update VERSION for v1.3.1

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check
2013-01-28 10:38:28 -06:00 · 2013-01-21 14:44:31 -06:00 · 2013-01-21 14:08:52 -06:00 · 2013-01-21 14:07:21 -06:00 · 2013-01-21 14:06:50 -06:00 · 2013-01-21 13:52:23 -06:00
1429 changed files with 25897 additions and 50548 deletions
@@ -1,13 +1,11 @@
 config-devices.*
 config-all-devices.*
-config-all-disas.*
 config-host.*
 config-target.*
-trace/generated-tracers.h
-trace/generated-tracers.c
-trace/generated-tracers-dtrace.h
-trace/generated-tracers-dtrace.dtrace
-libcacard/trace/generated-tracers.c
+trace.h
+trace.c
+trace-dtrace.h
+trace-dtrace.dtrace
 *-timestamp
 *-softmmu
 *-darwin-user
@@ -49,7 +47,6 @@ test-qmp-output-visitor
 test-string-input-visitor
 test-string-output-visitor
 test-visitor-serialization
-fsdev/virtfs-proxy-helper
 fsdev/virtfs-proxy-helper.1
 fsdev/virtfs-proxy-helper.pod
 .gdbinit
@@ -71,7 +68,6 @@ fsdev/virtfs-proxy-helper.pod
 *.tp
 *.vr
 *.d
-!scripts/qemu-guest-agent/fsfreeze-hook.d
 *.o
 *.lo
 *.la
@@ -123,23 +123,3 @@ gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
-
-6. C standard, implementation defined and undefined behaviors
-
-C code in QEMU should be written to the C99 language specification. A copy
-of the final version of the C99 standard with corrigenda TC1, TC2, and TC3
-included, formatted as a draft, can be downloaded from:
- http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf
-
-The C language specification defines regions of undefined behavior and
-implementation defined behavior (to give compiler authors enough leeway to
-produce better code).  In general, code in QEMU should follow the language
-specification and avoid both undefined and implementation defined
-constructs. ("It works fine on the gcc I tested it with" is not a valid
-argument...) However there are a few areas where we allow ourselves to
-assume certain behaviors because in practice all the platforms we care about
-behave in the same way and writing strictly conformant code would be
-painful. These are:
- * you may assume that integers are 2s complement representation
- * you may assume that right shift of a signed integer duplicates
-   the sign bit (ie it is an arithmetic shift, not a logical shift)
@@ -98,7 +98,6 @@ S: Maintained
 F: target-ppc/

 S390
-M: Richard Henderson <rth@twiddle.net>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: target-s390x/
@@ -133,7 +132,7 @@ Guest CPU Cores (KVM):
 ----------------------

 Overall
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
@@ -151,7 +150,7 @@ S: Maintained
 F: target-s390x/kvm.c

 X86
-M: Gleb Natapov <gleb@redhat.com>
+M: Avi Kivity <avi@redhat.com>
 M: Marcelo Tosatti <mtosatti@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
@@ -380,7 +379,7 @@ New World
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_newworld.c
+F: hw/ppc_newworld.c
 F: hw/unin_pci.c
 F: hw/dec_pci.[hc]

@@ -388,16 +387,15 @@ Old World
 M: Alexander Graf <agraf@suse.de>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/mac_oldworld.c
+F: hw/ppc_oldworld.c
 F: hw/grackle_pci.c

 PReP
 M: Andreas Färber <andreas.faerber@web.de>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
-F: hw/ppc/prep.c
+F: hw/ppc_prep.c
 F: hw/prep_pci.[hc]
-F: hw/pc87312.[hc]

 sPAPR
 M: David Gibson <david@gibson.dropbear.id.au>
@@ -492,7 +490,6 @@ F: hw/omap*
 PCI
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
-F: hw/pci/*
 F: hw/pci*
 F: hw/piix*

@@ -602,7 +599,6 @@ M: Andreas Färber <afaerber@suse.de>
 S: Supported
 F: qom/cpu.c
 F: include/qemu/cpu.h
-F: target-i386/cpu.c

 Device Tree
 M: Peter Crosthwaite <peter.crosthwaite@petalogix.com>
@@ -31,15 +31,12 @@ ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
 endif
 endif

-GENERATED_HEADERS = config-host.h qemu-options.def
-GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c
-
-GENERATED_HEADERS += trace/generated-tracers.h
+GENERATED_HEADERS = config-host.h trace.h qemu-options.def
 ifeq ($(TRACE_BACKEND),dtrace)
-GENERATED_HEADERS += trace/generated-tracers-dtrace.h
+GENERATED_HEADERS += trace-dtrace.h
 endif
-GENERATED_SOURCES += trace/generated-tracers.c
+GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
+GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c trace.c

 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
@@ -102,18 +99,6 @@ defconfig:
 	rm -f config-all-devices.mak $(SUBDIR_DEVICES_MAK)

 -include config-all-devices.mak
-include config-all-disas.mak
-CONFIG_SOFTMMU := $(if $(filter %-softmmu,$(TARGET_DIRS)),y)
-CONFIG_USER_ONLY := $(if $(filter %-user,$(TARGET_DIRS)),y)
-CONFIG_ALL=y
-
-ifneq ($(wildcard config-host.mak),)
-include $(SRC_PATH)/Makefile.objs
-include $(SRC_PATH)/tests/Makefile
-endif
-ifeq ($(CONFIG_SMARTCARD_NSS),y)
-include $(SRC_PATH)/libcacard/Makefile
-endif

 all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all

@@ -127,16 +112,26 @@ SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
 subdir-%:
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C $* V="$(V)" TARGET_DIR="$*/" all,)

+ifneq ($(wildcard config-host.mak),)
+include $(SRC_PATH)/Makefile.objs
+endif
+
+subdir-libcacard: $(oslib-obj-y) $(trace-obj-y) qemu-timer-common.o
+
 subdir-pixman: pixman/Makefile
 	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C pixman V="$(V)" all,)

 pixman/Makefile: $(SRC_PATH)/pixman/configure
-	(cd pixman; CFLAGS="$(CFLAGS) -fPIC $(extra_cflags) $(extra_ldflags)" $(SRC_PATH)/pixman/configure $(AUTOCONF_HOST) --disable-gtk --disable-shared --enable-static)
+	(cd pixman; CFLAGS="$(CFLAGS) -fPIC" $(SRC_PATH)/pixman/configure $(AUTOCONF_HOST) --disable-gtk --disable-shared --enable-static)

 $(SRC_PATH)/pixman/configure:
 	(cd $(SRC_PATH)/pixman; autoreconf -v --install)

-$(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y)
+$(SUBDIR_RULES): libqemustub.a
+
+$(filter %-softmmu,$(SUBDIR_RULES)): $(universal-obj-y) $(trace-obj-y) $(common-obj-y) $(extra-obj-y) subdir-libdis
+
+$(filter %-user,$(SUBDIR_RULES)): $(universal-obj-y) $(trace-obj-y) subdir-libdis-user subdir-libuser

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 romsubdir-%:
@@ -146,31 +141,66 @@ ALL_SUBDIRS=$(TARGET_DIRS) $(patsubst %,pc-bios/%, $(ROMS))

 recurse-all: $(SUBDIR_RULES) $(ROMSUBDIR_RULES)

+audio/audio.o audio/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
+
+QEMU_CFLAGS+=$(CURL_CFLAGS)
+
+QEMU_CFLAGS += -I$(SRC_PATH)/include
+
+ui/cocoa.o: ui/cocoa.m
+
+ui/sdl.o audio/sdlaudio.o ui/sdl_zoom.o hw/baum.o: QEMU_CFLAGS += $(SDL_CFLAGS)
+
+ui/vnc.o: QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+
 bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS)

 version.o: $(SRC_PATH)/version.rc config-host.h
 	$(call quiet-command,$(WINDRES) -I. -o $@ $<,"  RC    $(TARGET_DIR)$@")

 version-obj-$(CONFIG_WIN32) += version.o
-Makefile: $(version-obj-y)

 ######################################################################
-# Build libraries
+# Build library with stubs

 libqemustub.a: $(stub-obj-y)
-libqemuutil.a: $(util-obj-y)
+
+######################################################################
+# Support building shared library libcacard
+
+.PHONY: libcacard.la install-libcacard
+ifeq ($(LIBTOOL),)
+libcacard.la:
+	@echo "libtool is missing, please install and rerun configure"; exit 1
+
+install-libcacard:
+	@echo "libtool is missing, please install and rerun configure"; exit 1
+else
+libcacard.la: $(oslib-obj-y) qemu-timer-common.o $(addsuffix .lo, $(basename $(trace-obj-y)))
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" libcacard.la,)
+
+install-libcacard: libcacard.la
+	$(call quiet-command,$(MAKE) $(SUBDIR_MAKEFLAGS) -C libcacard V="$(V)" TARGET_DIR="$*/" install-libcacard,)
+endif

 ######################################################################

 qemu-img.o: qemu-img-cmds.h

-qemu-img$(EXESUF): qemu-img.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-nbd$(EXESUF): qemu-nbd.o $(block-obj-y) libqemuutil.a libqemustub.a
-qemu-io$(EXESUF): qemu-io.o cmd.o $(block-obj-y) libqemuutil.a libqemustub.a
+tools-obj-y = $(oslib-obj-y) $(trace-obj-y) qemu-tool.o qemu-timer.o \
+	main-loop.o iohandler.o error.o
+tools-obj-$(CONFIG_POSIX) += compatfd.o
+
+qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y) libqemustub.a
+qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y) libqemustub.a
+qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y) libqemustub.a

 qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o

-fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o libqemuutil.a libqemustub.a
+vscclient$(EXESUF): $(libcacard-y) $(oslib-obj-y) $(trace-obj-y) libcacard/vscclient.o libqemustub.a
+	$(call quiet-command,$(CC) $(LDFLAGS) -o $@ $^ $(libcacard_libs) $(LIBS),"  LINK  $@")
+
+fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o oslib-posix.o $(trace-obj-y)
 fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap

 qemu-img-cmds.h: $(SRC_PATH)/qemu-img-cmds.hx
@@ -181,16 +211,20 @@ qemu-ga$(EXESUF): QEMU_CFLAGS += -I qga/qapi-generated

 gen-out-type = $(subst .,-,$(suffix $@))

+ifneq ($(wildcard config-host.mak),)
+include $(SRC_PATH)/tests/Makefile
+endif
+
 qapi-py = $(SRC_PATH)/scripts/qapi.py $(SRC_PATH)/scripts/ordereddict.py

 qga/qapi-generated/qga-qapi-types.c qga/qapi-generated/qga-qapi-types.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-types.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-types.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
 qga/qapi-generated/qga-qapi-visit.c qga/qapi-generated/qga-qapi-visit.h :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-visit.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-visit.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")
 qga/qapi-generated/qga-qmp-commands.h qga/qapi-generated/qga-qmp-marshal.c :\
-$(SRC_PATH)/qga/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
+$(SRC_PATH)/qapi-schema-guest.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi-commands.py $(gen-out-type) -o qga/qapi-generated -p "qga-" < $<, "  GEN   $@")

 qapi-types.c qapi-types.h :\
@@ -206,27 +240,27 @@ $(SRC_PATH)/qapi-schema.json $(SRC_PATH)/scripts/qapi-commands.py $(qapi-py)
 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
 $(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)

-qemu-ga$(EXESUF): $(qga-obj-y) libqemuutil.a libqemustub.a
-	$(call LINK, $^)
+qemu-ga$(EXESUF): qemu-ga.o $(qga-obj-y) $(oslib-obj-y) $(trace-obj-y) $(qapi-obj-y) $(qobject-obj-y) $(version-obj-y) libqemustub.a
+
+QEMULIBS=libuser libdis libdis-user

 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
 	rm -f qemu-options.def
-	find . -name '*.[oda]' -type f -exec rm -f {} +
-	find . -name '*.l[oa]' -type f -exec rm -f {} +
-	rm -f $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
+	find . -name '*.[od]' -exec rm -f {} +
+	rm -f *.a *.lo $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~
 	rm -Rf .libs
 	rm -f qemu-img-cmds.h
+	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
 	@# May not be present in GENERATED_HEADERS
-	rm -f trace/generated-tracers-dtrace.dtrace*
-	rm -f trace/generated-tracers-dtrace.h*
+	rm -f trace-dtrace.h trace-dtrace.h-timestamp
 	rm -f $(foreach f,$(GENERATED_HEADERS),$(f) $(f)-timestamp)
 	rm -f $(foreach f,$(GENERATED_SOURCES),$(f) $(f)-timestamp)
 	rm -rf qapi-generated
 	rm -rf qga/qapi-generated
 	$(MAKE) -C tests/tcg clean
-	for d in $(ALL_SUBDIRS); do \
+	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
 	if test -d $$d; then $(MAKE) -C $$d $@ || exit 1; fi; \
 	rm -f $$d/qemu-options.def; \
        done
@@ -240,7 +274,7 @@ qemu-%.tar.bz2:

 distclean: clean
 	rm -f config-host.mak config-host.h* config-host.ld $(DOCS) qemu-options.texi qemu-img-cmds.texi qemu-monitor.texi
-	rm -f config-all-devices.mak config-all-disas.mak
+	rm -f config-all-devices.mak
 	rm -f roms/seabios/config.mak roms/vgabios/config.mak
 	rm -f qemu-doc.info qemu-doc.aux qemu-doc.cp qemu-doc.cps qemu-doc.dvi
 	rm -f qemu-doc.fn qemu-doc.fns qemu-doc.info qemu-doc.ky qemu-doc.kys
@@ -249,7 +283,7 @@ distclean: clean
 	rm -f config.log
 	rm -f linux-headers/asm
 	rm -f qemu-tech.info qemu-tech.aux qemu-tech.cp qemu-tech.dvi qemu-tech.fn qemu-tech.info qemu-tech.ky qemu-tech.log qemu-tech.pdf qemu-tech.pg qemu-tech.toc qemu-tech.tp qemu-tech.vr
-	for d in $(TARGET_DIRS); do \
+	for d in $(TARGET_DIRS) $(QEMULIBS); do \
 	rm -rf $$d || exit 1 ; \
        done
 	if test -f pixman/config.log; then make -C pixman distclean; fi
@@ -262,7 +296,6 @@ bepo
 ifdef INSTALL_BLOBS
 BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
-acpi-dsdt.aml q35-acpi-dsdt.aml \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
@@ -0,0 +1,20 @@
+# Makefile for disassemblers.
+
+include ../config-host.mak
+include config.mak
+include $(SRC_PATH)/rules.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(libdis-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	rm -f *.o *.d *.a *~
@@ -1,22 +1,58 @@
 #######################################################################
-# Common libraries for tools and emulators
+# Stub library, linked in tools
 stub-obj-y = stubs/
-util-obj-y = util/ qobject/ qapi/ trace/
+
+#######################################################################
+# Target-independent parts used in system and user emulation
+universal-obj-y =
+universal-obj-y += qemu-log.o
+
+#######################################################################
+# QObject
+qobject-obj-y = qint.o qstring.o qdict.o qlist.o qfloat.o qbool.o
+qobject-obj-y += qjson.o json-lexer.o json-streamer.o json-parser.o
+qobject-obj-y += qerror.o error.o qemu-error.o
+
+universal-obj-y += $(qobject-obj-y)
+
+#######################################################################
+# QOM
+qom-obj-y = qom/
+
+universal-obj-y += $(qom-obj-y)
+
+#######################################################################
+# oslib-obj-y is code depending on the OS (win32 vs posix)
+oslib-obj-y = osdep.o cutils.o qemu-timer-common.o
+oslib-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o
+oslib-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o
+
+#######################################################################
+# coroutines
+coroutine-obj-y = qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
+coroutine-obj-y += qemu-coroutine-sleep.o
+ifeq ($(CONFIG_UCONTEXT_COROUTINE),y)
+coroutine-obj-$(CONFIG_POSIX) += coroutine-ucontext.o
+else
+ifeq ($(CONFIG_SIGALTSTACK_COROUTINE),y)
+coroutine-obj-$(CONFIG_POSIX) += coroutine-sigaltstack.o
+else
+coroutine-obj-$(CONFIG_POSIX) += coroutine-gthread.o
+endif
+endif
+coroutine-obj-$(CONFIG_WIN32) += coroutine-win32.o

 #######################################################################
 # block-obj-y is code used by both qemu system emulation and qemu-img

-block-obj-y = async.o thread-pool.o
-block-obj-y += nbd.o block.o blockjob.o
-block-obj-y += main-loop.o iohandler.o qemu-timer.o
-block-obj-$(CONFIG_POSIX) += aio-posix.o
-block-obj-$(CONFIG_WIN32) += aio-win32.o
+block-obj-y = iov.o cache-utils.o qemu-option.o module.o async.o
+block-obj-y += nbd.o block.o blockjob.o aes.o qemu-config.o
+block-obj-y += thread-pool.o qemu-progress.o qemu-sockets.o uri.o notify.o
+block-obj-y += $(coroutine-obj-y) $(qobject-obj-y) $(version-obj-y)
+block-obj-$(CONFIG_POSIX) += event_notifier-posix.o aio-posix.o
+block-obj-$(CONFIG_WIN32) += event_notifier-win32.o aio-win32.o
 block-obj-y += block/
-block-obj-y += qapi-types.o qapi-visit.o
-
-block-obj-y += qemu-coroutine.o qemu-coroutine-lock.o qemu-coroutine-io.o
-block-obj-y += qemu-coroutine-sleep.o
-block-obj-y += coroutine-$(CONFIG_COROUTINE_BACKEND).o
+block-obj-y += $(qapi-obj-y) qapi-types.o qapi-visit.o

 ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS)$(CONFIG_PCI),yyy)
 # Lots of the fsdev/9pcode is pulled in by vl.c via qemu_fsdev_add.
@@ -24,6 +60,154 @@ ifeq ($(CONFIG_VIRTIO)$(CONFIG_VIRTFS)$(CONFIG_PCI),yyy)
 CONFIG_REALLY_VIRTFS=y
 endif

+######################################################################
+# Target independent part of system emulation. The long term path is to
+# suppress *all* target specific code in case of system emulation, i.e. a
+# single QEMU executable should support all CPUs and machines.
+
+common-obj-y = $(block-obj-y) blockdev.o blockdev-nbd.o block/
+common-obj-y += net.o net/
+common-obj-y += qom/
+common-obj-y += readline.o console.o cursor.o
+common-obj-y += qemu-pixman.o
+common-obj-y += $(oslib-obj-y)
+common-obj-$(CONFIG_WIN32) += os-win32.o
+common-obj-$(CONFIG_POSIX) += os-posix.o
+
+common-obj-$(CONFIG_LINUX) += fsdev/
+extra-obj-$(CONFIG_LINUX) += fsdev/
+
+common-obj-y += tcg-runtime.o host-utils.o main-loop.o
+common-obj-y += input.o
+common-obj-y += buffered_file.o migration.o migration-tcp.o
+common-obj-y += qemu-char.o #aio.o
+common-obj-y += block-migration.o iohandler.o
+common-obj-y += bitmap.o bitops.o
+common-obj-y += page_cache.o
+
+common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
+common-obj-$(CONFIG_WIN32) += version.o
+
+common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
+
+common-obj-y += audio/
+common-obj-y += hw/
+common-obj-y += ui/
+common-obj-y += bt-host.o bt-vhci.o
+
+common-obj-y += dma-helpers.o
+common-obj-y += acl.o
+common-obj-$(CONFIG_POSIX) += compatfd.o
+common-obj-y += qemu-timer.o qemu-timer-common.o
+common-obj-y += qtest.o
+common-obj-y += vl.o
+
+common-obj-$(CONFIG_SLIRP) += slirp/
+
+common-obj-y += backends/
+
+######################################################################
+# libseccomp
+ifeq ($(CONFIG_SECCOMP),y)
+common-obj-y += qemu-seccomp.o
+endif
+
+######################################################################
+# libuser
+
+user-obj-y =
+user-obj-y += envlist.o path.o
+user-obj-y += tcg-runtime.o host-utils.o
+user-obj-y += cache-utils.o
+user-obj-y += module.o
+user-obj-y += qemu-user.o
+user-obj-y += $(trace-obj-y)
+user-obj-y += qom/
+
+######################################################################
+# libdis
+# NOTE: the disassembler code is only needed for debugging
+
+libdis-y =
+libdis-$(CONFIG_ALPHA_DIS) += alpha-dis.o
+libdis-$(CONFIG_ARM_DIS) += arm-dis.o
+libdis-$(CONFIG_CRIS_DIS) += cris-dis.o
+libdis-$(CONFIG_HPPA_DIS) += hppa-dis.o
+libdis-$(CONFIG_I386_DIS) += i386-dis.o
+libdis-$(CONFIG_IA64_DIS) += ia64-dis.o
+libdis-$(CONFIG_M68K_DIS) += m68k-dis.o
+libdis-$(CONFIG_MICROBLAZE_DIS) += microblaze-dis.o
+libdis-$(CONFIG_MIPS_DIS) += mips-dis.o
+libdis-$(CONFIG_PPC_DIS) += ppc-dis.o
+libdis-$(CONFIG_S390_DIS) += s390-dis.o
+libdis-$(CONFIG_SH4_DIS) += sh4-dis.o
+libdis-$(CONFIG_SPARC_DIS) += sparc-dis.o
+libdis-$(CONFIG_LM32_DIS) += lm32-dis.o
+
+######################################################################
+# trace
+
+ifeq ($(TRACE_BACKEND),dtrace)
+TRACE_H_EXTRA_DEPS=trace-dtrace.h
+endif
+trace.h: trace.h-timestamp $(TRACE_H_EXTRA_DEPS)
+trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=h \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.h")
+	@cmp -s $@ trace.h || cp $@ trace.h
+
+trace.c: trace.c-timestamp
+trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=c \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.c")
+	@cmp -s $@ trace.c || cp $@ trace.c
+
+trace.o: trace.c $(GENERATED_HEADERS)
+
+trace-dtrace.h: trace-dtrace.dtrace
+	$(call quiet-command,dtrace -o $@ -h -s $<, "  GEN   trace-dtrace.h")
+
+# Normal practice is to name DTrace probe file with a '.d' extension
+# but that gets picked up by QEMU's Makefile as an external dependency
+# rule file. So we use '.dtrace' instead
+trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
+trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
+	$(call quiet-command,$(TRACETOOL) \
+		--format=d \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace-dtrace.dtrace")
+	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
+
+trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
+	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN   trace-dtrace.o")
+
+ifeq ($(LIBTOOL),)
+trace-dtrace.lo: trace-dtrace.dtrace
+	@echo "missing libtool. please install and rerun configure."; exit 1
+else
+trace-dtrace.lo: trace-dtrace.dtrace
+	$(call quiet-command,$(LIBTOOL) --mode=compile --tag=CC dtrace -o $@ -G -s $<, "  lt GEN trace-dtrace.o")
+endif
+
+trace/simple.o: trace/simple.c $(GENERATED_HEADERS)
+
+trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace.o
+ifneq ($(TRACE_BACKEND),dtrace)
+trace-obj-y = trace.o
+endif
+
+trace-obj-$(CONFIG_TRACE_DEFAULT) += trace/default.o
+trace-obj-$(CONFIG_TRACE_SIMPLE) += trace/simple.o
+trace-obj-$(CONFIG_TRACE_SIMPLE) += qemu-timer-common.o
+trace-obj-$(CONFIG_TRACE_STDERR) += trace/stderr.o
+trace-obj-y += trace/control.o
+
+$(trace-obj-y): $(GENERATED_HEADERS)
+
 ######################################################################
 # smartcard

@@ -33,68 +217,24 @@ libcacard-y += libcacard/vcard_emul_nss.o
 libcacard-y += libcacard/vcard_emul_type.o
 libcacard-y += libcacard/card_7816.o

-######################################################################
-# Target independent part of system emulation. The long term path is to
-# suppress *all* target specific code in case of system emulation, i.e. a
-# single QEMU executable should support all CPUs and machines.
-
-ifeq ($(CONFIG_SOFTMMU),y)
-common-obj-y = $(block-obj-y) blockdev.o blockdev-nbd.o block/
-common-obj-y += net/
-common-obj-y += readline.o
-common-obj-$(CONFIG_WIN32) += os-win32.o
-common-obj-$(CONFIG_POSIX) += os-posix.o
-
-common-obj-$(CONFIG_LINUX) += fsdev/
-
-common-obj-y += migration.o migration-tcp.o
-common-obj-y += qemu-char.o #aio.o
-common-obj-y += block-migration.o
-common-obj-y += page_cache.o xbzrle.o
-
-common-obj-$(CONFIG_POSIX) += migration-exec.o migration-unix.o migration-fd.o
-
-common-obj-$(CONFIG_SPICE) += spice-qemu-char.o
-
-common-obj-y += audio/
-common-obj-y += hw/
-
-common-obj-y += ui/
-common-obj-y += bt-host.o bt-vhci.o
-
-common-obj-y += dma-helpers.o
-common-obj-y += qtest.o
-common-obj-y += vl.o
-
-common-obj-$(CONFIG_SLIRP) += slirp/
-
-common-obj-y += backends/
-
-common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
-
 common-obj-$(CONFIG_SMARTCARD_NSS) += $(libcacard-y)

 ######################################################################
 # qapi

+qapi-obj-y = qapi/
+qapi-obj-y += qapi-types.o qapi-visit.o
+
 common-obj-y += qmp-marshal.o qapi-visit.o qapi-types.o
 common-obj-y += qmp.o hmp.o
-endif

-#######################################################################
-# Target-independent parts used in system and user emulation
-common-obj-y += qemu-log.o
-common-obj-y += tcg-runtime.o
-common-obj-y += hw/
-common-obj-y += qom/
-common-obj-y += disas/
+universal-obj-y += $(qapi-obj-y)

 ######################################################################
 # guest agent

-# FIXME: a few definitions from qapi-types.o/qapi-visit.o are needed
-# by libqemuutil.a.  These should be moved to a separate .json schema.
-qga-obj-y = qga/ qapi-types.o qapi-visit.o
+qga-obj-y = qga/ qemu-ga.o module.o qemu-tool.o
+qga-obj-$(CONFIG_POSIX) += qemu-sockets.o qemu-option.o

 vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)

@@ -104,8 +244,11 @@ QEMU_CFLAGS+=$(GLIB_CFLAGS)

 nested-vars += \
 	stub-obj-y \
-	util-obj-y \
 	qga-obj-y \
+	qom-obj-y \
+	qapi-obj-y \
 	block-obj-y \
-	common-obj-y
+	user-obj-y \
+	common-obj-y \
+	extra-obj-y
 dummy := $(call unnest-vars)
@@ -54,7 +54,7 @@ $(QEMU_PROG).stp: $(SRC_PATH)/trace-events
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-arch=$(TARGET_ARCH) \
 		--target-type=$(TARGET_TYPE) \
-		< $< > $@,"  GEN   $(TARGET_DIR)$(QEMU_PROG).stp")
+		< $< > $@,"  GEN   $(QEMU_PROG).stp")
 else
 stap:
 endif
@@ -69,12 +69,14 @@ all: $(PROGS) stap
 obj-y = exec.o translate-all.o cpu-exec.o
 obj-y += tcg/tcg.o tcg/optimize.o
 obj-$(CONFIG_TCG_INTERPRETER) += tci.o
-obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
 obj-y += fpu/softfloat.o
-obj-y += target-$(TARGET_BASE_ARCH)/
 obj-y += disas.o
+obj-$(CONFIG_TCI_DIS) += tci-dis.o
+obj-y += target-$(TARGET_BASE_ARCH)/
 obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o

+tci-dis.o: QEMU_CFLAGS += -I$(SRC_PATH)/tcg -I$(SRC_PATH)/tcg/tci
+
 #########################################################
 # Linux user emulator target

@@ -83,7 +85,7 @@ ifdef CONFIG_LINUX_USER
 QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) -I$(SRC_PATH)/linux-user

 obj-y += linux-user/
-obj-y += gdbstub.o thunk.o user-exec.o
+obj-y += gdbstub.o thunk.o user-exec.o $(oslib-obj-y)

 endif #CONFIG_LINUX_USER

@@ -95,7 +97,7 @@ ifdef CONFIG_BSD_USER
 QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)

 obj-y += bsd-user/
-obj-y += gdbstub.o user-exec.o
+obj-y += gdbstub.o user-exec.o $(oslib-obj-y)

 endif #CONFIG_BSD_USER

@@ -119,6 +121,11 @@ obj-$(CONFIG_NO_GET_MEMORY_MAPPING) += memory_mapping-stub.o
 obj-$(CONFIG_NO_CORE_DUMP) += dump-stub.o
 LIBS+=-lz

+QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
+QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
+QEMU_CFLAGS += $(VNC_JPEG_CFLAGS)
+QEMU_CFLAGS += $(VNC_PNG_CFLAGS)
+
 # xen support
 obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
 obj-$(CONFIG_NO_XEN) += xen-stub.o
@@ -145,16 +152,25 @@ nested-vars += obj-y
 include $(SRC_PATH)/Makefile.objs

 all-obj-y = $(obj-y)
+all-obj-y += $(addprefix ../, $(universal-obj-y))
+
+ifdef CONFIG_SOFTMMU
 all-obj-y += $(addprefix ../, $(common-obj-y))
+all-obj-y += $(addprefix ../libdis/, $(libdis-y))
+all-obj-y += $(addprefix ../, $(trace-obj-y))
+else
+all-obj-y += $(addprefix ../libuser/, $(user-obj-y))
+all-obj-y += $(addprefix ../libdis-user/, $(libdis-y))
+endif #CONFIG_LINUX_USER

 ifdef QEMU_PROGW
 # The linker builds a windows executable. Make also a console executable.
-$(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+$(QEMU_PROGW): $(all-obj-y) ../libqemustub.a
 	$(call LINK,$^)
 $(QEMU_PROG): $(QEMU_PROGW)
 	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"  GEN   $(TARGET_DIR)$(QEMU_PROG)")
 else
-$(QEMU_PROG): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
+$(QEMU_PROG): $(all-obj-y) ../libqemustub.a
 	$(call LINK,$^)
 endif

@@ -0,0 +1,24 @@
+# Makefile for qemu target independent user files.
+
+include ../config-host.mak
+include $(SRC_PATH)/rules.mak
+-include config.mak
+
+.PHONY: all
+
+$(call set-vpath, $(SRC_PATH))
+
+QEMU_CFLAGS+=-I..
+QEMU_CFLAGS += -I$(SRC_PATH)/include
+QEMU_CFLAGS += -DCONFIG_USER_ONLY
+
+include $(SRC_PATH)/Makefile.objs
+
+all: $(user-obj-y)
+# Dummy command so that make thinks it has done something
+	@true
+
+clean:
+	for d in . trace; do \
+	rm -f $$d/*.o $$d/*.d $$d/*.a $$d/*~; \
+	done
@@ -1 +1 @@
-1.4.2
+1.3.1
@@ -0,0 +1,430 @@
+/* a.out.h
+
+   Copyright 1997, 1998, 1999, 2001 Red Hat, Inc.
+
+This file is part of Cygwin.
+
+This software is a copyrighted work licensed under the terms of the
+Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
+details. */
+
+#ifndef _A_OUT_H_
+#define _A_OUT_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+#define COFF_IMAGE_WITH_PE
+#define COFF_LONG_SECTION_NAMES
+
+/*** coff information for Intel 386/486.  */
+
+
+/********************** FILE HEADER **********************/
+
+struct external_filehdr {
+  short f_magic;	/* magic number			*/
+  short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  short f_opthdr;	/* sizeof(optional hdr)		*/
+  short f_flags;	/* flags			*/
+};
+
+/* Bits for f_flags:
+ *	F_RELFLG	relocation info stripped from file
+ *	F_EXEC		file is executable (no unresolved external references)
+ *	F_LNNO		line numbers stripped from file
+ *	F_LSYMS		local symbols stripped from file
+ *	F_AR32WR	file has byte ordering of an AR32WR machine (e.g. vax)
+ */
+
+#define F_RELFLG	(0x0001)
+#define F_EXEC		(0x0002)
+#define F_LNNO		(0x0004)
+#define F_LSYMS		(0x0008)
+
+
+
+#define	I386MAGIC	0x14c
+#define I386PTXMAGIC	0x154
+#define I386AIXMAGIC	0x175
+
+/* This is Lynx's all-platform magic number for executables. */
+
+#define LYNXCOFFMAGIC	0415
+
+#define I386BADMAG(x) (((x).f_magic != I386MAGIC) \
+		       && (x).f_magic != I386AIXMAGIC \
+		       && (x).f_magic != I386PTXMAGIC \
+		       && (x).f_magic != LYNXCOFFMAGIC)
+
+#define	FILHDR	struct external_filehdr
+#define	FILHSZ	20
+
+
+/********************** AOUT "OPTIONAL HEADER"=
+ **********************/
+
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of data used for this file=
+ */
+}
+AOUTHDR;
+
+#define AOUTSZ 28
+#define AOUTHDRSZ 28
+
+#define OMAGIC          0404    /* object files, eg as output */
+#define ZMAGIC          0413    /* demand load format, eg normal ld output */
+#define STMAGIC		0401	/* target shlib */
+#define SHMAGIC		0443	/* host   shlib */
+
+
+/* define some NT default values */
+/*  #define NT_IMAGE_BASE        0x400000 moved to internal.h */
+#define NT_SECTION_ALIGNMENT 0x1000
+#define NT_FILE_ALIGNMENT    0x200
+#define NT_DEF_RESERVE       0x100000
+#define NT_DEF_COMMIT        0x1000
+
+/********************** SECTION HEADER **********************/
+
+
+struct external_scnhdr {
+  char		s_name[8];	/* section name			*/
+  host_ulong	s_paddr;	/* physical address, offset
+				   of last addr in scn */
+  host_ulong	s_vaddr;	/* virtual address		*/
+  host_ulong	s_size;		/* section size			*/
+  host_ulong	s_scnptr;	/* file ptr to raw data for section */
+  host_ulong	s_relptr;	/* file ptr to relocation	*/
+  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
+  unsigned short s_nreloc;	/* number of relocation entries	*/
+  unsigned short s_nlnno;	/* number of line number entries*/
+  host_ulong	s_flags;	/* flags			*/
+};
+
+#define	SCNHDR	struct external_scnhdr
+#define	SCNHSZ	40
+
+/*
+ * names of "special" sections
+ */
+#define _TEXT	".text"
+#define _DATA	".data"
+#define _BSS	".bss"
+#define _COMMENT ".comment"
+#define _LIB ".lib"
+
+/********************** LINE NUMBERS **********************/
+
+/* 1 line number entry for every "breakpointable" source line in a section.
+ * Line numbers are grouped on a per function basis; first entry in a function
+ * grouping will have l_lnno = 0 and in place of physical address will be the
+ * symbol table index of the function name.
+ */
+struct external_lineno {
+  union {
+    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
+    host_ulong l_paddr;	/* (physical) address of line number	*/
+  } l_addr;
+  unsigned short l_lnno;	/* line number		*/
+};
+
+#define	LINENO	struct external_lineno
+#define	LINESZ	6
+
+/********************** SYMBOLS **********************/
+
+#define E_SYMNMLEN	8	/* # characters in a symbol name	*/
+#define E_FILNMLEN	14	/* # characters in a file name		*/
+#define E_DIMNUM	4	/* # array dimensions in auxiliary entry */
+
+struct QEMU_PACKED external_syment
+{
+  union {
+    char e_name[E_SYMNMLEN];
+    struct {
+      host_ulong e_zeroes;
+      host_ulong e_offset;
+    } e;
+  } e;
+  host_ulong e_value;
+  unsigned short e_scnum;
+  unsigned short e_type;
+  char e_sclass[1];
+  char e_numaux[1];
+};
+
+#define N_BTMASK	(0xf)
+#define N_TMASK		(0x30)
+#define N_BTSHFT	(4)
+#define N_TSHIFT	(2)
+
+union external_auxent {
+  struct {
+    host_ulong x_tagndx;	/* str, un, or enum tag indx */
+    union {
+      struct {
+	unsigned short  x_lnno; /* declaration line number */
+	unsigned short  x_size; /* str/union/array size */
+      } x_lnsz;
+      host_ulong x_fsize;	/* size of function */
+    } x_misc;
+    union {
+      struct {			/* if ISFCN, tag, or .bb */
+	host_ulong x_lnnoptr;/* ptr to fcn line # */
+	host_ulong x_endndx;	/* entry ndx past block end */
+      } x_fcn;
+      struct {			/* if ISARY, up to 4 dimen. */
+	char x_dimen[E_DIMNUM][2];
+      } x_ary;
+    } x_fcnary;
+    unsigned short x_tvndx;	/* tv index */
+  } x_sym;
+
+  union {
+    char x_fname[E_FILNMLEN];
+    struct {
+      host_ulong x_zeroes;
+      host_ulong x_offset;
+    } x_n;
+  } x_file;
+
+  struct {
+    host_ulong x_scnlen;	/* section length */
+    unsigned short x_nreloc;	/* # relocation entries */
+    unsigned short x_nlinno;	/* # line numbers */
+    host_ulong x_checksum;	/* section COMDAT checksum */
+    unsigned short x_associated;/* COMDAT associated section index */
+    char x_comdat[1];		/* COMDAT selection number */
+  } x_scn;
+
+  struct {
+    host_ulong x_tvfill;	/* tv fill value */
+    unsigned short x_tvlen;	/* length of .tv */
+    char x_tvran[2][2];		/* tv range */
+  } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
+
+};
+
+#define	SYMENT	struct external_syment
+#define	SYMESZ	18
+#define	AUXENT	union external_auxent
+#define	AUXESZ	18
+
+#define _ETEXT	"etext"
+
+/********************** RELOCATION DIRECTIVES **********************/
+
+struct external_reloc {
+  char r_vaddr[4];
+  char r_symndx[4];
+  char r_type[2];
+};
+
+#define RELOC struct external_reloc
+#define RELSZ 10
+
+/* end of coff/i386.h */
+
+/* PE COFF header information */
+
+#ifndef _PE_H
+#define _PE_H
+
+/* NT specific file attributes */
+#define IMAGE_FILE_RELOCS_STRIPPED           0x0001
+#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
+#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
+#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
+#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
+#define IMAGE_FILE_32BIT_MACHINE             0x0100
+#define IMAGE_FILE_DEBUG_STRIPPED            0x0200
+#define IMAGE_FILE_SYSTEM                    0x1000
+#define IMAGE_FILE_DLL                       0x2000
+#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
+
+/* additional flags to be set for section headers to allow the NT loader to
+   read and write to the section data (to replace the addresses of data in
+   dlls for one thing); also to execute the section in .text's case=
+ */
+#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
+#define IMAGE_SCN_MEM_EXECUTE     0x20000000
+#define IMAGE_SCN_MEM_READ        0x40000000
+#define IMAGE_SCN_MEM_WRITE       0x80000000
+
+/*
+ * Section characteristics added for ppc-nt
+ */
+
+#define IMAGE_SCN_TYPE_NO_PAD                0x00000008  /* Reserved.  */
+
+#define IMAGE_SCN_CNT_CODE                   0x00000020  /* Section contains code. */
+#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  /* Section contains initialized data. */
+#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  /* Section contains uninitialized data. */
+
+#define IMAGE_SCN_LNK_OTHER                  0x00000100  /* Reserved.  */
+#define IMAGE_SCN_LNK_INFO                   0x00000200  /* Section contains comments or some other type of information. */
+#define IMAGE_SCN_LNK_REMOVE                 0x00000800  /* Section contents will not become part of image. */
+#define IMAGE_SCN_LNK_COMDAT                 0x00001000  /* Section contents comdat. */
+
+#define IMAGE_SCN_MEM_FARDATA                0x00008000
+
+#define IMAGE_SCN_MEM_PURGEABLE              0x00020000
+#define IMAGE_SCN_MEM_16BIT                  0x00020000
+#define IMAGE_SCN_MEM_LOCKED                 0x00040000
+#define IMAGE_SCN_MEM_PRELOAD                0x00080000
+
+#define IMAGE_SCN_ALIGN_1BYTES               0x00100000
+#define IMAGE_SCN_ALIGN_2BYTES               0x00200000
+#define IMAGE_SCN_ALIGN_4BYTES               0x00300000
+#define IMAGE_SCN_ALIGN_8BYTES               0x00400000
+#define IMAGE_SCN_ALIGN_16BYTES              0x00500000  /* Default alignment if no others are specified. */
+#define IMAGE_SCN_ALIGN_32BYTES              0x00600000
+#define IMAGE_SCN_ALIGN_64BYTES              0x00700000
+
+
+#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  /* Section contains extended relocations. */
+#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  /* Section is not cachable.               */
+#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  /* Section is not pageable.               */
+#define IMAGE_SCN_MEM_SHARED                 0x10000000  /* Section is shareable.                  */
+
+/* COMDAT selection codes.  */
+
+#define IMAGE_COMDAT_SELECT_NODUPLICATES     (1) /* Warn if duplicates.  */
+#define IMAGE_COMDAT_SELECT_ANY		     (2) /* No warning.  */
+#define IMAGE_COMDAT_SELECT_SAME_SIZE	     (3) /* Warn if different size.  */
+#define IMAGE_COMDAT_SELECT_EXACT_MATCH	     (4) /* Warn if different.  */
+#define IMAGE_COMDAT_SELECT_ASSOCIATIVE	     (5) /* Base on other section.  */
+
+/* Magic values that are true for all dos/nt implementations */
+#define DOSMAGIC       0x5a4d
+#define NT_SIGNATURE   0x00004550
+
+/* NT allows long filenames, we want to accommodate this.  This may break
+     some of the bfd functions */
+#undef  FILNMLEN
+#define FILNMLEN	18	/* # characters in a file name		*/
+
+
+#ifdef COFF_IMAGE_WITH_PE
+/* The filehdr is only weired in images */
+
+#undef FILHDR
+struct external_PE_filehdr
+{
+  /* DOS header fields */
+  unsigned short e_magic;	/* Magic number, 0x5a4d */
+  unsigned short e_cblp;	/* Bytes on last page of file, 0x90 */
+  unsigned short e_cp;		/* Pages in file, 0x3 */
+  unsigned short e_crlc;	/* Relocations, 0x0 */
+  unsigned short e_cparhdr;	/* Size of header in paragraphs, 0x4 */
+  unsigned short e_minalloc;	/* Minimum extra paragraphs needed, 0x0 */
+  unsigned short e_maxalloc;	/* Maximum extra paragraphs needed, 0xFFFF */
+  unsigned short e_ss;		/* Initial (relative) SS value, 0x0 */
+  unsigned short e_sp;		/* Initial SP value, 0xb8 */
+  unsigned short e_csum;	/* Checksum, 0x0 */
+  unsigned short e_ip;		/* Initial IP value, 0x0 */
+  unsigned short e_cs;		/* Initial (relative) CS value, 0x0 */
+  unsigned short e_lfarlc;	/* File address of relocation table, 0x40 */
+  unsigned short e_ovno;	/* Overlay number, 0x0 */
+  char e_res[4][2];		/* Reserved words, all 0x0 */
+  unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
+  unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
+  char e_res2[10][2];		/* Reserved words, all 0x0 */
+  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
+  char dos_message[16][4];	/* other stuff, always follow DOS header */
+  unsigned int nt_signature;	/* required NT signature, 0x4550 */
+
+  /* From standard header */
+
+  unsigned short f_magic;	/* magic number			*/
+  unsigned short f_nscns;	/* number of sections		*/
+  host_ulong f_timdat;	/* time & date stamp		*/
+  host_ulong f_symptr;	/* file pointer to symtab	*/
+  host_ulong f_nsyms;	/* number of symtab entries	*/
+  unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
+  unsigned short f_flags;	/* flags			*/
+};
+
+
+#define FILHDR struct external_PE_filehdr
+#undef FILHSZ
+#define FILHSZ 152
+
+#endif
+
+typedef struct
+{
+  unsigned short magic;		/* type of file				*/
+  unsigned short vstamp;	/* version stamp			*/
+  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
+  host_ulong	dsize;		/* initialized data "  "		*/
+  host_ulong	bsize;		/* uninitialized data "   "		*/
+  host_ulong	entry;		/* entry pt.				*/
+  host_ulong text_start;	/* base of text used for this file */
+  host_ulong data_start;	/* base of all data used for this file */
+
+  /* NT extra fields; see internal.h for descriptions */
+  host_ulong  ImageBase;
+  host_ulong  SectionAlignment;
+  host_ulong  FileAlignment;
+  unsigned short  MajorOperatingSystemVersion;
+  unsigned short  MinorOperatingSystemVersion;
+  unsigned short  MajorImageVersion;
+  unsigned short  MinorImageVersion;
+  unsigned short  MajorSubsystemVersion;
+  unsigned short  MinorSubsystemVersion;
+  char  Reserved1[4];
+  host_ulong  SizeOfImage;
+  host_ulong  SizeOfHeaders;
+  host_ulong  CheckSum;
+  unsigned short Subsystem;
+  unsigned short DllCharacteristics;
+  host_ulong  SizeOfStackReserve;
+  host_ulong  SizeOfStackCommit;
+  host_ulong  SizeOfHeapReserve;
+  host_ulong  SizeOfHeapCommit;
+  host_ulong  LoaderFlags;
+  host_ulong  NumberOfRvaAndSizes;
+  /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
+  char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
+
+} PEAOUTHDR;
+
+
+#undef AOUTSZ
+#define AOUTSZ (AOUTHDRSZ + 196)
+
+#undef  E_FILNMLEN
+#define E_FILNMLEN	18	/* # characters in a file name		*/
+#endif
+
+/* end of coff/pe.h */
+
+#define DT_NON		(0)	/* no derived type */
+#define DT_PTR		(1)	/* pointer */
+#define DT_FCN		(2)	/* function */
+#define DT_ARY		(3)	/* array */
+
+#define ISPTR(x)	(((x) & N_TMASK) == (DT_PTR << N_BTSHFT))
+#define ISFCN(x)	(((x) & N_TMASK) == (DT_FCN << N_BTSHFT))
+#define ISARY(x)	(((x) & N_TMASK) == (DT_ARY << N_BTSHFT))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _A_OUT_H_ */
@@ -24,7 +24,7 @@


