check if getauxval is available.

@@ -4681,33 +4523,6 @@ if compile_prog "" "" ; then
    have_rtnetlink=yes
 fi

-##########################################
-# check for usable AF_VSOCK environment
-have_af_vsock=no
-cat > $TMPC << EOF
-#include <errno.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#if !defined(AF_VSOCK)
-# error missing AF_VSOCK flag
-#endif
-#include <linux/vm_sockets.h>
-int main(void) {
-    int sock, ret;
-    struct sockaddr_vm svm;
-    socklen_t len = sizeof(svm);
-    sock = socket(AF_VSOCK, SOCK_STREAM, 0);
-    ret = getpeername(sock, (struct sockaddr *)&svm, &len);
-    if ((ret == -1) && (errno == ENOTCONN)) {
-        return 0;
-    }
-    return -1;
-}
-EOF
-if compile_prog "" "" ; then
-    have_af_vsock=yes
-fi
-
 #################################################
 # Sparc implicitly links with --relax, which is
 # incompatible with -r, so --no-relax should be
@@ -4723,14 +4538,8 @@ EOF
 if ! compile_object ""; then
  error_exit "Failed to compile object file for LD_REL_FLAGS test"
 fi
-for i in '-Wl,-r -Wl,--no-relax' -Wl,-r -r; do
-  if do_cc -nostdlib $i -o $TMPMO $TMPO; then
-    LD_REL_FLAGS=$i
-    break
-  fi
-done
-if test "$modules" = "yes" && test "$LD_REL_FLAGS" = ""; then
-  feature_not_found "modules" "Cannot find how to build relocatable objects"
+if do_cc -nostdlib -Wl,-r -Wl,--no-relax -o $TMPMO $TMPO; then
+  LD_REL_FLAGS="-Wl,--no-relax"
 fi

 ##########################################
@@ -4752,6 +4561,7 @@ if test "$libnfs" != "no" ; then
  if $pkg_config --atleast-version=1.9.3 libnfs; then
    libnfs="yes"
    libnfs_libs=$($pkg_config --libs libnfs)
+    LIBS="$LIBS $libnfs_libs"
  else
    if test "$libnfs" = "yes" ; then
      feature_not_found "libnfs" "Install libnfs devel >= 1.9.3"
@@ -5050,7 +4860,6 @@ echo "Linux AIO support $linux_aio"
 echo "ATTR/XATTR support $attr"
 echo "Install blobs     $blobs"
 echo "KVM support       $kvm"
-echo "COLO support      $colo"
 echo "RDMA support      $rdma"
 echo "TCG interpreter   $tcg_interpreter"
 echo "fdt support       $fdt"
@@ -5058,10 +4867,10 @@ echo "preadv support    $preadv"
 echo "fdatasync         $fdatasync"
 echo "madvise           $madvise"
 echo "posix_madvise     $posix_madvise"
+echo "uuid support      $uuid"
 echo "libcap-ng support $cap_ng"
 echo "vhost-net support $vhost_net"
 echo "vhost-scsi support $vhost_scsi"
-echo "vhost-vsock support $vhost_vsock"
 echo "Trace backends    $trace_backends"
 if have_backend "simple"; then
 echo "Trace output file $trace_file-<pid>"
@@ -5083,7 +4892,6 @@ echo "QGA MSI support   $guest_agent_msi"
 echo "seccomp support   $seccomp"
 echo "coroutine backend $coroutine"
 echo "coroutine pool    $coroutine_pool"
-echo "debug stack usage $debug_stack_usage"
 echo "GlusterFS support $glusterfs"
 echo "Archipelago support $archipelago"
 echo "gcov              $gcov_tool"
@@ -5092,6 +4900,7 @@ echo "TPM support       $tpm"
 echo "libssh2 support   $libssh2"
 echo "TPM passthrough   $tpm_passthrough"
 echo "QOM debugging     $qom_cast_debug"
+echo "vhdx              $vhdx"
 echo "lzo support       $lzo"
 echo "snappy support    $snappy"
 echo "bzip2 support     $bzip2"
@@ -5099,7 +4908,6 @@ echo "NUMA host support $numa"
 echo "tcmalloc support  $tcmalloc"
 echo "jemalloc support  $jemalloc"
 echo "avx2 optimization $avx2_opt"
-echo "replication support $replication"

 if test "$sdl_too_old" = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
@@ -5248,6 +5056,9 @@ fi
 if test "$fnmatch" = "yes" ; then
  echo "CONFIG_FNMATCH=y" >> $config_host_mak
 fi
+if test "$uuid" = "yes" ; then
+  echo "CONFIG_UUID=y" >> $config_host_mak
+fi
 if test "$xfs" = "yes" ; then
  echo "CONFIG_XFS=y" >> $config_host_mak
 fi
@@ -5336,12 +5147,6 @@ fi
 if test "$setns" = "yes" ; then
  echo "CONFIG_SETNS=y" >> $config_host_mak
 fi
-if test "$clock_adjtime" = "yes" ; then
-  echo "CONFIG_CLOCK_ADJTIME=y" >> $config_host_mak
-fi
-if test "$syncfs" = "yes" ; then
-  echo "CONFIG_SYNCFS=y" >> $config_host_mak
-fi
 if test "$inotify" = "yes" ; then
  echo "CONFIG_INOTIFY=y" >> $config_host_mak
 fi
@@ -5369,6 +5174,7 @@ fi
 if test "$glib_subprocess" = "yes" ; then
  echo "CONFIG_HAS_GLIB_SUBPROCESS_TESTS=y" >> $config_host_mak
 fi
+echo "GLIB_CFLAGS=$glib_cflags" >> $config_host_mak
 if test "$gtk" = "yes" ; then
  echo "CONFIG_GTK=y" >> $config_host_mak
  echo "CONFIG_GTKABI=$gtkabi" >> $config_host_mak
@@ -5404,9 +5210,6 @@ fi
 if test "$have_ifaddrs_h" = "yes" ; then
    echo "HAVE_IFADDRS_H=y" >> $config_host_mak
 fi
-if test "$have_broken_size_max" = "yes" ; then
-    echo "HAVE_BROKEN_SIZE_MAX=y" >> $config_host_mak
-fi

 # Work around a system header bug with some kernel/XFS header
 # versions where they both try to define 'struct fsxattr':
@@ -5449,9 +5252,6 @@ fi
 if test "$vhost_net" = "yes" ; then
  echo "CONFIG_VHOST_NET_USED=y" >> $config_host_mak
 fi
-if test "$vhost_vsock" = "yes" ; then
-  echo "CONFIG_VHOST_VSOCK=y" >> $config_host_mak
-fi
 if test "$blobs" = "yes" ; then
  echo "INSTALL_BLOBS=yes" >> $config_host_mak
 fi
@@ -5529,8 +5329,7 @@ if test "$libiscsi" = "yes" ; then
 fi

 if test "$libnfs" = "yes" ; then
-  echo "CONFIG_LIBNFS=m" >> $config_host_mak
-  echo "LIBNFS_LIBS=$libnfs_libs" >> $config_host_mak
+  echo "CONFIG_LIBNFS=y" >> $config_host_mak
 fi

 if test "$seccomp" = "yes"; then
@@ -5561,10 +5360,6 @@ else
  echo "CONFIG_COROUTINE_POOL=0" >> $config_host_mak
 fi

-if test "$debug_stack_usage" = "yes" ; then
-  echo "CONFIG_DEBUG_STACK_USAGE=y" >> $config_host_mak
-fi
-
 if test "$open_by_handle_at" = "yes" ; then
  echo "CONFIG_OPEN_BY_HANDLE=y" >> $config_host_mak
 fi
@@ -5593,14 +5388,6 @@ if test "$int128" = "yes" ; then
  echo "CONFIG_INT128=y" >> $config_host_mak
 fi

-if test "$atomic128" = "yes" ; then
-  echo "CONFIG_ATOMIC128=y" >> $config_host_mak
-fi
-
-if test "$atomic64" = "yes" ; then
-  echo "CONFIG_ATOMIC64=y" >> $config_host_mak
-fi
-
 if test "$getauxval" = "yes" ; then
  echo "CONFIG_GETAUXVAL=y" >> $config_host_mak
 fi
@@ -5634,6 +5421,10 @@ if test "$libssh2" = "yes" ; then
  echo "LIBSSH2_LIBS=$libssh2_libs" >> $config_host_mak
 fi

+if test "$vhdx" = "yes" ; then
+  echo "CONFIG_VHDX=y" >> $config_host_mak
+fi
+
 # USB host support
 if test "$libusb" = "yes"; then
  echo "HOST_USB=libusb legacy" >> $config_host_mak
@@ -5677,19 +5468,8 @@ if have_backend "ftrace"; then
    feature_not_found "ftrace(trace backend)" "ftrace requires Linux"
  fi
 fi
-if have_backend "syslog"; then
-  if test "$posix_syslog" = "yes" ; then
-    echo "CONFIG_TRACE_SYSLOG=y" >> $config_host_mak
-  else
-    feature_not_found "syslog(trace backend)" "syslog not available"
-  fi
-fi
 echo "CONFIG_TRACE_FILE=$trace_file" >> $config_host_mak

-if test "$colo" = "yes"; then
-  echo "CONFIG_COLO=y" >> $config_host_mak
-fi
-
 if test "$rdma" = "yes" ; then
  echo "CONFIG_RDMA=y" >> $config_host_mak
 fi
@@ -5698,14 +5478,6 @@ if test "$have_rtnetlink" = "yes" ; then
  echo "CONFIG_RTNETLINK=y" >> $config_host_mak
 fi

-if test "$replication" = "yes" ; then
-  echo "CONFIG_REPLICATION=y" >> $config_host_mak
-fi
-
-if test "$have_af_vsock" = "yes" ; then
-  echo "CONFIG_AF_VSOCK=y" >> $config_host_mak
-fi
-
 # Hold two types of flag:
 #   CONFIG_THREAD_SETNAME_BYTHREAD  - we've got a way of setting the name on
 #                                     a thread we have a handle to
@@ -6092,6 +5864,9 @@ for i in $ARCH $TARGET_BASE_ARCH ; do
  cris)
    disas_config "CRIS"
  ;;
+  hppa)
+    disas_config "HPPA"
+  ;;
  i386|x86_64|x32)
    disas_config "I386"
  ;;
@@ -6197,7 +5972,6 @@ FILES="$FILES roms/seabios/Makefile roms/vgabios/Makefile"
 FILES="$FILES pc-bios/qemu-icon.bmp"
 for bios_file in \
    $source_path/pc-bios/*.bin \
-    $source_path/pc-bios/*.lid \
    $source_path/pc-bios/*.aml \
    $source_path/pc-bios/*.rom \
    $source_path/pc-bios/*.dtb \
@@ -77,9 +77,3 @@ void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
    }
    siglongjmp(cpu->jmp_env, 1);
 }
-
-void cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc)
-{
-    cpu->exception_index = EXCP_ATOMIC;
-    cpu_loop_exit_restore(cpu, pc);
-}
@@ -143,20 +143,22 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
    uint8_t *tb_ptr = itb->tc_ptr;

    qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc,
-                           "Trace %p [%d: " TARGET_FMT_lx "] %s\n",
-                           itb->tc_ptr, cpu->cpu_index, itb->pc,
-                           lookup_symbol(itb->pc));
+                           "Trace %p [" TARGET_FMT_lx "] %s\n",
+                           itb->tc_ptr, itb->pc, lookup_symbol(itb->pc));

