Update version for 2.9.1 release

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
virtfs: error out gracefully when mandatory suboptions are missing
2017-09-07 11:25:12 -05:00 · 2017-09-05 15:42:17 -05:00 · 2017-09-04 23:12:48 -05:00 · 2017-09-01 18:15:39 -05:00 · 2017-09-01 18:15:24 -05:00 · 2017-09-01 18:10:46 -05:00
1653 changed files with 31654 additions and 80672 deletions
@@ -1,15 +0,0 @@
-# http://editorconfig.org
-root = true
-
-[*]
-end_of_line = lf
-insert_final_newline = true
-charset = utf-8
-
-[Makefile*]
-indent_style = tab
-indent_size = 8
-
-[*.{c,h}]
-indent_style = space
-indent_size = 4
@@ -1,8 +0,0 @@
-# GDB may have ./.gdbinit loading disabled by default.  In that case you can
-# follow the instructions it prints.  They boil down to adding the following to
-# your home directory's ~/.gdbinit file:
-#
-#   add-auto-load-safe-path /path/to/qemu/.gdbinit
-
-# Load QEMU-specific sub-commands and settings
-source scripts/qemu-gdb.py
@@ -50,7 +50,6 @@
 /qemu-version.h.tmp
 /module_block.h
 /vscclient
-/vhost-user-scsi
 /fsdev/virtfs-proxy-helper
 *.[1-9]
 *.a
@@ -100,14 +99,14 @@
 /pc-bios/optionrom/kvmvapic.img
 /pc-bios/s390-ccw/s390-ccw.elf
 /pc-bios/s390-ccw/s390-ccw.img
-/docs/interop/qemu-ga-qapi.texi
-/docs/interop/qemu-ga-ref.html
-/docs/interop/qemu-ga-ref.info*
-/docs/interop/qemu-ga-ref.txt
-/docs/interop/qemu-qmp-qapi.texi
-/docs/interop/qemu-qmp-ref.html
-/docs/interop/qemu-qmp-ref.info*
-/docs/interop/qemu-qmp-ref.txt
+/docs/qemu-ga-qapi.texi
+/docs/qemu-ga-ref.html
+/docs/qemu-ga-ref.info*
+/docs/qemu-ga-ref.txt
+/docs/qemu-qmp-qapi.texi
+/docs/qemu-qmp-ref.html
+/docs/qemu-qmp-ref.info*
+/docs/qemu-qmp-ref.txt
 /docs/version.texi
 *.tps
 .stgit-*
@@ -116,8 +115,6 @@ tags
 TAGS
 docker-src.*
 *~
-*.ast_raw
-*.depend_raw
 trace.h
 trace.c
 trace-ust.h
@@ -34,6 +34,3 @@
 [submodule "roms/skiboot"]
 	path = roms/skiboot
 	url = git://git.qemu.org/skiboot.git
-[submodule "roms/QemuMacDrivers"]
-	path = roms/QemuMacDrivers
-	url = git://git.qemu.org/QemuMacDrivers.git
@@ -1,35 +1,15 @@
 language: c
-git:
-   submodules: false
 env:
-  global:
-    - LC_ALL=C
  matrix:
-    - IMAGE=debian-amd64
-      TARGET_LIST=x86_64-softmmu,x86_64-linux-user
-    - IMAGE=debian-win32-cross
-      TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
-    - IMAGE=debian-win64-cross
-      TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
-    - IMAGE=debian-armel-cross
-      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
    - IMAGE=debian-armhf-cross
-      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
+      TARGET_LIST=arm-softmmu,arm-linux-user
    - IMAGE=debian-arm64-cross
      TARGET_LIST=aarch64-softmmu,aarch64-linux-user
    - IMAGE=debian-s390x-cross
      TARGET_LIST=s390x-softmmu,s390x-linux-user
-    - IMAGE=debian-mips-cross
-      TARGET_LIST=mips-softmmu,mipsel-linux-user
-    - IMAGE=debian-mips64el-cross
-      TARGET_LIST=mips64el-softmmu,mips64el-linux-user
-    - IMAGE=debian-powerpc-cross
-      TARGET_LIST=ppc-softmmu,ppcemb-softmmu,ppc-linux-user
-    - IMAGE=debian-ppc64el-cross
-      TARGET_LIST=ppc64-softmmu,ppc64-linux-user,ppc64abi32-linux-user
 build:
  pre_ci:
-    - make docker-image-${IMAGE} V=1
+    - make docker-image-${IMAGE}
  pre_ci_boot:
    image_name: qemu
    image_tag: ${IMAGE}
@@ -37,13 +17,5 @@ build:
    options: "-e HOME=/root"
  ci:
    - unset CC
-    # some targets require newer up to date packages, for example TARGET_LIST matching
-    # aarch64*-softmmu|arm*-softmmu|ppc*-softmmu|microblaze*-softmmu|mips64el-softmmu)
-    # see the configure script:
-    #    error_exit "DTC (libfdt) version >= 1.4.2 not present. Your options:"
-    #    "  (1) Preferred: Install the DTC (libfdt) devel package"
-    #    "  (2) Fetch the DTC submodule, using:"
-    #    "      git submodule update --init dtc"
-    - dpkg --compare-versions `dpkg-query --showformat='${Version}' --show libfdt-dev` ge 1.4.2 || git submodule update --init dtc
    - ./configure ${QEMU_CONFIGURE_OPTS} --target-list=${TARGET_LIST}
-    - make -j$(($(getconf _NPROCESSORS_ONLN) + 1))
+    - make -j2
@@ -46,7 +46,6 @@ notifications:
 env:
  global:
    - TEST_CMD="make check"
-    - MAKEFLAGS="-j3"
  matrix:
    - CONFIG=""
    - CONFIG="--enable-debug --enable-debug-tcg --enable-trace-backends=log"
@@ -65,7 +64,7 @@ before_install:
 before_script:
  - ./configure ${CONFIG}
 script:
-  - make ${MAKEFLAGS} && ${TEST_CMD}
+  - make -j3 && ${TEST_CMD}
 matrix:
  include:
    # Test with CLang for compile portability
@@ -87,7 +86,7 @@ matrix:
    - env: CONFIG="--enable-trace-backends=ust"
           TEST_CMD=""
      compiler: gcc
-    - env: CONFIG="--disable-tcg"
+    - env: CONFIG="--with-coroutine=gthread"
           TEST_CMD=""
      compiler: gcc
    - env: CONFIG=""
@@ -192,7 +191,7 @@ matrix:
      compiler: none
      env:
        - COMPILER_NAME=gcc CXX=g++-5 CC=gcc-5
-        - CONFIG="--cc=gcc-5 --cxx=g++-5 --disable-pie --disable-linux-user"
+        - CONFIG="--cc=gcc-5 --cxx=g++-5 --disable-pie --disable-linux-user --with-coroutine=gthread"
        - TEST_CMD=""
      before_script:
        - ./configure ${CONFIG} --extra-cflags="-g3 -O0 -fsanitize=thread -fuse-ld=gold" || cat config.log
@@ -123,38 +123,3 @@ We use traditional C-style /* */ comments and avoid // comments.

 Rationale: The // form is valid in C99, so this is purely a matter of
 consistency of style. The checkpatch script will warn you about this.
-
-8. trace-events style
-
-8.1 0x prefix
-
-In trace-events files, use a '0x' prefix to specify hex numbers, as in:
-
-some_trace(unsigned x, uint64_t y) "x 0x%x y 0x" PRIx64
-
-An exception is made for groups of numbers that are hexadecimal by
-convention and separated by the symbols '.', '/', ':', or ' ' (such as
-PCI bus id):
-
-another_trace(int cssid, int ssid, int dev_num) "bus id: %x.%x.%04x"
-
-However, you can use '0x' for such groups if you want. Anyway, be sure that
-it is obvious that numbers are in hex, ex.:
-
-data_dump(uint8_t c1, uint8_t c2, uint8_t c3) "bytes (in hex): %02x %02x %02x"
-
-Rationale: hex numbers are hard to read in logs when there is no 0x prefix,
-especially when (occasionally) the representation doesn't contain any letters
-and especially in one line with other decimal numbers. Number groups are allowed
-to not use '0x' because for some things notations like %x.%x.%x are used not
-only in Qemu. Also dumping raw data bytes with '0x' is less readable.
-
-8.2 '#' printf flag
-
-Do not use printf flag '#', like '%#x'.
-
-Rationale: there are two ways to add a '0x' prefix to printed number: '0x%...'
-and '%#...'. For consistency the only one way should be used. Arguments for
-'0x%' are:
- - it is more popular
- - '%#' omits the 0x for the value 0 which makes output inconsistent
@@ -12,8 +12,6 @@ consult qemu-devel and not any specific individual privately.
 Descriptions of section entries:

 	M: Mail patches to: FullName <address@domain>
-	R: Designated reviewer: FullName <address@domain>
-	   These reviewers should be CCed on patches.
 	L: Mailing list that is relevant to this area
 	W: Web-page with status/info
 	Q: Patchwork web based patch tracking system site
@@ -84,10 +82,14 @@ M: Paolo Bonzini <pbonzini@redhat.com>
 M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Richard Henderson <rth@twiddle.net>
 S: Maintained
+F: cpu-exec.c
+F: cpu-exec-common.c
 F: cpus.c
+F: cputlb.c
 F: exec.c
 F: softmmu_template.h
-F: accel/tcg/
+F: translate-all.*
+F: translate-common.c
 F: include/exec/cpu*.h
 F: include/exec/exec-all.h
 F: include/exec/helper*.h
@@ -194,8 +196,8 @@ F: hw/nios2/
 F: disas/nios2.c

 OpenRISC
-M: Stafford Horne <shorne@gmail.com>
-S: Odd Fixes
+M: Jia Liu <proljc@gmail.com>
+S: Maintained
 F: target/openrisc/
 F: hw/openrisc/
 F: tests/tcg/openrisc/
@@ -273,8 +275,8 @@ Overall
 M: Paolo Bonzini <pbonzini@redhat.com>
 L: kvm@vger.kernel.org
 S: Supported
+F: kvm-*
 F: */kvm.*
-F: accel/kvm/
 F: include/sysemu/kvm*.h

 ARM
@@ -295,7 +297,7 @@ F: target/ppc/kvm.c

 S390
 M: Christian Borntraeger <borntraeger@de.ibm.com>
-M: Cornelia Huck <cohuck@redhat.com>
+M: Cornelia Huck <cornelia.huck@de.ibm.com>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: target/s390x/kvm.c
@@ -323,8 +325,8 @@ M: Stefano Stabellini <sstabellini@kernel.org>
 M: Anthony Perard <anthony.perard@citrix.com>
 L: xen-devel@lists.xenproject.org
 S: Supported
+F: xen-*
 F: */xen*
-F: hw/9pfs/xen-9p-backend.c
 F: hw/char/xen_console.c
 F: hw/display/xenfb.c
 F: hw/net/xen_nic.c
@@ -349,12 +351,6 @@ L: qemu-devel@nongnu.org
 S: Maintained
 F: *posix*

-NETBSD
-L: qemu-devel@nongnu.org
-M: Kamil Rytarowski <kamil@netbsd.org>
-S: Maintained
-K: ^Subject:.*(?i)NetBSD
-
 W32, W64
 L: qemu-devel@nongnu.org
 M: Stefan Weil <sw@weilnetz.de>
@@ -375,7 +371,7 @@ F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c

-ARM PrimeCell and CMSDK devices
+ARM PrimeCell
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
@@ -389,10 +385,6 @@ F: hw/intc/pl190.c
 F: hw/sd/pl181.c
 F: hw/timer/pl031.c
 F: include/hw/arm/primecell.h
-F: hw/timer/cmsdk-apb-timer.c
-F: include/hw/timer/cmsdk-apb-timer.h
-F: hw/char/cmsdk-apb-uart.c
-F: include/hw/char/cmsdk-apb-uart.h

 ARM cores
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -454,14 +446,6 @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c

-MPS2
-M: Peter Maydell <peter.maydell@linaro.org>
-L: qemu-arm@nongnu.org
-S: Maintained
-F: hw/arm/mps2.c
-F: hw/misc/mps2-scc.c
-F: include/hw/misc/mps2-scc.h
-
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
 L: qemu-arm@nongnu.org
@@ -661,6 +645,7 @@ F: hw/ppc/ppc440_bamboo.c

 e500
 M: Alexander Graf <agraf@suse.de>
+M: Scott Wood <scottwood@freescale.com>
 L: qemu-ppc@nongnu.org
 S: Supported
 F: hw/ppc/e500.[hc]
@@ -671,6 +656,7 @@ F: pc-bios/u-boot.e500

 mpc8544ds
 M: Alexander Graf <agraf@suse.de>
+M: Scott Wood <scottwood@freescale.com>
 L: qemu-ppc@nongnu.org
 S: Supported
 F: hw/ppc/mpc8544ds.c
@@ -785,7 +771,7 @@ F: include/hw/sparc/grlib.h
 S390 Machines
 -------------
 S390 Virtio-ccw
-M: Cornelia Huck <cohuck@redhat.com>
+M: Cornelia Huck <cornelia.huck@de.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 M: Alexander Graf <agraf@suse.de>
 S: Supported
@@ -947,6 +933,7 @@ F: include/hw/ppc/ppc4xx.h

 ppce500
 M: Alexander Graf <agraf@suse.de>
+M: Scott Wood <scottwood@freescale.com>
 L: qemu-ppc@nongnu.org
 S: Supported
 F: hw/ppc/e500*
@@ -1012,14 +999,6 @@ S: Supported
 F: hw/vfio/*
 F: include/hw/vfio/

-vfio-ccw
-M: Cornelia Huck <cohuck@redhat.com>
-S: Supported
-F: hw/vfio/ccw.c
-F: hw/s390x/s390-ccw.c
-F: include/hw/s390x/s390-ccw.h
-T: git git://github.com/cohuck/qemu.git s390-next
-
 vhost
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
@@ -1055,7 +1034,7 @@ F: tests/virtio-blk-test.c
 T: git git://github.com/stefanha/qemu.git block

 virtio-ccw
-M: Cornelia Huck <cohuck@redhat.com>
+M: Cornelia Huck <cornelia.huck@de.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: hw/s390x/virtio-ccw.[hc]
@@ -1167,13 +1146,6 @@ F: docs/specs/vmgenid.txt
 F: tests/vmgenid-test.c
 F: stubs/vmgenid.c

-Unimplemented device
-M: Peter Maydell <peter.maydell@linaro.org>
-R: Philippe Mathieu-Daudé <f4bug@amsat.org>
-S: Maintained
-F: include/hw/misc/unimp.h
-F: hw/misc/unimp.c
-
 Subsystems
 ----------
 Audio
@@ -1198,7 +1170,6 @@ F: include/block/
 F: qemu-img*
 F: qemu-io*
 F: tests/qemu-iotests/
-F: util/qemu-progress.c
 T: git git://repo.or.cz/qemu/kevin.git block

 Block I/O path
@@ -1206,8 +1177,8 @@ M: Stefan Hajnoczi <stefanha@redhat.com>
 M: Fam Zheng <famz@redhat.com>
 L: qemu-block@nongnu.org
 S: Supported
-F: util/async.c
-F: util/aio-*.c
+F: async.c
+F: aio-*.c
 F: block/io.c
 F: migration/block*
 F: include/block/aio.h
@@ -1252,12 +1223,13 @@ M: Paolo Bonzini <pbonzini@redhat.com>
 M: Marc-André Lureau <marcandre.lureau@redhat.com>
 S: Maintained
 F: chardev/
-F: include/chardev/
+F: backends/msmouse.c
+F: backends/testdev.c

 Character Devices (Braille)
 M: Samuel Thibault <samuel.thibault@ens-lyon.org>
 S: Maintained
-F: chardev/baum.c
+F: backends/baum.c

 Command line option argument parsing
 M: Markus Armbruster <armbru@redhat.com>
@@ -1335,8 +1307,8 @@ Main loop
 M: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
 F: cpus.c
-F: util/main-loop.c
-F: util/qemu-timer.c
+F: main-loop.c
+F: qemu-timer.c
 F: vl.c

 Human Monitor (HMP)
@@ -1346,7 +1318,6 @@ F: monitor.c
 F: hmp.[ch]
 F: hmp-commands*.hx
 F: include/monitor/hmp-target.h
-F: tests/test-hmp.c

 Network device backends
 M: Jason Wang <jasowang@redhat.com>
@@ -1363,6 +1334,15 @@ W: http://info.iet.unipi.it/~luigi/netmap/
 S: Maintained
 F: net/netmap.c

+Network Block Device (NBD)
+M: Paolo Bonzini <pbonzini@redhat.com>
+S: Odd Fixes
+F: block/nbd*
+F: nbd/
+F: include/block/nbd*
+F: qemu-nbd.c
+T: git git://github.com/bonzini/qemu.git nbd-next
+
 NUMA
 M: Eduardo Habkost <ehabkost@redhat.com>
 S: Maintained
@@ -1417,7 +1397,8 @@ F: include/qapi/qmp/
 X: include/qapi/qmp/dispatch.h
 F: scripts/coccinelle/qobject.cocci
 F: tests/check-qdict.c
-F: tests/check-qnum.c
+F: tests/check-qfloat.c
+F: tests/check-qint.c
 F: tests/check-qjson.c
 F: tests/check-qlist.c
 F: tests/check-qstring.c
@@ -1495,7 +1476,7 @@ F: tests/vmstate-static-checker-data/
 F: docs/migration.txt

 Seccomp
-M: Eduardo Otubo <otubo@redhat.com>
+M: Eduardo Otubo <eduardo.otubo@profitbricks.com>
 S: Supported
 F: qemu-seccomp.c
 F: include/sysemu/seccomp.h
@@ -1506,7 +1487,6 @@ S: Maintained
 F: crypto/
 F: include/crypto/
 F: tests/test-crypto-*
-F: qemu.sasl

 Coroutines
 M: Stefan Hajnoczi <stefanha@redhat.com>
@@ -1569,18 +1549,6 @@ F: net/colo*
 F: net/filter-rewriter.c
 F: net/filter-mirror.c

-Record/replay
-M: Pavel Dovgalyuk <pavel.dovgaluk@ispras.ru>
-R: Paolo Bonzini <pbonzini@redhat.com>
-W: http://wiki.qemu.org/Features/record-replay
-S: Supported
-F: replay/*
-F: block/blkreplay.c
-F: net/filter-replay.c
-F: include/sysemu/replay.h
-F: docs/replay.txt
-F: stubs/replay.c
-
 Usermode Emulation
 ------------------
 Overall
@@ -1597,7 +1565,6 @@ F: default-configs/*-bsd-user.mak

 Linux user
 M: Riku Voipio <riku.voipio@iki.fi>
-R: Laurent Vivier <laurent@vivier.eu>
 S: Maintained
 F: linux-user/
 F: default-configs/*-linux-user.mak
@@ -1665,7 +1632,7 @@ TCI target
 M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
 F: tcg/tci/
-F: tcg/tci.c
+F: tci.c
 F: disas/tci.c

 Block drivers
@@ -1716,18 +1683,6 @@ S: Supported
 F: block/iscsi.c
 F: block/iscsi-opts.c

-Network Block Device (NBD)
-M: Eric Blake <eblake@redhat.com>
-M: Paolo Bonzini <pbonzini@redhat.com>
-L: qemu-block@nongnu.org
-S: Maintained
-F: block/nbd*
-F: nbd/
-F: include/block/nbd*
-F: qemu-nbd.*
-F: blockdev-nbd.c
-T: git git://repo.or.cz/qemu/ericb.git nbd
-
 NFS
 M: Jeff Cody <jcody@redhat.com>
 M: Peter Lieven <pl@kamp.de>
@@ -1863,8 +1818,8 @@ S: Supported
 F: tests/image-fuzzer/

 Replication
-M: Wen Congyang <wencongyang2@huawei.com>
-M: Xie Changlong <xiechanglong.d@gmail.com>
+M: Wen Congyang <wency@cn.fujitsu.com>
+M: Changlong Xie <xiecl.fnst@cn.fujitsu.com>
 S: Supported
 F: replication*
 F: block/replication.c
@@ -1875,14 +1830,12 @@ Build and test automation
 -------------------------
 M: Alex Bennée <alex.bennee@linaro.org>
 M: Fam Zheng <famz@redhat.com>
-R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 S: Maintained
 F: .travis.yml
 F: .shippable.yml
 F: tests/docker/
 W: https://travis-ci.org/qemu/qemu
-W: https://app.shippable.com/github/qemu/qemu
 W: http://patchew.org/QEMU/

 Documentation
@@ -207,8 +207,8 @@ HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF)

 ifdef BUILD_DOCS
 DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
-DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
-DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
+DOCS+=docs/qemu-qmp-ref.html docs/qemu-qmp-ref.txt docs/qemu-qmp-ref.7
+DOCS+=docs/qemu-ga-ref.html docs/qemu-ga-ref.txt docs/qemu-ga-ref.7
 ifdef CONFIG_VIRTFS
 DOCS+=fsdev/virtfs-proxy-helper.1
 endif
@@ -269,7 +269,6 @@ dummy := $(call unnest-vars,, \
                ivshmem-client-obj-y \
                ivshmem-server-obj-y \
                libvhost-user-obj-y \
-                vhost-user-scsi-obj-y \
                qga-vss-dll-obj-y \
                block-obj-y \
                block-obj-m \
@@ -281,7 +280,9 @@ dummy := $(call unnest-vars,, \
                common-obj-m \
                trace-obj-y)

+ifneq ($(wildcard config-host.mak),)
 include $(SRC_PATH)/tests/Makefile.include
+endif

 all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all modules

@@ -345,7 +346,7 @@ dtc/%:
 	mkdir -p $@

 $(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y) $(chardev-obj-y) \
-	$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY))
+	$(qom-obj-y) $(crypto-aes-obj-$(CONFIG_USER_ONLY)) $(trace-obj-y)

 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
 # Only keep -O and -g cflags
@@ -365,11 +366,11 @@ Makefile: $(version-obj-y)
 # Build libraries

 libqemustub.a: $(stub-obj-y)
-libqemuutil.a: $(util-obj-y) $(trace-obj-y)
+libqemuutil.a: $(util-obj-y)

 ######################################################################

-COMMON_LDADDS = libqemuutil.a libqemustub.a
+COMMON_LDADDS = $(trace-obj-y) libqemuutil.a libqemustub.a

 qemu-img.o: qemu-img-cmds.h

@@ -441,7 +442,7 @@ $(qapi-modules) $(SRC_PATH)/scripts/qapi-introspect.py $(qapi-py)
 		"GEN","$@")

 QGALIB_GEN=$(addprefix qga/qapi-generated/, qga-qapi-types.h qga-qapi-visit.h qga-qmp-commands.h)
-$(qga-obj-y): $(QGALIB_GEN)
+$(qga-obj-y) qemu-ga.o: $(QGALIB_GEN)

 qemu-ga$(EXESUF): $(qga-obj-y) $(COMMON_LDADDS)
 	$(call LINK, $^)
@@ -468,14 +469,10 @@ ifneq ($(EXESUF),)
 qemu-ga: qemu-ga$(EXESUF) $(QGA_VSS_PROVIDER) $(QEMU_GA_MSI)
 endif

-ifdef CONFIG_IVSHMEM
 ivshmem-client$(EXESUF): $(ivshmem-client-obj-y) $(COMMON_LDADDS)
 	$(call LINK, $^)
 ivshmem-server$(EXESUF): $(ivshmem-server-obj-y) $(COMMON_LDADDS)
 	$(call LINK, $^)
-endif
-vhost-user-scsi$(EXESUF): $(vhost-user-scsi-obj-y)
-	$(call LINK, $^)

 module_block.h: $(SRC_PATH)/scripts/modules/module_block.py config-host.mak
 	$(call quiet-command,$(PYTHON) $< $@ \
@@ -522,12 +519,11 @@ distclean: clean
 	rm -f qemu-doc.vr qemu-doc.txt
 	rm -f config.log
 	rm -f linux-headers/asm
-	rm -f docs/version.texi
-	rm -f docs/interop/qemu-ga-qapi.texi docs/interop/qemu-qmp-qapi.texi
-	rm -f docs/interop/qemu-qmp-ref.7 docs/interop/qemu-ga-ref.7
-	rm -f docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
-	rm -f docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
-	rm -f docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
+	rm -f docs/qemu-ga-qapi.texi docs/qemu-qmp-qapi.texi docs/version.texi
+	rm -f docs/qemu-qmp-ref.7 docs/qemu-ga-ref.7
+	rm -f docs/qemu-qmp-ref.txt docs/qemu-ga-ref.txt
+	rm -f docs/qemu-qmp-ref.pdf docs/qemu-ga-ref.pdf
+	rm -f docs/qemu-qmp-ref.html docs/qemu-ga-ref.html
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
        done
@@ -553,11 +549,10 @@ efi-e1000e.rom efi-vmxnet3.rom \
 qemu-icon.bmp qemu_logo_no_text.svg \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 multiboot.bin linuxboot.bin linuxboot_dma.bin kvmvapic.bin \
-s390-ccw.img s390-netboot.img \
+s390-ccw.img \
 spapr-rtas.bin slof.bin skiboot.lid \
 palcode-clipper \
-u-boot.e500 \
-qemu_vga.ndrv
+u-boot.e500
 else
 BLOBS=
 endif
@@ -566,13 +561,13 @@ install-doc: $(DOCS)
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) qemu-doc.txt "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.html "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.txt "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) docs/qemu-qmp-ref.html "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) docs/qemu-qmp-ref.txt "$(DESTDIR)$(qemu_docdir)"
 ifdef CONFIG_POSIX
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man7"
-	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
+	$(INSTALL_DATA) docs/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
 ifneq ($(TOOLS),)
 	$(INSTALL_DATA) qemu-img.1 "$(DESTDIR)$(mandir)/man1"
 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
@@ -580,9 +575,9 @@ ifneq ($(TOOLS),)
 endif
 ifneq (,$(findstring qemu-ga,$(TOOLS)))
 	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
-	$(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) docs/interop/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
-	$(INSTALL_DATA) docs/interop/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
+	$(INSTALL_DATA) docs/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) docs/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
+	$(INSTALL_DATA) docs/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
 endif
 endif
 ifdef CONFIG_VIRTFS
@@ -670,27 +665,28 @@ ui/console-gl.o: $(SRC_PATH)/ui/console-gl.c \

 # documentation
 MAKEINFO=makeinfo
-MAKEINFOINCLUDES= -I docs -I $(<D) -I $(@D)
-MAKEINFOFLAGS=--no-split --number-sections $(MAKEINFOINCLUDES)
-TEXI2PODFLAGS=$(MAKEINFOINCLUDES) "-DVERSION=$(VERSION)"
-TEXI2PDFFLAGS=$(if $(V),,--quiet) -I $(SRC_PATH) $(MAKEINFOINCLUDES)
+MAKEINFOFLAGS=--no-split --number-sections -I docs
+TEXIFLAG=$(if $(V),,--quiet)

 docs/version.texi: $(SRC_PATH)/VERSION
 	$(call quiet-command,echo "@set VERSION $(VERSION)" > $@,"GEN","$@")

-%.html: %.texi docs/version.texi
+%.html: %.texi
 	$(call quiet-command,LC_ALL=C $(MAKEINFO) $(MAKEINFOFLAGS) --no-headers \
 	--html $< -o $@,"GEN","$@")

-%.info: %.texi docs/version.texi
+%.info: %.texi
 	$(call quiet-command,$(MAKEINFO) $(MAKEINFOFLAGS) $< -o $@,"GEN","$@")

-%.txt: %.texi docs/version.texi
+%.txt: %.texi
 	$(call quiet-command,LC_ALL=C $(MAKEINFO) $(MAKEINFOFLAGS) --no-headers \
 	--plaintext $< -o $@,"GEN","$@")

-%.pdf: %.texi docs/version.texi
-	$(call quiet-command,texi2pdf $(TEXI2PDFFLAGS) $< -o $@,"GEN","$@")
+%.pdf: %.texi
+	$(call quiet-command,texi2pdf $(TEXIFLAG) -I $(SRC_PATH) -I docs $< -o $@,"GEN","$@")
+
+docs/qemu-ga-ref.html docs/qemu-ga-ref.info docs/qemu-ga-ref.txt docs/qemu-ga-ref.pdf docs/qemu-ga-ref.7.pod: docs/version.texi
+docs/qemu-qmp-ref.html docs/qemu-qmp-ref.info docs/qemu-qmp-ref.txt docs/qemu-qmp-ref.pdf docs/qemu-qmp-ref.pod: docs/version.texi

 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
@@ -704,12 +700,12 @@ qemu-monitor-info.texi: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxt
 qemu-img-cmds.texi: $(SRC_PATH)/qemu-img-cmds.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")

-docs/interop/qemu-qmp-qapi.texi docs/interop/qemu-ga-qapi.texi: $(SRC_PATH)/scripts/qapi2texi.py $(qapi-py)
+docs/qemu-qmp-qapi.texi docs/qemu-ga-qapi.texi: $(SRC_PATH)/scripts/qapi2texi.py $(qapi-py)

-docs/interop/qemu-qmp-qapi.texi: $(qapi-modules)
+docs/qemu-qmp-qapi.texi: $(qapi-modules)
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi2texi.py $< > $@,"GEN","$@")

-docs/interop/qemu-ga-qapi.texi: $(SRC_PATH)/qga/qapi-schema.json
+docs/qemu-ga-qapi.texi: $(SRC_PATH)/qga/qapi-schema.json
 	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/qapi2texi.py $< > $@,"GEN","$@")

 qemu.1: qemu-doc.texi qemu-options.texi qemu-monitor.texi qemu-monitor-info.texi
@@ -719,25 +715,21 @@ fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 qemu-ga.8: qemu-ga.texi

-html: qemu-doc.html docs/interop/qemu-qmp-ref.html docs/interop/qemu-ga-ref.html
-info: qemu-doc.info docs/interop/qemu-qmp-ref.info docs/interop/qemu-ga-ref.info
-pdf: qemu-doc.pdf docs/interop/qemu-qmp-ref.pdf docs/interop/qemu-ga-ref.pdf
-txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
+html: qemu-doc.html docs/qemu-qmp-ref.html docs/qemu-ga-ref.html
+info: qemu-doc.info docs/qemu-qmp-ref.info docs/qemu-ga-ref.info
+pdf: qemu-doc.pdf docs/qemu-qmp-ref.pdf docs/qemu-ga-ref.pdf
+txt: qemu-doc.txt docs/qemu-qmp-ref.txt docs/qemu-ga-ref.txt

 qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
 	qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
 	qemu-monitor-info.texi

-docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
-    docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
-    docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7: \
-	docs/interop/qemu-ga-ref.texi docs/interop/qemu-ga-qapi.texi
+docs/qemu-ga-ref.dvi docs/qemu-ga-ref.html docs/qemu-ga-ref.info docs/qemu-ga-ref.pdf docs/qemu-ga-ref.txt docs/qemu-ga-ref.7: \
+docs/qemu-ga-ref.texi docs/qemu-ga-qapi.texi

-docs/interop/qemu-qmp-ref.dvi docs/interop/qemu-qmp-ref.html \
-    docs/interop/qemu-qmp-ref.info docs/interop/qemu-qmp-ref.pdf \
-    docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7: \
-	docs/interop/qemu-qmp-ref.texi docs/interop/qemu-qmp-qapi.texi
+docs/qemu-qmp-ref.dvi docs/qemu-qmp-ref.html docs/qemu-qmp-ref.info docs/qemu-qmp-ref.pdf docs/qemu-qmp-ref.txt docs/qemu-qmp-ref.7: \
+docs/qemu-qmp-ref.texi docs/qemu-qmp-qapi.texi


 ifdef CONFIG_WIN32
@@ -798,11 +790,9 @@ endif # CONFIG_WIN

 # Add a dependency on the generated files, so that they are always
 # rebuilt before other object files
-ifneq ($(wildcard config-host.mak),)
 ifneq ($(filter-out $(UNCHECKED_GOALS),$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
 Makefile: $(GENERATED_FILES)
 endif
-endif

 .SECONDARY: $(TRACE_HEADERS) $(TRACE_HEADERS:%=%-timestamp) \
 	$(TRACE_SOURCES) $(TRACE_SOURCES:%=%-timestamp) \
@@ -40,7 +40,7 @@ io-obj-y = io/

 ifeq ($(CONFIG_SOFTMMU),y)
 common-obj-y = blockdev.o blockdev-nbd.o block/
-common-obj-y += bootdevice.o iothread.o
+common-obj-y += iothread.o
 common-obj-y += net/
 common-obj-y += qdev-monitor.o device-hotplug.o
 common-obj-$(CONFIG_WIN32) += os-win32.o
@@ -49,9 +49,13 @@ common-obj-$(CONFIG_POSIX) += os-posix.o
 common-obj-$(CONFIG_LINUX) += fsdev/

 common-obj-y += migration/
+common-obj-y += page_cache.o #aio.o
+
+common-obj-$(CONFIG_SPICE) += spice-qemu-char.o

 common-obj-y += audio/
 common-obj-y += hw/
+common-obj-y += accel.o

 common-obj-y += replay/

@@ -67,7 +71,6 @@ common-obj-y += tpm.o
 common-obj-$(CONFIG_SLIRP) += slirp/

 common-obj-y += backends/
-common-obj-y += chardev/

 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o

@@ -107,13 +110,9 @@ qga-vss-dll-obj-y = qga/

 ######################################################################
 # contrib
-ivshmem-client-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-client/
-ivshmem-server-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-server/
+ivshmem-client-obj-y = contrib/ivshmem-client/
+ivshmem-server-obj-y = contrib/ivshmem-server/
 libvhost-user-obj-y = contrib/libvhost-user/
-vhost-user-scsi.o-cflags := $(LIBISCSI_CFLAGS)
-vhost-user-scsi.o-libs := $(LIBISCSI_LIBS)
-vhost-user-scsi-obj-y = contrib/vhost-user-scsi/
-vhost-user-scsi-obj-y += contrib/libvhost-user/libvhost-user.o

 ######################################################################
 trace-events-subdirs =
@@ -122,7 +121,7 @@ trace-events-subdirs += crypto
 trace-events-subdirs += io
 trace-events-subdirs += migration
 trace-events-subdirs += block
-trace-events-subdirs += chardev
+trace-events-subdirs += backends
 trace-events-subdirs += hw/block
 trace-events-subdirs += hw/block/dataplane
 trace-events-subdirs += hw/char
@@ -165,9 +164,6 @@ trace-events-subdirs += target/ppc
 trace-events-subdirs += qom
 trace-events-subdirs += linux-user
 trace-events-subdirs += qapi
-trace-events-subdirs += accel/tcg
-trace-events-subdirs += accel/kvm
-trace-events-subdirs += nbd

 trace-events-files = $(SRC_PATH)/trace-events $(trace-events-subdirs:%=$(SRC_PATH)/%/trace-events)

@@ -48,10 +48,7 @@ else
 TARGET_TYPE=system
 endif

-tracetool-y = $(SRC_PATH)/scripts/tracetool.py
-tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")
-
-$(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all $(tracetool-y)
+$(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
@@ -61,7 +58,7 @@ $(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp-installed")

-$(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
+$(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
@@ -71,7 +68,7 @@ $(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp")

-$(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
+$(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=simpletrace-stap \
@@ -91,17 +88,20 @@ all: $(PROGS) stap

 #########################################################
 # cpu emulator library
-obj-y += exec.o
-obj-y += accel/
-obj-$(CONFIG_TCG) += tcg/tcg.o tcg/tcg-op.o tcg/optimize.o
-obj-$(CONFIG_TCG) += tcg/tcg-common.o tcg/tcg-runtime.o
-obj-$(CONFIG_TCG_INTERPRETER) += tcg/tci.o
+obj-y = exec.o translate-all.o cpu-exec.o
+obj-y += translate-common.o
+obj-y += cpu-exec-common.o
+obj-y += tcg/tcg.o tcg/tcg-op.o tcg/optimize.o
+obj-$(CONFIG_TCG_INTERPRETER) += tci.o
+obj-y += tcg/tcg-common.o
 obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
 obj-y += fpu/softfloat.o
 obj-y += target/$(TARGET_BASE_ARCH)/
 obj-y += disas.o
+obj-y += tcg-runtime.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
 obj-$(call lnot,$(CONFIG_HAX)) += hax-stub.o
+obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o

 obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decContext.o
 obj-$(CONFIG_LIBDECNUMBER) += libdecnumber/decNumber.o
@@ -140,14 +140,21 @@ endif #CONFIG_BSD_USER
 # System emulator target
 ifdef CONFIG_SOFTMMU
 obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o numa.o
-obj-y += qtest.o
+obj-y += qtest.o bootdevice.o
 obj-y += hw/
-obj-y += memory.o
+obj-$(CONFIG_KVM) += kvm-all.o
+obj-y += memory.o cputlb.o
 obj-y += memory_mapping.o
 obj-y += dump.o
-obj-y += migration/ram.o
+obj-y += migration/ram.o migration/savevm.o
 LIBS := $(libs_softmmu) $(LIBS)

+# xen support
+obj-$(CONFIG_XEN) += xen-common.o
+obj-$(CONFIG_XEN_I386) += xen-hvm.o xen-mapcache.o
+obj-$(call lnot,$(CONFIG_XEN)) += xen-common-stub.o
+obj-$(call lnot,$(CONFIG_XEN_I386)) += xen-hvm-stub.o
+
 # Hardware support
 ifeq ($(TARGET_NAME), sparc64)
 obj-y += hw/sparc64/
@@ -181,7 +188,8 @@ dummy := $(call unnest-vars,.., \
               qom-obj-y \
               io-obj-y \
               common-obj-y \
-               common-obj-m)
+               common-obj-m \
+               trace-obj-y)
 target-obj-y := $(target-obj-y-save)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(target-obj-y)
@@ -193,7 +201,7 @@ all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)

 $(QEMU_PROG_BUILD): config-devices.mak

-COMMON_LDADDS = ../libqemuutil.a ../libqemustub.a
+COMMON_LDADDS = $(trace-obj-y) ../libqemuutil.a ../libqemustub.a

 # build either PROG or PROGW
 $(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS)
@@ -1 +1 @@
-2.10.0
+2.9.1
@@ -33,7 +33,15 @@
 #include "sysemu/qtest.h"
 #include "hw/xen/xen.h"
 #include "qom/object.h"
-#include "qemu/error-report.h"
+
+int tcg_tb_size;
+static bool tcg_allowed = true;
+
+static int tcg_init(MachineState *ms)
+{
+    tcg_exec_init(tcg_tb_size * 1024 * 1024);
+    return 0;
+}

 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
@@ -70,20 +78,19 @@ static int accel_init_machine(AccelClass *acc, MachineState *ms)

 void configure_accelerator(MachineState *ms)
 {
-    const char *accel, *p;
+    const char *p;
    char buf[10];
    int ret;
    bool accel_initialised = false;
    bool init_failed = false;
    AccelClass *acc = NULL;

-    accel = qemu_opt_get(qemu_get_machine_opts(), "accel");
-    if (accel == NULL) {
+    p = qemu_opt_get(qemu_get_machine_opts(), "accel");
+    if (p == NULL) {
        /* Use the default "accelerator", tcg */
-        accel = "tcg";
+        p = "tcg";
    }

-    p = accel;
    while (!accel_initialised && *p != '\0') {
        if (*p == ':') {
            p++;
@@ -91,6 +98,7 @@ void configure_accelerator(MachineState *ms)
        p = get_opt_name(buf, sizeof(buf), p, ':');
        acc = accel_find(buf);
        if (!acc) {
+            fprintf(stderr, "\"%s\" accelerator not found.\n", buf);
            continue;
        }
        if (acc->available && !acc->available()) {
@@ -101,8 +109,9 @@ void configure_accelerator(MachineState *ms)
        ret = accel_init_machine(acc, ms);
        if (ret < 0) {
            init_failed = true;
-            error_report("failed to initialize %s: %s",
-                         acc->name, strerror(-ret));
+            fprintf(stderr, "failed to initialize %s: %s\n",
+                    acc->name,
+                    strerror(-ret));
        } else {
            accel_initialised = true;
        }
@@ -110,25 +119,37 @@ void configure_accelerator(MachineState *ms)

    if (!accel_initialised) {
        if (!init_failed) {
-            error_report("-machine accel=%s: No accelerator found", accel);
+            fprintf(stderr, "No accelerator found!\n");
        }
        exit(1);
    }

    if (init_failed) {
-        error_report("Back to %s accelerator", acc->name);
+        fprintf(stderr, "Back to %s accelerator.\n", acc->name);
    }
 }

-void accel_register_compat_props(AccelState *accel)
+
+static void tcg_accel_class_init(ObjectClass *oc, void *data)
 {
-    AccelClass *class = ACCEL_GET_CLASS(accel);
-    register_compat_props_array(class->global_props);
+    AccelClass *ac = ACCEL_CLASS(oc);
+    ac->name = "tcg";
+    ac->init_machine = tcg_init;
+    ac->allowed = &tcg_allowed;
 }

+#define TYPE_TCG_ACCEL ACCEL_CLASS_NAME("tcg")
+
+static const TypeInfo tcg_accel_type = {
+    .name = TYPE_TCG_ACCEL,
+    .parent = TYPE_ACCEL,
+    .class_init = tcg_accel_class_init,
+};
+
 static void register_accel_types(void)
 {
    type_register_static(&accel_type);
+    type_register_static(&tcg_accel_type);
 }

 type_init(register_accel_types);
@@ -1,4 +0,0 @@
-obj-$(CONFIG_SOFTMMU) += accel.o
-obj-y += kvm/
-obj-$(CONFIG_TCG) += tcg/
-obj-y += stubs/
@@ -1 +0,0 @@
-obj-$(CONFIG_KVM) += kvm-all.o
@@ -1,15 +0,0 @@
-# Trace events for debugging and performance instrumentation
-
-# kvm-all.c
-kvm_ioctl(int type, void *arg) "type 0x%x, arg %p"
-kvm_vm_ioctl(int type, void *arg) "type 0x%x, arg %p"
-kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type 0x%x, arg %p"
-kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
-kvm_device_ioctl(int fd, int type, void *arg) "dev fd %d, type 0x%x, arg %p"
-kvm_failed_reg_get(uint64_t id, const char *msg) "Warning: Unable to retrieve ONEREG %" PRIu64 " from KVM: %s"
-kvm_failed_reg_set(uint64_t id, const char *msg) "Warning: Unable to set ONEREG %" PRIu64 " to KVM: %s"
-kvm_irqchip_commit_routes(void) ""
-kvm_irqchip_add_msi_route(char *name, int vector, int virq) "dev %s vector %d virq %d"
-kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
-kvm_irqchip_release_virq(int virq) "virq %d"
-
@@ -1,2 +0,0 @@
-obj-$(call lnot,$(CONFIG_KVM)) += kvm-stub.o
-obj-$(call lnot,$(CONFIG_TCG)) += tcg-stub.o
@@ -1,22 +0,0 @@
-/*
- * QEMU TCG accelerator stub
- *
- * Copyright Red Hat, Inc. 2013
- *
- * Author: Paolo Bonzini     <pbonzini@redhat.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu-common.h"
-#include "cpu.h"
-#include "tcg/tcg.h"
-#include "exec/cpu-common.h"
-#include "exec/exec-all.h"
-
-void tb_flush(CPUState *cpu)
-{
-}
@@ -1,3 +0,0 @@
-obj-$(CONFIG_SOFTMMU) += tcg-all.o
-obj-$(CONFIG_SOFTMMU) += cputlb.o
-obj-y += cpu-exec.o cpu-exec-common.o translate-all.o
@@ -1,92 +0,0 @@
-/*
- * QEMU System Emulator, accelerator interfaces
- *
- * Copyright (c) 2003-2008 Fabrice Bellard
- * Copyright (c) 2014 Red Hat Inc.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "sysemu/accel.h"
-#include "sysemu/sysemu.h"
-#include "qom/object.h"
-#include "qemu-common.h"
-#include "qom/cpu.h"
-#include "sysemu/cpus.h"
-#include "qemu/main-loop.h"
-
-unsigned long tcg_tb_size;
-
-#ifndef CONFIG_USER_ONLY
-/* mask must never be zero, except for A20 change call */
-static void tcg_handle_interrupt(CPUState *cpu, int mask)
-{
-    int old_mask;
-    g_assert(qemu_mutex_iothread_locked());
-
-    old_mask = cpu->interrupt_request;
-    cpu->interrupt_request |= mask;
-
-    /*
-     * If called from iothread context, wake the target cpu in
-     * case its halted.
-     */
-    if (!qemu_cpu_is_self(cpu)) {
-        qemu_cpu_kick(cpu);
-    } else {
-        cpu->icount_decr.u16.high = -1;
-        if (use_icount &&
-            !cpu->can_do_io
-            && (mask & ~old_mask) != 0) {
-            cpu_abort(cpu, "Raised interrupt while not in I/O function");
-        }
-    }
-}
-#endif
-
-static int tcg_init(MachineState *ms)
-{
-    tcg_exec_init(tcg_tb_size * 1024 * 1024);
-    cpu_interrupt_handler = tcg_handle_interrupt;
-    return 0;
-}
-
-static void tcg_accel_class_init(ObjectClass *oc, void *data)
-{
-    AccelClass *ac = ACCEL_CLASS(oc);
-    ac->name = "tcg";
-    ac->init_machine = tcg_init;
-    ac->allowed = &tcg_allowed;
-}
-
-#define TYPE_TCG_ACCEL ACCEL_CLASS_NAME("tcg")
-
-static const TypeInfo tcg_accel_type = {
-    .name = TYPE_TCG_ACCEL,
-    .parent = TYPE_ACCEL,
-    .class_init = tcg_accel_class_init,
-};
-
-static void register_accel_types(void)
-{
-    type_register_static(&tcg_accel_type);
-}
-
-type_init(register_accel_types);
@@ -1,10 +0,0 @@
-# Trace events for debugging and performance instrumentation
-
-# TCG related tracing (mostly disabled by default)
-# cpu-exec.c
-disable exec_tb(void *tb, uintptr_t pc) "tb:%p pc=0x%"PRIxPTR
-disable exec_tb_nocache(void *tb, uintptr_t pc) "tb:%p pc=0x%"PRIxPTR
-disable exec_tb_exit(void *last_tb, unsigned int flags) "tb:%p flags=0x%x"
-
-# translate-all.c
-translate_block(void *tb, uintptr_t pc, uint8_t *tb_code) "tb:%p, pc:0x%"PRIxPTR", tb_code:%p"
@@ -27,7 +27,7 @@
 #include "sysemu/sysemu.h"
 #include "sysemu/arch_init.h"
 #include "hw/pci/pci.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/audio.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
 #include "qmp-commands.h"
@@ -85,6 +85,130 @@ int graphic_depth = 32;

 const uint32_t arch_type = QEMU_ARCH;

+struct soundhw {
+    const char *name;
+    const char *descr;
+    int enabled;
+    int isa;
+    union {
+        int (*init_isa) (ISABus *bus);
+        int (*init_pci) (PCIBus *bus);
+    } init;
+};
+
+static struct soundhw soundhw[9];
+static int soundhw_count;
+
+void isa_register_soundhw(const char *name, const char *descr,
+                          int (*init_isa)(ISABus *bus))
+{
+    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
+    soundhw[soundhw_count].name = name;
+    soundhw[soundhw_count].descr = descr;
+    soundhw[soundhw_count].isa = 1;
+    soundhw[soundhw_count].init.init_isa = init_isa;
+    soundhw_count++;
+}
+
+void pci_register_soundhw(const char *name, const char *descr,
+                          int (*init_pci)(PCIBus *bus))
+{
+    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
+    soundhw[soundhw_count].name = name;
+    soundhw[soundhw_count].descr = descr;
+    soundhw[soundhw_count].isa = 0;
+    soundhw[soundhw_count].init.init_pci = init_pci;
+    soundhw_count++;
+}
+
+void select_soundhw(const char *optarg)
+{
+    struct soundhw *c;
+
+    if (is_help_option(optarg)) {
+    show_valid_cards:
+
+        if (soundhw_count) {
+             printf("Valid sound card names (comma separated):\n");
+             for (c = soundhw; c->name; ++c) {
+                 printf ("%-11s %s\n", c->name, c->descr);
+             }
+             printf("\n-soundhw all will enable all of the above\n");
+        } else {
+             printf("Machine has no user-selectable audio hardware "
+                    "(it may or may not have always-present audio hardware).\n");
+        }
+        exit(!is_help_option(optarg));
+    }
+    else {
+        size_t l;
+        const char *p;
+        char *e;
+        int bad_card = 0;
+
+        if (!strcmp(optarg, "all")) {
+            for (c = soundhw; c->name; ++c) {
+                c->enabled = 1;
+            }
+            return;
+        }
+
+        p = optarg;
+        while (*p) {
+            e = strchr(p, ',');
+            l = !e ? strlen(p) : (size_t) (e - p);
+
+            for (c = soundhw; c->name; ++c) {
+                if (!strncmp(c->name, p, l) && !c->name[l]) {
+                    c->enabled = 1;
+                    break;
+                }
+            }
+
+            if (!c->name) {
+                if (l > 80) {
+                    error_report("Unknown sound card name (too big to show)");
+                }
+                else {
+                    error_report("Unknown sound card name `%.*s'",
+                                 (int) l, p);
+                }
+                bad_card = 1;
+            }
+            p += l + (e != NULL);
+        }
+
+        if (bad_card) {
+            goto show_valid_cards;
+        }
+    }
+}
+
+void audio_init(void)
+{
+    struct soundhw *c;
+    ISABus *isa_bus = (ISABus *) object_resolve_path_type("", TYPE_ISA_BUS, NULL);
+    PCIBus *pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
+
+    for (c = soundhw; c->name; ++c) {
+        if (c->enabled) {
+            if (c->isa) {
+                if (!isa_bus) {
+                    error_report("ISA bus not available for %s", c->name);
+                    exit(1);
+                }
+                c->init.init_isa(isa_bus);
+            } else {
+                if (!pci_bus) {
+                    error_report("PCI bus not available for %s", c->name);
+                    exit(1);
+                }
+                c->init.init_pci(pci_bus);
+            }
+        }
+    }
+}
+
 int kvm_available(void)
 {
 #ifdef CONFIG_KVM
@@ -71,12 +71,6 @@ void NAME (void *opaque, struct st_sample *ibuf, struct st_sample *obuf,
        while (rate->ipos <= (rate->opos >> 32)) {
            ilast = *ibuf++;
            rate->ipos++;
-
-            /* if ipos overflow, there is  a infinite loop */
-            if (rate->ipos == 0xffffffff) {
-                rate->ipos = 1;
-                rate->opos = rate->opos & 0xffffffff;
-            }
            /* See if we finished the input buffer yet */
            if (ibuf >= iend) {
                goto the_end;
@@ -1,9 +1,9 @@
-# See docs/devel/tracing.txt for syntax documentation.
+# See docs/tracing.txt for syntax documentation.