 #include "qemu-common.h"
-#include "qemu/acl.h"
+#include "acl.h"

 #ifdef CONFIG_FNMATCH
 #include <fnmatch.h>
@@ -103,8 +103,8 @@ void qemu_acl_reset(qemu_acl *acl)
    acl->defaultDeny = 1;
    QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
-        g_free(entry->match);
-        g_free(entry);
+        free(entry->match);
+        free(entry);
    }
    acl->nentries = 0;
 }
@@ -168,9 +168,6 @@ int qemu_acl_remove(qemu_acl *acl,
        i++;
        if (strcmp(entry->match, match) == 0) {
            QTAILQ_REMOVE(&acl->entries, entry, next);
-            acl->nentries--;
-            g_free(entry->match);
-            g_free(entry);
            return i;
        }
    }
@@ -25,7 +25,7 @@
 #ifndef __QEMU_ACL_H__
 #define __QEMU_ACL_H__

-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef struct qemu_acl_entry qemu_acl_entry;
 typedef struct qemu_acl qemu_acl;
@@ -28,7 +28,7 @@
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "qemu-common.h"
-#include "block/aes.h"
+#include "aes.h"

 #ifndef NDEBUG
 #define NDEBUG
@@ -14,9 +14,9 @@
 */

 #include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
+#include "block.h"
+#include "qemu-queue.h"
+#include "qemu_socket.h"

 struct AioHandler
 {
@@ -16,9 +16,9 @@
 */

 #include "qemu-common.h"
-#include "block/block.h"
-#include "qemu/queue.h"
-#include "qemu/sockets.h"
+#include "block.h"
+#include "qemu-queue.h"
+#include "qemu_socket.h"

 struct AioHandler {
    EventNotifier *e;
@@ -20,7 +20,7 @@ along with this file; see the file COPYING.  If not, see
 <http://www.gnu.org/licenses/>. */

 #include <stdio.h>
-#include "disas/bfd.h"
+#include "dis-asm.h"

 /* MAX is redefined below, so remove any previous definition. */
 #undef MAX
@@ -29,26 +29,25 @@
 #include <sys/mman.h>
 #endif
 #include "config.h"
-#include "monitor/monitor.h"
-#include "sysemu/sysemu.h"
-#include "qemu/bitops.h"
-#include "qemu/bitmap.h"
-#include "sysemu/arch_init.h"
+#include "monitor.h"
+#include "sysemu.h"
+#include "bitops.h"
+#include "bitmap.h"
+#include "arch_init.h"
 #include "audio/audio.h"
 #include "hw/pc.h"
-#include "hw/pci/pci.h"
+#include "hw/pci.h"
 #include "hw/audiodev.h"
-#include "sysemu/kvm.h"
-#include "migration/migration.h"
-#include "exec/gdbstub.h"
+#include "kvm.h"
+#include "migration.h"
+#include "net.h"
+#include "gdbstub.h"
 #include "hw/smbios.h"
-#include "exec/address-spaces.h"
+#include "exec-memory.h"
 #include "hw/pcspk.h"
-#include "migration/page_cache.h"
-#include "qemu/config-file.h"
+#include "qemu/page_cache.h"
 #include "qmp-commands.h"
 #include "trace.h"
-#include "exec/cpu-all.h"

 #ifdef DEBUG_ARCH_INIT
 #define DPRINTF(fmt, ...) \
@@ -265,21 +264,16 @@ uint64_t xbzrle_mig_pages_overflow(void)
    return acct_info.xbzrle_overflows;
 }

-static size_t save_block_hdr(QEMUFile *f, RAMBlock *block, ram_addr_t offset,
-                             int cont, int flag)
+static void save_block_hdr(QEMUFile *f, RAMBlock *block, ram_addr_t offset,
+        int cont, int flag)
 {
-    size_t size;
+        qemu_put_be64(f, offset | cont | flag);
+        if (!cont) {
+                qemu_put_byte(f, strlen(block->idstr));
+                qemu_put_buffer(f, (uint8_t *)block->idstr,
+                                strlen(block->idstr));
+        }

-    qemu_put_be64(f, offset | cont | flag);
-    size = 8;
-
-    if (!cont) {
-        qemu_put_byte(f, strlen(block->idstr));
-        qemu_put_buffer(f, (uint8_t *)block->idstr,
-                        strlen(block->idstr));
-        size += 1 + strlen(block->idstr);
-    }
-    return size;
 }

 #define ENCODING_FLAG_XBZRLE 0x1
@@ -326,43 +320,34 @@ static int save_xbzrle_page(QEMUFile *f, uint8_t *current_data,
    }

    /* Send XBZRLE based compressed page */
-    bytes_sent = save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_XBZRLE);
+    save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_XBZRLE);
    qemu_put_byte(f, ENCODING_FLAG_XBZRLE);
    qemu_put_be16(f, encoded_len);
    qemu_put_buffer(f, XBZRLE.encoded_buf, encoded_len);
-    bytes_sent += encoded_len + 1 + 2;
+    bytes_sent = encoded_len + 1 + 2;
    acct_info.xbzrle_pages++;
    acct_info.xbzrle_bytes += bytes_sent;

    return bytes_sent;
 }

-
-/* This is the last block that we have visited serching for dirty pages
- */
-static RAMBlock *last_seen_block;
-/* This is the last block from where we have sent data */
-static RAMBlock *last_sent_block;
+static RAMBlock *last_block;
 static ram_addr_t last_offset;
 static unsigned long *migration_bitmap;
 static uint64_t migration_dirty_pages;
-static uint32_t last_version;

-static inline
-ram_addr_t migration_bitmap_find_and_reset_dirty(MemoryRegion *mr,
-                                                 ram_addr_t start)
+static inline bool migration_bitmap_test_and_reset_dirty(MemoryRegion *mr,
+                                                         ram_addr_t offset)
 {
-    unsigned long base = mr->ram_addr >> TARGET_PAGE_BITS;
-    unsigned long nr = base + (start >> TARGET_PAGE_BITS);
-    unsigned long size = base + (int128_get64(mr->size) >> TARGET_PAGE_BITS);
+    bool ret;
+    int nr = (mr->ram_addr + offset) >> TARGET_PAGE_BITS;

-    unsigned long next = find_next_bit(migration_bitmap, size, nr);
+    ret = test_and_clear_bit(nr, migration_bitmap);

-    if (next < size) {
-        clear_bit(next, migration_bitmap);
+    if (ret) {
        migration_dirty_pages--;
    }
-    return (next - base) << TARGET_PAGE_BITS;
+    return ret;
 }

 static inline bool migration_bitmap_set_dirty(MemoryRegion *mr,
@@ -396,14 +381,15 @@ static void migration_bitmap_sync(void)
    trace_migration_bitmap_sync_start();
    memory_global_sync_dirty_bitmap(get_system_memory());

-    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+    QLIST_FOREACH(block, &ram_list.blocks, next) {
        for (addr = 0; addr < block->length; addr += TARGET_PAGE_SIZE) {
-            if (memory_region_test_and_clear_dirty(block->mr,
-                                                   addr, TARGET_PAGE_SIZE,
-                                                   DIRTY_MEMORY_MIGRATION)) {
+            if (memory_region_get_dirty(block->mr, addr, TARGET_PAGE_SIZE,
+                                        DIRTY_MEMORY_MIGRATION)) {
                migration_bitmap_set_dirty(block->mr, addr);
            }
        }
+        memory_region_reset_dirty(block->mr, 0, block->length,
+                                  DIRTY_MEMORY_MIGRATION);
    }
    trace_migration_bitmap_sync_end(migration_dirty_pages
                                    - num_dirty_pages_init);
@@ -419,54 +405,39 @@ static void migration_bitmap_sync(void)
    }
 }

+
 /*
 * ram_save_block: Writes a page of memory to the stream f
 *
- * Returns:  The number of bytes written.
- *           0 means no dirty pages
+ * Returns:  0: if the page hasn't changed
+ *          -1: if there are no more dirty pages
+ *           n: the amount of bytes written in other case
 */

 static int ram_save_block(QEMUFile *f, bool last_stage)
 {
-    RAMBlock *block = last_seen_block;
+    RAMBlock *block = last_block;
    ram_addr_t offset = last_offset;
-    bool complete_round = false;
-    int bytes_sent = 0;
+    int bytes_sent = -1;
    MemoryRegion *mr;
    ram_addr_t current_addr;

    if (!block)
-        block = QTAILQ_FIRST(&ram_list.blocks);
+        block = QLIST_FIRST(&ram_list.blocks);

-    while (true) {
+    do {
        mr = block->mr;
-        offset = migration_bitmap_find_and_reset_dirty(mr, offset);
-        if (complete_round && block == last_seen_block &&
-            offset >= last_offset) {
-            break;
-        }
-        if (offset >= block->length) {
-            offset = 0;
-            block = QTAILQ_NEXT(block, next);
-            if (!block) {
-                block = QTAILQ_FIRST(&ram_list.blocks);
-                complete_round = true;
-            }
-        } else {
+        if (migration_bitmap_test_and_reset_dirty(mr, offset)) {
            uint8_t *p;
-            int cont = (block == last_sent_block) ?
-                RAM_SAVE_FLAG_CONTINUE : 0;
+            int cont = (block == last_block) ? RAM_SAVE_FLAG_CONTINUE : 0;

            p = memory_region_get_ram_ptr(mr) + offset;

-            /* In doubt sent page as normal */
-            bytes_sent = -1;
            if (is_dup_page(p)) {
                acct_info.dup_pages++;
-                bytes_sent = save_block_hdr(f, block, offset, cont,
-                                            RAM_SAVE_FLAG_COMPRESS);
+                save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_COMPRESS);
                qemu_put_byte(f, *p);
-                bytes_sent += 1;
+                bytes_sent = 1;
            } else if (migrate_use_xbzrle()) {
                current_addr = block->offset + offset;
                bytes_sent = save_xbzrle_page(f, p, current_addr, block,
@@ -476,22 +447,30 @@ static int ram_save_block(QEMUFile *f, bool last_stage)
                }
            }

-            /* XBZRLE overflow or normal page */
+            /* either we didn't send yet (we may have had XBZRLE overflow) */
            if (bytes_sent == -1) {
-                bytes_sent = save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_PAGE);
+                save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_PAGE);
                qemu_put_buffer(f, p, TARGET_PAGE_SIZE);
-                bytes_sent += TARGET_PAGE_SIZE;
+                bytes_sent = TARGET_PAGE_SIZE;
                acct_info.norm_pages++;
            }

            /* if page is unmodified, continue to the next */
-            if (bytes_sent > 0) {
-                last_sent_block = block;
+            if (bytes_sent != 0) {
                break;
            }
        }
-    }
-    last_seen_block = block;
+
+        offset += TARGET_PAGE_SIZE;
+        if (offset >= block->length) {
+            offset = 0;
+            block = QLIST_NEXT(block, next);
+            if (!block)
+                block = QLIST_FIRST(&ram_list.blocks);
+        }
+    } while (block != last_block || offset != last_offset);
+
+    last_block = block;
    last_offset = offset;

    return bytes_sent;
@@ -519,12 +498,41 @@ uint64_t ram_bytes_total(void)
    RAMBlock *block;
    uint64_t total = 0;

-    QTAILQ_FOREACH(block, &ram_list.blocks, next)
+    QLIST_FOREACH(block, &ram_list.blocks, next)
        total += block->length;

    return total;
 }

+static int block_compar(const void *a, const void *b)
+{
+    RAMBlock * const *ablock = a;
+    RAMBlock * const *bblock = b;
+
+    return strcmp((*ablock)->idstr, (*bblock)->idstr);
+}
+
+static void sort_ram_list(void)
+{
+    RAMBlock *block, *nblock, **blocks;
+    int n;
+    n = 0;
+    QLIST_FOREACH(block, &ram_list.blocks, next) {
+        ++n;
+    }
+    blocks = g_malloc(n * sizeof *blocks);
+    n = 0;
+    QLIST_FOREACH_SAFE(block, &ram_list.blocks, next, nblock) {
+        blocks[n++] = block;
+        QLIST_REMOVE(block, next);
+    }
+    qsort(blocks, n, sizeof *blocks, block_compar);
+    while (--n >= 0) {
+        QLIST_INSERT_HEAD(&ram_list.blocks, blocks[n], next);
+    }
+    g_free(blocks);
+}
+
 static void migration_end(void)
 {
    if (migration_bitmap) {
@@ -548,12 +556,12 @@ static void ram_migration_cancel(void *opaque)
    migration_end();
 }

+
 static void reset_ram_globals(void)
 {
-    last_seen_block = NULL;
-    last_sent_block = NULL;
+    last_block = NULL;
    last_offset = 0;
-    last_version = ram_list.version;
+    sort_ram_list();
 }

 #define MAX_WAIT 50 /* ms, half buffered_file limit */
@@ -567,7 +575,6 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
    bitmap_set(migration_bitmap, 0, ram_pages);
    migration_dirty_pages = ram_pages;

-    qemu_mutex_lock_ramlist();
    bytes_transferred = 0;
    reset_ram_globals();

@@ -589,13 +596,12 @@ static int ram_save_setup(QEMUFile *f, void *opaque)

    qemu_put_be64(f, ram_bytes_total() | RAM_SAVE_FLAG_MEM_SIZE);

-    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+    QLIST_FOREACH(block, &ram_list.blocks, next) {
        qemu_put_byte(f, strlen(block->idstr));
        qemu_put_buffer(f, (uint8_t *)block->idstr, strlen(block->idstr));
        qemu_put_be64(f, block->length);
    }

-    qemu_mutex_unlock_ramlist();
    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);

    return 0;
@@ -603,28 +609,26 @@ static int ram_save_setup(QEMUFile *f, void *opaque)

 static int ram_save_iterate(QEMUFile *f, void *opaque)
 {
+    uint64_t bytes_transferred_last;
+    double bwidth = 0;
    int ret;
    int i;
-    int64_t t0;
-    int total_sent = 0;
+    uint64_t expected_downtime;
+    MigrationState *s = migrate_get_current();

-    qemu_mutex_lock_ramlist();
+    bytes_transferred_last = bytes_transferred;
+    bwidth = qemu_get_clock_ns(rt_clock);

-    if (ram_list.version != last_version) {
-        reset_ram_globals();
-    }
-
-    t0 = qemu_get_clock_ns(rt_clock);
    i = 0;
    while ((ret = qemu_file_rate_limit(f)) == 0) {
        int bytes_sent;

        bytes_sent = ram_save_block(f, false);
        /* no more blocks to sent */
-        if (bytes_sent == 0) {
+        if (bytes_sent < 0) {
            break;
        }
-        total_sent += bytes_sent;
+        bytes_transferred += bytes_sent;
        acct_info.iterations++;
        /* we want to check in the 1st loop, just in case it was the 1st time
           and we had to sync the dirty bitmap.
@@ -632,7 +636,7 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
           iterations
        */
        if ((i & 63) == 0) {
-            uint64_t t1 = (qemu_get_clock_ns(rt_clock) - t0) / 1000000;
+            uint64_t t1 = (qemu_get_clock_ns(rt_clock) - bwidth) / 1000000;
            if (t1 > MAX_WAIT) {
                DPRINTF("big wait: %" PRIu64 " milliseconds, %d iterations\n",
                        t1, i);
@@ -642,23 +646,38 @@ static int ram_save_iterate(QEMUFile *f, void *opaque)
        i++;
    }

-    qemu_mutex_unlock_ramlist();
-
    if (ret < 0) {
-        bytes_transferred += total_sent;
        return ret;
    }

-    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
-    total_sent += 8;
-    bytes_transferred += total_sent;
+    bwidth = qemu_get_clock_ns(rt_clock) - bwidth;
+    bwidth = (bytes_transferred - bytes_transferred_last) / bwidth;

-    return total_sent;
+    /* if we haven't transferred anything this round, force
+     * expected_downtime to a very high value, but without
+     * crashing */
+    if (bwidth == 0) {
+        bwidth = 0.000001;
+    }
+
+    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);
+
+    expected_downtime = ram_save_remaining() * TARGET_PAGE_SIZE / bwidth;
+    DPRINTF("ram_save_live: expected(%" PRIu64 ") <= max(" PRIu64 ")?\n",
+            expected_downtime, migrate_max_downtime());
+
+    if (expected_downtime <= migrate_max_downtime()) {
+        migration_bitmap_sync();
+        expected_downtime = ram_save_remaining() * TARGET_PAGE_SIZE / bwidth;
+        s->expected_downtime = expected_downtime / 1000000; /* ns -> ms */
+
+        return expected_downtime <= migrate_max_downtime();
+    }
+    return 0;
 }

 static int ram_save_complete(QEMUFile *f, void *opaque)
 {
-    qemu_mutex_lock_ramlist();
    migration_bitmap_sync();

    /* try transferring iterative blocks of memory */
@@ -669,32 +688,18 @@ static int ram_save_complete(QEMUFile *f, void *opaque)

        bytes_sent = ram_save_block(f, true);
        /* no more blocks to sent */
-        if (bytes_sent == 0) {
+        if (bytes_sent < 0) {
            break;
        }
        bytes_transferred += bytes_sent;
    }
    migration_end();

-    qemu_mutex_unlock_ramlist();
    qemu_put_be64(f, RAM_SAVE_FLAG_EOS);

    return 0;
 }

-static uint64_t ram_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)
-{
-    uint64_t remaining_size;
-
-    remaining_size = ram_save_remaining() * TARGET_PAGE_SIZE;
-
-    if (remaining_size < max_size) {
-        migration_bitmap_sync();
-        remaining_size = ram_save_remaining() * TARGET_PAGE_SIZE;
-    }
-    return remaining_size;
-}
-
 static int load_xbzrle(QEMUFile *f, ram_addr_t addr, void *host)
 {
    int ret, rc = 0;
@@ -757,7 +762,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,
    qemu_get_buffer(f, (uint8_t *)id, len);
    id[len] = 0;

-    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+    QLIST_FOREACH(block, &ram_list.blocks, next) {
        if (!strncmp(id, block->idstr, sizeof(id)))
            return memory_region_get_ram_ptr(block->mr) + offset;
    }
@@ -801,7 +806,7 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)
                    id[len] = 0;
                    length = qemu_get_be64(f);

-                    QTAILQ_FOREACH(block, &ram_list.blocks, next) {
+                    QLIST_FOREACH(block, &ram_list.blocks, next) {
                        if (!strncmp(id, block->idstr, sizeof(id))) {
                            if (block->length != length) {
                                ret =  -EINVAL;
@@ -851,6 +856,9 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id)

            qemu_get_buffer(f, host, TARGET_PAGE_SIZE);
        } else if (flags & RAM_SAVE_FLAG_XBZRLE) {
+            if (!migrate_use_xbzrle()) {
+                return -EINVAL;
+            }
            void *host = host_from_stream_offset(f, addr, flags);
            if (!host) {
                return -EINVAL;
@@ -878,7 +886,6 @@ SaveVMHandlers savevm_ram_handlers = {
    .save_live_setup = ram_save_setup,
    .save_live_iterate = ram_save_iterate,
    .save_live_complete = ram_save_complete,
-    .save_live_pending = ram_save_pending,
    .load_state = ram_load,
    .cancel = ram_migration_cancel,
 };
@@ -22,7 +22,7 @@
 /* Start of qemu specific additions.  Mostly this is stub definitions
   for things we don't care about.  */

-#include "disas/bfd.h"
+#include "dis-asm.h"
 #define ATTRIBUTE_UNUSED __attribute__((unused))
 #define ISSPACE(x) ((x) == ' ' || (x) == '\t' || (x) == '\n')

@@ -23,8 +23,8 @@
 */

 #include "qemu-common.h"
-#include "block/aio.h"
-#include "qemu/main-loop.h"
+#include "qemu-aio.h"
+#include "main-loop.h"

 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
@@ -215,3 +215,8 @@ void aio_context_unref(AioContext *ctx)
 {
    g_source_unref(&ctx->source);
 }
+
+void aio_flush(AioContext *ctx)
+{
+    while (aio_poll(ctx, true));
+}
@@ -12,6 +12,3 @@ common-obj-$(CONFIG_WINWAVE) += winwaveaudio.o
 common-obj-$(CONFIG_AUDIO_PT_INT) += audio_pt_int.o
 common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o
-
-$(obj)/audio.o $(obj)/fmodaudio.o: QEMU_CFLAGS += $(FMOD_CFLAGS)
-$(obj)/sdlaudio.o: QEMU_CFLAGS += $(SDL_CFLAGS)
@@ -23,7 +23,7 @@
 */
 #include <alsa/asoundlib.h>
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
+#include "qemu-char.h"
 #include "audio.h"

 #if QEMU_GNUC_PREREQ(4, 3)
@@ -23,9 +23,9 @@
 */
 #include "hw/hw.h"
 #include "audio.h"
-#include "monitor/monitor.h"
-#include "qemu/timer.h"
-#include "sysemu/sysemu.h"
+#include "monitor.h"
+#include "qemu-timer.h"
+#include "sysemu.h"

 #define AUDIO_CAP "audio"
 #include "audio_int.h"
@@ -828,9 +828,8 @@ static int audio_attach_capture (HWVoiceOut *hw)
        QLIST_INSERT_HEAD (&hw_cap->sw_head, sw, entries);
        QLIST_INSERT_HEAD (&hw->cap_head, sc, entries);
 #ifdef DEBUG_CAPTURE
-        sw->name = g_strdup_printf ("for %p %d,%d,%d",
-                                    hw, sw->info.freq, sw->info.bits,
-                                    sw->info.nchannels);
+        asprintf (&sw->name, "for %p %d,%d,%d",
+                  hw, sw->info.freq, sw->info.bits, sw->info.nchannels);
        dolog ("Added %s active = %d\n", sw->name, sw->active);
 #endif
        if (sw->active) {
@@ -25,7 +25,7 @@
 #define QEMU_AUDIO_H

 #include "config-host.h"
-#include "qemu/queue.h"
+#include "qemu-queue.h"

 typedef void (*audio_callback_fn) (void *opaque, int avail);

@@ -23,7 +23,7 @@
 */
 #include "qemu-common.h"
 #include "audio.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"

 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
@@ -31,8 +31,8 @@
 #include <sys/soundcard.h>
 #endif
 #include "qemu-common.h"
-#include "qemu/main-loop.h"
-#include "qemu/host-utils.h"
+#include "host-utils.h"
+#include "qemu-char.h"
 #include "audio.h"

 #define AUDIO_CAP "oss"
@@ -18,7 +18,7 @@
 */

 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "ui/qemu-spice.h"

 #define AUDIO_CAP "spice"
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "hw/hw.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "audio.h"

 #define AUDIO_CAP "wav"
@@ -1,5 +1,5 @@
 #include "hw/hw.h"
-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "audio.h"

 typedef struct {
@@ -1,7 +1,7 @@
 /* public domain */

 #include "qemu-common.h"
-#include "sysemu/sysemu.h"
+#include "sysemu.h"
 #include "audio.h"

 #define AUDIO_CAP "winwave"
@@ -11,8 +11,8 @@
 */

 #include "qemu/rng.h"
-#include "char/char.h"
-#include "qapi/qmp/qerror.h"
+#include "qemu-char.h"
+#include "qerror.h"
 #include "hw/qdev.h" /* just for DEFINE_PROP_CHR */

 #define TYPE_RNG_EGD "rng-egd"
@@ -207,7 +207,7 @@ static void rng_egd_class_init(ObjectClass *klass, void *data)
    rbc->opened = rng_egd_opened;
 }

-static const TypeInfo rng_egd_info = {
+static TypeInfo rng_egd_info = {
    .name = TYPE_RNG_EGD,
    .parent = TYPE_RNG_BACKEND,
    .instance_size = sizeof(RngEgd),
@@ -12,8 +12,8 @@

 #include "qemu/rng-random.h"
 #include "qemu/rng.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/main-loop.h"
+#include "qerror.h"
+#include "main-loop.h"

 struct RndRandom
 {
@@ -41,9 +41,6 @@ static void entropy_available(void *opaque)
    ssize_t len;

    len = read(s->fd, buffer, s->size);
-    if (len < 0 && errno == EAGAIN) {
-        return;
-    }
    g_assert(len != -1);

    s->receive_func(s->opaque, buffer, len);
@@ -147,7 +144,7 @@ static void rng_random_class_init(ObjectClass *klass, void *data)
    rbc->opened = rng_random_opened;
 }

-static const TypeInfo rng_random_info = {
+static TypeInfo rng_random_info = {
    .name = TYPE_RNG_RANDOM,
    .parent = TYPE_RNG_BACKEND,
    .instance_size = sizeof(RndRandom),
@@ -11,7 +11,7 @@
 */

 #include "qemu/rng.h"
-#include "qapi/qmp/qerror.h"
+#include "qerror.h"

 void rng_backend_request_entropy(RngBackend *s, size_t size,
                                 EntropyReceiveFunc *receive_entropy,
@@ -76,7 +76,7 @@ static void rng_backend_init(Object *obj)
                             NULL);
 }

-static const TypeInfo rng_backend_info = {
+static TypeInfo rng_backend_info = {
    .name = TYPE_RNG_BACKEND,
    .parent = TYPE_OBJECT,
    .instance_size = sizeof(RngBackend),
@@ -24,13 +24,13 @@
 * THE SOFTWARE.
 */

-#include "monitor/monitor.h"
-#include "exec/cpu-common.h"
-#include "sysemu/kvm.h"
-#include "sysemu/balloon.h"
+#include "monitor.h"
+#include "cpu-common.h"
+#include "kvm.h"
+#include "balloon.h"
 #include "trace.h"
 #include "qmp-commands.h"
-#include "qapi/qmp/qjson.h"
+#include "qjson.h"

 static QEMUBalloonEvent *balloon_event_fn;
 static QEMUBalloonStatus *balloon_stat_fn;
@@ -14,7 +14,7 @@
 #ifndef _QEMU_BALLOON_H
 #define _QEMU_BALLOON_H

-#include "monitor/monitor.h"
+#include "monitor.h"
 #include "qapi-types.h"

 typedef void (QEMUBalloonEvent)(void *opaque, ram_addr_t target);
@@ -9,8 +9,8 @@
 * Version 2.
 */

-#include "qemu/bitops.h"
-#include "qemu/bitmap.h"
+#include "bitops.h"
+#include "bitmap.h"

 /*
 * bitmaps provide an array of bits, implemented using an an
@@ -13,7 +13,7 @@
 #define BITMAP_H

 #include "qemu-common.h"
-#include "qemu/bitops.h"
+#include "bitops.h"

 /*
 * The available bitmap operations and their rough meaning in the
@@ -11,7 +11,7 @@
 * 2 of the License, or (at your option) any later version.
 */

-#include "qemu/bitops.h"
+#include "bitops.h"

 #define BITOP_WORD(nr)		((nr) / BITS_PER_LONG)

@@ -60,7 +60,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + bitops_ctzl(tmp);
+    return result + bitops_ffsl(tmp);
 }

 /*
@@ -109,7 +109,7 @@ found_first:
        return result + size;	/* Nope. */
    }
 found_middle:
-    return result + bitops_ctol(tmp);
+    return result + ffz(tmp);
 }

 unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
@@ -13,7 +13,6 @@
 #define BITOPS_H

 #include "qemu-common.h"
-#include "host-utils.h"

 #define BITS_PER_BYTE           CHAR_BIT
 #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
@@ -24,29 +23,41 @@
 #define BITS_TO_LONGS(nr)	DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))

 /**
- * bitops_ctzl - count trailing zeroes in word.
+ * bitops_ffs - find first bit in word.
 * @word: The word to search
 *
- * Returns -1 if no bit exists.  Note that compared to the C library
- * routine ffsl, this one returns one less.
+ * Undefined if no bit exists, so code should check against 0 first.
 */
-static unsigned long bitops_ctzl(unsigned long word)
+static unsigned long bitops_ffsl(unsigned long word)
 {
-#if QEMU_GNUC_PREREQ(3, 4)
-    return __builtin_ffsl(word) - 1;
-#else
-    if (!word) {
-        return -1;
-    }
+	int num = 0;

-    if (sizeof(long) == 4) {
-        return ctz32(word);
-    } else if (sizeof(long) == 8) {
-        return ctz64(word);
-    } else {
-        abort();
-    }
+#if LONG_MAX > 0x7FFFFFFF
+	if ((word & 0xffffffff) == 0) {
+		num += 32;
+		word >>= 32;
+	}
 #endif
+	if ((word & 0xffff) == 0) {
+		num += 16;
+		word >>= 16;
+	}
+	if ((word & 0xff) == 0) {
+		num += 8;
+		word >>= 8;
+	}
+	if ((word & 0xf) == 0) {
+		num += 4;
+		word >>= 4;
+	}
+	if ((word & 0x3) == 0) {
+		num += 2;
+		word >>= 2;
+	}
+	if ((word & 0x1) == 0) {
+		num += 1;
+        }
+	return num;
 }

 /**
@@ -88,14 +99,14 @@ static inline unsigned long bitops_flsl(unsigned long word)
 }

 /**
- * cto - count trailing ones in word.
+ * ffz - find first zero in word.
 * @word: The word to search
 *
- * Returns -1 if all bit are set.
+ * Undefined if no zero exists, so code should check against ~0UL first.
 */
-static inline unsigned long bitops_ctol(unsigned long word)
+static inline unsigned long ffz(unsigned long word)
 {
-    return bitops_ctzl(~word);
+    return bitops_ffsl(~word);
 }

 /**
@@ -14,17 +14,16 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "hw/hw.h"
-#include "qemu/queue.h"
-#include "qemu/timer.h"
-#include "migration/block.h"
-#include "migration/migration.h"
-#include "sysemu/blockdev.h"
+#include "qemu-queue.h"
+#include "qemu-timer.h"
+#include "block-migration.h"
+#include "migration.h"
+#include "blockdev.h"
 #include <assert.h>

-#define BLOCK_SIZE                       (1 << 20)
-#define BDRV_SECTORS_PER_DIRTY_CHUNK     (BLOCK_SIZE >> BDRV_SECTOR_BITS)
+#define BLOCK_SIZE (BDRV_SECTORS_PER_DIRTY_CHUNK << BDRV_SECTOR_BITS)

 #define BLK_MIG_FLAG_DEVICE_BLOCK       0x01
 #define BLK_MIG_FLAG_EOS                0x02
@@ -78,7 +77,9 @@ typedef struct BlkMigState {
    int64_t total_sector_sum;
    int prev_progress;
    int bulk_completed;
+    long double total_time;
    long double prev_time_offset;
+    int reads;
 } BlkMigState;

 static BlkMigState block_mig_state;
@@ -131,6 +132,12 @@ uint64_t blk_mig_bytes_total(void)
    return sum << BDRV_SECTOR_BITS;
 }

+static inline long double compute_read_bwidth(void)
+{
+    assert(block_mig_state.total_time != 0);
+    return (block_mig_state.reads / block_mig_state.total_time) * BLOCK_SIZE;
+}
+
 static int bmds_aio_inflight(BlkMigDevState *bmds, int64_t sector)
 {
    int64_t chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;
@@ -184,6 +191,8 @@ static void blk_mig_read_cb(void *opaque, int ret)

    blk->ret = ret;