 #if defined(DEBUG_DISAS)
-    if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-        && qemu_log_in_addr_range(itb->pc)) {
-        qemu_log_lock();
+    if (qemu_loglevel_mask(CPU_LOG_TB_CPU)) {
 #if defined(TARGET_I386)
        log_cpu_state(cpu, CPU_DUMP_CCOP);
+#elif defined(TARGET_M68K)
+        /* ??? Should not modify env state for dumping.  */
+        cpu_m68k_flush_flags(env, env->cc_op);
+        env->cc_op = CC_OP_FLAGS;
+        env->sr = (env->sr & 0xffe0) | env->cc_dest | (env->cc_x << 4);
+        log_cpu_state(cpu, 0);
 #else
        log_cpu_state(cpu, 0);
 #endif
-        qemu_log_unlock();
    }
 #endif /* DEBUG_DISAS */

@@ -189,7 +191,7 @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
        /* We were asked to stop executing TBs (probably a pending
         * interrupt. We've now stopped, so clear the flag.
         */
-        atomic_set(&cpu->tcg_exit_req, 0);
+        cpu->tcg_exit_req = 0;
    }
    return ret;
 }
@@ -201,60 +203,28 @@ static void cpu_exec_nocache(CPUState *cpu, int max_cycles,
                             TranslationBlock *orig_tb, bool ignore_icount)
 {
    TranslationBlock *tb;
+    bool old_tb_flushed;

    /* Should never happen.
       We only end up here when an existing TB is too long.  */
    if (max_cycles > CF_COUNT_MASK)
        max_cycles = CF_COUNT_MASK;

-    tb_lock();
+    old_tb_flushed = cpu->tb_flushed;
+    cpu->tb_flushed = false;
    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
                     max_cycles | CF_NOCACHE
                         | (ignore_icount ? CF_IGNORE_ICOUNT : 0));
-    tb->orig_tb = orig_tb;
-    tb_unlock();
-
+    tb->orig_tb = cpu->tb_flushed ? NULL : orig_tb;
+    cpu->tb_flushed |= old_tb_flushed;
    /* execute the generated code */
    trace_exec_tb_nocache(tb, tb->pc);
    cpu_tb_exec(cpu, tb);
-
-    tb_lock();
    tb_phys_invalidate(tb, -1);
    tb_free(tb);
-    tb_unlock();
 }
 #endif

-static void cpu_exec_step(CPUState *cpu)
-{
-    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
-    TranslationBlock *tb;
-    target_ulong cs_base, pc;
-    uint32_t flags;
-
-    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
-    tb = tb_gen_code(cpu, pc, cs_base, flags,
-                     1 | CF_NOCACHE | CF_IGNORE_ICOUNT);
-    tb->orig_tb = NULL;
-    /* execute the generated code */
-    trace_exec_tb_nocache(tb, pc);
-    cpu_tb_exec(cpu, tb);
-    tb_phys_invalidate(tb, -1);
-    tb_free(tb);
-}
-
-void cpu_exec_step_atomic(CPUState *cpu)
-{
-    start_exclusive();
-
-    /* Since we got here, we know that parallel_cpus must be true.  */
-    parallel_cpus = false;
-    cpu_exec_step(cpu);
-    parallel_cpus = true;
-
-    end_exclusive();
-}
-
 struct tb_desc {
    target_ulong pc;
    target_ulong cs_base;
@@ -271,8 +241,7 @@ static bool tb_cmp(const void *p, const void *d)
    if (tb->pc == desc->pc &&
        tb->page_addr[0] == desc->phys_page1 &&
        tb->cs_base == desc->cs_base &&
-        tb->flags == desc->flags &&
-        !atomic_read(&tb->invalid)) {
+        tb->flags == desc->flags) {
        /* check next page if needed */
        if (tb->page_addr[1] == -1) {
            return true;
@@ -290,7 +259,7 @@ static bool tb_cmp(const void *p, const void *d)
    return false;
 }

-static TranslationBlock *tb_htable_lookup(CPUState *cpu,
+static TranslationBlock *tb_find_physical(CPUState *cpu,
                                          target_ulong pc,
                                          target_ulong cs_base,
                                          uint32_t flags)
@@ -309,48 +278,72 @@ static TranslationBlock *tb_htable_lookup(CPUState *cpu,
    return qht_lookup(&tcg_ctx.tb_ctx.htable, tb_cmp, &desc, h);
 }

-static inline TranslationBlock *tb_find(CPUState *cpu,
-                                        TranslationBlock *last_tb,
-                                        int tb_exit)
+static TranslationBlock *tb_find_slow(CPUState *cpu,
+                                      target_ulong pc,
+                                      target_ulong cs_base,
+                                      uint32_t flags)
+{
+    TranslationBlock *tb;
+
+    tb = tb_find_physical(cpu, pc, cs_base, flags);
+    if (tb) {
+        goto found;
+    }
+
+#ifdef CONFIG_USER_ONLY
+    /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
+     * taken outside tb_lock.  Since we're momentarily dropping
+     * tb_lock, there's a chance that our desired tb has been
+     * translated.
+     */
+    tb_unlock();
+    mmap_lock();
+    tb_lock();
+    tb = tb_find_physical(cpu, pc, cs_base, flags);
+    if (tb) {
+        mmap_unlock();
+        goto found;
+    }
+#endif
+
+    /* if no translated code available, then translate it now */
+    tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
+
+#ifdef CONFIG_USER_ONLY
+    mmap_unlock();
+#endif
+
+found:
+    /* we add the TB in the virtual pc hash table */
+    cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
+    return tb;
+}
+
+static inline TranslationBlock *tb_find_fast(CPUState *cpu,
+                                             TranslationBlock **last_tb,
+                                             int tb_exit)
 {
    CPUArchState *env = (CPUArchState *)cpu->env_ptr;
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
-    bool have_tb_lock = false;

    /* we record a subset of the CPU state. It will
       always be the same before a given translated block
       is executed. */
    cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
-    tb = atomic_rcu_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]);
+    tb_lock();
+    tb = cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)];
    if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base ||
                 tb->flags != flags)) {
-        tb = tb_htable_lookup(cpu, pc, cs_base, flags);
-        if (!tb) {
-
-            /* mmap_lock is needed by tb_gen_code, and mmap_lock must be
-             * taken outside tb_lock. As system emulation is currently
-             * single threaded the locks are NOPs.
-             */
-            mmap_lock();
-            tb_lock();
-            have_tb_lock = true;
-
-            /* There's a chance that our desired tb has been translated while
-             * taking the locks so we check again inside the lock.
-             */
-            tb = tb_htable_lookup(cpu, pc, cs_base, flags);
-            if (!tb) {
-                /* if no translated code available, then translate it now */
-                tb = tb_gen_code(cpu, pc, cs_base, flags, 0);
-            }
-
-            mmap_unlock();
-        }
-
-        /* We add the TB in the virtual pc hash table for the fast lookup */
-        atomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
+        tb = tb_find_slow(cpu, pc, cs_base, flags);
+    }
+    if (cpu->tb_flushed) {
+        /* Ensure that no TB jump will be modified as the
+         * translation buffer has been flushed.
+         */
+        *last_tb = NULL;
+        cpu->tb_flushed = false;
    }
 #ifndef CONFIG_USER_ONLY
    /* We don't take care of direct jumps when address mapping changes in
@@ -358,22 +351,14 @@ static inline TranslationBlock *tb_find(CPUState *cpu,
     * spanning two pages because the mapping for the second page can change.
     */
    if (tb->page_addr[1] != -1) {
-        last_tb = NULL;
+        *last_tb = NULL;
    }
 #endif
    /* See if we can patch the calling TB. */
-    if (last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
-        if (!have_tb_lock) {
-            tb_lock();
-            have_tb_lock = true;
-        }
-        if (!tb->invalid) {
-            tb_add_jump(last_tb, tb_exit, tb);
-        }
-    }
-    if (have_tb_lock) {
-        tb_unlock();
+    if (*last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) {
+        tb_add_jump(*last_tb, tb_exit, tb);
    }
+    tb_unlock();
    return tb;
 }

@@ -452,7 +437,8 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
    } else if (replay_has_exception()
               && cpu->icount_decr.u16.low + cpu->icount_extra == 0) {
        /* try to cause an exception pending in the log */
-        cpu_exec_nocache(cpu, 1, tb_find(cpu, NULL, 0), true);
+        TranslationBlock *last_tb = NULL; /* Avoid chaining TBs */
+        cpu_exec_nocache(cpu, 1, tb_find_fast(cpu, &last_tb, 0), true);
        *ret = -1;
        return true;
 #endif
@@ -491,7 +477,7 @@ static inline void cpu_handle_interrupt(CPUState *cpu,
            X86CPU *x86_cpu = X86_CPU(cpu);
            CPUArchState *env = &x86_cpu->env;
            replay_interrupt();
-            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0);
+            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0);
            do_cpu_init(x86_cpu);
            cpu->exception_index = EXCP_HALTED;
            cpu_loop_exit(cpu);
@@ -523,8 +509,8 @@ static inline void cpu_handle_interrupt(CPUState *cpu,
            *last_tb = NULL;
        }
    }
-    if (unlikely(atomic_read(&cpu->exit_request) || replay_has_interrupt())) {
-        atomic_set(&cpu->exit_request, 0);
+    if (unlikely(cpu->exit_request || replay_has_interrupt())) {
+        cpu->exit_request = 0;
        cpu->exception_index = EXCP_INTERRUPT;
        cpu_loop_exit(cpu);
    }
@@ -536,13 +522,13 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 {
    uintptr_t ret;

-    if (unlikely(atomic_read(&cpu->exit_request))) {
+    if (unlikely(cpu->exit_request)) {
        return;
    }

    trace_exec_tb(tb, tb->pc);
    ret = cpu_tb_exec(cpu, tb);
-    tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK);
+    *last_tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK);
    *tb_exit = ret & TB_EXIT_MASK;
    switch (*tb_exit) {
    case TB_EXIT_REQUESTED:
@@ -566,7 +552,6 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
        abort();
 #else
        int insns_left = cpu->icount_decr.u32;
-        *last_tb = NULL;
        if (cpu->icount_extra && insns_left >= 0) {
            /* Refill decrementer and continue execution.  */
            cpu->icount_extra += insns_left;
@@ -576,17 +561,17 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
        } else {
            if (insns_left > 0) {
                /* Execute remaining instructions.  */
-                cpu_exec_nocache(cpu, insns_left, tb, false);
+                cpu_exec_nocache(cpu, insns_left, *last_tb, false);
                align_clocks(sc, cpu);
            }
            cpu->exception_index = EXCP_INTERRUPT;
+            *last_tb = NULL;
            cpu_loop_exit(cpu);
        }
        break;
 #endif
    }
    default:
-        *last_tb = tb;
        break;
    }
 }
@@ -633,9 +618,10 @@ int cpu_exec(CPUState *cpu)
                break;
            }