 # audio/alsaaudio.c
 alsa_revents(int revents) "revents = %d"
 alsa_pollout(int i, int fd) "i = %d fd = %d"
-alsa_set_handler(int events, int index, int fd, int err) "events=0x%x index=%d fd=%d err=%d"
+alsa_set_handler(int events, int index, int fd, int err) "events=%#x index=%d fd=%d err=%d"
 alsa_wrote_zero(int len) "Failed to write %d frames (wrote zero)"
 alsa_read_zero(long len) "Failed to read %ld frames (read zero)"
 alsa_xrun_out(void) "Recovering from playback xrun"
@@ -13,5 +13,5 @@ alsa_resume_in(void) "Resuming suspended input stream"
 alsa_no_frames(int state) "No frames available and ALSA state is %d"

 # audio/ossaudio.c
-oss_version(int version) "OSS version = 0x%x"
+oss_version(int version) "OSS version = %#x"
 oss_invalid_available_size(int size, int bufsize) "Invalid available size, size=%d bufsize=%d"
@@ -88,7 +88,6 @@ static void wav_capture_destroy (void *opaque)
    WAVState *wav = opaque;

    AUD_del_capture (wav->cap, wav);
-    g_free (wav);
 }

 static void wav_capture_info (void *opaque)
@@ -1,6 +1,10 @@
 common-obj-y += rng.o rng-egd.o
 common-obj-$(CONFIG_POSIX) += rng-random.o

+common-obj-y += msmouse.o wctablet.o testdev.o
+common-obj-$(CONFIG_BRLAPI) += baum.o
+baum.o-cflags := $(SDL_CFLAGS)
+
 common-obj-$(CONFIG_TPM) += tpm.o

 common-obj-y += hostmem.o hostmem-ram.o
@@ -24,7 +24,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "chardev/char.h"
+#include "sysemu/char.h"
 #include "qemu/timer.h"
 #include "hw/usb.h"
 #include "ui/console.h"
@@ -222,7 +222,7 @@ cryptodev_backend_can_be_deleted(UserCreatable *uc, Error **errp)

 static void cryptodev_backend_instance_init(Object *obj)
 {
-    object_property_add(obj, "queues", "uint32",
+    object_property_add(obj, "queues", "int",
                          cryptodev_backend_get_queues,
                          cryptodev_backend_set_queues,
                          NULL, NULL, NULL);
@@ -51,7 +51,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 #ifndef CONFIG_LINUX
    error_setg(errp, "-mem-path not supported on this host");
 #else
-    if (!host_memory_backend_mr_inited(backend)) {
+    if (!memory_region_size(&backend->mr)) {
        gchar *path;
        backend->force_prealloc = mem_prealloc;
        path = object_get_canonical_path(OBJECT(backend));
@@ -76,7 +76,7 @@ static void set_mem_path(Object *o, const char *str, Error **errp)
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

-    if (host_memory_backend_mr_inited(backend)) {
+    if (memory_region_size(&backend->mr)) {
        error_setg(errp, "cannot change property value");
        return;
    }
@@ -96,7 +96,7 @@ static void file_memory_backend_set_share(Object *o, bool value, Error **errp)
    HostMemoryBackend *backend = MEMORY_BACKEND(o);
    HostMemoryBackendFile *fb = MEMORY_BACKEND_FILE(o);

-    if (host_memory_backend_mr_inited(backend)) {
+    if (memory_region_size(&backend->mr)) {
        error_setg(errp, "cannot change property value");
        return;
    }
@@ -28,7 +28,7 @@ ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
    }

    path = object_get_canonical_path_component(OBJECT(backend));
-    memory_region_init_ram_nomigrate(&backend->mr, OBJECT(backend), path,
+    memory_region_init_ram(&backend->mr, OBJECT(backend), path,
                           backend->size, errp);
    g_free(path);
 }
@@ -45,7 +45,7 @@ host_memory_backend_set_size(Object *obj, Visitor *v, const char *name,
    Error *local_err = NULL;
    uint64_t value;

-    if (host_memory_backend_mr_inited(backend)) {
+    if (memory_region_size(&backend->mr)) {
        error_setg(&local_err, "cannot change property value");
        goto out;
    }
@@ -146,7 +146,7 @@ static void host_memory_backend_set_merge(Object *obj, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);

-    if (!host_memory_backend_mr_inited(backend)) {
+    if (!memory_region_size(&backend->mr)) {
        backend->merge = value;
        return;
    }
@@ -172,7 +172,7 @@ static void host_memory_backend_set_dump(Object *obj, bool value, Error **errp)
 {
    HostMemoryBackend *backend = MEMORY_BACKEND(obj);

-    if (!host_memory_backend_mr_inited(backend)) {
+    if (!memory_region_size(&backend->mr)) {
        backend->dump = value;
        return;
    }
@@ -208,7 +208,7 @@ static void host_memory_backend_set_prealloc(Object *obj, bool value,
        }
    }

-    if (!host_memory_backend_mr_inited(backend)) {
+    if (!memory_region_size(&backend->mr)) {
        backend->prealloc = value;
        return;
    }
@@ -237,19 +237,10 @@ static void host_memory_backend_init(Object *obj)
    backend->prealloc = mem_prealloc;
 }

-bool host_memory_backend_mr_inited(HostMemoryBackend *backend)
-{
-    /*
-     * NOTE: We forbid zero-length memory backend, so here zero means
-     * "we haven't inited the backend memory region yet".
-     */
-    return memory_region_size(&backend->mr) != 0;
-}
-
 MemoryRegion *
 host_memory_backend_get_memory(HostMemoryBackend *backend, Error **errp)
 {
-    return host_memory_backend_mr_inited(backend) ? &backend->mr : NULL;
+    return memory_region_size(&backend->mr) ? &backend->mr : NULL;
 }

 void host_memory_backend_set_mapped(HostMemoryBackend *backend, bool mapped)
@@ -23,7 +23,7 @@
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "chardev/char.h"
+#include "sysemu/char.h"
 #include "ui/console.h"
 #include "ui/input.h"

@@ -12,7 +12,7 @@

 #include "qemu/osdep.h"
 #include "sysemu/rng.h"
-#include "chardev/char-fe.h"
+#include "sysemu/char.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"

@@ -106,7 +106,7 @@ static void rng_egd_opened(RngBackend *b, Error **errp)

    /* FIXME we should resubmit pending requests when the CDS reconnects. */
    qemu_chr_fe_set_handlers(&s->chr, rng_egd_chr_can_read,
-                             rng_egd_chr_read, NULL, NULL, s, NULL, true);
+                             rng_egd_chr_read, NULL, s, NULL, true);
 }

 static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
@@ -145,7 +145,7 @@ static void rng_egd_finalize(Object *obj)
 {
    RngEgd *s = RNG_EGD(obj);

-    qemu_chr_fe_deinit(&s->chr, false);
+    qemu_chr_fe_deinit(&s->chr);
    g_free(s->chr_name);
 }

@@ -25,7 +25,7 @@
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "chardev/char.h"
+#include "sysemu/char.h"

 #define BUF_SIZE 32

@@ -0,0 +1,10 @@
+# See docs/tracing.txt for syntax documentation.
+
+# backends/wctablet.c
+wct_init(void) ""
+wct_cmd_re(void) ""
+wct_cmd_st(void) ""
+wct_cmd_sp(void) ""
+wct_cmd_ts(int input) "0x%02x"
+wct_cmd_other(const char *cmd) "%s"
+wct_speed(int speed) "%d"
@@ -32,7 +32,7 @@

 #include "qemu/osdep.h"
 #include "qemu-common.h"
-#include "chardev/char-serial.h"
+#include "sysemu/char.h"
 #include "ui/console.h"
 #include "ui/input.h"
 #include "trace.h"
@@ -163,16 +163,11 @@ void path_combine(char *dest, int dest_size,
    if (path_is_absolute(filename)) {
        pstrcpy(dest, dest_size, filename);
    } else {
-        const char *protocol_stripped = NULL;
-
-        if (path_has_protocol(base_path)) {
-            protocol_stripped = strchr(base_path, ':');
-            if (protocol_stripped) {
-                protocol_stripped++;
-            }
-        }
-        p = protocol_stripped ?: base_path;
-
+        p = strchr(base_path, ':');
+        if (p)
+            p++;
+        else
+            p = base_path;
        p1 = strrchr(base_path, '/');
 #ifdef _WIN32
        {
@@ -197,90 +192,6 @@ void path_combine(char *dest, int dest_size,
    }
 }

-/*
- * Helper function for bdrv_parse_filename() implementations to remove optional
- * protocol prefixes (especially "file:") from a filename and for putting the
- * stripped filename into the options QDict if there is such a prefix.
- */
-void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
-                                      QDict *options)
-{
-    if (strstart(filename, prefix, &filename)) {
-        /* Stripping the explicit protocol prefix may result in a protocol
-         * prefix being (wrongly) detected (if the filename contains a colon) */
-        if (path_has_protocol(filename)) {
-            QString *fat_filename;
-
-            /* This means there is some colon before the first slash; therefore,
-             * this cannot be an absolute path */
-            assert(!path_is_absolute(filename));
-
-            /* And we can thus fix the protocol detection issue by prefixing it
-             * by "./" */
-            fat_filename = qstring_from_str("./");
-            qstring_append(fat_filename, filename);
-
-            assert(!path_has_protocol(qstring_get_str(fat_filename)));
-
-            qdict_put(options, "filename", fat_filename);
-        } else {
-            /* If no protocol prefix was detected, we can use the shortened
-             * filename as-is */
-            qdict_put_str(options, "filename", filename);
-        }
-    }
-}
-
-
-/* Returns whether the image file is opened as read-only. Note that this can
- * return false and writing to the image file is still not possible because the
- * image is inactivated. */
-bool bdrv_is_read_only(BlockDriverState *bs)
-{
-    return bs->read_only;
-}
-
-/* Returns whether the image file can be written to right now */
-bool bdrv_is_writable(BlockDriverState *bs)
-{
-    return !bdrv_is_read_only(bs) && !(bs->open_flags & BDRV_O_INACTIVE);
-}
-
-int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
-                           bool ignore_allow_rdw, Error **errp)
-{
-    /* Do not set read_only if copy_on_read is enabled */
-    if (bs->copy_on_read && read_only) {
-        error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
-                   bdrv_get_device_or_node_name(bs));
-        return -EINVAL;
-    }
-
-    /* Do not clear read_only if it is prohibited */
-    if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
-        !ignore_allow_rdw)
-    {
-        error_setg(errp, "Node '%s' is read only",
-                   bdrv_get_device_or_node_name(bs));
-        return -EPERM;
-    }
-
-    return 0;
-}
-
-int bdrv_set_read_only(BlockDriverState *bs, bool read_only, Error **errp)
-{
-    int ret = 0;
-
-    ret = bdrv_can_set_read_only(bs, read_only, false, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
-    bs->read_only = read_only;
-    return 0;
-}
-
 void bdrv_get_full_backing_filename_from_filename(const char *backed,
                                                  const char *backing,
                                                  char *dest, size_t sz,
@@ -323,8 +234,6 @@ BlockDriverState *bdrv_new(void)
        QLIST_INIT(&bs->op_blockers[i]);
    }
    notifier_with_return_list_init(&bs->before_write_notifiers);
-    qemu_co_mutex_init(&bs->reqs_lock);
-    qemu_mutex_init(&bs->dirty_bitmap_mutex);
    bs->refcnt = 1;
    bs->aio_context = qemu_get_aio_context();

@@ -816,13 +725,6 @@ static void bdrv_child_cb_drained_end(BdrvChild *child)
    bdrv_drained_end(bs);
 }

-static int bdrv_child_cb_inactivate(BdrvChild *child)
-{
-    BlockDriverState *bs = child->opaque;
-    assert(bs->open_flags & BDRV_O_INACTIVE);
-    return 0;
-}
-
 /*
 * Returns the options and flags that a temporary snapshot should get, based on
 * the originally requested flags (the originally requested image will have
@@ -861,7 +763,6 @@ static void bdrv_inherited_options(int *child_flags, QDict *child_options,
     * the parent. */
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
-    qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);

    /* Inherit the read-only option from the parent if it's not set */
    qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
@@ -883,7 +784,6 @@ const BdrvChildRole child_file = {
    .inherit_options = bdrv_inherited_options,
    .drained_begin   = bdrv_child_cb_drained_begin,
    .drained_end     = bdrv_child_cb_drained_end,
-    .inactivate      = bdrv_child_cb_inactivate,
 };

 /*
@@ -905,7 +805,6 @@ const BdrvChildRole child_format = {
    .inherit_options = bdrv_inherited_fmt_options,
    .drained_begin   = bdrv_child_cb_drained_begin,
    .drained_end     = bdrv_child_cb_drained_end,
-    .inactivate      = bdrv_child_cb_inactivate,
 };

 static void bdrv_backing_attach(BdrvChild *c)
@@ -972,7 +871,6 @@ static void bdrv_backing_options(int *child_flags, QDict *child_options,
     * which is only applied on the top level (BlockBackend) */
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
    qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
-    qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);

    /* backing files always opened read-only */
    qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
@@ -991,7 +889,6 @@ const BdrvChildRole child_backing = {
    .inherit_options = bdrv_backing_options,
    .drained_begin   = bdrv_child_cb_drained_begin,
    .drained_end     = bdrv_child_cb_drained_end,
-    .inactivate      = bdrv_child_cb_inactivate,
 };

 static int bdrv_open_flags(BlockDriverState *bs, int flags)
@@ -1122,19 +1019,20 @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
        } else {
            error_setg_errno(errp, -ret, "Could not open image");
        }
-        goto open_failed;
+        goto free_and_fail;
    }

    ret = refresh_total_sectors(bs, bs->total_sectors);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "Could not refresh total sector count");
-        return ret;
+        goto free_and_fail;
    }

    bdrv_refresh_limits(bs, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
-        return -EINVAL;
+        ret = -EINVAL;
+        goto free_and_fail;
    }

    assert(bdrv_opt_mem_align(bs) != 0);
@@ -1142,14 +1040,12 @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
    assert(is_power_of_2(bs->bl.request_alignment));

    return 0;
-open_failed:
-    bs->drv = NULL;
-    if (bs->file != NULL) {
-        bdrv_unref_child(bs, bs->file);
-        bs->file = NULL;
-    }
+
+free_and_fail:
+    /* FIXME Close bs first if already opened*/
    g_free(bs->opaque);
    bs->opaque = NULL;
+    bs->drv = NULL;
    return ret;
 }

@@ -1170,9 +1066,7 @@ BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
    ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
    if (ret < 0) {
        QDECREF(bs->explicit_options);
-        bs->explicit_options = NULL;
        QDECREF(bs->options);
-        bs->options = NULL;
        bdrv_unref(bs);
        return NULL;
    }
@@ -1219,11 +1113,6 @@ QemuOptsList bdrv_runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "discard operation (ignore/off, unmap/on)",
        },
-        {
-            .name = BDRV_OPT_FORCE_SHARE,
-            .type = QEMU_OPT_BOOL,
-            .help = "always accept other writers (default: off)",
-        },
        { /* end of list */ }
    },
 };
@@ -1263,16 +1152,6 @@ static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
    drv = bdrv_find_format(driver_name);
    assert(drv != NULL);

-    bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
-
-    if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
-        error_setg(errp,
-                   BDRV_OPT_FORCE_SHARE
-                   "=on can only be used with read-only images");
-        ret = -EINVAL;
-        goto fail_opts;
-    }
-
    if (file != NULL) {
        filename = blk_bs(file)->filename;
    } else {
@@ -1308,9 +1187,7 @@ static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
        goto fail_opts;
    }

-    /* bdrv_new() and bdrv_close() make it so */
-    assert(atomic_read(&bs->copy_on_read) == 0);
-
+    assert(bs->copy_on_read == 0); /* bdrv_new() and bdrv_close() make it so */
    if (bs->open_flags & BDRV_O_COPY_ON_READ) {
        if (!bs->read_only) {
            bdrv_enable_copy_on_read(bs);
@@ -1534,22 +1411,6 @@ static int bdrv_child_check_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
 static void bdrv_child_abort_perm_update(BdrvChild *c);
 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared);

-static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
-                            BdrvChild *c,
-                            const BdrvChildRole *role,
-                            uint64_t parent_perm, uint64_t parent_shared,
-                            uint64_t *nperm, uint64_t *nshared)
-{
-    if (bs->drv && bs->drv->bdrv_child_perm) {
-        bs->drv->bdrv_child_perm(bs, c, role,
-                                 parent_perm, parent_shared,
-                                 nperm, nshared);
-    }
-    if (child_bs && child_bs->force_share) {
-        *nshared = BLK_PERM_ALL;
-    }
-}
-
 /*
 * Check whether permissions on this node can be changed in a way that
 * @cumulative_perms and @cumulative_shared_perms are the new cumulative
@@ -1569,7 +1430,7 @@ static int bdrv_check_perm(BlockDriverState *bs, uint64_t cumulative_perms,

    /* Write permissions never work with read-only images */
    if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
-        !bdrv_is_writable(bs))
+        bdrv_is_read_only(bs))
    {
        error_setg(errp, "Block node is read-only");
        return -EPERM;
@@ -1594,9 +1455,9 @@ static int bdrv_check_perm(BlockDriverState *bs, uint64_t cumulative_perms,
    /* Check all children */
    QLIST_FOREACH(c, &bs->children, next) {
        uint64_t cur_perm, cur_shared;
-        bdrv_child_perm(bs, c->bs, c, c->role,
-                        cumulative_perms, cumulative_shared_perms,
-                        &cur_perm, &cur_shared);
+        drv->bdrv_child_perm(bs, c, c->role,
+                             cumulative_perms, cumulative_shared_perms,
+                             &cur_perm, &cur_shared);
        ret = bdrv_child_check_perm(c, cur_perm, cur_shared, ignore_children,
                                    errp);
        if (ret < 0) {
@@ -1656,9 +1517,9 @@ static void bdrv_set_perm(BlockDriverState *bs, uint64_t cumulative_perms,
    /* Update all children */
    QLIST_FOREACH(c, &bs->children, next) {
        uint64_t cur_perm, cur_shared;
-        bdrv_child_perm(bs, c->bs, c, c->role,
-                        cumulative_perms, cumulative_shared_perms,
-                        &cur_perm, &cur_shared);
+        drv->bdrv_child_perm(bs, c, c->role,
+                             cumulative_perms, cumulative_shared_perms,
+                             &cur_perm, &cur_shared);
        bdrv_child_set_perm(c, cur_perm, cur_shared);
    }
 }
@@ -1688,7 +1549,7 @@ static char *bdrv_child_user_desc(BdrvChild *c)
    return g_strdup("another user");
 }

-char *bdrv_perm_names(uint64_t perm)
+static char *bdrv_perm_names(uint64_t perm)
 {
    struct perm_name {
        uint64_t perm;
@@ -1854,7 +1715,7 @@ void bdrv_format_default_perms(BlockDriverState *bs, BdrvChild *c,
        bdrv_filter_default_perms(bs, c, role, perm, shared, &perm, &shared);

        /* Format drivers may touch metadata even if the guest doesn't write */
-        if (bdrv_is_writable(bs)) {
+        if (!bdrv_is_read_only(bs)) {
            perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
        }

@@ -1880,10 +1741,6 @@ void bdrv_format_default_perms(BlockDriverState *bs, BdrvChild *c,
                  BLK_PERM_WRITE_UNCHANGED;
    }

-    if (bs->open_flags & BDRV_O_INACTIVE) {
-        shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
-    }
-
    *nperm = perm;
    *nshared = shared;
 }
@@ -1936,8 +1793,6 @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
    BlockDriverState *old_bs = child->bs;
    uint64_t perm, shared_perm;

-    bdrv_replace_child_noperm(child, new_bs);
-
    if (old_bs) {
        /* Update permissions for old node. This is guaranteed to succeed
         * because we're just taking a parent away, so we're loosening
@@ -1947,6 +1802,8 @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
        bdrv_set_perm(old_bs, perm, shared_perm);
    }

+    bdrv_replace_child_noperm(child, new_bs);
+
    if (new_bs) {
        bdrv_get_cumulative_perm(new_bs, &perm, &shared_perm);
        bdrv_set_perm(new_bs, perm, shared_perm);
@@ -1997,8 +1854,8 @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,

    assert(parent_bs->drv);
    assert(bdrv_get_aio_context(parent_bs) == bdrv_get_aio_context(child_bs));
-    bdrv_child_perm(parent_bs, child_bs, NULL, child_role,
-                    perm, shared_perm, &perm, &shared_perm);
+    parent_bs->drv->bdrv_child_perm(parent_bs, NULL, child_role,
+                                    perm, shared_perm, &perm, &shared_perm);

    child = bdrv_root_attach_child(child_bs, child_name, child_role,
                                   perm, shared_perm, parent_bs, errp);
@@ -2191,7 +2048,6 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
        ret = -EINVAL;
        goto free_exit;
    }
-    bdrv_set_aio_context(backing_hd, bdrv_get_aio_context(bs));

    /* Hook up the backing file link; drop our reference, bs owns the
     * backing_hd reference now */
@@ -2302,7 +2158,7 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
    char *tmp_filename = g_malloc0(PATH_MAX + 1);
    int64_t total_size;
    QemuOpts *opts = NULL;
-    BlockDriverState *bs_snapshot = NULL;
+    BlockDriverState *bs_snapshot;
    Error *local_err = NULL;
    int ret;

@@ -2342,25 +2198,28 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
    bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
    snapshot_options = NULL;
    if (!bs_snapshot) {
+        ret = -EINVAL;
        goto out;
    }

-    /* bdrv_append() consumes a strong reference to bs_snapshot
-     * (i.e. it will call bdrv_unref() on it) even on error, so in
-     * order to be able to return one, we have to increase
-     * bs_snapshot's refcount here */
+    /* bdrv_append() consumes a strong reference to bs_snapshot (i.e. it will
+     * call bdrv_unref() on it), so in order to be able to return one, we have
+     * to increase bs_snapshot's refcount here */
    bdrv_ref(bs_snapshot);
    bdrv_append(bs_snapshot, bs, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
-        bs_snapshot = NULL;
+        ret = -EINVAL;
        goto out;
    }

+    g_free(tmp_filename);
+    return bs_snapshot;
+
 out:
    QDECREF(snapshot_options);
    g_free(tmp_filename);
-    return bs_snapshot;
+    return NULL;
 }

 /*
@@ -2580,7 +2439,15 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
        goto close_and_fail;
    }

-    bdrv_parent_cb_change_media(bs, true);
+    if (!bdrv_key_required(bs)) {
+        bdrv_parent_cb_change_media(bs, true);
+    } else if (!runstate_check(RUN_STATE_PRELAUNCH)
+               && !runstate_check(RUN_STATE_INMIGRATE)
+               && !runstate_check(RUN_STATE_PAUSED)) { /* HACK */
+        error_setg(errp,
+                   "Guest must be stopped for opening of encrypted image");
+        goto close_and_fail;
+    }

    QDECREF(options);

@@ -2606,12 +2473,14 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,

 fail:
    blk_unref(file);
+    if (bs->file != NULL) {
+        bdrv_unref_child(bs, bs->file);
+    }
    QDECREF(snapshot_options);
    QDECREF(bs->explicit_options);
    QDECREF(bs->options);
    QDECREF(options);
    bs->options = NULL;
-    bs->explicit_options = NULL;
    bdrv_unref(bs);
    error_propagate(errp, local_err);
    return NULL;
@@ -2729,11 +2598,8 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
    bdrv_join_options(bs, options, old_options);
    QDECREF(old_options);

-    /* bdrv_open_inherit() sets and clears some additional flags internally */
+    /* bdrv_open() masks this flag out */
    flags &= ~BDRV_O_PROTOCOL;
-    if (flags & BDRV_O_RDWR) {
-        flags |= BDRV_O_ALLOW_RDWR;
-    }

    QLIST_FOREACH(child, &bs->children, next) {
        QDict *new_child_options;
@@ -2880,7 +2746,6 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
    BlockDriver *drv;
    QemuOpts *opts;
    const char *value;
-    bool read_only;

    assert(reopen_state != NULL);
    assert(reopen_state->bs->drv != NULL);
@@ -2909,13 +2774,12 @@ int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
        qdict_put_str(reopen_state->options, "driver", value);
    }

-    /* If we are to stay read-only, do not allow permission change
-     * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
-     * not set, or if the BDS still has copy_on_read enabled */
-    read_only = !(reopen_state->flags & BDRV_O_RDWR);
-    ret = bdrv_can_set_read_only(reopen_state->bs, read_only, true, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    /* if we are to stay read-only, do not allow permission change
+     * to r/w */
+    if (!(reopen_state->bs->open_flags & BDRV_O_ALLOW_RDWR) &&
+        reopen_state->flags & BDRV_O_RDWR) {
+        error_setg(errp, "Node '%s' is read only",
+                   bdrv_get_device_or_node_name(reopen_state->bs));
        goto error;
    }

@@ -2989,45 +2853,24 @@ error:
 void bdrv_reopen_commit(BDRVReopenState *reopen_state)
 {
    BlockDriver *drv;
-    BlockDriverState *bs;
-    bool old_can_write, new_can_write;

    assert(reopen_state != NULL);
-    bs = reopen_state->bs;
-    drv = bs->drv;
+    drv = reopen_state->bs->drv;
    assert(drv != NULL);

-    old_can_write =
-        !bdrv_is_read_only(bs) && !(bdrv_get_flags(bs) & BDRV_O_INACTIVE);
-
    /* If there are any driver level actions to take */
    if (drv->bdrv_reopen_commit) {
        drv->bdrv_reopen_commit(reopen_state);
    }

    /* set BDS specific flags now */
-    QDECREF(bs->explicit_options);
+    QDECREF(reopen_state->bs->explicit_options);

-    bs->explicit_options   = reopen_state->explicit_options;
-    bs->open_flags         = reopen_state->flags;
-    bs->read_only = !(reopen_state->flags & BDRV_O_RDWR);
+    reopen_state->bs->explicit_options   = reopen_state->explicit_options;
+    reopen_state->bs->open_flags         = reopen_state->flags;
+    reopen_state->bs->read_only = !(reopen_state->flags & BDRV_O_RDWR);

-    bdrv_refresh_limits(bs, NULL);
-
-    new_can_write =
-        !bdrv_is_read_only(bs) && !(bdrv_get_flags(bs) & BDRV_O_INACTIVE);
-    if (!old_can_write && new_can_write && drv->bdrv_reopen_bitmaps_rw) {
-        Error *local_err = NULL;
-        if (drv->bdrv_reopen_bitmaps_rw(bs, &local_err) < 0) {
-            /* This is not fatal, bitmaps just left read-only, so all following
-             * writes will fail. User can remove read-only bitmaps to unblock
-             * writes.
-             */
-            error_reportf_err(local_err,
-                              "%s: Failed to make dirty bitmaps writable: ",
-                              bdrv_get_node_name(bs));
-        }
-    }
+    bdrv_refresh_limits(reopen_state->bs, NULL);
 }

 /*
@@ -3061,6 +2904,9 @@ static void bdrv_close(BlockDriverState *bs)
    bdrv_flush(bs);
    bdrv_drain(bs); /* in case flush left pending I/O */

+    bdrv_release_named_dirty_bitmaps(bs);
+    assert(QLIST_EMPTY(&bs->dirty_bitmaps));
+
    if (bs->drv) {
        BdrvChild *child, *next;

@@ -3085,23 +2931,20 @@ static void bdrv_close(BlockDriverState *bs)

        g_free(bs->opaque);
        bs->opaque = NULL;
-        atomic_set(&bs->copy_on_read, 0);
+        bs->copy_on_read = 0;
        bs->backing_file[0] = '\0';
        bs->backing_format[0] = '\0';
        bs->total_sectors = 0;
        bs->encrypted = false;
+        bs->valid_key = false;
        bs->sg = false;
        QDECREF(bs->options);
        QDECREF(bs->explicit_options);
        bs->options = NULL;
-        bs->explicit_options = NULL;
        QDECREF(bs->full_open_options);
        bs->full_open_options = NULL;
    }

-    bdrv_release_named_dirty_bitmaps(bs);
-    assert(QLIST_EMPTY(&bs->dirty_bitmaps));
-
    QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
        g_free(ban);
    }
@@ -3419,14 +3262,17 @@ exit:
 /**
 * Truncate file to 'offset' bytes (needed only for file protocols)
 */
-int bdrv_truncate(BdrvChild *child, int64_t offset, PreallocMode prealloc,
-                  Error **errp)
+int bdrv_truncate(BdrvChild *child, int64_t offset, Error **errp)
 {
    BlockDriverState *bs = child->bs;
    BlockDriver *drv = bs->drv;
    int ret;

-    assert(child->perm & BLK_PERM_RESIZE);
+    /* FIXME: Some format block drivers use this function instead of implicitly
+     *        growing their file by writing beyond its end.
+     *        See bdrv_aligned_pwritev() for an explanation why we currently
+     *        cannot assert this permission in that case. */
+    // assert(child->perm & BLK_PERM_RESIZE);

    if (!drv) {
        error_setg(errp, "No medium inserted");
@@ -3441,14 +3287,14 @@ int bdrv_truncate(BdrvChild *child, int64_t offset, PreallocMode prealloc,
        return -EACCES;
    }

-    assert(!(bs->open_flags & BDRV_O_INACTIVE));
-
-    ret = drv->bdrv_truncate(bs, offset, prealloc, errp);
+    ret = drv->bdrv_truncate(bs, offset);
    if (ret == 0) {
        ret = refresh_total_sectors(bs, offset >> BDRV_SECTOR_BITS);
        bdrv_dirty_bitmap_truncate(bs);
        bdrv_parent_cb_resize(bs);
-        atomic_inc(&bs->write_gen);
+        ++bs->write_gen;
+    } else {
+        error_setg_errno(errp, -ret, "Failed to resize image");
    }
    return ret;
 }
@@ -3472,41 +3318,6 @@ int64_t bdrv_get_allocated_file_size(BlockDriverState *bs)
    return -ENOTSUP;
 }

-/*
- * bdrv_measure:
- * @drv: Format driver
- * @opts: Creation options for new image
- * @in_bs: Existing image containing data for new image (may be NULL)
- * @errp: Error object
- * Returns: A #BlockMeasureInfo (free using qapi_free_BlockMeasureInfo())
- *          or NULL on error
- *
- * Calculate file size required to create a new image.
- *
- * If @in_bs is given then space for allocated clusters and zero clusters
- * from that image are included in the calculation.  If @opts contains a
- * backing file that is shared by @in_bs then backing clusters may be omitted
- * from the calculation.
- *
- * If @in_bs is NULL then the calculation includes no allocated clusters
- * unless a preallocation option is given in @opts.
- *
- * Note that @in_bs may use a different BlockDriver from @drv.
- *
- * If an error occurs the @errp pointer is set.
- */
-BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
-                               BlockDriverState *in_bs, Error **errp)
-{
-    if (!drv->bdrv_measure) {
-        error_setg(errp, "Block driver '%s' does not support size measurement",
-                   drv->format_name);
-        return NULL;
-    }
-
-    return drv->bdrv_measure(opts, in_bs, errp);
-}
-
 /**
 * Return number of sectors on success, -errno on error.
 */
@@ -3546,6 +3357,11 @@ void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
    *nb_sectors_ptr = nb_sectors < 0 ? 0 : nb_sectors;
 }

+bool bdrv_is_read_only(BlockDriverState *bs)
+{
+    return bs->read_only;
+}
+
 bool bdrv_is_sg(BlockDriverState *bs)
 {
    return bs->sg;
@@ -3559,6 +3375,72 @@ bool bdrv_is_encrypted(BlockDriverState *bs)
    return bs->encrypted;
 }

+bool bdrv_key_required(BlockDriverState *bs)
+{
+    BdrvChild *backing = bs->backing;
+
+    if (backing && backing->bs->encrypted && !backing->bs->valid_key) {
+        return true;
+    }
+    return (bs->encrypted && !bs->valid_key);
+}
+
+int bdrv_set_key(BlockDriverState *bs, const char *key)
+{
+    int ret;
+    if (bs->backing && bs->backing->bs->encrypted) {
+        ret = bdrv_set_key(bs->backing->bs, key);
+        if (ret < 0)
+            return ret;
+        if (!bs->encrypted)
+            return 0;
+    }
+    if (!bs->encrypted) {
+        return -EINVAL;
+    } else if (!bs->drv || !bs->drv->bdrv_set_key) {
+        return -ENOMEDIUM;
+    }
+    ret = bs->drv->bdrv_set_key(bs, key);
+    if (ret < 0) {
+        bs->valid_key = false;
+    } else if (!bs->valid_key) {
+        /* call the change callback now, we skipped it on open */
+        bs->valid_key = true;
+        bdrv_parent_cb_change_media(bs, true);
+    }
+    return ret;
+}
+
+/*
+ * Provide an encryption key for @bs.
+ * If @key is non-null:
+ *     If @bs is not encrypted, fail.
+ *     Else if the key is invalid, fail.
+ *     Else set @bs's key to @key, replacing the existing key, if any.
+ * If @key is null:
+ *     If @bs is encrypted and still lacks a key, fail.
+ *     Else do nothing.
+ * On failure, store an error object through @errp if non-null.
+ */
+void bdrv_add_key(BlockDriverState *bs, const char *key, Error **errp)
+{
+    if (key) {
+        if (!bdrv_is_encrypted(bs)) {
+            error_setg(errp, "Node '%s' is not encrypted",
+                      bdrv_get_device_or_node_name(bs));
+        } else if (bdrv_set_key(bs, key) < 0) {
+            error_setg(errp, QERR_INVALID_PASSWORD);
+        }
+    } else {
+        if (bdrv_key_required(bs)) {
+            error_set(errp, ERROR_CLASS_DEVICE_ENCRYPTED,
+                      "'%s' (%s) is encrypted",
+                      bdrv_get_device_or_node_name(bs),
+                      bdrv_get_encrypted_filename(bs));
+        }
+    }
+}
+
 const char *bdrv_get_format_name(BlockDriverState *bs)
 {
    return bs->drv ? bs->drv->format_name : NULL;
@@ -3994,8 +3876,7 @@ void bdrv_init_with_whitelist(void)

 void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp)
 {
-    BdrvChild *child, *parent;
-    uint64_t perm, shared_perm;
+    BdrvChild *child;
    Error *local_err = NULL;
    int ret;

@@ -4031,26 +3912,6 @@ void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp)
        error_setg_errno(errp, -ret, "Could not refresh total sector count");
        return;
    }
-
-    /* Update permissions, they may differ for inactive nodes */
-    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
-    ret = bdrv_check_perm(bs, perm, shared_perm, NULL, &local_err);
-    if (ret < 0) {
-        bs->open_flags |= BDRV_O_INACTIVE;
-        error_propagate(errp, local_err);
-        return;
-    }
-    bdrv_set_perm(bs, perm, shared_perm);
-
-    QLIST_FOREACH(parent, &bs->parents, next_parent) {
-        if (parent->role->activate) {
-            parent->role->activate(parent, &local_err);
-            if (local_err) {
-                error_propagate(errp, local_err);
-                return;
-            }
-        }
-    }
 }

 void bdrv_invalidate_cache_all(Error **errp)
@@ -4075,7 +3936,7 @@ void bdrv_invalidate_cache_all(Error **errp)
 static int bdrv_inactivate_recurse(BlockDriverState *bs,
                                   bool setting_flag)
 {
-    BdrvChild *child, *parent;
+    BdrvChild *child;
    int ret;

    if (!setting_flag && bs->drv->bdrv_inactivate) {
@@ -4085,26 +3946,6 @@ static int bdrv_inactivate_recurse(BlockDriverState *bs,
        }
    }

-    if (setting_flag && !(bs->open_flags & BDRV_O_INACTIVE)) {
-        uint64_t perm, shared_perm;
-
-        QLIST_FOREACH(parent, &bs->parents, next_parent) {
-            if (parent->role->inactivate) {
-                ret = parent->role->inactivate(parent);
-                if (ret < 0) {
-                    return ret;
-                }
-            }
-        }
-
-        bs->open_flags |= BDRV_O_INACTIVE;
-
-        /* Update permissions, they may differ for inactive nodes */
-        bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
-        bdrv_check_perm(bs, perm, shared_perm, NULL, &error_abort);
-        bdrv_set_perm(bs, perm, shared_perm);
-    }
-
    QLIST_FOREACH(child, &bs->children, next) {
        ret = bdrv_inactivate_recurse(child->bs, setting_flag);
        if (ret < 0) {
@@ -4112,10 +3953,9 @@ static int bdrv_inactivate_recurse(BlockDriverState *bs,
        }
    }

-    /* At this point persistent bitmaps should be already stored by the format
-     * driver */
-    bdrv_release_persistent_dirty_bitmaps(bs);
-
+    if (setting_flag) {
+        bs->open_flags |= BDRV_O_INACTIVE;
+    }
    return 0;
 }

@@ -4248,9 +4088,11 @@ bool bdrv_op_is_blocked(BlockDriverState *bs, BlockOpType op, Error **errp)
    assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
    if (!QLIST_EMPTY(&bs->op_blockers[op])) {
        blocker = QLIST_FIRST(&bs->op_blockers[op]);
-        error_propagate(errp, error_copy(blocker->reason));
-        error_prepend(errp, "Node '%s' is busy: ",
-                      bdrv_get_device_or_node_name(bs));
+        if (errp) {
+            *errp = error_copy(blocker->reason);
+            error_prepend(errp, "Node '%s' is busy: ",
+                          bdrv_get_device_or_node_name(bs));
+        }
        return true;
    }
    return false;
@@ -4308,8 +4150,8 @@ bool bdrv_op_blocker_is_empty(BlockDriverState *bs)

 void bdrv_img_create(const char *filename, const char *fmt,
                     const char *base_filename, const char *base_fmt,
-                     char *options, uint64_t img_size, int flags, bool quiet,
-                     Error **errp)
+                     char *options, uint64_t img_size, int flags,
+                     Error **errp, bool quiet)
 {
    QemuOptsList *create_opts = NULL;
    QemuOpts *opts = NULL;
@@ -4390,65 +4232,55 @@ void bdrv_img_create(const char *filename, const char *fmt,

    backing_fmt = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);