+    block_mig_state.reads++;
+    block_mig_state.total_time += (curr_time - block_mig_state.prev_time_offset);
    block_mig_state.prev_time_offset = curr_time;

    QSIMPLEQ_INSERT_TAIL(&block_mig_state.blk_list, blk, entry);
@@ -255,7 +264,7 @@ static void set_dirty_tracking(int enable)
    BlkMigDevState *bmds;

    QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
-        bdrv_set_dirty_tracking(bmds->bs, enable ? BLOCK_SIZE : 0);
+        bdrv_set_dirty_tracking(bmds->bs, enable);
    }
 }

@@ -301,6 +310,8 @@ static void init_blk_migration(QEMUFile *f)
    block_mig_state.total_sector_sum = 0;
    block_mig_state.prev_progress = -1;
    block_mig_state.bulk_completed = 0;
+    block_mig_state.total_time = 0;
+    block_mig_state.reads = 0;

    bdrv_iterate(init_blk_migration_it, NULL);
 }
@@ -479,7 +490,33 @@ static int64_t get_remaining_dirty(void)
        dirty += bdrv_get_dirty_count(bmds->bs);
    }

-    return dirty << BDRV_SECTOR_BITS;
+    return dirty * BLOCK_SIZE;
+}
+
+static int is_stage2_completed(void)
+{
+    int64_t remaining_dirty;
+    long double bwidth;
+
+    if (block_mig_state.bulk_completed == 1) {
+
+        remaining_dirty = get_remaining_dirty();
+        if (remaining_dirty == 0) {
+            return 1;
+        }
+
+        bwidth = compute_read_bwidth();
+
+        if ((remaining_dirty / bwidth) <=
+            migrate_max_downtime()) {
+            /* finish stage2 because we think that we can finish remaining work
+               below max_downtime */
+
+            return 1;
+        }
+    }
+
+    return 0;
 }

 static void blk_mig_cleanup(void)
@@ -539,7 +576,6 @@ static int block_save_setup(QEMUFile *f, void *opaque)
 static int block_save_iterate(QEMUFile *f, void *opaque)
 {
    int ret;
-    int64_t last_ftell = qemu_ftell(f);

    DPRINTF("Enter save live iterate submitted %d transferred %d\n",
            block_mig_state.submitted, block_mig_state.transferred);
@@ -570,7 +606,7 @@ static int block_save_iterate(QEMUFile *f, void *opaque)
            }
        }
    }
-    if (ret < 0) {
+    if (ret) {
        blk_mig_cleanup();
        return ret;
    }
@@ -583,7 +619,7 @@ static int block_save_iterate(QEMUFile *f, void *opaque)

    qemu_put_be64(f, BLK_MIG_FLAG_EOS);

-    return qemu_ftell(f) - last_ftell;
+    return is_stage2_completed();
 }

 static int block_save_complete(QEMUFile *f, void *opaque)
@@ -610,7 +646,7 @@ static int block_save_complete(QEMUFile *f, void *opaque)
    } while (ret == 0);

    blk_mig_cleanup();
-    if (ret < 0) {
+    if (ret) {
        return ret;
    }
    /* report completion */
@@ -623,22 +659,6 @@ static int block_save_complete(QEMUFile *f, void *opaque)
    return 0;
 }

-static uint64_t block_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)
-{
-    /* Estimate pending number of bytes to send */
-    uint64_t pending = get_remaining_dirty() +
-                       block_mig_state.submitted * BLOCK_SIZE +
-                       block_mig_state.read_done * BLOCK_SIZE;
-
-    /* Report at least one block pending during bulk phase */
-    if (pending == 0 && !block_mig_state.bulk_completed) {
-        pending = BLOCK_SIZE;
-    }
-
-    DPRINTF("Enter save live pending  %" PRIu64 "\n", pending);
-    return pending;
-}
-
 static int block_load(QEMUFile *f, void *opaque, int version_id)
 {
    static int banner_printed;
@@ -704,7 +724,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                   (addr == 100) ? '\n' : '\r');
            fflush(stdout);
        } else if (!(flags & BLK_MIG_FLAG_EOS)) {
-            fprintf(stderr, "Unknown block migration flags: %#x\n", flags);
+            fprintf(stderr, "Unknown flags\n");
            return -EINVAL;
        }
        ret = qemu_file_get_error(f);
@@ -735,7 +755,6 @@ SaveVMHandlers savevm_block_handlers = {
    .save_live_setup = block_save_setup,
    .save_live_iterate = block_save_iterate,
    .save_live_complete = block_save_complete,
-    .save_live_pending = block_save_pending,
    .load_state = block_load,
    .cancel = block_migration_cancel,
    .is_active = block_is_active,
@@ -24,16 +24,16 @@
 #include "config-host.h"
 #include "qemu-common.h"
 #include "trace.h"
-#include "monitor/monitor.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
-#include "qemu/module.h"
-#include "qapi/qmp/qjson.h"
-#include "sysemu/sysemu.h"
-#include "qemu/notify.h"
-#include "block/coroutine.h"
+#include "monitor.h"
+#include "block_int.h"
+#include "blockjob.h"
+#include "module.h"
+#include "qjson.h"
+#include "sysemu.h"
+#include "notify.h"
+#include "qemu-coroutine.h"
 #include "qmp-commands.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"

 #ifdef CONFIG_BSD
 #include <sys/types.h>
@@ -155,6 +155,10 @@ void bdrv_io_limits_enable(BlockDriverState *bs)
 {
    qemu_co_queue_init(&bs->throttled_reqs);
    bs->block_timer = qemu_new_timer_ns(vm_clock, bdrv_block_timer, bs);
+    bs->slice_time  = 5 * BLOCK_IO_SLICE_TIME;
+    bs->slice_start = qemu_get_clock_ns(vm_clock);
+    bs->slice_end   = bs->slice_start + bs->slice_time;
+    memset(&bs->io_base, 0, sizeof(bs->io_base));
    bs->io_limits_enabled = true;
 }

@@ -514,16 +518,22 @@ BlockDriver *bdrv_find_protocol(const char *filename)
    return NULL;
 }

-static int find_image_format(BlockDriverState *bs, const char *filename,
-                             BlockDriver **pdrv)
+static int find_image_format(const char *filename, BlockDriver **pdrv)
 {
-    int score, score_max;
+    int ret, score, score_max;
    BlockDriver *drv1, *drv;
    uint8_t buf[2048];
-    int ret = 0;
+    BlockDriverState *bs;
+
+    ret = bdrv_file_open(&bs, filename, 0);
+    if (ret < 0) {
+        *pdrv = NULL;
+        return ret;
+    }

    /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
-    if (bs->sg || !bdrv_is_inserted(bs) || bdrv_getlength(bs) == 0) {
+    if (bs->sg || !bdrv_is_inserted(bs)) {
+        bdrv_delete(bs);
        drv = bdrv_find_format("raw");
        if (!drv) {
            ret = -ENOENT;
@@ -533,6 +543,7 @@ static int find_image_format(BlockDriverState *bs, const char *filename,
    }

    ret = bdrv_pread(bs, 0, buf, sizeof(buf));
+    bdrv_delete(bs);
    if (ret < 0) {
        *pdrv = NULL;
        return ret;
@@ -623,31 +634,10 @@ void bdrv_disable_copy_on_read(BlockDriverState *bs)
    bs->copy_on_read--;
 }

-static int bdrv_open_flags(BlockDriverState *bs, int flags)
-{
-    int open_flags = flags | BDRV_O_CACHE_WB;
-
-    /*
-     * Clear flags that are internal to the block layer before opening the
-     * image.
-     */
-    open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
-
-    /*
-     * Snapshots should be writable.
-     */
-    if (bs->is_temporary) {
-        open_flags |= BDRV_O_RDWR;
-    }
-
-    return open_flags;
-}
-
 /*
 * Common part for opening disk images and files
 */
-static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
-    const char *filename,
+static int bdrv_open_common(BlockDriverState *bs, const char *filename,
    int flags, BlockDriver *drv)
 {
    int ret, open_flags;
@@ -675,22 +665,31 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
    bs->opaque = g_malloc0(drv->instance_size);

    bs->enable_write_cache = !!(flags & BDRV_O_CACHE_WB);
-    open_flags = bdrv_open_flags(bs, flags);
+    open_flags = flags | BDRV_O_CACHE_WB;
+
+    /*
+     * Clear flags that are internal to the block layer before opening the
+     * image.
+     */
+    open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
+
+    /*
+     * Snapshots should be writable.
+     */
+    if (bs->is_temporary) {
+        open_flags |= BDRV_O_RDWR;
+    }

    bs->read_only = !(open_flags & BDRV_O_RDWR);

    /* Open the image, either directly or using a protocol */
    if (drv->bdrv_file_open) {
-        if (file != NULL) {
-            bdrv_swap(file, bs);
-            ret = 0;
-        } else {
-            ret = drv->bdrv_file_open(bs, filename, open_flags);
-        }
+        ret = drv->bdrv_file_open(bs, filename, open_flags);
    } else {
-        assert(file != NULL);
-        bs->file = file;
-        ret = drv->bdrv_open(bs, open_flags);
+        ret = bdrv_file_open(&bs->file, filename, open_flags);
+        if (ret >= 0) {
+            ret = drv->bdrv_open(bs, open_flags);
+        }
    }

    if (ret < 0) {
@@ -710,7 +709,10 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
    return 0;

 free_and_fail:
-    bs->file = NULL;
+    if (bs->file) {
+        bdrv_delete(bs->file);
+        bs->file = NULL;
+    }
    g_free(bs->opaque);
    bs->opaque = NULL;
    bs->drv = NULL;
@@ -732,7 +734,7 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename, int flags)
    }

    bs = bdrv_new("");
-    ret = bdrv_open_common(bs, NULL, filename, flags, drv);
+    ret = bdrv_open_common(bs, filename, flags, drv);
    if (ret < 0) {
        bdrv_delete(bs);
        return ret;
@@ -787,7 +789,6 @@ int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
    int ret;
    /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
    char tmp_filename[PATH_MAX + 1];
-    BlockDriverState *file = NULL;

    if (flags & BDRV_O_SNAPSHOT) {
        BlockDriverState *bs1;
@@ -847,36 +848,25 @@ int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
        bs->is_temporary = 1;
    }

-    /* Open image file without format layer */
+    /* Find the right image format driver */
+    if (!drv) {
+        ret = find_image_format(filename, &drv);
+    }
+
+    if (!drv) {
+        goto unlink_and_fail;
+    }
+
    if (flags & BDRV_O_RDWR) {
        flags |= BDRV_O_ALLOW_RDWR;
    }

-    ret = bdrv_file_open(&file, filename, bdrv_open_flags(bs, flags));
-    if (ret < 0) {
-        return ret;
-    }
-
-    /* Find the right image format driver */
-    if (!drv) {
-        ret = find_image_format(file, filename, &drv);
-    }
-
-    if (!drv) {
-        goto unlink_and_fail;
-    }
-
    /* Open the image */
-    ret = bdrv_open_common(bs, file, filename, flags, drv);
+    ret = bdrv_open_common(bs, filename, flags, drv);
    if (ret < 0) {
        goto unlink_and_fail;
    }

-    if (bs->file != file) {
-        bdrv_delete(file);
-        file = NULL;
-    }
-
    /* If there is a backing file, use it */
    if ((flags & BDRV_O_NO_BACKING) == 0) {
        ret = bdrv_open_backing_file(bs);
@@ -898,9 +888,6 @@ int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
    return 0;

 unlink_and_fail:
-    if (file != NULL) {
-        bdrv_delete(file);
-    }
    if (bs->is_temporary) {
        unlink(filename);
    }
@@ -1286,6 +1273,7 @@ static void bdrv_move_feature_fields(BlockDriverState *bs_dest,
    bs_dest->iostatus           = bs_src->iostatus;

    /* dirty bitmap */
+    bs_dest->dirty_count        = bs_src->dirty_count;
    bs_dest->dirty_bitmap       = bs_src->dirty_bitmap;

    /* job */
@@ -1673,10 +1661,10 @@ static void tracked_request_begin(BdrvTrackedRequest *req,
 /**
 * Round a region to cluster boundaries
 */
-void bdrv_round_to_clusters(BlockDriverState *bs,
-                            int64_t sector_num, int nb_sectors,
-                            int64_t *cluster_sector_num,
-                            int *cluster_nb_sectors)
+static void round_to_clusters(BlockDriverState *bs,
+                              int64_t sector_num, int nb_sectors,
+                              int64_t *cluster_sector_num,
+                              int *cluster_nb_sectors)
 {
    BlockDriverInfo bdi;

@@ -1718,8 +1706,8 @@ static void coroutine_fn wait_for_overlapping_requests(BlockDriverState *bs,
     * CoR read and write operations are atomic and guest writes cannot
     * interleave between them.
     */
-    bdrv_round_to_clusters(bs, sector_num, nb_sectors,
-                           &cluster_sector_num, &cluster_nb_sectors);
+    round_to_clusters(bs, sector_num, nb_sectors,
+                      &cluster_sector_num, &cluster_nb_sectors);

    do {
        retry = false;
@@ -2034,6 +2022,36 @@ int bdrv_read_unthrottled(BlockDriverState *bs, int64_t sector_num,
    return ret;
 }

+#define BITS_PER_LONG  (sizeof(unsigned long) * 8)
+
+static void set_dirty_bitmap(BlockDriverState *bs, int64_t sector_num,
+                             int nb_sectors, int dirty)
+{
+    int64_t start, end;
+    unsigned long val, idx, bit;
+
+    start = sector_num / BDRV_SECTORS_PER_DIRTY_CHUNK;
+    end = (sector_num + nb_sectors - 1) / BDRV_SECTORS_PER_DIRTY_CHUNK;
+
+    for (; start <= end; start++) {
+        idx = start / BITS_PER_LONG;
+        bit = start % BITS_PER_LONG;
+        val = bs->dirty_bitmap[idx];
+        if (dirty) {
+            if (!(val & (1UL << bit))) {
+                bs->dirty_count++;
+                val |= 1UL << bit;
+            }
+        } else {
+            if (val & (1UL << bit)) {
+                bs->dirty_count--;
+                val &= ~(1UL << bit);
+            }
+        }
+        bs->dirty_bitmap[idx] = val;
+    }
+}
+
 /* Return < 0 if error. Important errors are:
  -EIO         generic I/O error (may happen for all errors)
  -ENOMEDIUM   No media inserted.
@@ -2185,8 +2203,8 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BlockDriverState *bs,
    /* Cover entire cluster so no additional backing file I/O is required when
     * allocating cluster in the image file.
     */
-    bdrv_round_to_clusters(bs, sector_num, nb_sectors,
-                           &cluster_sector_num, &cluster_nb_sectors);
+    round_to_clusters(bs, sector_num, nb_sectors,
+                      &cluster_sector_num, &cluster_nb_sectors);

    trace_bdrv_co_do_copy_on_readv(bs, sector_num, nb_sectors,
                                   cluster_sector_num, cluster_nb_sectors);
@@ -2800,9 +2818,7 @@ int coroutine_fn bdrv_co_is_allocated_above(BlockDriverState *top,
         *
         * [sector_num+x, nr_sectors] allocated.
         */
-        if (n > pnum_inter &&
-            (intermediate == top ||
-             sector_num + pnum_inter < intermediate->total_sectors)) {
+        if (n > pnum_inter) {
            n = pnum_inter;
        }

@@ -2834,9 +2850,8 @@ BlockInfo *bdrv_query_info(BlockDriverState *bs)
    if (bs->dirty_bitmap) {
        info->has_dirty = true;
        info->dirty = g_malloc0(sizeof(*info->dirty));
-        info->dirty->count = bdrv_get_dirty_count(bs) * BDRV_SECTOR_SIZE;
-        info->dirty->granularity =
-            ((int64_t) BDRV_SECTOR_SIZE << hbitmap_granularity(bs->dirty_bitmap));
+        info->dirty->count = bdrv_get_dirty_count(bs) *
+            BDRV_SECTORS_PER_DIRTY_CHUNK * BDRV_SECTOR_SIZE;
    }

    if (bs->drv) {
@@ -3013,46 +3028,7 @@ void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event)
    }

    drv->bdrv_debug_event(bs, event);
-}

-int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
-                          const char *tag)
-{
-    while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {
-        bs = bs->file;
-    }
-
-    if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {
-        return bs->drv->bdrv_debug_breakpoint(bs, event, tag);
-    }
-
-    return -ENOTSUP;
-}
-
-int bdrv_debug_resume(BlockDriverState *bs, const char *tag)
-{
-    while (bs && bs->drv && !bs->drv->bdrv_debug_resume) {
-        bs = bs->file;
-    }
-
-    if (bs && bs->drv && bs->drv->bdrv_debug_resume) {
-        return bs->drv->bdrv_debug_resume(bs, tag);
-    }
-
-    return -ENOTSUP;
-}
-
-bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
-{
-    while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {
-        bs = bs->file;
-    }
-
-    if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {
-        return bs->drv->bdrv_debug_is_suspended(bs, tag);
-    }
-
-    return false;
 }

 /**************************************************************/
@@ -3306,7 +3282,11 @@ char *get_human_readable_size(char *buf, int buf_size, int64_t size)
 char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn)
 {
    char buf1[128], date_buf[128], clock_buf[128];
+#ifdef _WIN32
+    struct tm *ptm;
+#else
    struct tm tm;
+#endif
    time_t ti;
    int64_t secs;

@@ -3316,9 +3296,15 @@ char *bdrv_snapshot_dump(char *buf, int buf_size, QEMUSnapshotInfo *sn)
                 "ID", "TAG", "VM SIZE", "DATE", "VM CLOCK");
    } else {
        ti = sn->date_sec;
+#ifdef _WIN32
+        ptm = localtime(&ti);
+        strftime(date_buf, sizeof(date_buf),
+                 "%Y-%m-%d %H:%M:%S", ptm);
+#else
        localtime_r(&ti, &tm);
        strftime(date_buf, sizeof(date_buf),
                 "%Y-%m-%d %H:%M:%S", &tm);
+#endif
        secs = sn->vm_clock_nsec / 1000000000;
        snprintf(clock_buf, sizeof(clock_buf),
                 "%02d:%02d:%02d.%03d",
@@ -3792,20 +3778,12 @@ typedef struct BlockDriverAIOCBCoroutine {
    BlockDriverAIOCB common;
    BlockRequest req;
    bool is_write;
-    bool *done;
    QEMUBH* bh;
 } BlockDriverAIOCBCoroutine;

 static void bdrv_aio_co_cancel_em(BlockDriverAIOCB *blockacb)
 {
-    BlockDriverAIOCBCoroutine *acb =
-        container_of(blockacb, BlockDriverAIOCBCoroutine, common);
-    bool done = false;
-
-    acb->done = &done;
-    while (!done) {
-        qemu_aio_wait();
-    }
+    qemu_aio_flush();
 }

 static const AIOCBInfo bdrv_em_co_aiocb_info = {
@@ -3818,11 +3796,6 @@ static void bdrv_co_em_bh(void *opaque)
    BlockDriverAIOCBCoroutine *acb = opaque;

    acb->common.cb(acb->common.opaque, acb->req.error);
-
-    if (acb->done) {
-        *acb->done = true;
-    }
-
    qemu_bh_delete(acb->bh);
    qemu_aio_release(acb);
 }
@@ -3861,7 +3834,6 @@ static BlockDriverAIOCB *bdrv_co_aio_rw_vector(BlockDriverState *bs,
    acb->req.nb_sectors = nb_sectors;
    acb->req.qiov = qiov;
    acb->is_write = is_write;
-    acb->done = NULL;

    co = qemu_coroutine_create(bdrv_co_do_rw);
    qemu_coroutine_enter(co, acb);
@@ -3888,8 +3860,6 @@ BlockDriverAIOCB *bdrv_aio_flush(BlockDriverState *bs,
    BlockDriverAIOCBCoroutine *acb;

    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
-    acb->done = NULL;
-
    co = qemu_coroutine_create(bdrv_aio_flush_co_entry);
    qemu_coroutine_enter(co, acb);

@@ -3918,7 +3888,6 @@ BlockDriverAIOCB *bdrv_aio_discard(BlockDriverState *bs,
    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
    acb->req.sector = sector_num;
    acb->req.nb_sectors = nb_sectors;
-    acb->done = NULL;
    co = qemu_coroutine_create(bdrv_aio_discard_co_entry);
    qemu_coroutine_enter(co, acb);

@@ -4142,13 +4111,7 @@ int coroutine_fn bdrv_co_discard(BlockDriverState *bs, int64_t sector_num,
        return -EIO;
    } else if (bs->read_only) {
        return -EROFS;
-    }
-
-    if (bs->dirty_bitmap) {
-        bdrv_reset_dirty(bs, sector_num, nb_sectors);
-    }
-
-    if (bs->drv->bdrv_co_discard) {
+    } else if (bs->drv->bdrv_co_discard) {
        return bs->drv->bdrv_co_discard(bs, sector_num, nb_sectors);
    } else if (bs->drv->bdrv_aio_discard) {
        BlockDriverAIOCB *acb;
@@ -4287,36 +4250,22 @@ void *qemu_blockalign(BlockDriverState *bs, size_t size)
    return qemu_memalign((bs && bs->buffer_alignment) ? bs->buffer_alignment : 512, size);
 }

-/*
- * Check if all memory in this vector is sector aligned.
- */
-bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
-{
-    int i;
-
-    for (i = 0; i < qiov->niov; i++) {
-        if ((uintptr_t) qiov->iov[i].iov_base % bs->buffer_alignment) {
-            return false;
-        }
-    }
-
-    return true;
-}
-
-void bdrv_set_dirty_tracking(BlockDriverState *bs, int granularity)
+void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable)
 {
    int64_t bitmap_size;

-    assert((granularity & (granularity - 1)) == 0);
+    bs->dirty_count = 0;
+    if (enable) {
+        if (!bs->dirty_bitmap) {
+            bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS) +
+                    BDRV_SECTORS_PER_DIRTY_CHUNK * BITS_PER_LONG - 1;
+            bitmap_size /= BDRV_SECTORS_PER_DIRTY_CHUNK * BITS_PER_LONG;

-    if (granularity) {
-        granularity >>= BDRV_SECTOR_BITS;
-        assert(!bs->dirty_bitmap);
-        bitmap_size = (bdrv_getlength(bs) >> BDRV_SECTOR_BITS);
-        bs->dirty_bitmap = hbitmap_alloc(bitmap_size, ffs(granularity) - 1);
+            bs->dirty_bitmap = g_new0(unsigned long, bitmap_size);
+        }
    } else {
        if (bs->dirty_bitmap) {
-            hbitmap_free(bs->dirty_bitmap);
+            g_free(bs->dirty_bitmap);
            bs->dirty_bitmap = NULL;
        }
    }
@@ -4324,37 +4273,67 @@ void bdrv_set_dirty_tracking(BlockDriverState *bs, int granularity)

 int bdrv_get_dirty(BlockDriverState *bs, int64_t sector)
 {
-    if (bs->dirty_bitmap) {
-        return hbitmap_get(bs->dirty_bitmap, sector);
+    int64_t chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;
+
+    if (bs->dirty_bitmap &&
+        (sector << BDRV_SECTOR_BITS) < bdrv_getlength(bs)) {
+        return !!(bs->dirty_bitmap[chunk / BITS_PER_LONG] &
+            (1UL << (chunk % BITS_PER_LONG)));
    } else {
        return 0;
    }
 }

-void bdrv_dirty_iter_init(BlockDriverState *bs, HBitmapIter *hbi)
+int64_t bdrv_get_next_dirty(BlockDriverState *bs, int64_t sector)
 {
-    hbitmap_iter_init(hbi, bs->dirty_bitmap, 0);
+    int64_t chunk;
+    int bit, elem;
+
+    /* Avoid an infinite loop.  */
+    assert(bs->dirty_count > 0);
+
+    sector = (sector | (BDRV_SECTORS_PER_DIRTY_CHUNK - 1)) + 1;
+    chunk = sector / (int64_t)BDRV_SECTORS_PER_DIRTY_CHUNK;
+
+    QEMU_BUILD_BUG_ON(sizeof(bs->dirty_bitmap[0]) * 8 != BITS_PER_LONG);
+    elem = chunk / BITS_PER_LONG;
+    bit = chunk % BITS_PER_LONG;
+    for (;;) {
+        if (sector >= bs->total_sectors) {
+            sector = 0;
+            bit = elem = 0;
+        }
+        if (bit == 0 && bs->dirty_bitmap[elem] == 0) {
+            sector += BDRV_SECTORS_PER_DIRTY_CHUNK * BITS_PER_LONG;
+            elem++;
+        } else {
+            if (bs->dirty_bitmap[elem] & (1UL << bit)) {
+                return sector;
+            }
+            sector += BDRV_SECTORS_PER_DIRTY_CHUNK;
+            if (++bit == BITS_PER_LONG) {
+                bit = 0;
+                elem++;
+            }
+        }
+    }
 }

 void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
                    int nr_sectors)
 {
-    hbitmap_set(bs->dirty_bitmap, cur_sector, nr_sectors);
+    set_dirty_bitmap(bs, cur_sector, nr_sectors, 1);
 }

 void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector,
                      int nr_sectors)
 {
-    hbitmap_reset(bs->dirty_bitmap, cur_sector, nr_sectors);
+    set_dirty_bitmap(bs, cur_sector, nr_sectors, 0);
 }

 int64_t bdrv_get_dirty_count(BlockDriverState *bs)
 {
-    if (bs->dirty_bitmap) {
-        return hbitmap_count(bs->dirty_bitmap);
-    } else {
-        return 0;
-    }
+    return bs->dirty_count;
 }

 void bdrv_set_in_use(BlockDriverState *bs, int in_use)
@@ -4429,9 +4408,9 @@ bdrv_acct_done(BlockDriverState *bs, BlockAcctCookie *cookie)
    bs->total_time_ns[cookie->type] += get_clock() - cookie->start_time_ns;
 }

-void bdrv_img_create(const char *filename, const char *fmt,
-                     const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags, Error **errp)
+int bdrv_img_create(const char *filename, const char *fmt,
+                    const char *base_filename, const char *base_fmt,
+                    char *options, uint64_t img_size, int flags)
 {
    QEMUOptionParameter *param = NULL, *create_options = NULL;
    QEMUOptionParameter *backing_fmt, *backing_file, *size;
@@ -4443,14 +4422,16 @@ void bdrv_img_create(const char *filename, const char *fmt,
    /* Find driver and parse its options */
    drv = bdrv_find_format(fmt);
    if (!drv) {
-        error_setg(errp, "Unknown file format '%s'", fmt);
-        return;
+        error_report("Unknown file format '%s'", fmt);
+        ret = -EINVAL;
+        goto out;
    }

    proto_drv = bdrv_find_protocol(filename);
    if (!proto_drv) {
-        error_setg(errp, "Unknown protocol '%s'", filename);
-        return;
+        error_report("Unknown protocol '%s'", filename);
+        ret = -EINVAL;
+        goto out;
    }

    create_options = append_option_parameters(create_options,
@@ -4467,7 +4448,8 @@ void bdrv_img_create(const char *filename, const char *fmt,
    if (options) {
        param = parse_option_parameters(options, create_options, param);
        if (param == NULL) {
-            error_setg(errp, "Invalid options for file format '%s'.", fmt);
+            error_report("Invalid options for file format '%s'.", fmt);
+            ret = -EINVAL;
            goto out;
        }
    }
@@ -4475,16 +4457,18 @@ void bdrv_img_create(const char *filename, const char *fmt,
    if (base_filename) {
        if (set_option_parameter(param, BLOCK_OPT_BACKING_FILE,
                                 base_filename)) {
-            error_setg(errp, "Backing file not supported for file format '%s'",
-                       fmt);
+            error_report("Backing file not supported for file format '%s'",
+                         fmt);
+            ret = -EINVAL;
            goto out;
        }
    }

    if (base_fmt) {
        if (set_option_parameter(param, BLOCK_OPT_BACKING_FMT, base_fmt)) {
-            error_setg(errp, "Backing file format not supported for file "
-                             "format '%s'", fmt);
+            error_report("Backing file format not supported for file "
+                         "format '%s'", fmt);
+            ret = -EINVAL;
            goto out;
        }
    }
@@ -4492,8 +4476,9 @@ void bdrv_img_create(const char *filename, const char *fmt,
    backing_file = get_option_parameter(param, BLOCK_OPT_BACKING_FILE);
    if (backing_file && backing_file->value.s) {
        if (!strcmp(filename, backing_file->value.s)) {
-            error_setg(errp, "Error: Trying to create an image with the "
-                             "same filename as the backing file");
+            error_report("Error: Trying to create an image with the "
+                         "same filename as the backing file");
+            ret = -EINVAL;
            goto out;
        }
    }
@@ -4502,8 +4487,9 @@ void bdrv_img_create(const char *filename, const char *fmt,
    if (backing_fmt && backing_fmt->value.s) {
        backing_drv = bdrv_find_format(backing_fmt->value.s);
        if (!backing_drv) {
-            error_setg(errp, "Unknown backing file format '%s'",
-                       backing_fmt->value.s);
+            error_report("Unknown backing file format '%s'",
+                         backing_fmt->value.s);
+            ret = -EINVAL;
            goto out;
        }
    }
@@ -4525,8 +4511,7 @@ void bdrv_img_create(const char *filename, const char *fmt,

            ret = bdrv_open(bs, backing_file->value.s, back_flags, backing_drv);
            if (ret < 0) {
-                error_setg_errno(errp, -ret, "Could not open '%s'",
-                                 backing_file->value.s);
+                error_report("Could not open '%s'", backing_file->value.s);
                goto out;
            }
            bdrv_get_geometry(bs, &size);
@@ -4535,7 +4520,8 @@ void bdrv_img_create(const char *filename, const char *fmt,
            snprintf(buf, sizeof(buf), "%" PRId64, size);
            set_option_parameter(param, BLOCK_OPT_SIZE, buf);
        } else {
-            error_setg(errp, "Image creation needs a size parameter");
+            error_report("Image creation needs a size parameter");
+            ret = -EINVAL;
            goto out;
        }
    }
@@ -4545,16 +4531,17 @@ void bdrv_img_create(const char *filename, const char *fmt,
    puts("");

    ret = bdrv_create(drv, filename, param);
+
    if (ret < 0) {
        if (ret == -ENOTSUP) {
-            error_setg(errp,"Formatting or formatting option not supported for "
-                            "file format '%s'", fmt);
+            error_report("Formatting or formatting option not supported for "
+                         "file format '%s'", fmt);
        } else if (ret == -EFBIG) {
-            error_setg(errp, "The image size is too large for file format '%s'",
-                       fmt);
+            error_report("The image size is too large for file format '%s'",
+                         fmt);
        } else {
-            error_setg(errp, "%s: error while creating %s: %s", filename, fmt,
-                       strerror(-ret));
+            error_report("%s: error while creating %s: %s", filename, fmt,
+                         strerror(-ret));
        }
    }

@@ -4565,4 +4552,6 @@ out:
    if (bs) {
        bdrv_delete(bs);
    }
+
+    return ret;
 }
@@ -1,11 +1,11 @@
 #ifndef BLOCK_H
 #define BLOCK_H

-#include "block/aio.h"
+#include "qemu-aio.h"
 #include "qemu-common.h"
-#include "qemu/option.h"
-#include "block/coroutine.h"
-#include "qapi/qmp/qobject.h"
+#include "qemu-option.h"
+#include "qemu-coroutine.h"
+#include "qobject.h"
 #include "qapi-types.h"

 /* block.c */
@@ -309,10 +309,6 @@ int bdrv_get_flags(BlockDriverState *bs);
 int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
                          const uint8_t *buf, int nb_sectors);
 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi);
-void bdrv_round_to_clusters(BlockDriverState *bs,
-                            int64_t sector_num, int nb_sectors,
-                            int64_t *cluster_sector_num,
-                            int *cluster_nb_sectors);

 const char *bdrv_get_encrypted_filename(BlockDriverState *bs);
 void bdrv_get_backing_filename(BlockDriverState *bs,
@@ -347,20 +343,20 @@ int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                      int64_t pos, int size);

-void bdrv_img_create(const char *filename, const char *fmt,
-                     const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags, Error **errp);
+int bdrv_img_create(const char *filename, const char *fmt,
+                    const char *base_filename, const char *base_fmt,
+                    char *options, uint64_t img_size, int flags);

 void bdrv_set_buffer_alignment(BlockDriverState *bs, int align);
 void *qemu_blockalign(BlockDriverState *bs, size_t size);
-bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov);

-struct HBitmapIter;
-void bdrv_set_dirty_tracking(BlockDriverState *bs, int granularity);
+#define BDRV_SECTORS_PER_DIRTY_CHUNK 2048
+
+void bdrv_set_dirty_tracking(BlockDriverState *bs, int enable);
 int bdrv_get_dirty(BlockDriverState *bs, int64_t sector);
 void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
 void bdrv_reset_dirty(BlockDriverState *bs, int64_t cur_sector, int nr_sectors);
-void bdrv_dirty_iter_init(BlockDriverState *bs, struct HBitmapIter *hbi);
+int64_t bdrv_get_next_dirty(BlockDriverState *bs, int64_t sector);
 int64_t bdrv_get_dirty_count(BlockDriverState *bs);

 void bdrv_enable_copy_on_read(BlockDriverState *bs);
@@ -369,15 +365,6 @@ void bdrv_disable_copy_on_read(BlockDriverState *bs);
 void bdrv_set_in_use(BlockDriverState *bs, int in_use);
 int bdrv_in_use(BlockDriverState *bs);

-#ifdef CONFIG_LINUX_AIO
-int raw_get_aio_fd(BlockDriverState *bs);
-#else
-static inline int raw_get_aio_fd(BlockDriverState *bs)
-{
-    return -ENOTSUP;
-}
-#endif
-
 enum BlockAcctType {
    BDRV_ACCT_READ,
    BDRV_ACCT_WRITE,
@@ -444,9 +431,4 @@ typedef enum {
 #define BLKDBG_EVENT(bs, evt) bdrv_debug_event(bs, evt)
 void bdrv_debug_event(BlockDriverState *bs, BlkDebugEvent event);

-int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
-                           const char *tag);
-int bdrv_debug_resume(BlockDriverState *bs, const char *tag);
-bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag);
-
 #endif
@@ -18,5 +18,3 @@ endif
 common-obj-y += stream.o
 common-obj-y += commit.o
 common-obj-y += mirror.o
-
-$(obj)/curl.o: QEMU_CFLAGS+=$(CURL_CFLAGS)
@@ -23,17 +23,14 @@
 */

 #include "qemu-common.h"
-#include "qemu/config-file.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 typedef struct BDRVBlkdebugState {
    int state;
    int new_state;
-
    QLIST_HEAD(, BlkdebugRule) rules[BLKDBG_EVENT_MAX];
    QSIMPLEQ_HEAD(, BlkdebugRule) active_rules;
-    QLIST_HEAD(, BlkdebugSuspendedReq) suspended_reqs;
 } BDRVBlkdebugState;

 typedef struct BlkdebugAIOCB {
@@ -42,12 +39,6 @@ typedef struct BlkdebugAIOCB {
    int ret;
 } BlkdebugAIOCB;

-typedef struct BlkdebugSuspendedReq {
-    Coroutine *co;
-    char *tag;
-    QLIST_ENTRY(BlkdebugSuspendedReq) next;
-} BlkdebugSuspendedReq;
-
 static void blkdebug_aio_cancel(BlockDriverAIOCB *blockacb);

 static const AIOCBInfo blkdebug_aiocb_info = {
@@ -58,7 +49,6 @@ static const AIOCBInfo blkdebug_aiocb_info = {
 enum {
    ACTION_INJECT_ERROR,
    ACTION_SET_STATE,
-    ACTION_SUSPEND,
 };

 typedef struct BlkdebugRule {
@@ -75,9 +65,6 @@ typedef struct BlkdebugRule {
        struct {
            int new_state;
        } set_state;
-        struct {
-            char *tag;
-        } suspend;
    } options;
    QLIST_ENTRY(BlkdebugRule) next;
    QSIMPLEQ_ENTRY(BlkdebugRule) active_next;
@@ -239,11 +226,6 @@ static int add_rule(QemuOpts *opts, void *opaque)
        rule->options.set_state.new_state =
            qemu_opt_get_number(opts, "new_state", 0);
        break;
-
-    case ACTION_SUSPEND:
-        rule->options.suspend.tag =
-            g_strdup(qemu_opt_get(opts, "tag"));
-        break;
    };

    /* Add the rule */
@@ -252,32 +234,12 @@ static int add_rule(QemuOpts *opts, void *opaque)
    return 0;
 }

-static void remove_rule(BlkdebugRule *rule)
-{
-    switch (rule->action) {
-    case ACTION_INJECT_ERROR:
-    case ACTION_SET_STATE:
-        break;
-    case ACTION_SUSPEND:
-        g_free(rule->options.suspend.tag);
-        break;
-    }
-
-    QLIST_REMOVE(rule, next);
-    g_free(rule);
-}
-
 static int read_config(BDRVBlkdebugState *s, const char *filename)
 {
    FILE *f;
    int ret;
    struct add_rule_data d;

-    /* Allow usage without config file */
-    if (!*filename) {
-        return 0;
-    }
-
    f = fopen(filename, "r");
    if (f == NULL) {
        return -errno;
@@ -427,7 +389,6 @@ static BlockDriverAIOCB *blkdebug_aio_writev(BlockDriverState *bs,
    return bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors, cb, opaque);
 }

-
 static void blkdebug_close(BlockDriverState *bs)
 {
    BDRVBlkdebugState *s = bs->opaque;
@@ -436,32 +397,12 @@ static void blkdebug_close(BlockDriverState *bs)

    for (i = 0; i < BLKDBG_EVENT_MAX; i++) {
        QLIST_FOREACH_SAFE(rule, &s->rules[i], next, next) {
-            remove_rule(rule);
+            QLIST_REMOVE(rule, next);
+            g_free(rule);
        }
    }
 }