+            cpu->tb_flushed = false; /* reset before first TB lookup */
            for(;;) {
                cpu_handle_interrupt(cpu, &last_tb);
-                tb = tb_find(cpu, last_tb, tb_exit);
+                tb = tb_find_fast(cpu, &last_tb, tb_exit);
                cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit, &sc);
                /* Try to align the host and virtual clocks
                   if the guest is in advance */
@@ -1,353 +0,0 @@
-/*
- * CPU thread main loop - common bits for user and system mode emulation
- *
- *  Copyright (c) 2003-2005 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "qemu/main-loop.h"
-#include "exec/cpu-common.h"
-#include "qom/cpu.h"
-#include "sysemu/cpus.h"
-
-static QemuMutex qemu_cpu_list_lock;
-static QemuCond exclusive_cond;
-static QemuCond exclusive_resume;
-static QemuCond qemu_work_cond;
-
-/* >= 1 if a thread is inside start_exclusive/end_exclusive.  Written
- * under qemu_cpu_list_lock, read with atomic operations.
- */
-static int pending_cpus;
-
-void qemu_init_cpu_list(void)
-{
-    /* This is needed because qemu_init_cpu_list is also called by the
-     * child process in a fork.  */
-    pending_cpus = 0;
-
-    qemu_mutex_init(&qemu_cpu_list_lock);
-    qemu_cond_init(&exclusive_cond);
-    qemu_cond_init(&exclusive_resume);
-    qemu_cond_init(&qemu_work_cond);
-}
-
-void cpu_list_lock(void)
-{
-    qemu_mutex_lock(&qemu_cpu_list_lock);
-}
-
-void cpu_list_unlock(void)
-{
-    qemu_mutex_unlock(&qemu_cpu_list_lock);
-}
-
-static bool cpu_index_auto_assigned;
-
-static int cpu_get_free_index(void)
-{
-    CPUState *some_cpu;
-    int cpu_index = 0;
-
-    cpu_index_auto_assigned = true;
-    CPU_FOREACH(some_cpu) {
-        cpu_index++;
-    }
-    return cpu_index;
-}
-
-static void finish_safe_work(CPUState *cpu)
-{
-    cpu_exec_start(cpu);
-    cpu_exec_end(cpu);
-}
-
-void cpu_list_add(CPUState *cpu)
-{
-    qemu_mutex_lock(&qemu_cpu_list_lock);
-    if (cpu->cpu_index == UNASSIGNED_CPU_INDEX) {
-        cpu->cpu_index = cpu_get_free_index();
-        assert(cpu->cpu_index != UNASSIGNED_CPU_INDEX);
-    } else {
-        assert(!cpu_index_auto_assigned);
-    }
-    QTAILQ_INSERT_TAIL(&cpus, cpu, node);
-    qemu_mutex_unlock(&qemu_cpu_list_lock);
-
-    finish_safe_work(cpu);
-}
-
-void cpu_list_remove(CPUState *cpu)
-{
-    qemu_mutex_lock(&qemu_cpu_list_lock);
-    if (!QTAILQ_IN_USE(cpu, node)) {
-        /* there is nothing to undo since cpu_exec_init() hasn't been called */
-        qemu_mutex_unlock(&qemu_cpu_list_lock);
-        return;
-    }
-
-    assert(!(cpu_index_auto_assigned && cpu != QTAILQ_LAST(&cpus, CPUTailQ)));
-
-    QTAILQ_REMOVE(&cpus, cpu, node);
-    cpu->cpu_index = UNASSIGNED_CPU_INDEX;
-    qemu_mutex_unlock(&qemu_cpu_list_lock);
-}
-
-struct qemu_work_item {
-    struct qemu_work_item *next;
-    run_on_cpu_func func;
-    run_on_cpu_data data;
-    bool free, exclusive, done;
-};
-
-static void queue_work_on_cpu(CPUState *cpu, struct qemu_work_item *wi)
-{
-    qemu_mutex_lock(&cpu->work_mutex);
-    if (cpu->queued_work_first == NULL) {
-        cpu->queued_work_first = wi;
-    } else {
-        cpu->queued_work_last->next = wi;
-    }
-    cpu->queued_work_last = wi;
-    wi->next = NULL;
-    wi->done = false;
-    qemu_mutex_unlock(&cpu->work_mutex);
-
-    qemu_cpu_kick(cpu);
-}
-
-void do_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data data,
-                   QemuMutex *mutex)
-{
-    struct qemu_work_item wi;
-
-    if (qemu_cpu_is_self(cpu)) {
-        func(cpu, data);
-        return;
-    }
-
-    wi.func = func;
-    wi.data = data;
-    wi.done = false;
-    wi.free = false;
-    wi.exclusive = false;
-
-    queue_work_on_cpu(cpu, &wi);
-    while (!atomic_mb_read(&wi.done)) {
-        CPUState *self_cpu = current_cpu;
-
-        qemu_cond_wait(&qemu_work_cond, mutex);
-        current_cpu = self_cpu;
-    }
-}
-
-void async_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data data)
-{
-    struct qemu_work_item *wi;
-
-    wi = g_malloc0(sizeof(struct qemu_work_item));
-    wi->func = func;
-    wi->data = data;
-    wi->free = true;
-
-    queue_work_on_cpu(cpu, wi);
-}
-
-/* Wait for pending exclusive operations to complete.  The CPU list lock
-   must be held.  */
-static inline void exclusive_idle(void)
-{
-    while (pending_cpus) {
-        qemu_cond_wait(&exclusive_resume, &qemu_cpu_list_lock);
-    }
-}
-
-/* Start an exclusive operation.
-   Must only be called from outside cpu_exec.  */
-void start_exclusive(void)
-{
-    CPUState *other_cpu;
-    int running_cpus;
-
-    qemu_mutex_lock(&qemu_cpu_list_lock);
-    exclusive_idle();
-
-    /* Make all other cpus stop executing.  */
-    atomic_set(&pending_cpus, 1);
-
-    /* Write pending_cpus before reading other_cpu->running.  */
-    smp_mb();
-    running_cpus = 0;
-    CPU_FOREACH(other_cpu) {
-        if (atomic_read(&other_cpu->running)) {
-            other_cpu->has_waiter = true;
-            running_cpus++;
-            qemu_cpu_kick(other_cpu);
-        }
-    }
-
-    atomic_set(&pending_cpus, running_cpus + 1);
-    while (pending_cpus > 1) {
-        qemu_cond_wait(&exclusive_cond, &qemu_cpu_list_lock);
-    }
-
-    /* Can release mutex, no one will enter another exclusive
-     * section until end_exclusive resets pending_cpus to 0.
-     */
-    qemu_mutex_unlock(&qemu_cpu_list_lock);
-}
-
-/* Finish an exclusive operation.  */
-void end_exclusive(void)
-{
-    qemu_mutex_lock(&qemu_cpu_list_lock);
-    atomic_set(&pending_cpus, 0);
-    qemu_cond_broadcast(&exclusive_resume);
-    qemu_mutex_unlock(&qemu_cpu_list_lock);
-}
-
-/* Wait for exclusive ops to finish, and begin cpu execution.  */
-void cpu_exec_start(CPUState *cpu)
-{
-    atomic_set(&cpu->running, true);
-
-    /* Write cpu->running before reading pending_cpus.  */
-    smp_mb();
-
-    /* 1. start_exclusive saw cpu->running == true and pending_cpus >= 1.
-     * After taking the lock we'll see cpu->has_waiter == true and run---not
-     * for long because start_exclusive kicked us.  cpu_exec_end will
-     * decrement pending_cpus and signal the waiter.
-     *
-     * 2. start_exclusive saw cpu->running == false but pending_cpus >= 1.
-     * This includes the case when an exclusive item is running now.
-     * Then we'll see cpu->has_waiter == false and wait for the item to
-     * complete.
-     *
-     * 3. pending_cpus == 0.  Then start_exclusive is definitely going to
-     * see cpu->running == true, and it will kick the CPU.
-     */
-    if (unlikely(atomic_read(&pending_cpus))) {
-        qemu_mutex_lock(&qemu_cpu_list_lock);
-        if (!cpu->has_waiter) {
-            /* Not counted in pending_cpus, let the exclusive item
-             * run.  Since we have the lock, just set cpu->running to true
-             * while holding it; no need to check pending_cpus again.
-             */
-            atomic_set(&cpu->running, false);
-            exclusive_idle();
-            /* Now pending_cpus is zero.  */
-            atomic_set(&cpu->running, true);
-        } else {
-            /* Counted in pending_cpus, go ahead and release the
-             * waiter at cpu_exec_end.
-             */
-        }
-        qemu_mutex_unlock(&qemu_cpu_list_lock);
-    }
-}
-
-/* Mark cpu as not executing, and release pending exclusive ops.  */
-void cpu_exec_end(CPUState *cpu)
-{
-    atomic_set(&cpu->running, false);
-
-    /* Write cpu->running before reading pending_cpus.  */
-    smp_mb();
-
-    /* 1. start_exclusive saw cpu->running == true.  Then it will increment
-     * pending_cpus and wait for exclusive_cond.  After taking the lock
-     * we'll see cpu->has_waiter == true.
-     *
-     * 2. start_exclusive saw cpu->running == false but here pending_cpus >= 1.
-     * This includes the case when an exclusive item started after setting
-     * cpu->running to false and before we read pending_cpus.  Then we'll see
-     * cpu->has_waiter == false and not touch pending_cpus.  The next call to
-     * cpu_exec_start will run exclusive_idle if still necessary, thus waiting
-     * for the item to complete.
-     *
-     * 3. pending_cpus == 0.  Then start_exclusive is definitely going to
-     * see cpu->running == false, and it can ignore this CPU until the
-     * next cpu_exec_start.
-     */
-    if (unlikely(atomic_read(&pending_cpus))) {
-        qemu_mutex_lock(&qemu_cpu_list_lock);
-        if (cpu->has_waiter) {
-            cpu->has_waiter = false;
-            atomic_set(&pending_cpus, pending_cpus - 1);
-            if (pending_cpus == 1) {
-                qemu_cond_signal(&exclusive_cond);
-            }
-        }
-        qemu_mutex_unlock(&qemu_cpu_list_lock);
-    }
-}
-
-void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func,
-                           run_on_cpu_data data)
-{
-    struct qemu_work_item *wi;
-
-    wi = g_malloc0(sizeof(struct qemu_work_item));
-    wi->func = func;
-    wi->data = data;
-    wi->free = true;
-    wi->exclusive = true;
-
-    queue_work_on_cpu(cpu, wi);
-}
-
-void process_queued_cpu_work(CPUState *cpu)
-{
-    struct qemu_work_item *wi;
-
-    if (cpu->queued_work_first == NULL) {
-        return;
-    }
-
-    qemu_mutex_lock(&cpu->work_mutex);
-    while (cpu->queued_work_first != NULL) {
-        wi = cpu->queued_work_first;
-        cpu->queued_work_first = wi->next;
-        if (!cpu->queued_work_first) {
-            cpu->queued_work_last = NULL;
-        }
-        qemu_mutex_unlock(&cpu->work_mutex);
-        if (wi->exclusive) {
-            /* Running work items outside the BQL avoids the following deadlock:
-             * 1) start_exclusive() is called with the BQL taken while another
-             * CPU is running; 2) cpu_exec in the other CPU tries to takes the
-             * BQL, so it goes to sleep; start_exclusive() is sleeping too, so
-             * neither CPU can proceed.
-             */
-            qemu_mutex_unlock_iothread();
-            start_exclusive();
-            wi->func(cpu, wi->data);
-            end_exclusive();
-            qemu_mutex_lock_iothread();
-        } else {
-            wi->func(cpu, wi->data);
-        }
-        qemu_mutex_lock(&cpu->work_mutex);
-        if (wi->free) {
-            g_free(wi);
-        } else {
-            atomic_mb_set(&wi->done, true);
-        }
-    }
-    qemu_mutex_unlock(&cpu->work_mutex);
-    qemu_cond_broadcast(&qemu_work_cond);
-}
@@ -69,6 +69,7 @@