-    /* The size for the image must always be specified, unless we have a backing
-     * file and we have not been forbidden from opening it. */
+    // The size for the image must always be specified, with one exception:
+    // If we are using a backing file, we can obtain the size from there
    size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
-    if (backing_file && !(flags & BDRV_O_NO_BACKING)) {
-        BlockDriverState *bs;
-        char *full_backing = g_new0(char, PATH_MAX);
-        int back_flags;
-        QDict *backing_options = NULL;
-
-        bdrv_get_full_backing_filename_from_filename(filename, backing_file,
-                                                     full_backing, PATH_MAX,
-                                                     &local_err);
-        if (local_err) {
-            g_free(full_backing);
-            goto out;
-        }
-
-        /* backing files always opened read-only */
-        back_flags = flags;
-        back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
-
-        if (backing_fmt) {
-            backing_options = qdict_new();
-            qdict_put_str(backing_options, "driver", backing_fmt);
-        }
-
-        bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
-                       &local_err);
-        g_free(full_backing);
-        if (!bs && size != -1) {
-            /* Couldn't open BS, but we have a size, so it's nonfatal */
-            warn_reportf_err(local_err,
-                            "Could not verify backing image. "
-                            "This may become an error in future versions.\n");
-            local_err = NULL;
-        } else if (!bs) {
-            /* Couldn't open bs, do not have size */
-            error_append_hint(&local_err,
-                              "Could not open backing image to determine size.\n");
-            goto out;
-        } else {
-            if (size == -1) {
-                /* Opened BS, have no size */
-                size = bdrv_getlength(bs);
-                if (size < 0) {
-                    error_setg_errno(errp, -size, "Could not get size of '%s'",
-                                     backing_file);
-                    bdrv_unref(bs);
-                    goto out;
-                }
-                qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
-            }
-            bdrv_unref(bs);
-        }
-    } /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
-
    if (size == -1) {
-        error_setg(errp, "Image creation needs a size parameter");
-        goto out;
+        if (backing_file) {
+            BlockDriverState *bs;
+            char *full_backing = g_new0(char, PATH_MAX);
+            int64_t size;
+            int back_flags;
+            QDict *backing_options = NULL;
+
+            bdrv_get_full_backing_filename_from_filename(filename, backing_file,
+                                                         full_backing, PATH_MAX,
+                                                         &local_err);
+            if (local_err) {
+                g_free(full_backing);
+                goto out;
+            }
+
+            /* backing files always opened read-only */
+            back_flags = flags;
+            back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
+
+            if (backing_fmt) {
+                backing_options = qdict_new();
+                qdict_put_str(backing_options, "driver", backing_fmt);
+            }
+
+            bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
+                           &local_err);
+            g_free(full_backing);
+            if (!bs) {
+                goto out;
+            }
+            size = bdrv_getlength(bs);
+            if (size < 0) {
+                error_setg_errno(errp, -size, "Could not get size of '%s'",
+                                 backing_file);
+                bdrv_unref(bs);
+                goto out;
+            }
+
+            qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
+
+            bdrv_unref(bs);
+        } else {
+            error_setg(errp, "Image creation needs a size parameter");
+            goto out;
+        }
    }

    if (!quiet) {
@@ -4922,25 +4754,3 @@ void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)

    parent_bs->drv->bdrv_del_child(parent_bs, child, errp);
 }
-
-bool bdrv_can_store_new_dirty_bitmap(BlockDriverState *bs, const char *name,
-                                     uint32_t granularity, Error **errp)
-{
-    BlockDriver *drv = bs->drv;
-
-    if (!drv) {
-        error_setg_errno(errp, ENOMEDIUM,
-                         "Can't store persistent bitmaps to %s",
-                         bdrv_get_device_or_node_name(bs));
-        return false;
-    }
-
-    if (!drv->bdrv_can_store_new_dirty_bitmap) {
-        error_setg_errno(errp, ENOTSUP,
-                         "Can't store persistent bitmaps to %s",
-                         bdrv_get_device_or_node_name(bs));
-        return false;
-    }
-
-    return drv->bdrv_can_store_new_dirty_bitmap(bs, name, granularity, errp);
-}
@@ -1,6 +1,6 @@
 block-obj-y += raw-format.o qcow.o vdi.o vmdk.o cloop.o bochs.o vpc.o vvfat.o dmg.o
-block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o qcow2-bitmap.o
-block-obj-y += qed.o qed-l2-cache.o qed-table.o qed-cluster.o
+block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
+block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
 block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += quorum.o
@@ -19,7 +19,6 @@ block-obj-$(CONFIG_LIBNFS) += nfs.o
 block-obj-$(CONFIG_CURL) += curl.o
 block-obj-$(CONFIG_RBD) += rbd.o
 block-obj-$(CONFIG_GLUSTERFS) += gluster.o
-block-obj-$(CONFIG_VXHS) += vxhs.o
 block-obj-$(CONFIG_LIBSSH2) += ssh.o
 block-obj-y += accounting.o dirty-bitmap.o
 block-obj-y += write-threshold.o
@@ -39,7 +38,6 @@ rbd.o-cflags       := $(RBD_CFLAGS)
 rbd.o-libs         := $(RBD_LIBS)
 gluster.o-cflags   := $(GLUSTERFS_CFLAGS)
 gluster.o-libs     := $(GLUSTERFS_LIBS)
-vxhs.o-libs        := $(VXHS_LIBS)
 ssh.o-cflags       := $(LIBSSH2_CFLAGS)
 ssh.o-libs         := $(LIBSSH2_LIBS)
 block-obj-$(if $(CONFIG_BZIP2),m,n) += dmg-bz2.o
@@ -32,19 +32,15 @@
 static QEMUClockType clock_type = QEMU_CLOCK_REALTIME;
 static const int qtest_latency_ns = NANOSECONDS_PER_SECOND / 1000;

-void block_acct_init(BlockAcctStats *stats)
-{
-    qemu_mutex_init(&stats->lock);
-    if (qtest_enabled()) {
-        clock_type = QEMU_CLOCK_VIRTUAL;
-    }
-}
-
-void block_acct_setup(BlockAcctStats *stats, bool account_invalid,
-                      bool account_failed)
+void block_acct_init(BlockAcctStats *stats, bool account_invalid,
+                     bool account_failed)
 {
    stats->account_invalid = account_invalid;
    stats->account_failed = account_failed;
+
+    if (qtest_enabled()) {
+        clock_type = QEMU_CLOCK_VIRTUAL;
+    }
 }

 void block_acct_cleanup(BlockAcctStats *stats)
@@ -53,7 +49,6 @@ void block_acct_cleanup(BlockAcctStats *stats)
    QSLIST_FOREACH_SAFE(s, &stats->intervals, entries, next) {
        g_free(s);
    }
-    qemu_mutex_destroy(&stats->lock);
 }

 void block_acct_add_interval(BlockAcctStats *stats, unsigned interval_length)
@@ -63,15 +58,12 @@ void block_acct_add_interval(BlockAcctStats *stats, unsigned interval_length)

    s = g_new0(BlockAcctTimedStats, 1);
    s->interval_length = interval_length;
-    s->stats = stats;
-    qemu_mutex_lock(&stats->lock);
    QSLIST_INSERT_HEAD(&stats->intervals, s, entries);

    for (i = 0; i < BLOCK_MAX_IOTYPE; i++) {
        timed_average_init(&s->latency[i], clock_type,
                           (uint64_t) interval_length * NANOSECONDS_PER_SECOND);
    }
-    qemu_mutex_unlock(&stats->lock);
 }

 BlockAcctTimedStats *block_acct_interval_next(BlockAcctStats *stats,
@@ -94,8 +86,7 @@ void block_acct_start(BlockAcctStats *stats, BlockAcctCookie *cookie,
    cookie->type = type;
 }

-static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,
-                                 bool failed)
+void block_acct_done(BlockAcctStats *stats, BlockAcctCookie *cookie)
 {
    BlockAcctTimedStats *s;
    int64_t time_ns = qemu_clock_get_ns(clock_type);
@@ -107,16 +98,31 @@ static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,

    assert(cookie->type < BLOCK_MAX_IOTYPE);

-    qemu_mutex_lock(&stats->lock);
+    stats->nr_bytes[cookie->type] += cookie->bytes;
+    stats->nr_ops[cookie->type]++;
+    stats->total_time_ns[cookie->type] += latency_ns;
+    stats->last_access_time_ns = time_ns;

-    if (failed) {
-        stats->failed_ops[cookie->type]++;
-    } else {
-        stats->nr_bytes[cookie->type] += cookie->bytes;
-        stats->nr_ops[cookie->type]++;
+    QSLIST_FOREACH(s, &stats->intervals, entries) {
+        timed_average_account(&s->latency[cookie->type], latency_ns);
    }
+}
+
+void block_acct_failed(BlockAcctStats *stats, BlockAcctCookie *cookie)
+{
+    assert(cookie->type < BLOCK_MAX_IOTYPE);
+
+    stats->failed_ops[cookie->type]++;
+
+    if (stats->account_failed) {
+        BlockAcctTimedStats *s;
+        int64_t time_ns = qemu_clock_get_ns(clock_type);
+        int64_t latency_ns = time_ns - cookie->start_time_ns;
+
+        if (qtest_enabled()) {
+            latency_ns = qtest_latency_ns;
+        }

-    if (!failed || stats->account_failed) {
        stats->total_time_ns[cookie->type] += latency_ns;
        stats->last_access_time_ns = time_ns;

@@ -124,45 +130,29 @@ static void block_account_one_io(BlockAcctStats *stats, BlockAcctCookie *cookie,
            timed_average_account(&s->latency[cookie->type], latency_ns);
        }
    }
-
-    qemu_mutex_unlock(&stats->lock);
-}
-
-void block_acct_done(BlockAcctStats *stats, BlockAcctCookie *cookie)
-{
-    block_account_one_io(stats, cookie, false);
-}
-
-void block_acct_failed(BlockAcctStats *stats, BlockAcctCookie *cookie)
-{
-    block_account_one_io(stats, cookie, true);
 }

 void block_acct_invalid(BlockAcctStats *stats, enum BlockAcctType type)
 {
    assert(type < BLOCK_MAX_IOTYPE);

-    /* block_account_one_io() updates total_time_ns[], but this one does
-     * not.  The reason is that invalid requests are accounted during their
-     * submission, therefore there's no actual I/O involved.
-     */
-    qemu_mutex_lock(&stats->lock);
+    /* block_acct_done() and block_acct_failed() update
+     * total_time_ns[], but this one does not. The reason is that
+     * invalid requests are accounted during their submission,
+     * therefore there's no actual I/O involved. */
+
    stats->invalid_ops[type]++;

    if (stats->account_invalid) {
        stats->last_access_time_ns = qemu_clock_get_ns(clock_type);
    }
-    qemu_mutex_unlock(&stats->lock);
 }

 void block_acct_merge_done(BlockAcctStats *stats, enum BlockAcctType type,
                      int num_requests)
 {
    assert(type < BLOCK_MAX_IOTYPE);
-
-    qemu_mutex_lock(&stats->lock);
    stats->merged[type] += num_requests;
-    qemu_mutex_unlock(&stats->lock);
 }

 int64_t block_acct_idle_time_ns(BlockAcctStats *stats)
@@ -177,9 +167,7 @@ double block_acct_queue_depth(BlockAcctTimedStats *stats,

    assert(type < BLOCK_MAX_IOTYPE);

-    qemu_mutex_lock(&stats->stats->lock);
    sum = timed_average_sum(&stats->latency[type], &elapsed);
-    qemu_mutex_unlock(&stats->stats->lock);

    return (double) sum / elapsed;
 }
@@ -39,7 +39,7 @@ typedef struct BackupBlockJob {
    BlockdevOnError on_source_error;
    BlockdevOnError on_target_error;
    CoRwlock flush_rwlock;
-    uint64_t bytes_read;
+    uint64_t sectors_read;
    unsigned long *done_bitmap;
    int64_t cluster_size;
    bool compress;
@@ -47,6 +47,12 @@ typedef struct BackupBlockJob {
    QLIST_HEAD(, CowRequest) inflight_reqs;
 } BackupBlockJob;

+/* Size of a cluster in sectors, instead of bytes. */
+static inline int64_t cluster_size_sectors(BackupBlockJob *job)
+{
+  return job->cluster_size / BDRV_SECTOR_SIZE;
+}
+
 /* See if in-flight requests overlap and wait for them to complete */
 static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
                                                       int64_t start,
@@ -58,7 +64,7 @@ static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,
    do {
        retry = false;
        QLIST_FOREACH(req, &job->inflight_reqs, list) {
-            if (end > req->start_byte && start < req->end_byte) {
+            if (end > req->start && start < req->end) {
                qemu_co_queue_wait(&req->wait_queue, NULL);
                retry = true;
                break;
@@ -69,10 +75,10 @@ static void coroutine_fn wait_for_overlapping_requests(BackupBlockJob *job,

 /* Keep track of an in-flight request */
 static void cow_request_begin(CowRequest *req, BackupBlockJob *job,
-                              int64_t start, int64_t end)
+                                     int64_t start, int64_t end)
 {
-    req->start_byte = start;
-    req->end_byte = end;
+    req->start = start;
+    req->end = end;
    qemu_co_queue_init(&req->wait_queue);
    QLIST_INSERT_HEAD(&job->inflight_reqs, req, list);
 }
@@ -85,7 +91,7 @@ static void cow_request_end(CowRequest *req)
 }

 static int coroutine_fn backup_do_cow(BackupBlockJob *job,
-                                      int64_t offset, uint64_t bytes,
+                                      int64_t sector_num, int nb_sectors,
                                      bool *error_is_read,
                                      bool is_write_notifier)
 {
@@ -95,37 +101,41 @@ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
    QEMUIOVector bounce_qiov;
    void *bounce_buffer = NULL;
    int ret = 0;
-    int64_t start, end; /* bytes */
-    int n; /* bytes */
+    int64_t sectors_per_cluster = cluster_size_sectors(job);
+    int64_t start, end;
+    int n;

    qemu_co_rwlock_rdlock(&job->flush_rwlock);

-    start = QEMU_ALIGN_DOWN(offset, job->cluster_size);
-    end = QEMU_ALIGN_UP(bytes + offset, job->cluster_size);
+    start = sector_num / sectors_per_cluster;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);

-    trace_backup_do_cow_enter(job, start, offset, bytes);
+    trace_backup_do_cow_enter(job, start, sector_num, nb_sectors);

    wait_for_overlapping_requests(job, start, end);
    cow_request_begin(&cow_request, job, start, end);

-    for (; start < end; start += job->cluster_size) {
-        if (test_bit(start / job->cluster_size, job->done_bitmap)) {
+    for (; start < end; start++) {
+        if (test_bit(start, job->done_bitmap)) {
            trace_backup_do_cow_skip(job, start);
            continue; /* already copied */
        }

        trace_backup_do_cow_process(job, start);

-        n = MIN(job->cluster_size, job->common.len - start);
+        n = MIN(sectors_per_cluster,
+                job->common.len / BDRV_SECTOR_SIZE -
+                start * sectors_per_cluster);

        if (!bounce_buffer) {
            bounce_buffer = blk_blockalign(blk, job->cluster_size);
        }
        iov.iov_base = bounce_buffer;
-        iov.iov_len = n;
+        iov.iov_len = n * BDRV_SECTOR_SIZE;
        qemu_iovec_init_external(&bounce_qiov, &iov, 1);

-        ret = blk_co_preadv(blk, start, bounce_qiov.size, &bounce_qiov,
+        ret = blk_co_preadv(blk, start * job->cluster_size,
+                            bounce_qiov.size, &bounce_qiov,
                            is_write_notifier ? BDRV_REQ_NO_SERIALISING : 0);
        if (ret < 0) {
            trace_backup_do_cow_read_fail(job, start, ret);
@@ -136,10 +146,10 @@ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
        }

        if (buffer_is_zero(iov.iov_base, iov.iov_len)) {
-            ret = blk_co_pwrite_zeroes(job->target, start,
+            ret = blk_co_pwrite_zeroes(job->target, start * job->cluster_size,
                                       bounce_qiov.size, BDRV_REQ_MAY_UNMAP);
        } else {
-            ret = blk_co_pwritev(job->target, start,
+            ret = blk_co_pwritev(job->target, start * job->cluster_size,
                                 bounce_qiov.size, &bounce_qiov,
                                 job->compress ? BDRV_REQ_WRITE_COMPRESSED : 0);
        }
@@ -151,13 +161,13 @@ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
            goto out;
        }

-        set_bit(start / job->cluster_size, job->done_bitmap);
+        set_bit(start, job->done_bitmap);

        /* Publish progress, guest I/O counts as progress too.  Note that the
         * offset field is an opaque progress value, it is not a disk offset.
         */
-        job->bytes_read += n;
-        job->common.offset += n;
+        job->sectors_read += n;
+        job->common.offset += n * BDRV_SECTOR_SIZE;
    }

 out:
@@ -167,7 +177,7 @@ out:

    cow_request_end(&cow_request);

-    trace_backup_do_cow_return(job, offset, bytes, ret);
+    trace_backup_do_cow_return(job, sector_num, nb_sectors, ret);

    qemu_co_rwlock_unlock(&job->flush_rwlock);

@@ -180,12 +190,14 @@ static int coroutine_fn backup_before_write_notify(
 {
    BackupBlockJob *job = container_of(notifier, BackupBlockJob, before_write);
    BdrvTrackedRequest *req = opaque;
+    int64_t sector_num = req->offset >> BDRV_SECTOR_BITS;
+    int nb_sectors = req->bytes >> BDRV_SECTOR_BITS;

    assert(req->bs == blk_bs(job->common.blk));
-    assert(QEMU_IS_ALIGNED(req->offset, BDRV_SECTOR_SIZE));
-    assert(QEMU_IS_ALIGNED(req->bytes, BDRV_SECTOR_SIZE));
+    assert((req->offset & (BDRV_SECTOR_SIZE - 1)) == 0);
+    assert((req->bytes & (BDRV_SECTOR_SIZE - 1)) == 0);

-    return backup_do_cow(job, req->offset, req->bytes, NULL, true);
+    return backup_do_cow(job, sector_num, nb_sectors, NULL, true);
 }

 static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
@@ -196,7 +208,7 @@ static void backup_set_speed(BlockJob *job, int64_t speed, Error **errp)
        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
-    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }

 static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
@@ -263,29 +275,32 @@ void backup_do_checkpoint(BlockJob *job, Error **errp)
    bitmap_zero(backup_job->done_bitmap, len);
 }

-void backup_wait_for_overlapping_requests(BlockJob *job, int64_t offset,
-                                          uint64_t bytes)
+void backup_wait_for_overlapping_requests(BlockJob *job, int64_t sector_num,
+                                          int nb_sectors)
 {
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
    int64_t start, end;

    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);

-    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
-    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    start = sector_num / sectors_per_cluster;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
    wait_for_overlapping_requests(backup_job, start, end);
 }

 void backup_cow_request_begin(CowRequest *req, BlockJob *job,
-                              int64_t offset, uint64_t bytes)
+                              int64_t sector_num,
+                              int nb_sectors)
 {
    BackupBlockJob *backup_job = container_of(job, BackupBlockJob, common);
+    int64_t sectors_per_cluster = cluster_size_sectors(backup_job);
    int64_t start, end;

    assert(job->driver->job_type == BLOCK_JOB_TYPE_BACKUP);

-    start = QEMU_ALIGN_DOWN(offset, backup_job->cluster_size);
-    end = QEMU_ALIGN_UP(offset + bytes, backup_job->cluster_size);
+    start = sector_num / sectors_per_cluster;
+    end = DIV_ROUND_UP(sector_num + nb_sectors, sectors_per_cluster);
    cow_request_begin(req, backup_job, start, end);
 }

@@ -344,8 +359,8 @@ static bool coroutine_fn yield_and_check(BackupBlockJob *job)
     */
    if (job->common.speed) {
        uint64_t delay_ns = ratelimit_calculate_delay(&job->limit,
-                                                      job->bytes_read);
-        job->bytes_read = 0;
+                                                      job->sectors_read);
+        job->sectors_read = 0;
        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, delay_ns);
    } else {
        block_job_sleep_ns(&job->common, QEMU_CLOCK_REALTIME, 0);
@@ -364,10 +379,11 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
    int ret = 0;
    int clusters_per_iter;
    uint32_t granularity;
-    int64_t offset;
+    int64_t sector;
    int64_t cluster;
    int64_t end;
    int64_t last_cluster = -1;
+    int64_t sectors_per_cluster = cluster_size_sectors(job);
    BdrvDirtyBitmapIter *dbi;

    granularity = bdrv_dirty_bitmap_granularity(job->sync_bitmap);
@@ -375,8 +391,8 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
    dbi = bdrv_dirty_iter_new(job->sync_bitmap, 0);

    /* Find the next dirty sector(s) */
-    while ((offset = bdrv_dirty_iter_next(dbi) * BDRV_SECTOR_SIZE) >= 0) {
-        cluster = offset / job->cluster_size;
+    while ((sector = bdrv_dirty_iter_next(dbi)) != -1) {
+        cluster = sector / sectors_per_cluster;

        /* Fake progress updates for any clusters we skipped */
        if (cluster != last_cluster + 1) {
@@ -389,8 +405,8 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
                if (yield_and_check(job)) {
                    goto out;
                }
-                ret = backup_do_cow(job, cluster * job->cluster_size,
-                                    job->cluster_size, &error_is_read,
+                ret = backup_do_cow(job, cluster * sectors_per_cluster,
+                                    sectors_per_cluster, &error_is_read,
                                    false);
                if ((ret < 0) &&
                    backup_error_action(job, error_is_read, -ret) ==
@@ -403,8 +419,7 @@ static int coroutine_fn backup_run_incremental(BackupBlockJob *job)
        /* If the bitmap granularity is smaller than the backup granularity,
         * we need to advance the iterator pointer to the next cluster. */
        if (granularity < job->cluster_size) {
-            bdrv_set_dirty_iter(dbi,
-                                cluster * job->cluster_size / BDRV_SECTOR_SIZE);
+            bdrv_set_dirty_iter(dbi, cluster * sectors_per_cluster);
        }

        last_cluster = cluster - 1;
@@ -426,14 +441,17 @@ static void coroutine_fn backup_run(void *opaque)
    BackupBlockJob *job = opaque;
    BackupCompleteData *data;
    BlockDriverState *bs = blk_bs(job->common.blk);
-    int64_t offset;
+    int64_t start, end;
+    int64_t sectors_per_cluster = cluster_size_sectors(job);
    int ret = 0;

    QLIST_INIT(&job->inflight_reqs);
    qemu_co_rwlock_init(&job->flush_rwlock);

-    job->done_bitmap = bitmap_new(DIV_ROUND_UP(job->common.len,
-                                               job->cluster_size));
+    start = 0;
+    end = DIV_ROUND_UP(job->common.len, job->cluster_size);
+
+    job->done_bitmap = bitmap_new(end);

    job->before_write.notify = backup_before_write_notify;
    bdrv_add_before_write_notifier(bs, &job->before_write);
@@ -448,8 +466,7 @@ static void coroutine_fn backup_run(void *opaque)
        ret = backup_run_incremental(job);
    } else {
        /* Both FULL and TOP SYNC_MODE's require copying.. */
-        for (offset = 0; offset < job->common.len;
-             offset += job->cluster_size) {
+        for (; start < end; start++) {
            bool error_is_read;
            int alloced = 0;

@@ -458,13 +475,12 @@ static void coroutine_fn backup_run(void *opaque)
            }

            if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
-                int i;
-                int64_t n;
+                int i, n;

                /* Check to see if these blocks are already in the
                 * backing file. */

-                for (i = 0; i < job->cluster_size;) {
+                for (i = 0; i < sectors_per_cluster;) {
                    /* bdrv_is_allocated() only returns true/false based
                     * on the first set of sectors it comes across that
                     * are are all in the same state.
@@ -472,8 +488,9 @@ static void coroutine_fn backup_run(void *opaque)
                     * backup cluster length.  We end up copying more than
                     * needed but at some point that is always the case. */
                    alloced =
-                        bdrv_is_allocated(bs, offset + i,
-                                          job->cluster_size - i, &n);
+                        bdrv_is_allocated(bs,
+                                start * sectors_per_cluster + i,
+                                sectors_per_cluster - i, &n);
                    i += n;

                    if (alloced || n == 0) {
@@ -491,8 +508,9 @@ static void coroutine_fn backup_run(void *opaque)
            if (alloced < 0) {
                ret = alloced;
            } else {
-                ret = backup_do_cow(job, offset, job->cluster_size,
-                                    &error_is_read, false);
+                ret = backup_do_cow(job, start * sectors_per_cluster,
+                                    sectors_per_cluster, &error_is_read,
+                                    false);
            }
            if (ret < 0) {
                /* Depending on error action, fail now or retry cluster */
@@ -501,7 +519,7 @@ static void coroutine_fn backup_run(void *opaque)
                if (action == BLOCK_ERROR_ACTION_REPORT) {
                    break;
                } else {
-                    offset -= job->cluster_size;
+                    start--;
                    continue;
                }
            }
@@ -639,12 +657,12 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
    ret = bdrv_get_info(target, &bdi);
    if (ret == -ENOTSUP && !target->backing) {
        /* Cluster size is not defined */
-        warn_report("The target block device doesn't provide "
-                    "information about the block size and it doesn't have a "
-                    "backing file. The default block size of %u bytes is "
-                    "used. If the actual block size of the target exceeds "
-                    "this default, the backup may be unusable",
-                    BACKUP_CLUSTER_SIZE_DEFAULT);
+        error_report("WARNING: The target block device doesn't provide "
+                     "information about the block size and it doesn't have a "
+                     "backing file. The default block size of %u bytes is "
+                     "used. If the actual block size of the target exceeds "
+                     "this default, the backup may be unusable",
+                     BACKUP_CLUSTER_SIZE_DEFAULT);
        job->cluster_size = BACKUP_CLUSTER_SIZE_DEFAULT;
    } else if (ret < 0 && !target->backing) {
        error_setg_errno(errp, -ret,
@@ -674,7 +692,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
    }
    if (job) {
        backup_clean(&job->common);
-        block_job_early_fail(&job->common);
+        block_job_unref(&job->common);
    }

    return NULL;
@@ -31,6 +31,7 @@
 #include "qemu/module.h"
 #include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
 #include "sysemu/qtest.h"

@@ -575,7 +576,7 @@ static int blkdebug_co_flush(BlockDriverState *bs)
 }

 static int coroutine_fn blkdebug_co_pwrite_zeroes(BlockDriverState *bs,
-                                                  int64_t offset, int bytes,
+                                                  int64_t offset, int count,
                                                  BdrvRequestFlags flags)
 {
    uint32_t align = MAX(bs->bl.request_alignment,
@@ -586,29 +587,29 @@ static int coroutine_fn blkdebug_co_pwrite_zeroes(BlockDriverState *bs,
     * preferred alignment (so that we test the fallback to writes on
     * unaligned portions), and check that the block layer never hands
     * us anything unaligned that crosses an alignment boundary.  */
-    if (bytes < align) {
+    if (count < align) {
        assert(QEMU_IS_ALIGNED(offset, align) ||
-               QEMU_IS_ALIGNED(offset + bytes, align) ||
+               QEMU_IS_ALIGNED(offset + count, align) ||
               DIV_ROUND_UP(offset, align) ==
-               DIV_ROUND_UP(offset + bytes, align));
+               DIV_ROUND_UP(offset + count, align));
        return -ENOTSUP;
    }
    assert(QEMU_IS_ALIGNED(offset, align));
-    assert(QEMU_IS_ALIGNED(bytes, align));
+    assert(QEMU_IS_ALIGNED(count, align));
    if (bs->bl.max_pwrite_zeroes) {
-        assert(bytes <= bs->bl.max_pwrite_zeroes);
+        assert(count <= bs->bl.max_pwrite_zeroes);
    }

-    err = rule_check(bs, offset, bytes);
+    err = rule_check(bs, offset, count);
    if (err) {
        return err;
    }

-    return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
+    return bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
 }

 static int coroutine_fn blkdebug_co_pdiscard(BlockDriverState *bs,
-                                             int64_t offset, int bytes)
+                                             int64_t offset, int count)
 {
    uint32_t align = bs->bl.pdiscard_alignment;
    int err;
@@ -616,39 +617,29 @@ static int coroutine_fn blkdebug_co_pdiscard(BlockDriverState *bs,
    /* Only pass through requests that are larger than requested
     * minimum alignment, and ensure that unaligned requests do not
     * cross optimum discard boundaries. */
-    if (bytes < bs->bl.request_alignment) {
+    if (count < bs->bl.request_alignment) {
        assert(QEMU_IS_ALIGNED(offset, align) ||
-               QEMU_IS_ALIGNED(offset + bytes, align) ||
+               QEMU_IS_ALIGNED(offset + count, align) ||
               DIV_ROUND_UP(offset, align) ==
-               DIV_ROUND_UP(offset + bytes, align));
+               DIV_ROUND_UP(offset + count, align));
        return -ENOTSUP;
    }
    assert(QEMU_IS_ALIGNED(offset, bs->bl.request_alignment));
-    assert(QEMU_IS_ALIGNED(bytes, bs->bl.request_alignment));
-    if (align && bytes >= align) {
+    assert(QEMU_IS_ALIGNED(count, bs->bl.request_alignment));
+    if (align && count >= align) {
        assert(QEMU_IS_ALIGNED(offset, align));
-        assert(QEMU_IS_ALIGNED(bytes, align));
+        assert(QEMU_IS_ALIGNED(count, align));
    }
    if (bs->bl.max_pdiscard) {
-        assert(bytes <= bs->bl.max_pdiscard);
+        assert(count <= bs->bl.max_pdiscard);
    }

-    err = rule_check(bs, offset, bytes);
+    err = rule_check(bs, offset, count);
    if (err) {
        return err;
    }

-    return bdrv_co_pdiscard(bs->file->bs, offset, bytes);
-}
-
-static int64_t coroutine_fn blkdebug_co_get_block_status(
-    BlockDriverState *bs, int64_t sector_num, int nb_sectors, int *pnum,
-    BlockDriverState **file)
-{
-    *pnum = nb_sectors;
-    *file = bs->file->bs;
-    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
-        (sector_num << BDRV_SECTOR_BITS);
+    return bdrv_co_pdiscard(bs->file->bs, offset, count);
 }

 static void blkdebug_close(BlockDriverState *bs)
@@ -821,10 +812,9 @@ static int64_t blkdebug_getlength(BlockDriverState *bs)
    return bdrv_getlength(bs->file->bs);
 }

-static int blkdebug_truncate(BlockDriverState *bs, int64_t offset,
-                             PreallocMode prealloc, Error **errp)
+static int blkdebug_truncate(BlockDriverState *bs, int64_t offset)
 {
-    return bdrv_truncate(bs->file, offset, prealloc, errp);
+    return bdrv_truncate(bs->file, offset, NULL);
 }

 static void blkdebug_refresh_filename(BlockDriverState *bs, QDict *options)
@@ -926,7 +916,6 @@ static BlockDriver bdrv_blkdebug = {
    .bdrv_co_flush_to_disk  = blkdebug_co_flush,
    .bdrv_co_pwrite_zeroes  = blkdebug_co_pwrite_zeroes,
    .bdrv_co_pdiscard       = blkdebug_co_pdiscard,
-    .bdrv_co_get_block_status = blkdebug_co_get_block_status,

    .bdrv_debug_event           = blkdebug_debug_event,
    .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
@@ -96,10 +96,10 @@ static int coroutine_fn blkreplay_co_pwritev(BlockDriverState *bs,
 }

 static int coroutine_fn blkreplay_co_pwrite_zeroes(BlockDriverState *bs,
-    int64_t offset, int bytes, BdrvRequestFlags flags)
+    int64_t offset, int count, BdrvRequestFlags flags)
 {
    uint64_t reqid = blkreplay_next_id();
-    int ret = bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
+    int ret = bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();

@@ -107,10 +107,10 @@ static int coroutine_fn blkreplay_co_pwrite_zeroes(BlockDriverState *bs,
 }

 static int coroutine_fn blkreplay_co_pdiscard(BlockDriverState *bs,
-                                              int64_t offset, int bytes)
+                                              int64_t offset, int count)
 {
    uint64_t reqid = blkreplay_next_id();
-    int ret = bdrv_co_pdiscard(bs->file->bs, offset, bytes);
+    int ret = bdrv_co_pdiscard(bs->file->bs, offset, count);
    block_request_create(reqid, bs, qemu_coroutine_self());
    qemu_coroutine_yield();

@@ -20,7 +20,6 @@
 #include "qapi-event.h"
 #include "qemu/id.h"
 #include "trace.h"
-#include "migration/misc.h"

 /* Number of coroutines to reserve per attached device model */
 #define COROUTINE_POOL_RESERVATION 64
@@ -69,8 +68,6 @@ struct BlockBackend {
    NotifierList remove_bs_notifiers, insert_bs_notifiers;

    int quiesce_counter;
-    VMChangeStateEntry *vmsh;
-    bool force_allow_inactivate;
 };

 typedef struct BlockBackendAIOCB {
@@ -86,6 +83,7 @@ static const AIOCBInfo block_backend_aiocb_info = {

 static void drive_info_del(DriveInfo *dinfo);
 static BlockBackend *bdrv_first_blk(BlockDriverState *bs);
+static char *blk_get_attached_dev_id(BlockBackend *blk);

 /* All BlockBackends */
 static QTAILQ_HEAD(, BlockBackend) block_backends =
@@ -132,111 +130,6 @@ static const char *blk_root_get_name(BdrvChild *child)
    return blk_name(child->opaque);
 }

-static void blk_vm_state_changed(void *opaque, int running, RunState state)
-{
-    Error *local_err = NULL;
-    BlockBackend *blk = opaque;
-
-    if (state == RUN_STATE_INMIGRATE) {
-        return;
-    }
-
-    qemu_del_vm_change_state_handler(blk->vmsh);
-    blk->vmsh = NULL;
-    blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);
-    if (local_err) {
-        error_report_err(local_err);
-    }
-}
-
-/*
- * Notifies the user of the BlockBackend that migration has completed. qdev
- * devices can tighten their permissions in response (specifically revoke
- * shared write permissions that we needed for storage migration).
- *
- * If an error is returned, the VM cannot be allowed to be resumed.
- */
-static void blk_root_activate(BdrvChild *child, Error **errp)
-{
-    BlockBackend *blk = child->opaque;
-    Error *local_err = NULL;
-
-    if (!blk->disable_perm) {
-        return;
-    }
-
-    blk->disable_perm = false;
-
-    blk_set_perm(blk, blk->perm, BLK_PERM_ALL, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        blk->disable_perm = true;
-        return;
-    }
-
-    if (runstate_check(RUN_STATE_INMIGRATE)) {
-        /* Activation can happen when migration process is still active, for
-         * example when nbd_server_add is called during non-shared storage
-         * migration. Defer the shared_perm update to migration completion. */
-        if (!blk->vmsh) {
-            blk->vmsh = qemu_add_vm_change_state_handler(blk_vm_state_changed,
-                                                         blk);
-        }
-        return;
-    }
-
-    blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        blk->disable_perm = true;
-        return;
-    }
-}
-
-void blk_set_force_allow_inactivate(BlockBackend *blk)
-{
-    blk->force_allow_inactivate = true;
-}
-
-static bool blk_can_inactivate(BlockBackend *blk)
-{
-    /* If it is a guest device, inactivate is ok. */
-    if (blk->dev || blk_name(blk)[0]) {
-        return true;
-    }
-
-    /* Inactivating means no more writes to the image can be done,
-     * even if those writes would be changes invisible to the
-     * guest.  For block job BBs that satisfy this, we can just allow
-     * it.  This is the case for mirror job source, which is required
-     * by libvirt non-shared block migration. */
-    if (!(blk->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED))) {
-        return true;
-    }
-
-    return blk->force_allow_inactivate;
-}
-
-static int blk_root_inactivate(BdrvChild *child)
-{
-    BlockBackend *blk = child->opaque;
-
-    if (blk->disable_perm) {
-        return 0;
-    }
-
-    if (!blk_can_inactivate(blk)) {
-        return -EPERM;
-    }
-
-    blk->disable_perm = true;
-    if (blk->root) {
-        bdrv_child_try_set_perm(blk->root, 0, BLK_PERM_ALL, &error_abort);
-    }
-
-    return 0;
-}
-
 static const BdrvChildRole child_root = {
    .inherit_options    = blk_root_inherit_options,

@@ -247,9 +140,6 @@ static const BdrvChildRole child_root = {

    .drained_begin      = blk_root_drained_begin,
    .drained_end        = blk_root_drained_end,
-
-    .activate           = blk_root_activate,
-    .inactivate         = blk_root_inactivate,
 };

 /*
@@ -273,10 +163,8 @@ BlockBackend *blk_new(uint64_t perm, uint64_t shared_perm)
    blk->shared_perm = shared_perm;
    blk_set_enable_write_cache(blk, true);

-    qemu_co_mutex_init(&blk->public.throttled_reqs_lock);
    qemu_co_queue_init(&blk->public.throttled_reqs[0]);
    qemu_co_queue_init(&blk->public.throttled_reqs[1]);
-    block_acct_init(&blk->stats);

    notifier_list_init(&blk->remove_bs_notifiers);
    notifier_list_init(&blk->insert_bs_notifiers);
@@ -349,10 +237,6 @@ static void blk_delete(BlockBackend *blk)
    if (blk->root) {
        blk_remove_bs(blk);
    }
-    if (blk->vmsh) {
-        qemu_del_vm_change_state_handler(blk->vmsh);
-        blk->vmsh = NULL;
-    }
    assert(QLIST_EMPTY(&blk->remove_bs_notifiers.notifiers));
    assert(QLIST_EMPTY(&blk->insert_bs_notifiers.notifiers));
    QTAILQ_REMOVE(&block_backends, blk, link);
@@ -404,7 +288,7 @@ void blk_unref(BlockBackend *blk)
 * Behaves similarly to blk_next() but iterates over all BlockBackends, even the
 * ones which are hidden (i.e. are not referenced by the monitor).
 */
-BlockBackend *blk_all_next(BlockBackend *blk)
+static BlockBackend *blk_all_next(BlockBackend *blk)
 {
    return blk ? QTAILQ_NEXT(blk, link)
               : QTAILQ_FIRST(&block_backends);
@@ -536,7 +420,7 @@ void monitor_remove_blk(BlockBackend *blk)
 * Return @blk's name, a non-null string.
 * Returns an empty string iff @blk is not referenced by the monitor.
 */
-const char *blk_name(const BlockBackend *blk)
+const char *blk_name(BlockBackend *blk)
 {
    return blk->name ?: "";
 }
@@ -717,6 +601,34 @@ void blk_get_perm(BlockBackend *blk, uint64_t *perm, uint64_t *shared_perm)
    *shared_perm = blk->shared_perm;
 }

+/*
+ * Notifies the user of all BlockBackends that migration has completed. qdev
+ * devices can tighten their permissions in response (specifically revoke
+ * shared write permissions that we needed for storage migration).
+ *
+ * If an error is returned, the VM cannot be allowed to be resumed.
+ */
+void blk_resume_after_migration(Error **errp)
+{
+    BlockBackend *blk;
+    Error *local_err = NULL;
+
+    for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
+        if (!blk->disable_perm) {
+            continue;
+        }
+
+        blk->disable_perm = false;
+
+        blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            blk->disable_perm = true;
+            return;
+        }
+    }
+}
+
 static int blk_do_attach_dev(BlockBackend *blk, void *dev)
 {
    if (blk->dev) {
@@ -787,7 +699,7 @@ void *blk_get_attached_dev(BlockBackend *blk)

 /* Return the qdev ID, or if no ID is assigned the QOM path, of the block
 * device attached to the BlockBackend. */
-char *blk_get_attached_dev_id(BlockBackend *blk)
+static char *blk_get_attached_dev_id(BlockBackend *blk)
 {
    DeviceState *dev;

@@ -1160,9 +1072,9 @@ int blk_pread_unthrottled(BlockBackend *blk, int64_t offset, uint8_t *buf,
 }

 int blk_pwrite_zeroes(BlockBackend *blk, int64_t offset,
-                      int bytes, BdrvRequestFlags flags)
+                      int count, BdrvRequestFlags flags)
 {
-    return blk_prw(blk, offset, NULL, bytes, blk_write_entry,
+    return blk_prw(blk, offset, NULL, count, blk_write_entry,
                   flags | BDRV_REQ_ZERO_WRITE);
 }

@@ -1372,10 +1284,10 @@ static void blk_aio_pdiscard_entry(void *opaque)
 }

 BlockAIOCB *blk_aio_pdiscard(BlockBackend *blk,
-                             int64_t offset, int bytes,
+                             int64_t offset, int count,
                             BlockCompletionFunc *cb, void *opaque)
 {
-    return blk_aio_prwv(blk, offset, bytes, NULL, blk_aio_pdiscard_entry, 0,
+    return blk_aio_prwv(blk, offset, count, NULL, blk_aio_pdiscard_entry, 0,
                        cb, opaque);
 }

@@ -1435,14 +1347,14 @@ BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
    return blk_aio_prwv(blk, req, 0, &qiov, blk_aio_ioctl_entry, 0, cb, opaque);
 }

-int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
+int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int count)
 {
-    int ret = blk_check_byte_request(blk, offset, bytes);
+    int ret = blk_check_byte_request(blk, offset, count);
    if (ret < 0) {
        return ret;
    }

-    return bdrv_co_pdiscard(blk_bs(blk), offset, bytes);
+    return bdrv_co_pdiscard(blk_bs(blk), offset, count);
 }

 int blk_co_flush(BlockBackend *blk)
@@ -1821,9 +1733,9 @@ void *blk_aio_get(const AIOCBInfo *aiocb_info, BlockBackend *blk,
 }

 int coroutine_fn blk_co_pwrite_zeroes(BlockBackend *blk, int64_t offset,
-                                      int bytes, BdrvRequestFlags flags)
+                                      int count, BdrvRequestFlags flags)
 {
-    return blk_co_pwritev(blk, offset, bytes, NULL,
+    return blk_co_pwritev(blk, offset, count, NULL,
                          flags | BDRV_REQ_ZERO_WRITE);
 }

@@ -1834,15 +1746,14 @@ int blk_pwrite_compressed(BlockBackend *blk, int64_t offset, const void *buf,
                   BDRV_REQ_WRITE_COMPRESSED);
 }

-int blk_truncate(BlockBackend *blk, int64_t offset, PreallocMode prealloc,
-                 Error **errp)
+int blk_truncate(BlockBackend *blk, int64_t offset, Error **errp)
 {
    if (!blk_is_available(blk)) {
        error_setg(errp, "No medium inserted");
        return -ENOMEDIUM;
    }

-    return bdrv_truncate(blk->root, offset, prealloc, errp);
+    return bdrv_truncate(blk->root, offset, errp);
 }

 static void blk_pdiscard_entry(void *opaque)
@@ -1851,9 +1762,9 @@ static void blk_pdiscard_entry(void *opaque)
    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, rwco->qiov->size);
 }

-int blk_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
+int blk_pdiscard(BlockBackend *blk, int64_t offset, int count)
 {
-    return blk_prw(blk, offset, NULL, bytes, blk_pdiscard_entry, 0);
+    return blk_prw(blk, offset, NULL, count, blk_pdiscard_entry, 0);
 }

 int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
@@ -2017,7 +1928,7 @@ static void blk_root_drained_begin(BdrvChild *child)
    /* Note that blk->root may not be accessible here yet if we are just
     * attaching to a BlockDriverState that is drained. Use child instead. */

-    if (atomic_fetch_inc(&blk->public.io_limits_disabled) == 0) {
+    if (blk->public.io_limits_disabled++ == 0) {
        throttle_group_restart_blk(blk);
    }
 }
@@ -2028,7 +1939,7 @@ static void blk_root_drained_end(BdrvChild *child)
    assert(blk->quiesce_counter);

    assert(blk->public.io_limits_disabled);
-    atomic_dec(&blk->public.io_limits_disabled);
+    --blk->public.io_limits_disabled;

    if (--blk->quiesce_counter == 0) {
        if (blk->dev_ops && blk->dev_ops->drained_end) {
@@ -110,10 +110,7 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
        return -EINVAL;
    }

-    ret = bdrv_set_read_only(bs, true, errp); /* no write support yet */
-    if (ret < 0) {
-        return ret;
-    }
+    bs->read_only = true; /* no write support yet */

    ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
    if (ret < 0) {
@@ -72,10 +72,7 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
        return -EINVAL;
    }

-    ret = bdrv_set_read_only(bs, true, errp);
-    if (ret < 0) {
-        return ret;
-    }
+    bs->read_only = true;

    /* read header */
    ret = bdrv_pread(bs->file, 128, &s->block_size, 4);
@@ -47,25 +47,26 @@ typedef struct CommitBlockJob {
 } CommitBlockJob;

 static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
-                                        int64_t offset, uint64_t bytes,
+                                        int64_t sector_num, int nb_sectors,
                                        void *buf)
 {
    int ret = 0;
    QEMUIOVector qiov;
    struct iovec iov = {
        .iov_base = buf,
-        .iov_len = bytes,
+        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
    };

-    assert(bytes < SIZE_MAX);
    qemu_iovec_init_external(&qiov, &iov, 1);

-    ret = blk_co_preadv(bs, offset, qiov.size, &qiov, 0);
+    ret = blk_co_preadv(bs, sector_num * BDRV_SECTOR_SIZE,
+                        qiov.size, &qiov, 0);
    if (ret < 0) {
        return ret;
    }

-    ret = blk_co_pwritev(base, offset, qiov.size, &qiov, 0);
+    ret = blk_co_pwritev(base, sector_num * BDRV_SECTOR_SIZE,
+                         qiov.size, &qiov, 0);
    if (ret < 0) {
        return ret;
    }
@@ -145,16 +146,17 @@ static void coroutine_fn commit_run(void *opaque)
 {
    CommitBlockJob *s = opaque;
    CommitCompleteData *data;
-    int64_t offset;
+    int64_t sector_num, end;
    uint64_t delay_ns = 0;
    int ret = 0;
-    int64_t n = 0; /* bytes */
+    int n = 0;
    void *buf = NULL;
    int bytes_written = 0;
    int64_t base_len;

    ret = s->common.len = blk_getlength(s->top);