-static void suspend_request(BlockDriverState *bs, BlkdebugRule *rule)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq r;
-
-    r = (BlkdebugSuspendedReq) {
-        .co         = qemu_coroutine_self(),
-        .tag        = g_strdup(rule->options.suspend.tag),
-    };
-
-    remove_rule(rule);
-    QLIST_INSERT_HEAD(&s->suspended_reqs, &r, next);
-
-    printf("blkdebug: Suspended request '%s'\n", r.tag);
-    qemu_coroutine_yield();
-    printf("blkdebug: Resuming request '%s'\n", r.tag);
-
-    QLIST_REMOVE(&r, next);
-    g_free(r.tag);
-}
-
 static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
    bool injected)
 {
@@ -485,10 +426,6 @@ static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
    case ACTION_SET_STATE:
        s->new_state = rule->options.set_state.new_state;
        break;
-
-    case ACTION_SUSPEND:
-        suspend_request(bs, rule);
-        break;
    }
    return injected;
 }
@@ -496,72 +433,19 @@ static bool process_rule(BlockDriverState *bs, struct BlkdebugRule *rule,
 static void blkdebug_debug_event(BlockDriverState *bs, BlkDebugEvent event)
 {
    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule, *next;
+    struct BlkdebugRule *rule;
    bool injected;

    assert((int)event >= 0 && event < BLKDBG_EVENT_MAX);

    injected = false;
    s->new_state = s->state;
-    QLIST_FOREACH_SAFE(rule, &s->rules[event], next, next) {
+    QLIST_FOREACH(rule, &s->rules[event], next) {
        injected = process_rule(bs, rule, injected);
    }
    s->state = s->new_state;
 }

-static int blkdebug_debug_breakpoint(BlockDriverState *bs, const char *event,
-                                     const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    struct BlkdebugRule *rule;
-    BlkDebugEvent blkdebug_event;
-
-    if (get_event_by_name(event, &blkdebug_event) < 0) {
-        return -ENOENT;
-    }
-
-
-    rule = g_malloc(sizeof(*rule));
-    *rule = (struct BlkdebugRule) {
-        .event  = blkdebug_event,
-        .action = ACTION_SUSPEND,
-        .state  = 0,
-        .options.suspend.tag = g_strdup(tag),
-    };
-
-    QLIST_INSERT_HEAD(&s->rules[blkdebug_event], rule, next);
-
-    return 0;
-}
-
-static int blkdebug_debug_resume(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            qemu_coroutine_enter(r->co, NULL);
-            return 0;
-        }
-    }
-    return -ENOENT;
-}
-
-
-static bool blkdebug_debug_is_suspended(BlockDriverState *bs, const char *tag)
-{
-    BDRVBlkdebugState *s = bs->opaque;
-    BlkdebugSuspendedReq *r;
-
-    QLIST_FOREACH(r, &s->suspended_reqs, next) {
-        if (!strcmp(r->tag, tag)) {
-            return true;
-        }
-    }
-    return false;
-}
-
 static int64_t blkdebug_getlength(BlockDriverState *bs)
 {
    return bdrv_getlength(bs->file);
@@ -580,10 +464,7 @@ static BlockDriver bdrv_blkdebug = {
    .bdrv_aio_readv     = blkdebug_aio_readv,
    .bdrv_aio_writev    = blkdebug_aio_writev,

-    .bdrv_debug_event           = blkdebug_debug_event,
-    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
-    .bdrv_debug_resume          = blkdebug_debug_resume,
-    .bdrv_debug_is_suspended    = blkdebug_debug_is_suspended,
+    .bdrv_debug_event   = blkdebug_debug_event,
 };

 static void bdrv_blkdebug_init(void)
@@ -8,8 +8,8 @@
 */

 #include <stdarg.h>
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
-#include "block/block_int.h"
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
+#include "block_int.h"

 typedef struct {
    BlockDriverState *test_file;
@@ -23,8 +23,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -114,13 +114,11 @@ static int bochs_open(BlockDriverState *bs, int flags)
    int i;
    struct bochs_header bochs;
    struct bochs_header_v1 header_v1;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 0, &bochs, sizeof(bochs)) != sizeof(bochs)) {
+        goto fail;
    }

    if (strcmp(bochs.magic, HEADER_MAGIC) ||
@@ -128,7 +126,7 @@ static int bochs_open(BlockDriverState *bs, int flags)
        strcmp(bochs.subtype, GROWING_TYPE) ||
 	((le32_to_cpu(bochs.version) != HEADER_VERSION) &&
 	(le32_to_cpu(bochs.version) != HEADER_V1))) {
-        return -EMEDIUMTYPE;
+        goto fail;
    }

    if (le32_to_cpu(bochs.version) == HEADER_V1) {
@@ -140,13 +138,9 @@ static int bochs_open(BlockDriverState *bs, int flags)

    s->catalog_size = le32_to_cpu(bochs.extra.redolog.catalog);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
-                     s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, le32_to_cpu(bochs.header), s->catalog_bitmap,
+                   s->catalog_size * 4) != s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

@@ -159,10 +153,8 @@ static int bochs_open(BlockDriverState *bs, int flags)

    qemu_co_mutex_init(&s->lock);
    return 0;
-
-fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+ fail:
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVCloopState {
@@ -57,32 +57,27 @@ static int cloop_open(BlockDriverState *bs, int flags)
 {
    BDRVCloopState *s = bs->opaque;
    uint32_t offsets_size, max_compressed_block_size = 1, i;
-    int ret;

    bs->read_only = 1;

    /* read header */
-    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128, &s->block_size, 4) < 4) {
+        goto cloop_close;
    }
    s->block_size = be32_to_cpu(s->block_size);

-    ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4);
-    if (ret < 0) {
-        return ret;
+    if (bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4) < 4) {
+        goto cloop_close;
    }
    s->n_blocks = be32_to_cpu(s->n_blocks);

    /* read offsets */
    offsets_size = s->n_blocks * sizeof(uint64_t);
    s->offsets = g_malloc(offsets_size);
-
-    ret = bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size);
-    if (ret < 0) {
-        goto fail;
+    if (bdrv_pread(bs->file, 128 + 4 + 4, s->offsets, offsets_size) <
+            offsets_size) {
+        goto cloop_close;
    }
-
    for(i=0;i<s->n_blocks;i++) {
        s->offsets[i] = be64_to_cpu(s->offsets[i]);
        if (i > 0) {
@@ -97,8 +92,7 @@ static int cloop_open(BlockDriverState *bs, int flags)
    s->compressed_block = g_malloc(max_compressed_block_size + 1);
    s->uncompressed_block = g_malloc(s->block_size);
    if (inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
+        goto cloop_close;
    }
    s->current_block = s->n_blocks;

@@ -107,11 +101,8 @@ static int cloop_open(BlockDriverState *bs, int flags)
    qemu_co_mutex_init(&s->lock);
    return 0;

-fail:
-    g_free(s->offsets);
-    g_free(s->compressed_block);
-    g_free(s->uncompressed_block);
-    return ret;
+cloop_close:
+    return -1;
 }

 static inline int cloop_read_block(BlockDriverState *bs, int block_num)
@@ -13,8 +13,8 @@
 */

 #include "trace.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
+#include "block_int.h"
+#include "blockjob.h"
 #include "qemu/ratelimit.h"

 enum {
@@ -65,7 +65,7 @@ static void coroutine_fn commit_run(void *opaque)
    BlockDriverState *active = s->active;
    BlockDriverState *top = s->top;
    BlockDriverState *base = s->base;
-    BlockDriverState *overlay_bs;
+    BlockDriverState *overlay_bs = NULL;
    int64_t sector_num, end;
    int ret = 0;
    int n = 0;
@@ -92,6 +92,8 @@ static void coroutine_fn commit_run(void *opaque)
        }
    }

+    overlay_bs = bdrv_find_overlay(active, top);
+
    end = s->common.len >> BDRV_SECTOR_BITS;
    buf = qemu_blockalign(top, COMMIT_BUFFER_SIZE);

@@ -101,7 +103,7 @@ static void coroutine_fn commit_run(void *opaque)

 wait:
        /* Note that even when no rate limit is applied we need to yield
-         * with no pending I/O here so that bdrv_drain_all() returns.
+         * with no pending I/O here so that qemu_aio_flush() returns.
         */
        block_job_sleep_ns(&s->common, rt_clock, delay_ns);
        if (block_job_is_cancelled(&s->common)) {
@@ -154,8 +156,7 @@ exit_restore_reopen:
    if (s->base_flags != bdrv_get_flags(base)) {
        bdrv_reopen(base, s->base_flags, NULL);
    }
-    overlay_bs = bdrv_find_overlay(active, top);
-    if (overlay_bs && s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
+    if (s->orig_overlay_flags != bdrv_get_flags(overlay_bs)) {
        bdrv_reopen(overlay_bs, s->orig_overlay_flags, NULL);
    }

@@ -22,8 +22,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/
 /* COW block driver using file system holes */
@@ -73,7 +73,7 @@ static int cow_open(BlockDriverState *bs, int flags)
    }

    if (be32_to_cpu(cow_header.magic) != COW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }

@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include <curl/curl.h>

 // #define DEBUG
@@ -34,10 +34,6 @@
 #define DPRINTF(fmt, ...) do { } while (0)
 #endif

-#define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
-                   CURLPROTO_FTP | CURLPROTO_FTPS | \
-                   CURLPROTO_TFTP)
-
 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
 #define SECTOR_SIZE     512
@@ -306,17 +302,6 @@ static CURLState *curl_init_state(BDRVCURLState *s)
    curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
    curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);

-    /* Restrict supported protocols to avoid security issues in the more
-     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
-     * CVE-2013-0249.
-     *
-     * Restricting protocols is only supported from 7.19.4 upwards.
-     */
-#if LIBCURL_VERSION_NUM >= 0x071304
-    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
-    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
-#endif
-
 #ifdef DEBUG_VERBOSE
    curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif
@@ -22,9 +22,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/bswap.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "bswap.h"
+#include "module.h"
 #include <zlib.h>

 typedef struct BDRVDMGState {
@@ -57,42 +57,29 @@ static int dmg_probe(const uint8_t *buf, int buf_size, const char *filename)
    return 0;
 }

-static int read_uint64(BlockDriverState *bs, int64_t offset, uint64_t *result)
+static off_t read_off(BlockDriverState *bs, int64_t offset)
 {
-    uint64_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 8);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be64_to_cpu(buffer);
-    return 0;
+	uint64_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 8) < 8)
+		return 0;
+	return be64_to_cpu(buffer);
 }

-static int read_uint32(BlockDriverState *bs, int64_t offset, uint32_t *result)
+static off_t read_uint32(BlockDriverState *bs, int64_t offset)
 {
-    uint32_t buffer;
-    int ret;
-
-    ret = bdrv_pread(bs->file, offset, &buffer, 4);
-    if (ret < 0) {
-        return ret;
-    }
-
-    *result = be32_to_cpu(buffer);
-    return 0;
+	uint32_t buffer;
+	if (bdrv_pread(bs->file, offset, &buffer, 4) < 4)
+		return 0;
+	return be32_to_cpu(buffer);
 }

 static int dmg_open(BlockDriverState *bs, int flags)
 {
    BDRVDMGState *s = bs->opaque;
-    uint64_t info_begin,info_end,last_in_offset,last_out_offset;
-    uint32_t count, tmp;
+    off_t info_begin,info_end,last_in_offset,last_out_offset;
+    uint32_t count;
    uint32_t max_compressed_size=1,max_sectors_per_chunk=1,i;
    int64_t offset;
-    int ret;

    bs->read_only = 1;
    s->n_chunks = 0;
@@ -101,32 +88,21 @@ static int dmg_open(BlockDriverState *bs, int flags)
    /* read offset of info blocks */
    offset = bdrv_getlength(bs->file);
    if (offset < 0) {
-        ret = offset;
        goto fail;
    }
    offset -= 0x1d8;

-    ret = read_uint64(bs, offset, &info_begin);
-    if (ret < 0) {
-        goto fail;
-    } else if (info_begin == 0) {
-        ret = -EINVAL;
+    info_begin = read_off(bs, offset);
+    if (info_begin == 0) {
+	goto fail;
+    }
+
+    if (read_uint32(bs, info_begin) != 0x100) {
        goto fail;
    }

-    ret = read_uint32(bs, info_begin, &tmp);
-    if (ret < 0) {
-        goto fail;
-    } else if (tmp != 0x100) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
-    ret = read_uint32(bs, info_begin + 4, &count);
-    if (ret < 0) {
-        goto fail;
-    } else if (count == 0) {
-        ret = -EINVAL;
+    count = read_uint32(bs, info_begin + 4);
+    if (count == 0) {
        goto fail;
    }
    info_end = info_begin + count;
@@ -138,20 +114,12 @@ static int dmg_open(BlockDriverState *bs, int flags)
    while (offset < info_end) {
        uint32_t type;

-        ret = read_uint32(bs, offset, &count);
-        if (ret < 0) {
-            goto fail;
-        } else if (count == 0) {
-            ret = -EINVAL;
-            goto fail;
-        }
+	count = read_uint32(bs, offset);
+	if(count==0)
+	    goto fail;
        offset += 4;

-        ret = read_uint32(bs, offset, &type);
-        if (ret < 0) {
-            goto fail;
-        }
-
+	type = read_uint32(bs, offset);
 	if (type == 0x6d697368 && count >= 244) {
 	    int new_size, chunk_count;

@@ -166,11 +134,8 @@ static int dmg_open(BlockDriverState *bs, int flags)
 	    s->sectors = g_realloc(s->sectors, new_size);
 	    s->sectorcounts = g_realloc(s->sectorcounts, new_size);

-            for (i = s->n_chunks; i < s->n_chunks + chunk_count; i++) {
-                ret = read_uint32(bs, offset, &s->types[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
+	    for(i=s->n_chunks;i<s->n_chunks+chunk_count;i++) {
+		s->types[i] = read_uint32(bs, offset);
 		offset += 4;
 		if(s->types[i]!=0x80000005 && s->types[i]!=1 && s->types[i]!=2) {
 		    if(s->types[i]==0xffffffff) {
@@ -184,31 +149,17 @@ static int dmg_open(BlockDriverState *bs, int flags)
 		}
 		offset += 4;

-                ret = read_uint64(bs, offset, &s->sectors[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->sectors[i] += last_out_offset;
-                offset += 8;
+		s->sectors[i] = last_out_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->sectorcounts[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->sectorcounts[i] = read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->offsets[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                s->offsets[i] += last_in_offset;
-                offset += 8;
+		s->offsets[i] = last_in_offset+read_off(bs, offset);
+		offset += 8;

-                ret = read_uint64(bs, offset, &s->lengths[i]);
-                if (ret < 0) {
-                    goto fail;
-                }
-                offset += 8;
+		s->lengths[i] = read_off(bs, offset);
+		offset += 8;

 		if(s->lengths[i]>max_compressed_size)
 		    max_compressed_size = s->lengths[i];
@@ -222,25 +173,15 @@ static int dmg_open(BlockDriverState *bs, int flags)
    /* initialize zlib engine */
    s->compressed_chunk = g_malloc(max_compressed_size+1);
    s->uncompressed_chunk = g_malloc(512*max_sectors_per_chunk);
-    if(inflateInit(&s->zstream) != Z_OK) {
-        ret = -EINVAL;
-        goto fail;
-    }
+    if(inflateInit(&s->zstream) != Z_OK)
+	goto fail;

    s->current_chunk = s->n_chunks;

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-    return ret;
+    return -1;
 }

 static inline int is_sector_in_chunk(BDRVDMGState* s,
@@ -355,15 +296,15 @@ static coroutine_fn int dmg_co_read(BlockDriverState *bs, int64_t sector_num,
 static void dmg_close(BlockDriverState *bs)
 {
    BDRVDMGState *s = bs->opaque;
-
-    g_free(s->types);
-    g_free(s->offsets);
-    g_free(s->lengths);
-    g_free(s->sectors);
-    g_free(s->sectorcounts);
-    g_free(s->compressed_chunk);
-    g_free(s->uncompressed_chunk);
-
+    if(s->n_chunks>0) {
+	free(s->types);
+	free(s->offsets);
+	free(s->lengths);
+	free(s->sectors);
+	free(s->sectorcounts);
+    }
+    free(s->compressed_chunk);
+    free(s->uncompressed_chunk);
    inflateEnd(&s->zstream);
 }

@@ -16,9 +16,9 @@
 * GNU GPL, version 2 or (at your option) any later version.
 */
 #include <glusterfs/api/glfs.h>
-#include "block/block_int.h"
-#include "qemu/sockets.h"
-#include "qemu/uri.h"
+#include "block_int.h"
+#include "qemu_socket.h"
+#include "uri.h"

 typedef struct GlusterAIOCB {
    BlockDriverAIOCB common;
@@ -217,7 +217,7 @@ static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename)
    ret = glfs_init(glfs);
    if (ret) {
        error_report("Gluster connection failed for server=%s port=%d "
-             "volume=%s image=%s transport=%s", gconf->server, gconf->port,
+             "volume=%s image=%s transport=%s\n", gconf->server, gconf->port,
             gconf->volname, gconf->image, gconf->transport);
        goto out;
    }
@@ -27,9 +27,8 @@
 #include <poll.h>
 #include <arpa/inet.h>
 #include "qemu-common.h"
-#include "qemu/config-file.h"
-#include "qemu/error-report.h"
-#include "block/block_int.h"
+#include "qemu-error.h"
+#include "block_int.h"
 #include "trace.h"
 #include "hw/scsi-defs.h"

@@ -48,7 +47,6 @@ typedef struct IscsiLun {
    int block_size;
    uint64_t num_blocks;
    int events;
-    QEMUTimer *nop_timer;
 } IscsiLun;

 typedef struct IscsiAIOCB {
@@ -67,9 +65,6 @@ typedef struct IscsiAIOCB {
 #endif
 } IscsiAIOCB;

-#define NOP_INTERVAL 5000
-#define MAX_NOP_FAILURES 3
-
 static void
 iscsi_bh_cb(void *p)
 {
@@ -77,9 +72,6 @@ iscsi_bh_cb(void *p)

    qemu_bh_delete(acb->bh);

-    g_free(acb->buf);
-    acb->buf = NULL;
-
    if (acb->canceled == 0) {
        acb->common.cb(acb->common.opaque, acb->status);
    }
@@ -201,7 +193,6 @@ iscsi_aio_write16_cb(struct iscsi_context *iscsi, int status,
    trace_iscsi_aio_write16_cb(iscsi, status, acb, acb->canceled);

    g_free(acb->buf);
-    acb->buf = NULL;

    if (acb->canceled != 0) {
        return;
@@ -234,10 +225,7 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
    size_t size;
    uint32_t num_sectors;
    uint64_t lba;
-#if !defined(LIBISCSI_FEATURE_IOVECTOR)
    struct iscsi_data data;
-#endif
-    int ret;

    acb = qemu_aio_get(&iscsi_aiocb_info, bs, cb, opaque);
    trace_iscsi_aio_writev(iscsi, sector_num, nb_sectors, opaque, acb);
@@ -248,23 +236,12 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
    acb->canceled   = 0;
    acb->bh         = NULL;
    acb->status     = -EINPROGRESS;
-    acb->buf        = NULL;

+    /* XXX we should pass the iovec to write16 to avoid the extra copy */
    /* this will allow us to get rid of 'buf' completely */
    size = nb_sectors * BDRV_SECTOR_SIZE;
-
-#if !defined(LIBISCSI_FEATURE_IOVECTOR)
-    data.size = MIN(size, acb->qiov->size);
-
-    /* if the iovec only contains one buffer we can pass it directly */
-    if (acb->qiov->niov == 1) {
-        data.data = acb->qiov->iov[0].iov_base;
-    } else {
-        acb->buf = g_malloc(data.size);
-        qemu_iovec_to_buf(acb->qiov, 0, acb->buf, data.size);
-        data.data = acb->buf;
-    }
-#endif
+    acb->buf = g_malloc(size);
+    qemu_iovec_to_buf(acb->qiov, 0, acb->buf, size);

    acb->task = malloc(sizeof(struct scsi_task));
    if (acb->task == NULL) {
@@ -285,28 +262,19 @@ iscsi_aio_writev(BlockDriverState *bs, int64_t sector_num,
    *(uint32_t *)&acb->task->cdb[10] = htonl(num_sectors);
    acb->task->expxferlen = size;

-#if defined(LIBISCSI_FEATURE_IOVECTOR)
-    ret = iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
-                                   iscsi_aio_write16_cb,
-                                   NULL,
-                                   acb);
-#else
-    ret = iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
-                                   iscsi_aio_write16_cb,
-                                   &data,
-                                   acb);
-#endif
-    if (ret != 0) {
+    data.data = acb->buf;
+    data.size = size;
+
+    if (iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
+                                 iscsi_aio_write16_cb,
+                                 &data,
+                                 acb) != 0) {
        scsi_free_scsi_task(acb->task);
        g_free(acb->buf);
        qemu_aio_release(acb);
        return NULL;
    }

-#if defined(LIBISCSI_FEATURE_IOVECTOR)
-    scsi_task_set_iov_out(acb->task, (struct scsi_iovec*) acb->qiov->iov, acb->qiov->niov);
-#endif
-
    iscsi_set_events(iscsilun);

    return &acb->common;
@@ -344,10 +312,7 @@ iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
    struct iscsi_context *iscsi = iscsilun->iscsi;
    IscsiAIOCB *acb;
    size_t qemu_read_size;
-#if !defined(LIBISCSI_FEATURE_IOVECTOR)
    int i;
-#endif
-    int ret;
    uint64_t lba;
    uint32_t num_sectors;

@@ -409,25 +374,20 @@ iscsi_aio_readv(BlockDriverState *bs, int64_t sector_num,
        break;
    }

-    ret = iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
-                                   iscsi_aio_read16_cb,
-                                   NULL,
-                                   acb);
-    if (ret != 0) {
+    if (iscsi_scsi_command_async(iscsi, iscsilun->lun, acb->task,
+                                 iscsi_aio_read16_cb,
+                                 NULL,
+                                 acb) != 0) {
        scsi_free_scsi_task(acb->task);
        qemu_aio_release(acb);
        return NULL;
    }

-#if defined(LIBISCSI_FEATURE_IOVECTOR)
-    scsi_task_set_iov_in(acb->task, (struct scsi_iovec*) acb->qiov->iov, acb->qiov->niov);
-#else
    for (i = 0; i < acb->qiov->niov; i++) {
        scsi_task_add_data_in_buffer(acb->task,
                acb->qiov->iov[i].iov_len,
                acb->qiov->iov[i].iov_base);
    }
-#endif

    iscsi_set_events(iscsilun);

@@ -469,7 +429,6 @@ iscsi_aio_flush(BlockDriverState *bs,
    acb->canceled   = 0;
    acb->bh         = NULL;
    acb->status     = -EINPROGRESS;
-    acb->buf        = NULL;

    acb->task = iscsi_synchronizecache10_task(iscsi, iscsilun->lun,
                                         0, 0, 0, 0,
@@ -523,7 +482,6 @@ iscsi_aio_discard(BlockDriverState *bs,
    acb->canceled   = 0;
    acb->bh         = NULL;
    acb->status     = -EINPROGRESS;
-    acb->buf        = NULL;

    list[0].lba = sector_qemu2lun(sector_num, iscsilun);
    list[0].num = nb_sectors * BDRV_SECTOR_SIZE / iscsilun->block_size;
@@ -803,26 +761,6 @@ static char *parse_initiator_name(const char *target)
    }
 }

-#if defined(LIBISCSI_FEATURE_NOP_COUNTER)
-static void iscsi_nop_timed_event(void *opaque)
-{
-    IscsiLun *iscsilun = opaque;
-
-    if (iscsi_get_nops_in_flight(iscsilun->iscsi) > MAX_NOP_FAILURES) {
-        error_report("iSCSI: NOP timeout. Reconnecting...");
-        iscsi_reconnect(iscsilun->iscsi);
-    }
-
-    if (iscsi_nop_out_async(iscsilun->iscsi, NULL, NULL, 0, NULL) != 0) {
-        error_report("iSCSI: failed to sent NOP-Out. Disabling NOP messages.");
-        return;
-    }
-
-    qemu_mod_timer(iscsilun->nop_timer, qemu_get_clock_ms(rt_clock) + NOP_INTERVAL);
-    iscsi_set_events(iscsilun);
-}
-#endif
-
 /*
 * We support iscsi url's on the form
 * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
@@ -983,12 +921,6 @@ static int iscsi_open(BlockDriverState *bs, const char *filename, int flags)

    ret = 0;

-#if defined(LIBISCSI_FEATURE_NOP_COUNTER)
-    /* Set up a timer for sending out iSCSI NOPs */
-    iscsilun->nop_timer = qemu_new_timer_ms(rt_clock, iscsi_nop_timed_event, iscsilun);
-    qemu_mod_timer(iscsilun->nop_timer, qemu_get_clock_ms(rt_clock) + NOP_INTERVAL);
-#endif
-
 out:
    if (initiator_name != NULL) {
        g_free(initiator_name);
@@ -1014,10 +946,6 @@ static void iscsi_close(BlockDriverState *bs)
    IscsiLun *iscsilun = bs->opaque;
    struct iscsi_context *iscsi = iscsilun->iscsi;

-    if (iscsilun->nop_timer) {
-        qemu_del_timer(iscsilun->nop_timer);
-        qemu_free_timer(iscsilun->nop_timer);
-    }
    qemu_aio_set_fd_handler(iscsi_get_fd(iscsi), NULL, NULL, NULL, NULL);
    iscsi_destroy_context(iscsi);
    memset(iscsilun, 0, sizeof(IscsiLun));
@@ -1028,60 +956,6 @@ static int iscsi_has_zero_init(BlockDriverState *bs)
    return 0;
 }

-static int iscsi_create(const char *filename, QEMUOptionParameter *options)
-{
-    int ret = 0;
-    int64_t total_size = 0;
-    BlockDriverState bs;
-    IscsiLun *iscsilun = NULL;
-
-    memset(&bs, 0, sizeof(BlockDriverState));
-
-    /* Read out options */
-    while (options && options->name) {
-        if (!strcmp(options->name, "size")) {
-            total_size = options->value.n / BDRV_SECTOR_SIZE;
-        }
-        options++;
-    }
-
-    bs.opaque = g_malloc0(sizeof(struct IscsiLun));
-    iscsilun = bs.opaque;
-
-    ret = iscsi_open(&bs, filename, 0);
-    if (ret != 0) {
-        goto out;
-    }
-    if (iscsilun->nop_timer) {
-        qemu_del_timer(iscsilun->nop_timer);
-        qemu_free_timer(iscsilun->nop_timer);
-    }
-    if (iscsilun->type != TYPE_DISK) {
-        ret = -ENODEV;
-        goto out;
-    }
-    if (bs.total_sectors < total_size) {
-        ret = -ENOSPC;
-    }
-
-    ret = 0;
-out:
-    if (iscsilun->iscsi != NULL) {
-        iscsi_destroy_context(iscsilun->iscsi);
-    }
-    g_free(bs.opaque);
-    return ret;
-}
-
-static QEMUOptionParameter iscsi_create_options[] = {
-    {
-        .name = BLOCK_OPT_SIZE,
-        .type = OPT_SIZE,
-        .help = "Virtual disk size"
-    },
-    { NULL }
-};
-
 static BlockDriver bdrv_iscsi = {
    .format_name     = "iscsi",
    .protocol_name   = "iscsi",
@@ -1089,8 +963,6 @@ static BlockDriver bdrv_iscsi = {
    .instance_size   = sizeof(IscsiLun),
    .bdrv_file_open  = iscsi_open,
    .bdrv_close      = iscsi_close,
-    .bdrv_create     = iscsi_create,
-    .create_options  = iscsi_create_options,

    .bdrv_getlength  = iscsi_getlength,

@@ -1107,36 +979,9 @@ static BlockDriver bdrv_iscsi = {
 #endif
 };

-static QemuOptsList qemu_iscsi_opts = {
-    .name = "iscsi",
-    .head = QTAILQ_HEAD_INITIALIZER(qemu_iscsi_opts.head),
-    .desc = {
-        {
-            .name = "user",
-            .type = QEMU_OPT_STRING,
-            .help = "username for CHAP authentication to target",
-        },{
-            .name = "password",
-            .type = QEMU_OPT_STRING,
-            .help = "password for CHAP authentication to target",
-        },{
-            .name = "header-digest",
-            .type = QEMU_OPT_STRING,
-            .help = "HeaderDigest setting. "
-                    "{CRC32C|CRC32C-NONE|NONE-CRC32C|NONE}",
-        },{
-            .name = "initiator-name",
-            .type = QEMU_OPT_STRING,
-            .help = "Initiator iqn name to use when connecting",
-        },
-        { /* end of list */ }
-    },
-};
-
 static void iscsi_block_init(void)
 {
    bdrv_register(&bdrv_iscsi);
-    qemu_add_opts(&qemu_iscsi_opts);
 }

 block_init(iscsi_block_init);
@@ -8,10 +8,10 @@
 * See the COPYING file in the top-level directory.
 */
 #include "qemu-common.h"
-#include "block/aio.h"
-#include "qemu/queue.h"
+#include "qemu-aio.h"
+#include "qemu-queue.h"
 #include "block/raw-aio.h"
-#include "qemu/event_notifier.h"
+#include "event_notifier.h"

 #include <libaio.h>

@@ -12,20 +12,20 @@
 */

 #include "trace.h"
-#include "block/blockjob.h"
-#include "block/block_int.h"
+#include "blockjob.h"
+#include "block_int.h"
 #include "qemu/ratelimit.h"
-#include "qemu/bitmap.h"

-#define SLICE_TIME    100000000ULL /* ns */
-#define MAX_IN_FLIGHT 16
+enum {
+    /*
+     * Size of data buffer for populating the image file.  This should be large
+     * enough to process multiple clusters in a single call, so that populating
+     * contiguous regions of the image is efficient.
+     */
+    BLOCK_SIZE = 512 * BDRV_SECTORS_PER_DIRTY_CHUNK, /* in bytes */
+};

-/* The mirroring buffer is a list of granularity-sized chunks.
- * Free chunks are organized in a list.
- */
-typedef struct MirrorBuffer {
-    QSIMPLEQ_ENTRY(MirrorBuffer) next;
-} MirrorBuffer;
+#define SLICE_TIME 100000000ULL /* ns */

 typedef struct MirrorBlockJob {
    BlockJob common;
@@ -36,26 +36,9 @@ typedef struct MirrorBlockJob {
    bool synced;
    bool should_complete;
    int64_t sector_num;
-    int64_t granularity;
-    size_t buf_size;
-    unsigned long *cow_bitmap;
-    HBitmapIter hbi;
    uint8_t *buf;
-    QSIMPLEQ_HEAD(, MirrorBuffer) buf_free;
-    int buf_free_count;
-
-    unsigned long *in_flight_bitmap;
-    int in_flight;
-    int ret;
 } MirrorBlockJob;

-typedef struct MirrorOp {
-    MirrorBlockJob *s;
-    QEMUIOVector qiov;
-    int64_t sector_num;
-    int nb_sectors;
-} MirrorOp;
-
 static BlockErrorAction mirror_error_action(MirrorBlockJob *s, bool read,
                                            int error)
 {
@@ -69,234 +52,51 @@ static BlockErrorAction mirror_error_action(MirrorBlockJob *s, bool read,
    }
 }

-static void mirror_iteration_done(MirrorOp *op, int ret)
-{
-    MirrorBlockJob *s = op->s;
-    struct iovec *iov;
-    int64_t chunk_num;
-    int i, nb_chunks, sectors_per_chunk;
-
-    trace_mirror_iteration_done(s, op->sector_num, op->nb_sectors, ret);
-
-    s->in_flight--;
-    iov = op->qiov.iov;
-    for (i = 0; i < op->qiov.niov; i++) {
-        MirrorBuffer *buf = (MirrorBuffer *) iov[i].iov_base;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, buf, next);
-        s->buf_free_count++;
-    }
-
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    chunk_num = op->sector_num / sectors_per_chunk;
-    nb_chunks = op->nb_sectors / sectors_per_chunk;
-    bitmap_clear(s->in_flight_bitmap, chunk_num, nb_chunks);
-    if (s->cow_bitmap && ret >= 0) {
-        bitmap_set(s->cow_bitmap, chunk_num, nb_chunks);
-    }
-
-    g_slice_free(MirrorOp, op);
-    qemu_coroutine_enter(s->common.co, NULL);
-}
-
-static void mirror_write_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, false, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-    }
-    mirror_iteration_done(op, ret);
-}
-
-static void mirror_read_complete(void *opaque, int ret)
-{
-    MirrorOp *op = opaque;
-    MirrorBlockJob *s = op->s;
-    if (ret < 0) {
-        BlockDriverState *source = s->common.bs;
-        BlockErrorAction action;
-
-        bdrv_set_dirty(source, op->sector_num, op->nb_sectors);
-        action = mirror_error_action(s, true, -ret);
-        if (action == BDRV_ACTION_REPORT && s->ret >= 0) {
-            s->ret = ret;
-        }
-
-        mirror_iteration_done(op, ret);
-        return;
-    }
-    bdrv_aio_writev(s->target, op->sector_num, &op->qiov, op->nb_sectors,
-                    mirror_write_complete, op);
-}
-
-static void coroutine_fn mirror_iteration(MirrorBlockJob *s)
+static int coroutine_fn mirror_iteration(MirrorBlockJob *s,
+                                         BlockErrorAction *p_action)
 {
    BlockDriverState *source = s->common.bs;
-    int nb_sectors, sectors_per_chunk, nb_chunks;
-    int64_t end, sector_num, next_chunk, next_sector, hbitmap_next_sector;
-    MirrorOp *op;
+    BlockDriverState *target = s->target;
+    QEMUIOVector qiov;
+    int ret, nb_sectors;
+    int64_t end;
+    struct iovec iov;

-    s->sector_num = hbitmap_iter_next(&s->hbi);
-    if (s->sector_num < 0) {
-        bdrv_dirty_iter_init(source, &s->hbi);
-        s->sector_num = hbitmap_iter_next(&s->hbi);
-        trace_mirror_restart_iter(s, bdrv_get_dirty_count(source));
-        assert(s->sector_num >= 0);
-    }
-
-    hbitmap_next_sector = s->sector_num;
-    sector_num = s->sector_num;
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
    end = s->common.len >> BDRV_SECTOR_BITS;
-
-    /* Extend the QEMUIOVector to include all adjacent blocks that will
-     * be copied in this operation.
-     *
-     * We have to do this if we have no backing file yet in the destination,
-     * and the cluster size is very large.  Then we need to do COW ourselves.
-     * The first time a cluster is copied, copy it entirely.  Note that,
-     * because both the granularity and the cluster size are powers of two,
-     * the number of sectors to copy cannot exceed one cluster.
-     *
-     * We also want to extend the QEMUIOVector to include more adjacent
-     * dirty blocks if possible, to limit the number of I/O operations and
-     * run efficiently even with a small granularity.
-     */
-    nb_chunks = 0;
-    nb_sectors = 0;
-    next_sector = sector_num;
-    next_chunk = sector_num / sectors_per_chunk;
-
-    /* Wait for I/O to this cluster (from a previous iteration) to be done.  */
-    while (test_bit(next_chunk, s->in_flight_bitmap)) {
-        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
-        qemu_coroutine_yield();
-    }
-
-    do {
-        int added_sectors, added_chunks;
-
-        if (!bdrv_get_dirty(source, next_sector) ||
-            test_bit(next_chunk, s->in_flight_bitmap)) {
-            assert(nb_sectors > 0);
-            break;
-        }
-
-        added_sectors = sectors_per_chunk;
-        if (s->cow_bitmap && !test_bit(next_chunk, s->cow_bitmap)) {
-            bdrv_round_to_clusters(s->target,
-                                   next_sector, added_sectors,
-                                   &next_sector, &added_sectors);
-
-            /* On the first iteration, the rounding may make us copy
-             * sectors before the first dirty one.
-             */
-            if (next_sector < sector_num) {
-                assert(nb_sectors == 0);
-                sector_num = next_sector;
-                next_chunk = next_sector / sectors_per_chunk;
-            }
-        }
-
-        added_sectors = MIN(added_sectors, end - (sector_num + nb_sectors));
-        added_chunks = (added_sectors + sectors_per_chunk - 1) / sectors_per_chunk;
-
-        /* When doing COW, it may happen that there is not enough space for
-         * a full cluster.  Wait if that is the case.
-         */
-        while (nb_chunks == 0 && s->buf_free_count < added_chunks) {
-            trace_mirror_yield_buf_busy(s, nb_chunks, s->in_flight);
-            qemu_coroutine_yield();
-        }
-        if (s->buf_free_count < nb_chunks + added_chunks) {
-            trace_mirror_break_buf_busy(s, nb_chunks, s->in_flight);
-            break;
-        }
-
-        /* We have enough free space to copy these sectors.  */
-        bitmap_set(s->in_flight_bitmap, next_chunk, added_chunks);
-
-        nb_sectors += added_sectors;
-        nb_chunks += added_chunks;
-        next_sector += added_sectors;
-        next_chunk += added_chunks;
-    } while (next_sector < end);
-
-    /* Allocate a MirrorOp that is used as an AIO callback.  */
-    op = g_slice_new(MirrorOp);
-    op->s = s;
-    op->sector_num = sector_num;
-    op->nb_sectors = nb_sectors;
-
-    /* Now make a QEMUIOVector taking enough granularity-sized chunks
-     * from s->buf_free.
-     */
-    qemu_iovec_init(&op->qiov, nb_chunks);
-    next_sector = sector_num;
-    while (nb_chunks-- > 0) {
-        MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
-        QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
-        s->buf_free_count--;
-        qemu_iovec_add(&op->qiov, buf, s->granularity);
-
-        /* Advance the HBitmapIter in parallel, so that we do not examine
-         * the same sector twice.
-         */
-        if (next_sector > hbitmap_next_sector && bdrv_get_dirty(source, next_sector)) {
-            hbitmap_next_sector = hbitmap_iter_next(&s->hbi);
-        }
-
-        next_sector += sectors_per_chunk;
-    }
-
-    bdrv_reset_dirty(source, sector_num, nb_sectors);
+    s->sector_num = bdrv_get_next_dirty(source, s->sector_num);
+    nb_sectors = MIN(BDRV_SECTORS_PER_DIRTY_CHUNK, end - s->sector_num);
+    bdrv_reset_dirty(source, s->sector_num, nb_sectors);

    /* Copy the dirty cluster.  */
-    s->in_flight++;
-    trace_mirror_one_iteration(s, sector_num, nb_sectors);
-    bdrv_aio_readv(source, sector_num, &op->qiov, nb_sectors,
-                   mirror_read_complete, op);
-}
+    iov.iov_base = s->buf;
+    iov.iov_len  = nb_sectors * 512;
+    qemu_iovec_init_external(&qiov, &iov, 1);