 #endif /* CONFIG_LINUX */

+static CPUState *next_cpu;
 int64_t max_delay;
 int64_t max_advance;

@@ -190,12 +191,8 @@ int64_t cpu_icount_to_ns(int64_t icount)
    return icount << icount_time_shift;
 }

-/* return the time elapsed in VM between vm_start and vm_stop.  Unless
- * icount is active, cpu_get_ticks() uses units of the host CPU cycle
- * counter.
- *
- * Caller must hold the BQL
- */
+/* return the host CPU cycle counter and handle stop/restart */
+/* Caller must hold the BQL */
 int64_t cpu_get_ticks(void)
 {
    int64_t ticks;
@@ -222,19 +219,17 @@ int64_t cpu_get_ticks(void)

 static int64_t cpu_get_clock_locked(void)
 {
-    int64_t time;
+    int64_t ticks;

-    time = timers_state.cpu_clock_offset;
+    ticks = timers_state.cpu_clock_offset;
    if (timers_state.cpu_ticks_enabled) {
-        time += get_clock();
+        ticks += get_clock();
    }

-    return time;
+    return ticks;
 }

-/* Return the monotonic time elapsed in VM, i.e.,
- * the time between vm_start and vm_stop
- */
+/* return the host CPU monotonic timer and handle stop/restart */
 int64_t cpu_get_clock(void)
 {
    int64_t ti;
@@ -249,7 +244,7 @@ int64_t cpu_get_clock(void)
 }

 /* enable cpu_get_ticks()
- * Caller must hold BQL which serves as mutex for vm_clock_seqlock.
+ * Caller must hold BQL which server as mutex for vm_clock_seqlock.
 */
 void cpu_enable_ticks(void)
 {
@@ -265,7 +260,7 @@ void cpu_enable_ticks(void)

 /* disable cpu_get_ticks() : the clock is stopped. You must not call
 * cpu_get_ticks() after that.
- * Caller must hold BQL which serves as mutex for vm_clock_seqlock.
+ * Caller must hold BQL which server as mutex for vm_clock_seqlock.
 */
 void cpu_disable_ticks(void)
 {
@@ -556,8 +551,9 @@ static const VMStateDescription vmstate_timers = {
    }
 };

-static void cpu_throttle_thread(CPUState *cpu, run_on_cpu_data opaque)
+static void cpu_throttle_thread(void *opaque)
 {
+    CPUState *cpu = opaque;
    double pct;
    double throttle_ratio;
    long sleeptime_ns;
@@ -587,8 +583,7 @@ static void cpu_throttle_timer_tick(void *opaque)
    }
    CPU_FOREACH(cpu) {
        if (!atomic_xchg(&cpu->throttle_thread_scheduled, 1)) {
-            async_run_on_cpu(cpu, cpu_throttle_thread,
-                             RUN_ON_CPU_NULL);
+            async_run_on_cpu(cpu, cpu_throttle_thread, cpu);
        }
    }

@@ -750,7 +745,6 @@ static int do_vm_stop(RunState state)
    }

    bdrv_drain_all();
-    replay_disable_events();
    ret = bdrv_flush_all();

    return ret;
@@ -903,21 +897,79 @@ static QemuThread io_thread;
 static QemuCond qemu_cpu_cond;
 /* system init */
 static QemuCond qemu_pause_cond;
+static QemuCond qemu_work_cond;

 void qemu_init_cpu_loop(void)
 {
    qemu_init_sigbus();
    qemu_cond_init(&qemu_cpu_cond);
    qemu_cond_init(&qemu_pause_cond);
+    qemu_cond_init(&qemu_work_cond);
    qemu_cond_init(&qemu_io_proceeded_cond);
    qemu_mutex_init(&qemu_global_mutex);

    qemu_thread_get_self(&io_thread);
 }

-void run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data data)
+void run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
 {
-    do_run_on_cpu(cpu, func, data, &qemu_global_mutex);
+    struct qemu_work_item wi;
+
+    if (qemu_cpu_is_self(cpu)) {
+        func(data);
+        return;
+    }
+
+    wi.func = func;
+    wi.data = data;
+    wi.free = false;
+
+    qemu_mutex_lock(&cpu->work_mutex);
+    if (cpu->queued_work_first == NULL) {
+        cpu->queued_work_first = &wi;
+    } else {
+        cpu->queued_work_last->next = &wi;
+    }
+    cpu->queued_work_last = &wi;
+    wi.next = NULL;
+    wi.done = false;
+    qemu_mutex_unlock(&cpu->work_mutex);
+
+    qemu_cpu_kick(cpu);
+    while (!atomic_mb_read(&wi.done)) {
+        CPUState *self_cpu = current_cpu;
+
+        qemu_cond_wait(&qemu_work_cond, &qemu_global_mutex);
+        current_cpu = self_cpu;
+    }
+}
+
+void async_run_on_cpu(CPUState *cpu, void (*func)(void *data), void *data)
+{
+    struct qemu_work_item *wi;
+
+    if (qemu_cpu_is_self(cpu)) {
+        func(data);
+        return;
+    }
+
+    wi = g_malloc0(sizeof(struct qemu_work_item));
+    wi->func = func;
+    wi->data = data;
+    wi->free = true;
+
+    qemu_mutex_lock(&cpu->work_mutex);
+    if (cpu->queued_work_first == NULL) {
+        cpu->queued_work_first = wi;
+    } else {
+        cpu->queued_work_last->next = wi;
+    }
+    cpu->queued_work_last = wi;
+    wi->next = NULL;
+    wi->done = false;
+    qemu_mutex_unlock(&cpu->work_mutex);
+
+    qemu_cpu_kick(cpu);
 }

 static void qemu_kvm_destroy_vcpu(CPUState *cpu)
@@ -932,6 +984,34 @@ static void qemu_tcg_destroy_vcpu(CPUState *cpu)
 {
 }

+static void flush_queued_work(CPUState *cpu)
+{
+    struct qemu_work_item *wi;
+
+    if (cpu->queued_work_first == NULL) {
+        return;
+    }
+
+    qemu_mutex_lock(&cpu->work_mutex);
+    while (cpu->queued_work_first != NULL) {
+        wi = cpu->queued_work_first;
+        cpu->queued_work_first = wi->next;
+        if (!cpu->queued_work_first) {
+            cpu->queued_work_last = NULL;
+        }
+        qemu_mutex_unlock(&cpu->work_mutex);
+        wi->func(wi->data);
+        qemu_mutex_lock(&cpu->work_mutex);
+        if (wi->free) {
+            g_free(wi);
+        } else {
+            atomic_mb_set(&wi->done, true);
+        }
+    }
+    qemu_mutex_unlock(&cpu->work_mutex);
+    qemu_cond_broadcast(&qemu_work_cond);
+}
+
 static void qemu_wait_io_event_common(CPUState *cpu)
 {
    if (cpu->stop) {
@@ -939,7 +1019,7 @@ static void qemu_wait_io_event_common(CPUState *cpu)
        cpu->stopped = true;
        qemu_cond_broadcast(&qemu_pause_cond);
    }
-    process_queued_cpu_work(cpu);
+    flush_queued_work(cpu);
    cpu->thread_kicked = false;
 }

@@ -1055,102 +1135,12 @@ static void *qemu_dummy_cpu_thread_fn(void *arg)
 #endif
 }

-static int64_t tcg_get_icount_limit(void)
-{
-    int64_t deadline;
-
-    if (replay_mode != REPLAY_MODE_PLAY) {
-        deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
-
-        /* Maintain prior (possibly buggy) behaviour where if no deadline
-         * was set (as there is no QEMU_CLOCK_VIRTUAL timer) or it is more than
-         * INT32_MAX nanoseconds ahead, we still use INT32_MAX
-         * nanoseconds.
-         */
-        if ((deadline < 0) || (deadline > INT32_MAX)) {
-            deadline = INT32_MAX;
-        }
-
-        return qemu_icount_round(deadline);
-    } else {
-        return replay_get_instructions();
-    }
-}
-
-static void handle_icount_deadline(void)
-{
-    if (use_icount) {
-        int64_t deadline =
-            qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
-
-        if (deadline == 0) {
-            qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
-        }
-    }
-}
-
-static int tcg_cpu_exec(CPUState *cpu)
-{
-    int ret;
-#ifdef CONFIG_PROFILER
-    int64_t ti;
-#endif
-
-#ifdef CONFIG_PROFILER
-    ti = profile_getclock();
-#endif
-    if (use_icount) {
-        int64_t count;
-        int decr;
-        timers_state.qemu_icount -= (cpu->icount_decr.u16.low
-                                    + cpu->icount_extra);
-        cpu->icount_decr.u16.low = 0;
-        cpu->icount_extra = 0;
-        count = tcg_get_icount_limit();
-        timers_state.qemu_icount += count;
-        decr = (count > 0xffff) ? 0xffff : count;
-        count -= decr;
-        cpu->icount_decr.u16.low = decr;
-        cpu->icount_extra = count;
-    }
-    cpu_exec_start(cpu);
-    ret = cpu_exec(cpu);
-    cpu_exec_end(cpu);
-#ifdef CONFIG_PROFILER
-    tcg_time += profile_getclock() - ti;
-#endif
-    if (use_icount) {
-        /* Fold pending instructions back into the
-           instruction counter, and clear the interrupt flag.  */
-        timers_state.qemu_icount -= (cpu->icount_decr.u16.low
-                        + cpu->icount_extra);
-        cpu->icount_decr.u32 = 0;
-        cpu->icount_extra = 0;
-        replay_account_executed_instructions();
-    }
-    return ret;
-}
-
-/* Destroy any remaining vCPUs which have been unplugged and have
- * finished running
- */
-static void deal_with_unplugged_cpus(void)
-{
-    CPUState *cpu;
-
-    CPU_FOREACH(cpu) {
-        if (cpu->unplug && !cpu_can_run(cpu)) {
-            qemu_tcg_destroy_vcpu(cpu);
-            cpu->created = false;
-            qemu_cond_signal(&qemu_cpu_cond);
-            break;
-        }
-    }
-}
+static void tcg_exec_all(void);

 static void *qemu_tcg_cpu_thread_fn(void *arg)
 {
    CPUState *cpu = arg;
+    CPUState *remove_cpu = NULL;

    rcu_register_thread();