+
    if (s->common.len < 0) {
        goto out;
    }
@@ -165,15 +167,16 @@ static void coroutine_fn commit_run(void *opaque)
    }

    if (base_len < s->common.len) {
-        ret = blk_truncate(s->base, s->common.len, PREALLOC_MODE_OFF, NULL);
+        ret = blk_truncate(s->base, s->common.len, NULL);
        if (ret) {
            goto out;
        }
    }

+    end = s->common.len >> BDRV_SECTOR_BITS;
    buf = blk_blockalign(s->top, COMMIT_BUFFER_SIZE);

-    for (offset = 0; offset < s->common.len; offset += n) {
+    for (sector_num = 0; sector_num < end; sector_num += n) {
        bool copy;

        /* Note that even when no rate limit is applied we need to yield
@@ -185,12 +188,14 @@ static void coroutine_fn commit_run(void *opaque)
        }
        /* Copy if allocated above the base */
        ret = bdrv_is_allocated_above(blk_bs(s->top), blk_bs(s->base),
-                                      offset, COMMIT_BUFFER_SIZE, &n);
+                                      sector_num,
+                                      COMMIT_BUFFER_SIZE / BDRV_SECTOR_SIZE,
+                                      &n);
        copy = (ret == 1);
-        trace_commit_one_iteration(s, offset, n, ret);
+        trace_commit_one_iteration(s, sector_num, n, ret);
        if (copy) {
-            ret = commit_populate(s->top, s->base, offset, n, buf);
-            bytes_written += n;
+            ret = commit_populate(s->top, s->base, sector_num, n, buf);
+            bytes_written += n * BDRV_SECTOR_SIZE;
        }
        if (ret < 0) {
            BlockErrorAction action =
@@ -203,7 +208,7 @@ static void coroutine_fn commit_run(void *opaque)
            }
        }
        /* Publish progress */
-        s->common.offset += n;
+        s->common.offset += n * BDRV_SECTOR_SIZE;

        if (copy && s->common.speed) {
            delay_ns = ratelimit_calculate_delay(&s->limit, n);
@@ -228,7 +233,7 @@ static void commit_set_speed(BlockJob *job, int64_t speed, Error **errp)
        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
-    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }

 static const BlockJobDriver commit_job_driver = {
@@ -250,7 +255,7 @@ static int64_t coroutine_fn bdrv_commit_top_get_block_status(
 {
    *pnum = nb_sectors;
    *file = bs->backing->bs;
-    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |
           (sector_num << BDRV_SECTOR_BITS);
 }

@@ -440,11 +445,11 @@ fail:
    if (commit_top_bs) {
        bdrv_set_backing_hd(overlay_bs, top, &error_abort);
    }
-    block_job_early_fail(&s->common);
+    block_job_unref(&s->common);
 }


-#define COMMIT_BUF_SIZE (2048 * BDRV_SECTOR_SIZE)
+#define COMMIT_BUF_SECTORS 2048

 /* commit COW file into the raw image */
 int bdrv_commit(BlockDriverState *bs)
@@ -453,9 +458,8 @@ int bdrv_commit(BlockDriverState *bs)
    BlockDriverState *backing_file_bs = NULL;
    BlockDriverState *commit_top_bs = NULL;
    BlockDriver *drv = bs->drv;
-    int64_t offset, length, backing_length;
-    int ro, open_flags;
-    int64_t n;
+    int64_t sector, total_sectors, length, backing_length;
+    int n, ro, open_flags;
    int ret = 0;
    uint8_t *buf = NULL;
    Error *local_err = NULL;
@@ -526,33 +530,37 @@ int bdrv_commit(BlockDriverState *bs)
     * grow the backing file image if possible.  If not possible,
     * we must return an error */
    if (length > backing_length) {
-        ret = blk_truncate(backing, length, PREALLOC_MODE_OFF, &local_err);
+        ret = blk_truncate(backing, length, &local_err);
        if (ret < 0) {
            error_report_err(local_err);
            goto ro_cleanup;
        }
    }

+    total_sectors = length >> BDRV_SECTOR_BITS;
+
    /* blk_try_blockalign() for src will choose an alignment that works for
     * backing as well, so no need to compare the alignment manually. */
-    buf = blk_try_blockalign(src, COMMIT_BUF_SIZE);
+    buf = blk_try_blockalign(src, COMMIT_BUF_SECTORS * BDRV_SECTOR_SIZE);
    if (buf == NULL) {
        ret = -ENOMEM;
        goto ro_cleanup;
    }

-    for (offset = 0; offset < length; offset += n) {
-        ret = bdrv_is_allocated(bs, offset, COMMIT_BUF_SIZE, &n);
+    for (sector = 0; sector < total_sectors; sector += n) {
+        ret = bdrv_is_allocated(bs, sector, COMMIT_BUF_SECTORS, &n);
        if (ret < 0) {
            goto ro_cleanup;
        }
        if (ret) {
-            ret = blk_pread(src, offset, buf, n);
+            ret = blk_pread(src, sector * BDRV_SECTOR_SIZE, buf,
+                            n * BDRV_SECTOR_SIZE);
            if (ret < 0) {
                goto ro_cleanup;
            }

-            ret = blk_pwrite(backing, offset, buf, n, 0);
+            ret = blk_pwrite(backing, sector * BDRV_SECTOR_SIZE, buf,
+                             n * BDRV_SECTOR_SIZE, 0);
            if (ret < 0) {
                goto ro_cleanup;
            }
@@ -24,10 +24,16 @@
 #include "sysemu/block-backend.h"
 #include "crypto/block.h"
 #include "qapi/opts-visitor.h"
-#include "qapi/qobject-input-visitor.h"
 #include "qapi-visit.h"
 #include "qapi/error.h"
-#include "block/crypto.h"
+
+#define BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET "key-secret"
+#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG "cipher-alg"
+#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE "cipher-mode"
+#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG "ivgen-alg"
+#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG "ivgen-hash-alg"
+#define BLOCK_CRYPTO_OPT_LUKS_HASH_ALG "hash-alg"
+#define BLOCK_CRYPTO_OPT_LUKS_ITER_TIME "iter-time"

 typedef struct BlockCrypto BlockCrypto;

@@ -53,8 +59,8 @@ static ssize_t block_crypto_read_func(QCryptoBlock *block,
                                      size_t offset,
                                      uint8_t *buf,
                                      size_t buflen,
-                                      void *opaque,
-                                      Error **errp)
+                                      Error **errp,
+                                      void *opaque)
 {
    BlockDriverState *bs = opaque;
    ssize_t ret;
@@ -80,8 +86,8 @@ static ssize_t block_crypto_write_func(QCryptoBlock *block,
                                       size_t offset,
                                       const uint8_t *buf,
                                       size_t buflen,
-                                       void *opaque,
-                                       Error **errp)
+                                       Error **errp,
+                                       void *opaque)
 {
    struct BlockCryptoCreateData *data = opaque;
    ssize_t ret;
@@ -97,8 +103,8 @@ static ssize_t block_crypto_write_func(QCryptoBlock *block,

 static ssize_t block_crypto_init_func(QCryptoBlock *block,
                                      size_t headerlen,
-                                      void *opaque,
-                                      Error **errp)
+                                      Error **errp,
+                                      void *opaque)
 {
    struct BlockCryptoCreateData *data = opaque;
    int ret;
@@ -129,7 +135,11 @@ static QemuOptsList block_crypto_runtime_opts_luks = {
    .name = "crypto",
    .head = QTAILQ_HEAD_INITIALIZER(block_crypto_runtime_opts_luks.head),
    .desc = {
-        BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
+            .type = QEMU_OPT_STRING,
+            .help = "ID of the secret that provides the encryption key",
+        },
        { /* end of list */ }
    },
 };
@@ -144,21 +154,49 @@ static QemuOptsList block_crypto_create_opts_luks = {
            .type = QEMU_OPT_SIZE,
            .help = "Virtual disk size"
        },
-        BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(""),
-        BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(""),
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET,
+            .type = QEMU_OPT_STRING,
+            .help = "ID of the secret that provides the encryption key",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG,
+            .type = QEMU_OPT_STRING,
+            .help = "Name of encryption cipher algorithm",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE,
+            .type = QEMU_OPT_STRING,
+            .help = "Name of encryption cipher mode",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG,
+            .type = QEMU_OPT_STRING,
+            .help = "Name of IV generator algorithm",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG,
+            .type = QEMU_OPT_STRING,
+            .help = "Name of IV generator hash algorithm",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_HASH_ALG,
+            .type = QEMU_OPT_STRING,
+            .help = "Name of encryption hash algorithm",
+        },
+        {
+            .name = BLOCK_CRYPTO_OPT_LUKS_ITER_TIME,
+            .type = QEMU_OPT_NUMBER,
+            .help = "Time to spend in PBKDF in milliseconds",
+        },
        { /* end of list */ }
    },
 };


-QCryptoBlockOpenOptions *
+static QCryptoBlockOpenOptions *
 block_crypto_open_opts_init(QCryptoBlockFormat format,
-                            QDict *opts,
+                            QemuOpts *opts,
                            Error **errp)
 {
    Visitor *v;
@@ -168,7 +206,7 @@ block_crypto_open_opts_init(QCryptoBlockFormat format,
    ret = g_new0(QCryptoBlockOpenOptions, 1);
    ret->format = format;

-    v = qobject_input_visitor_new_keyval(QOBJECT(opts));
+    v = opts_visitor_new(opts);

    visit_start_struct(v, NULL, NULL, 0, &local_err);
    if (local_err) {
@@ -181,11 +219,6 @@ block_crypto_open_opts_init(QCryptoBlockFormat format,
            v, &ret->u.luks, &local_err);
        break;

-    case Q_CRYPTO_BLOCK_FORMAT_QCOW:
-        visit_type_QCryptoBlockOptionsQCow_members(
-            v, &ret->u.qcow, &local_err);
-        break;
-
    default:
        error_setg(&local_err, "Unsupported block format %d", format);
        break;
@@ -207,9 +240,9 @@ block_crypto_open_opts_init(QCryptoBlockFormat format,
 }


-QCryptoBlockCreateOptions *
+static QCryptoBlockCreateOptions *
 block_crypto_create_opts_init(QCryptoBlockFormat format,
-                              QDict *opts,
+                              QemuOpts *opts,
                              Error **errp)
 {
    Visitor *v;
@@ -219,7 +252,7 @@ block_crypto_create_opts_init(QCryptoBlockFormat format,
    ret = g_new0(QCryptoBlockCreateOptions, 1);
    ret->format = format;

-    v = qobject_input_visitor_new_keyval(QOBJECT(opts));
+    v = opts_visitor_new(opts);

    visit_start_struct(v, NULL, NULL, 0, &local_err);
    if (local_err) {
@@ -232,11 +265,6 @@ block_crypto_create_opts_init(QCryptoBlockFormat format,
            v, &ret->u.luks, &local_err);
        break;

-    case Q_CRYPTO_BLOCK_FORMAT_QCOW:
-        visit_type_QCryptoBlockOptionsQCow_members(
-            v, &ret->u.qcow, &local_err);
-        break;
-
    default:
        error_setg(&local_err, "Unsupported block format %d", format);
        break;
@@ -271,7 +299,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
    int ret = -EINVAL;
    QCryptoBlockOpenOptions *open_opts = NULL;
    unsigned int cflags = 0;
-    QDict *cryptoopts = NULL;

    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
@@ -286,9 +313,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
        goto cleanup;
    }

-    cryptoopts = qemu_opts_to_qdict(opts, NULL);
-
-    open_opts = block_crypto_open_opts_init(format, cryptoopts, errp);
+    open_opts = block_crypto_open_opts_init(format, opts, errp);
    if (!open_opts) {
        goto cleanup;
    }
@@ -296,7 +321,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
    if (flags & BDRV_O_NO_IO) {
        cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
    }
-    crypto->block = qcrypto_block_open(open_opts, NULL,
+    crypto->block = qcrypto_block_open(open_opts,
                                       block_crypto_read_func,
                                       bs,
                                       cflags,
@@ -308,10 +333,10 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
    }

    bs->encrypted = true;
+    bs->valid_key = true;

    ret = 0;
 cleanup:
-    QDECREF(cryptoopts);
    qapi_free_QCryptoBlockOpenOptions(open_opts);
    return ret;
 }
@@ -331,16 +356,13 @@ static int block_crypto_create_generic(QCryptoBlockFormat format,
        .opts = opts,
        .filename = filename,
    };
-    QDict *cryptoopts;

-    cryptoopts = qemu_opts_to_qdict(opts, NULL);
-
-    create_opts = block_crypto_create_opts_init(format, cryptoopts, errp);
+    create_opts = block_crypto_create_opts_init(format, opts, errp);
    if (!create_opts) {
        return -1;
    }

-    crypto = qcrypto_block_create(create_opts, NULL,
+    crypto = qcrypto_block_create(create_opts,
                                  block_crypto_init_func,
                                  block_crypto_write_func,
                                  &data,
@@ -353,15 +375,13 @@ static int block_crypto_create_generic(QCryptoBlockFormat format,

    ret = 0;
 cleanup:
-    QDECREF(cryptoopts);
    qcrypto_block_free(crypto);
    blk_unref(data.blk);
    qapi_free_QCryptoBlockCreateOptions(create_opts);
    return ret;
 }

-static int block_crypto_truncate(BlockDriverState *bs, int64_t offset,
-                                 PreallocMode prealloc, Error **errp)
+static int block_crypto_truncate(BlockDriverState *bs, int64_t offset)
 {
    BlockCrypto *crypto = bs->opaque;
    size_t payload_offset =
@@ -369,7 +389,7 @@ static int block_crypto_truncate(BlockDriverState *bs, int64_t offset,

    offset += payload_offset;

-    return bdrv_truncate(bs->file, offset, prealloc, errp);
+    return bdrv_truncate(bs->file, offset, NULL);
 }

 static void block_crypto_close(BlockDriverState *bs)
@@ -1,101 +0,0 @@
-/*
- * QEMU block full disk encryption
- *
- * Copyright (c) 2015-2017 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#ifndef BLOCK_CRYPTO_H__
-#define BLOCK_CRYPTO_H__
-
-#define BLOCK_CRYPTO_OPT_DEF_KEY_SECRET(prefix, helpstr)                \
-    {                                                                   \
-        .name = prefix BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,                \
-        .type = QEMU_OPT_STRING,                                        \
-        .help = helpstr,                                                \
-    }
-
-#define BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET "key-secret"
-
-#define BLOCK_CRYPTO_OPT_DEF_QCOW_KEY_SECRET(prefix)                    \
-    BLOCK_CRYPTO_OPT_DEF_KEY_SECRET(prefix,                             \
-        "ID of the secret that provides the AES encryption key")
-
-#define BLOCK_CRYPTO_OPT_LUKS_KEY_SECRET "key-secret"
-#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG "cipher-alg"
-#define BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE "cipher-mode"
-#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG "ivgen-alg"
-#define BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG "ivgen-hash-alg"
-#define BLOCK_CRYPTO_OPT_LUKS_HASH_ALG "hash-alg"
-#define BLOCK_CRYPTO_OPT_LUKS_ITER_TIME "iter-time"
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_KEY_SECRET(prefix)                    \
-    BLOCK_CRYPTO_OPT_DEF_KEY_SECRET(prefix,                             \
-        "ID of the secret that provides the keyslot passphrase")
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG(prefix)       \
-    {                                                      \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_CIPHER_ALG,   \
-        .type = QEMU_OPT_STRING,                           \
-        .help = "Name of encryption cipher algorithm",     \
-    }
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE(prefix)      \
-    {                                                      \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_CIPHER_MODE,  \
-        .type = QEMU_OPT_STRING,                           \
-        .help = "Name of encryption cipher mode",          \
-    }
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG(prefix)     \
-    {                                                   \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_IVGEN_ALG, \
-        .type = QEMU_OPT_STRING,                        \
-        .help = "Name of IV generator algorithm",       \
-    }
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG(prefix)        \
-    {                                                           \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_IVGEN_HASH_ALG,    \
-        .type = QEMU_OPT_STRING,                                \
-        .help = "Name of IV generator hash algorithm",          \
-    }
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG(prefix)       \
-    {                                                    \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_HASH_ALG,   \
-        .type = QEMU_OPT_STRING,                         \
-        .help = "Name of encryption hash algorithm",     \
-    }
-
-#define BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME(prefix)           \
-    {                                                         \
-        .name = prefix BLOCK_CRYPTO_OPT_LUKS_ITER_TIME,       \
-        .type = QEMU_OPT_NUMBER,                              \
-        .help = "Time to spend in PBKDF in milliseconds",     \
-    }
-
-QCryptoBlockCreateOptions *
-block_crypto_create_opts_init(QCryptoBlockFormat format,
-                              QDict *opts,
-                              Error **errp);
-
-QCryptoBlockOpenOptions *
-block_crypto_open_opts_init(QCryptoBlockFormat format,
-                            QDict *opts,
-                            Error **errp);
-
-#endif /* BLOCK_CRYPTO_H__ */
@@ -76,12 +76,15 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 #define CURL_TIMEOUT_DEFAULT 5
 #define CURL_TIMEOUT_MAX 10000

+#define FIND_RET_NONE   0
+#define FIND_RET_OK     1
+#define FIND_RET_WAIT   2
+
 #define CURL_BLOCK_OPT_URL       "url"
 #define CURL_BLOCK_OPT_READAHEAD "readahead"
 #define CURL_BLOCK_OPT_SSLVERIFY "sslverify"
 #define CURL_BLOCK_OPT_TIMEOUT "timeout"
 #define CURL_BLOCK_OPT_COOKIE    "cookie"
-#define CURL_BLOCK_OPT_COOKIE_SECRET "cookie-secret"
 #define CURL_BLOCK_OPT_USERNAME "username"
 #define CURL_BLOCK_OPT_PASSWORD_SECRET "password-secret"
 #define CURL_BLOCK_OPT_PROXY_USERNAME "proxy-username"
@@ -90,17 +93,14 @@ static CURLMcode __curl_multi_socket_action(CURLM *multi_handle,
 struct BDRVCURLState;

 typedef struct CURLAIOCB {
-    Coroutine *co;
+    BlockAIOCB common;
    QEMUIOVector *qiov;

-    uint64_t offset;
-    uint64_t bytes;
-    int ret;
+    int64_t sector_num;
+    int nb_sectors;

    size_t start;
    size_t end;
-
-    QSIMPLEQ_ENTRY(CURLAIOCB) next;
 } CURLAIOCB;

 typedef struct CURLSocket {
@@ -115,7 +115,7 @@ typedef struct CURLState
    CURL *curl;
    QLIST_HEAD(, CURLSocket) sockets;
    char *orig_buf;
-    uint64_t buf_start;
+    size_t buf_start;
    size_t buf_off;
    size_t buf_len;
    char range[128];
@@ -126,7 +126,7 @@ typedef struct CURLState
 typedef struct BDRVCURLState {
    CURLM *multi;
    QEMUTimer timer;
-    uint64_t len;
+    size_t len;
    CURLState states[CURL_NUM_STATES];
    char *url;
    size_t readahead_size;
@@ -136,7 +136,6 @@ typedef struct BDRVCURLState {
    bool accept_range;
    AioContext *aio_context;
    QemuMutex mutex;
-    QSIMPLEQ_HEAD(, CURLAIOCB) free_state_waitq;
    char *username;
    char *password;
    char *proxyusername;
@@ -258,7 +257,7 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
            continue;

        if ((s->buf_off >= acb->end)) {
-            size_t request_length = acb->bytes;
+            size_t request_length = acb->nb_sectors * BDRV_SECTOR_SIZE;

            qemu_iovec_from_buf(acb->qiov, 0, s->orig_buf + acb->start,
                                acb->end - acb->start);
@@ -269,11 +268,11 @@ static size_t curl_read_cb(void *ptr, size_t size, size_t nmemb, void *opaque)
                                  request_length - offset);
            }

-            acb->ret = 0;
-            s->acb[i] = NULL;
            qemu_mutex_unlock(&s->s->mutex);
-            aio_co_wake(acb->co);
+            acb->common.cb(acb->common.opaque, 0);
            qemu_mutex_lock(&s->s->mutex);
+            qemu_aio_unref(acb);
+            s->acb[i] = NULL;
        }
    }

@@ -283,18 +282,18 @@ read_end:
 }

 /* Called with s->mutex held.  */
-static bool curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len,
-                          CURLAIOCB *acb)
+static int curl_find_buf(BDRVCURLState *s, size_t start, size_t len,
+                         CURLAIOCB *acb)
 {
    int i;
-    uint64_t end = start + len;
-    uint64_t clamped_end = MIN(end, s->len);
-    uint64_t clamped_len = clamped_end - start;
+    size_t end = start + len;
+    size_t clamped_end = MIN(end, s->len);
+    size_t clamped_len = clamped_end - start;

    for (i=0; i<CURL_NUM_STATES; i++) {
        CURLState *state = &s->states[i];
-        uint64_t buf_end = (state->buf_start + state->buf_off);
-        uint64_t buf_fend = (state->buf_start + state->buf_len);
+        size_t buf_end = (state->buf_start + state->buf_off);
+        size_t buf_fend = (state->buf_start + state->buf_len);

        if (!state->orig_buf)
            continue;
@@ -313,8 +312,7 @@ static bool curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len,
            if (clamped_len < len) {
                qemu_iovec_memset(acb->qiov, clamped_len, 0, len - clamped_len);
            }
-            acb->ret = 0;
-            return true;
+            return FIND_RET_OK;
        }

        // Wait for unfinished chunks
@@ -332,13 +330,13 @@ static bool curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len,
            for (j=0; j<CURL_NUM_ACB; j++) {
                if (!state->acb[j]) {
                    state->acb[j] = acb;
-                    return true;
+                    return FIND_RET_WAIT;
                }
            }
        }
    }

-    return false;
+    return FIND_RET_NONE;
 }

 /* Called with s->mutex held.  */
@@ -383,11 +381,11 @@ static void curl_multi_check_completion(BDRVCURLState *s)
                        continue;
                    }

-                    acb->ret = -EIO;
-                    state->acb[i] = NULL;
                    qemu_mutex_unlock(&s->mutex);
-                    aio_co_wake(acb->co);
+                    acb->common.cb(acb->common.opaque, -EIO);
                    qemu_mutex_lock(&s->mutex);
+                    qemu_aio_unref(acb);
+                    state->acb[i] = NULL;
                }
            }

@@ -457,27 +455,34 @@ static void curl_multi_timeout_do(void *arg)
 }

 /* Called with s->mutex held.  */
-static CURLState *curl_find_state(BDRVCURLState *s)
+static CURLState *curl_init_state(BlockDriverState *bs, BDRVCURLState *s)
 {
    CURLState *state = NULL;
-    int i;
+    int i, j;
+
+    do {
+        for (i=0; i<CURL_NUM_STATES; i++) {
+            for (j=0; j<CURL_NUM_ACB; j++)
+                if (s->states[i].acb[j])
+                    continue;
+            if (s->states[i].in_use)
+                continue;

-    for (i = 0; i < CURL_NUM_STATES; i++) {
-        if (!s->states[i].in_use) {
            state = &s->states[i];
            state->in_use = 1;
            break;
        }
-    }
-    return state;
-}
+        if (!state) {
+            qemu_mutex_unlock(&s->mutex);
+            aio_poll(bdrv_get_aio_context(bs), true);
+            qemu_mutex_lock(&s->mutex);
+        }
+    } while(!state);

-static int curl_init_state(BDRVCURLState *s, CURLState *state)
-{
    if (!state->curl) {
        state->curl = curl_easy_init();
        if (!state->curl) {
-            return -EIO;
+            return NULL;
        }
        curl_easy_setopt(state->curl, CURLOPT_URL, s->url);
        curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,
@@ -530,13 +535,12 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
    QLIST_INIT(&state->sockets);
    state->s = s;

-    return 0;
+    return state;
 }

 /* Called with s->mutex held.  */
 static void curl_clean_state(CURLState *s)
 {
-    CURLAIOCB *next;
    int j;
    for (j = 0; j < CURL_NUM_ACB; j++) {
        assert(!s->acb[j]);
@@ -553,14 +557,6 @@ static void curl_clean_state(CURLState *s)
    }

    s->in_use = 0;
-
-    next = QSIMPLEQ_FIRST(&s->s->free_state_waitq);
-    if (next) {
-        QSIMPLEQ_REMOVE_HEAD(&s->s->free_state_waitq, next);
-        qemu_mutex_unlock(&s->s->mutex);
-        aio_co_wake(next->co);
-        qemu_mutex_lock(&s->s->mutex);
-    }
 }

 static void curl_parse_filename(const char *filename, QDict *options,
@@ -643,11 +639,6 @@ static QemuOptsList runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "Pass the cookie or list of cookies with each request"
        },
-        {
-            .name = CURL_BLOCK_OPT_COOKIE_SECRET,
-            .type = QEMU_OPT_STRING,
-            .help = "ID of secret used as cookie passed with each request"
-        },
        {
            .name = CURL_BLOCK_OPT_USERNAME,
            .type = QEMU_OPT_STRING,
@@ -682,7 +673,6 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    Error *local_err = NULL;
    const char *file;
    const char *cookie;
-    const char *cookie_secret;
    double d;
    const char *secretid;
    const char *protocol_delimiter;
@@ -720,22 +710,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    s->sslverify = qemu_opt_get_bool(opts, CURL_BLOCK_OPT_SSLVERIFY, true);

    cookie = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE);
-    cookie_secret = qemu_opt_get(opts, CURL_BLOCK_OPT_COOKIE_SECRET);
-
-    if (cookie && cookie_secret) {
-        error_setg(errp,
-                   "curl driver cannot handle both cookie and cookie secret");
-        goto out_noclean;
-    }
-
-    if (cookie_secret) {
-        s->cookie = qcrypto_secret_lookup_as_utf8(cookie_secret, errp);
-        if (!s->cookie) {
-            goto out_noclean;
-        }
-    } else {
-        s->cookie = g_strdup(cookie);
-    }
+    s->cookie = g_strdup(cookie);

    file = qemu_opt_get(opts, CURL_BLOCK_OPT_URL);
    if (file == NULL) {
@@ -778,22 +753,16 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }

    DPRINTF("CURL: Opening %s\n", file);
-    QSIMPLEQ_INIT(&s->free_state_waitq);
    s->aio_context = bdrv_get_aio_context(bs);
    s->url = g_strdup(file);
    qemu_mutex_lock(&s->mutex);
-    state = curl_find_state(s);
+    state = curl_init_state(bs, s);
    qemu_mutex_unlock(&s->mutex);
-    if (!state) {
+    if (!state)
        goto out_noclean;
-    }

    // Get file size

-    if (curl_init_state(s, state) < 0) {
-        goto out;
-    }
-
    s->accept_range = false;
    curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1);
    curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION,
@@ -821,7 +790,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
    }
 #endif

-    s->len = d;
+    s->len = (size_t)d;

    if ((!strncasecmp(s->url, "http://", strlen("http://"))
        || !strncasecmp(s->url, "https://", strlen("https://")))
@@ -830,7 +799,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
                "Server does not support 'range' (byte ranges).");
        goto out;
    }
-    DPRINTF("CURL: Size = %" PRIu64 "\n", s->len);
+    DPRINTF("CURL: Size = %zd\n", s->len);

    qemu_mutex_lock(&s->mutex);
    curl_clean_state(state);
@@ -855,44 +824,47 @@ out_noclean:
    return -EINVAL;
 }

-static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
+static const AIOCBInfo curl_aiocb_info = {
+    .aiocb_size         = sizeof(CURLAIOCB),
+};
+
+
+static void curl_readv_bh_cb(void *p)
 {
    CURLState *state;
    int running;
+    int ret = -EINPROGRESS;

+    CURLAIOCB *acb = p;
+    BlockDriverState *bs = acb->common.bs;
    BDRVCURLState *s = bs->opaque;

-    uint64_t start = acb->offset;
-    uint64_t end;
+    size_t start = acb->sector_num * BDRV_SECTOR_SIZE;
+    size_t end;

    qemu_mutex_lock(&s->mutex);

    // In case we have the requested data already (e.g. read-ahead),
    // we can just call the callback and be done.
-    if (curl_find_buf(s, start, acb->bytes, acb)) {
-        goto out;
+    switch (curl_find_buf(s, start, acb->nb_sectors * BDRV_SECTOR_SIZE, acb)) {
+        case FIND_RET_OK:
+            ret = 0;
+            goto out;
+        case FIND_RET_WAIT:
+            goto out;
+        default:
+            break;
    }

    // No cache found, so let's start a new request
-    for (;;) {
-        state = curl_find_state(s);
-        if (state) {
-            break;
-        }
-        QSIMPLEQ_INSERT_TAIL(&s->free_state_waitq, acb, next);
-        qemu_mutex_unlock(&s->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&s->mutex);
-    }
-
-    if (curl_init_state(s, state) < 0) {
-        curl_clean_state(state);
-        acb->ret = -EIO;
+    state = curl_init_state(acb->common.bs, s);
+    if (!state) {
+        ret = -EIO;
        goto out;
    }

    acb->start = 0;
-    acb->end = MIN(acb->bytes, s->len - start);
+    acb->end = MIN(acb->nb_sectors * BDRV_SECTOR_SIZE, s->len - start);

    state->buf_off = 0;
    g_free(state->orig_buf);
@@ -902,14 +874,14 @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
    state->orig_buf = g_try_malloc(state->buf_len);
    if (state->buf_len && state->orig_buf == NULL) {
        curl_clean_state(state);
-        acb->ret = -ENOMEM;
+        ret = -ENOMEM;
        goto out;
    }
    state->acb[0] = acb;

-    snprintf(state->range, 127, "%" PRIu64 "-%" PRIu64, start, end);
-    DPRINTF("CURL (AIO): Reading %" PRIu64 " at %" PRIu64 " (%s)\n",
-            acb->bytes, start, state->range);
+    snprintf(state->range, 127, "%zd-%zd", start, end);
+    DPRINTF("CURL (AIO): Reading %llu at %zd (%s)\n",
+            (acb->nb_sectors * BDRV_SECTOR_SIZE), start, state->range);
    curl_easy_setopt(state->curl, CURLOPT_RANGE, state->range);

    curl_multi_add_handle(s->multi, state->curl);
@@ -919,24 +891,26 @@ static void curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)

 out:
    qemu_mutex_unlock(&s->mutex);
+    if (ret != -EINPROGRESS) {
+        acb->common.cb(acb->common.opaque, ret);
+        qemu_aio_unref(acb);
+    }
 }

-static int coroutine_fn curl_co_preadv(BlockDriverState *bs,
-        uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
+static BlockAIOCB *curl_aio_readv(BlockDriverState *bs,
+        int64_t sector_num, QEMUIOVector *qiov, int nb_sectors,
+        BlockCompletionFunc *cb, void *opaque)
 {
-    CURLAIOCB acb = {
-        .co = qemu_coroutine_self(),
-        .ret = -EINPROGRESS,
-        .qiov = qiov,
-        .offset = offset,
-        .bytes = bytes
-    };
+    CURLAIOCB *acb;

-    curl_setup_preadv(bs, &acb);
-    while (acb.ret == -EINPROGRESS) {
-        qemu_coroutine_yield();
-    }
-    return acb.ret;
+    acb = qemu_aio_get(&curl_aiocb_info, bs, cb, opaque);
+
+    acb->qiov = qiov;
+    acb->sector_num = sector_num;
+    acb->nb_sectors = nb_sectors;
+
+    aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), curl_readv_bh_cb, acb);
+    return &acb->common;
 }

 static void curl_close(BlockDriverState *bs)
@@ -967,7 +941,7 @@ static BlockDriver bdrv_http = {
    .bdrv_close                 = curl_close,
    .bdrv_getlength             = curl_getlength,

-    .bdrv_co_preadv             = curl_co_preadv,
+    .bdrv_aio_readv             = curl_aio_readv,

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
@@ -983,7 +957,7 @@ static BlockDriver bdrv_https = {
    .bdrv_close                 = curl_close,
    .bdrv_getlength             = curl_getlength,

-    .bdrv_co_preadv             = curl_co_preadv,
+    .bdrv_aio_readv             = curl_aio_readv,

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
@@ -999,7 +973,7 @@ static BlockDriver bdrv_ftp = {
    .bdrv_close                 = curl_close,
    .bdrv_getlength             = curl_getlength,

-    .bdrv_co_preadv             = curl_co_preadv,
+    .bdrv_aio_readv             = curl_aio_readv,

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
@@ -1015,7 +989,7 @@ static BlockDriver bdrv_ftps = {
    .bdrv_close                 = curl_close,
    .bdrv_getlength             = curl_getlength,

-    .bdrv_co_preadv             = curl_co_preadv,
+    .bdrv_aio_readv             = curl_aio_readv,

    .bdrv_detach_aio_context    = curl_detach_aio_context,
    .bdrv_attach_aio_context    = curl_attach_aio_context,
@@ -37,24 +37,13 @@
 *     or enabled. A frozen bitmap can only abdicate() or reclaim().
 */
 struct BdrvDirtyBitmap {
-    QemuMutex *mutex;
    HBitmap *bitmap;            /* Dirty sector bitmap implementation */
    HBitmap *meta;              /* Meta dirty bitmap */
    BdrvDirtyBitmap *successor; /* Anonymous child; implies frozen status */
    char *name;                 /* Optional non-empty unique ID */
    int64_t size;               /* Size of the bitmap (Number of sectors) */
-    bool disabled;              /* Bitmap is disabled. It ignores all writes to
-                                   the device */
+    bool disabled;              /* Bitmap is read-only */
    int active_iterators;       /* How many iterators are active */
-    bool readonly;              /* Bitmap is read-only. This field also
-                                   prevents the respective image from being
-                                   modified (i.e. blocks writes and discards).
-                                   Such operations must fail and both the image
-                                   and this bitmap must remain unchanged while
-                                   this flag is set. */
-    bool autoload;              /* For persistent bitmaps: bitmap must be
-                                   autoloaded on image opening */
-    bool persistent;            /* bitmap must be saved to owner disk image */
    QLIST_ENTRY(BdrvDirtyBitmap) list;
 };

@@ -63,27 +52,6 @@ struct BdrvDirtyBitmapIter {
    BdrvDirtyBitmap *bitmap;
 };

-static inline void bdrv_dirty_bitmaps_lock(BlockDriverState *bs)
-{
-    qemu_mutex_lock(&bs->dirty_bitmap_mutex);
-}
-
-static inline void bdrv_dirty_bitmaps_unlock(BlockDriverState *bs)
-{
-    qemu_mutex_unlock(&bs->dirty_bitmap_mutex);
-}
-
-void bdrv_dirty_bitmap_lock(BdrvDirtyBitmap *bitmap)
-{
-    qemu_mutex_lock(bitmap->mutex);
-}
-
-void bdrv_dirty_bitmap_unlock(BdrvDirtyBitmap *bitmap)
-{
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-/* Called with BQL or dirty_bitmap lock taken.  */
 BdrvDirtyBitmap *bdrv_find_dirty_bitmap(BlockDriverState *bs, const char *name)
 {
    BdrvDirtyBitmap *bm;
@@ -97,17 +65,13 @@ BdrvDirtyBitmap *bdrv_find_dirty_bitmap(BlockDriverState *bs, const char *name)
    return NULL;
 }

-/* Called with BQL taken.  */
 void bdrv_dirty_bitmap_make_anon(BdrvDirtyBitmap *bitmap)
 {
    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    g_free(bitmap->name);
    bitmap->name = NULL;
-    bitmap->persistent = false;
-    bitmap->autoload = false;
 }

-/* Called with BQL taken.  */
 BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
                                          uint32_t granularity,
                                          const char *name,
@@ -132,14 +96,11 @@ BdrvDirtyBitmap *bdrv_create_dirty_bitmap(BlockDriverState *bs,
        return NULL;
    }
    bitmap = g_new0(BdrvDirtyBitmap, 1);
-    bitmap->mutex = &bs->dirty_bitmap_mutex;
    bitmap->bitmap = hbitmap_alloc(bitmap_size, ctz32(sector_granularity));
    bitmap->size = bitmap_size;
    bitmap->name = g_strdup(name);
    bitmap->disabled = false;
-    bdrv_dirty_bitmaps_lock(bs);
    QLIST_INSERT_HEAD(&bs->dirty_bitmaps, bitmap, list);
-    bdrv_dirty_bitmaps_unlock(bs);
    return bitmap;
 }

@@ -158,24 +119,20 @@ void bdrv_create_meta_dirty_bitmap(BdrvDirtyBitmap *bitmap,
                                   int chunk_size)
 {
    assert(!bitmap->meta);
-    qemu_mutex_lock(bitmap->mutex);
    bitmap->meta = hbitmap_create_meta(bitmap->bitmap,
                                       chunk_size * BITS_PER_BYTE);
-    qemu_mutex_unlock(bitmap->mutex);
 }

 void bdrv_release_meta_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
    assert(bitmap->meta);
-    qemu_mutex_lock(bitmap->mutex);
    hbitmap_free_meta(bitmap->bitmap);
    bitmap->meta = NULL;
-    qemu_mutex_unlock(bitmap->mutex);
 }

-int bdrv_dirty_bitmap_get_meta_locked(BlockDriverState *bs,
-                                      BdrvDirtyBitmap *bitmap, int64_t sector,
-                                      int nb_sectors)
+int bdrv_dirty_bitmap_get_meta(BlockDriverState *bs,
+                               BdrvDirtyBitmap *bitmap, int64_t sector,
+                               int nb_sectors)
 {
    uint64_t i;
    int sectors_per_bit = 1 << hbitmap_granularity(bitmap->meta);
@@ -190,26 +147,11 @@ int bdrv_dirty_bitmap_get_meta_locked(BlockDriverState *bs,
    return false;
 }

-int bdrv_dirty_bitmap_get_meta(BlockDriverState *bs,
-                               BdrvDirtyBitmap *bitmap, int64_t sector,
-                               int nb_sectors)
-{
-    bool dirty;
-
-    qemu_mutex_lock(bitmap->mutex);
-    dirty = bdrv_dirty_bitmap_get_meta_locked(bs, bitmap, sector, nb_sectors);
-    qemu_mutex_unlock(bitmap->mutex);
-
-    return dirty;
-}
-
 void bdrv_dirty_bitmap_reset_meta(BlockDriverState *bs,
                                  BdrvDirtyBitmap *bitmap, int64_t sector,
                                  int nb_sectors)
 {
-    qemu_mutex_lock(bitmap->mutex);
    hbitmap_reset(bitmap->meta, sector, nb_sectors);
-    qemu_mutex_unlock(bitmap->mutex);
 }

 int64_t bdrv_dirty_bitmap_size(const BdrvDirtyBitmap *bitmap)
@@ -222,19 +164,16 @@ const char *bdrv_dirty_bitmap_name(const BdrvDirtyBitmap *bitmap)
    return bitmap->name;
 }

-/* Called with BQL taken.  */
 bool bdrv_dirty_bitmap_frozen(BdrvDirtyBitmap *bitmap)
 {
    return bitmap->successor;
 }

-/* Called with BQL taken.  */
 bool bdrv_dirty_bitmap_enabled(BdrvDirtyBitmap *bitmap)
 {
    return !(bitmap->disabled || bitmap->successor);
 }

-/* Called with BQL taken.  */
 DirtyBitmapStatus bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap)
 {
    if (bdrv_dirty_bitmap_frozen(bitmap)) {
@@ -249,7 +188,6 @@ DirtyBitmapStatus bdrv_dirty_bitmap_status(BdrvDirtyBitmap *bitmap)
 /**
 * Create a successor bitmap destined to replace this bitmap after an operation.
 * Requires that the bitmap is not frozen and has no successor.
- * Called with BQL taken.
 */
 int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,
                                       BdrvDirtyBitmap *bitmap, Error **errp)
@@ -282,7 +220,6 @@ int bdrv_dirty_bitmap_create_successor(BlockDriverState *bs,
 /**
 * For a bitmap with a successor, yield our name to the successor,
 * delete the old bitmap, and return a handle to the new bitmap.
- * Called with BQL taken.
 */
 BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
                                            BdrvDirtyBitmap *bitmap,
@@ -301,10 +238,6 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
    bitmap->name = NULL;
    successor->name = name;
    bitmap->successor = NULL;
-    successor->persistent = bitmap->persistent;
-    bitmap->persistent = false;
-    successor->autoload = bitmap->autoload;
-    bitmap->autoload = false;
    bdrv_release_dirty_bitmap(bs, bitmap);

    return successor;
@@ -314,7 +247,6 @@ BdrvDirtyBitmap *bdrv_dirty_bitmap_abdicate(BlockDriverState *bs,
 * In cases of failure where we can no longer safely delete the parent,
 * we may wish to re-join the parent and child/successor.
 * The merged parent will be un-frozen, but not explicitly re-enabled.
- * Called with BQL taken.
 */
 BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap(BlockDriverState *bs,
                                           BdrvDirtyBitmap *parent,
@@ -339,37 +271,27 @@ BdrvDirtyBitmap *bdrv_reclaim_dirty_bitmap(BlockDriverState *bs,

 /**
 * Truncates _all_ bitmaps attached to a BDS.
- * Called with BQL taken.
 */
 void bdrv_dirty_bitmap_truncate(BlockDriverState *bs)
 {
    BdrvDirtyBitmap *bitmap;
    uint64_t size = bdrv_nb_sectors(bs);

-    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {
        assert(!bdrv_dirty_bitmap_frozen(bitmap));
        assert(!bitmap->active_iterators);
        hbitmap_truncate(bitmap->bitmap, size);
        bitmap->size = size;
    }
-    bdrv_dirty_bitmaps_unlock(bs);
 }

-static bool bdrv_dirty_bitmap_has_name(BdrvDirtyBitmap *bitmap)
-{
-    return !!bdrv_dirty_bitmap_name(bitmap);
-}
-
-/* Called with BQL taken.  */
-static void bdrv_do_release_matching_dirty_bitmap(
-    BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
-    bool (*cond)(BdrvDirtyBitmap *bitmap))
+static void bdrv_do_release_matching_dirty_bitmap(BlockDriverState *bs,
+                                                  BdrvDirtyBitmap *bitmap,
+                                                  bool only_named)
 {
    BdrvDirtyBitmap *bm, *next;
-    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH_SAFE(bm, &bs->dirty_bitmaps, list, next) {
-        if ((!bitmap || bm == bitmap) && (!cond || cond(bm))) {
+        if ((!bitmap || bm == bitmap) && (!only_named || bm->name)) {
            assert(!bm->active_iterators);
            assert(!bdrv_dirty_bitmap_frozen(bm));
            assert(!bm->meta);
@@ -379,72 +301,35 @@ static void bdrv_do_release_matching_dirty_bitmap(
            g_free(bm);

            if (bitmap) {
-                goto out;
+                return;
            }
        }
    }
    if (bitmap) {
        abort();
    }
-
-out:
-    bdrv_dirty_bitmaps_unlock(bs);
 }

-/* Called with BQL taken.  */
 void bdrv_release_dirty_bitmap(BlockDriverState *bs, BdrvDirtyBitmap *bitmap)
 {
-    bdrv_do_release_matching_dirty_bitmap(bs, bitmap, NULL);
+    bdrv_do_release_matching_dirty_bitmap(bs, bitmap, false);
 }

 /**
 * Release all named dirty bitmaps attached to a BDS (for use in bdrv_close()).
 * There must not be any frozen bitmaps attached.
- * This function does not remove persistent bitmaps from the storage.
- * Called with BQL taken.
 */
 void bdrv_release_named_dirty_bitmaps(BlockDriverState *bs)
 {
-    bdrv_do_release_matching_dirty_bitmap(bs, NULL, bdrv_dirty_bitmap_has_name);
+    bdrv_do_release_matching_dirty_bitmap(bs, NULL, true);
 }

-/**
- * Release all persistent dirty bitmaps attached to a BDS (for use in
- * bdrv_inactivate_recurse()).
- * There must not be any frozen bitmaps attached.
- * This function does not remove persistent bitmaps from the storage.
- */
-void bdrv_release_persistent_dirty_bitmaps(BlockDriverState *bs)
-{
-    bdrv_do_release_matching_dirty_bitmap(bs, NULL,
-                                          bdrv_dirty_bitmap_get_persistance);
-}
-
-/**
- * Remove persistent dirty bitmap from the storage if it exists.
- * Absence of bitmap is not an error, because we have the following scenario:
- * BdrvDirtyBitmap can have .persistent = true but not yet saved and have no
- * stored version. For such bitmap bdrv_remove_persistent_dirty_bitmap() should
- * not fail.
- * This function doesn't release corresponding BdrvDirtyBitmap.
- */
-void bdrv_remove_persistent_dirty_bitmap(BlockDriverState *bs,
-                                         const char *name,
-                                         Error **errp)
-{
-    if (bs->drv && bs->drv->bdrv_remove_persistent_dirty_bitmap) {
-        bs->drv->bdrv_remove_persistent_dirty_bitmap(bs, name, errp);
-    }
-}
-
-/* Called with BQL taken.  */
 void bdrv_disable_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
    assert(!bdrv_dirty_bitmap_frozen(bitmap));
    bitmap->disabled = true;
 }