-static void mirror_free_init(MirrorBlockJob *s)
-{
-    int granularity = s->granularity;
-    size_t buf_size = s->buf_size;
-    uint8_t *buf = s->buf;
-
-    assert(s->buf_free_count == 0);
-    QSIMPLEQ_INIT(&s->buf_free);
-    while (buf_size != 0) {
-        MirrorBuffer *cur = (MirrorBuffer *)buf;
-        QSIMPLEQ_INSERT_TAIL(&s->buf_free, cur, next);
-        s->buf_free_count++;
-        buf_size -= granularity;
-        buf += granularity;
+    trace_mirror_one_iteration(s, s->sector_num, nb_sectors);
+    ret = bdrv_co_readv(source, s->sector_num, nb_sectors, &qiov);
+    if (ret < 0) {
+        *p_action = mirror_error_action(s, true, -ret);
+        goto fail;
    }
-}
-
-static void mirror_drain(MirrorBlockJob *s)
-{
-    while (s->in_flight > 0) {
-        qemu_coroutine_yield();
+    ret = bdrv_co_writev(target, s->sector_num, nb_sectors, &qiov);
+    if (ret < 0) {
+        *p_action = mirror_error_action(s, false, -ret);
+        s->synced = false;
+        goto fail;
    }
+    return 0;
+
+fail:
+    /* Try again later.  */
+    bdrv_set_dirty(source, s->sector_num, nb_sectors);
+    return ret;
 }

 static void coroutine_fn mirror_run(void *opaque)
 {
    MirrorBlockJob *s = opaque;
    BlockDriverState *bs = s->common.bs;
-    int64_t sector_num, end, sectors_per_chunk, length;
-    uint64_t last_pause_ns;
-    BlockDriverInfo bdi;
-    char backing_filename[1024];
+    int64_t sector_num, end;
    int ret = 0;
    int n;

@@ -305,39 +105,20 @@ static void coroutine_fn mirror_run(void *opaque)
    }

    s->common.len = bdrv_getlength(bs);
-    if (s->common.len <= 0) {
+    if (s->common.len < 0) {
        block_job_completed(&s->common, s->common.len);
        return;
    }

-    length = (bdrv_getlength(bs) + s->granularity - 1) / s->granularity;
-    s->in_flight_bitmap = bitmap_new(length);
-
-    /* If we have no backing file yet in the destination, we cannot let
-     * the destination do COW.  Instead, we copy sectors around the
-     * dirty data if needed.  We need a bitmap to do that.
-     */
-    bdrv_get_backing_filename(s->target, backing_filename,
-                              sizeof(backing_filename));
-    if (backing_filename[0] && !s->target->backing_hd) {
-        bdrv_get_info(s->target, &bdi);
-        if (s->granularity < bdi.cluster_size) {
-            s->buf_size = MAX(s->buf_size, bdi.cluster_size);
-            s->cow_bitmap = bitmap_new(length);
-        }
-    }
-
    end = s->common.len >> BDRV_SECTOR_BITS;
-    s->buf = qemu_blockalign(bs, s->buf_size);
-    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
-    mirror_free_init(s);
+    s->buf = qemu_blockalign(bs, BLOCK_SIZE);

    if (s->mode != MIRROR_SYNC_MODE_NONE) {
        /* First part, loop on the sectors and initialize the dirty bitmap.  */
        BlockDriverState *base;
        base = s->mode == MIRROR_SYNC_MODE_FULL ? NULL : bs->backing_hd;
        for (sector_num = 0; sector_num < end; ) {
-            int64_t next = (sector_num | (sectors_per_chunk - 1)) + 1;
+            int64_t next = (sector_num | (BDRV_SECTORS_PER_DIRTY_CHUNK - 1)) + 1;
            ret = bdrv_co_is_allocated_above(bs, base,
                                             sector_num, next - sector_num, &n);

@@ -355,40 +136,24 @@ static void coroutine_fn mirror_run(void *opaque)
        }
    }

-    bdrv_dirty_iter_init(bs, &s->hbi);
-    last_pause_ns = qemu_get_clock_ns(rt_clock);
+    s->sector_num = -1;
    for (;;) {
        uint64_t delay_ns;
        int64_t cnt;
        bool should_complete;

-        if (s->ret < 0) {
-            ret = s->ret;
-            goto immediate_exit;
-        }
-
        cnt = bdrv_get_dirty_count(bs);
-
-        /* Note that even when no rate limit is applied we need to yield
-         * periodically with no pending I/O so that qemu_aio_flush() returns.
-         * We do so every SLICE_TIME nanoseconds, or when there is an error,
-         * or when the source is clean, whichever comes first.
-         */
-        if (qemu_get_clock_ns(rt_clock) - last_pause_ns < SLICE_TIME &&
-            s->common.iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
-            if (s->in_flight == MAX_IN_FLIGHT || s->buf_free_count == 0 ||
-                (cnt == 0 && s->in_flight > 0)) {
-                trace_mirror_yield(s, s->in_flight, s->buf_free_count, cnt);
-                qemu_coroutine_yield();
-                continue;
-            } else if (cnt != 0) {
-                mirror_iteration(s);
-                continue;
+        if (cnt != 0) {
+            BlockErrorAction action = BDRV_ACTION_REPORT;
+            ret = mirror_iteration(s, &action);
+            if (ret < 0 && action == BDRV_ACTION_REPORT) {
+                goto immediate_exit;
            }
+            cnt = bdrv_get_dirty_count(bs);
        }

        should_complete = false;
-        if (s->in_flight == 0 && cnt == 0) {
+        if (cnt == 0) {
            trace_mirror_before_flush(s);
            ret = bdrv_flush(s->target);
            if (ret < 0) {
@@ -431,20 +196,23 @@ static void coroutine_fn mirror_run(void *opaque)
        trace_mirror_before_sleep(s, cnt, s->synced);
        if (!s->synced) {
            /* Publish progress */
-            s->common.offset = (end - cnt) * BDRV_SECTOR_SIZE;
+            s->common.offset = end * BDRV_SECTOR_SIZE - cnt * BLOCK_SIZE;

            if (s->common.speed) {
-                delay_ns = ratelimit_calculate_delay(&s->limit, sectors_per_chunk);
+                delay_ns = ratelimit_calculate_delay(&s->limit, BDRV_SECTORS_PER_DIRTY_CHUNK);
            } else {
                delay_ns = 0;
            }

+            /* Note that even when no rate limit is applied we need to yield
+             * with no pending I/O here so that qemu_aio_flush() returns.
+             */
            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
            if (block_job_is_cancelled(&s->common)) {
                break;
            }
        } else if (!should_complete) {
-            delay_ns = (s->in_flight == 0 && cnt == 0 ? SLICE_TIME : 0);
+            delay_ns = (cnt == 0 ? SLICE_TIME : 0);
            block_job_sleep_ns(&s->common, rt_clock, delay_ns);
        } else if (cnt == 0) {
            /* The two disks are in sync.  Exit and report successful
@@ -454,24 +222,11 @@ static void coroutine_fn mirror_run(void *opaque)
            s->common.cancelled = false;
            break;
        }
-        last_pause_ns = qemu_get_clock_ns(rt_clock);
    }

 immediate_exit:
-    if (s->in_flight > 0) {
-        /* We get here only if something went wrong.  Either the job failed,
-         * or it was cancelled prematurely so that we do not guarantee that
-         * the target is a copy of the source.
-         */
-        assert(ret < 0 || (!s->synced && block_job_is_cancelled(&s->common)));
-        mirror_drain(s);
-    }
-
-    assert(s->in_flight == 0);
-    qemu_vfree(s->buf);
-    g_free(s->cow_bitmap);
-    g_free(s->in_flight_bitmap);
-    bdrv_set_dirty_tracking(bs, 0);
+    g_free(s->buf);
+    bdrv_set_dirty_tracking(bs, false);
    bdrv_iostatus_disable(s->target);
    if (s->should_complete && ret == 0) {
        if (bdrv_get_flags(s->target) != bdrv_get_flags(s->common.bs)) {
@@ -533,28 +288,14 @@ static BlockJobType mirror_job_type = {
 };

 void mirror_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed, int64_t granularity, int64_t buf_size,
-                  MirrorSyncMode mode, BlockdevOnError on_source_error,
+                  int64_t speed, MirrorSyncMode mode,
+                  BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
                  BlockDriverCompletionFunc *cb,
                  void *opaque, Error **errp)
 {
    MirrorBlockJob *s;

-    if (granularity == 0) {
-        /* Choose the default granularity based on the target file's cluster
-         * size, clamped between 4k and 64k.  */
-        BlockDriverInfo bdi;
-        if (bdrv_get_info(target, &bdi) >= 0 && bdi.cluster_size != 0) {
-            granularity = MAX(4096, bdi.cluster_size);
-            granularity = MIN(65536, granularity);
-        } else {
-            granularity = 65536;
-        }
-    }
-
-    assert ((granularity & (granularity - 1)) == 0);
-
    if ((on_source_error == BLOCKDEV_ON_ERROR_STOP ||
         on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) &&
        !bdrv_iostatus_is_enabled(bs)) {
@@ -571,10 +312,7 @@ void mirror_start(BlockDriverState *bs, BlockDriverState *target,
    s->on_target_error = on_target_error;
    s->target = target;
    s->mode = mode;
-    s->granularity = granularity;
-    s->buf_size = MAX(buf_size, granularity);
-
-    bdrv_set_dirty_tracking(bs, granularity);
+    bdrv_set_dirty_tracking(bs, true);
    bdrv_set_enable_write_cache(s->target, true);
    bdrv_set_on_error(s->target, on_target_error, on_target_error);
    bdrv_iostatus_enable(s->target);
@@ -27,11 +27,11 @@
 */

 #include "qemu-common.h"
-#include "block/nbd.h"
-#include "qemu/uri.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "qemu/sockets.h"
+#include "nbd.h"
+#include "uri.h"
+#include "block_int.h"
+#include "module.h"
+#include "qemu_socket.h"

 #include <sys/types.h>
 #include <unistd.h>
@@ -274,7 +274,7 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
        ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
                            offset, request->len);
        if (ret != request->len) {
-            rc = -EIO;
+            return -EIO;
        }
    }
    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
@@ -350,7 +350,7 @@ static int nbd_establish_connection(BlockDriverState *bs)

    /* Now that we're connected, set the socket to be non-blocking and
     * kick the reply mechanism.  */
-    qemu_set_nonblock(sock);
+    socket_set_nonblock(sock);
    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL,
                            nbd_have_request, s);

@@ -24,8 +24,8 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 /**************************************************************/

@@ -73,18 +73,14 @@ static int parallels_open(BlockDriverState *bs, int flags)
    BDRVParallelsState *s = bs->opaque;
    int i;
    struct parallels_header ph;
-    int ret;

    bs->read_only = 1; // no write support yet

-    ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, &ph, sizeof(ph)) != sizeof(ph))
        goto fail;
-    }

    if (memcmp(ph.magic, HEADER_MAGIC, 16) ||
-        (le32_to_cpu(ph.version) != HEADER_VERSION)) {
-        ret = -EMEDIUMTYPE;
+	(le32_to_cpu(ph.version) != HEADER_VERSION)) {
        goto fail;
    }

@@ -94,21 +90,18 @@ static int parallels_open(BlockDriverState *bs, int flags)

    s->catalog_size = le32_to_cpu(ph.catalog_entries);
    s->catalog_bitmap = g_malloc(s->catalog_size * 4);
-
-    ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4);
-    if (ret < 0) {
-        goto fail;
-    }
-
+    if (bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4) !=
+	s->catalog_size * 4)
+	goto fail;
    for (i = 0; i < s->catalog_size; i++)
 	le32_to_cpus(&s->catalog_bitmap[i]);

    qemu_co_mutex_init(&s->lock);
    return 0;
-
 fail:
-    g_free(s->catalog_bitmap);
-    return ret;
+    if (s->catalog_bitmap)
+	g_free(s->catalog_bitmap);
+    return -1;
 }

 static int64_t seek_to_sector(BlockDriverState *bs, int64_t sector_num)
@@ -22,11 +22,11 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>
-#include "block/aes.h"
-#include "migration/migration.h"
+#include "aes.h"
+#include "migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -112,7 +112,7 @@ static int qcow_open(BlockDriverState *bs, int flags)
    be64_to_cpus(&header.l1_table_offset);

    if (header.magic != QCOW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }
    if (header.version != QCOW_VERSION) {
@@ -22,7 +22,7 @@
 * THE SOFTWARE.
 */

-#include "block/block_int.h"
+#include "block_int.h"
 #include "qemu-common.h"
 #include "qcow2.h"
 #include "trace.h"
@@ -25,7 +25,7 @@
 #include <zlib.h>

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"
 #include "trace.h"

@@ -454,9 +454,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
        *cluster_offset &= L2E_COMPRESSED_OFFSET_SIZE_MASK;
        break;
    case QCOW2_CLUSTER_ZERO:
-        if (s->qcow_version < 3) {
-            return -EIO;
-        }
        c = count_contiguous_clusters(nb_clusters, s->cluster_size,
                &l2_table[l2_index], 0,
                QCOW_OFLAG_COMPRESSED | QCOW_OFLAG_ZERO);
@@ -618,67 +615,57 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    return cluster_offset;
 }

-static int perform_cow(BlockDriverState *bs, QCowL2Meta *m, Qcow2COWRegion *r)
-{
-    BDRVQcowState *s = bs->opaque;
-    int ret;
-
-    if (r->nb_sectors == 0) {
-        return 0;
-    }
-
-    qemu_co_mutex_unlock(&s->lock);
-    ret = copy_sectors(bs, m->offset / BDRV_SECTOR_SIZE, m->alloc_offset,
-                       r->offset / BDRV_SECTOR_SIZE,
-                       r->offset / BDRV_SECTOR_SIZE + r->nb_sectors);
-    qemu_co_mutex_lock(&s->lock);
-
-    if (ret < 0) {
-        return ret;
-    }
-
-    /*
-     * Before we update the L2 table to actually point to the new cluster, we
-     * need to be sure that the refcounts have been increased and COW was
-     * handled.
-     */
-    qcow2_cache_depends_on_flush(s->l2_table_cache);
-
-    return 0;
-}
-
 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
 {
    BDRVQcowState *s = bs->opaque;
    int i, j = 0, l2_index, ret;
-    uint64_t *old_cluster, *l2_table;
+    uint64_t *old_cluster, start_sect, *l2_table;
    uint64_t cluster_offset = m->alloc_offset;
+    bool cow = false;

    trace_qcow2_cluster_link_l2(qemu_coroutine_self(), m->nb_clusters);
-    assert(m->nb_clusters > 0);
+
+    if (m->nb_clusters == 0)
+        return 0;

    old_cluster = g_malloc(m->nb_clusters * sizeof(uint64_t));

    /* copy content of unmodified sectors */
-    ret = perform_cow(bs, m, &m->cow_start);
-    if (ret < 0) {
-        goto err;
+    start_sect = (m->offset & ~(s->cluster_size - 1)) >> 9;
+    if (m->n_start) {
+        cow = true;
+        qemu_co_mutex_unlock(&s->lock);
+        ret = copy_sectors(bs, start_sect, cluster_offset, 0, m->n_start);
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0)
+            goto err;
    }

-    ret = perform_cow(bs, m, &m->cow_end);
-    if (ret < 0) {
-        goto err;
+    if (m->nb_available & (s->cluster_sectors - 1)) {
+        cow = true;
+        qemu_co_mutex_unlock(&s->lock);
+        ret = copy_sectors(bs, start_sect, cluster_offset, m->nb_available,
+                           align_offset(m->nb_available, s->cluster_sectors));
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0)
+            goto err;
    }

-    /* Update L2 table. */
-    if (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS) {
-        qcow2_mark_dirty(bs);
+    /*
+     * Update L2 table.
+     *
+     * Before we update the L2 table to actually point to the new cluster, we
+     * need to be sure that the refcounts have been increased and COW was
+     * handled.
+     */
+    if (cow) {
+        qcow2_cache_depends_on_flush(s->l2_table_cache);
    }
+
    if (qcow2_need_accurate_refcounts(s)) {
        qcow2_cache_set_dependency(bs, s->l2_table_cache,
                                   s->refcount_block_cache);
    }
-
    ret = get_cluster_table(bs, m->offset, &l2_table, &l2_index);
    if (ret < 0) {
        goto err;
@@ -756,16 +743,38 @@ out:
 }

 /*
- * Check if there already is an AIO write request in flight which allocates
- * the same cluster. In this case we need to wait until the previous
- * request has completed and updated the L2 table accordingly.
+ * Allocates new clusters for the given guest_offset.
+ *
+ * At most *nb_clusters are allocated, and on return *nb_clusters is updated to
+ * contain the number of clusters that have been allocated and are contiguous
+ * in the image file.
+ *
+ * If *host_offset is non-zero, it specifies the offset in the image file at
+ * which the new clusters must start. *nb_clusters can be 0 on return in this
+ * case if the cluster at host_offset is already in use. If *host_offset is
+ * zero, the clusters can be allocated anywhere in the image file.
+ *
+ * *host_offset is updated to contain the offset into the image file at which
+ * the first allocated cluster starts.
+ *
+ * Return 0 on success and -errno in error cases. -EAGAIN means that the
+ * function has been waiting for another request and the allocation must be
+ * restarted, but the whole request should not be failed.
 */
-static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
-    unsigned int *nb_clusters)
+static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
+    uint64_t *host_offset, unsigned int *nb_clusters)
 {
    BDRVQcowState *s = bs->opaque;
    QCowL2Meta *old_alloc;

+    trace_qcow2_do_alloc_clusters_offset(qemu_coroutine_self(), guest_offset,
+                                         *host_offset, *nb_clusters);
+
+    /*
+     * Check if there already is an AIO write request in flight which allocates
+     * the same cluster. In this case we need to wait until the previous
+     * request has completed and updated the L2 table accordingly.
+     */
    QLIST_FOREACH(old_alloc, &s->cluster_allocs, next_in_flight) {

        uint64_t start = guest_offset >> s->cluster_bits;
@@ -798,42 +807,6 @@ static int handle_dependencies(BlockDriverState *bs, uint64_t guest_offset,
        abort();
    }

-    return 0;
-}
-
-/*
- * Allocates new clusters for the given guest_offset.
- *
- * At most *nb_clusters are allocated, and on return *nb_clusters is updated to
- * contain the number of clusters that have been allocated and are contiguous
- * in the image file.
- *
- * If *host_offset is non-zero, it specifies the offset in the image file at
- * which the new clusters must start. *nb_clusters can be 0 on return in this
- * case if the cluster at host_offset is already in use. If *host_offset is
- * zero, the clusters can be allocated anywhere in the image file.
- *
- * *host_offset is updated to contain the offset into the image file at which
- * the first allocated cluster starts.
- *
- * Return 0 on success and -errno in error cases. -EAGAIN means that the
- * function has been waiting for another request and the allocation must be
- * restarted, but the whole request should not be failed.
- */
-static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
-    uint64_t *host_offset, unsigned int *nb_clusters)
-{
-    BDRVQcowState *s = bs->opaque;
-    int ret;
-
-    trace_qcow2_do_alloc_clusters_offset(qemu_coroutine_self(), guest_offset,
-                                         *host_offset, *nb_clusters);
-
-    ret = handle_dependencies(bs, guest_offset, nb_clusters);
-    if (ret < 0) {
-        return ret;
-    }
-
    /* Allocate new clusters */
    trace_qcow2_cluster_alloc_phys(qemu_coroutine_self());
    if (*host_offset == 0) {
@@ -845,7 +818,7 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
        *host_offset = cluster_offset;
        return 0;
    } else {
-        ret = qcow2_alloc_clusters_at(bs, *host_offset, *nb_clusters);
+        int ret = qcow2_alloc_clusters_at(bs, *host_offset, *nb_clusters);
        if (ret < 0) {
            return ret;
        }
@@ -874,7 +847,7 @@ static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
 * Return 0 on success and -errno in error cases
 */
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
-    int n_start, int n_end, int *num, uint64_t *host_offset, QCowL2Meta **m)
+    int n_start, int n_end, int *num, QCowL2Meta *m)
 {
    BDRVQcowState *s = bs->opaque;
    int l2_index, ret, sectors;
@@ -946,6 +919,12 @@ again:
    }

    /* If there is something left to allocate, do that now */
+    *m = (QCowL2Meta) {
+        .cluster_offset     = cluster_offset,
+        .nb_clusters        = 0,
+    };
+    qemu_co_queue_init(&m->dependent_requests);
+
    if (nb_clusters > 0) {
        uint64_t alloc_offset;
        uint64_t alloc_cluster_offset;
@@ -978,40 +957,22 @@ again:
             *
             * avail_sectors: Number of sectors from the start of the first
             * newly allocated to the end of the last newly allocated cluster.
-             *
-             * nb_sectors: The number of sectors from the start of the first
-             * newly allocated cluster to the end of the aread that the write
-             * request actually writes to (excluding COW at the end)
             */
            int requested_sectors = n_end - keep_clusters * s->cluster_sectors;
            int avail_sectors = nb_clusters
                                << (s->cluster_bits - BDRV_SECTOR_BITS);
-            int alloc_n_start = keep_clusters == 0 ? n_start : 0;
-            int nb_sectors = MIN(requested_sectors, avail_sectors);

-            if (keep_clusters == 0) {
-                cluster_offset = alloc_cluster_offset;
-            }
-
-            *m = g_malloc0(sizeof(**m));
-
-            **m = (QCowL2Meta) {
+            *m = (QCowL2Meta) {
+                .cluster_offset = keep_clusters == 0 ?
+                                  alloc_cluster_offset : cluster_offset,
                .alloc_offset   = alloc_cluster_offset,
-                .offset         = alloc_offset & ~(s->cluster_size - 1),
+                .offset         = alloc_offset,
+                .n_start        = keep_clusters == 0 ? n_start : 0,
                .nb_clusters    = nb_clusters,
-                .nb_available   = nb_sectors,
-
-                .cow_start = {
-                    .offset     = 0,
-                    .nb_sectors = alloc_n_start,
-                },
-                .cow_end = {
-                    .offset     = nb_sectors * BDRV_SECTOR_SIZE,
-                    .nb_sectors = avail_sectors - nb_sectors,
-                },
+                .nb_available   = MIN(requested_sectors, avail_sectors),
            };
-            qemu_co_queue_init(&(*m)->dependent_requests);
-            QLIST_INSERT_HEAD(&s->cluster_allocs, *m, next_in_flight);
+            qemu_co_queue_init(&m->dependent_requests);
+            QLIST_INSERT_HEAD(&s->cluster_allocs, m, next_in_flight);
        }
    }

@@ -1023,13 +984,12 @@ again:

    assert(sectors > n_start);
    *num = sectors - n_start;
-    *host_offset = cluster_offset;

    return 0;

 fail:
-    if (*m && (*m)->nb_clusters > 0) {
-        QLIST_REMOVE(*m, next_in_flight);
+    if (m->nb_clusters > 0) {
+        QLIST_REMOVE(m, next_in_flight);
    }
    return ret;
 }
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 static int64_t alloc_clusters_noref(BlockDriverState *bs, int64_t size);
@@ -201,10 +201,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    *refcount_block = NULL;

    /* We write to the refcount table, so we might depend on L2 tables */
-    ret = qcow2_cache_flush(bs, s->l2_table_cache);
-    if (ret < 0) {
-        return ret;
-    }
+    qcow2_cache_flush(bs, s->l2_table_cache);

    /* Allocate the refcount block itself and mark it as used */
    int64_t new_block = alloc_clusters_noref(bs, s->cluster_size);
@@ -240,10 +237,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
            goto fail_block;
        }

-        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
-        if (ret < 0) {
-            goto fail_block;
-        }
+        bdrv_flush(bs->file);

        /* Initialize the new refcount block only after updating its refcount,
         * update_refcount uses the refcount cache itself */
@@ -743,7 +737,11 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
     * l1_table_offset when it is the current s->l1_table_offset! Be careful
     * when changing this! */
    if (l1_table_offset != s->l1_table_offset) {
-        l1_table = g_malloc0(align_offset(l1_size2, 512));
+        if (l1_size2 != 0) {
+            l1_table = g_malloc0(align_offset(l1_size2, 512));
+        } else {
+            l1_table = NULL;
+        }
        l1_allocated = 1;
        if (bdrv_pread(bs->file, l1_table_offset,
                       l1_table, l1_size2) != l1_size2)
@@ -23,7 +23,7 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
+#include "block_int.h"
 #include "block/qcow2.h"

 typedef struct QEMU_PACKED QCowSnapshotHeader {
@@ -180,14 +180,11 @@ static int qcow2_write_snapshots(BlockDriverState *bs)

    /* Allocate space for the new snapshot list */
    snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size);
+    bdrv_flush(bs->file);
    offset = snapshots_offset;
    if (offset < 0) {
        return offset;
    }
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        return ret;
-    }

    /* Write all snapshots to the new list */
    for(i = 0; i < s->nb_snapshots; i++) {
@@ -22,13 +22,13 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"
 #include <zlib.h>
-#include "block/aes.h"
+#include "aes.h"
 #include "block/qcow2.h"
-#include "qemu/error-report.h"
-#include "qapi/qmp/qerror.h"
+#include "qemu-error.h"
+#include "qerror.h"
 #include "trace.h"

 /*
@@ -222,7 +222,7 @@ static void report_unsupported_feature(BlockDriverState *bs,
 * updated successfully.  Therefore it is not required to check the return
 * value of this function.
 */
-int qcow2_mark_dirty(BlockDriverState *bs)
+static int qcow2_mark_dirty(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;
    uint64_t val;
@@ -311,7 +311,7 @@ static int qcow2_open(BlockDriverState *bs, int flags)
    be32_to_cpus(&header.nb_snapshots);

    if (header.magic != QCOW_MAGIC) {
-        ret = -EMEDIUMTYPE;
+        ret = -EINVAL;
        goto fail;
    }
    if (header.version < 2 || header.version > 3) {
@@ -584,7 +584,7 @@ static int coroutine_fn qcow2_co_is_allocated(BlockDriverState *bs,
        *pnum = 0;
    }

-    return (cluster_offset != 0) || (ret == QCOW2_CLUSTER_ZERO);
+    return (cluster_offset != 0);
 }

 /* handle reading after the end of the backing file */
@@ -665,6 +665,10 @@ static coroutine_fn int qcow2_co_readv(BlockDriverState *bs, int64_t sector_num,
            break;

        case QCOW2_CLUSTER_ZERO:
+            if (s->qcow_version < 3) {
+                ret = -EIO;
+                goto fail;
+            }
            qemu_iovec_memset(&hd_qiov, 0, 0, 512 * cur_nr_sectors);
            break;

@@ -741,6 +745,21 @@ fail:
    return ret;
 }

+static void run_dependent_requests(BDRVQcowState *s, QCowL2Meta *m)
+{
+    /* Take the request off the list of running requests */
+    if (m->nb_clusters != 0) {
+        QLIST_REMOVE(m, next_in_flight);
+    }
+
+    /* Restart all dependent requests */
+    if (!qemu_co_queue_empty(&m->dependent_requests)) {
+        qemu_co_mutex_unlock(&s->lock);
+        qemu_co_queue_restart_all(&m->dependent_requests);
+        qemu_co_mutex_lock(&s->lock);
+    }
+}
+
 static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
                           int64_t sector_num,
                           int remaining_sectors,
@@ -755,11 +774,15 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
    QEMUIOVector hd_qiov;
    uint64_t bytes_done = 0;
    uint8_t *cluster_data = NULL;
-    QCowL2Meta *l2meta = NULL;
+    QCowL2Meta l2meta = {
+        .nb_clusters = 0,
+    };

    trace_qcow2_writev_start_req(qemu_coroutine_self(), sector_num,
                                 remaining_sectors);

+    qemu_co_queue_init(&l2meta.dependent_requests);
+
    qemu_iovec_init(&hd_qiov, qiov->niov);

    s->cluster_cache_offset = -1; /* disable compressed cache */
@@ -768,8 +791,6 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,

    while (remaining_sectors != 0) {

-        l2meta = NULL;
-
        trace_qcow2_writev_start_part(qemu_coroutine_self());
        index_in_cluster = sector_num & (s->cluster_sectors - 1);
        n_end = index_in_cluster + remaining_sectors;
@@ -779,11 +800,17 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
        }

        ret = qcow2_alloc_cluster_offset(bs, sector_num << 9,
-            index_in_cluster, n_end, &cur_nr_sectors, &cluster_offset, &l2meta);
+            index_in_cluster, n_end, &cur_nr_sectors, &l2meta);
        if (ret < 0) {
            goto fail;
        }

+        if (l2meta.nb_clusters > 0 &&
+            (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS)) {
+            qcow2_mark_dirty(bs);
+        }
+
+        cluster_offset = l2meta.cluster_offset;
        assert((cluster_offset & 511) == 0);

        qemu_iovec_reset(&hd_qiov);
@@ -808,8 +835,8 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
                cur_nr_sectors * 512);
        }

-        qemu_co_mutex_unlock(&s->lock);
        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
+        qemu_co_mutex_unlock(&s->lock);
        trace_qcow2_writev_data(qemu_coroutine_self(),
                                (cluster_offset >> 9) + index_in_cluster);
        ret = bdrv_co_writev(bs->file,
@@ -820,25 +847,13 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
            goto fail;
        }

-        if (l2meta != NULL) {
-            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
-            if (ret < 0) {
-                goto fail;
-            }
-
-            /* Take the request off the list of running requests */
-            if (l2meta->nb_clusters != 0) {
-                QLIST_REMOVE(l2meta, next_in_flight);
-            }
-
-            qemu_co_mutex_unlock(&s->lock);
-            qemu_co_queue_restart_all(&l2meta->dependent_requests);
-            qemu_co_mutex_lock(&s->lock);
-
-            g_free(l2meta);
-            l2meta = NULL;
+        ret = qcow2_alloc_cluster_link_l2(bs, &l2meta);
+        if (ret < 0) {
+            goto fail;
        }

+        run_dependent_requests(s, &l2meta);
+
        remaining_sectors -= cur_nr_sectors;
        sector_num += cur_nr_sectors;
        bytes_done += cur_nr_sectors * 512;
@@ -847,15 +862,9 @@ static coroutine_fn int qcow2_co_writev(BlockDriverState *bs,
    ret = 0;

 fail:
-    qemu_co_mutex_unlock(&s->lock);
+    run_dependent_requests(s, &l2meta);

-    if (l2meta != NULL) {
-        if (l2meta->nb_clusters != 0) {
-            QLIST_REMOVE(l2meta, next_in_flight);
-        }
-        qemu_co_queue_restart_all(&l2meta->dependent_requests);
-        g_free(l2meta);
-    }
+    qemu_co_mutex_unlock(&s->lock);

    qemu_iovec_destroy(&hd_qiov);
    qemu_vfree(cluster_data);
@@ -1119,33 +1128,31 @@ static int preallocate(BlockDriverState *bs)
 {
    uint64_t nb_sectors;
    uint64_t offset;
-    uint64_t host_offset = 0;
    int num;
    int ret;
-    QCowL2Meta *meta;
+    QCowL2Meta meta;

    nb_sectors = bdrv_getlength(bs) >> 9;
    offset = 0;
+    qemu_co_queue_init(&meta.dependent_requests);
+    meta.cluster_offset = 0;

    while (nb_sectors) {
        num = MIN(nb_sectors, INT_MAX >> 9);
-        ret = qcow2_alloc_cluster_offset(bs, offset, 0, num, &num,
-                                         &host_offset, &meta);
+        ret = qcow2_alloc_cluster_offset(bs, offset, 0, num, &num, &meta);
        if (ret < 0) {
            return ret;
        }

-        ret = qcow2_alloc_cluster_link_l2(bs, meta);
+        ret = qcow2_alloc_cluster_link_l2(bs, &meta);
        if (ret < 0) {
-            qcow2_free_any_clusters(bs, meta->alloc_offset, meta->nb_clusters);
+            qcow2_free_any_clusters(bs, meta.cluster_offset, meta.nb_clusters);
            return ret;
        }

        /* There are no dependent requests, but we need to remove our request
         * from the list of in-flight requests */
-        if (meta != NULL) {
-            QLIST_REMOVE(meta, next_in_flight);
-        }
+        run_dependent_requests(bs->opaque, &meta);

        /* TODO Preallocate data if requested */

@@ -1158,10 +1165,10 @@ static int preallocate(BlockDriverState *bs)
     * all of the allocated clusters (otherwise we get failing reads after
     * EOF). Extend the image to the last allocated sector.
     */
-    if (host_offset != 0) {
+    if (meta.cluster_offset != 0) {
        uint8_t buf[512];
        memset(buf, 0, 512);
-        ret = bdrv_write(bs->file, (host_offset >> 9) + num - 1, buf, 1);
+        ret = bdrv_write(bs->file, (meta.cluster_offset >> 9) + num - 1, buf, 1);
        if (ret < 0) {
            return ret;
        }
@@ -25,8 +25,8 @@
 #ifndef BLOCK_QCOW2_H
 #define BLOCK_QCOW2_H

-#include "block/aes.h"
-#include "block/coroutine.h"
+#include "aes.h"
+#include "qemu-coroutine.h"

 //#define DEBUG_ALLOC
 //#define DEBUG_ALLOC2
@@ -196,56 +196,17 @@ typedef struct QCowCreateState {

 struct QCowAIOCB;

-typedef struct Qcow2COWRegion {
-    /**
-     * Offset of the COW region in bytes from the start of the first cluster
-     * touched by the request.
-     */
-    uint64_t    offset;
-
-    /** Number of sectors to copy */
-    int         nb_sectors;
-} Qcow2COWRegion;
-
-/**
- * Describes an in-flight (part of a) write request that writes to clusters
- * that are not referenced in their L2 table yet.
- */
+/* XXX This could be private for qcow2-cluster.c */
 typedef struct QCowL2Meta
 {
-    /** Guest offset of the first newly allocated cluster */
    uint64_t offset;
-
-    /** Host offset of the first newly allocated cluster */
+    uint64_t cluster_offset;
    uint64_t alloc_offset;
-
-    /**
-     * Number of sectors from the start of the first allocated cluster to
-     * the end of the (possibly shortened) request
-     */
+    int n_start;
    int nb_available;
-
-    /** Number of newly allocated clusters */
    int nb_clusters;
-
-    /**
-     * Requests that overlap with this allocation and wait to be restarted
-     * when the allocating request has completed.
-     */
    CoQueue dependent_requests;

-    /**
-     * The COW Region between the start of the first allocated cluster and the
-     * area the guest actually writes to.
-     */
-    Qcow2COWRegion cow_start;
-
-    /**
-     * The COW Region between the area the guest actually writes to and the
-     * end of the last allocated cluster.
-     */
-    Qcow2COWRegion cow_end;
-
    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;

@@ -303,8 +264,6 @@ static inline bool qcow2_need_accurate_refcounts(BDRVQcowState *s)
 /* qcow2.c functions */
 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors);
-
-int qcow2_mark_dirty(BlockDriverState *bs);
 int qcow2_update_header(BlockDriverState *bs);

 /* qcow2-refcount.c functions */
@@ -338,7 +297,7 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int *num, uint64_t *cluster_offset);
 int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
-    int n_start, int n_end, int *num, uint64_t *host_offset, QCowL2Meta **m);
+    int n_start, int n_end, int *num, QCowL2Meta *m);
 uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
                                         uint64_t offset,
                                         int compressed_size);
@@ -13,7 +13,7 @@
 */

 #include "trace.h"
-#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
+#include "qemu_socket.h" /* for EINPROGRESS on Windows */
 #include "qed.h"

 typedef struct {
@@ -12,11 +12,11 @@
 *
 */

-#include "qemu/timer.h"
+#include "qemu-timer.h"
 #include "trace.h"
 #include "qed.h"
-#include "qapi/qmp/qerror.h"
-#include "migration/migration.h"
+#include "qerror.h"
+#include "migration.h"

 static void qed_aio_cancel(BlockDriverAIOCB *blockacb)
 {
@@ -390,7 +390,7 @@ static int bdrv_qed_open(BlockDriverState *bs, int flags)
    qed_header_le_to_cpu(&le_header, &s->header);

    if (s->header.magic != QED_MAGIC) {
-        return -EMEDIUMTYPE;
+        return -EINVAL;
    }
    if (s->header.features & ~QED_FEATURE_MASK) {
        /* image uses unsupported feature bits */
@@ -15,7 +15,7 @@
 #ifndef BLOCK_QED_H
 #define BLOCK_QED_H

-#include "block/block_int.h"
+#include "block_int.h"

 /* The layout of a QED file is as follows:
 *
@@ -20,14 +20,11 @@
 #define QEMU_AIO_WRITE        0x0002
 #define QEMU_AIO_IOCTL        0x0004
 #define QEMU_AIO_FLUSH        0x0008
-#define QEMU_AIO_DISCARD      0x0010
 #define QEMU_AIO_TYPE_MASK \
-        (QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH| \
-         QEMU_AIO_DISCARD)
+	(QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH)

 /* AIO flags */
 #define QEMU_AIO_MISALIGNED   0x1000
-#define QEMU_AIO_BLKDEV       0x2000


 /* linux-aio.c - Linux native implementation */
@@ -22,13 +22,14 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "qemu/timer.h"
-#include "qemu/log.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "qemu-log.h"
+#include "block_int.h"
+#include "module.h"
 #include "trace.h"
-#include "block/thread-pool.h"
-#include "qemu/iov.h"
+#include "thread-pool.h"
+#include "iov.h"
 #include "raw-aio.h"

 #if defined(__APPLE__) && (__MACH__)
@@ -59,9 +60,6 @@
 #ifdef CONFIG_FIEMAP
 #include <linux/fiemap.h>
 #endif
-#ifdef CONFIG_FALLOCATE_PUNCH_HOLE
-#include <linux/falloc.h>
-#endif
 #if defined (__FreeBSD__) || defined(__FreeBSD_kernel__)
 #include <sys/disk.h>
 #include <sys/cdio.h>
@@ -141,7 +139,6 @@ typedef struct BDRVRawState {
 #ifdef CONFIG_XFS
    bool is_xfs : 1;
 #endif
-    bool has_discard : 1;
 } BDRVRawState;

 typedef struct BDRVRawReopenState {
@@ -163,7 +160,7 @@ typedef struct RawPosixAIOData {
        void *aio_ioctl_buf;
    };
    int aio_niov;
-    uint64_t aio_nbytes;
+    size_t aio_nbytes;
 #define aio_ioctl_cmd   aio_nbytes /* for QEMU_AIO_IOCTL */
    off_t aio_offset;
    int aio_type;
@@ -293,7 +290,6 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
    }
 #endif

-    s->has_discard = 1;
 #ifdef CONFIG_XFS
    if (platform_test_xfs_fd(s->fd)) {
        s->is_xfs = 1;
@@ -345,20 +341,11 @@ static int raw_reopen_prepare(BDRVReopenState *state,

    raw_s->fd = -1;

-    int fcntl_flags = O_APPEND | O_NONBLOCK;
+    int fcntl_flags = O_APPEND | O_ASYNC | O_NONBLOCK;
 #ifdef O_NOATIME
    fcntl_flags |= O_NOATIME;
 #endif