@@ -1177,44 +1167,29 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
    /* process any pending work */
    atomic_mb_set(&exit_request, 1);

-    cpu = first_cpu;
-
    while (1) {
-        /* Account partial waits to QEMU_CLOCK_VIRTUAL.  */
-        qemu_account_warp_timer();
+        tcg_exec_all();

-        if (!cpu) {
-            cpu = first_cpu;
+        if (use_icount) {
+            int64_t deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
+
+            if (deadline == 0) {
+                qemu_clock_notify(QEMU_CLOCK_VIRTUAL);
+            }
        }
-
-        for (; cpu != NULL && !exit_request; cpu = CPU_NEXT(cpu)) {
-
-            qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
-                              (cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);
-
-            if (cpu_can_run(cpu)) {
-                int r;
-                r = tcg_cpu_exec(cpu);
-                if (r == EXCP_DEBUG) {
-                    cpu_handle_guest_debug(cpu);
-                    break;
-                }
-            } else if (cpu->stop || cpu->stopped) {
-                if (cpu->unplug) {
-                    cpu = CPU_NEXT(cpu);
-                }
+        qemu_tcg_wait_io_event(QTAILQ_FIRST(&cpus));
+        CPU_FOREACH(cpu) {
+            if (cpu->unplug && !cpu_can_run(cpu)) {
+                remove_cpu = cpu;
                break;
            }
-
-        } /* for cpu.. */
-
-        /* Pairs with smp_wmb in qemu_cpu_kick.  */
-        atomic_mb_set(&exit_request, 0);
-
-        handle_icount_deadline();
-
-        qemu_tcg_wait_io_event(QTAILQ_FIRST(&cpus));
-        deal_with_unplugged_cpus();
+        }
+        if (remove_cpu) {
+            qemu_tcg_destroy_vcpu(remove_cpu);
+            cpu->created = false;
+            qemu_cond_signal(&qemu_cpu_cond);
+            remove_cpu = NULL;
+        }
    }

    return NULL;
@@ -1312,17 +1287,17 @@ void qemu_mutex_unlock_iothread(void)
    qemu_mutex_unlock(&qemu_global_mutex);
 }

-static bool all_vcpus_paused(void)
+static int all_vcpus_paused(void)
 {
    CPUState *cpu;

    CPU_FOREACH(cpu) {
        if (!cpu->stopped) {
-            return false;
+            return 0;
        }
    }

-    return true;
+    return 1;
 }

 void pause_all_vcpus(void)
@@ -1517,6 +1492,102 @@ int vm_stop_force_state(RunState state)
    }
 }

+static int64_t tcg_get_icount_limit(void)
+{
+    int64_t deadline;
+
+    if (replay_mode != REPLAY_MODE_PLAY) {
+        deadline = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
+
+        /* Maintain prior (possibly buggy) behaviour where if no deadline
+         * was set (as there is no QEMU_CLOCK_VIRTUAL timer) or it is more than
+         * INT32_MAX nanoseconds ahead, we still use INT32_MAX
+         * nanoseconds.
+         */
+        if ((deadline < 0) || (deadline > INT32_MAX)) {
+            deadline = INT32_MAX;
+        }
+
+        return qemu_icount_round(deadline);
+    } else {
+        return replay_get_instructions();
+    }
+}
+
+static int tcg_cpu_exec(CPUState *cpu)
+{
+    int ret;
+#ifdef CONFIG_PROFILER
+    int64_t ti;
+#endif
+
+#ifdef CONFIG_PROFILER
+    ti = profile_getclock();
+#endif
+    if (use_icount) {
+        int64_t count;
+        int decr;
+        timers_state.qemu_icount -= (cpu->icount_decr.u16.low
+                                    + cpu->icount_extra);
+        cpu->icount_decr.u16.low = 0;
+        cpu->icount_extra = 0;
+        count = tcg_get_icount_limit();
+        timers_state.qemu_icount += count;
+        decr = (count > 0xffff) ? 0xffff : count;
+        count -= decr;
+        cpu->icount_decr.u16.low = decr;
+        cpu->icount_extra = count;
+    }
+    ret = cpu_exec(cpu);
+#ifdef CONFIG_PROFILER
+    tcg_time += profile_getclock() - ti;
+#endif
+    if (use_icount) {
+        /* Fold pending instructions back into the
+           instruction counter, and clear the interrupt flag.  */
+        timers_state.qemu_icount -= (cpu->icount_decr.u16.low
+                        + cpu->icount_extra);
+        cpu->icount_decr.u32 = 0;
+        cpu->icount_extra = 0;
+        replay_account_executed_instructions();
+    }
+    return ret;
+}
+
+static void tcg_exec_all(void)
+{
+    int r;
+
+    /* Account partial waits to QEMU_CLOCK_VIRTUAL.  */
+    qemu_account_warp_timer();
+
+    if (next_cpu == NULL) {
+        next_cpu = first_cpu;
+    }
+    for (; next_cpu != NULL && !exit_request; next_cpu = CPU_NEXT(next_cpu)) {
+        CPUState *cpu = next_cpu;
+
+        qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
+                          (cpu->singlestep_enabled & SSTEP_NOTIMER) == 0);
+
+        if (cpu_can_run(cpu)) {
+            r = tcg_cpu_exec(cpu);
+            if (r == EXCP_DEBUG) {
+                cpu_handle_guest_debug(cpu);
+                break;
+            }
+        } else if (cpu->stop || cpu->stopped) {
+            if (cpu->unplug) {
+                next_cpu = CPU_NEXT(cpu);
+            }
+            break;
+        }
+    }
+
+    /* Pairs with smp_wmb in qemu_cpu_kick.  */
+    atomic_mb_set(&exit_request, 0);
+}
+
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
 {
    /* XXX: implement xxx_cpu_list for targets that still miss it */
@@ -23,14 +23,15 @@
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
 #include "exec/cpu_ldst.h"
+
 #include "exec/cputlb.h"
+
 #include "exec/memory-internal.h"
 #include "exec/ram_addr.h"
+#include "exec/exec-all.h"
 #include "tcg/tcg.h"
 #include "qemu/error-report.h"
 #include "exec/log.h"
-#include "exec/helper-proto.h"
-#include "qemu/atomic.h"

 /* DEBUG defines, enable DEBUG_TLB_LOG to log to the CPU_LOG_MMU target */
 /* #define DEBUG_TLB */
@@ -497,43 +498,6 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
    return qemu_ram_addr_from_host_nofail(p);
 }

-static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-                         target_ulong addr, uintptr_t retaddr, int size)
-{
-    CPUState *cpu = ENV_GET_CPU(env);
-    hwaddr physaddr = iotlbentry->addr;
-    MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs);
-    uint64_t val;
-
-    physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
-    cpu->mem_io_pc = retaddr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
-        cpu_io_recompile(cpu, retaddr);
-    }
-
-    cpu->mem_io_vaddr = addr;
-    memory_region_dispatch_read(mr, physaddr, &val, size, iotlbentry->attrs);
-    return val;
-}
-
-static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry,
-                      uint64_t val, target_ulong addr,
-                      uintptr_t retaddr, int size)
-{
-    CPUState *cpu = ENV_GET_CPU(env);
-    hwaddr physaddr = iotlbentry->addr;
-    MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs);
-
-    physaddr = (physaddr & TARGET_PAGE_MASK) + addr;
-    if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) {
-        cpu_io_recompile(cpu, retaddr);
-    }
-
-    cpu->mem_io_vaddr = addr;
-    cpu->mem_io_pc = retaddr;
-    memory_region_dispatch_write(mr, physaddr, val, size, iotlbentry->attrs);
-}
-
 /* Return true if ADDR is present in the victim tlb, and has been copied
   back to the main tlb.  */
 static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
@@ -563,178 +527,36 @@ static bool victim_tlb_hit(CPUArchState *env, size_t mmu_idx, size_t index,
  victim_tlb_hit(env, mmu_idx, index, offsetof(CPUTLBEntry, TY), \
                 (ADDR) & TARGET_PAGE_MASK)

-/* Probe for whether the specified guest write access is permitted.
- * If it is not permitted then an exception will be taken in the same
- * way as if this were a real write access (and we will not return).
- * Otherwise the function will return, and there will be a valid
- * entry in the TLB for this access.
- */
-void probe_write(CPUArchState *env, target_ulong addr, int mmu_idx,
-                 uintptr_t retaddr)
-{
-    int index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    target_ulong tlb_addr = env->tlb_table[mmu_idx][index].addr_write;
-
-    if ((addr & TARGET_PAGE_MASK)
-        != (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        /* TLB entry is for a different page */
-        if (!VICTIM_TLB_HIT(addr_write, addr)) {
-            tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
-        }
-    }
-}
-
-/* Probe for a read-modify-write atomic operation.  Do not allow unaligned
- * operations, or io operations to proceed.  Return the host address.  */
-static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
-                               TCGMemOpIdx oi, uintptr_t retaddr)
-{
-    size_t mmu_idx = get_mmuidx(oi);
-    size_t index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    CPUTLBEntry *tlbe = &env->tlb_table[mmu_idx][index];
-    target_ulong tlb_addr = tlbe->addr_write;
-    TCGMemOp mop = get_memop(oi);
-    int a_bits = get_alignment_bits(mop);
-    int s_bits = mop & MO_SIZE;
-
-    /* Adjust the given return address.  */
-    retaddr -= GETPC_ADJ;
-
-    /* Enforce guest required alignment.  */
-    if (unlikely(a_bits > 0 && (addr & ((1 << a_bits) - 1)))) {
-        /* ??? Maybe indicate atomic op to cpu_unaligned_access */
-        cpu_unaligned_access(ENV_GET_CPU(env), addr, MMU_DATA_STORE,
-                             mmu_idx, retaddr);
-    }
-
-    /* Enforce qemu required alignment.  */
-    if (unlikely(addr & ((1 << s_bits) - 1))) {
-        /* We get here if guest alignment was not requested,
-           or was not enforced by cpu_unaligned_access above.
-           We might widen the access and emulate, but for now
-           mark an exception and exit the cpu loop.  */
-        goto stop_the_world;
-    }
-
-    /* Check TLB entry and enforce page permissions.  */
-    if ((addr & TARGET_PAGE_MASK)
-        != (tlb_addr & (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        if (!VICTIM_TLB_HIT(addr_write, addr)) {
-            tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_STORE, mmu_idx, retaddr);
-        }
-        tlb_addr = tlbe->addr_write;
-    }
-
-    /* Notice an IO access, or a notdirty page.  */
-    if (unlikely(tlb_addr & ~TARGET_PAGE_MASK)) {
-        /* There's really nothing that can be done to
-           support this apart from stop-the-world.  */
-        goto stop_the_world;
-    }
-
-    /* Let the guest notice RMW on a write-only page.  */
-    if (unlikely(tlbe->addr_read != tlb_addr)) {
-        tlb_fill(ENV_GET_CPU(env), addr, MMU_DATA_LOAD, mmu_idx, retaddr);
-        /* Since we don't support reads and writes to different addresses,
-           and we do have the proper page loaded for write, this shouldn't
-           ever return.  But just in case, handle via stop-the-world.  */
-        goto stop_the_world;
-    }
-
-    return (void *)((uintptr_t)addr + tlbe->addend);
-
- stop_the_world:
-    cpu_loop_exit_atomic(ENV_GET_CPU(env), retaddr);
-}
-
-#ifdef TARGET_WORDS_BIGENDIAN
-# define TGT_BE(X)  (X)
-# define TGT_LE(X)  BSWAP(X)
-#else
-# define TGT_BE(X)  BSWAP(X)
-# define TGT_LE(X)  (X)
-#endif
-
 #define MMUSUFFIX _mmu