-/* Called with BQL taken.  */
 void bdrv_enable_dirty_bitmap(BdrvDirtyBitmap *bitmap)
 {
    assert(!bdrv_dirty_bitmap_frozen(bitmap));
@@ -457,7 +342,6 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
    BlockDirtyInfoList *list = NULL;
    BlockDirtyInfoList **plist = &list;

-    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
        BlockDirtyInfo *info = g_new0(BlockDirtyInfo, 1);
        BlockDirtyInfoList *entry = g_new0(BlockDirtyInfoList, 1);
@@ -470,14 +354,12 @@ BlockDirtyInfoList *bdrv_query_dirty_bitmaps(BlockDriverState *bs)
        *plist = entry;
        plist = &entry->next;
    }
-    bdrv_dirty_bitmaps_unlock(bs);

    return list;
 }

-/* Called within bdrv_dirty_bitmap_lock..unlock */
-int bdrv_get_dirty_locked(BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
-                          int64_t sector)
+int bdrv_get_dirty(BlockDriverState *bs, BdrvDirtyBitmap *bitmap,
+                   int64_t sector)
 {
    if (bitmap) {
        return hbitmap_get(bitmap->bitmap, sector);
@@ -506,7 +388,7 @@ uint32_t bdrv_get_default_bitmap_granularity(BlockDriverState *bs)
    return granularity;
 }

-uint32_t bdrv_dirty_bitmap_granularity(const BdrvDirtyBitmap *bitmap)
+uint32_t bdrv_dirty_bitmap_granularity(BdrvDirtyBitmap *bitmap)
 {
    return BDRV_SECTOR_SIZE << hbitmap_granularity(bitmap->bitmap);
 }
@@ -550,45 +432,23 @@ int64_t bdrv_dirty_iter_next(BdrvDirtyBitmapIter *iter)
    return hbitmap_iter_next(&iter->hbi);
 }

-/* Called within bdrv_dirty_bitmap_lock..unlock */
-void bdrv_set_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
-                                  int64_t cur_sector, int64_t nr_sectors)
-{
-    assert(bdrv_dirty_bitmap_enabled(bitmap));
-    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);
-}
-
 void bdrv_set_dirty_bitmap(BdrvDirtyBitmap *bitmap,
                           int64_t cur_sector, int64_t nr_sectors)
-{
-    bdrv_dirty_bitmap_lock(bitmap);
-    bdrv_set_dirty_bitmap_locked(bitmap, cur_sector, nr_sectors);
-    bdrv_dirty_bitmap_unlock(bitmap);
-}
-
-/* Called within bdrv_dirty_bitmap_lock..unlock */
-void bdrv_reset_dirty_bitmap_locked(BdrvDirtyBitmap *bitmap,
-                                    int64_t cur_sector, int64_t nr_sectors)
 {
    assert(bdrv_dirty_bitmap_enabled(bitmap));
-    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    hbitmap_reset(bitmap->bitmap, cur_sector, nr_sectors);
+    hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);
 }

 void bdrv_reset_dirty_bitmap(BdrvDirtyBitmap *bitmap,
                             int64_t cur_sector, int64_t nr_sectors)
 {
-    bdrv_dirty_bitmap_lock(bitmap);
-    bdrv_reset_dirty_bitmap_locked(bitmap, cur_sector, nr_sectors);
-    bdrv_dirty_bitmap_unlock(bitmap);
+    assert(bdrv_dirty_bitmap_enabled(bitmap));
+    hbitmap_reset(bitmap->bitmap, cur_sector, nr_sectors);
 }

 void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
 {
    assert(bdrv_dirty_bitmap_enabled(bitmap));
-    assert(!bdrv_dirty_bitmap_readonly(bitmap));
-    bdrv_dirty_bitmap_lock(bitmap);
    if (!out) {
        hbitmap_reset_all(bitmap->bitmap);
    } else {
@@ -597,14 +457,12 @@ void bdrv_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap **out)
                                       hbitmap_granularity(backup));
        *out = backup;
    }
-    bdrv_dirty_bitmap_unlock(bitmap);
 }

 void bdrv_undo_clear_dirty_bitmap(BdrvDirtyBitmap *bitmap, HBitmap *in)
 {
    HBitmap *tmp = bitmap->bitmap;
    assert(bdrv_dirty_bitmap_enabled(bitmap));
-    assert(!bdrv_dirty_bitmap_readonly(bitmap));
    bitmap->bitmap = in;
    hbitmap_free(tmp);
 }
@@ -641,13 +499,6 @@ void bdrv_dirty_bitmap_deserialize_zeroes(BdrvDirtyBitmap *bitmap,
    hbitmap_deserialize_zeroes(bitmap->bitmap, start, count, finish);
 }

-void bdrv_dirty_bitmap_deserialize_ones(BdrvDirtyBitmap *bitmap,
-                                        uint64_t start, uint64_t count,
-                                        bool finish)
-{
-    hbitmap_deserialize_ones(bitmap->bitmap, start, count, finish);
-}
-
 void bdrv_dirty_bitmap_deserialize_finish(BdrvDirtyBitmap *bitmap)
 {
    hbitmap_deserialize_finish(bitmap->bitmap);
@@ -657,20 +508,12 @@ void bdrv_set_dirty(BlockDriverState *bs, int64_t cur_sector,
                    int64_t nr_sectors)
 {
    BdrvDirtyBitmap *bitmap;
-
-    if (QLIST_EMPTY(&bs->dirty_bitmaps)) {
-        return;
-    }
-
-    bdrv_dirty_bitmaps_lock(bs);
    QLIST_FOREACH(bitmap, &bs->dirty_bitmaps, list) {
        if (!bdrv_dirty_bitmap_enabled(bitmap)) {
            continue;
        }
-        assert(!bdrv_dirty_bitmap_readonly(bitmap));
        hbitmap_set(bitmap->bitmap, cur_sector, nr_sectors);
    }
-    bdrv_dirty_bitmaps_unlock(bs);
 }

 /**
@@ -690,78 +533,3 @@ int64_t bdrv_get_meta_dirty_count(BdrvDirtyBitmap *bitmap)
 {
    return hbitmap_count(bitmap->meta);
 }
-
-bool bdrv_dirty_bitmap_readonly(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->readonly;
-}
-
-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_readonly(BdrvDirtyBitmap *bitmap, bool value)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    bitmap->readonly = value;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-bool bdrv_has_readonly_bitmaps(BlockDriverState *bs)
-{
-    BdrvDirtyBitmap *bm;
-    QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
-        if (bm->readonly) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_autoload(BdrvDirtyBitmap *bitmap, bool autoload)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    bitmap->autoload = autoload;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-bool bdrv_dirty_bitmap_get_autoload(const BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->autoload;
-}
-
-/* Called with BQL taken. */
-void bdrv_dirty_bitmap_set_persistance(BdrvDirtyBitmap *bitmap, bool persistent)
-{
-    qemu_mutex_lock(bitmap->mutex);
-    bitmap->persistent = persistent;
-    qemu_mutex_unlock(bitmap->mutex);
-}
-
-bool bdrv_dirty_bitmap_get_persistance(BdrvDirtyBitmap *bitmap)
-{
-    return bitmap->persistent;
-}
-
-bool bdrv_has_changed_persistent_bitmaps(BlockDriverState *bs)
-{
-    BdrvDirtyBitmap *bm;
-    QLIST_FOREACH(bm, &bs->dirty_bitmaps, list) {
-        if (bm->persistent && !bm->readonly) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-BdrvDirtyBitmap *bdrv_dirty_bitmap_next(BlockDriverState *bs,
-                                        BdrvDirtyBitmap *bitmap)
-{
-    return bitmap == NULL ? QLIST_FIRST(&bs->dirty_bitmaps) :
-                            QLIST_NEXT(bitmap, list);
-}
-
-char *bdrv_dirty_bitmap_sha256(const BdrvDirtyBitmap *bitmap, Error **errp)
-{
-    return hbitmap_sha256(bitmap->bitmap, errp);
-}
@@ -419,12 +419,8 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
        return -EINVAL;
    }

-    ret = bdrv_set_read_only(bs, true, errp);
-    if (ret < 0) {
-        return ret;
-    }
-
    block_module_load_one("dmg-bz2");
+    bs->read_only = true;

    s->n_chunks = 0;
    s->offsets = s->lengths = s->sectors = s->sectorcounts = NULL;
@@ -25,6 +25,8 @@
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "trace.h"
@@ -129,23 +131,12 @@ do { \

 #define MAX_BLOCKSIZE	4096

-/* Posix file locking bytes. Libvirt takes byte 0, we start from higher bytes,
- * leaving a few more bytes for its future use. */
-#define RAW_LOCK_PERM_BASE             100
-#define RAW_LOCK_SHARED_BASE           200
-
 typedef struct BDRVRawState {
    int fd;
-    int lock_fd;
-    bool use_lock;
    int type;
    int open_flags;
    size_t buf_align;

-    /* The current permissions. */
-    uint64_t perm;
-    uint64_t shared_perm;
-
 #ifdef CONFIG_XFS
    bool is_xfs:1;
 #endif
@@ -381,7 +372,12 @@ static void raw_parse_flags(int bdrv_flags, int *open_flags)
 static void raw_parse_filename(const char *filename, QDict *options,
                               Error **errp)
 {
-    bdrv_parse_filename_strip_prefix(filename, "file:", options);
+    /* The filename does not have to be prefixed by the protocol name, since
+     * "file" is the default protocol; therefore, the return value of this
+     * function call can be ignored. */
+    strstart(filename, "file:", &filename);
+
+    qdict_put_str(options, "filename", filename);
 }

 static QemuOptsList raw_runtime_opts = {
@@ -398,11 +394,6 @@ static QemuOptsList raw_runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "host AIO implementation (threads, native)",
        },
-        {
-            .name = "locking",
-            .type = QEMU_OPT_STRING,
-            .help = "file locking mode (on/off/auto, default: auto)",
-        },
        { /* end of list */ }
    },
 };
@@ -417,7 +408,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    BlockdevAioOptions aio, aio_default;
    int fd, ret;
    struct stat st;
-    OnOffAuto locking;

    opts = qemu_opts_create(&raw_runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
@@ -447,34 +437,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    }
    s->use_linux_aio = (aio == BLOCKDEV_AIO_OPTIONS_NATIVE);

-    locking = qapi_enum_parse(OnOffAuto_lookup, qemu_opt_get(opts, "locking"),
-                              ON_OFF_AUTO__MAX, ON_OFF_AUTO_AUTO, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -EINVAL;
-        goto fail;
-    }
-    switch (locking) {
-    case ON_OFF_AUTO_ON:
-        s->use_lock = true;
-        if (!qemu_has_ofd_lock()) {
-            fprintf(stderr,
-                    "File lock requested but OFD locking syscall is "
-                    "unavailable, falling back to POSIX file locks.\n"
-                    "Due to the implementation, locks can be lost "
-                    "unexpectedly.\n");
-        }
-        break;
-    case ON_OFF_AUTO_OFF:
-        s->use_lock = false;
-        break;
-    case ON_OFF_AUTO_AUTO:
-        s->use_lock = qemu_has_ofd_lock();
-        break;
-    default:
-        abort();
-    }
-
    s->open_flags = open_flags;
    raw_parse_flags(bdrv_flags, &s->open_flags);

@@ -490,21 +452,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
    }
    s->fd = fd;

-    s->lock_fd = -1;
-    if (s->use_lock) {
-        fd = qemu_open(filename, s->open_flags);
-        if (fd < 0) {
-            ret = -errno;
-            error_setg_errno(errp, errno, "Could not open '%s' for locking",
-                             filename);
-            qemu_close(s->fd);
-            goto fail;
-        }
-        s->lock_fd = fd;
-    }
-    s->perm = 0;
-    s->shared_perm = BLK_PERM_ALL;
-
 #ifdef CONFIG_LINUX_AIO
     /* Currently Linux does AIO only for files opened with O_DIRECT */
    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
@@ -592,161 +539,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
    return raw_open_common(bs, options, flags, 0, errp);
 }

-typedef enum {
-    RAW_PL_PREPARE,
-    RAW_PL_COMMIT,
-    RAW_PL_ABORT,
-} RawPermLockOp;
-
-#define PERM_FOREACH(i) \
-    for ((i) = 0; (1ULL << (i)) <= BLK_PERM_ALL; i++)
-
-/* Lock bytes indicated by @perm_lock_bits and @shared_perm_lock_bits in the
- * file; if @unlock == true, also unlock the unneeded bytes.
- * @shared_perm_lock_bits is the mask of all permissions that are NOT shared.
- */
-static int raw_apply_lock_bytes(BDRVRawState *s,
-                                uint64_t perm_lock_bits,
-                                uint64_t shared_perm_lock_bits,
-                                bool unlock, Error **errp)
-{
-    int ret;
-    int i;
-
-    PERM_FOREACH(i) {
-        int off = RAW_LOCK_PERM_BASE + i;
-        if (perm_lock_bits & (1ULL << i)) {
-            ret = qemu_lock_fd(s->lock_fd, off, 1, false);
-            if (ret) {
-                error_setg(errp, "Failed to lock byte %d", off);
-                return ret;
-            }
-        } else if (unlock) {
-            ret = qemu_unlock_fd(s->lock_fd, off, 1);
-            if (ret) {
-                error_setg(errp, "Failed to unlock byte %d", off);
-                return ret;
-            }
-        }
-    }
-    PERM_FOREACH(i) {
-        int off = RAW_LOCK_SHARED_BASE + i;
-        if (shared_perm_lock_bits & (1ULL << i)) {
-            ret = qemu_lock_fd(s->lock_fd, off, 1, false);
-            if (ret) {
-                error_setg(errp, "Failed to lock byte %d", off);
-                return ret;
-            }
-        } else if (unlock) {
-            ret = qemu_unlock_fd(s->lock_fd, off, 1);
-            if (ret) {
-                error_setg(errp, "Failed to unlock byte %d", off);
-                return ret;
-            }
-        }
-    }
-    return 0;
-}
-
-/* Check "unshared" bytes implied by @perm and ~@shared_perm in the file. */
-static int raw_check_lock_bytes(BDRVRawState *s,
-                                uint64_t perm, uint64_t shared_perm,
-                                Error **errp)
-{
-    int ret;
-    int i;
-
-    PERM_FOREACH(i) {
-        int off = RAW_LOCK_SHARED_BASE + i;
-        uint64_t p = 1ULL << i;
-        if (perm & p) {
-            ret = qemu_lock_fd_test(s->lock_fd, off, 1, true);
-            if (ret) {
-                char *perm_name = bdrv_perm_names(p);
-                error_setg(errp,
-                           "Failed to get \"%s\" lock",
-                           perm_name);
-                g_free(perm_name);
-                error_append_hint(errp,
-                                  "Is another process using the image?\n");
-                return ret;
-            }
-        }
-    }
-    PERM_FOREACH(i) {
-        int off = RAW_LOCK_PERM_BASE + i;
-        uint64_t p = 1ULL << i;
-        if (!(shared_perm & p)) {
-            ret = qemu_lock_fd_test(s->lock_fd, off, 1, true);
-            if (ret) {
-                char *perm_name = bdrv_perm_names(p);
-                error_setg(errp,
-                           "Failed to get shared \"%s\" lock",
-                           perm_name);
-                g_free(perm_name);
-                error_append_hint(errp,
-                                  "Is another process using the image?\n");
-                return ret;
-            }
-        }
-    }
-    return 0;
-}
-
-static int raw_handle_perm_lock(BlockDriverState *bs,
-                                RawPermLockOp op,
-                                uint64_t new_perm, uint64_t new_shared,
-                                Error **errp)
-{
-    BDRVRawState *s = bs->opaque;
-    int ret = 0;
-    Error *local_err = NULL;
-
-    if (!s->use_lock) {
-        return 0;
-    }
-
-    if (bdrv_get_flags(bs) & BDRV_O_INACTIVE) {
-        return 0;
-    }
-
-    assert(s->lock_fd > 0);
-
-    switch (op) {
-    case RAW_PL_PREPARE:
-        ret = raw_apply_lock_bytes(s, s->perm | new_perm,
-                                   ~s->shared_perm | ~new_shared,
-                                   false, errp);
-        if (!ret) {
-            ret = raw_check_lock_bytes(s, new_perm, new_shared, errp);
-            if (!ret) {
-                return 0;
-            }
-        }
-        op = RAW_PL_ABORT;
-        /* fall through to unlock bytes. */
-    case RAW_PL_ABORT:
-        raw_apply_lock_bytes(s, s->perm, ~s->shared_perm, true, &local_err);
-        if (local_err) {
-            /* Theoretically the above call only unlocks bytes and it cannot
-             * fail. Something weird happened, report it.
-             */
-            error_report_err(local_err);
-        }
-        break;
-    case RAW_PL_COMMIT:
-        raw_apply_lock_bytes(s, new_perm, ~new_shared, true, &local_err);
-        if (local_err) {
-            /* Theoretically the above call only unlocks bytes and it cannot
-             * fail. Something weird happened, report it.
-             */
-            error_report_err(local_err);
-        }
-        break;
-    }
-    return ret;
-}
-
 static int raw_reopen_prepare(BDRVReopenState *state,
                              BlockReopenQueue *queue, Error **errp)
 {
@@ -1336,9 +1128,6 @@ static ssize_t handle_aiocb_write_zeroes(RawPosixAIOData *aiocb)
 #if defined(CONFIG_FALLOCATE) || defined(CONFIG_XFS)
    BDRVRawState *s = aiocb->bs->opaque;
 #endif
-#ifdef CONFIG_FALLOCATE
-    int64_t len;
-#endif

    if (aiocb->aio_type & QEMU_AIO_BLKDEV) {
        return handle_aiocb_write_zeroes_block(aiocb);
@@ -1381,10 +1170,7 @@ static ssize_t handle_aiocb_write_zeroes(RawPosixAIOData *aiocb)
 #endif

 #ifdef CONFIG_FALLOCATE
-    /* Last resort: we are trying to extend the file with zeroed data. This
-     * can be done via fallocate(fd, 0) */
-    len = bdrv_getlength(aiocb->bs);
-    if (s->has_fallocate && len >= 0 && aiocb->aio_offset >= len) {
+    if (s->has_fallocate && aiocb->aio_offset >= bdrv_getlength(aiocb->bs)) {
        int ret = do_fallocate(s->fd, 0, aiocb->aio_offset, aiocb->aio_nbytes);
        if (ret == 0 || ret != -ENOTSUP) {
            return ret;
@@ -1488,7 +1274,7 @@ static int aio_worker(void *arg)

 static int paio_submit_co(BlockDriverState *bs, int fd,
                          int64_t offset, QEMUIOVector *qiov,
-                          int bytes, int type)
+                          int count, int type)
 {
    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
    ThreadPool *pool;
@@ -1497,22 +1283,22 @@ static int paio_submit_co(BlockDriverState *bs, int fd,
    acb->aio_type = type;
    acb->aio_fildes = fd;

-    acb->aio_nbytes = bytes;
+    acb->aio_nbytes = count;
    acb->aio_offset = offset;

    if (qiov) {
        acb->aio_iov = qiov->iov;
        acb->aio_niov = qiov->niov;
-        assert(qiov->size == bytes);
+        assert(qiov->size == count);
    }

-    trace_paio_submit_co(offset, bytes, type);
+    trace_paio_submit_co(offset, count, type);
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
    return thread_pool_submit_co(pool, aio_worker, acb);
 }

 static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
-        int64_t offset, QEMUIOVector *qiov, int bytes,
+        int64_t offset, QEMUIOVector *qiov, int count,
        BlockCompletionFunc *cb, void *opaque, int type)
 {
    RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
@@ -1522,7 +1308,7 @@ static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
    acb->aio_type = type;
    acb->aio_fildes = fd;

-    acb->aio_nbytes = bytes;
+    acb->aio_nbytes = count;
    acb->aio_offset = offset;

    if (qiov) {
@@ -1531,7 +1317,7 @@ static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
        assert(qiov->size == acb->aio_nbytes);
    }

-    trace_paio_submit(acb, opaque, offset, bytes, type);
+    trace_paio_submit(acb, opaque, offset, count, type);
    pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
    return thread_pool_submit_aio(pool, aio_worker, acb, cb, opaque);
 }
@@ -1621,156 +1407,26 @@ static void raw_close(BlockDriverState *bs)
        qemu_close(s->fd);
        s->fd = -1;
    }
-    if (s->lock_fd >= 0) {
-        qemu_close(s->lock_fd);
-        s->lock_fd = -1;
-    }
 }

-/**
- * Truncates the given regular file @fd to @offset and, when growing, fills the
- * new space according to @prealloc.
- *
- * Returns: 0 on success, -errno on failure.
- */
-static int raw_regular_truncate(int fd, int64_t offset, PreallocMode prealloc,
-                                Error **errp)
-{
-    int result = 0;
-    int64_t current_length = 0;
-    char *buf = NULL;
-    struct stat st;
-
-    if (fstat(fd, &st) < 0) {
-        result = -errno;
-        error_setg_errno(errp, -result, "Could not stat file");
-        return result;
-    }
-
-    current_length = st.st_size;
-    if (current_length > offset && prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Cannot use preallocation for shrinking files");
-        return -ENOTSUP;
-    }
-
-    switch (prealloc) {
-#ifdef CONFIG_POSIX_FALLOCATE
-    case PREALLOC_MODE_FALLOC:
-        /*
-         * Truncating before posix_fallocate() makes it about twice slower on
-         * file systems that do not support fallocate(), trying to check if a
-         * block is allocated before allocating it, so don't do that here.
-         */
-        result = -posix_fallocate(fd, current_length, offset - current_length);
-        if (result != 0) {
-            /* posix_fallocate() doesn't set errno. */
-            error_setg_errno(errp, -result,
-                             "Could not preallocate new data");
-        }
-        goto out;
-#endif
-    case PREALLOC_MODE_FULL:
-    {
-        int64_t num = 0, left = offset - current_length;
-
-        /*
-         * Knowing the final size from the beginning could allow the file
-         * system driver to do less allocations and possibly avoid
-         * fragmentation of the file.
-         */
-        if (ftruncate(fd, offset) != 0) {
-            result = -errno;
-            error_setg_errno(errp, -result, "Could not resize file");
-            goto out;
-        }
-
-        buf = g_malloc0(65536);
-
-        result = lseek(fd, current_length, SEEK_SET);
-        if (result < 0) {
-            result = -errno;
-            error_setg_errno(errp, -result,
-                             "Failed to seek to the old end of file");
-            goto out;
-        }
-
-        while (left > 0) {
-            num = MIN(left, 65536);
-            result = write(fd, buf, num);
-            if (result < 0) {
-                result = -errno;
-                error_setg_errno(errp, -result,
-                                 "Could not write zeros for preallocation");
-                goto out;
-            }
-            left -= result;
-        }
-        if (result >= 0) {
-            result = fsync(fd);
-            if (result < 0) {
-                result = -errno;
-                error_setg_errno(errp, -result,
-                                 "Could not flush file to disk");
-                goto out;
-            }
-        }
-        goto out;
-    }
-    case PREALLOC_MODE_OFF:
-        if (ftruncate(fd, offset) != 0) {
-            result = -errno;
-            error_setg_errno(errp, -result, "Could not resize file");
-        }
-        return result;
-    default:
-        result = -ENOTSUP;
-        error_setg(errp, "Unsupported preallocation mode: %s",
-                   PreallocMode_lookup[prealloc]);
-        return result;
-    }
-
-out:
-    if (result < 0) {
-        if (ftruncate(fd, current_length) < 0) {
-            error_report("Failed to restore old file length: %s",
-                         strerror(errno));
-        }
-    }
-
-    g_free(buf);
-    return result;
-}
-
-static int raw_truncate(BlockDriverState *bs, int64_t offset,
-                        PreallocMode prealloc, Error **errp)
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
    struct stat st;
-    int ret;

    if (fstat(s->fd, &st)) {
-        ret = -errno;
-        error_setg_errno(errp, -ret, "Failed to fstat() the file");
-        return ret;
+        return -errno;
    }

    if (S_ISREG(st.st_mode)) {
-        return raw_regular_truncate(s->fd, offset, prealloc, errp);
-    }
-
-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Preallocation mode '%s' unsupported for this "
-                   "non-regular file", PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
-    if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
-        if (offset > raw_getlength(bs)) {
-            error_setg(errp, "Cannot grow device files");
-            return -EINVAL;
+        if (ftruncate(s->fd, offset) < 0) {
+            return -errno;
        }
+    } else if (S_ISCHR(st.st_mode) || S_ISBLK(st.st_mode)) {
+       if (offset > raw_getlength(bs)) {
+           return -EINVAL;
+       }
    } else {
-        error_setg(errp, "Resizing this file is not supported");
        return -ENOTSUP;
    }

@@ -2007,9 +1663,71 @@ static int raw_create(const char *filename, QemuOpts *opts, Error **errp)
 #endif
    }

-    result = raw_regular_truncate(fd, total_size, prealloc, errp);
-    if (result < 0) {
-        goto out_close;
+    switch (prealloc) {
+#ifdef CONFIG_POSIX_FALLOCATE
+    case PREALLOC_MODE_FALLOC:
+        /*
+         * Truncating before posix_fallocate() makes it about twice slower on
+         * file systems that do not support fallocate(), trying to check if a
+         * block is allocated before allocating it, so don't do that here.
+         */
+        result = -posix_fallocate(fd, 0, total_size);
+        if (result != 0) {
+            /* posix_fallocate() doesn't set errno. */
+            error_setg_errno(errp, -result,
+                             "Could not preallocate data for the new file");
+        }
+        break;
+#endif
+    case PREALLOC_MODE_FULL:
+    {
+        /*
+         * Knowing the final size from the beginning could allow the file
+         * system driver to do less allocations and possibly avoid
+         * fragmentation of the file.
+         */
+        if (ftruncate(fd, total_size) != 0) {
+            result = -errno;
+            error_setg_errno(errp, -result, "Could not resize file");
+            goto out_close;
+        }
+
+        int64_t num = 0, left = total_size;
+        buf = g_malloc0(65536);
+
+        while (left > 0) {
+            num = MIN(left, 65536);
+            result = write(fd, buf, num);
+            if (result < 0) {
+                result = -errno;
+                error_setg_errno(errp, -result,
+                                 "Could not write to the new file");
+                break;
+            }
+            left -= result;
+        }
+        if (result >= 0) {
+            result = fsync(fd);
+            if (result < 0) {
+                result = -errno;
+                error_setg_errno(errp, -result,
+                                 "Could not flush new file to disk");
+            }
+        }
+        g_free(buf);
+        break;
+    }
+    case PREALLOC_MODE_OFF:
+        if (ftruncate(fd, total_size) != 0) {
+            result = -errno;
+            error_setg_errno(errp, -result, "Could not resize file");
+        }
+        break;
+    default:
+        result = -EINVAL;
+        error_setg(errp, "Unsupported preallocation mode: %s",
+                   PreallocMode_lookup[prealloc]);
+        break;
    }

 out_close:
@@ -2169,26 +1887,26 @@ static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
 }

 static coroutine_fn BlockAIOCB *raw_aio_pdiscard(BlockDriverState *bs,
-    int64_t offset, int bytes,
+    int64_t offset, int count,
    BlockCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;

-    return paio_submit(bs, s->fd, offset, NULL, bytes,
+    return paio_submit(bs, s->fd, offset, NULL, count,
                       cb, opaque, QEMU_AIO_DISCARD);
 }

 static int coroutine_fn raw_co_pwrite_zeroes(
    BlockDriverState *bs, int64_t offset,
-    int bytes, BdrvRequestFlags flags)
+    int count, BdrvRequestFlags flags)
 {
    BDRVRawState *s = bs->opaque;

    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
-        return paio_submit_co(bs, s->fd, offset, NULL, bytes,
+        return paio_submit_co(bs, s->fd, offset, NULL, count,
                              QEMU_AIO_WRITE_ZEROES);
    } else if (s->discard_zeroes) {
-        return paio_submit_co(bs, s->fd, offset, NULL, bytes,
+        return paio_submit_co(bs, s->fd, offset, NULL, count,
                              QEMU_AIO_DISCARD);
    }
    return -ENOTSUP;
@@ -2226,25 +1944,6 @@ static QemuOptsList raw_create_opts = {
    }
 };

-static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
-                          Error **errp)
-{
-    return raw_handle_perm_lock(bs, RAW_PL_PREPARE, perm, shared, errp);
-}
-
-static void raw_set_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared)
-{
-    BDRVRawState *s = bs->opaque;
-    raw_handle_perm_lock(bs, RAW_PL_COMMIT, perm, shared, NULL);
-    s->perm = perm;
-    s->shared_perm = shared;
-}
-
-static void raw_abort_perm_update(BlockDriverState *bs)
-{
-    raw_handle_perm_lock(bs, RAW_PL_ABORT, 0, 0, NULL);
-}
-
 BlockDriver bdrv_file = {
    .format_name = "file",
    .protocol_name = "file",
@@ -2275,9 +1974,7 @@ BlockDriver bdrv_file = {
    .bdrv_get_info = raw_get_info,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
-    .bdrv_check_perm = raw_check_perm,
-    .bdrv_set_perm   = raw_set_perm,
-    .bdrv_abort_perm_update = raw_abort_perm_update,
+
    .create_opts = &raw_create_opts,
 };

@@ -2450,7 +2147,10 @@ static int check_hdev_writable(BDRVRawState *s)
 static void hdev_parse_filename(const char *filename, QDict *options,
                                Error **errp)
 {
-    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
+    /* The prefix is optional, just as for "file". */
+    strstart(filename, "host_device:", &filename);
+
+    qdict_put_str(options, "filename", filename);
 }

 static bool hdev_is_sg(BlockDriverState *bs)
@@ -2620,7 +2320,7 @@ static int fd_open(BlockDriverState *bs)
 }

 static coroutine_fn BlockAIOCB *hdev_aio_pdiscard(BlockDriverState *bs,
-    int64_t offset, int bytes,
+    int64_t offset, int count,
    BlockCompletionFunc *cb, void *opaque)
 {
    BDRVRawState *s = bs->opaque;
@@ -2628,12 +2328,12 @@ static coroutine_fn BlockAIOCB *hdev_aio_pdiscard(BlockDriverState *bs,
    if (fd_open(bs) < 0) {
        return NULL;
    }
-    return paio_submit(bs, s->fd, offset, NULL, bytes,
+    return paio_submit(bs, s->fd, offset, NULL, count,
                       cb, opaque, QEMU_AIO_DISCARD|QEMU_AIO_BLKDEV);
 }

 static coroutine_fn int hdev_co_pwrite_zeroes(BlockDriverState *bs,
-    int64_t offset, int bytes, BdrvRequestFlags flags)
+    int64_t offset, int count, BdrvRequestFlags flags)
 {
    BDRVRawState *s = bs->opaque;
    int rc;
@@ -2643,10 +2343,10 @@ static coroutine_fn int hdev_co_pwrite_zeroes(BlockDriverState *bs,
        return rc;
    }
    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
-        return paio_submit_co(bs, s->fd, offset, NULL, bytes,
+        return paio_submit_co(bs, s->fd, offset, NULL, count,
                              QEMU_AIO_WRITE_ZEROES|QEMU_AIO_BLKDEV);
    } else if (s->discard_zeroes) {
-        return paio_submit_co(bs, s->fd, offset, NULL, bytes,
+        return paio_submit_co(bs, s->fd, offset, NULL, count,
                              QEMU_AIO_DISCARD|QEMU_AIO_BLKDEV);
    }
    return -ENOTSUP;
@@ -2733,9 +2433,6 @@ static BlockDriver bdrv_host_device = {
    .bdrv_get_info = raw_get_info,
    .bdrv_get_allocated_file_size
                        = raw_get_allocated_file_size,
-    .bdrv_check_perm = raw_check_perm,
-    .bdrv_set_perm   = raw_set_perm,
-    .bdrv_abort_perm_update = raw_abort_perm_update,
    .bdrv_probe_blocksizes = hdev_probe_blocksizes,
    .bdrv_probe_geometry = hdev_probe_geometry,

@@ -2749,7 +2446,10 @@ static BlockDriver bdrv_host_device = {
 static void cdrom_parse_filename(const char *filename, QDict *options,
                                 Error **errp)
 {
-    bdrv_parse_filename_strip_prefix(filename, "host_cdrom:", options);
+    /* The prefix is optional, just as for "file". */
+    strstart(filename, "host_cdrom:", &filename);
+
+    qdict_put_str(options, "filename", filename);
 }
 #endif

@@ -24,6 +24,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
+#include "qemu/timer.h"
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "block/raw-aio.h"
@@ -276,7 +277,12 @@ static void raw_parse_flags(int flags, bool use_aio, int *access_flags,
 static void raw_parse_filename(const char *filename, QDict *options,
                               Error **errp)
 {
-    bdrv_parse_filename_strip_prefix(filename, "file:", options);
+    /* The filename does not have to be prefixed by the protocol name, since
+     * "file" is the default protocol; therefore, the return value of this
+     * function call can be ignored. */
+    strstart(filename, "file:", &filename);
+
+    qdict_put_str(options, "filename", filename);
 }

 static QemuOptsList raw_runtime_opts = {
@@ -339,12 +345,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    if (qdict_get_try_bool(options, "locking", false)) {
-        error_setg(errp, "locking=on is not supported on Windows");
-        ret = -EINVAL;
-        goto fail;
-    }
-
    filename = qemu_opt_get(opts, "filename");

    use_aio = get_aio_option(opts, flags, &local_err);
@@ -461,19 +461,12 @@ static void raw_close(BlockDriverState *bs)
    }
 }

-static int raw_truncate(BlockDriverState *bs, int64_t offset,
-                        PreallocMode prealloc, Error **errp)
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;
    LONG low, high;
    DWORD dwPtrLow;

-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
    low = offset;
    high = offset >> 32;

@@ -483,11 +476,11 @@ static int raw_truncate(BlockDriverState *bs, int64_t offset,
     */
    dwPtrLow = SetFilePointer(s->hfile, low, &high, FILE_BEGIN);
    if (dwPtrLow == INVALID_SET_FILE_POINTER && GetLastError() != NO_ERROR) {
-        error_setg_win32(errp, GetLastError(), "SetFilePointer error");
+        fprintf(stderr, "SetFilePointer error: %lu\n", GetLastError());
        return -EIO;
    }
    if (SetEndOfFile(s->hfile) == 0) {
-        error_setg_win32(errp, GetLastError(), "SetEndOfFile error");
+        fprintf(stderr, "SetEndOfFile error: %lu\n", GetLastError());
        return -EIO;
    }
    return 0;
@@ -673,7 +666,10 @@ static int hdev_probe_device(const char *filename)
 static void hdev_parse_filename(const char *filename, QDict *options,
                                Error **errp)
 {
-    bdrv_parse_filename_strip_prefix(filename, "host_device:", options);
+    /* The prefix is optional, just as for "file". */
+    strstart(filename, "host_device:", &filename);
+
+    qdict_put_str(options, "filename", filename);
 }

 static int hdev_open(BlockDriverState *bs, QDict *options, int flags,
@@ -321,7 +321,7 @@ static int parse_volume_options(BlockdevOptionsGluster *gconf, char *path)
 static int qemu_gluster_parse_uri(BlockdevOptionsGluster *gconf,
                                  const char *filename)
 {
-    SocketAddress *gsconf;
+    SocketAddressFlat *gsconf;
    URI *uri;
    QueryParams *qp = NULL;
    bool is_unix = false;
@@ -332,20 +332,21 @@ static int qemu_gluster_parse_uri(BlockdevOptionsGluster *gconf,
        return -EINVAL;
    }

-    gconf->server = g_new0(SocketAddressList, 1);
-    gconf->server->value = gsconf = g_new0(SocketAddress, 1);
+    gconf->server = g_new0(SocketAddressFlatList, 1);
+    gconf->server->value = gsconf = g_new0(SocketAddressFlat, 1);

    /* transport */
    if (!uri->scheme || !strcmp(uri->scheme, "gluster")) {
-        gsconf->type = SOCKET_ADDRESS_TYPE_INET;
+        gsconf->type = SOCKET_ADDRESS_FLAT_TYPE_INET;
    } else if (!strcmp(uri->scheme, "gluster+tcp")) {
-        gsconf->type = SOCKET_ADDRESS_TYPE_INET;
+        gsconf->type = SOCKET_ADDRESS_FLAT_TYPE_INET;
    } else if (!strcmp(uri->scheme, "gluster+unix")) {
-        gsconf->type = SOCKET_ADDRESS_TYPE_UNIX;
+        gsconf->type = SOCKET_ADDRESS_FLAT_TYPE_UNIX;
        is_unix = true;
    } else if (!strcmp(uri->scheme, "gluster+rdma")) {
-        gsconf->type = SOCKET_ADDRESS_TYPE_INET;
-        warn_report("rdma feature is not supported, falling back to tcp");
+        gsconf->type = SOCKET_ADDRESS_FLAT_TYPE_INET;
+        error_report("Warning: rdma feature is not supported, falling "
+                     "back to tcp");
    } else {
        ret = -EINVAL;
        goto out;
@@ -395,7 +396,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
    struct glfs *glfs;
    int ret;
    int old_errno;
-    SocketAddressList *server;
+    SocketAddressFlatList *server;
    unsigned long long port;

    glfs = glfs_find_preopened(gconf->volume);
@@ -412,11 +413,11 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,

    for (server = gconf->server; server; server = server->next) {
        switch (server->value->type) {
-        case SOCKET_ADDRESS_TYPE_UNIX:
+        case SOCKET_ADDRESS_FLAT_TYPE_UNIX:
            ret = glfs_set_volfile_server(glfs, "unix",
                                   server->value->u.q_unix.path, 0);
            break;
-        case SOCKET_ADDRESS_TYPE_INET:
+        case SOCKET_ADDRESS_FLAT_TYPE_INET:
            if (parse_uint_full(server->value->u.inet.port, &port, 10) < 0 ||
                port > 65535) {
                error_setg(errp, "'%s' is not a valid port number",
@@ -428,8 +429,8 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
                                   server->value->u.inet.host,
                                   (int)port);
            break;
-        case SOCKET_ADDRESS_TYPE_VSOCK:
-        case SOCKET_ADDRESS_TYPE_FD:
+        case SOCKET_ADDRESS_FLAT_TYPE_VSOCK:
+        case SOCKET_ADDRESS_FLAT_TYPE_FD:
        default:
            abort();
        }
@@ -449,7 +450,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
        error_setg(errp, "Gluster connection for volume %s, path %s failed"
                         " to connect", gconf->volume, gconf->path);
        for (server = gconf->server; server; server = server->next) {
-            if (server->value->type  == SOCKET_ADDRESS_TYPE_UNIX) {
+            if (server->value->type  == SOCKET_ADDRESS_FLAT_TYPE_UNIX) {
                error_append_hint(errp, "hint: failed on socket %s ",
                                  server->value->u.q_unix.path);
            } else {
@@ -486,13 +487,14 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
                                  QDict *options, Error **errp)
 {
    QemuOpts *opts;
-    SocketAddress *gsconf = NULL;
-    SocketAddressList *curr = NULL;
+    SocketAddressFlat *gsconf = NULL;
+    SocketAddressFlatList *curr = NULL;
    QDict *backing_options = NULL;
    Error *local_err = NULL;
    char *str = NULL;
    const char *ptr;
-    int i, type, num_servers;
+    size_t num_servers;
+    int i, type;

    /* create opts info from runtime_json_opts list */
    opts = qemu_opts_create(&runtime_json_opts, NULL, 0, &error_abort);
@@ -540,14 +542,14 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
            goto out;

        }
-        gsconf = g_new0(SocketAddress, 1);
+        gsconf = g_new0(SocketAddressFlat, 1);
        if (!strcmp(ptr, "tcp")) {
            ptr = "inet";       /* accept legacy "tcp" */
        }
-        type = qapi_enum_parse(SocketAddressType_lookup, ptr,
-                               SOCKET_ADDRESS_TYPE__MAX, -1, NULL);
-        if (type != SOCKET_ADDRESS_TYPE_INET
-            && type != SOCKET_ADDRESS_TYPE_UNIX) {
+        type = qapi_enum_parse(SocketAddressFlatType_lookup, ptr,
+                               SOCKET_ADDRESS_FLAT_TYPE__MAX, -1, NULL);
+        if (type != SOCKET_ADDRESS_FLAT_TYPE_INET
+            && type != SOCKET_ADDRESS_FLAT_TYPE_UNIX) {
            error_setg(&local_err,
                       "Parameter '%s' may be 'inet' or 'unix'",
                       GLUSTER_OPT_TYPE);
@@ -557,7 +559,7 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
        gsconf->type = type;
        qemu_opts_del(opts);

-        if (gsconf->type == SOCKET_ADDRESS_TYPE_INET) {
+        if (gsconf->type == SOCKET_ADDRESS_FLAT_TYPE_INET) {
            /* create opts info from runtime_inet_opts list */
            opts = qemu_opts_create(&runtime_inet_opts, NULL, 0, &error_abort);
            qemu_opts_absorb_qdict(opts, backing_options, &local_err);
@@ -626,11 +628,11 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,
        }

        if (gconf->server == NULL) {
-            gconf->server = g_new0(SocketAddressList, 1);
+            gconf->server = g_new0(SocketAddressFlatList, 1);
            gconf->server->value = gsconf;
            curr = gconf->server;
        } else {
-            curr->next = g_new0(SocketAddressList, 1);
+            curr->next = g_new0(SocketAddressFlatList, 1);
            curr->next->value = gsconf;
            curr = curr->next;
        }
@@ -646,7 +648,7 @@ static int qemu_gluster_parse_json(BlockdevOptionsGluster *gconf,

 out:
    error_propagate(errp, local_err);
-    qapi_free_SocketAddress(gsconf);
+    qapi_free_SocketAddressFlat(gsconf);
    qemu_opts_del(opts);
    g_free(str);
    QDECREF(backing_options);
@@ -962,6 +964,29 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
    qemu_coroutine_yield();
    return acb.ret;
 }
+
+static inline bool gluster_supports_zerofill(void)
+{
+    return 1;
+}
+
+static inline int qemu_gluster_zerofill(struct glfs_fd *fd, int64_t offset,
+                                        int64_t size)
+{
+    return glfs_zerofill(fd, offset, size);
+}
+
+#else
+static inline bool gluster_supports_zerofill(void)
+{
+    return 0;
+}
+
+static inline int qemu_gluster_zerofill(struct glfs_fd *fd, int64_t offset,
+                                        int64_t size)
+{
+    return 0;
+}
 #endif

 static int qemu_gluster_create(const char *filename,
@@ -971,10 +996,9 @@ static int qemu_gluster_create(const char *filename,
    struct glfs *glfs;
    struct glfs_fd *fd;
    int ret = 0;
-    PreallocMode prealloc;
+    int prealloc = 0;
    int64_t total_size = 0;
    char *tmp = NULL;
-    Error *local_err = NULL;

    gconf = g_new0(BlockdevOptionsGluster, 1);
    gconf->debug = qemu_opt_get_number_del(opts, GLUSTER_OPT_DEBUG,
@@ -1002,12 +1026,13 @@ static int qemu_gluster_create(const char *filename,
                          BDRV_SECTOR_SIZE);

    tmp = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
-    prealloc = qapi_enum_parse(PreallocMode_lookup, tmp,
-                               PREALLOC_MODE__MAX, PREALLOC_MODE_OFF,
-                               &local_err);
-    g_free(tmp);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    if (!tmp || !strcmp(tmp, "off")) {
+        prealloc = 0;
+    } else if (!strcmp(tmp, "full") && gluster_supports_zerofill()) {
+        prealloc = 1;
+    } else {
+        error_setg(errp, "Invalid preallocation mode: '%s'"
+                         " or GlusterFS doesn't support zerofill API", tmp);
        ret = -EINVAL;
        goto out;
    }
@@ -1016,48 +1041,21 @@ static int qemu_gluster_create(const char *filename,
                    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR);
    if (!fd) {
        ret = -errno;
-        goto out;
-    }
-
-    switch (prealloc) {
-#ifdef CONFIG_GLUSTERFS_FALLOCATE
-    case PREALLOC_MODE_FALLOC:
-        if (glfs_fallocate(fd, 0, 0, total_size)) {
-            error_setg(errp, "Could not preallocate data for the new file");
-            ret = -errno;
-        }
-        break;
-#endif /* CONFIG_GLUSTERFS_FALLOCATE */
-#ifdef CONFIG_GLUSTERFS_ZEROFILL
-    case PREALLOC_MODE_FULL:
+    } else {
        if (!glfs_ftruncate(fd, total_size)) {
-            if (glfs_zerofill(fd, 0, total_size)) {
-                error_setg(errp, "Could not zerofill the new file");
+            if (prealloc && qemu_gluster_zerofill(fd, 0, total_size)) {
                ret = -errno;
            }
        } else {
-            error_setg(errp, "Could not resize file");
            ret = -errno;
        }
-        break;
-#endif /* CONFIG_GLUSTERFS_ZEROFILL */
-    case PREALLOC_MODE_OFF:
-        if (glfs_ftruncate(fd, total_size) != 0) {
-            ret = -errno;
-            error_setg(errp, "Could not resize file");
-        }
-        break;
-    default:
-        ret = -EINVAL;
-        error_setg(errp, "Unsupported preallocation mode: %s",
-                   PreallocMode_lookup[prealloc]);
-        break;
-    }