-#ifdef O_ASYNC
-    /* Not all operating systems have O_ASYNC, and those that don't
-     * will not let us track the state into raw_s->open_flags (typically
-     * you achieve the same effect with an ioctl, for example I_SETSIG
-     * on Solaris). But we do not use O_ASYNC, so that's fine.
-     */
-    assert((s->open_flags & O_ASYNC) == 0);
-#endif
-
    if ((raw_s->open_flags & ~fcntl_flags) == (s->open_flags & ~fcntl_flags)) {
        /* dup the original fd */
        /* TODO: use qemu fcntl wrapper */
@@ -444,6 +431,22 @@ static void raw_reopen_abort(BDRVReopenState *state)
 #endif
 */

+/*
+ * Check if all memory in this vector is sector aligned.
+ */
+static int qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
+{
+    int i;
+
+    for (i = 0; i < qiov->niov; i++) {
+        if ((uintptr_t) qiov->iov[i].iov_base % bs->buffer_alignment) {
+            return 0;
+        }
+    }
+
+    return 1;
+}
+
 static ssize_t handle_aiocb_ioctl(RawPosixAIOData *aiocb)
 {
    int ret;
@@ -632,72 +635,6 @@ static ssize_t handle_aiocb_rw(RawPosixAIOData *aiocb)
    return nbytes;
 }

-#ifdef CONFIG_XFS
-static int xfs_discard(BDRVRawState *s, int64_t offset, uint64_t bytes)
-{
-    struct xfs_flock64 fl;
-
-    memset(&fl, 0, sizeof(fl));
-    fl.l_whence = SEEK_SET;
-    fl.l_start = offset;
-    fl.l_len = bytes;
-
-    if (xfsctl(NULL, s->fd, XFS_IOC_UNRESVSP64, &fl) < 0) {
-        DEBUG_BLOCK_PRINT("cannot punch hole (%s)\n", strerror(errno));
-        return -errno;
-    }
-
-    return 0;
-}
-#endif
-
-static ssize_t handle_aiocb_discard(RawPosixAIOData *aiocb)
-{
-    int ret = -EOPNOTSUPP;
-    BDRVRawState *s = aiocb->bs->opaque;
-
-    if (s->has_discard == 0) {
-        return 0;
-    }
-
-    if (aiocb->aio_type & QEMU_AIO_BLKDEV) {
-#ifdef BLKDISCARD
-        do {
-            uint64_t range[2] = { aiocb->aio_offset, aiocb->aio_nbytes };
-            if (ioctl(aiocb->aio_fildes, BLKDISCARD, range) == 0) {
-                return 0;
-            }
-        } while (errno == EINTR);
-
-        ret = -errno;
-#endif
-    } else {
-#ifdef CONFIG_XFS
-        if (s->is_xfs) {
-            return xfs_discard(s, aiocb->aio_offset, aiocb->aio_nbytes);
-        }
-#endif
-
-#ifdef CONFIG_FALLOCATE_PUNCH_HOLE
-        do {
-            if (fallocate(s->fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-                          aiocb->aio_offset, aiocb->aio_nbytes) == 0) {
-                return 0;
-            }
-        } while (errno == EINTR);
-
-        ret = -errno;
-#endif
-    }
-
-    if (ret == -ENODEV || ret == -ENOSYS || ret == -EOPNOTSUPP ||
-        ret == -ENOTTY) {
-        s->has_discard = 0;
-        ret = 0;
-    }
-    return ret;
-}
-
 static int aio_worker(void *arg)
 {
    RawPosixAIOData *aiocb = arg;
@@ -732,9 +669,6 @@ static int aio_worker(void *arg)
    case QEMU_AIO_IOCTL:
        ret = handle_aiocb_ioctl(aiocb);
        break;
-    case QEMU_AIO_DISCARD:
-        ret = handle_aiocb_discard(aiocb);
-        break;
    default:
        fprintf(stderr, "invalid aio request (0x%x)\n", aiocb->aio_type);
        ret = -EINVAL;
@@ -766,6 +700,22 @@ static BlockDriverAIOCB *paio_submit(BlockDriverState *bs, int fd,
    return thread_pool_submit_aio(aio_worker, acb, cb, opaque);
 }

+static BlockDriverAIOCB *paio_ioctl(BlockDriverState *bs, int fd,
+        unsigned long int req, void *buf,
+        BlockDriverCompletionFunc *cb, void *opaque)
+{
+    RawPosixAIOData *acb = g_slice_new(RawPosixAIOData);
+
+    acb->bs = bs;
+    acb->aio_type = QEMU_AIO_IOCTL;
+    acb->aio_fildes = fd;
+    acb->aio_offset = 0;
+    acb->aio_ioctl_buf = buf;
+    acb->aio_ioctl_cmd = req;
+
+    return thread_pool_submit_aio(aio_worker, acb, cb, opaque);
+}
+
 static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,
        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
        BlockDriverCompletionFunc *cb, void *opaque, int type)
@@ -781,7 +731,7 @@ static BlockDriverAIOCB *raw_aio_submit(BlockDriverState *bs,
     * driver that it needs to copy the buffer.
     */
    if ((bs->open_flags & BDRV_O_NOCACHE)) {
-        if (!bdrv_qiov_is_aligned(bs, qiov)) {
+        if (!qiov_is_aligned(bs, qiov)) {
            type |= QEMU_AIO_MISALIGNED;
 #ifdef CONFIG_LINUX_AIO
        } else if (s->use_aio) {
@@ -1135,14 +1085,37 @@ static int coroutine_fn raw_co_is_allocated(BlockDriverState *bs,
    }
 }

-static coroutine_fn BlockDriverAIOCB *raw_aio_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors,
-    BlockDriverCompletionFunc *cb, void *opaque)
+#ifdef CONFIG_XFS
+static int xfs_discard(BDRVRawState *s, int64_t sector_num, int nb_sectors)
 {
+    struct xfs_flock64 fl;
+
+    memset(&fl, 0, sizeof(fl));
+    fl.l_whence = SEEK_SET;
+    fl.l_start = sector_num << 9;
+    fl.l_len = (int64_t)nb_sectors << 9;
+
+    if (xfsctl(NULL, s->fd, XFS_IOC_UNRESVSP64, &fl) < 0) {
+        DEBUG_BLOCK_PRINT("cannot punch hole (%s)\n", strerror(errno));
+        return -errno;
+    }
+
+    return 0;
+}
+#endif
+
+static coroutine_fn int raw_co_discard(BlockDriverState *bs,
+    int64_t sector_num, int nb_sectors)
+{
+#ifdef CONFIG_XFS
    BDRVRawState *s = bs->opaque;

-    return paio_submit(bs, s->fd, sector_num, NULL, nb_sectors,
-                       cb, opaque, QEMU_AIO_DISCARD);
+    if (s->is_xfs) {
+        return xfs_discard(s, sector_num, nb_sectors);
+    }
+#endif
+
+    return 0;
 }

 static QEMUOptionParameter raw_create_options[] = {
@@ -1165,12 +1138,12 @@ static BlockDriver bdrv_file = {
    .bdrv_reopen_abort = raw_reopen_abort,
    .bdrv_close = raw_close,
    .bdrv_create = raw_create,
+    .bdrv_co_discard = raw_co_discard,
    .bdrv_co_is_allocated = raw_co_is_allocated,

    .bdrv_aio_readv = raw_aio_readv,
    .bdrv_aio_writev = raw_aio_writev,
    .bdrv_aio_flush = raw_aio_flush,
-    .bdrv_aio_discard = raw_aio_discard,

    .bdrv_truncate = raw_truncate,
    .bdrv_getlength = raw_getlength,
@@ -1257,43 +1230,9 @@ static int hdev_probe_device(const char *filename)
    return 0;
 }

-static int check_hdev_writable(BDRVRawState *s)
-{
-#if defined(BLKROGET)
-    /* Linux block devices can be configured "read-only" using blockdev(8).
-     * This is independent of device node permissions and therefore open(2)
-     * with O_RDWR succeeds.  Actual writes fail with EPERM.
-     *
-     * bdrv_open() is supposed to fail if the disk is read-only.  Explicitly
-     * check for read-only block devices so that Linux block devices behave
-     * properly.
-     */
-    struct stat st;
-    int readonly = 0;
-
-    if (fstat(s->fd, &st)) {
-        return -errno;
-    }
-
-    if (!S_ISBLK(st.st_mode)) {
-        return 0;
-    }
-
-    if (ioctl(s->fd, BLKROGET, &readonly) < 0) {
-        return -errno;
-    }
-
-    if (readonly) {
-        return -EACCES;
-    }
-#endif /* defined(BLKROGET) */
-    return 0;
-}
-
 static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
    BDRVRawState *s = bs->opaque;
-    int ret;

 #if defined(__APPLE__) && defined(__MACH__)
    if (strstart(filename, "/dev/cdrom", NULL)) {
@@ -1334,20 +1273,7 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
    }
 #endif

-    ret = raw_open_common(bs, filename, flags, 0);
-    if (ret < 0) {
-        return ret;
-    }
-
-    if (flags & BDRV_O_RDWR) {
-        ret = check_hdev_writable(s);
-        if (ret < 0) {
-            raw_close(bs);
-            return ret;
-        }
-    }
-
-    return ret;
+    return raw_open_common(bs, filename, flags, 0);
 }

 #if defined(__linux__)
@@ -1412,19 +1338,10 @@ static BlockDriverAIOCB *hdev_aio_ioctl(BlockDriverState *bs,
        BlockDriverCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;
-    RawPosixAIOData *acb;

    if (fd_open(bs) < 0)
        return NULL;
-
-    acb = g_slice_new(RawPosixAIOData);
-    acb->bs = bs;
-    acb->aio_type = QEMU_AIO_IOCTL;
-    acb->aio_fildes = s->fd;
-    acb->aio_offset = 0;
-    acb->aio_ioctl_buf = buf;
-    acb->aio_ioctl_cmd = req;
-    return thread_pool_submit_aio(aio_worker, acb, cb, opaque);
+    return paio_ioctl(bs, s->fd, req, buf, cb, opaque);
 }

 #elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
@@ -1446,19 +1363,6 @@ static int fd_open(BlockDriverState *bs)

 #endif /* !linux && !FreeBSD */

-static coroutine_fn BlockDriverAIOCB *hdev_aio_discard(BlockDriverState *bs,
-    int64_t sector_num, int nb_sectors,
-    BlockDriverCompletionFunc *cb, void *opaque)
-{
-    BDRVRawState *s = bs->opaque;
-
-    if (fd_open(bs) < 0) {
-        return NULL;
-    }
-    return paio_submit(bs, s->fd, sector_num, NULL, nb_sectors,
-                       cb, opaque, QEMU_AIO_DISCARD|QEMU_AIO_BLKDEV);
-}
-
 static int hdev_create(const char *filename, QEMUOptionParameter *options)
 {
    int fd;
@@ -1511,7 +1415,6 @@ static BlockDriver bdrv_host_device = {
    .bdrv_aio_readv	= raw_aio_readv,
    .bdrv_aio_writev	= raw_aio_writev,
    .bdrv_aio_flush	= raw_aio_flush,
-    .bdrv_aio_discard   = hdev_aio_discard,

    .bdrv_truncate      = raw_truncate,
    .bdrv_getlength	= raw_getlength,
@@ -1873,40 +1776,6 @@ static BlockDriver bdrv_host_cdrom = {
 };
 #endif /* __FreeBSD__ */

-#ifdef CONFIG_LINUX_AIO
-/**
- * Return the file descriptor for Linux AIO
- *
- * This function is a layering violation and should be removed when it becomes
- * possible to call the block layer outside the global mutex.  It allows the
- * caller to hijack the file descriptor so I/O can be performed outside the
- * block layer.
- */
-int raw_get_aio_fd(BlockDriverState *bs)
-{
-    BDRVRawState *s;
-
-    if (!bs->drv) {
-        return -ENOMEDIUM;
-    }
-
-    if (bs->drv == bdrv_find_format("raw")) {
-        bs = bs->file;
-    }
-
-    /* raw-posix has several protocols so just check for raw_aio_readv */
-    if (bs->drv->bdrv_aio_readv != raw_aio_readv) {
-        return -ENOTSUP;
-    }
-
-    s = bs->opaque;
-    if (!s->use_aio) {
-        return -ENOTSUP;
-    }
-    return s->fd;
-}
-#endif /* CONFIG_LINUX_AIO */
-
 static void bdrv_file_init(void)
 {
    /*
@@ -22,13 +22,13 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "qemu/timer.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "qemu-timer.h"
+#include "block_int.h"
+#include "module.h"
 #include "raw-aio.h"
 #include "trace.h"
-#include "block/thread-pool.h"
-#include "qemu/iov.h"
+#include "thread-pool.h"
+#include "iov.h"
 #include <windows.h>
 #include <winioctl.h>

@@ -303,24 +303,13 @@ static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
    LONG low, high;
-    DWORD dwPtrLow;

    low = offset;
    high = offset >> 32;
-
-    /*
-     * An error has occurred if the return value is INVALID_SET_FILE_POINTER
-     * and GetLastError doesn't return NO_ERROR.
-     */
-    dwPtrLow = SetFilePointer(s->hfile, low, &high, FILE_BEGIN);
-    if (dwPtrLow == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        fprintf(stderr, "SetFilePointer error: %lu\n", GetLastError());
+    if (!SetFilePointer(s->hfile, low, &high, FILE_BEGIN))
+	return -EIO;
+    if (!SetEndOfFile(s->hfile))
        return -EIO;
-    }
-    if (SetEndOfFile(s->hfile) == 0) {
-        fprintf(stderr, "SetEndOfFile error: %lu\n", GetLastError());
-        return -EIO;
-    }
    return 0;
 }

@@ -1,7 +1,7 @@

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "block_int.h"
+#include "module.h"

 static int raw_open(BlockDriverState *bs, int flags)
 {
@@ -14,8 +14,8 @@
 #include <inttypes.h>

 #include "qemu-common.h"
-#include "qemu/error-report.h"
-#include "block/block_int.h"
+#include "qemu-error.h"
+#include "block_int.h"

 #include <rbd/librbd.h>

@@ -63,8 +63,7 @@
 typedef enum {
    RBD_AIO_READ,
    RBD_AIO_WRITE,
-    RBD_AIO_DISCARD,
-    RBD_AIO_FLUSH
+    RBD_AIO_DISCARD
 } RBDAIOCmd;

 typedef struct RBDAIOCB {
@@ -78,7 +77,6 @@ typedef struct RBDAIOCB {
    int error;
    struct BDRVRBDState *s;
    int cancelled;
-    int status;
 } RBDAIOCB;

 typedef struct RADOSCB {
@@ -378,9 +376,16 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
    RBDAIOCB *acb = rcb->acb;
    int64_t r;

+    if (acb->cancelled) {
+        qemu_vfree(acb->bounce);
+        qemu_aio_release(acb);
+        goto done;
+    }
+
    r = rcb->ret;

-    if (acb->cmd != RBD_AIO_READ) {
+    if (acb->cmd == RBD_AIO_WRITE ||
+        acb->cmd == RBD_AIO_DISCARD) {
        if (r < 0) {
            acb->ret = r;
            acb->error = 1;
@@ -404,6 +409,7 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
    /* Note that acb->bh can be NULL in case where the aio was cancelled */
    acb->bh = qemu_bh_new(rbd_aio_bh_cb, acb);
    qemu_bh_schedule(acb->bh);
+done:
    g_free(rcb);
 }

@@ -562,12 +568,6 @@ static void qemu_rbd_aio_cancel(BlockDriverAIOCB *blockacb)
 {
    RBDAIOCB *acb = (RBDAIOCB *) blockacb;
    acb->cancelled = 1;
-
-    while (acb->status == -EINPROGRESS) {
-        qemu_aio_wait();
-    }
-
-    qemu_aio_release(acb);
 }

 static const AIOCBInfo rbd_aiocb_info = {
@@ -639,11 +639,8 @@ static void rbd_aio_bh_cb(void *opaque)
    acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
    qemu_bh_delete(acb->bh);
    acb->bh = NULL;
-    acb->status = 0;

-    if (!acb->cancelled) {
-        qemu_aio_release(acb);
-    }
+    qemu_aio_release(acb);
 }

 static int rbd_aio_discard_wrapper(rbd_image_t image,
@@ -658,16 +655,6 @@ static int rbd_aio_discard_wrapper(rbd_image_t image,
 #endif
 }

-static int rbd_aio_flush_wrapper(rbd_image_t image,
-                                 rbd_completion_t comp)
-{
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-    return rbd_aio_flush(image, comp);
-#else
-    return -ENOTSUP;
-#endif
-}
-
 static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
                                       int64_t sector_num,
                                       QEMUIOVector *qiov,
@@ -688,7 +675,7 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    acb = qemu_aio_get(&rbd_aiocb_info, bs, cb, opaque);
    acb->cmd = cmd;
    acb->qiov = qiov;
-    if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
+    if (cmd == RBD_AIO_DISCARD) {
        acb->bounce = NULL;
    } else {
        acb->bounce = qemu_blockalign(bs, qiov->size);
@@ -698,7 +685,6 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    acb->s = s;
    acb->cancelled = 0;
    acb->bh = NULL;
-    acb->status = -EINPROGRESS;

    if (cmd == RBD_AIO_WRITE) {
        qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
@@ -732,9 +718,6 @@ static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
    case RBD_AIO_DISCARD:
        r = rbd_aio_discard_wrapper(s->image, off, size, c);
        break;
-    case RBD_AIO_FLUSH:
-        r = rbd_aio_flush_wrapper(s->image, c);
-        break;
    default:
        r = -EINVAL;
    }
@@ -774,16 +757,6 @@ static BlockDriverAIOCB *qemu_rbd_aio_writev(BlockDriverState *bs,
                         RBD_AIO_WRITE);
 }

-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-static BlockDriverAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
-                                            BlockDriverCompletionFunc *cb,
-                                            void *opaque)
-{
-    return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
-}
-
-#else
-
 static int qemu_rbd_co_flush(BlockDriverState *bs)
 {
 #if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 1)
@@ -794,7 +767,6 @@ static int qemu_rbd_co_flush(BlockDriverState *bs)
    return 0;
 #endif
 }
-#endif

 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
@@ -972,12 +944,7 @@ static BlockDriver bdrv_rbd = {

    .bdrv_aio_readv         = qemu_rbd_aio_readv,
    .bdrv_aio_writev        = qemu_rbd_aio_writev,
-
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-    .bdrv_aio_flush         = qemu_rbd_aio_flush,
-#else
    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
-#endif

 #ifdef LIBRBD_SUPPORTS_DISCARD
    .bdrv_aio_discard       = qemu_rbd_aio_discard,
@@ -13,10 +13,10 @@
 */

 #include "qemu-common.h"
-#include "qemu/error-report.h"
-#include "qemu/sockets.h"
-#include "block/block_int.h"
-#include "qemu/bitops.h"
+#include "qemu-error.h"
+#include "qemu_socket.h"
+#include "block_int.h"
+#include "bitops.h"

 #define SD_PROTO_VER 0x01

@@ -36,8 +36,7 @@

 #define SD_FLAG_CMD_WRITE    0x01
 #define SD_FLAG_CMD_COW      0x02
-#define SD_FLAG_CMD_CACHE    0x04 /* Writeback mode for cache */
-#define SD_FLAG_CMD_DIRECT   0x08 /* Don't use cache */
+#define SD_FLAG_CMD_CACHE    0x04

 #define SD_RES_SUCCESS       0x00 /* Success */
 #define SD_RES_UNKNOWN       0x01 /* Unknown error */
@@ -145,7 +144,7 @@ typedef struct SheepdogVdiReq {
    uint32_t id;
    uint32_t data_length;
    uint64_t vdi_size;
-    uint32_t vdi_id;
+    uint32_t base_vdi_id;
    uint32_t copies;
    uint32_t snapid;
    uint32_t pad[3];
@@ -266,7 +265,6 @@ typedef struct AIOReq {
 enum AIOCBState {
    AIOCB_WRITE_UDATA,
    AIOCB_READ_UDATA,
-    AIOCB_FLUSH_CACHE,
 };

 struct SheepdogAIOCB {
@@ -295,11 +293,12 @@ typedef struct BDRVSheepdogState {

    char name[SD_MAX_VDI_LEN];
    bool is_snapshot;
-    uint32_t cache_flags;
+    bool cache_enabled;

    char *addr;
    char *port;
    int fd;
+    int flush_fd;

    CoMutex lock;
    Coroutine *co_send;
@@ -427,11 +426,12 @@ static const AIOCBInfo sd_aiocb_info = {
 };

 static SheepdogAIOCB *sd_aio_setup(BlockDriverState *bs, QEMUIOVector *qiov,
-                                   int64_t sector_num, int nb_sectors)
+                                   int64_t sector_num, int nb_sectors,
+                                   BlockDriverCompletionFunc *cb, void *opaque)
 {
    SheepdogAIOCB *acb;

-    acb = qemu_aio_get(&sd_aiocb_info, bs, NULL, NULL);
+    acb = qemu_aio_get(&sd_aiocb_info, bs, cb, opaque);

    acb->qiov = qiov;

@@ -549,7 +549,7 @@ static coroutine_fn void do_co_req(void *opaque)
    co = qemu_coroutine_self();
    qemu_aio_set_fd_handler(sockfd, NULL, restart_co_req, NULL, co);

-    qemu_set_block(sockfd);
+    socket_set_block(sockfd);
    ret = send_co_req(sockfd, hdr, data, wlen);
    if (ret < 0) {
        goto out;
@@ -579,7 +579,7 @@ static coroutine_fn void do_co_req(void *opaque)
    ret = 0;
 out:
    qemu_aio_set_fd_handler(sockfd, NULL, NULL, NULL, NULL);
-    qemu_set_nonblock(sockfd);
+    socket_set_nonblock(sockfd);

    srco->ret = ret;
    srco->finished = true;
@@ -714,17 +714,16 @@ static void coroutine_fn aio_read_response(void *opaque)
             * and max_dirty_data_idx are changed to include updated
             * index between them.
             */
-            if (rsp.result == SD_RES_SUCCESS) {
-                s->inode.data_vdi_id[idx] = s->inode.vdi_id;
-                s->max_dirty_data_idx = MAX(idx, s->max_dirty_data_idx);
-                s->min_dirty_data_idx = MIN(idx, s->min_dirty_data_idx);
-            }
+            s->inode.data_vdi_id[idx] = s->inode.vdi_id;
+            s->max_dirty_data_idx = MAX(idx, s->max_dirty_data_idx);
+            s->min_dirty_data_idx = MIN(idx, s->min_dirty_data_idx);
+
            /*
             * Some requests may be blocked because simultaneous
             * create requests are not allowed, so we search the
             * pending requests here.
             */
-            send_pending_req(s, aio_req->oid);
+            send_pending_req(s, vid_to_data_oid(s->inode.vdi_id, idx));
        }
        break;
    case AIOCB_READ_UDATA:
@@ -735,13 +734,6 @@ static void coroutine_fn aio_read_response(void *opaque)
            goto out;
        }
        break;
-    case AIOCB_FLUSH_CACHE:
-        if (rsp.result == SD_RES_INVALID_PARMS) {
-            dprintf("disable cache since the server doesn't support it\n");
-            s->cache_flags = SD_FLAG_CMD_DIRECT;
-            rsp.result = SD_RES_SUCCESS;
-        }
-        break;
    }

    if (rsp.result != SD_RES_SUCCESS) {
@@ -812,7 +804,7 @@ static int get_sheep_fd(BDRVSheepdogState *s)
        return fd;
    }

-    qemu_set_nonblock(fd);
+    socket_set_nonblock(fd);

    ret = set_nodelay(fd);
    if (ret) {
@@ -956,7 +948,7 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
 {
    int nr_copies = s->inode.nr_copies;
    SheepdogObjReq hdr;
-    unsigned int wlen = 0;
+    unsigned int wlen;
    int ret;
    uint64_t oid = aio_req->oid;
    unsigned int datalen = aio_req->data_len;
@@ -970,27 +962,22 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,

    memset(&hdr, 0, sizeof(hdr));

-    switch (aiocb_type) {
-    case AIOCB_FLUSH_CACHE:
-        hdr.opcode = SD_OP_FLUSH_VDI;
-        break;
-    case AIOCB_READ_UDATA:
+    if (aiocb_type == AIOCB_READ_UDATA) {
+        wlen = 0;
        hdr.opcode = SD_OP_READ_OBJ;
        hdr.flags = flags;
-        break;
-    case AIOCB_WRITE_UDATA:
-        if (create) {
-            hdr.opcode = SD_OP_CREATE_AND_WRITE_OBJ;
-        } else {
-            hdr.opcode = SD_OP_WRITE_OBJ;
-        }
+    } else if (create) {
        wlen = datalen;
+        hdr.opcode = SD_OP_CREATE_AND_WRITE_OBJ;
+        hdr.flags = SD_FLAG_CMD_WRITE | flags;
+    } else {
+        wlen = datalen;
+        hdr.opcode = SD_OP_WRITE_OBJ;
        hdr.flags = SD_FLAG_CMD_WRITE | flags;
-        break;
    }

-    if (s->cache_flags) {
-        hdr.flags |= s->cache_flags;
+    if (s->cache_enabled) {
+        hdr.flags |= SD_FLAG_CMD_CACHE;
    }

    hdr.oid = oid;
@@ -1035,7 +1022,7 @@ static int coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,

 static int read_write_object(int fd, char *buf, uint64_t oid, int copies,
                             unsigned int datalen, uint64_t offset,
-                             bool write, bool create, uint32_t cache_flags)
+                             bool write, bool create, bool cache)
 {
    SheepdogObjReq hdr;
    SheepdogObjRsp *rsp = (SheepdogObjRsp *)&hdr;
@@ -1059,7 +1046,9 @@ static int read_write_object(int fd, char *buf, uint64_t oid, int copies,
        hdr.opcode = SD_OP_READ_OBJ;
    }

-    hdr.flags |= cache_flags;
+    if (cache) {
+        hdr.flags |= SD_FLAG_CMD_CACHE;
+    }

    hdr.oid = oid;
    hdr.data_length = datalen;
@@ -1082,19 +1071,18 @@ static int read_write_object(int fd, char *buf, uint64_t oid, int copies,
 }

 static int read_object(int fd, char *buf, uint64_t oid, int copies,
-                       unsigned int datalen, uint64_t offset,
-                       uint32_t cache_flags)
+                       unsigned int datalen, uint64_t offset, bool cache)
 {
    return read_write_object(fd, buf, oid, copies, datalen, offset, false,
-                             false, cache_flags);
+                             false, cache);
 }

 static int write_object(int fd, char *buf, uint64_t oid, int copies,
                        unsigned int datalen, uint64_t offset, bool create,
-                        uint32_t cache_flags)
+                        bool cache)
 {
    return read_write_object(fd, buf, oid, copies, datalen, offset, true,
-                             create, cache_flags);
+                             create, cache);
 }

 static int sd_open(BlockDriverState *bs, const char *filename, int flags)
@@ -1129,13 +1117,12 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)
        goto out;
    }

-    /*
-     * QEMU block layer emulates writethrough cache as 'writeback + flush', so
-     * we always set SD_FLAG_CMD_CACHE (writeback cache) as default.
-     */
-    s->cache_flags = SD_FLAG_CMD_CACHE;
-    if (flags & BDRV_O_NOCACHE) {
-        s->cache_flags = SD_FLAG_CMD_DIRECT;
+    s->cache_enabled = true;
+    s->flush_fd = connect_to_sdog(s->addr, s->port);
+    if (s->flush_fd < 0) {
+        error_report("failed to connect");
+        ret = s->flush_fd;
+        goto out;
    }

    if (snapid || tag[0] != '\0') {
@@ -1152,7 +1139,7 @@ static int sd_open(BlockDriverState *bs, const char *filename, int flags)

    buf = g_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), 0, SD_INODE_SIZE, 0,
-                      s->cache_flags);
+                      s->cache_enabled);

    closesocket(fd);

@@ -1201,7 +1188,7 @@ static int do_sd_create(char *filename, int64_t vdi_size,

    memset(&hdr, 0, sizeof(hdr));
    hdr.opcode = SD_OP_NEW_VDI;
-    hdr.vdi_id = base_vid;
+    hdr.base_vdi_id = base_vid;

    wlen = SD_MAX_VDI_LEN;

@@ -1384,7 +1371,6 @@ static void sd_close(BlockDriverState *bs)
    memset(&hdr, 0, sizeof(hdr));

    hdr.opcode = SD_OP_RELEASE_VDI;
-    hdr.vdi_id = s->inode.vdi_id;
    wlen = strlen(s->name) + 1;
    hdr.data_length = wlen;
    hdr.flags = SD_FLAG_CMD_WRITE;
@@ -1400,6 +1386,9 @@ static void sd_close(BlockDriverState *bs)

    qemu_aio_set_fd_handler(s->fd, NULL, NULL, NULL, NULL);
    closesocket(s->fd);
+    if (s->cache_enabled) {
+        closesocket(s->flush_fd);
+    }
    g_free(s->addr);
 }

@@ -1433,7 +1422,7 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset)
    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
    s->inode.vdi_size = offset;
    ret = write_object(fd, (char *)&s->inode, vid_to_vdi_oid(s->inode.vdi_id),
-                       s->inode.nr_copies, datalen, 0, false, s->cache_flags);
+                       s->inode.nr_copies, datalen, 0, false, s->cache_enabled);
    close(fd);

    if (ret < 0) {
@@ -1516,7 +1505,7 @@ static int sd_create_branch(BDRVSheepdogState *s)
    }

    ret = read_object(fd, buf, vid_to_vdi_oid(vid), s->inode.nr_copies,
-                      SD_INODE_SIZE, 0, s->cache_flags);
+                      SD_INODE_SIZE, 0, s->cache_enabled);

    closesocket(fd);

@@ -1672,7 +1661,7 @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
        bs->total_sectors = sector_num + nb_sectors;
    }

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
    acb->aio_done_func = sd_write_done;
    acb->aiocb_type = AIOCB_WRITE_UDATA;

@@ -1693,7 +1682,7 @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
    SheepdogAIOCB *acb;
    int ret;

-    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors);
+    acb = sd_aio_setup(bs, qiov, sector_num, nb_sectors, NULL, NULL);
    acb->aiocb_type = AIOCB_READ_UDATA;
    acb->aio_done_func = sd_finish_aiocb;

@@ -1711,31 +1700,39 @@ static coroutine_fn int sd_co_readv(BlockDriverState *bs, int64_t sector_num,
 static int coroutine_fn sd_co_flush_to_disk(BlockDriverState *bs)
 {
    BDRVSheepdogState *s = bs->opaque;
-    SheepdogAIOCB *acb;
-    AIOReq *aio_req;
+    SheepdogObjReq hdr = { 0 };
+    SheepdogObjRsp *rsp = (SheepdogObjRsp *)&hdr;
+    SheepdogInode *inode = &s->inode;
    int ret;
+    unsigned int wlen = 0, rlen = 0;

-    if (s->cache_flags != SD_FLAG_CMD_CACHE) {
+    if (!s->cache_enabled) {
        return 0;
    }

-    acb = sd_aio_setup(bs, NULL, 0, 0);
-    acb->aiocb_type = AIOCB_FLUSH_CACHE;
-    acb->aio_done_func = sd_finish_aiocb;
+    hdr.opcode = SD_OP_FLUSH_VDI;
+    hdr.oid = vid_to_vdi_oid(inode->vdi_id);

-    aio_req = alloc_aio_req(s, acb, vid_to_vdi_oid(s->inode.vdi_id),
-                            0, 0, 0, 0, 0);
-    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-    ret = add_aio_request(s, aio_req, NULL, 0, false, acb->aiocb_type);
-    if (ret < 0) {
-        error_report("add_aio_request is failed");
-        free_aio_req(s, aio_req);
-        qemu_aio_release(acb);
+    ret = do_req(s->flush_fd, (SheepdogReq *)&hdr, NULL, &wlen, &rlen);
+    if (ret) {
+        error_report("failed to send a request to the sheep");
        return ret;
    }

-    qemu_coroutine_yield();
-    return acb->ret;
+    if (rsp->result == SD_RES_INVALID_PARMS) {
+        dprintf("disable write cache since the server doesn't support it\n");
+
+        s->cache_enabled = false;
+        closesocket(s->flush_fd);
+        return 0;
+    }
+
+    if (rsp->result != SD_RES_SUCCESS) {
+        error_report("%s", sd_strerror(rsp->result));
+        return -EIO;
+    }
+
+    return 0;
 }

 static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
@@ -1776,7 +1773,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    }

    ret = write_object(fd, (char *)&s->inode, vid_to_vdi_oid(s->inode.vdi_id),
-                       s->inode.nr_copies, datalen, 0, false, s->cache_flags);
+                       s->inode.nr_copies, datalen, 0, false, s->cache_enabled);
    if (ret < 0) {
        error_report("failed to write snapshot's inode.");
        goto cleanup;
@@ -1793,7 +1790,7 @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
    inode = (SheepdogInode *)g_malloc(datalen);

    ret = read_object(fd, (char *)inode, vid_to_vdi_oid(new_vid),
-                      s->inode.nr_copies, datalen, 0, s->cache_flags);
+                      s->inode.nr_copies, datalen, 0, s->cache_enabled);

    if (ret < 0) {
        error_report("failed to read new inode info. %s", strerror(errno));
@@ -1847,7 +1844,7 @@ static int sd_snapshot_goto(BlockDriverState *bs, const char *snapshot_id)

    buf = g_malloc(SD_INODE_SIZE);
    ret = read_object(fd, buf, vid_to_vdi_oid(vid), s->inode.nr_copies,
-                      SD_INODE_SIZE, 0, s->cache_flags);
+                      SD_INODE_SIZE, 0, s->cache_enabled);

    closesocket(fd);

@@ -1944,7 +1941,7 @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
        /* we don't need to read entire object */
        ret = read_object(fd, (char *)&inode, vid_to_vdi_oid(vid),
                          0, SD_INODE_SIZE - sizeof(inode.data_vdi_id), 0,
-                          s->cache_flags);
+                          s->cache_enabled);

        if (ret) {
            continue;
@@ -2005,11 +2002,11 @@ static int do_load_save_vmstate(BDRVSheepdogState *s, uint8_t *data,
        if (load) {
            ret = read_object(fd, (char *)data, vmstate_oid,
                              s->inode.nr_copies, data_len, offset,
-                              s->cache_flags);
+                              s->cache_enabled);
        } else {
            ret = write_object(fd, (char *)data, vmstate_oid,
                               s->inode.nr_copies, data_len, offset, create,
-                               s->cache_flags);
+                               s->cache_enabled);
        }

        if (ret < 0) {
@@ -12,8 +12,8 @@
 */

 #include "trace.h"
-#include "block/block_int.h"
-#include "block/blockjob.h"
+#include "block_int.h"
+#include "blockjob.h"
 #include "qemu/ratelimit.h"

 enum {
@@ -108,7 +108,7 @@ static void coroutine_fn stream_run(void *opaque)

 wait:
        /* Note that even when no rate limit is applied we need to yield
-         * with no pending I/O here so that bdrv_drain_all() returns.
+         * with no pending I/O here so that qemu_aio_flush() returns.
         */
        block_job_sleep_ns(&s->common, rt_clock, delay_ns);
        if (block_job_is_cancelled(&s->common)) {
@@ -50,15 +50,15 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 #if defined(CONFIG_UUID)
 #include <uuid/uuid.h>
 #else
 /* TODO: move uuid emulation to some central place in QEMU. */
-#include "sysemu/sysemu.h"     /* UUID_FMT */
+#include "sysemu.h"     /* UUID_FMT */
 typedef unsigned char uuid_t[16];
 #endif

@@ -246,7 +246,7 @@ static void vdi_header_print(VdiHeader *header)
 {
    char uuid[37];
    logout("text        %s", header->text);
-    logout("signature   0x%08x\n", header->signature);
+    logout("signature   0x%04x\n", header->signature);
    logout("header size 0x%04x\n", header->header_size);
    logout("image type  0x%04x\n", header->image_type);
    logout("image flags 0x%04x\n", header->image_flags);
@@ -369,12 +369,10 @@ static int vdi_open(BlockDriverState *bs, int flags)
    BDRVVdiState *s = bs->opaque;
    VdiHeader header;
    size_t bmap_size;
-    int ret;

    logout("\n");

-    ret = bdrv_read(bs->file, 0, (uint8_t *)&header, 1);
-    if (ret < 0) {
+    if (bdrv_read(bs->file, 0, (uint8_t *)&header, 1) < 0) {
        goto fail;
    }

@@ -392,45 +390,33 @@ static int vdi_open(BlockDriverState *bs, int flags)
        header.disk_size &= ~(SECTOR_SIZE - 1);
    }

-    if (header.signature != VDI_SIGNATURE) {
-        logout("bad vdi signature %08x\n", header.signature);
-        ret = -EMEDIUMTYPE;
-        goto fail;
-    } else if (header.version != VDI_VERSION_1_1) {
+    if (header.version != VDI_VERSION_1_1) {
        logout("unsupported version %u.%u\n",
               header.version >> 16, header.version & 0xffff);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_bmap % SECTOR_SIZE != 0) {
        /* We only support block maps which start on a sector boundary. */
        logout("unsupported block map offset 0x%x B\n", header.offset_bmap);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.offset_data % SECTOR_SIZE != 0) {
        /* We only support data blocks which start on a sector boundary. */
        logout("unsupported data offset 0x%x B\n", header.offset_data);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.sector_size != SECTOR_SIZE) {
        logout("unsupported sector size %u B\n", header.sector_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.block_size != 1 * MiB) {
        logout("unsupported block size %u B\n", header.block_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (header.disk_size >
               (uint64_t)header.blocks_in_image * header.block_size) {
        logout("unsupported disk size %" PRIu64 " B\n", header.disk_size);
-        ret = -ENOTSUP;
        goto fail;
    } else if (!uuid_is_null(header.uuid_link)) {
        logout("link uuid != 0, unsupported\n");
-        ret = -ENOTSUP;
        goto fail;
    } else if (!uuid_is_null(header.uuid_parent)) {
        logout("parent uuid != 0, unsupported\n");
-        ret = -ENOTSUP;
        goto fail;
    }

@@ -443,9 +429,10 @@ static int vdi_open(BlockDriverState *bs, int flags)

    bmap_size = header.blocks_in_image * sizeof(uint32_t);
    bmap_size = (bmap_size + SECTOR_SIZE - 1) / SECTOR_SIZE;
-    s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
-    ret = bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size);
-    if (ret < 0) {
+    if (bmap_size > 0) {
+        s->bmap = g_malloc(bmap_size * SECTOR_SIZE);
+    }
+    if (bdrv_read(bs->file, s->bmap_sector, (uint8_t *)s->bmap, bmap_size) < 0) {
        goto fail_free_bmap;
    }