-#define DATA_SIZE 1
+#define SHIFT 0
 #include "softmmu_template.h"

-#define DATA_SIZE 2
+#define SHIFT 1
 #include "softmmu_template.h"

-#define DATA_SIZE 4
+#define SHIFT 2
 #include "softmmu_template.h"

-#define DATA_SIZE 8
+#define SHIFT 3
 #include "softmmu_template.h"
-
-/* First set of helpers allows passing in of OI and RETADDR.  This makes
-   them callable from other helpers.  */
-
-#define EXTRA_ARGS     , TCGMemOpIdx oi, uintptr_t retaddr
-#define ATOMIC_NAME(X) \
-    HELPER(glue(glue(glue(atomic_ ## X, SUFFIX), END), _mmu))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, retaddr)
-
-#define DATA_SIZE 1
-#include "atomic_template.h"
-
-#define DATA_SIZE 2
-#include "atomic_template.h"
-
-#define DATA_SIZE 4
-#include "atomic_template.h"
-
-#ifdef CONFIG_ATOMIC64
-#define DATA_SIZE 8
-#include "atomic_template.h"
-#endif
-
-#ifdef CONFIG_ATOMIC128
-#define DATA_SIZE 16
-#include "atomic_template.h"
-#endif
-
-/* Second set of helpers are directly callable from TCG as helpers.  */
-
-#undef EXTRA_ARGS
-#undef ATOMIC_NAME
-#undef ATOMIC_MMU_LOOKUP
-#define EXTRA_ARGS         , TCGMemOpIdx oi
-#define ATOMIC_NAME(X)     HELPER(glue(glue(atomic_ ## X, SUFFIX), END))
-#define ATOMIC_MMU_LOOKUP  atomic_mmu_lookup(env, addr, oi, GETPC())
-
-#define DATA_SIZE 1
-#include "atomic_template.h"
-
-#define DATA_SIZE 2
-#include "atomic_template.h"
-
-#define DATA_SIZE 4
-#include "atomic_template.h"
-
-#ifdef CONFIG_ATOMIC64
-#define DATA_SIZE 8
-#include "atomic_template.h"
-#endif
-
-/* Code access functions.  */
-
 #undef MMUSUFFIX
+
 #define MMUSUFFIX _cmmu
-#undef GETPC
-#define GETPC() ((uintptr_t)0)
+#undef GETPC_ADJ
+#define GETPC_ADJ 0
+#undef GETRA
+#define GETRA() ((uintptr_t)0)
 #define SOFTMMU_CODE_ACCESS

-#define DATA_SIZE 1
+#define SHIFT 0
 #include "softmmu_template.h"

-#define DATA_SIZE 2
+#define SHIFT 1
 #include "softmmu_template.h"

-#define DATA_SIZE 4
+#define SHIFT 2
 #include "softmmu_template.h"

-#define DATA_SIZE 8
+#define SHIFT 3
 #include "softmmu_template.h"
@@ -29,7 +29,10 @@
 #include "crypto/pbkdf.h"
 #include "crypto/secret.h"
 #include "crypto/random.h"
-#include "qemu/uuid.h"
+
+#ifdef CONFIG_UUID
+#include <uuid/uuid.h>
+#endif

 #include "qemu/coroutine.h"

@@ -874,12 +877,18 @@ qcrypto_block_luks_open(QCryptoBlock *block,
 }


-static void
-qcrypto_block_luks_uuid_gen(uint8_t *uuidstr)
+static int
+qcrypto_block_luks_uuid_gen(uint8_t *uuidstr, Error **errp)
 {
-    QemuUUID uuid;
-    qemu_uuid_generate(&uuid);
-    qemu_uuid_unparse(&uuid, (char *)uuidstr);
+#ifdef CONFIG_UUID
+    uuid_t uuid;
+    uuid_generate(uuid);
+    uuid_unparse(uuid, (char *)uuidstr);
+    return 0;
+#else
+    error_setg(errp, "Unable to generate uuids on this platform");
+    return -1;
+#endif
 }

 static int
@@ -908,12 +917,8 @@ qcrypto_block_luks_create(QCryptoBlock *block,
    const char *hash_alg;
    char *cipher_mode_spec = NULL;
    QCryptoCipherAlgorithm ivcipheralg = 0;
-    uint64_t iters;

    memcpy(&luks_opts, &options->u.luks, sizeof(luks_opts));
-    if (!luks_opts.has_iter_time) {
-        luks_opts.iter_time = 2000;
-    }
    if (!luks_opts.has_cipher_alg) {
        luks_opts.cipher_alg = QCRYPTO_CIPHER_ALG_AES_256;
    }
@@ -956,7 +961,10 @@ qcrypto_block_luks_create(QCryptoBlock *block,
     * it out to disk
     */
    luks->header.version = QCRYPTO_BLOCK_LUKS_VERSION;
-    qcrypto_block_luks_uuid_gen(luks->header.uuid);
+    if (qcrypto_block_luks_uuid_gen(luks->header.uuid,
+                                    errp) < 0) {
+        goto error;
+    }

    cipher_alg = qcrypto_block_luks_cipher_alg_lookup(luks_opts.cipher_alg,
                                                      errp);
@@ -1056,40 +1064,26 @@ qcrypto_block_luks_create(QCryptoBlock *block,
    /* Determine how many iterations we need to hash the master
     * key, in order to have 1 second of compute time used
     */
-    iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
-                                       masterkey, luks->header.key_bytes,
-                                       luks->header.master_key_salt,
-                                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
-                                       QCRYPTO_BLOCK_LUKS_DIGEST_LEN,
-                                       &local_err);
+    luks->header.master_key_iterations =
+        qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
+                                   masterkey, luks->header.key_bytes,
+                                   luks->header.master_key_salt,
+                                   QCRYPTO_BLOCK_LUKS_SALT_LEN,
+                                   &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto error;
    }

-    if (iters > (ULLONG_MAX / luks_opts.iter_time)) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu too large to scale",
-                         (unsigned long long)iters);
-        goto error;
-    }
-
-    /* iter_time was in millis, but count_iters reported for secs */
-    iters = iters * luks_opts.iter_time / 1000;
-
    /* Why /= 8 ?  That matches cryptsetup, but there's no
     * explanation why they chose /= 8... Probably so that
     * if all 8 keyslots are active we only spend 1 second
     * in total time to check all keys */
-    iters /= 8;
-    if (iters > UINT32_MAX) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu larger than %u",
-                         (unsigned long long)iters, UINT32_MAX);
-        goto error;
-    }
-    iters = MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS);
-    luks->header.master_key_iterations = iters;
+    luks->header.master_key_iterations /= 8;
+    luks->header.master_key_iterations = MAX(
+        luks->header.master_key_iterations,
+        QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS);
+

    /* Hash the master key, saving the result in the LUKS
     * header. This hash is used when opening the encrypted
@@ -1137,36 +1131,22 @@ qcrypto_block_luks_create(QCryptoBlock *block,
    /* Again we determine how many iterations are required to
     * hash the user password while consuming 1 second of compute
     * time */
-    iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
-                                       (uint8_t *)password, strlen(password),
-                                       luks->header.key_slots[0].salt,
-                                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
-                                       luks->header.key_bytes,
-                                       &local_err);
+    luks->header.key_slots[0].iterations =
+        qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
+                                   (uint8_t *)password, strlen(password),
+                                   luks->header.key_slots[0].salt,
+                                   QCRYPTO_BLOCK_LUKS_SALT_LEN,
+                                   &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto error;
    }
-
-    if (iters > (ULLONG_MAX / luks_opts.iter_time)) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu too large to scale",
-                         (unsigned long long)iters);
-        goto error;
-    }
-
-    /* iter_time was in millis, but count_iters reported for secs */
-    iters = iters * luks_opts.iter_time / 1000;
-
-    if (iters > UINT32_MAX) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu larger than %u",
-                         (unsigned long long)iters, UINT32_MAX);
-        goto error;
-    }
-
-    luks->header.key_slots[0].iterations =
-        MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS);
+    /* Why /= 2 ?  That matches cryptsetup, but there's no
+     * explanation why they chose /= 2... */
+    luks->header.key_slots[0].iterations /= 2;
+    luks->header.key_slots[0].iterations = MAX(
+        luks->header.key_slots[0].iterations,
+        QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS);


    /* Generate a key that we'll use to encrypt the master
@@ -59,8 +59,7 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,

    if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
        !qcrypto_block_drivers[options->format]) {
-        error_setg(errp, "Unsupported block driver %s",
-                   QCryptoBlockFormat_lookup[options->format]);
+        error_setg(errp, "Unsupported block driver %d", options->format);
        g_free(block);
        return NULL;
    }
@@ -89,8 +88,7 @@ QCryptoBlock *qcrypto_block_create(QCryptoBlockCreateOptions *options,

    if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
        !qcrypto_block_drivers[options->format]) {
-        error_setg(errp, "Unsupported block driver %s",
-                   QCryptoBlockFormat_lookup[options->format]);
+        error_setg(errp, "Unsupported block driver %d", options->format);
        g_free(block);
        return NULL;
    }
@@ -244,8 +244,7 @@ static int qcrypto_cipher_init_aes(QCryptoCipher *cipher,
    if (cipher->mode != QCRYPTO_CIPHER_MODE_CBC &&
        cipher->mode != QCRYPTO_CIPHER_MODE_ECB &&
        cipher->mode != QCRYPTO_CIPHER_MODE_XTS) {
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[cipher->mode]);
+        error_setg(errp, "Unsupported cipher mode %d", cipher->mode);
        return -1;
    }

@@ -377,8 +376,7 @@ static int qcrypto_cipher_init_des_rfb(QCryptoCipher *cipher,
    QCryptoCipherBuiltin *ctxt;

    if (cipher->mode != QCRYPTO_CIPHER_MODE_ECB) {
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[cipher->mode]);
+        error_setg(errp, "Unsupported cipher mode %d", cipher->mode);
        return -1;
    }