-    if (glfs_close(fd) != 0) {
-        ret = -errno;
+        if (glfs_close(fd) != 0) {
+            ret = -errno;
+        }
    }
 out:
+    g_free(tmp);
    qapi_free_BlockdevOptionsGluster(gconf);
    glfs_clear_preopened(glfs);
    return ret;
@@ -1094,23 +1092,14 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
    return acb.ret;
 }

-static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset,
-                                 PreallocMode prealloc, Error **errp)
+static int qemu_gluster_truncate(BlockDriverState *bs, int64_t offset)
 {
    int ret;
    BDRVGlusterState *s = bs->opaque;

-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
    ret = glfs_ftruncate(s->fd, offset);
    if (ret < 0) {
-        ret = -errno;
-        error_setg_errno(errp, -ret, "Failed to truncate file");
-        return ret;
+        return -errno;
    }

    return 0;
@@ -1283,14 +1272,7 @@ static int find_allocation(BlockDriverState *bs, off_t start,
    if (offs < 0) {
        return -errno;          /* D3 or D4 */
    }
-
-    if (offs < start) {
-        /* This is not a valid return by lseek().  We are safe to just return
-         * -EIO in this case, and we'll treat it like D4. Unfortunately some
-         *  versions of gluster server will return offs < start, so an assert
-         *  here will unnecessarily abort QEMU. */
-        return -EIO;
-    }
+    assert(offs >= start);

    if (offs > start) {
        /* D2: in hole, next data at offs */
@@ -1322,14 +1304,7 @@ static int find_allocation(BlockDriverState *bs, off_t start,
    if (offs < 0) {
        return -errno;          /* D1 and (H3 or H4) */
    }
-
-    if (offs < start) {
-        /* This is not a valid return by lseek().  We are safe to just return
-         * -EIO in this case, and we'll treat it like H4. Unfortunately some
-         *  versions of gluster server will return offs < start, so an assert
-         *  here will unnecessarily abort QEMU. */
-        return -EIO;
-    }
+    assert(offs >= start);

    if (offs > start) {
        /*
@@ -26,7 +26,6 @@
 #include "trace.h"
 #include "sysemu/block-backend.h"
 #include "block/blockjob.h"
-#include "block/blockjob_int.h"
 #include "block/block_int.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
@@ -34,8 +33,16 @@

 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */

+static BlockAIOCB *bdrv_co_aio_prw_vector(BdrvChild *child,
+                                          int64_t offset,
+                                          QEMUIOVector *qiov,
+                                          BdrvRequestFlags flags,
+                                          BlockCompletionFunc *cb,
+                                          void *opaque,
+                                          bool is_write);
+static void coroutine_fn bdrv_co_do_rw(void *opaque);
 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-    int64_t offset, int bytes, BdrvRequestFlags flags);
+    int64_t offset, int count, BdrvRequestFlags flags);

 void bdrv_parent_drained_begin(BlockDriverState *bs)
 {
@@ -122,13 +129,13 @@ void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
 */
 void bdrv_enable_copy_on_read(BlockDriverState *bs)
 {
-    atomic_inc(&bs->copy_on_read);
+    bs->copy_on_read++;
 }

 void bdrv_disable_copy_on_read(BlockDriverState *bs)
 {
-    int old = atomic_fetch_dec(&bs->copy_on_read);
-    assert(old >= 1);
+    assert(bs->copy_on_read > 0);
+    bs->copy_on_read--;
 }

 /* Check if any requests are in-flight (including throttled requests) */
@@ -149,37 +156,6 @@ bool bdrv_requests_pending(BlockDriverState *bs)
    return false;
 }

-typedef struct {
-    Coroutine *co;
-    BlockDriverState *bs;
-    bool done;
-} BdrvCoDrainData;
-
-static void coroutine_fn bdrv_drain_invoke_entry(void *opaque)
-{
-    BdrvCoDrainData *data = opaque;
-    BlockDriverState *bs = data->bs;
-
-    bs->drv->bdrv_co_drain(bs);
-
-    /* Set data->done before reading bs->wakeup.  */
-    atomic_mb_set(&data->done, true);
-    bdrv_wakeup(bs);
-}
-
-static void bdrv_drain_invoke(BlockDriverState *bs)
-{
-    BdrvCoDrainData data = { .bs = bs, .done = false };
-
-    if (!bs->drv || !bs->drv->bdrv_co_drain) {
-        return;
-    }
-
-    data.co = qemu_coroutine_create(bdrv_drain_invoke_entry, &data);
-    bdrv_coroutine_enter(bs, data.co);
-    BDRV_POLL_WHILE(bs, !data.done);
-}
-
 static bool bdrv_drain_recurse(BlockDriverState *bs)
 {
    BdrvChild *child, *tmp;
@@ -187,8 +163,9 @@ static bool bdrv_drain_recurse(BlockDriverState *bs)

    waited = BDRV_POLL_WHILE(bs, atomic_read(&bs->in_flight) > 0);

-    /* Ensure any pending metadata writes are submitted to bs->file.  */
-    bdrv_drain_invoke(bs);
+    if (bs->drv && bs->drv->bdrv_drain) {
+        bs->drv->bdrv_drain(bs);
+    }

    QLIST_FOREACH_SAFE(child, &bs->children, next, tmp) {
        BlockDriverState *bs = child->bs;
@@ -214,6 +191,12 @@ static bool bdrv_drain_recurse(BlockDriverState *bs)
    return waited;
 }

+typedef struct {
+    Coroutine *co;
+    BlockDriverState *bs;
+    bool done;
+} BdrvCoDrainData;
+
 static void bdrv_co_drain_bh_cb(void *opaque)
 {
    BdrvCoDrainData *data = opaque;
@@ -257,7 +240,7 @@ void bdrv_drained_begin(BlockDriverState *bs)
        return;
    }

-    if (atomic_fetch_inc(&bs->quiesce_counter) == 0) {
+    if (!bs->quiesce_counter++) {
        aio_disable_external(bdrv_get_aio_context(bs));
        bdrv_parent_drained_begin(bs);
    }
@@ -268,7 +251,7 @@ void bdrv_drained_begin(BlockDriverState *bs)
 void bdrv_drained_end(BlockDriverState *bs)
 {
    assert(bs->quiesce_counter > 0);
-    if (atomic_fetch_dec(&bs->quiesce_counter) > 1) {
+    if (--bs->quiesce_counter > 0) {
        return;
    }

@@ -318,9 +301,16 @@ void bdrv_drain_all_begin(void)
    bool waited = true;
    BlockDriverState *bs;
    BdrvNextIterator it;
+    BlockJob *job = NULL;
    GSList *aio_ctxs = NULL, *ctx;

-    block_job_pause_all();
+    while ((job = block_job_next(job))) {
+        AioContext *aio_context = blk_get_aio_context(job->blk);
+
+        aio_context_acquire(aio_context);
+        block_job_pause(job);
+        aio_context_release(aio_context);
+    }

    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
        AioContext *aio_context = bdrv_get_aio_context(bs);
@@ -364,6 +354,7 @@ void bdrv_drain_all_end(void)
 {
    BlockDriverState *bs;
    BdrvNextIterator it;
+    BlockJob *job = NULL;

    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
        AioContext *aio_context = bdrv_get_aio_context(bs);
@@ -374,7 +365,13 @@ void bdrv_drain_all_end(void)
        aio_context_release(aio_context);
    }

-    block_job_resume_all();
+    while ((job = block_job_next(job))) {
+        AioContext *aio_context = blk_get_aio_context(job->blk);
+
+        aio_context_acquire(aio_context);
+        block_job_resume(job);
+        aio_context_release(aio_context);
+    }
 }

 void bdrv_drain_all(void)
@@ -391,13 +388,11 @@ void bdrv_drain_all(void)
 static void tracked_request_end(BdrvTrackedRequest *req)
 {
    if (req->serialising) {
-        atomic_dec(&req->bs->serialising_in_flight);
+        req->bs->serialising_in_flight--;
    }

-    qemu_co_mutex_lock(&req->bs->reqs_lock);
    QLIST_REMOVE(req, list);
    qemu_co_queue_restart_all(&req->wait_queue);
-    qemu_co_mutex_unlock(&req->bs->reqs_lock);
 }

 /**
@@ -422,9 +417,7 @@ static void tracked_request_begin(BdrvTrackedRequest *req,

    qemu_co_queue_init(&req->wait_queue);

-    qemu_co_mutex_lock(&bs->reqs_lock);
    QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);
-    qemu_co_mutex_unlock(&bs->reqs_lock);
 }

 static void mark_request_serialising(BdrvTrackedRequest *req, uint64_t align)
@@ -434,7 +427,7 @@ static void mark_request_serialising(BdrvTrackedRequest *req, uint64_t align)
                               - overlap_offset;

    if (!req->serialising) {
-        atomic_inc(&req->bs->serialising_in_flight);
+        req->bs->serialising_in_flight++;
        req->serialising = true;
    }

@@ -442,6 +435,27 @@ static void mark_request_serialising(BdrvTrackedRequest *req, uint64_t align)
    req->overlap_bytes = MAX(req->overlap_bytes, overlap_bytes);
 }

+/**
+ * Round a region to cluster boundaries (sector-based)
+ */
+void bdrv_round_sectors_to_clusters(BlockDriverState *bs,
+                                    int64_t sector_num, int nb_sectors,
+                                    int64_t *cluster_sector_num,
+                                    int *cluster_nb_sectors)
+{
+    BlockDriverInfo bdi;
+
+    if (bdrv_get_info(bs, &bdi) < 0 || bdi.cluster_size == 0) {
+        *cluster_sector_num = sector_num;
+        *cluster_nb_sectors = nb_sectors;
+    } else {
+        int64_t c = bdi.cluster_size / BDRV_SECTOR_SIZE;
+        *cluster_sector_num = QEMU_ALIGN_DOWN(sector_num, c);
+        *cluster_nb_sectors = QEMU_ALIGN_UP(sector_num - *cluster_sector_num +
+                                            nb_sectors, c);
+    }
+}
+
 /**
 * Round a region to cluster boundaries
 */
@@ -500,8 +514,7 @@ static void dummy_bh_cb(void *opaque)

 void bdrv_wakeup(BlockDriverState *bs)
 {
-    /* The barrier (or an atomic op) is in the caller.  */
-    if (atomic_read(&bs->wakeup)) {
+    if (bs->wakeup) {
        aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
    }
 }
@@ -519,13 +532,12 @@ static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
    bool retry;
    bool waited = false;

-    if (!atomic_read(&bs->serialising_in_flight)) {
+    if (!bs->serialising_in_flight) {
        return false;
    }

    do {
        retry = false;
-        qemu_co_mutex_lock(&bs->reqs_lock);
        QLIST_FOREACH(req, &bs->tracked_requests, list) {
            if (req == self || (!req->serialising && !self->serialising)) {
                continue;
@@ -544,7 +556,7 @@ static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
                 * (instead of producing a deadlock in the former case). */
                if (!req->waiting_for) {
                    self->waiting_for = req;
-                    qemu_co_queue_wait(&req->wait_queue, &bs->reqs_lock);
+                    qemu_co_queue_wait(&req->wait_queue, NULL);
                    self->waiting_for = NULL;
                    retry = true;
                    waited = true;
@@ -552,7 +564,6 @@ static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
                }
            }
        }
-        qemu_co_mutex_unlock(&bs->reqs_lock);
    } while (retry);

    return waited;
@@ -669,12 +680,12 @@ int bdrv_write(BdrvChild *child, int64_t sector_num,
 }

 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
-                       int bytes, BdrvRequestFlags flags)
+                       int count, BdrvRequestFlags flags)
 {
    QEMUIOVector qiov;
    struct iovec iov = {
        .iov_base = NULL,
-        .iov_len = bytes,
+        .iov_len = count,
    };

    qemu_iovec_init_external(&qiov, &iov, 1);
@@ -1057,18 +1068,17 @@ static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
    }

    if (flags & BDRV_REQ_COPY_ON_READ) {
-        /* TODO: Simplify further once bdrv_is_allocated no longer
-         * requires sector alignment */
-        int64_t start = QEMU_ALIGN_DOWN(offset, BDRV_SECTOR_SIZE);
-        int64_t end = QEMU_ALIGN_UP(offset + bytes, BDRV_SECTOR_SIZE);
-        int64_t pnum;
+        int64_t start_sector = offset >> BDRV_SECTOR_BITS;
+        int64_t end_sector = DIV_ROUND_UP(offset + bytes, BDRV_SECTOR_SIZE);
+        unsigned int nb_sectors = end_sector - start_sector;
+        int pnum;

-        ret = bdrv_is_allocated(bs, start, end - start, &pnum);
+        ret = bdrv_is_allocated(bs, start_sector, nb_sectors, &pnum);
        if (ret < 0) {
            goto out;
        }

-        if (!ret || pnum != end - start) {
+        if (!ret || pnum != nb_sectors) {
            ret = bdrv_co_do_copy_on_readv(child, offset, bytes, qiov);
            goto out;
        }
@@ -1135,8 +1145,6 @@ int coroutine_fn bdrv_co_preadv(BdrvChild *child,
    bool use_local_qiov = false;
    int ret;

-    trace_bdrv_co_preadv(child->bs, offset, bytes, flags);
-
    if (!drv) {
        return -ENOMEDIUM;
    }
@@ -1149,7 +1157,7 @@ int coroutine_fn bdrv_co_preadv(BdrvChild *child,
    bdrv_inc_in_flight(bs);

    /* Don't do copy-on-read if we read data before write operation */
-    if (atomic_read(&bs->copy_on_read) && !(flags & BDRV_REQ_NO_SERIALISING)) {
+    if (bs->copy_on_read && !(flags & BDRV_REQ_NO_SERIALISING)) {
        flags |= BDRV_REQ_COPY_ON_READ;
    }

@@ -1209,6 +1217,8 @@ static int coroutine_fn bdrv_co_do_readv(BdrvChild *child,
 int coroutine_fn bdrv_co_readv(BdrvChild *child, int64_t sector_num,
                               int nb_sectors, QEMUIOVector *qiov)
 {
+    trace_bdrv_co_readv(child->bs, sector_num, nb_sectors);
+
    return bdrv_co_do_readv(child, sector_num, nb_sectors, qiov, 0);
 }

@@ -1216,7 +1226,7 @@ int coroutine_fn bdrv_co_readv(BdrvChild *child, int64_t sector_num,
 #define MAX_WRITE_ZEROES_BOUNCE_BUFFER (32768 << BDRV_SECTOR_BITS)

 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-    int64_t offset, int bytes, BdrvRequestFlags flags)
+    int64_t offset, int count, BdrvRequestFlags flags)
 {
    BlockDriver *drv = bs->drv;
    QEMUIOVector qiov;
@@ -1234,12 +1244,12 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,

    assert(alignment % bs->bl.request_alignment == 0);
    head = offset % alignment;
-    tail = (offset + bytes) % alignment;
+    tail = (offset + count) % alignment;
    max_write_zeroes = QEMU_ALIGN_DOWN(max_write_zeroes, alignment);
    assert(max_write_zeroes >= bs->bl.request_alignment);

-    while (bytes > 0 && !ret) {
-        int num = bytes;
+    while (count > 0 && !ret) {
+        int num = count;

        /* Align request.  Block drivers can expect the "bulk" of the request
         * to be aligned, and that unaligned requests do not cross cluster
@@ -1249,7 +1259,7 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
            /* Make a small request up to the first aligned sector. For
             * convenience, limit this request to max_transfer even if
             * we don't need to fall back to writes.  */
-            num = MIN(MIN(bytes, max_transfer), alignment - head);
+            num = MIN(MIN(count, max_transfer), alignment - head);
            head = (head + num) % alignment;
            assert(num < max_write_zeroes);
        } else if (tail && num > alignment) {
@@ -1310,7 +1320,7 @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
        }

        offset += num;
-        bytes -= num;
+        count -= num;
    }

 fail:
@@ -1339,10 +1349,6 @@ static int coroutine_fn bdrv_aligned_pwritev(BdrvChild *child,
    uint64_t bytes_remaining = bytes;
    int max_transfer;

-    if (bdrv_has_readonly_bitmaps(bs)) {
-        return -EPERM;
-    }
-
    assert(is_power_of_2(align));
    assert((offset & (align - 1)) == 0);
    assert((bytes & (align - 1)) == 0);
@@ -1356,8 +1362,16 @@ static int coroutine_fn bdrv_aligned_pwritev(BdrvChild *child,
    assert(!waited || !req->serialising);
    assert(req->overlap_offset <= offset);
    assert(offset + bytes <= req->overlap_offset + req->overlap_bytes);
-    assert(child->perm & BLK_PERM_WRITE);
-    assert(end_sector <= bs->total_sectors || child->perm & BLK_PERM_RESIZE);
+    /* FIXME: Block migration uses the BlockBackend of the guest device at a
+     *        point when it has not yet taken write permissions. This will be
+     *        fixed by a future patch, but for now we have to bypass this
+     *        assertion for block migration to work. */
+    // assert(child->perm & BLK_PERM_WRITE);
+    /* FIXME: Because of the above, we also cannot guarantee that all format
+     *        BDS take the BLK_PERM_RESIZE permission on their file BDS, since
+     *        they are not obligated to do so if they do not have any parent
+     *        that has taken the permission to write to them. */
+    // assert(end_sector <= bs->total_sectors || child->perm & BLK_PERM_RESIZE);

    ret = notifier_with_return_list_notify(&bs->before_write_notifiers, req);

@@ -1408,10 +1422,12 @@ static int coroutine_fn bdrv_aligned_pwritev(BdrvChild *child,
    }
    bdrv_debug_event(bs, BLKDBG_PWRITEV_DONE);

-    atomic_inc(&bs->write_gen);
+    ++bs->write_gen;
    bdrv_set_dirty(bs, start_sector, end_sector - start_sector);

-    stat64_max(&bs->wr_highest_offset, offset + bytes);
+    if (bs->wr_highest_offset < offset + bytes) {
+        bs->wr_highest_offset = offset + bytes;
+    }

    if (ret >= 0) {
        bs->total_sectors = MAX(bs->total_sectors, end_sector);
@@ -1436,7 +1452,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
    int ret = 0;

    head_padding_bytes = offset & (align - 1);
-    tail_padding_bytes = (align - (offset + bytes)) & (align - 1);
+    tail_padding_bytes = align - ((offset + bytes) & (align - 1));


    assert(flags & BDRV_REQ_ZERO_WRITE);
@@ -1526,8 +1542,6 @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
    bool use_local_qiov = false;
    int ret;

-    trace_bdrv_co_pwritev(child->bs, offset, bytes, flags);
-
    if (!bs->drv) {
        return -ENOMEDIUM;
    }
@@ -1662,19 +1676,21 @@ static int coroutine_fn bdrv_co_do_writev(BdrvChild *child,
 int coroutine_fn bdrv_co_writev(BdrvChild *child, int64_t sector_num,
    int nb_sectors, QEMUIOVector *qiov)
 {
+    trace_bdrv_co_writev(child->bs, sector_num, nb_sectors);
+
    return bdrv_co_do_writev(child, sector_num, nb_sectors, qiov, 0);
 }

 int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset,
-                                       int bytes, BdrvRequestFlags flags)
+                                       int count, BdrvRequestFlags flags)
 {
-    trace_bdrv_co_pwrite_zeroes(child->bs, offset, bytes, flags);
+    trace_bdrv_co_pwrite_zeroes(child->bs, offset, count, flags);

    if (!(child->bs->open_flags & BDRV_O_UNMAP)) {
        flags &= ~BDRV_REQ_MAY_UNMAP;
    }

-    return bdrv_co_pwritev(child, offset, bytes, NULL,
+    return bdrv_co_pwritev(child, offset, count, NULL,
                           BDRV_REQ_ZERO_WRITE | flags);
 }

@@ -1719,16 +1735,15 @@ typedef struct BdrvCoGetBlockStatusData {
 * Drivers not implementing the functionality are assumed to not support
 * backing files, hence all their sectors are reported as allocated.
 *
- * If 'sector_num' is beyond the end of the disk image the return value is
- * BDRV_BLOCK_EOF and 'pnum' is set to 0.
+ * If 'sector_num' is beyond the end of the disk image the return value is 0
+ * and 'pnum' is set to 0.
 *
 * 'pnum' is set to the number of sectors (including and immediately following
 * the specified sector) that are known to be in the same
 * allocated/unallocated state.
 *
 * 'nb_sectors' is the max value 'pnum' should be set to.  If nb_sectors goes
- * beyond the end of the disk image it will be clamped; if 'pnum' is set to
- * the end of the image, then the returned value will include BDRV_BLOCK_EOF.
+ * beyond the end of the disk image it will be clamped.
 *
 * If returned value is positive and BDRV_BLOCK_OFFSET_VALID bit is set, 'file'
 * points to the BDS which the sector range is allocated in.
@@ -1750,7 +1765,7 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,

    if (sector_num >= total_sectors) {
        *pnum = 0;
-        return BDRV_BLOCK_EOF;
+        return 0;
    }

    n = total_sectors - sector_num;
@@ -1761,9 +1776,6 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
    if (!bs->drv->bdrv_co_get_block_status) {
        *pnum = nb_sectors;
        ret = BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED;
-        if (sector_num + nb_sectors == total_sectors) {
-            ret |= BDRV_BLOCK_EOF;
-        }
        if (bs->drv->protocol_name) {
            ret |= BDRV_BLOCK_OFFSET_VALID | (sector_num * BDRV_SECTOR_SIZE);
            *file = bs;
@@ -1812,13 +1824,10 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
            /* Ignore errors.  This is just providing extra information, it
             * is useful but not necessary.
             */
-            if (ret2 & BDRV_BLOCK_EOF &&
-                (!file_pnum || ret2 & BDRV_BLOCK_ZERO)) {
-                /*
-                 * It is valid for the format block driver to read
-                 * beyond the end of the underlying file's current
-                 * size; such areas read as zero.
-                 */
+            if (!file_pnum) {
+                /* !file_pnum indicates an offset at or beyond the EOF; it is
+                 * perfectly valid for the format block driver to point to such
+                 * offsets, so catch it and mark everything as zero */
                ret |= BDRV_BLOCK_ZERO;
            } else {
                /* Limit request to the range reported by the protocol driver */
@@ -1830,9 +1839,6 @@ static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,

 out:
    bdrv_dec_in_flight(bs);
-    if (ret >= 0 && sector_num + *pnum == total_sectors) {
-        ret |= BDRV_BLOCK_EOF;
-    }
    return ret;
 }

@@ -1845,30 +1851,16 @@ static int64_t coroutine_fn bdrv_co_get_block_status_above(BlockDriverState *bs,
 {
    BlockDriverState *p;
    int64_t ret = 0;
-    bool first = true;

    assert(bs != base);
    for (p = bs; p != base; p = backing_bs(p)) {
        ret = bdrv_co_get_block_status(p, sector_num, nb_sectors, pnum, file);
-        if (ret < 0) {
-            break;
-        }
-        if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {
-            /*
-             * Reading beyond the end of the file continues to read
-             * zeroes, but we can only widen the result to the
-             * unallocated length we learned from an earlier
-             * iteration.
-             */
-            *pnum = nb_sectors;
-        }
-        if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) {
+        if (ret < 0 || ret & BDRV_BLOCK_ALLOCATED) {
            break;
        }
        /* [sector_num, pnum] unallocated on this layer, which could be only
         * the first part of [sector_num, nb_sectors].  */
        nb_sectors = MIN(nb_sectors, *pnum);
-        first = false;
    }
    return ret;
 }
@@ -1929,72 +1921,59 @@ int64_t bdrv_get_block_status(BlockDriverState *bs,
                                       sector_num, nb_sectors, pnum, file);
 }

-int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset,
-                                   int64_t bytes, int64_t *pnum)
+int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num,
+                                   int nb_sectors, int *pnum)
 {
    BlockDriverState *file;
-    int64_t sector_num = offset >> BDRV_SECTOR_BITS;
-    int nb_sectors = bytes >> BDRV_SECTOR_BITS;
-    int64_t ret;
-    int psectors;
-
-    assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
-    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE) && bytes < INT_MAX);
-    ret = bdrv_get_block_status(bs, sector_num, nb_sectors, &psectors,
-                                &file);
+    int64_t ret = bdrv_get_block_status(bs, sector_num, nb_sectors, pnum,
+                                        &file);
    if (ret < 0) {
        return ret;
    }
-    if (pnum) {
-        *pnum = psectors * BDRV_SECTOR_SIZE;
-    }
    return !!(ret & BDRV_BLOCK_ALLOCATED);
 }

 /*
 * Given an image chain: ... -> [BASE] -> [INTER1] -> [INTER2] -> [TOP]
 *
- * Return true if (a prefix of) the given range is allocated in any image
- * between BASE and TOP (inclusive).  BASE can be NULL to check if the given
- * offset is allocated in any image of the chain.  Return false otherwise,
- * or negative errno on failure.
+ * Return true if the given sector is allocated in any image between
+ * BASE and TOP (inclusive).  BASE can be NULL to check if the given
+ * sector is allocated in any image of the chain.  Return false otherwise.
 *
- * 'pnum' is set to the number of bytes (including and immediately
- * following the specified offset) that are known to be in the same
- * allocated/unallocated state.  Note that a subsequent call starting
- * at 'offset + *pnum' may return the same allocation status (in other
- * words, the result is not necessarily the maximum possible range);
- * but 'pnum' will only be 0 when end of file is reached.
+ * 'pnum' is set to the number of sectors (including and immediately following
+ *  the specified sector) that are known to be in the same
+ *  allocated/unallocated state.
 *
 */
 int bdrv_is_allocated_above(BlockDriverState *top,
                            BlockDriverState *base,
-                            int64_t offset, int64_t bytes, int64_t *pnum)
+                            int64_t sector_num,
+                            int nb_sectors, int *pnum)
 {
    BlockDriverState *intermediate;
-    int ret;
-    int64_t n = bytes;
+    int ret, n = nb_sectors;

    intermediate = top;
    while (intermediate && intermediate != base) {
-        int64_t pnum_inter;
-        int64_t size_inter;
-
-        ret = bdrv_is_allocated(intermediate, offset, bytes, &pnum_inter);
+        int pnum_inter;
+        ret = bdrv_is_allocated(intermediate, sector_num, nb_sectors,
+                                &pnum_inter);
        if (ret < 0) {
            return ret;
-        }
-        if (ret) {
+        } else if (ret) {
            *pnum = pnum_inter;
            return 1;
        }

-        size_inter = bdrv_getlength(intermediate);
-        if (size_inter < 0) {
-            return size_inter;
-        }
+        /*
+         * [sector_num, nb_sectors] is unallocated on top but intermediate
+         * might have
+         *
+         * [sector_num+x, nr_sectors] allocated.
+         */
        if (n > pnum_inter &&
-            (intermediate == top || offset + pnum_inter < size_inter)) {
+            (intermediate == top ||
+             sector_num + pnum_inter < intermediate->total_sectors)) {
            n = pnum_inter;
        }

@@ -2018,24 +1997,17 @@ bdrv_co_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
                   bool is_read)
 {
    BlockDriver *drv = bs->drv;
-    int ret = -ENOTSUP;
-
-    bdrv_inc_in_flight(bs);

    if (!drv) {
-        ret = -ENOMEDIUM;
+        return -ENOMEDIUM;
    } else if (drv->bdrv_load_vmstate) {
-        if (is_read) {
-            ret = drv->bdrv_load_vmstate(bs, qiov, pos);
-        } else {
-            ret = drv->bdrv_save_vmstate(bs, qiov, pos);
-        }
+        return is_read ? drv->bdrv_load_vmstate(bs, qiov, pos)
+                       : drv->bdrv_save_vmstate(bs, qiov, pos);
    } else if (bs->file) {
-        ret = bdrv_co_rw_vmstate(bs->file->bs, qiov, pos, is_read);
+        return bdrv_co_rw_vmstate(bs->file->bs, qiov, pos, is_read);
    }

-    bdrv_dec_in_flight(bs);
-    return ret;
+    return -ENOTSUP;
 }

 static void coroutine_fn bdrv_co_rw_vmstate_entry(void *opaque)
@@ -2061,7 +2033,9 @@ bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
        Coroutine *co = qemu_coroutine_create(bdrv_co_rw_vmstate_entry, &data);

        bdrv_coroutine_enter(bs, co);
-        BDRV_POLL_WHILE(bs, data.ret == -EINPROGRESS);
+        while (data.ret == -EINPROGRESS) {
+            aio_poll(bdrv_get_aio_context(bs), true);
+        }
        return data.ret;
    }
 }
@@ -2118,6 +2092,28 @@ int bdrv_readv_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
 /**************************************************************/
 /* async I/Os */

+BlockAIOCB *bdrv_aio_readv(BdrvChild *child, int64_t sector_num,
+                           QEMUIOVector *qiov, int nb_sectors,
+                           BlockCompletionFunc *cb, void *opaque)
+{
+    trace_bdrv_aio_readv(child->bs, sector_num, nb_sectors, opaque);
+
+    assert(nb_sectors << BDRV_SECTOR_BITS == qiov->size);
+    return bdrv_co_aio_prw_vector(child, sector_num << BDRV_SECTOR_BITS, qiov,
+                                  0, cb, opaque, false);
+}
+
+BlockAIOCB *bdrv_aio_writev(BdrvChild *child, int64_t sector_num,
+                            QEMUIOVector *qiov, int nb_sectors,
+                            BlockCompletionFunc *cb, void *opaque)
+{
+    trace_bdrv_aio_writev(child->bs, sector_num, nb_sectors, opaque);
+
+    assert(nb_sectors << BDRV_SECTOR_BITS == qiov->size);
+    return bdrv_co_aio_prw_vector(child, sector_num << BDRV_SECTOR_BITS, qiov,
+                                  0, cb, opaque, true);
+}
+
 void bdrv_aio_cancel(BlockAIOCB *acb)
 {
    qemu_aio_ref(acb);
@@ -2149,6 +2145,147 @@ void bdrv_aio_cancel_async(BlockAIOCB *acb)
    }
 }

+/**************************************************************/
+/* async block device emulation */
+
+typedef struct BlockRequest {
+    union {
+        /* Used during read, write, trim */
+        struct {
+            int64_t offset;
+            int bytes;
+            int flags;
+            QEMUIOVector *qiov;
+        };
+        /* Used during ioctl */
+        struct {
+            int req;
+            void *buf;
+        };
+    };
+    BlockCompletionFunc *cb;
+    void *opaque;
+
+    int error;
+} BlockRequest;
+
+typedef struct BlockAIOCBCoroutine {
+    BlockAIOCB common;
+    BdrvChild *child;
+    BlockRequest req;
+    bool is_write;
+    bool need_bh;
+    bool *done;
+} BlockAIOCBCoroutine;
+
+static const AIOCBInfo bdrv_em_co_aiocb_info = {
+    .aiocb_size         = sizeof(BlockAIOCBCoroutine),
+};
+
+static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
+{
+    if (!acb->need_bh) {
+        bdrv_dec_in_flight(acb->common.bs);
+        acb->common.cb(acb->common.opaque, acb->req.error);
+        qemu_aio_unref(acb);
+    }
+}
+
+static void bdrv_co_em_bh(void *opaque)
+{
+    BlockAIOCBCoroutine *acb = opaque;
+
+    assert(!acb->need_bh);
+    bdrv_co_complete(acb);
+}
+
+static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
+{
+    acb->need_bh = false;
+    if (acb->req.error != -EINPROGRESS) {
+        BlockDriverState *bs = acb->common.bs;
+
+        aio_bh_schedule_oneshot(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);
+    }
+}
+
+/* Invoke bdrv_co_do_readv/bdrv_co_do_writev */
+static void coroutine_fn bdrv_co_do_rw(void *opaque)
+{
+    BlockAIOCBCoroutine *acb = opaque;
+
+    if (!acb->is_write) {
+        acb->req.error = bdrv_co_preadv(acb->child, acb->req.offset,
+            acb->req.qiov->size, acb->req.qiov, acb->req.flags);
+    } else {
+        acb->req.error = bdrv_co_pwritev(acb->child, acb->req.offset,
+            acb->req.qiov->size, acb->req.qiov, acb->req.flags);
+    }
+
+    bdrv_co_complete(acb);
+}
+
+static BlockAIOCB *bdrv_co_aio_prw_vector(BdrvChild *child,
+                                          int64_t offset,
+                                          QEMUIOVector *qiov,
+                                          BdrvRequestFlags flags,
+                                          BlockCompletionFunc *cb,
+                                          void *opaque,
+                                          bool is_write)
+{
+    Coroutine *co;
+    BlockAIOCBCoroutine *acb;
+
+    /* Matched by bdrv_co_complete's bdrv_dec_in_flight.  */
+    bdrv_inc_in_flight(child->bs);
+
+    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, child->bs, cb, opaque);
+    acb->child = child;
+    acb->need_bh = true;
+    acb->req.error = -EINPROGRESS;
+    acb->req.offset = offset;
+    acb->req.qiov = qiov;
+    acb->req.flags = flags;
+    acb->is_write = is_write;
+
+    co = qemu_coroutine_create(bdrv_co_do_rw, acb);
+    bdrv_coroutine_enter(child->bs, co);
+
+    bdrv_co_maybe_schedule_bh(acb);
+    return &acb->common;
+}
+
+static void coroutine_fn bdrv_aio_flush_co_entry(void *opaque)
+{
+    BlockAIOCBCoroutine *acb = opaque;
+    BlockDriverState *bs = acb->common.bs;
+
+    acb->req.error = bdrv_co_flush(bs);
+    bdrv_co_complete(acb);
+}
+
+BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
+        BlockCompletionFunc *cb, void *opaque)
+{
+    trace_bdrv_aio_flush(bs, opaque);
+
+    Coroutine *co;
+    BlockAIOCBCoroutine *acb;
+
+    /* Matched by bdrv_co_complete's bdrv_dec_in_flight.  */
+    bdrv_inc_in_flight(bs);
+
+    acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
+    acb->need_bh = true;
+    acb->req.error = -EINPROGRESS;
+
+    co = qemu_coroutine_create(bdrv_aio_flush_co_entry, acb);
+    bdrv_coroutine_enter(bs, co);
+
+    bdrv_co_maybe_schedule_bh(acb);
+    return &acb->common;
+}
+
 /**************************************************************/
 /* Coroutine block device emulation */

@@ -2172,22 +2309,19 @@ int coroutine_fn bdrv_co_flush(BlockDriverState *bs)

    bdrv_inc_in_flight(bs);

-    if (!bdrv_is_inserted(bs) || bdrv_is_read_only(bs) ||
+    if (!bs || !bdrv_is_inserted(bs) || bdrv_is_read_only(bs) ||
        bdrv_is_sg(bs)) {
        goto early_exit;
    }

-    qemu_co_mutex_lock(&bs->reqs_lock);
-    current_gen = atomic_read(&bs->write_gen);
+    current_gen = bs->write_gen;

    /* Wait until any previous flushes are completed */
    while (bs->active_flush_req) {
-        qemu_co_queue_wait(&bs->flush_queue, &bs->reqs_lock);
+        qemu_co_queue_wait(&bs->flush_queue, NULL);
    }

-    /* Flushes reach this point in nondecreasing current_gen order.  */
    bs->active_flush_req = true;
-    qemu_co_mutex_unlock(&bs->reqs_lock);

    /* Write back all layers by calling one driver function */
    if (bs->drv->bdrv_co_flush) {
@@ -2259,12 +2393,9 @@ out:
    if (ret == 0) {
        bs->flushed_gen = current_gen;
    }
-
-    qemu_co_mutex_lock(&bs->reqs_lock);
    bs->active_flush_req = false;
    /* Return value is ignored - it's ok if wait queue is empty */
    qemu_co_queue_next(&bs->flush_queue);
-    qemu_co_mutex_unlock(&bs->reqs_lock);

 early_exit:
    bdrv_dec_in_flight(bs);
@@ -2294,18 +2425,18 @@ int bdrv_flush(BlockDriverState *bs)
 typedef struct DiscardCo {
    BlockDriverState *bs;
    int64_t offset;
-    int bytes;
+    int count;
    int ret;
 } DiscardCo;
 static void coroutine_fn bdrv_pdiscard_co_entry(void *opaque)
 {
    DiscardCo *rwco = opaque;

-    rwco->ret = bdrv_co_pdiscard(rwco->bs, rwco->offset, rwco->bytes);
+    rwco->ret = bdrv_co_pdiscard(rwco->bs, rwco->offset, rwco->count);
 }

 int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
-                                  int bytes)
+                                  int count)
 {
    BdrvTrackedRequest req;
    int max_pdiscard, ret;
@@ -2315,11 +2446,7 @@ int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
        return -ENOMEDIUM;
    }

-    if (bdrv_has_readonly_bitmaps(bs)) {
-        return -EPERM;
-    }
-
-    ret = bdrv_check_byte_request(bs, offset, bytes);
+    ret = bdrv_check_byte_request(bs, offset, count);
    if (ret < 0) {
        return ret;
    } else if (bs->read_only) {
@@ -2344,10 +2471,10 @@ int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
    align = MAX(bs->bl.pdiscard_alignment, bs->bl.request_alignment);
    assert(align % bs->bl.request_alignment == 0);
    head = offset % align;
-    tail = (offset + bytes) % align;
+    tail = (offset + count) % align;

    bdrv_inc_in_flight(bs);
-    tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_DISCARD);
+    tracked_request_begin(&req, bs, offset, count, BDRV_TRACKED_DISCARD);

    ret = notifier_with_return_list_notify(&bs->before_write_notifiers, &req);
    if (ret < 0) {
@@ -2358,12 +2485,13 @@ int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
                                   align);
    assert(max_pdiscard >= bs->bl.request_alignment);

-    while (bytes > 0) {
-        int num = bytes;
+    while (count > 0) {
+        int ret;
+        int num = count;

        if (head) {
            /* Make small requests to get to alignment boundaries. */
-            num = MIN(bytes, align - head);
+            num = MIN(count, align - head);
            if (!QEMU_IS_ALIGNED(num, bs->bl.request_alignment)) {
                num %= bs->bl.request_alignment;
            }
@@ -2407,11 +2535,11 @@ int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset,
        }

        offset += num;
-        bytes -= num;
+        count -= num;
    }
    ret = 0;
 out:
-    atomic_inc(&bs->write_gen);
+    ++bs->write_gen;
    bdrv_set_dirty(bs, req.offset >> BDRV_SECTOR_BITS,
                   req.bytes >> BDRV_SECTOR_BITS);
    tracked_request_end(&req);
@@ -2419,13 +2547,13 @@ out:
    return ret;
 }

-int bdrv_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
+int bdrv_pdiscard(BlockDriverState *bs, int64_t offset, int count)
 {
    Coroutine *co;
    DiscardCo rwco = {
        .bs = bs,
        .offset = offset,
-        .bytes = bytes,
+        .count = count,
        .ret = NOT_DONE,
    };

@@ -2538,7 +2666,7 @@ void bdrv_io_plug(BlockDriverState *bs)
        bdrv_io_plug(child->bs);
    }

-    if (atomic_fetch_inc(&bs->io_plugged) == 0) {
+    if (bs->io_plugged++ == 0) {
        BlockDriver *drv = bs->drv;
        if (drv && drv->bdrv_io_plug) {
            drv->bdrv_io_plug(bs);
@@ -2551,7 +2679,7 @@ void bdrv_io_unplug(BlockDriverState *bs)
    BdrvChild *child;

    assert(bs->io_plugged);
-    if (atomic_fetch_dec(&bs->io_plugged) == 1) {
+    if (--bs->io_plugged == 0) {
        BlockDriver *drv = bs->drv;
        if (drv && drv->bdrv_io_unplug) {
            drv->bdrv_io_unplug(bs);
@@ -1116,14 +1116,14 @@ iscsi_getlength(BlockDriverState *bs)
 }

 static int
-coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
+coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
 {
    IscsiLun *iscsilun = bs->opaque;
    struct IscsiTask iTask;
    struct unmap_list list;
    int r = 0;

-    if (!is_byte_request_lun_aligned(offset, bytes, iscsilun)) {
+    if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
        return -ENOTSUP;
    }

@@ -1133,7 +1133,7 @@ coroutine_fn iscsi_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
    }

    list.lba = offset / iscsilun->block_size;
-    list.num = bytes / iscsilun->block_size;
+    list.num = count / iscsilun->block_size;

    iscsi_co_init_iscsitask(iscsilun, &iTask);
    qemu_mutex_lock(&iscsilun->mutex);
@@ -1174,7 +1174,7 @@ retry:
    }

    iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
-                               bytes >> BDRV_SECTOR_BITS);
+                               count >> BDRV_SECTOR_BITS);

 out_unlock:
    qemu_mutex_unlock(&iscsilun->mutex);
@@ -1183,7 +1183,7 @@ out_unlock:

 static int
 coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-                                    int bytes, BdrvRequestFlags flags)
+                                    int count, BdrvRequestFlags flags)
 {
    IscsiLun *iscsilun = bs->opaque;
    struct IscsiTask iTask;
@@ -1192,7 +1192,7 @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
    bool use_16_for_ws = iscsilun->use_16_for_rw;
    int r = 0;

-    if (!is_byte_request_lun_aligned(offset, bytes, iscsilun)) {
+    if (!is_byte_request_lun_aligned(offset, count, iscsilun)) {
        return -ENOTSUP;
    }

@@ -1215,7 +1215,7 @@ coroutine_fn iscsi_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
    }

    lba = offset / iscsilun->block_size;
-    nb_blocks = bytes / iscsilun->block_size;
+    nb_blocks = count / iscsilun->block_size;

    if (iscsilun->zeroblock == NULL) {
        iscsilun->zeroblock = g_try_malloc0(iscsilun->block_size);
@@ -1273,17 +1273,17 @@ retry:

    if (iTask.status != SCSI_STATUS_GOOD) {
        iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
-                                   bytes >> BDRV_SECTOR_BITS);
+                                   count >> BDRV_SECTOR_BITS);
        r = iTask.err_code;
        goto out_unlock;
    }

    if (flags & BDRV_REQ_MAY_UNMAP) {
        iscsi_allocmap_set_invalid(iscsilun, offset >> BDRV_SECTOR_BITS,
-                                   bytes >> BDRV_SECTOR_BITS);
+                                   count >> BDRV_SECTOR_BITS);
    } else {
        iscsi_allocmap_set_allocated(iscsilun, offset >> BDRV_SECTOR_BITS,
-                                     bytes >> BDRV_SECTOR_BITS);
+                                     count >> BDRV_SECTOR_BITS);
    }

 out_unlock:
@@ -1732,10 +1732,6 @@ static QemuOptsList runtime_opts = {
            .name = "timeout",
            .type = QEMU_OPT_NUMBER,
        },
-        {
-            .name = "filename",
-            .type = QEMU_OPT_STRING,
-        },
        { /* end of list */ }
    },
 };
@@ -1751,27 +1747,12 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
    char *initiator_name = NULL;
    QemuOpts *opts;
    Error *local_err = NULL;
-    const char *transport_name, *portal, *target, *filename;
+    const char *transport_name, *portal, *target;
 #if LIBISCSI_API_VERSION >= (20160603)
    enum iscsi_transport_type transport;
 #endif
    int i, ret = 0, timeout = 0, lun;

-    /* If we are given a filename, parse the filename, with precedence given to
-     * filename encoded options */
-    filename = qdict_get_try_str(options, "filename");
-    if (filename) {
-        warn_report("'filename' option specified. "
-                    "This is an unsupported option, and may be deprecated "
-                    "in the future");
-        iscsi_parse_filename(filename, options, &local_err);
-        if (local_err) {
-            ret = -EINVAL;
-            error_propagate(errp, local_err);
-            goto exit;
-        }
-    }
-
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
@@ -1986,7 +1967,6 @@ out:
        }
        memset(iscsilun, 0, sizeof(IscsiLun));
    }
-exit:
    return ret;
 }

@@ -2079,31 +2059,22 @@ static void iscsi_reopen_commit(BDRVReopenState *reopen_state)
    }
 }

-static int iscsi_truncate(BlockDriverState *bs, int64_t offset,
-                          PreallocMode prealloc, Error **errp)
+static int iscsi_truncate(BlockDriverState *bs, int64_t offset)
 {
    IscsiLun *iscsilun = bs->opaque;
    Error *local_err = NULL;

-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
    if (iscsilun->type != TYPE_DISK) {
-        error_setg(errp, "Cannot resize non-disk iSCSI devices");
        return -ENOTSUP;
    }

    iscsi_readcapacity_sync(iscsilun, &local_err);
    if (local_err != NULL) {
-        error_propagate(errp, local_err);
+        error_free(local_err);
        return -EIO;
    }

    if (offset > iscsi_getlength(bs)) {
-        error_setg(errp, "Cannot grow iSCSI devices");
        return -EINVAL;
    }