@@ -461,7 +448,7 @@ static int vdi_open(BlockDriverState *bs, int flags)
    g_free(s->bmap);

 fail:
-    return ret;
+    return -1;
 }

 static int vdi_reopen_prepare(BDRVReopenState *state,
@@ -24,9 +24,9 @@
 */

 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"
 #include <zlib.h>

 #define VMDK3_MAGIC (('C' << 24) | ('O' << 16) | ('W' << 8) | 'D')
@@ -616,7 +616,7 @@ static int vmdk_open_sparse(BlockDriverState *bs,
            return vmdk_open_vmdk4(bs, file, flags);
            break;
        default:
-            return -EMEDIUMTYPE;
+            return -EINVAL;
            break;
    }
 }
@@ -641,7 +641,7 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
         * RW [size in sectors] SPARSE "file-name.vmdk"
         */
        flat_offset = -1;
-        ret = sscanf(p, "%10s %" SCNd64 " %10s \"%511[^\n\r\"]\" %" SCNd64,
+        ret = sscanf(p, "%10s %" SCNd64 " %10s %511s %" SCNd64,
                access, &sectors, type, fname, &flat_offset);
        if (ret < 4 || strcmp(access, "RW")) {
            goto next_line;
@@ -653,6 +653,14 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
            return -EINVAL;
        }

+        /* trim the quotation marks around */
+        if (fname[0] == '"') {
+            memmove(fname, fname + 1, strlen(fname));
+            if (strlen(fname) <= 1 || fname[strlen(fname) - 1] != '"') {
+                return -EINVAL;
+            }
+            fname[strlen(fname) - 1] = '\0';
+        }
        if (sectors <= 0 ||
            (strcmp(type, "FLAT") && strcmp(type, "SPARSE")) ||
            (strcmp(access, "RW"))) {
@@ -710,7 +718,7 @@ static int vmdk_open_desc_file(BlockDriverState *bs, int flags,
    }
    buf[2047] = '\0';
    if (vmdk_parse_description(buf, "createType", ct, sizeof(ct))) {
-        return -EMEDIUMTYPE;
+        return -EINVAL;
    }
    if (strcmp(ct, "monolithicFlat") &&
        strcmp(ct, "twoGbMaxExtentSparse") &&
@@ -1434,7 +1442,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    int fd, idx = 0;
    char desc[BUF_SIZE];
    int64_t total_size = 0, filesize;
-    const char *adapter_type = NULL;
    const char *backing_file = NULL;
    const char *fmt = NULL;
    int flags = 0;
@@ -1446,7 +1453,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    const char *desc_extent_line;
    char parent_desc_line[BUF_SIZE] = "";
    uint32_t parent_cid = 0xffffffff;
-    uint32_t number_heads = 16;
    const char desc_template[] =
        "# Disk DescriptorFile\n"
        "version=1\n"
@@ -1463,9 +1469,9 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
        "\n"
        "ddb.virtualHWVersion = \"%d\"\n"
        "ddb.geometry.cylinders = \"%" PRId64 "\"\n"
-        "ddb.geometry.heads = \"%d\"\n"
+        "ddb.geometry.heads = \"16\"\n"
        "ddb.geometry.sectors = \"63\"\n"
-        "ddb.adapterType = \"%s\"\n";
+        "ddb.adapterType = \"ide\"\n";

    if (filename_decompose(filename, path, prefix, postfix, PATH_MAX)) {
        return -EINVAL;
@@ -1474,8 +1480,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
    while (options && options->name) {
        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
            total_size = options->value.n;
-        } else if (!strcmp(options->name, BLOCK_OPT_ADAPTER_TYPE)) {
-            adapter_type = options->value.s;
        } else if (!strcmp(options->name, BLOCK_OPT_BACKING_FILE)) {
            backing_file = options->value.s;
        } else if (!strcmp(options->name, BLOCK_OPT_COMPAT6)) {
@@ -1485,20 +1489,6 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
        }
        options++;
    }
-    if (!adapter_type) {
-        adapter_type = "ide";
-    } else if (strcmp(adapter_type, "ide") &&
-               strcmp(adapter_type, "buslogic") &&
-               strcmp(adapter_type, "lsilogic") &&
-               strcmp(adapter_type, "legacyESX")) {
-        fprintf(stderr, "VMDK: Unknown adapter type: '%s'.\n", adapter_type);
-        return -EINVAL;
-    }
-    if (strcmp(adapter_type, "ide") != 0) {
-        /* that's the number of heads with which vmware operates when
-           creating, exporting, etc. vmdk files with a non-ide adapter type */
-        number_heads = 255;
-    }
    if (!fmt) {
        /* Default format to monolithicSparse */
        fmt = "monolithicSparse";
@@ -1586,8 +1576,7 @@ static int vmdk_create(const char *filename, QEMUOptionParameter *options)
            parent_desc_line,
            ext_desc_lines,
            (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4),
-            total_size / (int64_t)(63 * number_heads * 512), number_heads,
-                adapter_type);
+            total_size / (int64_t)(63 * 16 * 512));
    if (split || flat) {
        fd = qemu_open(filename,
                       O_WRONLY | O_CREAT | O_TRUNC | O_BINARY | O_LARGEFILE,
@@ -1671,12 +1660,6 @@ static QEMUOptionParameter vmdk_create_options[] = {
        .type = OPT_SIZE,
        .help = "Virtual disk size"
    },
-    {
-        .name = BLOCK_OPT_ADAPTER_TYPE,
-        .type = OPT_STRING,
-        .help = "Virtual adapter type, can be one of "
-                "ide (default), lsilogic, buslogic or legacyESX"
-    },
    {
        .name = BLOCK_OPT_BACKING_FILE,
        .type = OPT_STRING,
@@ -23,12 +23,9 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
-#if defined(CONFIG_UUID)
-#include <uuid/uuid.h>
-#endif
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 /**************************************************************/

@@ -163,33 +160,24 @@ static int vpc_open(BlockDriverState *bs, int flags)
    struct vhd_dyndisk_header* dyndisk_header;
    uint8_t buf[HEADER_SIZE];
    uint32_t checksum;
+    int err = -1;
    int disk_type = VHD_DYNAMIC;
-    int ret;

-    ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
-    if (ret < 0) {
+    if (bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE) != HEADER_SIZE)
        goto fail;
-    }

    footer = (struct vhd_footer*) s->footer_buf;
    if (strncmp(footer->creator, "conectix", 8)) {
        int64_t offset = bdrv_getlength(bs->file);
-        if (offset < 0) {
-            ret = offset;
-            goto fail;
-        } else if (offset < HEADER_SIZE) {
-            ret = -EINVAL;
+        if (offset < HEADER_SIZE) {
            goto fail;
        }
-
        /* If a fixed disk, the footer is found only at the end of the file */
-        ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
-                         HEADER_SIZE);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf, HEADER_SIZE)
+                != HEADER_SIZE) {
            goto fail;
        }
        if (strncmp(footer->creator, "conectix", 8)) {
-            ret = -EMEDIUMTYPE;
            goto fail;
        }
        disk_type = VHD_FIXED;
@@ -210,23 +198,20 @@ static int vpc_open(BlockDriverState *bs, int flags)
    bs->total_sectors = (int64_t)
        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;

-    /* Allow a maximum disk size of approximately 2 TB */
-    if (bs->total_sectors >= 65535LL * 255 * 255) {
-        ret = -EFBIG;
+    if (bs->total_sectors >= 65535 * 16 * 255) {
+        err = -EFBIG;
        goto fail;
    }

    if (disk_type == VHD_DYNAMIC) {
-        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
-                         HEADER_SIZE);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
+                HEADER_SIZE) != HEADER_SIZE) {
            goto fail;
        }

        dyndisk_header = (struct vhd_dyndisk_header *) buf;

        if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
-            ret = -EINVAL;
            goto fail;
        }

@@ -237,10 +222,8 @@ static int vpc_open(BlockDriverState *bs, int flags)
        s->pagetable = g_malloc(s->max_table_entries * 4);

        s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
-
-        ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
-                         s->max_table_entries * 4);
-        if (ret < 0) {
+        if (bdrv_pread(bs->file, s->bat_offset, s->pagetable,
+                s->max_table_entries * 4) != s->max_table_entries * 4) {
            goto fail;
        }

@@ -278,13 +261,8 @@ static int vpc_open(BlockDriverState *bs, int flags)
    migrate_add_blocker(s->migration_blocker);

    return 0;
-
-fail:
-    g_free(s->pagetable);
-#ifdef CACHE
-    g_free(s->pageentry_u8);
-#endif
-    return ret;
+ fail:
+    return err;
 }

 static int vpc_reopen_prepare(BDRVReopenState *state,
@@ -546,27 +524,19 @@ static coroutine_fn int vpc_co_write(BlockDriverState *bs, int64_t sector_num,
 * Note that the geometry doesn't always exactly match total_sectors but
 * may round it down.
 *
- * Returns 0 on success, -EFBIG if the size is larger than ~2 TB. Override
- * the hardware EIDE and ATA-2 limit of 16 heads (max disk size of 127 GB)
- * and instead allow up to 255 heads.
+ * Returns 0 on success, -EFBIG if the size is larger than 127 GB
 */
 static int calculate_geometry(int64_t total_sectors, uint16_t* cyls,
    uint8_t* heads, uint8_t* secs_per_cyl)
 {
    uint32_t cyls_times_heads;

-    /* Allow a maximum disk size of approximately 2 TB */
-    if (total_sectors > 65535LL * 255 * 255) {
+    if (total_sectors > 65535 * 16 * 255)
        return -EFBIG;
-    }

    if (total_sectors > 65535 * 16 * 63) {
        *secs_per_cyl = 255;
-        if (total_sectors > 65535 * 16 * 255) {
-            *heads = 255;
-        } else {
-            *heads = 16;
-        }
+        *heads = 16;
        cyls_times_heads = total_sectors / *secs_per_cyl;
    } else {
        *secs_per_cyl = 17;
@@ -769,9 +739,7 @@ static int vpc_create(const char *filename, QEMUOptionParameter *options)

    footer->type = be32_to_cpu(disk_type);

-#if defined(CONFIG_UUID)
-    uuid_generate(footer->uuid);
-#endif
+    /* TODO uuid is missing */

    footer->checksum = be32_to_cpu(vpc_checksum(buf, HEADER_SIZE));

@@ -25,9 +25,9 @@
 #include <sys/stat.h>
 #include <dirent.h>
 #include "qemu-common.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
-#include "migration/migration.h"
+#include "block_int.h"
+#include "module.h"
+#include "migration.h"

 #ifndef S_IWGRP
 #define S_IWGRP 0
@@ -529,9 +529,13 @@ static inline uint8_t fat_chksum(const direntry_t* entry)
 /* if return_time==0, this returns the fat_date, else the fat_time */
 static uint16_t fat_datetime(time_t time,int return_time) {
    struct tm* t;
+#ifdef _WIN32
+    t=localtime(&time); /* this is not thread safe */
+#else
    struct tm t1;
    t = &t1;
    localtime_r(&time,t);
+#endif
    if(return_time)
 	return cpu_to_le16((t->tm_sec/2)|(t->tm_min<<5)|(t->tm_hour<<11));
    return cpu_to_le16((t->tm_mday)|((t->tm_mon+1)<<5)|((t->tm_year-80)<<9));
@@ -22,14 +22,13 @@
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
-#include "qemu/timer.h"
-#include "block/block_int.h"
-#include "qemu/module.h"
+#include "qemu-timer.h"
+#include "block_int.h"
+#include "module.h"
 #include "qemu-common.h"
-#include "block/aio.h"
+#include "qemu-aio.h"
 #include "raw-aio.h"
-#include "qemu/event_notifier.h"
-#include "qemu/iov.h"
+#include "event_notifier.h"
 #include <windows.h>
 #include <winioctl.h>

@@ -81,7 +80,13 @@ static void win32_aio_process_completion(QEMUWin32AIOState *s,
    if (!waiocb->is_linear) {
        if (ret == 0 && waiocb->is_read) {
            QEMUIOVector *qiov = waiocb->qiov;
-            iov_from_buf(qiov->iov, qiov->niov, 0, waiocb->buf, qiov->size);
+            char *p = waiocb->buf;
+            int i;
+
+            for (i = 0; i < qiov->niov; ++i) {
+                memcpy(qiov->iov[i].iov_base, p, qiov->iov[i].iov_len);
+                p += qiov->iov[i].iov_len;
+            }
        }
        qemu_vfree(waiocb->buf);
    }
@@ -148,7 +153,13 @@ BlockDriverAIOCB *win32_aio_submit(BlockDriverState *bs,
    if (qiov->niov > 1) {
        waiocb->buf = qemu_blockalign(bs, qiov->size);
        if (type & QEMU_AIO_WRITE) {
-            iov_to_buf(qiov->iov, qiov->niov, 0, waiocb->buf, qiov->size);
+            char *p = waiocb->buf;
+            int i;
+
+            for (i = 0; i < qiov->niov; ++i) {
+                memcpy(p, qiov->iov[i].iov_base, qiov->iov[i].iov_len);
+                p += qiov->iov[i].iov_len;
+            }
        }
        waiocb->is_linear = false;
    } else {
@@ -24,15 +24,14 @@
 #ifndef BLOCK_INT_H
 #define BLOCK_INT_H

-#include "block/block.h"
-#include "qemu/option.h"
-#include "qemu/queue.h"
-#include "block/coroutine.h"
-#include "qemu/timer.h"
+#include "block.h"
+#include "qemu-option.h"
+#include "qemu-queue.h"
+#include "qemu-coroutine.h"
+#include "qemu-timer.h"
 #include "qapi-types.h"
-#include "qapi/qmp/qerror.h"
-#include "monitor/monitor.h"
-#include "qemu/hbitmap.h"
+#include "qerror.h"
+#include "monitor.h"

 #define BLOCK_FLAG_ENCRYPT          1
 #define BLOCK_FLAG_COMPAT6          4
@@ -56,7 +55,6 @@
 #define BLOCK_OPT_SUBFMT            "subformat"
 #define BLOCK_OPT_COMPAT_LEVEL      "compat"
 #define BLOCK_OPT_LAZY_REFCOUNTS    "lazy_refcounts"
-#define BLOCK_OPT_ADAPTER_TYPE      "adapter_type"

 typedef struct BdrvTrackedRequest BdrvTrackedRequest;

@@ -192,12 +190,6 @@ struct BlockDriver {

    void (*bdrv_debug_event)(BlockDriverState *bs, BlkDebugEvent event);

-    /* TODO Better pass a option string/QDict/QemuOpts to add any rule? */
-    int (*bdrv_debug_breakpoint)(BlockDriverState *bs, const char *event,
-        const char *tag);
-    int (*bdrv_debug_resume)(BlockDriverState *bs, const char *tag);
-    bool (*bdrv_debug_is_suspended)(BlockDriverState *bs, const char *tag);
-
    /*
     * Returns 1 if newly created images are guaranteed to contain only
     * zeros, 0 otherwise.
@@ -277,7 +269,8 @@ struct BlockDriverState {
    bool iostatus_enabled;
    BlockDeviceIoStatus iostatus;
    char device_name[32];
-    HBitmap *dirty_bitmap;
+    unsigned long *dirty_bitmap;
+    int64_t dirty_count;
    int in_use; /* users other than guest access, eg. block migration */
    QTAILQ_ENTRY(BlockDriverState) list;

@@ -345,8 +338,6 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,
 * @bs: Block device to operate on.
 * @target: Block device to write to.
 * @speed: The maximum speed, in bytes per second, or 0 for unlimited.
- * @granularity: The chosen granularity for the dirty bitmap.
- * @buf_size: The amount of data that can be in flight at one time.
 * @mode: Whether to collapse all images in the chain to the target.
 * @on_source_error: The action to take upon error reading from the source.
 * @on_target_error: The action to take upon error writing to the target.
@@ -360,8 +351,8 @@ void commit_start(BlockDriverState *bs, BlockDriverState *base,
 * @bs will be switched to read from @target.
 */
 void mirror_start(BlockDriverState *bs, BlockDriverState *target,
-                  int64_t speed, int64_t granularity, int64_t buf_size,
-                  MirrorSyncMode mode, BlockdevOnError on_source_error,
+                  int64_t speed, MirrorSyncMode mode,
+                  BlockdevOnError on_source_error,
                  BlockdevOnError on_target_error,
                  BlockDriverCompletionFunc *cb,
                  void *opaque, Error **errp);
@@ -9,15 +9,15 @@
 * later.  See the COPYING file in the top-level directory.
 */

-#include "sysemu/blockdev.h"
+#include "blockdev.h"
 #include "hw/block-common.h"
-#include "monitor/monitor.h"
-#include "qapi/qmp/qerror.h"
-#include "sysemu/sysemu.h"
+#include "monitor.h"
+#include "qerror.h"
+#include "sysemu.h"
 #include "qmp-commands.h"
 #include "trace.h"
-#include "block/nbd.h"
-#include "qemu/sockets.h"
+#include "nbd.h"
+#include "qemu_socket.h"

 static int server_fd = -1;

@@ -7,19 +7,19 @@
 * later.  See the COPYING file in the top-level directory.
 */

-#include "sysemu/blockdev.h"
+#include "blockdev.h"
 #include "hw/block-common.h"
-#include "block/blockjob.h"
-#include "monitor/monitor.h"
-#include "qapi/qmp/qerror.h"
-#include "qemu/option.h"
-#include "qemu/config-file.h"
-#include "qapi/qmp/types.h"
-#include "sysemu/sysemu.h"
-#include "block/block_int.h"
+#include "blockjob.h"
+#include "monitor.h"
+#include "qerror.h"
+#include "qemu-option.h"
+#include "qemu-config.h"
+#include "qemu-objects.h"
+#include "sysemu.h"
+#include "block_int.h"
 #include "qmp-commands.h"
 #include "trace.h"
-#include "sysemu/arch_init.h"
+#include "arch_init.h"

 static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);

@@ -275,7 +275,7 @@ static bool do_check_io_limits(BlockIOLimit *io_limits)
    return true;
 }

-DriveInfo *drive_init(QemuOpts *opts, BlockInterfaceType block_default_type)
+DriveInfo *drive_init(QemuOpts *opts, int default_to_scsi)
 {
    const char *buf;
    const char *file = NULL;
@@ -325,7 +325,7 @@ DriveInfo *drive_init(QemuOpts *opts, BlockInterfaceType block_default_type)
            return NULL;
 	}
    } else {
-        type = block_default_type;
+        type = default_to_scsi ? IF_SCSI : IF_IDE;
    }

    max_devs = if_max_devs[type];
@@ -568,7 +568,7 @@ DriveInfo *drive_init(QemuOpts *opts, BlockInterfaceType block_default_type)
        break;
    case IF_VIRTIO:
        /* add virtio block device */
-        opts = qemu_opts_create_nofail(qemu_find_opts("device"));
+        opts = qemu_opts_create(qemu_find_opts("device"), NULL, 0, NULL);
        if (arch_type == QEMU_ARCH_S390X) {
            qemu_opt_set(opts, "driver", "virtio-blk-s390");
        } else {
@@ -617,13 +617,8 @@ DriveInfo *drive_init(QemuOpts *opts, BlockInterfaceType block_default_type)

    ret = bdrv_open(dinfo->bdrv, file, bdrv_flags, drv);
    if (ret < 0) {
-        if (ret == -EMEDIUMTYPE) {
-            error_report("could not open disk image %s: not in %s format",
-                         file, drv->format_name);
-        } else {
-            error_report("could not open disk image %s: %s",
-                         file, strerror(-ret));
-        }
+        error_report("could not open disk image %s: %s",
+                     file, strerror(-ret));
        goto err;
    }

@@ -647,17 +642,21 @@ void do_commit(Monitor *mon, const QDict *qdict)

    if (!strcmp(device, "all")) {
        ret = bdrv_commit_all();
+        if (ret == -EBUSY) {
+            qerror_report(QERR_DEVICE_IN_USE, device);
+            return;
+        }
    } else {
        bs = bdrv_find(device);
        if (!bs) {
-            monitor_printf(mon, "Device '%s' not found\n", device);
+            qerror_report(QERR_DEVICE_NOT_FOUND, device);
            return;
        }
        ret = bdrv_commit(bs);
-    }
-    if (ret < 0) {
-        monitor_printf(mon, "'commit' error for '%s': %s\n", device,
-                       strerror(-ret));
+        if (ret == -EBUSY) {
+            qerror_report(QERR_DEVICE_IN_USE, device);
+            return;
+        }
    }
 }

@@ -708,7 +707,6 @@ void qmp_transaction(BlockdevActionList *dev_list, Error **errp)
    int ret = 0;
    BlockdevActionList *dev_entry = dev_list;
    BlkTransactionStates *states, *next;
-    Error *local_err = NULL;

    QSIMPLEQ_HEAD(snap_bdrv_states, BlkTransactionStates) snap_bdrv_states;
    QSIMPLEQ_INIT(&snap_bdrv_states);
@@ -788,12 +786,12 @@ void qmp_transaction(BlockdevActionList *dev_list, Error **errp)

        /* create new image w/backing file */
        if (mode != NEW_IMAGE_MODE_EXISTING) {
-            bdrv_img_create(new_image_file, format,
-                            states->old_bs->filename,
-                            states->old_bs->drv->format_name,
-                            NULL, -1, flags, &local_err);
-            if (error_is_set(&local_err)) {
-                error_propagate(errp, local_err);
+            ret = bdrv_img_create(new_image_file, format,
+                                  states->old_bs->filename,
+                                  states->old_bs->drv->format_name,
+                                  NULL, -1, flags);
+            if (ret) {
+                error_set(errp, QERR_OPEN_FILE_FAILED, new_image_file);
                goto delete_and_fail;
            }
        }
@@ -1043,9 +1041,6 @@ void qmp_block_resize(const char *device, int64_t size, Error **errp)
        return;
    }

-    /* complete all in-flight operations before resizing the device */
-    bdrv_drain_all();
-
    switch (bdrv_truncate(bs, size)) {
    case 0:
        break;
@@ -1192,19 +1187,16 @@ void qmp_block_commit(const char *device,
    drive_get_ref(drive_get_by_blockdev(bs));
 }

-#define DEFAULT_MIRROR_BUF_SIZE   (10 << 20)
-
 void qmp_drive_mirror(const char *device, const char *target,
                      bool has_format, const char *format,
                      enum MirrorSyncMode sync,
                      bool has_mode, enum NewImageMode mode,
                      bool has_speed, int64_t speed,
-                      bool has_granularity, uint32_t granularity,
-                      bool has_buf_size, int64_t buf_size,
                      bool has_on_source_error, BlockdevOnError on_source_error,
                      bool has_on_target_error, BlockdevOnError on_target_error,
                      Error **errp)
 {
+    BlockDriverInfo bdi;
    BlockDriverState *bs;
    BlockDriverState *source, *target_bs;
    BlockDriver *proto_drv;
@@ -1226,21 +1218,6 @@ void qmp_drive_mirror(const char *device, const char *target,
    if (!has_mode) {
        mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
    }
-    if (!has_granularity) {
-        granularity = 0;
-    }
-    if (!has_buf_size) {
-        buf_size = DEFAULT_MIRROR_BUF_SIZE;
-    }
-
-    if (granularity != 0 && (granularity < 512 || granularity > 1048576 * 64)) {
-        error_set(errp, QERR_INVALID_PARAMETER, device);
-        return;
-    }
-    if (granularity & (granularity - 1)) {
-        error_set(errp, QERR_INVALID_PARAMETER, device);
-        return;
-    }

    bs = bdrv_find(device);
    if (!bs) {
@@ -1281,13 +1258,13 @@ void qmp_drive_mirror(const char *device, const char *target,
        return;
    }

-    bdrv_get_geometry(bs, &size);
-    size *= 512;
    if (sync == MIRROR_SYNC_MODE_FULL && mode != NEW_IMAGE_MODE_EXISTING) {
        /* create new image w/o backing file */
        assert(format && drv);
-        bdrv_img_create(target, format,
-                        NULL, NULL, NULL, size, flags, &local_err);
+        bdrv_get_geometry(bs, &size);
+        size *= 512;
+        ret = bdrv_img_create(target, format,
+                              NULL, NULL, NULL, size, flags);
    } else {
        switch (mode) {
        case NEW_IMAGE_MODE_EXISTING:
@@ -1295,24 +1272,21 @@ void qmp_drive_mirror(const char *device, const char *target,
            break;
        case NEW_IMAGE_MODE_ABSOLUTE_PATHS:
            /* create new image with backing file */
-            bdrv_img_create(target, format,
-                            source->filename,
-                            source->drv->format_name,
-                            NULL, size, flags, &local_err);
+            ret = bdrv_img_create(target, format,
+                                  source->filename,
+                                  source->drv->format_name,
+                                  NULL, -1, flags);
            break;
        default:
            abort();
        }
    }

-    if (error_is_set(&local_err)) {
-        error_propagate(errp, local_err);
+    if (ret) {
+        error_set(errp, QERR_OPEN_FILE_FAILED, target);
        return;
    }

-    /* Mirroring takes care of copy-on-write using the source's backing
-     * file.
-     */
    target_bs = bdrv_new("");
    ret = bdrv_open(target_bs, target, flags | BDRV_O_NO_BACKING, drv);

@@ -1322,8 +1296,18 @@ void qmp_drive_mirror(const char *device, const char *target,
        return;
    }

-    mirror_start(bs, target_bs, speed, granularity, buf_size, sync,
-                 on_source_error, on_target_error,
+    /* We need a backing file if we will copy parts of a cluster.  */
+    if (bdrv_get_info(target_bs, &bdi) >= 0 && bdi.cluster_size != 0 &&
+        bdi.cluster_size >= BDRV_SECTORS_PER_DIRTY_CHUNK * 512) {
+        ret = bdrv_open_backing_file(target_bs);
+        if (ret < 0) {
+            bdrv_delete(target_bs);
+            error_set(errp, QERR_OPEN_FILE_FAILED, target);
+            return;
+        }
+    }
+
+    mirror_start(bs, target_bs, speed, sync, on_source_error, on_target_error,
                 block_job_cb, bs, &local_err);
    if (local_err != NULL) {
        bdrv_delete(target_bs);
@@ -1442,121 +1426,3 @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
    bdrv_iterate(do_qmp_query_block_jobs_one, &prev);
    return dummy.next;
 }
-
-QemuOptsList qemu_drive_opts = {
-    .name = "drive",
-    .head = QTAILQ_HEAD_INITIALIZER(qemu_drive_opts.head),
-    .desc = {
-        {
-            .name = "bus",
-            .type = QEMU_OPT_NUMBER,
-            .help = "bus number",
-        },{
-            .name = "unit",
-            .type = QEMU_OPT_NUMBER,
-            .help = "unit number (i.e. lun for scsi)",
-        },{
-            .name = "if",
-            .type = QEMU_OPT_STRING,
-            .help = "interface (ide, scsi, sd, mtd, floppy, pflash, virtio)",
-        },{
-            .name = "index",
-            .type = QEMU_OPT_NUMBER,
-            .help = "index number",
-        },{
-            .name = "cyls",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of cylinders (ide disk geometry)",
-        },{
-            .name = "heads",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of heads (ide disk geometry)",
-        },{
-            .name = "secs",
-            .type = QEMU_OPT_NUMBER,
-            .help = "number of sectors (ide disk geometry)",
-        },{
-            .name = "trans",
-            .type = QEMU_OPT_STRING,
-            .help = "chs translation (auto, lba. none)",
-        },{
-            .name = "media",
-            .type = QEMU_OPT_STRING,
-            .help = "media type (disk, cdrom)",
-        },{
-            .name = "snapshot",
-            .type = QEMU_OPT_BOOL,
-            .help = "enable/disable snapshot mode",
-        },{
-            .name = "file",
-            .type = QEMU_OPT_STRING,
-            .help = "disk image",
-        },{
-            .name = "cache",
-            .type = QEMU_OPT_STRING,
-            .help = "host cache usage (none, writeback, writethrough, "
-                    "directsync, unsafe)",
-        },{
-            .name = "aio",
-            .type = QEMU_OPT_STRING,
-            .help = "host AIO implementation (threads, native)",
-        },{
-            .name = "format",
-            .type = QEMU_OPT_STRING,
-            .help = "disk format (raw, qcow2, ...)",
-        },{
-            .name = "serial",
-            .type = QEMU_OPT_STRING,
-            .help = "disk serial number",
-        },{
-            .name = "rerror",
-            .type = QEMU_OPT_STRING,
-            .help = "read error action",
-        },{
-            .name = "werror",
-            .type = QEMU_OPT_STRING,
-            .help = "write error action",
-        },{
-            .name = "addr",
-            .type = QEMU_OPT_STRING,
-            .help = "pci address (virtio only)",
-        },{
-            .name = "readonly",
-            .type = QEMU_OPT_BOOL,
-            .help = "open drive file as read-only",
-        },{
-            .name = "iops",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit total I/O operations per second",
-        },{
-            .name = "iops_rd",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit read operations per second",
-        },{
-            .name = "iops_wr",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit write operations per second",
-        },{
-            .name = "bps",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit total bytes per second",
-        },{
-            .name = "bps_rd",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit read bytes per second",
-        },{
-            .name = "bps_wr",
-            .type = QEMU_OPT_NUMBER,
-            .help = "limit write bytes per second",
-        },{
-            .name = "copy-on-read",
-            .type = QEMU_OPT_BOOL,
-            .help = "copy read data from backing file into image file",
-        },{
-            .name = "boot",
-            .type = QEMU_OPT_BOOL,
-            .help = "(deprecated, ignored)",
-        },
-        { /* end of list */ }
-    },
-};
@@ -10,22 +10,17 @@
 #ifndef BLOCKDEV_H
 #define BLOCKDEV_H

-#include "block/block.h"
-#include "qapi/error.h"
-#include "qemu/queue.h"
+#include "block.h"
+#include "error.h"
+#include "qemu-queue.h"

 void blockdev_mark_auto_del(BlockDriverState *bs);
 void blockdev_auto_del(BlockDriverState *bs);

 typedef enum {
    IF_DEFAULT = -1,            /* for use with drive_add() only */
-    /*
-     * IF_IDE must be zero, because we want QEMUMachine member
-     * block_default_type to default-initialize to IF_IDE
-     */
-    IF_IDE = 0,
    IF_NONE,
-    IF_SCSI, IF_FLOPPY, IF_PFLASH, IF_MTD, IF_SD, IF_VIRTIO, IF_XEN,
+    IF_IDE, IF_SCSI, IF_FLOPPY, IF_PFLASH, IF_MTD, IF_SD, IF_VIRTIO, IF_XEN,
    IF_COUNT
 } BlockInterfaceType;

@@ -56,7 +51,7 @@ DriveInfo *drive_get_by_blockdev(BlockDriverState *bs);
 QemuOpts *drive_def(const char *optstr);
 QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file,
                    const char *optstr);
-DriveInfo *drive_init(QemuOpts *arg, BlockInterfaceType block_default_type);
+DriveInfo *drive_init(QemuOpts *arg, int default_to_scsi);

 /* device-hotplug */

@@ -26,14 +26,14 @@
 #include "config-host.h"
 #include "qemu-common.h"
 #include "trace.h"
-#include "monitor/monitor.h"
-#include "block/block.h"
-#include "block/blockjob.h"
-#include "block/block_int.h"
-#include "qapi/qmp/qjson.h"
-#include "block/coroutine.h"
+#include "monitor.h"
+#include "block.h"
+#include "blockjob.h"
+#include "block_int.h"
+#include "qjson.h"
+#include "qemu-coroutine.h"
 #include "qmp-commands.h"
-#include "qemu/timer.h"
+#include "qemu-timer.h"

 void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
                       int64_t speed, BlockDriverCompletionFunc *cb,
@@ -25,7 +25,7 @@
 #ifndef BLOCKJOB_H
 #define BLOCKJOB_H 1

-#include "block/block.h"
+#include "block.h"

 /**
 * BlockJobType:
@@ -10,7 +10,7 @@
 #include <string.h>

 #include "qemu.h"
-#include "disas/disas.h"
+#include "disas.h"

 #ifdef _ARCH_PPC64
 #undef ARCH_DLINFO
@@ -31,8 +31,8 @@
 /* For tb_lock */
 #include "cpu.h"
 #include "tcg.h"
-#include "qemu/timer.h"
-#include "qemu/envlist.h"
+#include "qemu-timer.h"
+#include "envlist.h"

 #define DEBUG_LOGFILE "/tmp/qemu.log"

@@ -917,7 +917,7 @@ int main(int argc, char **argv)
        fprintf(stderr, "Unable to find CPU definition\n");
        exit(1);
    }
-#if defined(TARGET_SPARC) || defined(TARGET_PPC)
+#if defined(TARGET_I386) || defined(TARGET_SPARC) || defined(TARGET_PPC)
    cpu_reset(ENV_GET_CPU(env));
 #endif
    thread_env = env;
@@ -74,7 +74,7 @@ void mmap_unlock(void)
 }
 #endif

-static void *bsd_vmalloc(size_t size)
+void *qemu_vmalloc(size_t size)
 {
    void *p;
    mmap_lock();
@@ -98,7 +98,7 @@ void *g_malloc(size_t size)
 {
    char * p;
    size += 16;
-    p = bsd_vmalloc(size);
+    p = qemu_vmalloc(size);
    *(size_t *)p = size;
    return p + 16;
 }
@@ -0,0 +1,24 @@
+#ifndef QEMU_TYPES_H
+#define QEMU_TYPES_H
+#include "cpu.h"
+
+#ifdef TARGET_ABI32
+typedef uint32_t abi_ulong;
+typedef int32_t abi_long;
+#define TARGET_ABI_FMT_lx "%08x"
+#define TARGET_ABI_FMT_ld "%d"
+#define TARGET_ABI_FMT_lu "%u"
+#define TARGET_ABI_BITS 32
+#else
+typedef target_ulong abi_ulong;
+typedef target_long abi_long;
+#define TARGET_ABI_FMT_lx TARGET_FMT_lx
+#define TARGET_ABI_FMT_ld TARGET_FMT_ld
+#define TARGET_ABI_FMT_lu TARGET_FMT_lu
+#define TARGET_ABI_BITS TARGET_LONG_BITS
+/* for consistency, define ABI32 too */
+#if TARGET_ABI_BITS == 32
+#define TARGET_ABI32 1
+#endif
+#endif
+#endif
@@ -11,7 +11,7 @@
 #include <stdlib.h>
 #endif /* DEBUG_REMAP */

-#include "exec/user/abitypes.h"
+#include "qemu-types.h"

 enum BSDType {
    target_freebsd,
@@ -23,7 +23,7 @@ extern enum BSDType bsd_type;
 #include "syscall_defs.h"
 #include "syscall.h"
 #include "target_signal.h"
-#include "exec/gdbstub.h"
+#include "gdbstub.h"

 #if defined(CONFIG_USE_NPTL)
 #define THREAD __thread
@@ -146,7 +146,7 @@ int get_osversion(void);
 void fork_start(void);
 void fork_end(int child);

-#include "qemu/log.h"
+#include "qemu-log.h"