@@ -400,26 +398,14 @@ static int qcrypto_cipher_init_des_rfb(QCryptoCipher *cipher,
 }


-bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
-                             QCryptoCipherMode mode)
+bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
 {
    switch (alg) {
    case QCRYPTO_CIPHER_ALG_DES_RFB:
    case QCRYPTO_CIPHER_ALG_AES_128:
    case QCRYPTO_CIPHER_ALG_AES_192:
    case QCRYPTO_CIPHER_ALG_AES_256:
-        break;
-    default:
-        return false;
-    }
-
-    switch (mode) {
-    case QCRYPTO_CIPHER_MODE_ECB:
-    case QCRYPTO_CIPHER_MODE_CBC:
-    case QCRYPTO_CIPHER_MODE_XTS:
        return true;
-    case QCRYPTO_CIPHER_MODE_CTR:
-        return false;
    default:
        return false;
    }
@@ -433,17 +419,6 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
 {
    QCryptoCipher *cipher;

-    switch (mode) {
-    case QCRYPTO_CIPHER_MODE_ECB:
-    case QCRYPTO_CIPHER_MODE_CBC:
-    case QCRYPTO_CIPHER_MODE_XTS:
-        break;
-    default:
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[mode]);
-        return NULL;
-    }
-
    cipher = g_new0(QCryptoCipher, 1);
    cipher->alg = alg;
    cipher->mode = mode;
@@ -467,8 +442,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        break;
    default:
        error_setg(errp,
-                   "Unsupported cipher algorithm %s",
-                   QCryptoCipherAlgorithm_lookup[cipher->alg]);
+                   "Unsupported cipher algorithm %d", cipher->alg);
        goto error;
    }

@@ -24,8 +24,7 @@
 #include <gcrypt.h>


-bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
-                             QCryptoCipherMode mode)
+bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
 {
    switch (alg) {
    case QCRYPTO_CIPHER_ALG_DES_RFB:
@@ -38,16 +37,6 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
    case QCRYPTO_CIPHER_ALG_SERPENT_256:
    case QCRYPTO_CIPHER_ALG_TWOFISH_128:
    case QCRYPTO_CIPHER_ALG_TWOFISH_256:
-        break;
-    default:
-        return false;
-    }
-
-    switch (mode) {
-    case QCRYPTO_CIPHER_MODE_ECB:
-    case QCRYPTO_CIPHER_MODE_CBC:
-    case QCRYPTO_CIPHER_MODE_XTS:
-    case QCRYPTO_CIPHER_MODE_CTR:
        return true;
    default:
        return false;
@@ -59,7 +48,6 @@ struct QCryptoCipherGcrypt {
    gcry_cipher_hd_t handle;
    gcry_cipher_hd_t tweakhandle;
    size_t blocksize;
-    /* Initialization vector or Counter */
    uint8_t *iv;
 };

@@ -81,12 +69,8 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
    case QCRYPTO_CIPHER_MODE_CBC:
        gcrymode = GCRY_CIPHER_MODE_CBC;
        break;
-    case QCRYPTO_CIPHER_MODE_CTR:
-        gcrymode = GCRY_CIPHER_MODE_CTR;
-        break;
    default:
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[mode]);
+        error_setg(errp, "Unsupported cipher mode %d", mode);
        return NULL;
    }

@@ -136,8 +120,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        break;

    default:
-        error_setg(errp, "Unsupported cipher algorithm %s",
-                   QCryptoCipherAlgorithm_lookup[alg]);
+        error_setg(errp, "Unsupported cipher algorithm %d", alg);
        return NULL;
    }

@@ -354,21 +337,12 @@ int qcrypto_cipher_setiv(QCryptoCipher *cipher,
    if (ctx->iv) {
        memcpy(ctx->iv, iv, niv);
    } else {
-        if (cipher->mode == QCRYPTO_CIPHER_MODE_CTR) {
-            err = gcry_cipher_setctr(ctx->handle, iv, niv);
-            if (err != 0) {
-                error_setg(errp, "Cannot set Counter: %s",
-                       gcry_strerror(err));
-                return -1;
-            }
-        } else {
-            gcry_cipher_reset(ctx->handle);
-            err = gcry_cipher_setiv(ctx->handle, iv, niv);
-            if (err != 0) {
-                error_setg(errp, "Cannot set IV: %s",
-                       gcry_strerror(err));
-                return -1;
-            }
+        gcry_cipher_reset(ctx->handle);
+        err = gcry_cipher_setiv(ctx->handle, iv, niv);
+        if (err != 0) {
+            error_setg(errp, "Cannot set IV: %s",
+                   gcry_strerror(err));
+            return -1;
        }
    }

@@ -28,7 +28,6 @@
 #include <nettle/cast128.h>
 #include <nettle/serpent.h>
 #include <nettle/twofish.h>
-#include <nettle/ctr.h>

 typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
                                               size_t length,
@@ -187,13 +186,12 @@ struct QCryptoCipherNettle {
    QCryptoCipherNettleFuncNative alg_decrypt_native;
    QCryptoCipherNettleFuncWrapper alg_encrypt_wrapper;
    QCryptoCipherNettleFuncWrapper alg_decrypt_wrapper;
-    /* Initialization vector or Counter */
+
    uint8_t *iv;
    size_t blocksize;
 };

-bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
-                             QCryptoCipherMode mode)
+bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg)
 {
    switch (alg) {
    case QCRYPTO_CIPHER_ALG_DES_RFB:
@@ -207,16 +205,6 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgorithm alg,
    case QCRYPTO_CIPHER_ALG_TWOFISH_128:
    case QCRYPTO_CIPHER_ALG_TWOFISH_192:
    case QCRYPTO_CIPHER_ALG_TWOFISH_256:
-        break;
-    default:
-        return false;
-    }
-
-    switch (mode) {
-    case QCRYPTO_CIPHER_MODE_ECB:
-    case QCRYPTO_CIPHER_MODE_CBC:
-    case QCRYPTO_CIPHER_MODE_XTS:
-    case QCRYPTO_CIPHER_MODE_CTR:
        return true;
    default:
        return false;
@@ -237,11 +225,9 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
    case QCRYPTO_CIPHER_MODE_ECB:
    case QCRYPTO_CIPHER_MODE_CBC:
    case QCRYPTO_CIPHER_MODE_XTS:
-    case QCRYPTO_CIPHER_MODE_CTR:
        break;
    default:
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[mode]);
+        error_setg(errp, "Unsupported cipher mode %d", mode);
        return NULL;
    }

@@ -371,8 +357,7 @@ QCryptoCipher *qcrypto_cipher_new(QCryptoCipherAlgorithm alg,
        break;

    default:
-        error_setg(errp, "Unsupported cipher algorithm %s",
-                   QCryptoCipherAlgorithm_lookup[alg]);
+        error_setg(errp, "Unsupported cipher algorithm %d", alg);
        goto error;
    }

@@ -443,15 +428,9 @@ int qcrypto_cipher_encrypt(QCryptoCipher *cipher,
                    ctx->iv, len, out, in);
        break;

-    case QCRYPTO_CIPHER_MODE_CTR:
-        ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
-                    ctx->blocksize, ctx->iv,
-                    len, out, in);
-        break;
-
    default:
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[cipher->mode]);
+        error_setg(errp, "Unsupported cipher algorithm %d",
+                   cipher->alg);
        return -1;
    }
    return 0;
@@ -488,15 +467,10 @@ int qcrypto_cipher_decrypt(QCryptoCipher *cipher,
                    ctx->alg_encrypt_wrapper, ctx->alg_decrypt_wrapper,
                    ctx->iv, len, out, in);
        break;
-    case QCRYPTO_CIPHER_MODE_CTR:
-        ctr_crypt(ctx->ctx, ctx->alg_encrypt_native,
-                    ctx->blocksize, ctx->iv,
-                    len, out, in);
-        break;

    default:
-        error_setg(errp, "Unsupported cipher mode %s",
-                   QCryptoCipherMode_lookup[cipher->mode]);
+        error_setg(errp, "Unsupported cipher algorithm %d",
+                   cipher->alg);
        return -1;
    }
    return 0;
@@ -55,7 +55,6 @@ static bool mode_need_iv[QCRYPTO_CIPHER_MODE__MAX] = {
    [QCRYPTO_CIPHER_MODE_ECB] = false,
    [QCRYPTO_CIPHER_MODE_CBC] = true,
    [QCRYPTO_CIPHER_MODE_XTS] = true,
-    [QCRYPTO_CIPHER_MODE_CTR] = true,
 };


@@ -59,7 +59,8 @@

 #if (defined(CONFIG_GCRYPT) &&                  \
     (!defined(CONFIG_GNUTLS) ||                \
-     (LIBGNUTLS_VERSION_NUMBER < 0x020c00)) &&    \
+      !defined(GNUTLS_VERSION_NUMBER) ||       \
+      (GNUTLS_VERSION_NUMBER < 0x020c00)) &&    \
     (!defined(GCRYPT_VERSION_NUMBER) ||        \
      (GCRYPT_VERSION_NUMBER < 0x010600)))
 #define QCRYPTO_INIT_GCRYPT_THREADS
@@ -119,10 +120,6 @@ static struct gcry_thread_cbs qcrypto_gcrypt_thread_impl = {

 int qcrypto_init(Error **errp)
 {
-#ifdef QCRYPTO_INIT_GCRYPT_THREADS
-    gcry_control(GCRYCTL_SET_THREAD_CBS, &qcrypto_gcrypt_thread_impl);
-#endif /* QCRYPTO_INIT_GCRYPT_THREADS */
-
 #ifdef CONFIG_GNUTLS
    int ret;
    ret = gnutls_global_init();
@@ -143,6 +140,9 @@ int qcrypto_init(Error **errp)
        error_setg(errp, "Unable to initialize gcrypt");
        return -1;
    }
+#ifdef QCRYPTO_INIT_GCRYPT_THREADS
+    gcry_control(GCRYCTL_SET_THREAD_CBS, &qcrypto_gcrypt_thread_impl);
+#endif /* QCRYPTO_INIT_GCRYPT_THREADS */
    gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
 #endif