@@ -24,8 +24,9 @@

 #define SLICE_TIME    100000000ULL /* ns */
 #define MAX_IN_FLIGHT 16
-#define MAX_IO_BYTES (1 << 20) /* 1 Mb */
-#define DEFAULT_MIRROR_BUF_SIZE (MAX_IN_FLIGHT * MAX_IO_BYTES)
+#define MAX_IO_SECTORS ((1 << 20) >> BDRV_SECTOR_BITS) /* 1 Mb */
+#define DEFAULT_MIRROR_BUF_SIZE \
+    (MAX_IN_FLIGHT * MAX_IO_SECTORS * BDRV_SECTOR_SIZE)

 /* The mirroring buffer is a list of granularity-sized chunks.
 * Free chunks are organized in a list.
@@ -66,11 +67,11 @@ typedef struct MirrorBlockJob {
    uint64_t last_pause_ns;
    unsigned long *in_flight_bitmap;
    int in_flight;
-    int64_t bytes_in_flight;
+    int64_t sectors_in_flight;
    int ret;
    bool unmap;
    bool waiting_for_io;
-    int target_cluster_size;
+    int target_cluster_sectors;
    int max_iov;
    bool initial_zeroing_ongoing;
 } MirrorBlockJob;
@@ -78,8 +79,8 @@ typedef struct MirrorBlockJob {
 typedef struct MirrorOp {
    MirrorBlockJob *s;
    QEMUIOVector qiov;
-    int64_t offset;
-    uint64_t bytes;
+    int64_t sector_num;
+    int nb_sectors;
 } MirrorOp;

 static BlockErrorAction mirror_error_action(MirrorBlockJob *s, bool read,
@@ -100,12 +101,12 @@ static void mirror_iteration_done(MirrorOp *op, int ret)
    MirrorBlockJob *s = op->s;
    struct iovec *iov;
    int64_t chunk_num;
-    int i, nb_chunks;
+    int i, nb_chunks, sectors_per_chunk;

-    trace_mirror_iteration_done(s, op->offset, op->bytes, ret);
+    trace_mirror_iteration_done(s, op->sector_num, op->nb_sectors, ret);

    s->in_flight--;
-    s->bytes_in_flight -= op->bytes;
+    s->sectors_in_flight -= op->nb_sectors;
    iov = op->qiov.iov;
    for (i = 0; i < op->qiov.niov; i++) {
        MirrorBuffer *buf = (MirrorBuffer *) iov[i].iov_base;
@@ -113,15 +114,16 @@ static void mirror_iteration_done(MirrorOp *op, int ret)
        s->buf_free_count++;
    }

-    chunk_num = op->offset / s->granularity;
-    nb_chunks = DIV_ROUND_UP(op->bytes, s->granularity);
+    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
+    chunk_num = op->sector_num / sectors_per_chunk;
+    nb_chunks = DIV_ROUND_UP(op->nb_sectors, sectors_per_chunk);
    bitmap_clear(s->in_flight_bitmap, chunk_num, nb_chunks);
    if (ret >= 0) {
        if (s->cow_bitmap) {
            bitmap_set(s->cow_bitmap, chunk_num, nb_chunks);
        }
        if (!s->initial_zeroing_ongoing) {
-            s->common.offset += op->bytes;
+            s->common.offset += (uint64_t)op->nb_sectors * BDRV_SECTOR_SIZE;
        }
    }
    qemu_iovec_destroy(&op->qiov);
@@ -141,8 +143,7 @@ static void mirror_write_complete(void *opaque, int ret)
    if (ret < 0) {
        BlockErrorAction action;

-        bdrv_set_dirty_bitmap(s->dirty_bitmap, op->offset >> BDRV_SECTOR_BITS,
-                              op->bytes >> BDRV_SECTOR_BITS);
+        bdrv_set_dirty_bitmap(s->dirty_bitmap, op->sector_num, op->nb_sectors);
        action = mirror_error_action(s, false, -ret);
        if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {
            s->ret = ret;
@@ -161,8 +162,7 @@ static void mirror_read_complete(void *opaque, int ret)
    if (ret < 0) {
        BlockErrorAction action;

-        bdrv_set_dirty_bitmap(s->dirty_bitmap, op->offset >> BDRV_SECTOR_BITS,
-                              op->bytes >> BDRV_SECTOR_BITS);
+        bdrv_set_dirty_bitmap(s->dirty_bitmap, op->sector_num, op->nb_sectors);
        action = mirror_error_action(s, true, -ret);
        if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) {
            s->ret = ret;
@@ -170,53 +170,56 @@ static void mirror_read_complete(void *opaque, int ret)

        mirror_iteration_done(op, ret);
    } else {
-        blk_aio_pwritev(s->target, op->offset, &op->qiov,
+        blk_aio_pwritev(s->target, op->sector_num * BDRV_SECTOR_SIZE, &op->qiov,
                        0, mirror_write_complete, op);
    }
    aio_context_release(blk_get_aio_context(s->common.blk));
 }

-/* Clip bytes relative to offset to not exceed end-of-file */
-static inline int64_t mirror_clip_bytes(MirrorBlockJob *s,
-                                        int64_t offset,
-                                        int64_t bytes)
+static inline void mirror_clip_sectors(MirrorBlockJob *s,
+                                       int64_t sector_num,
+                                       int *nb_sectors)
 {
-    return MIN(bytes, s->bdev_length - offset);
+    *nb_sectors = MIN(*nb_sectors,
+                      s->bdev_length / BDRV_SECTOR_SIZE - sector_num);
 }

-/* Round offset and/or bytes to target cluster if COW is needed, and
- * return the offset of the adjusted tail against original. */
-static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
-                            uint64_t *bytes)
+/* Round sector_num and/or nb_sectors to target cluster if COW is needed, and
+ * return the offset of the adjusted tail sector against original. */
+static int mirror_cow_align(MirrorBlockJob *s,
+                            int64_t *sector_num,
+                            int *nb_sectors)
 {
    bool need_cow;
    int ret = 0;
-    int64_t align_offset = *offset;
-    unsigned int align_bytes = *bytes;
-    int max_bytes = s->granularity * s->max_iov;
+    int chunk_sectors = s->granularity >> BDRV_SECTOR_BITS;
+    int64_t align_sector_num = *sector_num;
+    int align_nb_sectors = *nb_sectors;
+    int max_sectors = chunk_sectors * s->max_iov;

-    assert(*bytes < INT_MAX);
-    need_cow = !test_bit(*offset / s->granularity, s->cow_bitmap);
-    need_cow |= !test_bit((*offset + *bytes - 1) / s->granularity,
+    need_cow = !test_bit(*sector_num / chunk_sectors, s->cow_bitmap);
+    need_cow |= !test_bit((*sector_num + *nb_sectors - 1) / chunk_sectors,
                          s->cow_bitmap);
    if (need_cow) {
-        bdrv_round_to_clusters(blk_bs(s->target), *offset, *bytes,
-                               &align_offset, &align_bytes);
+        bdrv_round_sectors_to_clusters(blk_bs(s->target), *sector_num,
+                                       *nb_sectors, &align_sector_num,
+                                       &align_nb_sectors);
    }

-    if (align_bytes > max_bytes) {
-        align_bytes = max_bytes;
+    if (align_nb_sectors > max_sectors) {
+        align_nb_sectors = max_sectors;
        if (need_cow) {
-            align_bytes = QEMU_ALIGN_DOWN(align_bytes, s->target_cluster_size);
+            align_nb_sectors = QEMU_ALIGN_DOWN(align_nb_sectors,
+                                               s->target_cluster_sectors);
        }
    }
-    /* Clipping may result in align_bytes unaligned to chunk boundary, but
+    /* Clipping may result in align_nb_sectors unaligned to chunk boundary, but
     * that doesn't matter because it's already the end of source image. */
-    align_bytes = mirror_clip_bytes(s, align_offset, align_bytes);
+    mirror_clip_sectors(s, align_sector_num, &align_nb_sectors);

-    ret = align_offset + align_bytes - (*offset + *bytes);
-    *offset = align_offset;
-    *bytes = align_bytes;
+    ret = align_sector_num + align_nb_sectors - (*sector_num + *nb_sectors);
+    *sector_num = align_sector_num;
+    *nb_sectors = align_nb_sectors;
    assert(ret >= 0);
    return ret;
 }
@@ -230,51 +233,50 @@ static inline void mirror_wait_for_io(MirrorBlockJob *s)
 }

 /* Submit async read while handling COW.
- * Returns: The number of bytes copied after and including offset,
- *          excluding any bytes copied prior to offset due to alignment.
- *          This will be @bytes if no alignment is necessary, or
- *          (new_end - offset) if tail is rounded up or down due to
+ * Returns: The number of sectors copied after and including sector_num,
+ *          excluding any sectors copied prior to sector_num due to alignment.
+ *          This will be nb_sectors if no alignment is necessary, or
+ *          (new_end - sector_num) if tail is rounded up or down due to
 *          alignment or buffer limit.
 */
-static uint64_t mirror_do_read(MirrorBlockJob *s, int64_t offset,
-                               uint64_t bytes)
+static int mirror_do_read(MirrorBlockJob *s, int64_t sector_num,
+                          int nb_sectors)
 {
    BlockBackend *source = s->common.blk;
-    int nb_chunks;
-    uint64_t ret;
+    int sectors_per_chunk, nb_chunks;
+    int ret;
    MirrorOp *op;
-    uint64_t max_bytes;
+    int max_sectors;

-    max_bytes = s->granularity * s->max_iov;
+    sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
+    max_sectors = sectors_per_chunk * s->max_iov;

    /* We can only handle as much as buf_size at a time. */
-    bytes = MIN(s->buf_size, MIN(max_bytes, bytes));
-    assert(bytes);
-    assert(bytes < BDRV_REQUEST_MAX_BYTES);
-    ret = bytes;
+    nb_sectors = MIN(s->buf_size >> BDRV_SECTOR_BITS, nb_sectors);
+    nb_sectors = MIN(max_sectors, nb_sectors);
+    assert(nb_sectors);
+    ret = nb_sectors;

    if (s->cow_bitmap) {
-        ret += mirror_cow_align(s, &offset, &bytes);
+        ret += mirror_cow_align(s, &sector_num, &nb_sectors);
    }
-    assert(bytes <= s->buf_size);
-    /* The offset is granularity-aligned because:
+    assert(nb_sectors << BDRV_SECTOR_BITS <= s->buf_size);
+    /* The sector range must meet granularity because:
     * 1) Caller passes in aligned values;
     * 2) mirror_cow_align is used only when target cluster is larger. */
-    assert(QEMU_IS_ALIGNED(offset, s->granularity));
-    /* The range is sector-aligned, since bdrv_getlength() rounds up. */
-    assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
-    nb_chunks = DIV_ROUND_UP(bytes, s->granularity);
+    assert(!(sector_num % sectors_per_chunk));
+    nb_chunks = DIV_ROUND_UP(nb_sectors, sectors_per_chunk);

    while (s->buf_free_count < nb_chunks) {
-        trace_mirror_yield_in_flight(s, offset, s->in_flight);
+        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
        mirror_wait_for_io(s);
    }

    /* Allocate a MirrorOp that is used as an AIO callback.  */
    op = g_new(MirrorOp, 1);
    op->s = s;
-    op->offset = offset;
-    op->bytes = bytes;
+    op->sector_num = sector_num;
+    op->nb_sectors = nb_sectors;

    /* Now make a QEMUIOVector taking enough granularity-sized chunks
     * from s->buf_free.
@@ -282,7 +284,7 @@ static uint64_t mirror_do_read(MirrorBlockJob *s, int64_t offset,
    qemu_iovec_init(&op->qiov, nb_chunks);
    while (nb_chunks-- > 0) {
        MirrorBuffer *buf = QSIMPLEQ_FIRST(&s->buf_free);
-        size_t remaining = bytes - op->qiov.size;
+        size_t remaining = nb_sectors * BDRV_SECTOR_SIZE - op->qiov.size;

        QSIMPLEQ_REMOVE_HEAD(&s->buf_free, next);
        s->buf_free_count--;
@@ -291,16 +293,17 @@ static uint64_t mirror_do_read(MirrorBlockJob *s, int64_t offset,

    /* Copy the dirty cluster.  */
    s->in_flight++;
-    s->bytes_in_flight += bytes;
-    trace_mirror_one_iteration(s, offset, bytes);
+    s->sectors_in_flight += nb_sectors;
+    trace_mirror_one_iteration(s, sector_num, nb_sectors);

-    blk_aio_preadv(source, offset, &op->qiov, 0, mirror_read_complete, op);
+    blk_aio_preadv(source, sector_num * BDRV_SECTOR_SIZE, &op->qiov, 0,
+                   mirror_read_complete, op);
    return ret;
 }

 static void mirror_do_zero_or_discard(MirrorBlockJob *s,
-                                      int64_t offset,
-                                      uint64_t bytes,
+                                      int64_t sector_num,
+                                      int nb_sectors,
                                      bool is_discard)
 {
    MirrorOp *op;
@@ -309,17 +312,19 @@ static void mirror_do_zero_or_discard(MirrorBlockJob *s,
     * so the freeing in mirror_iteration_done is nop. */
    op = g_new0(MirrorOp, 1);
    op->s = s;
-    op->offset = offset;
-    op->bytes = bytes;
+    op->sector_num = sector_num;
+    op->nb_sectors = nb_sectors;

    s->in_flight++;
-    s->bytes_in_flight += bytes;
+    s->sectors_in_flight += nb_sectors;
    if (is_discard) {
-        blk_aio_pdiscard(s->target, offset,
-                         op->bytes, mirror_write_complete, op);
+        blk_aio_pdiscard(s->target, sector_num << BDRV_SECTOR_BITS,
+                         op->nb_sectors << BDRV_SECTOR_BITS,
+                         mirror_write_complete, op);
    } else {
-        blk_aio_pwrite_zeroes(s->target, offset,
-                              op->bytes, s->unmap ? BDRV_REQ_MAY_UNMAP : 0,
+        blk_aio_pwrite_zeroes(s->target, sector_num * BDRV_SECTOR_SIZE,
+                              op->nb_sectors * BDRV_SECTOR_SIZE,
+                              s->unmap ? BDRV_REQ_MAY_UNMAP : 0,
                              mirror_write_complete, op);
    }
 }
@@ -327,28 +332,27 @@ static void mirror_do_zero_or_discard(MirrorBlockJob *s,
 static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
 {
    BlockDriverState *source = s->source;
-    int64_t offset, first_chunk;
+    int64_t sector_num, first_chunk;
    uint64_t delay_ns = 0;
    /* At least the first dirty chunk is mirrored in one iteration. */
    int nb_chunks = 1;
+    int64_t end = s->bdev_length / BDRV_SECTOR_SIZE;
    int sectors_per_chunk = s->granularity >> BDRV_SECTOR_BITS;
    bool write_zeroes_ok = bdrv_can_write_zeroes_with_unmap(blk_bs(s->target));
-    int max_io_bytes = MAX(s->buf_size / MAX_IN_FLIGHT, MAX_IO_BYTES);
+    int max_io_sectors = MAX((s->buf_size >> BDRV_SECTOR_BITS) / MAX_IN_FLIGHT,
+                             MAX_IO_SECTORS);

-    bdrv_dirty_bitmap_lock(s->dirty_bitmap);
-    offset = bdrv_dirty_iter_next(s->dbi) * BDRV_SECTOR_SIZE;
-    if (offset < 0) {
+    sector_num = bdrv_dirty_iter_next(s->dbi);
+    if (sector_num < 0) {
        bdrv_set_dirty_iter(s->dbi, 0);
-        offset = bdrv_dirty_iter_next(s->dbi) * BDRV_SECTOR_SIZE;
-        trace_mirror_restart_iter(s, bdrv_get_dirty_count(s->dirty_bitmap) *
-                                  BDRV_SECTOR_SIZE);
-        assert(offset >= 0);
+        sector_num = bdrv_dirty_iter_next(s->dbi);
+        trace_mirror_restart_iter(s, bdrv_get_dirty_count(s->dirty_bitmap));
+        assert(sector_num >= 0);
    }
-    bdrv_dirty_bitmap_unlock(s->dirty_bitmap);

-    first_chunk = offset / s->granularity;
+    first_chunk = sector_num / sectors_per_chunk;
    while (test_bit(first_chunk, s->in_flight_bitmap)) {
-        trace_mirror_yield_in_flight(s, offset, s->in_flight);
+        trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
        mirror_wait_for_io(s);
    }

@@ -356,27 +360,25 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)

    /* Find the number of consective dirty chunks following the first dirty
     * one, and wait for in flight requests in them. */
-    bdrv_dirty_bitmap_lock(s->dirty_bitmap);
-    while (nb_chunks * s->granularity < s->buf_size) {
+    while (nb_chunks * sectors_per_chunk < (s->buf_size >> BDRV_SECTOR_BITS)) {
        int64_t next_dirty;
-        int64_t next_offset = offset + nb_chunks * s->granularity;
-        int64_t next_chunk = next_offset / s->granularity;
-        if (next_offset >= s->bdev_length ||
-            !bdrv_get_dirty_locked(source, s->dirty_bitmap,
-                                   next_offset >> BDRV_SECTOR_BITS)) {
+        int64_t next_sector = sector_num + nb_chunks * sectors_per_chunk;
+        int64_t next_chunk = next_sector / sectors_per_chunk;
+        if (next_sector >= end ||
+            !bdrv_get_dirty(source, s->dirty_bitmap, next_sector)) {
            break;
        }
        if (test_bit(next_chunk, s->in_flight_bitmap)) {
            break;
        }

-        next_dirty = bdrv_dirty_iter_next(s->dbi) * BDRV_SECTOR_SIZE;
-        if (next_dirty > next_offset || next_dirty < 0) {
+        next_dirty = bdrv_dirty_iter_next(s->dbi);
+        if (next_dirty > next_sector || next_dirty < 0) {
            /* The bitmap iterator's cache is stale, refresh it */
-            bdrv_set_dirty_iter(s->dbi, next_offset >> BDRV_SECTOR_BITS);
-            next_dirty = bdrv_dirty_iter_next(s->dbi) * BDRV_SECTOR_SIZE;
+            bdrv_set_dirty_iter(s->dbi, next_sector);
+            next_dirty = bdrv_dirty_iter_next(s->dbi);
        }
-        assert(next_dirty == next_offset);
+        assert(next_dirty == next_sector);
        nb_chunks++;
    }

@@ -384,16 +386,12 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
     * calling bdrv_get_block_status_above could yield - if some blocks are
     * marked dirty in this window, we need to know.
     */
-    bdrv_reset_dirty_bitmap_locked(s->dirty_bitmap, offset >> BDRV_SECTOR_BITS,
-                                   nb_chunks * sectors_per_chunk);
-    bdrv_dirty_bitmap_unlock(s->dirty_bitmap);
-
-    bitmap_set(s->in_flight_bitmap, offset / s->granularity, nb_chunks);
-    while (nb_chunks > 0 && offset < s->bdev_length) {
+    bdrv_reset_dirty_bitmap(s->dirty_bitmap, sector_num,
+                            nb_chunks * sectors_per_chunk);
+    bitmap_set(s->in_flight_bitmap, sector_num / sectors_per_chunk, nb_chunks);
+    while (nb_chunks > 0 && sector_num < end) {
        int64_t ret;
-        int io_sectors;
-        unsigned int io_bytes;
-        int64_t io_bytes_acct;
+        int io_sectors, io_sectors_acct;
        BlockDriverState *file;
        enum MirrorMethod {
            MIRROR_METHOD_COPY,
@@ -401,28 +399,27 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
            MIRROR_METHOD_DISCARD
        } mirror_method = MIRROR_METHOD_COPY;

-        assert(!(offset % s->granularity));
-        ret = bdrv_get_block_status_above(source, NULL,
-                                          offset >> BDRV_SECTOR_BITS,
+        assert(!(sector_num % sectors_per_chunk));
+        ret = bdrv_get_block_status_above(source, NULL, sector_num,
                                          nb_chunks * sectors_per_chunk,
                                          &io_sectors, &file);
-        io_bytes = io_sectors * BDRV_SECTOR_SIZE;
        if (ret < 0) {
-            io_bytes = MIN(nb_chunks * s->granularity, max_io_bytes);
+            io_sectors = MIN(nb_chunks * sectors_per_chunk, max_io_sectors);
        } else if (ret & BDRV_BLOCK_DATA) {
-            io_bytes = MIN(io_bytes, max_io_bytes);
+            io_sectors = MIN(io_sectors, max_io_sectors);
        }

-        io_bytes -= io_bytes % s->granularity;
-        if (io_bytes < s->granularity) {
-            io_bytes = s->granularity;
+        io_sectors -= io_sectors % sectors_per_chunk;
+        if (io_sectors < sectors_per_chunk) {
+            io_sectors = sectors_per_chunk;
        } else if (ret >= 0 && !(ret & BDRV_BLOCK_DATA)) {
-            int64_t target_offset;
-            unsigned int target_bytes;
-            bdrv_round_to_clusters(blk_bs(s->target), offset, io_bytes,
-                                   &target_offset, &target_bytes);
-            if (target_offset == offset &&
-                target_bytes == io_bytes) {
+            int64_t target_sector_num;
+            int target_nb_sectors;
+            bdrv_round_sectors_to_clusters(blk_bs(s->target), sector_num,
+                                           io_sectors,  &target_sector_num,
+                                           &target_nb_sectors);
+            if (target_sector_num == sector_num &&
+                target_nb_sectors == io_sectors) {
                mirror_method = ret & BDRV_BLOCK_ZERO ?
                                    MIRROR_METHOD_ZERO :
                                    MIRROR_METHOD_DISCARD;
@@ -430,7 +427,7 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
        }

        while (s->in_flight >= MAX_IN_FLIGHT) {
-            trace_mirror_yield_in_flight(s, offset, s->in_flight);
+            trace_mirror_yield_in_flight(s, sector_num, s->in_flight);
            mirror_wait_for_io(s);
        }

@@ -438,29 +435,30 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
            return 0;
        }

-        io_bytes = mirror_clip_bytes(s, offset, io_bytes);
+        mirror_clip_sectors(s, sector_num, &io_sectors);
        switch (mirror_method) {
        case MIRROR_METHOD_COPY:
-            io_bytes = io_bytes_acct = mirror_do_read(s, offset, io_bytes);
+            io_sectors = mirror_do_read(s, sector_num, io_sectors);
+            io_sectors_acct = io_sectors;
            break;
        case MIRROR_METHOD_ZERO:
        case MIRROR_METHOD_DISCARD:
-            mirror_do_zero_or_discard(s, offset, io_bytes,
+            mirror_do_zero_or_discard(s, sector_num, io_sectors,
                                      mirror_method == MIRROR_METHOD_DISCARD);
            if (write_zeroes_ok) {
-                io_bytes_acct = 0;
+                io_sectors_acct = 0;
            } else {
-                io_bytes_acct = io_bytes;
+                io_sectors_acct = io_sectors;
            }
            break;
        default:
            abort();
        }
-        assert(io_bytes);
-        offset += io_bytes;
-        nb_chunks -= DIV_ROUND_UP(io_bytes, s->granularity);
+        assert(io_sectors);
+        sector_num += io_sectors;
+        nb_chunks -= DIV_ROUND_UP(io_sectors, sectors_per_chunk);
        if (s->common.speed) {
-            delay_ns = ratelimit_calculate_delay(&s->limit, io_bytes_acct);
+            delay_ns = ratelimit_calculate_delay(&s->limit, io_sectors_acct);
        }
    }
    return delay_ns;
@@ -508,8 +506,6 @@ static void mirror_exit(BlockJob *job, void *opaque)
    BlockDriverState *mirror_top_bs = s->mirror_top_bs;
    Error *local_err = NULL;

-    bdrv_release_dirty_bitmap(src, s->dirty_bitmap);
-
    /* Make sure that the source BDS doesn't go away before we called
     * block_job_completed(). */
    bdrv_ref(src);
@@ -621,7 +617,6 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
    BlockDriverState *bs = s->source;
    BlockDriverState *target_bs = blk_bs(s->target);
    int ret, n;
-    int64_t count;

    end = s->bdev_length / BDRV_SECTOR_SIZE;

@@ -650,8 +645,7 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
                continue;
            }

-            mirror_do_zero_or_discard(s, sector_num * BDRV_SECTOR_SIZE,
-                                      nb_sectors * BDRV_SECTOR_SIZE, false);
+            mirror_do_zero_or_discard(s, sector_num, nb_sectors, false);
            sector_num += nb_sectors;
        }

@@ -671,16 +665,11 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
            return 0;
        }

-        ret = bdrv_is_allocated_above(bs, base, sector_num * BDRV_SECTOR_SIZE,
-                                      nb_sectors * BDRV_SECTOR_SIZE, &count);
+        ret = bdrv_is_allocated_above(bs, base, sector_num, nb_sectors, &n);
        if (ret < 0) {
            return ret;
        }

-        /* TODO: Relax this once bdrv_is_allocated_above and dirty
-         * bitmaps no longer require sector alignment. */
-        assert(QEMU_IS_ALIGNED(count, BDRV_SECTOR_SIZE));
-        n = count >> BDRV_SECTOR_BITS;
        assert(n > 0);
        if (ret == 1) {
            bdrv_set_dirty_bitmap(s->dirty_bitmap, sector_num, n);
@@ -716,6 +705,7 @@ static void coroutine_fn mirror_run(void *opaque)
    char backing_filename[2]; /* we only need 2 characters because we are only
                                 checking for a NULL string */
    int ret = 0;
+    int target_cluster_size = BDRV_SECTOR_SIZE;

    if (block_job_is_cancelled(&s->common)) {
        goto immediate_exit;
@@ -739,8 +729,7 @@ static void coroutine_fn mirror_run(void *opaque)
        }

        if (s->bdev_length > base_length) {
-            ret = blk_truncate(s->target, s->bdev_length, PREALLOC_MODE_OFF,
-                               NULL);
+            ret = blk_truncate(s->target, s->bdev_length, NULL);
            if (ret < 0) {
                goto immediate_exit;
            }
@@ -768,15 +757,14 @@ static void coroutine_fn mirror_run(void *opaque)
    bdrv_get_backing_filename(target_bs, backing_filename,
                              sizeof(backing_filename));
    if (!bdrv_get_info(target_bs, &bdi) && bdi.cluster_size) {
-        s->target_cluster_size = bdi.cluster_size;
-    } else {
-        s->target_cluster_size = BDRV_SECTOR_SIZE;
+        target_cluster_size = bdi.cluster_size;
    }
-    if (backing_filename[0] && !target_bs->backing &&
-        s->granularity < s->target_cluster_size) {
-        s->buf_size = MAX(s->buf_size, s->target_cluster_size);
+    if (backing_filename[0] && !target_bs->backing
+        && s->granularity < target_cluster_size) {
+        s->buf_size = MAX(s->buf_size, target_cluster_size);
        s->cow_bitmap = bitmap_new(length);
    }
+    s->target_cluster_sectors = target_cluster_size >> BDRV_SECTOR_BITS;
    s->max_iov = MIN(bs->bl.max_iov, target_bs->bl.max_iov);

    s->buf = qemu_try_blockalign(bs, s->buf_size);
@@ -812,10 +800,10 @@ static void coroutine_fn mirror_run(void *opaque)
        cnt = bdrv_get_dirty_count(s->dirty_bitmap);
        /* s->common.offset contains the number of bytes already processed so
         * far, cnt is the number of dirty sectors remaining and
-         * s->bytes_in_flight is the number of bytes currently being
+         * s->sectors_in_flight is the number of sectors currently being
         * processed; together those are the current total operation length */
-        s->common.len = s->common.offset + s->bytes_in_flight +
-            cnt * BDRV_SECTOR_SIZE;
+        s->common.len = s->common.offset +
+                        (cnt + s->sectors_in_flight) * BDRV_SECTOR_SIZE;

        /* Note that even when no rate limit is applied we need to yield
         * periodically with no pending I/O so that bdrv_drain_all() returns.
@@ -827,8 +815,7 @@ static void coroutine_fn mirror_run(void *opaque)
            s->common.iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
            if (s->in_flight >= MAX_IN_FLIGHT || s->buf_free_count == 0 ||
                (cnt == 0 && s->in_flight > 0)) {
-                trace_mirror_yield(s, cnt * BDRV_SECTOR_SIZE,
-                                   s->buf_free_count, s->in_flight);
+                trace_mirror_yield(s, cnt, s->buf_free_count, s->in_flight);
                mirror_wait_for_io(s);
                continue;
            } else if (cnt != 0) {
@@ -869,7 +856,7 @@ static void coroutine_fn mirror_run(void *opaque)
             * whether to switch to target check one last time if I/O has
             * come in the meanwhile, and if not flush the data to disk.
             */
-            trace_mirror_before_drain(s, cnt * BDRV_SECTOR_SIZE);
+            trace_mirror_before_drain(s, cnt);

            bdrv_drained_begin(bs);
            cnt = bdrv_get_dirty_count(s->dirty_bitmap);
@@ -888,8 +875,7 @@ static void coroutine_fn mirror_run(void *opaque)
        }

        ret = 0;
-        trace_mirror_before_sleep(s, cnt * BDRV_SECTOR_SIZE,
-                                  s->synced, delay_ns);
+        trace_mirror_before_sleep(s, cnt, s->synced, delay_ns);
        if (!s->synced) {
            block_job_sleep_ns(&s->common, QEMU_CLOCK_REALTIME, delay_ns);
            if (block_job_is_cancelled(&s->common)) {
@@ -918,6 +904,7 @@ immediate_exit:
    g_free(s->cow_bitmap);
    g_free(s->in_flight_bitmap);
    bdrv_dirty_iter_free(s->dbi);
+    bdrv_release_dirty_bitmap(bs, s->dirty_bitmap);

    data = g_malloc(sizeof(*data));
    data->ret = ret;
@@ -936,7 +923,7 @@ static void mirror_set_speed(BlockJob *job, int64_t speed, Error **errp)
        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
-    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }

 static void mirror_complete(BlockJob *job, Error **errp)
@@ -1065,20 +1052,20 @@ static int64_t coroutine_fn bdrv_mirror_top_get_block_status(
 {
    *pnum = nb_sectors;
    *file = bs->backing->bs;
-    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |
           (sector_num << BDRV_SECTOR_BITS);
 }

 static int coroutine_fn bdrv_mirror_top_pwrite_zeroes(BlockDriverState *bs,
-    int64_t offset, int bytes, BdrvRequestFlags flags)
+    int64_t offset, int count, BdrvRequestFlags flags)
 {
-    return bdrv_co_pwrite_zeroes(bs->backing, offset, bytes, flags);
+    return bdrv_co_pwrite_zeroes(bs->backing, offset, count, flags);
 }

 static int coroutine_fn bdrv_mirror_top_pdiscard(BlockDriverState *bs,
-    int64_t offset, int bytes)
+    int64_t offset, int count)
 {
-    return bdrv_co_pdiscard(bs->backing->bs, offset, bytes);
+    return bdrv_co_pdiscard(bs->backing->bs, offset, count);
 }

 static void bdrv_mirror_top_refresh_filename(BlockDriverState *bs, QDict *opts)
@@ -1130,12 +1117,10 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
                             BlockdevOnError on_target_error,
                             bool unmap,
                             BlockCompletionFunc *cb,
-                             void *opaque,
+                             void *opaque, Error **errp,
                             const BlockJobDriver *driver,
                             bool is_none_mode, BlockDriverState *base,
-                             bool auto_complete, const char *filter_node_name,
-                             bool is_mirror,
-                             Error **errp)
+                             bool auto_complete, const char *filter_node_name)
 {
    MirrorBlockJob *s;
    BlockDriverState *mirror_top_bs;
@@ -1149,8 +1134,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
    }

    assert ((granularity & (granularity - 1)) == 0);
-    /* Granularity must be large enough for sector-based dirty bitmap */
-    assert(granularity >= BDRV_SECTOR_SIZE);

    if (buf_size < 0) {
        error_setg(errp, "Invalid parameter 'buf-size'");
@@ -1223,15 +1206,6 @@ static void mirror_start_job(const char *job_id, BlockDriverState *bs,
    if (ret < 0) {
        goto fail;
    }
-    if (is_mirror) {
-        /* XXX: Mirror target could be a NBD server of target QEMU in the case
-         * of non-shared block migration. To allow migration completion, we
-         * have to allow "inactivate" of the target BB.  When that happens, we
-         * know the job is drained, and the vcpus are stopped, so no write
-         * operation will be performed. Block layer already has assertions to
-         * ensure that. */
-        blk_set_force_allow_inactivate(s->target);
-    }

    s->replaces = g_strdup(replaces);
    s->on_source_error = on_source_error;
@@ -1285,7 +1259,7 @@ fail:

        g_free(s->replaces);
        blk_unref(s->target);
-        block_job_early_fail(&s->common);
+        block_job_unref(&s->common);
    }

    bdrv_child_try_set_perm(mirror_top_bs->backing, 0, BLK_PERM_ALL,
@@ -1314,17 +1288,17 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
    base = mode == MIRROR_SYNC_MODE_TOP ? backing_bs(bs) : NULL;
    mirror_start_job(job_id, bs, BLOCK_JOB_DEFAULT, target, replaces,
                     speed, granularity, buf_size, backing_mode,
-                     on_source_error, on_target_error, unmap, NULL, NULL,
+                     on_source_error, on_target_error, unmap, NULL, NULL, errp,
                     &mirror_job_driver, is_none_mode, base, false,
-                     filter_node_name, true, errp);
+                     filter_node_name);
 }

 void commit_active_start(const char *job_id, BlockDriverState *bs,
                         BlockDriverState *base, int creation_flags,
                         int64_t speed, BlockdevOnError on_error,
                         const char *filter_node_name,
-                         BlockCompletionFunc *cb, void *opaque,
-                         bool auto_complete, Error **errp)
+                         BlockCompletionFunc *cb, void *opaque, Error **errp,
+                         bool auto_complete)
 {
    int orig_base_flags;
    Error *local_err = NULL;
@@ -1337,9 +1311,9 @@ void commit_active_start(const char *job_id, BlockDriverState *bs,

    mirror_start_job(job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                     MIRROR_LEAVE_BACKING_CHAIN,
-                     on_error, on_error, true, cb, opaque,
+                     on_error, on_error, true, cb, opaque, &local_err,
                     &commit_active_job_driver, false, base, auto_complete,
-                     filter_node_name, false, &local_err);
+                     filter_node_name);
    if (local_err) {
        error_propagate(errp, local_err);
        goto error_restore_flags;
@@ -28,7 +28,6 @@
 */

 #include "qemu/osdep.h"
-#include "qapi/error.h"
 #include "nbd-client.h"

 #define HANDLE_TO_INDEX(bs, handle) ((handle) ^ ((uint64_t)(intptr_t)bs))
@@ -39,10 +38,8 @@ static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
    int i;

    for (i = 0; i < MAX_NBD_REQUESTS; i++) {
-        NBDClientRequest *req = &s->requests[i];
-
-        if (req->coroutine && req->receiving) {
-            aio_co_wake(req->coroutine);
+        if (s->recv_coroutine[i]) {
+            aio_co_wake(s->recv_coroutine[i]);
        }
    }
 }
@@ -72,15 +69,11 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
 {
    NBDClientSession *s = opaque;
    uint64_t i;
-    int ret = 0;
-    Error *local_err = NULL;
+    int ret;

-    while (!s->quit) {
+    for (;;) {
        assert(s->reply.handle == 0);
-        ret = nbd_receive_reply(s->ioc, &s->reply, &local_err);
-        if (ret < 0) {
-            error_report_err(local_err);
-        }
+        ret = nbd_receive_reply(s->ioc, &s->reply);
        if (ret <= 0) {
            break;
        }
@@ -90,28 +83,25 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
         * one coroutine is called until the reply finishes.
         */
        i = HANDLE_TO_INDEX(s, s->reply.handle);
-        if (i >= MAX_NBD_REQUESTS ||
-            !s->requests[i].coroutine ||
-            !s->requests[i].receiving) {
+        if (i >= MAX_NBD_REQUESTS || !s->recv_coroutine[i]) {
            break;
        }

-        /* We're woken up again by the request itself.  Note that there
+        /* We're woken up by the recv_coroutine itself.  Note that there
         * is no race between yielding and reentering read_reply_co.  This
         * is because:
         *
-         * - if the request runs on the same AioContext, it is only
+         * - if recv_coroutine[i] runs on the same AioContext, it is only
         *   entered after we yield
         *
-         * - if the request runs on a different AioContext, reentering
+         * - if recv_coroutine[i] runs on a different AioContext, reentering
         *   read_reply_co happens through a bottom half, which can only
         *   run after we yield.
         */
-        aio_co_wake(s->requests[i].coroutine);
+        aio_co_wake(s->recv_coroutine[i]);
        qemu_coroutine_yield();
    }

-    s->quit = true;
    nbd_recv_coroutines_enter_all(s);
    s->read_reply_co = NULL;
 }
@@ -124,29 +114,18 @@ static int nbd_co_send_request(BlockDriverState *bs,
    int rc, ret, i;

    qemu_co_mutex_lock(&s->send_mutex);
-    while (s->in_flight == MAX_NBD_REQUESTS) {
-        qemu_co_queue_wait(&s->free_sema, &s->send_mutex);
-    }
-    s->in_flight++;

    for (i = 0; i < MAX_NBD_REQUESTS; i++) {
-        if (s->requests[i].coroutine == NULL) {
+        if (s->recv_coroutine[i] == NULL) {
+            s->recv_coroutine[i] = qemu_coroutine_self();
            break;
        }
    }

    g_assert(qemu_in_coroutine());
    assert(i < MAX_NBD_REQUESTS);
-
-    s->requests[i].coroutine = qemu_coroutine_self();
-    s->requests[i].receiving = false;
-
    request->handle = INDEX_TO_HANDLE(s, i);

-    if (s->quit) {
-        qemu_co_mutex_unlock(&s->send_mutex);
-        return -EIO;
-    }
    if (!s->ioc) {
        qemu_co_mutex_unlock(&s->send_mutex);
        return -EPIPE;
@@ -155,9 +134,9 @@ static int nbd_co_send_request(BlockDriverState *bs,
    if (qiov) {
        qio_channel_set_cork(s->ioc, true);
        rc = nbd_send_request(s->ioc, request);
-        if (rc >= 0 && !s->quit) {
-            ret = nbd_rwv(s->ioc, qiov->iov, qiov->niov, request->len, false,
-                          NULL);
+        if (rc >= 0) {
+            ret = nbd_wr_syncv(s->ioc, qiov->iov, qiov->niov, request->len,
+                               false);
            if (ret != request->len) {
                rc = -EIO;
            }
@@ -166,9 +145,6 @@ static int nbd_co_send_request(BlockDriverState *bs,
    } else {
        rc = nbd_send_request(s->ioc, request);
    }
-    if (rc < 0) {
-        s->quit = true;
-    }
    qemu_co_mutex_unlock(&s->send_mutex);
    return rc;
 }
@@ -178,23 +154,20 @@ static void nbd_co_receive_reply(NBDClientSession *s,
                                 NBDReply *reply,
                                 QEMUIOVector *qiov)
 {
-    int i = HANDLE_TO_INDEX(s, request->handle);
    int ret;

    /* Wait until we're woken up by nbd_read_reply_entry.  */
-    s->requests[i].receiving = true;
    qemu_coroutine_yield();
-    s->requests[i].receiving = false;
    *reply = s->reply;
-    if (reply->handle != request->handle || !s->ioc || s->quit) {
+    if (reply->handle != request->handle ||
+        !s->ioc) {
        reply->error = EIO;
    } else {
        if (qiov && reply->error == 0) {
-            ret = nbd_rwv(s->ioc, qiov->iov, qiov->niov, request->len, true,
-                          NULL);
+            ret = nbd_wr_syncv(s->ioc, qiov->iov, qiov->niov, request->len,
+                               true);
            if (ret != request->len) {
                reply->error = EIO;
-                s->quit = true;
            }
        }

@@ -203,23 +176,34 @@ static void nbd_co_receive_reply(NBDClientSession *s,
    }
 }

+static void nbd_coroutine_start(NBDClientSession *s,
+                                NBDRequest *request)
+{
+    /* Poor man semaphore.  The free_sema is locked when no other request
+     * can be accepted, and unlocked after receiving one reply.  */
+    if (s->in_flight == MAX_NBD_REQUESTS) {
+        qemu_co_queue_wait(&s->free_sema, NULL);
+        assert(s->in_flight < MAX_NBD_REQUESTS);
+    }
+    s->in_flight++;
+
+    /* s->recv_coroutine[i] is set as soon as we get the send_lock.  */
+}
+
 static void nbd_coroutine_end(BlockDriverState *bs,
                              NBDRequest *request)
 {
    NBDClientSession *s = nbd_get_client_session(bs);
    int i = HANDLE_TO_INDEX(s, request->handle);

-    s->requests[i].coroutine = NULL;
+    s->recv_coroutine[i] = NULL;
+    s->in_flight--;
+    qemu_co_queue_next(&s->free_sema);

    /* Kick the read_reply_co to get the next reply.  */
    if (s->read_reply_co) {
        aio_co_wake(s->read_reply_co);
    }
-
-    qemu_co_mutex_lock(&s->send_mutex);
-    s->in_flight--;
-    qemu_co_queue_next(&s->free_sema);
-    qemu_co_mutex_unlock(&s->send_mutex);
 }

 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
@@ -237,6 +221,7 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
    assert(bytes <= NBD_MAX_BUFFER_SIZE);
    assert(!flags);

+    nbd_coroutine_start(client, &request);
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
        reply.error = -ret;
@@ -260,12 +245,13 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
    ssize_t ret;

    if (flags & BDRV_REQ_FUA) {
-        assert(client->info.flags & NBD_FLAG_SEND_FUA);
+        assert(client->nbdflags & NBD_FLAG_SEND_FUA);
        request.flags |= NBD_CMD_FLAG_FUA;
    }

    assert(bytes <= NBD_MAX_BUFFER_SIZE);

+    nbd_coroutine_start(client, &request);
    ret = nbd_co_send_request(bs, &request, qiov);
    if (ret < 0) {
        reply.error = -ret;
@@ -277,29 +263,30 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
 }

 int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-                                int bytes, BdrvRequestFlags flags)
+                                int count, BdrvRequestFlags flags)
 {
    ssize_t ret;
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
        .type = NBD_CMD_WRITE_ZEROES,
        .from = offset,
-        .len = bytes,
+        .len = count,
    };
    NBDReply reply;

-    if (!(client->info.flags & NBD_FLAG_SEND_WRITE_ZEROES)) {
+    if (!(client->nbdflags & NBD_FLAG_SEND_WRITE_ZEROES)) {
        return -ENOTSUP;
    }

    if (flags & BDRV_REQ_FUA) {
-        assert(client->info.flags & NBD_FLAG_SEND_FUA);
+        assert(client->nbdflags & NBD_FLAG_SEND_FUA);
        request.flags |= NBD_CMD_FLAG_FUA;
    }
    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
        request.flags |= NBD_CMD_FLAG_NO_HOLE;
    }

+    nbd_coroutine_start(client, &request);
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
        reply.error = -ret;
@@ -317,13 +304,14 @@ int nbd_client_co_flush(BlockDriverState *bs)
    NBDReply reply;
    ssize_t ret;

-    if (!(client->info.flags & NBD_FLAG_SEND_FLUSH)) {
+    if (!(client->nbdflags & NBD_FLAG_SEND_FLUSH)) {
        return 0;
    }

    request.from = 0;
    request.len = 0;

+    nbd_coroutine_start(client, &request);
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
        reply.error = -ret;
@@ -334,21 +322,22 @@ int nbd_client_co_flush(BlockDriverState *bs)
    return -reply.error;
 }

-int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes)
+int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
 {
    NBDClientSession *client = nbd_get_client_session(bs);
    NBDRequest request = {
        .type = NBD_CMD_TRIM,
        .from = offset,
-        .len = bytes,
+        .len = count,
    };
    NBDReply reply;
    ssize_t ret;

-    if (!(client->info.flags & NBD_FLAG_SEND_TRIM)) {
+    if (!(client->nbdflags & NBD_FLAG_SEND_TRIM)) {
        return 0;
    }

+    nbd_coroutine_start(client, &request);
    ret = nbd_co_send_request(bs, &request, NULL);
    if (ret < 0) {
        reply.error = -ret;
@@ -402,24 +391,22 @@ int nbd_client_init(BlockDriverState *bs,
    logout("session init %s\n", export);
    qio_channel_set_blocking(QIO_CHANNEL(sioc), true, NULL);

-    client->info.request_sizes = true;
    ret = nbd_receive_negotiate(QIO_CHANNEL(sioc), export,
+                                &client->nbdflags,
                                tlscreds, hostname,
-                                &client->ioc, &client->info, errp);
+                                &client->ioc,
+                                &client->size, errp);
    if (ret < 0) {
        logout("Failed to negotiate with the NBD server\n");
        return ret;
    }
-    if (client->info.flags & NBD_FLAG_SEND_FUA) {
+    if (client->nbdflags & NBD_FLAG_SEND_FUA) {
        bs->supported_write_flags = BDRV_REQ_FUA;
        bs->supported_zero_flags |= BDRV_REQ_FUA;
    }
-    if (client->info.flags & NBD_FLAG_SEND_WRITE_ZEROES) {
+    if (client->nbdflags & NBD_FLAG_SEND_WRITE_ZEROES) {
        bs->supported_zero_flags |= BDRV_REQ_MAY_UNMAP;
    }
-    if (client->info.min_block > bs->bl.request_alignment) {
-        bs->bl.request_alignment = client->info.min_block;
-    }

    qemu_co_mutex_init(&client->send_mutex);
    qemu_co_queue_init(&client->free_sema);
@@ -17,24 +17,19 @@