 /* strace.c */
 void
@@ -0,0 +1,713 @@
+#ifndef BSWAP_H
+#define BSWAP_H
+
+#include "config-host.h"
+
+#include <inttypes.h>
+#include "softfloat.h"
+
+#ifdef CONFIG_MACHINE_BSWAP_H
+#include <sys/endian.h>
+#include <sys/types.h>
+#include <machine/bswap.h>
+#else
+
+#ifdef CONFIG_BYTESWAP_H
+#include <byteswap.h>
+#else
+
+#define bswap_16(x) \
+({ \
+	uint16_t __x = (x); \
+	((uint16_t)( \
+		(((uint16_t)(__x) & (uint16_t)0x00ffU) << 8) | \
+		(((uint16_t)(__x) & (uint16_t)0xff00U) >> 8) )); \
+})
+
+#define bswap_32(x) \
+({ \
+	uint32_t __x = (x); \
+	((uint32_t)( \
+		(((uint32_t)(__x) & (uint32_t)0x000000ffUL) << 24) | \
+		(((uint32_t)(__x) & (uint32_t)0x0000ff00UL) <<  8) | \
+		(((uint32_t)(__x) & (uint32_t)0x00ff0000UL) >>  8) | \
+		(((uint32_t)(__x) & (uint32_t)0xff000000UL) >> 24) )); \
+})
+
+#define bswap_64(x) \
+({ \
+	uint64_t __x = (x); \
+	((uint64_t)( \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x00000000000000ffULL) << 56) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x000000000000ff00ULL) << 40) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x0000000000ff0000ULL) << 24) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x00000000ff000000ULL) <<  8) | \
+	        (uint64_t)(((uint64_t)(__x) & (uint64_t)0x000000ff00000000ULL) >>  8) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x0000ff0000000000ULL) >> 24) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0x00ff000000000000ULL) >> 40) | \
+		(uint64_t)(((uint64_t)(__x) & (uint64_t)0xff00000000000000ULL) >> 56) )); \
+})
+
+#endif /* !CONFIG_BYTESWAP_H */
+
+static inline uint16_t bswap16(uint16_t x)
+{
+    return bswap_16(x);
+}
+
+static inline uint32_t bswap32(uint32_t x)
+{
+    return bswap_32(x);
+}
+
+static inline uint64_t bswap64(uint64_t x)
+{
+    return bswap_64(x);
+}
+
+#endif /* ! CONFIG_MACHINE_BSWAP_H */
+
+static inline void bswap16s(uint16_t *s)
+{
+    *s = bswap16(*s);
+}
+
+static inline void bswap32s(uint32_t *s)
+{
+    *s = bswap32(*s);
+}
+
+static inline void bswap64s(uint64_t *s)
+{
+    *s = bswap64(*s);
+}
+
+#if defined(HOST_WORDS_BIGENDIAN)
+#define be_bswap(v, size) (v)
+#define le_bswap(v, size) bswap ## size(v)
+#define be_bswaps(v, size)
+#define le_bswaps(p, size) *p = bswap ## size(*p);
+#else
+#define le_bswap(v, size) (v)
+#define be_bswap(v, size) bswap ## size(v)
+#define le_bswaps(v, size)
+#define be_bswaps(p, size) *p = bswap ## size(*p);
+#endif
+
+#define CPU_CONVERT(endian, size, type)\
+static inline type endian ## size ## _to_cpu(type v)\
+{\
+    return endian ## _bswap(v, size);\
+}\
+\
+static inline type cpu_to_ ## endian ## size(type v)\
+{\
+    return endian ## _bswap(v, size);\
+}\
+\
+static inline void endian ## size ## _to_cpus(type *p)\
+{\
+    endian ## _bswaps(p, size)\
+}\
+\
+static inline void cpu_to_ ## endian ## size ## s(type *p)\
+{\
+    endian ## _bswaps(p, size)\
+}\
+\
+static inline type endian ## size ## _to_cpup(const type *p)\
+{\
+    return endian ## size ## _to_cpu(*p);\
+}\
+\
+static inline void cpu_to_ ## endian ## size ## w(type *p, type v)\
+{\
+     *p = cpu_to_ ## endian ## size(v);\
+}
+
+CPU_CONVERT(be, 16, uint16_t)
+CPU_CONVERT(be, 32, uint32_t)
+CPU_CONVERT(be, 64, uint64_t)
+
+CPU_CONVERT(le, 16, uint16_t)
+CPU_CONVERT(le, 32, uint32_t)
+CPU_CONVERT(le, 64, uint64_t)
+
+/* unaligned versions (optimized for frequent unaligned accesses)*/
+
+#if defined(__i386__) || defined(_ARCH_PPC)
+
+#define cpu_to_le16wu(p, v) cpu_to_le16w(p, v)
+#define cpu_to_le32wu(p, v) cpu_to_le32w(p, v)
+#define le16_to_cpupu(p) le16_to_cpup(p)
+#define le32_to_cpupu(p) le32_to_cpup(p)
+#define be32_to_cpupu(p) be32_to_cpup(p)
+
+#define cpu_to_be16wu(p, v) cpu_to_be16w(p, v)
+#define cpu_to_be32wu(p, v) cpu_to_be32w(p, v)
+#define cpu_to_be64wu(p, v) cpu_to_be64w(p, v)
+
+#else
+
+static inline void cpu_to_le16wu(uint16_t *p, uint16_t v)
+{
+    uint8_t *p1 = (uint8_t *)p;
+
+    p1[0] = v & 0xff;
+    p1[1] = v >> 8;
+}
+
+static inline void cpu_to_le32wu(uint32_t *p, uint32_t v)
+{
+    uint8_t *p1 = (uint8_t *)p;
+
+    p1[0] = v & 0xff;
+    p1[1] = v >> 8;
+    p1[2] = v >> 16;
+    p1[3] = v >> 24;
+}
+
+static inline uint16_t le16_to_cpupu(const uint16_t *p)
+{
+    const uint8_t *p1 = (const uint8_t *)p;
+    return p1[0] | (p1[1] << 8);
+}
+
+static inline uint32_t le32_to_cpupu(const uint32_t *p)
+{
+    const uint8_t *p1 = (const uint8_t *)p;
+    return p1[0] | (p1[1] << 8) | (p1[2] << 16) | (p1[3] << 24);
+}
+
+static inline uint32_t be32_to_cpupu(const uint32_t *p)
+{
+    const uint8_t *p1 = (const uint8_t *)p;
+    return p1[3] | (p1[2] << 8) | (p1[1] << 16) | (p1[0] << 24);
+}
+
+static inline void cpu_to_be16wu(uint16_t *p, uint16_t v)
+{
+    uint8_t *p1 = (uint8_t *)p;
+
+    p1[0] = v >> 8;
+    p1[1] = v & 0xff;
+}
+
+static inline void cpu_to_be32wu(uint32_t *p, uint32_t v)
+{
+    uint8_t *p1 = (uint8_t *)p;
+
+    p1[0] = v >> 24;
+    p1[1] = v >> 16;
+    p1[2] = v >> 8;
+    p1[3] = v & 0xff;
+}
+
+static inline void cpu_to_be64wu(uint64_t *p, uint64_t v)
+{
+    uint8_t *p1 = (uint8_t *)p;
+
+    p1[0] = v >> 56;
+    p1[1] = v >> 48;
+    p1[2] = v >> 40;
+    p1[3] = v >> 32;
+    p1[4] = v >> 24;
+    p1[5] = v >> 16;
+    p1[6] = v >> 8;
+    p1[7] = v & 0xff;
+}
+
+#endif
+
+#ifdef HOST_WORDS_BIGENDIAN
+#define cpu_to_32wu cpu_to_be32wu
+#define leul_to_cpu(v) glue(glue(le,HOST_LONG_BITS),_to_cpu)(v)
+#else
+#define cpu_to_32wu cpu_to_le32wu
+#define leul_to_cpu(v) (v)
+#endif
+
+#undef le_bswap
+#undef be_bswap
+#undef le_bswaps
+#undef be_bswaps
+
+/* len must be one of 1, 2, 4 */
+static inline uint32_t qemu_bswap_len(uint32_t value, int len)
+{
+    return bswap32(value) >> (32 - 8 * len);
+}
+
+typedef union {
+    float32 f;
+    uint32_t l;
+} CPU_FloatU;
+
+typedef union {
+    float64 d;
+#if defined(HOST_WORDS_BIGENDIAN)
+    struct {
+        uint32_t upper;
+        uint32_t lower;
+    } l;
+#else
+    struct {
+        uint32_t lower;
+        uint32_t upper;
+    } l;
+#endif
+    uint64_t ll;
+} CPU_DoubleU;
+
+typedef union {
+     floatx80 d;
+     struct {
+         uint64_t lower;
+         uint16_t upper;
+     } l;
+} CPU_LDoubleU;
+
+typedef union {
+    float128 q;
+#if defined(HOST_WORDS_BIGENDIAN)
+    struct {
+        uint32_t upmost;
+        uint32_t upper;
+        uint32_t lower;
+        uint32_t lowest;
+    } l;
+    struct {
+        uint64_t upper;
+        uint64_t lower;
+    } ll;
+#else
+    struct {
+        uint32_t lowest;
+        uint32_t lower;
+        uint32_t upper;
+        uint32_t upmost;
+    } l;
+    struct {
+        uint64_t lower;
+        uint64_t upper;
+    } ll;
+#endif
+} CPU_QuadU;
+
+/* unaligned/endian-independent pointer access */
+
+/*
+ * the generic syntax is:
+ *
+ * load: ld{type}{sign}{size}{endian}_p(ptr)
+ *
+ * store: st{type}{size}{endian}_p(ptr, val)
+ *
+ * Note there are small differences with the softmmu access API!
+ *
+ * type is:
+ * (empty): integer access
+ *   f    : float access
+ *
+ * sign is:
+ * (empty): for floats or 32 bit size
+ *   u    : unsigned
+ *   s    : signed
+ *
+ * size is:
+ *   b: 8 bits
+ *   w: 16 bits
+ *   l: 32 bits
+ *   q: 64 bits
+ *
+ * endian is:
+ * (empty): 8 bit access
+ *   be   : big endian
+ *   le   : little endian
+ */
+static inline int ldub_p(const void *ptr)
+{
+    return *(uint8_t *)ptr;
+}
+
+static inline int ldsb_p(const void *ptr)
+{
+    return *(int8_t *)ptr;
+}
+
+static inline void stb_p(void *ptr, int v)
+{
+    *(uint8_t *)ptr = v;
+}
+
+/* NOTE: on arm, putting 2 in /proc/sys/debug/alignment so that the
+   kernel handles unaligned load/stores may give better results, but
+   it is a system wide setting : bad */
+#if defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
+
+/* conservative code for little endian unaligned accesses */
+static inline int lduw_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return val;
+#else
+    const uint8_t *p = ptr;
+    return p[0] | (p[1] << 8);
+#endif
+}
+
+static inline int ldsw_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lhbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return (int16_t)val;
+#else
+    const uint8_t *p = ptr;
+    return (int16_t)(p[0] | (p[1] << 8));
+#endif
+}
+
+static inline int ldl_le_p(const void *ptr)
+{
+#ifdef _ARCH_PPC
+    int val;
+    __asm__ __volatile__ ("lwbrx %0,0,%1" : "=r" (val) : "r" (ptr));
+    return val;
+#else
+    const uint8_t *p = ptr;
+    return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
+#endif
+}
+
+static inline uint64_t ldq_le_p(const void *ptr)
+{
+    const uint8_t *p = ptr;
+    uint32_t v1, v2;
+    v1 = ldl_le_p(p);
+    v2 = ldl_le_p(p + 4);
+    return v1 | ((uint64_t)v2 << 32);
+}
+
+static inline void stw_le_p(void *ptr, int v)
+{
+#ifdef _ARCH_PPC
+    __asm__ __volatile__ ("sthbrx %1,0,%2" : "=m" (*(uint16_t *)ptr) : "r" (v), "r" (ptr));
+#else
+    uint8_t *p = ptr;
+    p[0] = v;
+    p[1] = v >> 8;
+#endif
+}
+
+static inline void stl_le_p(void *ptr, int v)
+{
+#ifdef _ARCH_PPC
+    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
+#else
+    uint8_t *p = ptr;
+    p[0] = v;
+    p[1] = v >> 8;
+    p[2] = v >> 16;
+    p[3] = v >> 24;
+#endif
+}
+
+static inline void stq_le_p(void *ptr, uint64_t v)
+{
+    uint8_t *p = ptr;
+    stl_le_p(p, (uint32_t)v);
+    stl_le_p(p + 4, v >> 32);
+}
+
+/* float access */
+
+static inline float32 ldfl_le_p(const void *ptr)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.i = ldl_le_p(ptr);
+    return u.f;
+}
+
+static inline void stfl_le_p(void *ptr, float32 v)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.f = v;
+    stl_le_p(ptr, u.i);
+}
+
+static inline float64 ldfq_le_p(const void *ptr)
+{
+    CPU_DoubleU u;
+    u.l.lower = ldl_le_p(ptr);
+    u.l.upper = ldl_le_p(ptr + 4);
+    return u.d;
+}
+
+static inline void stfq_le_p(void *ptr, float64 v)
+{
+    CPU_DoubleU u;
+    u.d = v;
+    stl_le_p(ptr, u.l.lower);
+    stl_le_p(ptr + 4, u.l.upper);
+}
+
+#else
+
+static inline int lduw_le_p(const void *ptr)
+{
+    return *(uint16_t *)ptr;
+}
+
+static inline int ldsw_le_p(const void *ptr)
+{
+    return *(int16_t *)ptr;
+}
+
+static inline int ldl_le_p(const void *ptr)
+{
+    return *(uint32_t *)ptr;
+}
+
+static inline uint64_t ldq_le_p(const void *ptr)
+{
+    return *(uint64_t *)ptr;
+}
+
+static inline void stw_le_p(void *ptr, int v)
+{
+    *(uint16_t *)ptr = v;
+}
+
+static inline void stl_le_p(void *ptr, int v)
+{
+    *(uint32_t *)ptr = v;
+}
+
+static inline void stq_le_p(void *ptr, uint64_t v)
+{
+    *(uint64_t *)ptr = v;
+}
+
+/* float access */
+
+static inline float32 ldfl_le_p(const void *ptr)
+{
+    return *(float32 *)ptr;
+}
+
+static inline float64 ldfq_le_p(const void *ptr)
+{
+    return *(float64 *)ptr;
+}
+
+static inline void stfl_le_p(void *ptr, float32 v)
+{
+    *(float32 *)ptr = v;
+}
+
+static inline void stfq_le_p(void *ptr, float64 v)
+{
+    *(float64 *)ptr = v;
+}
+#endif
+
+#if !defined(HOST_WORDS_BIGENDIAN) || defined(WORDS_ALIGNED)
+
+static inline int lduw_be_p(const void *ptr)
+{
+#if defined(__i386__)
+    int val;
+    asm volatile ("movzwl %1, %0\n"
+                  "xchgb %b0, %h0\n"
+                  : "=q" (val)
+                  : "m" (*(uint16_t *)ptr));
+    return val;
+#else
+    const uint8_t *b = ptr;
+    return ((b[0] << 8) | b[1]);
+#endif
+}
+
+static inline int ldsw_be_p(const void *ptr)
+{
+#if defined(__i386__)
+    int val;
+    asm volatile ("movzwl %1, %0\n"
+                  "xchgb %b0, %h0\n"
+                  : "=q" (val)
+                  : "m" (*(uint16_t *)ptr));
+    return (int16_t)val;
+#else
+    const uint8_t *b = ptr;
+    return (int16_t)((b[0] << 8) | b[1]);
+#endif
+}
+
+static inline int ldl_be_p(const void *ptr)
+{
+#if defined(__i386__) || defined(__x86_64__)
+    int val;
+    asm volatile ("movl %1, %0\n"
+                  "bswap %0\n"
+                  : "=r" (val)
+                  : "m" (*(uint32_t *)ptr));
+    return val;
+#else
+    const uint8_t *b = ptr;
+    return (b[0] << 24) | (b[1] << 16) | (b[2] << 8) | b[3];
+#endif
+}
+
+static inline uint64_t ldq_be_p(const void *ptr)
+{
+    uint32_t a,b;
+    a = ldl_be_p(ptr);
+    b = ldl_be_p((uint8_t *)ptr + 4);
+    return (((uint64_t)a<<32)|b);
+}
+
+static inline void stw_be_p(void *ptr, int v)
+{
+#if defined(__i386__)
+    asm volatile ("xchgb %b0, %h0\n"
+                  "movw %w0, %1\n"
+                  : "=q" (v)
+                  : "m" (*(uint16_t *)ptr), "0" (v));
+#else
+    uint8_t *d = (uint8_t *) ptr;
+    d[0] = v >> 8;
+    d[1] = v;
+#endif
+}
+
+static inline void stl_be_p(void *ptr, int v)
+{
+#if defined(__i386__) || defined(__x86_64__)
+    asm volatile ("bswap %0\n"
+                  "movl %0, %1\n"
+                  : "=r" (v)
+                  : "m" (*(uint32_t *)ptr), "0" (v));
+#else
+    uint8_t *d = (uint8_t *) ptr;
+    d[0] = v >> 24;
+    d[1] = v >> 16;
+    d[2] = v >> 8;
+    d[3] = v;
+#endif
+}
+
+static inline void stq_be_p(void *ptr, uint64_t v)
+{
+    stl_be_p(ptr, v >> 32);
+    stl_be_p((uint8_t *)ptr + 4, v);
+}
+
+/* float access */
+
+static inline float32 ldfl_be_p(const void *ptr)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.i = ldl_be_p(ptr);
+    return u.f;
+}
+
+static inline void stfl_be_p(void *ptr, float32 v)
+{
+    union {
+        float32 f;
+        uint32_t i;
+    } u;
+    u.f = v;
+    stl_be_p(ptr, u.i);
+}
+
+static inline float64 ldfq_be_p(const void *ptr)
+{
+    CPU_DoubleU u;
+    u.l.upper = ldl_be_p(ptr);
+    u.l.lower = ldl_be_p((uint8_t *)ptr + 4);
+    return u.d;
+}
+
+static inline void stfq_be_p(void *ptr, float64 v)
+{
+    CPU_DoubleU u;
+    u.d = v;
+    stl_be_p(ptr, u.l.upper);
+    stl_be_p((uint8_t *)ptr + 4, u.l.lower);
+}
+
+#else
+
+static inline int lduw_be_p(const void *ptr)
+{
+    return *(uint16_t *)ptr;
+}
+
+static inline int ldsw_be_p(const void *ptr)
+{
+    return *(int16_t *)ptr;
+}
+
+static inline int ldl_be_p(const void *ptr)
+{
+    return *(uint32_t *)ptr;
+}
+
+static inline uint64_t ldq_be_p(const void *ptr)
+{
+    return *(uint64_t *)ptr;
+}
+
+static inline void stw_be_p(void *ptr, int v)
+{
+    *(uint16_t *)ptr = v;
+}
+
+static inline void stl_be_p(void *ptr, int v)
+{
+    *(uint32_t *)ptr = v;
+}
+
+static inline void stq_be_p(void *ptr, uint64_t v)
+{
+    *(uint64_t *)ptr = v;
+}
+
+/* float access */
+
+static inline float32 ldfl_be_p(const void *ptr)
+{
+    return *(float32 *)ptr;
+}
+
+static inline float64 ldfq_be_p(const void *ptr)
+{
+    return *(float64 *)ptr;
+}
+
+static inline void stfl_be_p(void *ptr, float32 v)
+{
+    *(float32 *)ptr = v;
+}
+
+static inline void stfq_be_p(void *ptr, float64 v)
+{
+    *(float64 *)ptr = v;
+}
+
+#endif
+
+#endif /* BSWAP_H */
@@ -18,8 +18,9 @@
 */

 #include "qemu-common.h"
-#include "bt/bt.h"
-#include "qemu/main-loop.h"
+#include "qemu-char.h"
+#include "net.h"
+#include "bt-host.h"

 #ifndef _WIN32
 # include <errno.h>
@@ -0,0 +1,9 @@
+#ifndef BT_HOST_H
+#define BT_HOST_H
+
+struct HCIInfo;
+
+/* bt-host.c */
+struct HCIInfo *bt_host_hci(const char *id);
+
+#endif
@@ -18,9 +18,9 @@
 */

 #include "qemu-common.h"
-#include "bt/bt.h"
+#include "qemu-char.h"
+#include "net.h"
 #include "hw/bt.h"
-#include "qemu/main-loop.h"

 #define VHCI_DEV	"/dev/vhci"
 #define VHCI_UDEV	"/dev/hci_vhci"
@@ -0,0 +1,269 @@
+/*
+ * QEMU buffered QEMUFile
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu-common.h"
+#include "hw/hw.h"
+#include "qemu-timer.h"
+#include "qemu-char.h"
+#include "buffered_file.h"
+
+//#define DEBUG_BUFFERED_FILE
+
+typedef struct QEMUFileBuffered
+{
+    MigrationState *migration_state;
+    QEMUFile *file;
+    int freeze_output;
+    size_t bytes_xfer;
+    size_t xfer_limit;
+    uint8_t *buffer;
+    size_t buffer_size;
+    size_t buffer_capacity;
+    QEMUTimer *timer;
+} QEMUFileBuffered;
+
+#ifdef DEBUG_BUFFERED_FILE
+#define DPRINTF(fmt, ...) \
+    do { printf("buffered-file: " fmt, ## __VA_ARGS__); } while (0)
+#else
+#define DPRINTF(fmt, ...) \
+    do { } while (0)
+#endif
+
+static void buffered_append(QEMUFileBuffered *s,
+                            const uint8_t *buf, size_t size)
+{
+    if (size > (s->buffer_capacity - s->buffer_size)) {
+        DPRINTF("increasing buffer capacity from %zu by %zu\n",
+                s->buffer_capacity, size + 1024);
+
+        s->buffer_capacity += size + 1024;
+
+        s->buffer = g_realloc(s->buffer, s->buffer_capacity);
+    }
+
+    memcpy(s->buffer + s->buffer_size, buf, size);
+    s->buffer_size += size;
+}
+
+static ssize_t buffered_flush(QEMUFileBuffered *s)
+{
+    size_t offset = 0;
+    ssize_t ret = 0;
+
+    DPRINTF("flushing %zu byte(s) of data\n", s->buffer_size);
+
+    while (s->bytes_xfer < s->xfer_limit && offset < s->buffer_size) {
+        size_t to_send = MIN(s->buffer_size - offset, s->xfer_limit - s->bytes_xfer);
+        ret = migrate_fd_put_buffer(s->migration_state, s->buffer + offset,
+                                    to_send);
+        if (ret == -EAGAIN) {
+            DPRINTF("backend not ready, freezing\n");
+            ret = 0;
+            s->freeze_output = 1;
+            break;
+        }
+
+        if (ret <= 0) {
+            DPRINTF("error flushing data, %zd\n", ret);
+            break;
+        } else {
+            DPRINTF("flushed %zd byte(s)\n", ret);
+            offset += ret;
+            s->bytes_xfer += ret;
+        }
+    }
+
+    DPRINTF("flushed %zu of %zu byte(s)\n", offset, s->buffer_size);
+    memmove(s->buffer, s->buffer + offset, s->buffer_size - offset);
+    s->buffer_size -= offset;
+
+    if (ret < 0) {
+        return ret;
+    }
+    return offset;
+}
+
+static int buffered_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int size)
+{
+    QEMUFileBuffered *s = opaque;
+    ssize_t error;
+
+    DPRINTF("putting %d bytes at %" PRId64 "\n", size, pos);
+
+    error = qemu_file_get_error(s->file);
+    if (error) {
+        DPRINTF("flush when error, bailing: %s\n", strerror(-error));
+        return error;
+    }
+
+    DPRINTF("unfreezing output\n");
+    s->freeze_output = 0;
+
+    if (size > 0) {
+        DPRINTF("buffering %d bytes\n", size - offset);
+        buffered_append(s, buf, size);
+    }
+
+    error = buffered_flush(s);
+    if (error < 0) {
+        DPRINTF("buffered flush error. bailing: %s\n", strerror(-error));
+        return error;
+    }
+
+    if (pos == 0 && size == 0) {
+        DPRINTF("file is ready\n");
+        if (!s->freeze_output && s->bytes_xfer < s->xfer_limit) {
+            DPRINTF("notifying client\n");
+            migrate_fd_put_ready(s->migration_state);
+        }
+    }
+
+    return size;
+}
+
+static int buffered_close(void *opaque)
+{
+    QEMUFileBuffered *s = opaque;
+    ssize_t ret = 0;
+    int ret2;
+
+    DPRINTF("closing\n");
+
+    s->xfer_limit = INT_MAX;
+    while (!qemu_file_get_error(s->file) && s->buffer_size) {
+        ret = buffered_flush(s);
+        if (ret < 0) {
+            break;
+        }
+        if (s->freeze_output) {
+            ret = migrate_fd_wait_for_unfreeze(s->migration_state);
+            if (ret < 0) {
+                break;
+            }
+        }
+    }
+
+    ret2 = migrate_fd_close(s->migration_state);
+    if (ret >= 0) {
+        ret = ret2;
+    }
+    qemu_del_timer(s->timer);
+    qemu_free_timer(s->timer);
+    g_free(s->buffer);
+    g_free(s);
+
+    return ret;
+}
+
+/*
+ * The meaning of the return values is:
+ *   0: We can continue sending
+ *   1: Time to stop
+ *   negative: There has been an error
+ */
+static int buffered_get_fd(void *opaque)
+{
+    QEMUFileBuffered *s = opaque;
+
+    return qemu_get_fd(s->file);
+}
+
+static int buffered_rate_limit(void *opaque)
+{
+    QEMUFileBuffered *s = opaque;
+    int ret;
+
+    ret = qemu_file_get_error(s->file);
+    if (ret) {
+        return ret;
+    }
+    if (s->freeze_output)
+        return 1;
+
+    if (s->bytes_xfer > s->xfer_limit)
+        return 1;
+
+    return 0;
+}
+
+static int64_t buffered_set_rate_limit(void *opaque, int64_t new_rate)
+{
+    QEMUFileBuffered *s = opaque;
+    if (qemu_file_get_error(s->file)) {
+        goto out;
+    }
+    if (new_rate > SIZE_MAX) {
+        new_rate = SIZE_MAX;
+    }
+
+    s->xfer_limit = new_rate / 10;
+    
+out:
+    return s->xfer_limit;
+}
+
+static int64_t buffered_get_rate_limit(void *opaque)
+{
+    QEMUFileBuffered *s = opaque;
+  
+    return s->xfer_limit;
+}
+
+static void buffered_rate_tick(void *opaque)
+{
+    QEMUFileBuffered *s = opaque;
+
+    if (qemu_file_get_error(s->file)) {
+        buffered_close(s);
+        return;
+    }
+
+    qemu_mod_timer(s->timer, qemu_get_clock_ms(rt_clock) + 100);
+
+    if (s->freeze_output)
+        return;
+
+    s->bytes_xfer = 0;
+
+    buffered_put_buffer(s, NULL, 0, 0);
+}
+
+static const QEMUFileOps buffered_file_ops = {
+    .get_fd =         buffered_get_fd,
+    .put_buffer =     buffered_put_buffer,
+    .close =          buffered_close,
+    .rate_limit =     buffered_rate_limit,
+    .get_rate_limit = buffered_get_rate_limit,
+    .set_rate_limit = buffered_set_rate_limit,
+};
+
+QEMUFile *qemu_fopen_ops_buffered(MigrationState *migration_state)
+{
+    QEMUFileBuffered *s;
+
+    s = g_malloc0(sizeof(*s));
+
+    s->migration_state = migration_state;
+    s->xfer_limit = migration_state->bandwidth_limit / 10;
+
+    s->file = qemu_fopen_ops(s, &buffered_file_ops);
+
+    s->timer = qemu_new_timer_ms(rt_clock, buffered_rate_tick, s);
+
+    qemu_mod_timer(s->timer, qemu_get_clock_ms(rt_clock) + 100);
+
+    return s->file;
+}
@@ -0,0 +1,22 @@
+/*
+ * QEMU buffered QEMUFile
+ *
+ * Copyright IBM, Corp. 2008
+ *
+ * Authors:
+ *  Anthony Liguori   <aliguori@us.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef QEMU_BUFFERED_FILE_H
+#define QEMU_BUFFERED_FILE_H
+
+#include "hw/hw.h"
+#include "migration.h"
+
+QEMUFile *qemu_fopen_ops_buffered(MigrationState *migration_state);
+
+#endif
Author	SHA1	Message	Date
Michael Roth	04024dea26	update VERSION for v1.3.1 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-28 10:38:28 -06:00
Markus Armbruster	1bd4397e8d	qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check The pointer arithmetic there is safe, but ugly. Coverity grouses about it. However, the actual comparison is off by one: <= end instead of < end. Fix by rewriting the check in a cleaner way. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `bc5f92e5db`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 14:44:31 -06:00
Sander Eikelenboom	e76672424d	Fix compile errors when enabling Xen debug logging. Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it> Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit `f1b8caf1d9`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 14:08:52 -06:00
Stefano Stabellini	df50a7e0cb	xen: fix trivial PCI passthrough MSI-X bug We are currently passing entry->data as address parameter. Pass entry->addr instead. Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> Tested-by: Sander Eikelenboom <linux@eikelenboom.it> Xen-devel: http://marc.info/?l=xen-devel&m=135515462613715 (cherry picked from commit `044b99c655`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 14:07:21 -06:00
Roger Pau Monne	90c96d33c4	xen_disk: fix memory leak On ioreq_release the full ioreq was memset to 0, loosing all the data and memory allocations inside the QEMUIOVector, which leads to a memory leak. Create a new function to specifically reset ioreq. Reported-by: Maik Wessler <maik.wessler@yahoo.com> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> (cherry picked from commit `282c6a2f29`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 14:06:50 -06:00
Peter Maydell	4ee28799d4	tcg/target-arm: Add missing parens to assertions Silence a (legitimate) complaint about missing parentheses: tcg/arm/tcg-target.c: In function ‘tcg_out_qemu_ld’: tcg/arm/tcg-target.c:1148:5: error: suggest parentheses around comparison in operand of ‘&’ [-Werror=parentheses] tcg/arm/tcg-target.c: In function ‘tcg_out_qemu_st’: tcg/arm/tcg-target.c:1357:5: error: suggest parentheses around comparison in operand of ‘&’ [-Werror=parentheses] which meant that we would mistakenly always assert if running a QEMU built with debug enabled on ARM. Signed-off-by: Peter Maydell <peter.maydelL@linaro.org> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `5256a7208a`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 13:52:23 -06:00
Kevin Wolf	563068a8b2	win32-aio: Fix memory leak The buffer is allocated for both reads and writes, and obviously it should be freed even if an error occurs. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `e8bccad5ac`) Conflicts: block/win32-aio.c *addressed conflict due to buggy g_free() still in use instead of qemu_vfree() as it is upstream (via commit `7479acdb`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 13:43:10 -06:00
Kevin Wolf	cdb483457c	win32-aio: Fix vectored reads Copying data in the right direction really helps a lot! Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `bcbbd234d4`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 13:24:00 -06:00
Kevin Wolf	9d173df553	aio: Fix return value of aio_poll() aio_poll() must return true if any work is still pending, even if it didn't make progress, so that bdrv_drain_all() doesn't stop waiting too early. The possibility of stopping early occasionally lead to a failed assertion in bdrv_drain_all(), when some in-flight request was missed and the function didn't really drain all requests. In order to make that change, the return value as specified in the function comment must change for blocking = false; fortunately, the return value of blocking = false callers is only used in test cases, so this change shouldn't cause any trouble. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `2ea9b58f0b`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-21 13:23:52 -06:00
Paolo Bonzini	204dd38c2d	raw-posix: fix bdrv_aio_ioctl When the raw-posix aio=thread code was moved from posix-aio-compat.c to block/raw-posix.c, there was an unintended change to the ioctl code. The code used to return the ioctl command, which posix_aio_read() would later morph into a zero. This hack is not necessary anymore, and in fact breaks scsi-generic (which expects a zero return code). Remove it. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> (cherry picked from commit `b608c8dc02`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 23:05:45 -06:00
Alex Williamson	86bab45948	vfio-pci: Loosen sanity checks to allow future features VFIO_PCI_NUM_REGIONS and VFIO_PCI_NUM_IRQS should never have been used in this manner as it locks a specific kernel implementation. Future features may introduce new regions or interrupt entries (VGA may add legacy ranges, AER might add an IRQ for error signalling). Fix this before it gets us into trouble. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit `8fc94e5a80`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 23:05:45 -06:00
Alex Williamson	006c747440	pci-assign: Enable MSIX on device to match guest When a guest enables MSIX on a device we evaluate the MSIX vector table, typically find no unmasked vectors and don't switch the device to MSIX mode. This generally works fine and the device will be switched once the guest enables and therefore unmasks a vector. Unfortunately some drivers enable MSIX, then use interfaces to send commands between VF & PF or PF & firmware that act based on the host state of the device. These therefore may break when MSIX is managed lazily. This change re-enables the previous test used to enable MSIX (see qemu-kvm a6b402c9), which basically guesses whether a vector will be used based on the data field of the vector table. Cc: qemu-stable@nongnu.org Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit `feb9a2ab4b`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 23:05:44 -06:00
Alex Williamson	f042cca009	vfio-pci: Make host MSI-X enable track guest Guests typically enable MSI-X with all of the vectors in the MSI-X vector table masked. Only when the vector is enabled does the vector get unmasked, resulting in a vector_use callback. These two points, enable and unmask, correspond to pci_enable_msix() and request_irq() for Linux guests. Some drivers rely on VF/PF or PF/fw communication channels that expect the physical state of the device to match the guest visible state of the device. They don't appreciate lazily enabling MSI-X on the physical device. To solve this, enable MSI-X with a single vector when the MSI-X capability is enabled and immediate disable the vector. This leaves the physical device in exactly the same state between host and guest. Furthermore, the brief gap where we enable vector 0, it fires into userspace, not KVM, so the guest doesn't get spurious interrupts. Ideally we could call VFIO_DEVICE_SET_IRQS with the right parameters to enable MSI-X with zero vectors, but this will currently return an error as the Linux MSI-X interfaces do not allow it. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit `b0223e29af`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 23:05:44 -06:00
Max Filippov	1205b8080f	target-xtensa: fix search_pc for the last TB opcode Zero out tcg_ctx.gen_opc_instr_start for instructions representing the last guest opcode in the TB. Cc: qemu-stable@nongnu.org Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `36f25d2537`) *modified to use older global version of gen_opc_instr_start Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 23:04:53 -06:00
Paolo Bonzini	ff0c079c14	buffered_file: do not send more than s->bytes_xfer bytes per tick Sending more was possible if the buffer was large. Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit `bde54c08b4`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:38:00 -06:00
Paolo Bonzini	d745511fc9	migration: fix migration_bitmap leak Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit `244eaa7514`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:37:38 -06:00
Michael Contreras	5afd0ecaa6	e1000: Discard oversized packets based on SBP\|LPE Discard packets longer than 16384 when !SBP to match the hardware behavior. Signed-off-by: Michael Contreras <michael@inetric.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> (cherry picked from commit `2c0331f4f7`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:37:17 -06:00
Uri Lublin	c4cd5b0f6d	qxl+vnc: register a vm state change handler for dummy spice_server When qxl + vnc are used, a dummy spice_server is initialized. The spice_server has to be told when the VM runstate changes, which is what this patch does. Without it, from qxl_send_events(), the following error message is shown: qxl_send_events: spice-server bug: guest stopped, ignoring Cc: qemu-stable@nongnu.org Signed-off-by: Uri Lublin <uril@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `938b8a36b6`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:36:22 -06:00
Gerd Hoffmann	7ca2496588	qxl: save qemu_create_displaysurface_from result Spotted by Coverity. https://bugzilla.redhat.com/show_bug.cgi?id=885644 Cc: qemu-stable@nongnu.org Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `2f464b5a32`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:35:40 -06:00
Max Filippov	bfae9374f1	target-xtensa: fix ITLB/DTLB page protection flags With MMU option xtensa architecture has two TLBs: ITLB and DTLB. ITLB is only used for code access, DTLB is only for data. However TLB entries in both TLBs have attribute field controlling write and exec access. These bits need to be properly masked off depending on TLB type before being used as tlb_set_page prot argument. Otherwise the following happens: (1) ITLB entry for some PFN gets invalidated (2) DTLB entry for the same PFN gets updated, attributes allow code execution (3) code at the page with that PFN is executed (possible due to step 2), entry for the TB is written into the jump cache (4) QEMU TLB entry for the PFN gets replaced with an entry for some other PFN (5) code in the TB from step 3 is executed (possible due to jump cache) and it accesses data, for which there's no DTLB entry, causing DTLB miss exception (6) re-translation of the TB from step 5 is attempted, but there's no QEMU TLB entry nor xtensa ITLB entry for that PFN, which causes ITLB miss exception at the TB start address (7) ITLB miss exception is handled by the guest, but execution is resumed from the beginning of the faulting TB (the point where ITLB miss occured), not from the point where DTLB miss occured, which is wrong. With that fix the above scenario causes ITLB miss exception (that used to be step 7) at step 3, right at the beginning of the TB. Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `659f807c0a`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:34:54 -06:00
Gerd Hoffmann	b68c48ff01	pixman: fix vnc tight png/jpeg support This patch adds an x argument to qemu_pixman_linebuf_fill so it can also be used to convert a partial scanline. Then fix tight + png/jpeg encoding by passing in the x+y offset, so the data is read from the correct screen location instead of the upper left corner. Cc: 1087974@bugs.launchpad.net Cc: qemu-stable@nongnu.org Reported-by: Tim Hardeneck <thardeck@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `bc210eb163`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 22:33:57 -06:00
Gerd Hoffmann	36fd8179b6	Update seabios to a810e4e72a0d42c7bc04eda57382f8e019add901 git shortlog: Kevin O'Connor (6): floppy: Minor - reduce handle_0e code size when CONFIG_FLOPPY is disabled. vga: Minor comment spelling fix. Don't recursively evaluate CFLAGS variables. Don't use gcc's -combine option. Add compile checking phase to build. acpi: Use prt_slot() macro to describe irq pins of first PCI device. Laszlo Ersek (1): maininit(): print machine UUID under seabios version message Paolo Bonzini (1): acpi: reintroduce LNKS Paolo's patch fixes the FreeBSD boot failure. Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `15faf946f7`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 10:47:39 -06:00
Gerd Hoffmann	0bc5f4ad63	seabios: update to e8a76b0f225bba5ba9d63ab227e0a37b3beb1059 This patch updates seabios to latest git master. Changes: (1) q35 patches merged. (2) some acpi cleanups. (3) fixes irq 8 conflict. (3) makes this a candidate for the stable branch Cc: qemu-stable@nongnu.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> (cherry picked from commit `ff1562908d`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-15 10:46:57 -06:00
Alex Williamson	37e1428cc7	vfio-pci: Don't use kvm_irqchip_in_kernel kvm_irqchip_in_kernel() has an architecture specific meaning, so we shouldn't be using it to determine whether to enabled KVM INTx bypass. kvm_irqfds_enabled() seems most appropriate. Also use this to protect our other call to kvm_check_extension() as that explodes when KVM isn't enabled. Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Cc: qemu-stable@nongnu.org (cherry picked from commit `d281084d3e`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:45:06 -06:00
Petar Jovanovic	518799a3e7	target-mips: Fix incorrect shift for SHILO and SHILOV helper_shilo has not been shifting an accumulator value correctly for negative values in 'shift' field. Minor optimization for shift=0 case. This change also adds tests that will trigger issue and check for regressions. Signed-off-by: Petar Jovanovic <petarj@mips.com> Reviewed-by: Richard Henderson <rth@twiddle.net> Reviewed-by: Eric Johnson <ericj@mips.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `19e6c50d2d`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:43:29 -06:00
Petar Jovanovic	16c5fe49de	target-mips: Fix incorrect code and test for INSV Content of register rs should be shifted for pos before applying a mask. This change contains both fix for the instruction and to the existing test. Signed-off-by: Petar Jovanovic <petarj@mips.com> Reviewed-by: Eric Johnson <ericj@mips.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> (cherry picked from commit `34f5606ee1`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:42:38 -06:00
David Gibson	f1a2195ec3	migration: Fix madvise breakage if host and guest have different page sizes madvise(DONTNEED) will throw away the contents of the whole page at the given address, even if the given length is less than the page size. One can argue about whether that's the correct behaviour, but that's what it's done for a long time in Linux at least. That means that the madvise() in ram_load(), on a setup where TARGET_PAGE_SIZE is smaller than the host page size, can throw away data in guest pages adjacent to the one it's actually processing right now, leading to guest memory corruption on an incoming migration. This patch therefore, disables the madvise() if the host page size is larger than TARGET_PAGE_SIZE. This means we don't get the benefits of that madvise() in this case, but a more complete fix is more difficult to accomplish. This at least fixes the guest memory corruption. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `45e6cee42b`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:41:11 -06:00
David Gibson	3b4fc1f9d2	Fix off-by-1 error in RAM migration code The code for migrating (or savevm-ing) memory pages starts off by creating a dirty bitmap and filling it with 1s. Except, actually, because bit addresses are 0-based it fills every bit except bit 0 with 1s and puts an extra 1 beyond the end of the bitmap, potentially corrupting unrelated memory. Oops. This patch fixes it. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit `7ec81e56ed`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:40:38 -06:00
Brad Smith	d67d95f24e	Disable semaphores fallback code for OpenBSD Disable the semaphores fallback code for OpenBSD as modern OpenBSD releases now have sem_timedwait(). Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `927fa909d5`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:36:36 -06:00
Brad Smith	0a7ad69a0f	Fix semaphores fallback code As reported in bug 1087114 the semaphores fallback code is broken which results in QEMU crashing and making QEMU unusable. This patch is from Paolo. This needs to be back ported to the 1.3 stable tree as well. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Brad Smith <brad@comstyle.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com> (cherry picked from commit `a795ef8dcb`) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>	2013-01-14 15:36:28 -06:00
@@ -1 +1 @@
 .4.2
 .3.1