@@ -28,11 +28,7 @@ bool qcrypto_pbkdf2_supports(QCryptoHashAlgorithm hash)
    switch (hash) {
    case QCRYPTO_HASH_ALG_MD5:
    case QCRYPTO_HASH_ALG_SHA1:
-    case QCRYPTO_HASH_ALG_SHA224:
    case QCRYPTO_HASH_ALG_SHA256:
-    case QCRYPTO_HASH_ALG_SHA384:
-    case QCRYPTO_HASH_ALG_SHA512:
-    case QCRYPTO_HASH_ALG_RIPEMD160:
        return true;
    default:
        return false;
@@ -42,33 +38,20 @@ bool qcrypto_pbkdf2_supports(QCryptoHashAlgorithm hash)
 int qcrypto_pbkdf2(QCryptoHashAlgorithm hash,
                   const uint8_t *key, size_t nkey,
                   const uint8_t *salt, size_t nsalt,
-                   uint64_t iterations,
+                   unsigned int iterations,
                   uint8_t *out, size_t nout,
                   Error **errp)
 {
    static const int hash_map[QCRYPTO_HASH_ALG__MAX] = {
        [QCRYPTO_HASH_ALG_MD5] = GCRY_MD_MD5,
        [QCRYPTO_HASH_ALG_SHA1] = GCRY_MD_SHA1,
-        [QCRYPTO_HASH_ALG_SHA224] = GCRY_MD_SHA224,
        [QCRYPTO_HASH_ALG_SHA256] = GCRY_MD_SHA256,
-        [QCRYPTO_HASH_ALG_SHA384] = GCRY_MD_SHA384,
-        [QCRYPTO_HASH_ALG_SHA512] = GCRY_MD_SHA512,
-        [QCRYPTO_HASH_ALG_RIPEMD160] = GCRY_MD_RMD160,
    };
    int ret;

-    if (iterations > ULONG_MAX) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu must be less than %lu",
-                         (long long unsigned)iterations, ULONG_MAX);
-        return -1;
-    }
-
    if (hash >= G_N_ELEMENTS(hash_map) ||
        hash_map[hash] == GCRY_MD_NONE) {
-        error_setg_errno(errp, ENOSYS,
-                         "PBKDF does not support hash algorithm %s",
-                         QCryptoHashAlgorithm_lookup[hash]);
+        error_setg(errp, "Unexpected hash algorithm %d", hash);
        return -1;
    }

@@ -20,7 +20,6 @@

 #include "qemu/osdep.h"
 #include <nettle/pbkdf2.h>
-#include <nettle/hmac.h>
 #include "qapi/error.h"
 #include "crypto/pbkdf.h"

@@ -29,11 +28,7 @@ bool qcrypto_pbkdf2_supports(QCryptoHashAlgorithm hash)
 {
    switch (hash) {
    case QCRYPTO_HASH_ALG_SHA1:
-    case QCRYPTO_HASH_ALG_SHA224:
    case QCRYPTO_HASH_ALG_SHA256:
-    case QCRYPTO_HASH_ALG_SHA384:
-    case QCRYPTO_HASH_ALG_SHA512:
-    case QCRYPTO_HASH_ALG_RIPEMD160:
        return true;
    default:
        return false;
@@ -43,74 +38,28 @@ bool qcrypto_pbkdf2_supports(QCryptoHashAlgorithm hash)
 int qcrypto_pbkdf2(QCryptoHashAlgorithm hash,
                   const uint8_t *key, size_t nkey,
                   const uint8_t *salt, size_t nsalt,
-                   uint64_t iterations,
+                   unsigned int iterations,
                   uint8_t *out, size_t nout,
                   Error **errp)
 {
-    union {
-        struct hmac_md5_ctx md5;
-        struct hmac_sha1_ctx sha1;
-        struct hmac_sha224_ctx sha224;
-        struct hmac_sha256_ctx sha256;
-        struct hmac_sha384_ctx sha384;
-        struct hmac_sha512_ctx sha512;
-        struct hmac_ripemd160_ctx ripemd160;
-    } ctx;
-
-    if (iterations > UINT_MAX) {
-        error_setg_errno(errp, ERANGE,
-                         "PBKDF iterations %llu must be less than %u",
-                         (long long unsigned)iterations, UINT_MAX);
-        return -1;
-    }
-
    switch (hash) {
-    case QCRYPTO_HASH_ALG_MD5:
-        hmac_md5_set_key(&ctx.md5, nkey, key);
-        PBKDF2(&ctx.md5, hmac_md5_update, hmac_md5_digest,
-               MD5_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
-        break;
-
    case QCRYPTO_HASH_ALG_SHA1:
-        hmac_sha1_set_key(&ctx.sha1, nkey, key);
-        PBKDF2(&ctx.sha1, hmac_sha1_update, hmac_sha1_digest,
-               SHA1_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
-        break;
-
-    case QCRYPTO_HASH_ALG_SHA224:
-        hmac_sha224_set_key(&ctx.sha224, nkey, key);
-        PBKDF2(&ctx.sha224, hmac_sha224_update, hmac_sha224_digest,
-               SHA224_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
+        pbkdf2_hmac_sha1(nkey, key,
+                         iterations,
+                         nsalt, salt,
+                         nout, out);
        break;

    case QCRYPTO_HASH_ALG_SHA256:
-        hmac_sha256_set_key(&ctx.sha256, nkey, key);
-        PBKDF2(&ctx.sha256, hmac_sha256_update, hmac_sha256_digest,
-               SHA256_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
-        break;
-
-    case QCRYPTO_HASH_ALG_SHA384:
-        hmac_sha384_set_key(&ctx.sha384, nkey, key);
-        PBKDF2(&ctx.sha384, hmac_sha384_update, hmac_sha384_digest,
-               SHA384_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
-        break;
-
-    case QCRYPTO_HASH_ALG_SHA512:
-        hmac_sha512_set_key(&ctx.sha512, nkey, key);
-        PBKDF2(&ctx.sha512, hmac_sha512_update, hmac_sha512_digest,
-               SHA512_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
-        break;
-
-    case QCRYPTO_HASH_ALG_RIPEMD160:
-        hmac_ripemd160_set_key(&ctx.ripemd160, nkey, key);
-        PBKDF2(&ctx.ripemd160, hmac_ripemd160_update, hmac_ripemd160_digest,
-               RIPEMD160_DIGEST_SIZE, iterations, nsalt, salt, nout, out);
+        pbkdf2_hmac_sha256(nkey, key,
+                           iterations,
+                           nsalt, salt,
+                           nout, out);
        break;

    default:
        error_setg_errno(errp, ENOSYS,
-                         "PBKDF does not support hash algorithm %s",
-                         QCryptoHashAlgorithm_lookup[hash]);
+                         "PBKDF does not support hash algorithm %d", hash);
        return -1;
    }
    return 0;
@@ -32,7 +32,7 @@ int qcrypto_pbkdf2(QCryptoHashAlgorithm hash G_GNUC_UNUSED,
                   size_t nkey G_GNUC_UNUSED,
                   const uint8_t *salt G_GNUC_UNUSED,
                   size_t nsalt G_GNUC_UNUSED,
-                   uint64_t iterations G_GNUC_UNUSED,
+                   unsigned int iterations G_GNUC_UNUSED,
                   uint8_t *out G_GNUC_UNUSED,
                   size_t nout G_GNUC_UNUSED,
                   Error **errp)
@@ -62,33 +62,29 @@ static int qcrypto_pbkdf2_get_thread_cpu(unsigned long long *val_ms,
 #endif
 }

-uint64_t qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
-                                    const uint8_t *key, size_t nkey,
-                                    const uint8_t *salt, size_t nsalt,
-                                    size_t nout,
-                                    Error **errp)
+int qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,
+                               const uint8_t *key, size_t nkey,
+                               const uint8_t *salt, size_t nsalt,
+                               Error **errp)
 {
-    uint64_t ret = -1;
-    uint8_t *out;
-    uint64_t iterations = (1 << 15);
+    uint8_t out[32];
+    long long int iterations = (1 << 15);
    unsigned long long delta_ms, start_ms, end_ms;

-    out = g_new(uint8_t, nout);
-
    while (1) {
        if (qcrypto_pbkdf2_get_thread_cpu(&start_ms, errp) < 0) {
-            goto cleanup;
+            return -1;
        }
        if (qcrypto_pbkdf2(hash,
                           key, nkey,
                           salt, nsalt,
                           iterations,
-                           out, nout,
+                           out, sizeof(out),
                           errp) < 0) {
-            goto cleanup;
+            return -1;
        }
        if (qcrypto_pbkdf2_get_thread_cpu(&end_ms, errp) < 0) {
-            goto cleanup;
+            return -1;
        }

        delta_ms = end_ms - start_ms;
@@ -104,10 +100,11 @@ uint64_t qcrypto_pbkdf2_count_iters(QCryptoHashAlgorithm hash,

    iterations = iterations * 1000 / delta_ms;

-    ret = iterations;
+    if (iterations > INT32_MAX) {
+        error_setg(errp, "Iterations %lld too large for a 32-bit int",
+                   iterations);
+        return -1;
+    }

- cleanup:
-    memset(out, 0, nout);
-    g_free(out);
-    return ret;
+    return iterations;
 }
@@ -615,7 +615,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
    }

    if (cert != NULL && key != NULL) {
-#if LIBGNUTLS_VERSION_NUMBER >= 0x030111
+#if GNUTLS_VERSION_NUMBER >= 0x030111
        char *password = NULL;
        if (creds->passwordid) {
            password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
@@ -630,7 +630,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                                                    password,
                                                    0);
        g_free(password);
-#else /* LIBGNUTLS_VERSION_NUMBER < 0x030111 */
+#else /* GNUTLS_VERSION_NUMBER < 0x030111 */
        if (creds->passwordid) {
            error_setg(errp, "PKCS8 decryption requires GNUTLS >= 3.1.11");
            goto cleanup;
@@ -638,7 +638,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
        ret = gnutls_certificate_set_x509_key_file(creds->data,
                                                   cert, key,
                                                   GNUTLS_X509_FMT_PEM);
-#endif
+#endif /* GNUTLS_VERSION_NUMBER < 0x030111 */
        if (ret < 0) {
            error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
                       cert, key, gnutls_strerror(ret));
@@ -351,22 +351,16 @@ qcrypto_tls_session_check_credentials(QCryptoTLSSession *session,
 {
    if (object_dynamic_cast(OBJECT(session->creds),
                            TYPE_QCRYPTO_TLS_CREDS_ANON)) {
-        trace_qcrypto_tls_session_check_creds(session, "nop");
        return 0;
    } else if (object_dynamic_cast(OBJECT(session->creds),
                            TYPE_QCRYPTO_TLS_CREDS_X509)) {
        if (session->creds->verifyPeer) {
-            int ret = qcrypto_tls_session_check_certificate(session,
-                                                            errp);
-            trace_qcrypto_tls_session_check_creds(session,
-                                                  ret == 0 ? "pass" : "fail");
-            return ret;
+            return qcrypto_tls_session_check_certificate(session,
+                                                         errp);
        } else {
-            trace_qcrypto_tls_session_check_creds(session, "skip");
            return 0;
        }
    } else {
-        trace_qcrypto_tls_session_check_creds(session, "error");
        error_setg(errp, "Unexpected credential type %s",
                   object_get_typename(OBJECT(session->creds)));
        return -1;
@@ -17,4 +17,3 @@ qcrypto_tls_creds_x509_load_cert_list(void *creds, const char *file) "TLS creds

 # crypto/tlssession.c
 qcrypto_tls_session_new(void *session, void *creds, const char *hostname, const char *aclname, int endpoint) "TLS session new session=%p creds=%p hostname=%s aclname=%s endpoint=%d"
-qcrypto_tls_session_check_creds(void *session, const char *status) "TLS session check creds session=%p status=%s"
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .8.1.1
 .7.1