 #define MAX_NBD_REQUESTS    16

-typedef struct {
-    Coroutine *coroutine;
-    bool receiving;         /* waiting for read_reply_co? */
-} NBDClientRequest;
-
 typedef struct NBDClientSession {
    QIOChannelSocket *sioc; /* The master data channel */
    QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
-    NBDExportInfo info;
+    uint16_t nbdflags;
+    off_t size;

    CoMutex send_mutex;
    CoQueue free_sema;
    Coroutine *read_reply_co;
    int in_flight;

-    NBDClientRequest requests[MAX_NBD_REQUESTS];
+    Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
    NBDReply reply;
-    bool quit;
 } NBDClientSession;

 NBDClientSession *nbd_get_client_session(BlockDriverState *bs);
@@ -47,12 +42,12 @@ int nbd_client_init(BlockDriverState *bs,
                    Error **errp);
 void nbd_client_close(BlockDriverState *bs);

-int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes);
+int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count);
 int nbd_client_co_flush(BlockDriverState *bs);
 int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
                          uint64_t bytes, QEMUIOVector *qiov, int flags);
 int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-                                int bytes, BdrvRequestFlags flags);
+                                int count, BdrvRequestFlags flags);
 int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
                         uint64_t bytes, QEMUIOVector *qiov, int flags);

@@ -37,6 +37,7 @@
 #include "qapi/qobject-output-visitor.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qjson.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
 #include "qemu/cutils.h"

@@ -46,7 +47,7 @@ typedef struct BDRVNBDState {
    NBDClientSession client;

    /* For nbd_refresh_filename() */
-    SocketAddress *saddr;
+    SocketAddressFlat *saddr;
    char *export, *tlscredsid;
 } BDRVNBDState;

@@ -197,16 +198,16 @@ static void nbd_parse_filename(const char *filename, QDict *options,
        qdict_put_str(options, "server.type", "unix");
        qdict_put_str(options, "server.path", unixpath);
    } else {
-        InetSocketAddress *addr = g_new(InetSocketAddress, 1);
+        InetSocketAddress *addr = NULL;

-        if (inet_parse(addr, host_spec, errp)) {
-            goto out_inet;
+        addr = inet_parse(host_spec, errp);
+        if (!addr) {
+            goto out;
        }

        qdict_put_str(options, "server.type", "inet");
        qdict_put_str(options, "server.host", addr->host);
        qdict_put_str(options, "server.port", addr->port);
-    out_inet:
        qapi_free_InetSocketAddress(addr);
    }

@@ -257,10 +258,10 @@ static bool nbd_process_legacy_socket_options(QDict *output_options,
    return true;
 }

-static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
-                                 Error **errp)
+static SocketAddressFlat *nbd_config(BDRVNBDState *s, QDict *options,
+                                     Error **errp)
 {
-    SocketAddress *saddr = NULL;
+    SocketAddressFlat *saddr = NULL;
    QDict *addr = NULL;
    QObject *crumpled_addr = NULL;
    Visitor *iv = NULL;
@@ -286,7 +287,7 @@ static SocketAddress *nbd_config(BDRVNBDState *s, QDict *options,
     * visitor expects the former.
     */
    iv = qobject_input_visitor_new(crumpled_addr);
-    visit_type_SocketAddress(iv, NULL, &saddr, &local_err);
+    visit_type_SocketAddressFlat(iv, NULL, &saddr, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto done;
@@ -305,9 +306,10 @@ NBDClientSession *nbd_get_client_session(BlockDriverState *bs)
    return &s->client;
 }

-static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
+static QIOChannelSocket *nbd_establish_connection(SocketAddressFlat *saddr_flat,
                                                  Error **errp)
 {
+    SocketAddress *saddr = socket_address_crumple(saddr_flat);
    QIOChannelSocket *sioc;
    Error *local_err = NULL;

@@ -317,6 +319,7 @@ static QIOChannelSocket *nbd_establish_connection(SocketAddress *saddr,
    qio_channel_socket_connect_sync(sioc,
                                    saddr,
                                    &local_err);
+    qapi_free_SocketAddress(saddr);
    if (local_err) {
        object_unref(OBJECT(sioc));
        error_propagate(errp, local_err);
@@ -409,7 +412,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        goto error;
    }

-    /* Translate @host, @port, and @path to a SocketAddress */
+    /* Translate @host, @port, and @path to a SocketAddressFlat */
    if (!nbd_process_legacy_socket_options(options, opts, errp)) {
        goto error;
    }
@@ -430,7 +433,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        }

        /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
-        if (s->saddr->type != SOCKET_ADDRESS_TYPE_INET) {
+        if (s->saddr->type != SOCKET_ADDRESS_FLAT_TYPE_INET) {
            error_setg(errp, "TLS only supported over IP sockets");
            goto error;
        }
@@ -457,7 +460,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
        object_unref(OBJECT(tlscreds));
    }
    if (ret < 0) {
-        qapi_free_SocketAddress(s->saddr);
+        qapi_free_SocketAddressFlat(s->saddr);
        g_free(s->export);
        g_free(s->tlscredsid);
    }
@@ -472,17 +475,9 @@ static int nbd_co_flush(BlockDriverState *bs)

 static void nbd_refresh_limits(BlockDriverState *bs, Error **errp)
 {
-    NBDClientSession *s = nbd_get_client_session(bs);
-    uint32_t max = MIN_NON_ZERO(NBD_MAX_BUFFER_SIZE, s->info.max_block);
-
-    bs->bl.max_pdiscard = max;
-    bs->bl.max_pwrite_zeroes = max;
-    bs->bl.max_transfer = max;
-
-    if (s->info.opt_block &&
-        s->info.opt_block > bs->bl.opt_transfer) {
-        bs->bl.opt_transfer = s->info.opt_block;
-    }
+    bs->bl.max_pdiscard = NBD_MAX_BUFFER_SIZE;
+    bs->bl.max_pwrite_zeroes = NBD_MAX_BUFFER_SIZE;
+    bs->bl.max_transfer = NBD_MAX_BUFFER_SIZE;
 }

 static void nbd_close(BlockDriverState *bs)
@@ -491,7 +486,7 @@ static void nbd_close(BlockDriverState *bs)

    nbd_client_close(bs);

-    qapi_free_SocketAddress(s->saddr);
+    qapi_free_SocketAddressFlat(s->saddr);
    g_free(s->export);
    g_free(s->tlscredsid);
 }
@@ -500,7 +495,7 @@ static int64_t nbd_getlength(BlockDriverState *bs)
 {
    BDRVNBDState *s = bs->opaque;

-    return s->client.info.size;
+    return s->client.size;
 }

 static void nbd_detach_aio_context(BlockDriverState *bs)
@@ -522,13 +517,13 @@ static void nbd_refresh_filename(BlockDriverState *bs, QDict *options)
    Visitor *ov;
    const char *host = NULL, *port = NULL, *path = NULL;

-    if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
+    if (s->saddr->type == SOCKET_ADDRESS_FLAT_TYPE_INET) {
        const InetSocketAddress *inet = &s->saddr->u.inet;
        if (!inet->has_ipv4 && !inet->has_ipv6 && !inet->has_to) {
            host = inet->host;
            port = inet->port;
        }
-    } else if (s->saddr->type == SOCKET_ADDRESS_TYPE_UNIX) {
+    } else if (s->saddr->type == SOCKET_ADDRESS_FLAT_TYPE_UNIX) {
        path = s->saddr->u.q_unix.path;
    } /* else can't represent as pseudo-filename */

@@ -549,7 +544,7 @@ static void nbd_refresh_filename(BlockDriverState *bs, QDict *options)
    }

    ov = qobject_output_visitor_new(&saddr_qdict);
-    visit_type_SocketAddress(ov, NULL, &s->saddr, &error_abort);
+    visit_type_SocketAddressFlat(ov, NULL, &s->saddr, &error_abort);
    visit_complete(ov, &saddr_qdict);
    visit_free(ov);
    qdict_put_obj(opts, "server", saddr_qdict);
@@ -36,6 +36,7 @@
 #include "qemu/cutils.h"
 #include "sysemu/sysemu.h"
 #include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
 #include "qapi-visit.h"
 #include "qapi/qobject-input-visitor.h"
@@ -494,7 +495,7 @@ out:


 static int64_t nfs_client_open(NFSClient *client, QDict *options,
-                               int flags, int open_flags, Error **errp)
+                               int flags, Error **errp, int open_flags)
 {
    int ret = -EINVAL;
    QemuOpts *opts = NULL;
@@ -563,8 +564,8 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options,
        }
        client->readahead = qemu_opt_get_number(opts, "readahead-size", 0);
        if (client->readahead > QEMU_NFS_MAX_READAHEAD_SIZE) {
-            warn_report("Truncating NFS readahead size to %d",
-                        QEMU_NFS_MAX_READAHEAD_SIZE);
+            error_report("NFS Warning: Truncating NFS readahead "
+                         "size to %d", QEMU_NFS_MAX_READAHEAD_SIZE);
            client->readahead = QEMU_NFS_MAX_READAHEAD_SIZE;
        }
        nfs_set_readahead(client->context, client->readahead);
@@ -584,8 +585,8 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options,
        }
        client->pagecache = qemu_opt_get_number(opts, "page-cache-size", 0);
        if (client->pagecache > QEMU_NFS_MAX_PAGECACHE_SIZE) {
-            warn_report("Truncating NFS pagecache size to %d pages",
-                        QEMU_NFS_MAX_PAGECACHE_SIZE);
+            error_report("NFS Warning: Truncating NFS pagecache "
+                         "size to %d pages", QEMU_NFS_MAX_PAGECACHE_SIZE);
            client->pagecache = QEMU_NFS_MAX_PAGECACHE_SIZE;
        }
        nfs_set_pagecache(client->context, client->pagecache);
@@ -600,8 +601,8 @@ static int64_t nfs_client_open(NFSClient *client, QDict *options,
        /* limit the maximum debug level to avoid potential flooding
         * of our log files. */
        if (client->debug > QEMU_NFS_MAX_DEBUG_LEVEL) {
-            warn_report("Limiting NFS debug level to %d",
-                        QEMU_NFS_MAX_DEBUG_LEVEL);
+            error_report("NFS Warning: Limiting NFS debug level "
+                         "to %d", QEMU_NFS_MAX_DEBUG_LEVEL);
            client->debug = QEMU_NFS_MAX_DEBUG_LEVEL;
        }
        nfs_set_debug(client->context, client->debug);
@@ -661,7 +662,7 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,

    ret = nfs_client_open(client, options,
                          (flags & BDRV_O_RDWR) ? O_RDWR : O_RDONLY,
-                          bs->open_flags, errp);
+                          errp, bs->open_flags);
    if (ret < 0) {
        return ret;
    }
@@ -703,7 +704,7 @@ static int nfs_file_create(const char *url, QemuOpts *opts, Error **errp)
        goto out;
    }

-    ret = nfs_client_open(client, options, O_CREAT, 0, errp);
+    ret = nfs_client_open(client, options, O_CREAT, errp, 0);
    if (ret < 0) {
        goto out;
    }
@@ -734,9 +735,7 @@ nfs_get_allocated_file_size_cb(int ret, struct nfs_context *nfs, void *data,
    if (task->ret < 0) {
        error_report("NFS Error: %s", nfs_get_error(nfs));
    }
-
-    /* Set task->complete before reading bs->wakeup.  */
-    atomic_mb_set(&task->complete, 1);
+    task->complete = 1;
    bdrv_wakeup(task->bs);
 }

@@ -764,25 +763,10 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
    return (task.ret < 0 ? task.ret : st.st_blocks * 512);
 }

-static int nfs_file_truncate(BlockDriverState *bs, int64_t offset,
-                             PreallocMode prealloc, Error **errp)
+static int nfs_file_truncate(BlockDriverState *bs, int64_t offset)
 {
    NFSClient *client = bs->opaque;
-    int ret;
-
-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
-    ret = nfs_ftruncate(client->context, client->fh, offset);
-    if (ret < 0) {
-        error_setg_errno(errp, -ret, "Failed to truncate file");
-        return ret;
-    }
-
-    return 0;
+    return nfs_ftruncate(client->context, client->fh, offset);
 }

 /* Note that this will not re-establish a connection with the NFS server
@@ -29,6 +29,11 @@ static QemuOptsList runtime_opts = {
    .name = "null",
    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "",
+        },
        {
            .name = BLOCK_OPT_SIZE,
            .type = QEMU_OPT_SIZE,
@@ -49,30 +54,6 @@ static QemuOptsList runtime_opts = {
    },
 };

-static void null_co_parse_filename(const char *filename, QDict *options,
-                                   Error **errp)
-{
-    /* This functions only exists so that a null-co:// filename is accepted
-     * with the null-co driver. */
-    if (strcmp(filename, "null-co://")) {
-        error_setg(errp, "The only allowed filename for this driver is "
-                         "'null-co://'");
-        return;
-    }
-}
-
-static void null_aio_parse_filename(const char *filename, QDict *options,
-                                    Error **errp)
-{
-    /* This functions only exists so that a null-aio:// filename is accepted
-     * with the null-aio driver. */
-    if (strcmp(filename, "null-aio://")) {
-        error_setg(errp, "The only allowed filename for this driver is "
-                         "'null-aio://'");
-        return;
-    }
-}
-
 static int null_file_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
@@ -261,7 +242,6 @@ static BlockDriver bdrv_null_co = {
    .instance_size          = sizeof(BDRVNullState),

    .bdrv_file_open         = null_file_open,
-    .bdrv_parse_filename    = null_co_parse_filename,
    .bdrv_close             = null_close,
    .bdrv_getlength         = null_getlength,

@@ -281,7 +261,6 @@ static BlockDriver bdrv_null_aio = {
    .instance_size          = sizeof(BDRVNullState),

    .bdrv_file_open         = null_file_open,
-    .bdrv_parse_filename    = null_aio_parse_filename,
    .bdrv_close             = null_close,
    .bdrv_getlength         = null_getlength,

@@ -192,7 +192,7 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
                                 int nb_sectors, int *pnum)
 {
    BDRVParallelsState *s = bs->opaque;
-    int64_t pos, space, idx, to_allocate, i, len;
+    int64_t pos, space, idx, to_allocate, i;

    pos = block_status(s, sector_num, nb_sectors, pnum);
    if (pos > 0) {
@@ -214,11 +214,7 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
    assert(idx < s->bat_size && idx + to_allocate <= s->bat_size);

    space = to_allocate * s->tracks;
-    len = bdrv_getlength(bs->file->bs);
-    if (len < 0) {
-        return len;
-    }
-    if (s->data_end + space > (len >> BDRV_SECTOR_BITS)) {
+    if (s->data_end + space > bdrv_getlength(bs->file->bs) >> BDRV_SECTOR_BITS) {
        int ret;
        space += s->prealloc_size;
        if (s->prealloc_mode == PRL_PREALLOC_MODE_FALLOCATE) {
@@ -228,7 +224,7 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
        } else {
            ret = bdrv_truncate(bs->file,
                                (s->data_end + space) << BDRV_SECTOR_BITS,
-                                PREALLOC_MODE_OFF, NULL);
+                                NULL);
        }
        if (ret < 0) {
            return ret;
@@ -462,8 +458,7 @@ static int parallels_check(BlockDriverState *bs, BdrvCheckResult *res,
        res->leaks += count;
        if (fix & BDRV_FIX_LEAKS) {
            Error *local_err = NULL;
-            ret = bdrv_truncate(bs->file, res->image_end_offset,
-                                PREALLOC_MODE_OFF, &local_err);
+            ret = bdrv_truncate(bs->file, res->image_end_offset, &local_err);
            if (ret < 0) {
                error_report_err(local_err);
                res->check_errors++;
@@ -512,7 +507,7 @@ static int parallels_create(const char *filename, QemuOpts *opts, Error **errp)

    blk_set_allow_write_beyond_eof(file, true);

-    ret = blk_truncate(file, 0, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(file, 0, errp);
    if (ret < 0) {
        goto exit;
    }
@@ -703,7 +698,8 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail_options;
    }

-    if (!bdrv_has_zero_init(bs->file->bs)) {
+    if (!(flags & BDRV_O_RESIZE) || !bdrv_has_zero_init(bs->file->bs) ||
+            bdrv_truncate(bs->file, bdrv_getlength(bs->file->bs), NULL) != 0) {
        s->prealloc_mode = PRL_PREALLOC_MODE_FALLOCATE;
    }

@@ -746,8 +742,7 @@ static void parallels_close(BlockDriverState *bs)
    }

    if (bs->open_flags & BDRV_O_RDWR) {
-        bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS,
-                      PREALLOC_MODE_OFF, NULL);
+        bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS, NULL);
    }

    g_free(s->bat_dirty_bmap);
@@ -45,7 +45,7 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
    info->ro                     = bs->read_only;
    info->drv                    = g_strdup(bs->drv->format_name);
    info->encrypted              = bs->encrypted;
-    info->encryption_key_missing = false;
+    info->encryption_key_missing = bdrv_key_required(bs);

    info->cache = g_new(BlockdevCacheInfo, 1);
    *info->cache = (BlockdevCacheInfo) {
@@ -145,9 +145,8 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,

        /* Skip automatically inserted nodes that the user isn't aware of for
         * query-block (blk != NULL), but not for query-named-block-nodes */
-        while (blk && bs0->drv && bs0->implicit) {
+        while (blk && bs0 && bs0->drv && bs0->implicit) {
            bs0 = backing_bs(bs0);
-            assert(bs0);
        }
    }

@@ -331,7 +330,6 @@ static void bdrv_query_info(BlockBackend *blk, BlockInfo **p_info,
 {
    BlockInfo *info = g_malloc0(sizeof(*info));
    BlockDriverState *bs = blk_bs(blk);
-    char *qdev;

    /* Skip automatically inserted nodes that the user isn't aware of */
    while (bs && bs->drv && bs->implicit) {
@@ -343,14 +341,6 @@ static void bdrv_query_info(BlockBackend *blk, BlockInfo **p_info,
    info->locked = blk_dev_is_medium_locked(blk);
    info->removable = blk_dev_has_removable_media(blk);

-    qdev = blk_get_attached_dev_id(blk);
-    if (qdev && *qdev) {
-        info->has_qdev = true;
-        info->qdev = qdev;
-    } else {
-        g_free(qdev);
-    }
-
    if (blk_dev_has_tray(blk)) {
        info->has_tray_open = true;
        info->tray_open = blk_dev_is_tray_open(blk);
@@ -473,7 +463,7 @@ static BlockStats *bdrv_query_bds_stats(BlockDriverState *bs,
        s->node_name = g_strdup(bdrv_get_node_name(bs));
    }

-    s->stats->wr_highest_offset = stat64_get(&bs->wr_highest_offset);
+    s->stats->wr_highest_offset = bs->wr_highest_offset;

    if (bs->file) {
        s->has_parent = true;
@@ -494,14 +484,8 @@ BlockInfoList *qmp_query_block(Error **errp)
    BlockBackend *blk;
    Error *local_err = NULL;

-    for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
-        BlockInfoList *info;
-
-        if (!*blk_name(blk) && !blk_get_attached_dev(blk)) {
-            continue;
-        }
-
-        info = g_malloc0(sizeof(*info));
+    for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {
+        BlockInfoList *info = g_malloc0(sizeof(*info));
        bdrv_query_info(blk, &info->value, &local_err);
        if (local_err) {
            error_propagate(errp, local_err);
@@ -633,11 +617,9 @@ static void dump_qobject(fprintf_function func_fprintf, void *f,
                         int comp_indent, QObject *obj)
 {
    switch (qobject_type(obj)) {
-        case QTYPE_QNUM: {
-            QNum *value = qobject_to_qnum(obj);
-            char *tmp = qnum_to_string(value);
-            func_fprintf(f, "%s", tmp);
-            g_free(tmp);
+        case QTYPE_QINT: {
+            QInt *value = qobject_to_qint(obj);
+            func_fprintf(f, "%" PRId64, qint_get_int(value));
            break;
        }
        case QTYPE_QSTRING: {
@@ -655,6 +637,11 @@ static void dump_qobject(fprintf_function func_fprintf, void *f,
            dump_qlist(func_fprintf, f, comp_indent, value);
            break;
        }
+        case QTYPE_QFLOAT: {
+            QFloat *value = qobject_to_qfloat(obj);
+            func_fprintf(f, "%g", qfloat_get_double(value));
+            break;
+        }
        case QTYPE_QBOOL: {
            QBool *value = qobject_to_qbool(obj);
            func_fprintf(f, "%s", qbool_get_bool(value) ? "true" : "false");
@@ -31,10 +31,8 @@
 #include "qemu/bswap.h"
 #include <zlib.h>
 #include "qapi/qmp/qerror.h"
-#include "qapi/qmp/qstring.h"
-#include "crypto/block.h"
-#include "migration/blocker.h"
-#include "block/crypto.h"
+#include "crypto/cipher.h"
+#include "migration/migration.h"

 /**************************************************************/
 /* QEMU COW block driver with compression and encryption support */
@@ -79,7 +77,7 @@ typedef struct BDRVQcowState {
    uint8_t *cluster_cache;
    uint8_t *cluster_data;
    uint64_t cluster_cache_offset;
-    QCryptoBlock *crypto; /* Disk encryption format driver */
+    QCryptoCipher *cipher; /* NULL if no key yet */
    uint32_t crypt_method_header;
    CoMutex lock;
    Error *migration_blocker;
@@ -99,15 +97,6 @@ static int qcow_probe(const uint8_t *buf, int buf_size, const char *filename)
        return 0;
 }

-static QemuOptsList qcow_runtime_opts = {
-    .name = "qcow",
-    .head = QTAILQ_HEAD_INITIALIZER(qcow_runtime_opts.head),
-    .desc = {
-        BLOCK_CRYPTO_OPT_DEF_QCOW_KEY_SECRET("encrypt."),
-        { /* end of list */ }
-    },
-};
-
 static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
                     Error **errp)
 {
@@ -116,19 +105,11 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
    int ret;
    QCowHeader header;
    Error *local_err = NULL;
-    QCryptoBlockOpenOptions *crypto_opts = NULL;
-    unsigned int cflags = 0;
-    QDict *encryptopts = NULL;
-    const char *encryptfmt;
-
-    qdict_extract_subqdict(options, &encryptopts, "encrypt.");
-    encryptfmt = qdict_get_try_str(encryptopts, "format");

    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
    if (!bs->file) {
-        ret = -EINVAL;
-        goto fail;
+        return -EINVAL;
    }

    ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
@@ -174,6 +155,17 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

+    if (header.crypt_method > QCOW_CRYPT_AES) {
+        error_setg(errp, "invalid encryption method in qcow header");
+        ret = -EINVAL;
+        goto fail;
+    }
+    if (!qcrypto_cipher_supports(QCRYPTO_CIPHER_ALG_AES_128,
+                                 QCRYPTO_CIPHER_MODE_CBC)) {
+        error_setg(errp, "AES cipher not available");
+        ret = -EINVAL;
+        goto fail;
+    }
    s->crypt_method_header = header.crypt_method;
    if (s->crypt_method_header) {
        if (bdrv_uses_whitelist() &&
@@ -189,44 +181,8 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
            ret = -ENOSYS;
            goto fail;
        }
-        if (s->crypt_method_header == QCOW_CRYPT_AES) {
-            if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
-                error_setg(errp,
-                           "Header reported 'aes' encryption format but "
-                           "options specify '%s'", encryptfmt);
-                ret = -EINVAL;
-                goto fail;
-            }
-            qdict_del(encryptopts, "format");
-            crypto_opts = block_crypto_open_opts_init(
-                Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp);
-            if (!crypto_opts) {
-                ret = -EINVAL;
-                goto fail;
-            }

-            if (flags & BDRV_O_NO_IO) {
-                cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
-            }
-            s->crypto = qcrypto_block_open(crypto_opts, "encrypt.",
-                                           NULL, NULL, cflags, errp);
-            if (!s->crypto) {
-                ret = -EINVAL;
-                goto fail;
-            }
-        } else {
-            error_setg(errp, "invalid encryption method in qcow header");
-            ret = -EINVAL;
-            goto fail;
-        }
        bs->encrypted = true;
-    } else {
-        if (encryptfmt) {
-            error_setg(errp, "No encryption in image header, but options "
-                       "specified format '%s'", encryptfmt);
-            ret = -EINVAL;
-            goto fail;
-        }
    }
    s->cluster_bits = header.cluster_bits;
    s->cluster_size = 1 << s->cluster_bits;
@@ -310,8 +266,6 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail;
    }

-    QDECREF(encryptopts);
-    qapi_free_QCryptoBlockOpenOptions(crypto_opts);
    qemu_co_mutex_init(&s->lock);
    return 0;

@@ -320,9 +274,6 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
    qemu_vfree(s->l2_cache);
    g_free(s->cluster_cache);
    g_free(s->cluster_data);
-    qcrypto_block_free(s->crypto);
-    QDECREF(encryptopts);
-    qapi_free_QCryptoBlockOpenOptions(crypto_opts);
    return ret;
 }

@@ -335,6 +286,85 @@ static int qcow_reopen_prepare(BDRVReopenState *state,
    return 0;
 }

+static int qcow_set_key(BlockDriverState *bs, const char *key)
+{
+    BDRVQcowState *s = bs->opaque;
+    uint8_t keybuf[16];
+    int len, i;
+    Error *err;
+
+    memset(keybuf, 0, 16);
+    len = strlen(key);
+    if (len > 16)
+        len = 16;
+    /* XXX: we could compress the chars to 7 bits to increase
+       entropy */
+    for(i = 0;i < len;i++) {
+        keybuf[i] = key[i];
+    }
+    assert(bs->encrypted);
+
+    qcrypto_cipher_free(s->cipher);
+    s->cipher = qcrypto_cipher_new(
+        QCRYPTO_CIPHER_ALG_AES_128,
+        QCRYPTO_CIPHER_MODE_CBC,
+        keybuf, G_N_ELEMENTS(keybuf),
+        &err);
+
+    if (!s->cipher) {
+        /* XXX would be nice if errors in this method could
+         * be properly propagate to the caller. Would need
+         * the bdrv_set_key() API signature to be fixed. */
+        error_free(err);
+        return -1;
+    }
+    return 0;
+}
+
+/* The crypt function is compatible with the linux cryptoloop
+   algorithm for < 4 GB images. NOTE: out_buf == in_buf is
+   supported */
+static int encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
+                           uint8_t *out_buf, const uint8_t *in_buf,
+                           int nb_sectors, bool enc, Error **errp)
+{
+    union {
+        uint64_t ll[2];
+        uint8_t b[16];
+    } ivec;
+    int i;
+    int ret;
+
+    for(i = 0; i < nb_sectors; i++) {
+        ivec.ll[0] = cpu_to_le64(sector_num);
+        ivec.ll[1] = 0;
+        if (qcrypto_cipher_setiv(s->cipher,
+                                 ivec.b, G_N_ELEMENTS(ivec.b),
+                                 errp) < 0) {
+            return -1;
+        }
+        if (enc) {
+            ret = qcrypto_cipher_encrypt(s->cipher,
+                                         in_buf,
+                                         out_buf,
+                                         512,
+                                         errp);
+        } else {
+            ret = qcrypto_cipher_decrypt(s->cipher,
+                                         in_buf,
+                                         out_buf,
+                                         512,
+                                         errp);
+        }
+        if (ret < 0) {
+            return -1;
+        }
+        sector_num++;
+        in_buf += 512;
+        out_buf += 512;
+    }
+    return 0;
+}

 /* 'allocate' is:
 *
@@ -443,23 +473,22 @@ static uint64_t get_cluster_offset(BlockDriverState *bs,
                /* round to cluster size */
                cluster_offset = (cluster_offset + s->cluster_size - 1) &
                    ~(s->cluster_size - 1);
-                bdrv_truncate(bs->file, cluster_offset + s->cluster_size,
-                              PREALLOC_MODE_OFF, NULL);
+                bdrv_truncate(bs->file, cluster_offset + s->cluster_size, NULL);
                /* if encrypted, we must initialize the cluster
                   content which won't be written */
                if (bs->encrypted &&
                    (n_end - n_start) < s->cluster_sectors) {
                    uint64_t start_sect;
-                    assert(s->crypto);
+                    assert(s->cipher);
                    start_sect = (offset & ~(s->cluster_size - 1)) >> 9;
+                    memset(s->cluster_data + 512, 0x00, 512);
                    for(i = 0; i < s->cluster_sectors; i++) {
                        if (i < n_start || i >= n_end) {
                            Error *err = NULL;
-                            memset(s->cluster_data, 0x00, 512);
-                            if (qcrypto_block_encrypt(s->crypto, start_sect + i,
-                                                      s->cluster_data,
-                                                      BDRV_SECTOR_SIZE,
-                                                      &err) < 0) {
+                            if (encrypt_sectors(s, start_sect + i,
+                                                s->cluster_data,
+                                                s->cluster_data + 512, 1,
+                                                true, &err) < 0) {
                                error_free(err);
                                errno = EIO;
                                return -1;
@@ -504,7 +533,7 @@ static int64_t coroutine_fn qcow_co_get_block_status(BlockDriverState *bs,
    if (!cluster_offset) {
        return 0;
    }
-    if ((cluster_offset & QCOW_OFLAG_COMPRESSED) || s->crypto) {
+    if ((cluster_offset & QCOW_OFLAG_COMPRESSED) || s->cipher) {
        return BDRV_BLOCK_DATA;
    }
    cluster_offset |= (index_in_cluster << BDRV_SECTOR_BITS);
@@ -635,9 +664,9 @@ static coroutine_fn int qcow_co_readv(BlockDriverState *bs, int64_t sector_num,
                break;
            }
            if (bs->encrypted) {
-                assert(s->crypto);
-                if (qcrypto_block_decrypt(s->crypto, sector_num, buf,
-                                          n * BDRV_SECTOR_SIZE, &err) < 0) {
+                assert(s->cipher);
+                if (encrypt_sectors(s, sector_num, buf, buf,
+                                    n, false, &err) < 0) {
                    goto fail;
                }
            }
@@ -671,7 +700,9 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
    BDRVQcowState *s = bs->opaque;
    int index_in_cluster;
    uint64_t cluster_offset;
+    const uint8_t *src_buf;
    int ret = 0, n;
+    uint8_t *cluster_data = NULL;
    struct iovec hd_iov;
    QEMUIOVector hd_qiov;
    uint8_t *buf;
@@ -679,9 +710,7 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,

    s->cluster_cache_offset = -1; /* disable compressed cache */

-    /* We must always copy the iov when encrypting, so we
-     * don't modify the original data buffer during encryption */
-    if (bs->encrypted || qiov->niov > 1) {
+    if (qiov->niov > 1) {
        buf = orig_buf = qemu_try_blockalign(bs, qiov->size);
        if (buf == NULL) {
            return -ENOMEM;
@@ -710,16 +739,22 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
        }
        if (bs->encrypted) {
            Error *err = NULL;
-            assert(s->crypto);
-            if (qcrypto_block_encrypt(s->crypto, sector_num, buf,
-                                      n * BDRV_SECTOR_SIZE, &err) < 0) {
+            assert(s->cipher);
+            if (!cluster_data) {
+                cluster_data = g_malloc0(s->cluster_size);
+            }
+            if (encrypt_sectors(s, sector_num, cluster_data, buf,
+                                n, true, &err) < 0) {
                error_free(err);
                ret = -EIO;
                break;
            }
+            src_buf = cluster_data;
+        } else {
+            src_buf = buf;
        }

-        hd_iov.iov_base = (void *)buf;
+        hd_iov.iov_base = (void *)src_buf;
        hd_iov.iov_len = n * 512;
        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
        qemu_co_mutex_unlock(&s->lock);
@@ -738,7 +773,10 @@ static coroutine_fn int qcow_co_writev(BlockDriverState *bs, int64_t sector_num,
    }
    qemu_co_mutex_unlock(&s->lock);

-    qemu_vfree(orig_buf);
+    if (qiov->niov > 1) {
+        qemu_vfree(orig_buf);
+    }
+    g_free(cluster_data);

    return ret;
 }
@@ -747,8 +785,8 @@ static void qcow_close(BlockDriverState *bs)
 {
    BDRVQcowState *s = bs->opaque;

-    qcrypto_block_free(s->crypto);
-    s->crypto = NULL;
+    qcrypto_cipher_free(s->cipher);
+    s->cipher = NULL;
    g_free(s->l1_table);
    qemu_vfree(s->l2_cache);
    g_free(s->cluster_cache);
@@ -765,35 +803,17 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
    uint8_t *tmp;
    int64_t total_size = 0;
    char *backing_file = NULL;
+    int flags = 0;
    Error *local_err = NULL;
    int ret;
    BlockBackend *qcow_blk;
-    char *encryptfmt = NULL;
-    QDict *options;
-    QDict *encryptopts = NULL;
-    QCryptoBlockCreateOptions *crypto_opts = NULL;
-    QCryptoBlock *crypto = NULL;

    /* Read out options */
    total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
                          BDRV_SECTOR_SIZE);
-    if (total_size == 0) {
-        error_setg(errp, "Image size is too small, cannot be zero length");
-        ret = -EINVAL;
-        goto cleanup;
-    }
-
    backing_file = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
-    encryptfmt = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
-    if (encryptfmt) {
-        if (qemu_opt_get(opts, BLOCK_OPT_ENCRYPT)) {
-            error_setg(errp, "Options " BLOCK_OPT_ENCRYPT " and "
-                       BLOCK_OPT_ENCRYPT_FORMAT " are mutually exclusive");
-            ret = -EINVAL;
-            goto cleanup;
-        }
-    } else if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
-        encryptfmt = g_strdup("aes");
+    if (qemu_opt_get_bool_del(opts, BLOCK_OPT_ENCRYPT, false)) {
+        flags |= BLOCK_FLAG_ENCRYPT;
    }

    ret = bdrv_create_file(filename, opts, &local_err);
@@ -813,7 +833,7 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)

    blk_set_allow_write_beyond_eof(qcow_blk, true);

-    ret = blk_truncate(qcow_blk, 0, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(qcow_blk, 0, errp);
    if (ret < 0) {
        goto exit;
    }
@@ -832,7 +852,6 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
            header_size += backing_filename_len;
        } else {
            /* special backing file for vvfat */
-            g_free(backing_file);
            backing_file = NULL;
        }
        header.cluster_bits = 9; /* 512 byte cluster to avoid copying
@@ -847,32 +866,8 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
    l1_size = (total_size + (1LL << shift) - 1) >> shift;

    header.l1_table_offset = cpu_to_be64(header_size);
-
-    options = qemu_opts_to_qdict(opts, NULL);
-    qdict_extract_subqdict(options, &encryptopts, "encrypt.");
-    QDECREF(options);
-    if (encryptfmt) {
-        if (!g_str_equal(encryptfmt, "aes")) {
-            error_setg(errp, "Unknown encryption format '%s', expected 'aes'",
-                       encryptfmt);
-            ret = -EINVAL;
-            goto exit;
-        }
+    if (flags & BLOCK_FLAG_ENCRYPT) {
        header.crypt_method = cpu_to_be32(QCOW_CRYPT_AES);
-
-        crypto_opts = block_crypto_create_opts_init(
-            Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp);
-        if (!crypto_opts) {
-            ret = -EINVAL;
-            goto exit;
-        }
-
-        crypto = qcrypto_block_create(crypto_opts, "encrypt.",
-                                      NULL, NULL, NULL, errp);
-        if (!crypto) {
-            ret = -EINVAL;
-            goto exit;
-        }
    } else {
        header.crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
    }
@@ -907,10 +902,6 @@ static int qcow_create(const char *filename, QemuOpts *opts, Error **errp)
 exit:
    blk_unref(qcow_blk);
 cleanup:
-    QDECREF(encryptopts);
-    g_free(encryptfmt);
-    qcrypto_block_free(crypto);
-    qapi_free_QCryptoBlockCreateOptions(crypto_opts);
    g_free(backing_file);
    return ret;
 }
@@ -925,8 +916,7 @@ static int qcow_make_empty(BlockDriverState *bs)
    if (bdrv_pwrite_sync(bs->file, s->l1_table_offset, s->l1_table,
            l1_length) < 0)
        return -1;
-    ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length,
-                        PREALLOC_MODE_OFF, NULL);
+    ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length, NULL);
    if (ret < 0)
        return ret;

@@ -1050,15 +1040,9 @@ static QemuOptsList qcow_create_opts = {
        {
            .name = BLOCK_OPT_ENCRYPT,
            .type = QEMU_OPT_BOOL,
-            .help = "Encrypt the image with format 'aes'. (Deprecated "
-                    "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",
+            .help = "Encrypt the image",
+            .def_value_str = "off"
        },
-        {
-            .name = BLOCK_OPT_ENCRYPT_FORMAT,
-            .type = QEMU_OPT_STRING,
-            .help = "Encrypt the image, format choices: 'aes'",
-        },
-        BLOCK_CRYPTO_OPT_DEF_QCOW_KEY_SECRET("encrypt."),
        { /* end of list */ }
    }
 };
@@ -1079,6 +1063,7 @@ static BlockDriver bdrv_qcow = {
    .bdrv_co_writev         = qcow_co_writev,
    .bdrv_co_get_block_status   = qcow_co_get_block_status,

+    .bdrv_set_key           = qcow_set_key,
    .bdrv_make_empty        = qcow_make_empty,
    .bdrv_co_pwritev_compressed = qcow_co_pwritev_compressed,
    .bdrv_get_info          = qcow_get_info,
@@ -309,19 +309,14 @@ static int count_contiguous_clusters(int nb_clusters, int cluster_size,
        uint64_t *l2_table, uint64_t stop_flags)
 {
    int i;
-    QCow2ClusterType first_cluster_type;
    uint64_t mask = stop_flags | L2E_OFFSET_MASK | QCOW_OFLAG_COMPRESSED;
    uint64_t first_entry = be64_to_cpu(l2_table[0]);
    uint64_t offset = first_entry & mask;

-    if (!offset) {
+    if (!offset)
        return 0;
-    }

-    /* must be allocated */
-    first_cluster_type = qcow2_get_cluster_type(first_entry);
-    assert(first_cluster_type == QCOW2_CLUSTER_NORMAL ||
-           first_cluster_type == QCOW2_CLUSTER_ZERO_ALLOC);
+    assert(qcow2_get_cluster_type(first_entry) == QCOW2_CLUSTER_NORMAL);

    for (i = 0; i < nb_clusters; i++) {
        uint64_t l2_entry = be64_to_cpu(l2_table[i]) & mask;
@@ -333,21 +328,14 @@ static int count_contiguous_clusters(int nb_clusters, int cluster_size,
 	return i;
 }

-/*
- * Checks how many consecutive unallocated clusters in a given L2
- * table have the same cluster type.
- */
-static int count_contiguous_clusters_unallocated(int nb_clusters,
-                                                 uint64_t *l2_table,
-                                                 QCow2ClusterType wanted_type)
+static int count_contiguous_clusters_by_type(int nb_clusters,
+                                             uint64_t *l2_table,
+                                             int wanted_type)
 {
    int i;

-    assert(wanted_type == QCOW2_CLUSTER_ZERO_PLAIN ||
-           wanted_type == QCOW2_CLUSTER_UNALLOCATED);
    for (i = 0; i < nb_clusters; i++) {
-        uint64_t entry = be64_to_cpu(l2_table[i]);
-        QCow2ClusterType type = qcow2_get_cluster_type(entry);
+        int type = qcow2_get_cluster_type(be64_to_cpu(l2_table[i]));

        if (type != wanted_type) {
            break;
@@ -357,21 +345,76 @@ static int count_contiguous_clusters_unallocated(int nb_clusters,
    return i;
 }

-static int coroutine_fn do_perform_cow_read(BlockDriverState *bs,
-                                            uint64_t src_cluster_offset,
-                                            unsigned offset_in_cluster,
-                                            QEMUIOVector *qiov)
+/* The crypt function is compatible with the linux cryptoloop
+   algorithm for < 4 GB images. NOTE: out_buf == in_buf is
+   supported */
+int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
+                          uint8_t *out_buf, const uint8_t *in_buf,
+                          int nb_sectors, bool enc,
+                          Error **errp)
 {
+    union {
+        uint64_t ll[2];
+        uint8_t b[16];
+    } ivec;
+    int i;
    int ret;

-    if (qiov->size == 0) {
-        return 0;
+    for(i = 0; i < nb_sectors; i++) {
+        ivec.ll[0] = cpu_to_le64(sector_num);
+        ivec.ll[1] = 0;
+        if (qcrypto_cipher_setiv(s->cipher,
+                                 ivec.b, G_N_ELEMENTS(ivec.b),
+                                 errp) < 0) {
+            return -1;
+        }
+        if (enc) {
+            ret = qcrypto_cipher_encrypt(s->cipher,
+                                         in_buf,
+                                         out_buf,
+                                         512,
+                                         errp);
+        } else {
+            ret = qcrypto_cipher_decrypt(s->cipher,
+                                         in_buf,
+                                         out_buf,
+                                         512,
+                                         errp);
+        }
+        if (ret < 0) {
+            return -1;
+        }
+        sector_num++;
+        in_buf += 512;
+        out_buf += 512;
    }
+    return 0;
+}
+
+static int coroutine_fn do_perform_cow(BlockDriverState *bs,
+                                       uint64_t src_cluster_offset,
+                                       uint64_t cluster_offset,
+                                       int offset_in_cluster,
+                                       int bytes)
+{
+    BDRVQcow2State *s = bs->opaque;
+    QEMUIOVector qiov;
+    struct iovec iov;
+    int ret;
+
+    iov.iov_len = bytes;
+    iov.iov_base = qemu_try_blockalign(bs, iov.iov_len);
+    if (iov.iov_base == NULL) {
+        return -ENOMEM;
+    }
+
+    qemu_iovec_init_external(&qiov, &iov, 1);

    BLKDBG_EVENT(bs->file, BLKDBG_COW_READ);

    if (!bs->drv) {
-        return -ENOMEDIUM;
+        ret = -ENOMEDIUM;
+        goto out;
    }

    /* Call .bdrv_co_readv() directly instead of using the public block-layer
@@ -379,63 +422,43 @@ static int coroutine_fn do_perform_cow_read(BlockDriverState *bs,
     * which can lead to deadlock when block layer copy-on-read is enabled.
     */
    ret = bs->drv->bdrv_co_preadv(bs, src_cluster_offset + offset_in_cluster,
-                                  qiov->size, qiov, 0);
+                                  bytes, &qiov, 0);
    if (ret < 0) {
-        return ret;
+        goto out;
    }

-    return 0;
-}
-
-static bool coroutine_fn do_perform_cow_encrypt(BlockDriverState *bs,
-                                                uint64_t src_cluster_offset,
-                                                uint64_t cluster_offset,
-                                                unsigned offset_in_cluster,
-                                                uint8_t *buffer,
-                                                unsigned bytes)
-{
-    if (bytes && bs->encrypted) {
-        BDRVQcow2State *s = bs->opaque;
-        int64_t sector = (s->crypt_physical_offset ?
-                          (cluster_offset + offset_in_cluster) :
-                          (src_cluster_offset + offset_in_cluster))
+    if (bs->encrypted) {
+        Error *err = NULL;
+        int64_t sector = (src_cluster_offset + offset_in_cluster)
                         >> BDRV_SECTOR_BITS;
+        assert(s->cipher);
        assert((offset_in_cluster & ~BDRV_SECTOR_MASK) == 0);
        assert((bytes & ~BDRV_SECTOR_MASK) == 0);
-        assert(s->crypto);
-        if (qcrypto_block_encrypt(s->crypto, sector, buffer,
-                                  bytes, NULL) < 0) {
-            return false;
+        if (qcow2_encrypt_sectors(s, sector, iov.iov_base, iov.iov_base,
+                                  bytes >> BDRV_SECTOR_BITS, true, &err) < 0) {
+            ret = -EIO;
+            error_free(err);
+            goto out;
        }
    }
-    return true;
-}
-
-static int coroutine_fn do_perform_cow_write(BlockDriverState *bs,
-                                             uint64_t cluster_offset,
-                                             unsigned offset_in_cluster,
-                                             QEMUIOVector *qiov)
-{
-    int ret;
-
-    if (qiov->size == 0) {
-        return 0;
-    }

    ret = qcow2_pre_write_overlap_check(bs, 0,
-            cluster_offset + offset_in_cluster, qiov->size);
+            cluster_offset + offset_in_cluster, bytes);
    if (ret < 0) {
-        return ret;
+        goto out;
    }

    BLKDBG_EVENT(bs->file, BLKDBG_COW_WRITE);
    ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
-                          qiov->size, qiov, 0);
+                          bytes, &qiov, 0);
    if (ret < 0) {
-        return ret;
+        goto out;
    }

-    return 0;
+    ret = 0;
+out:
+    qemu_vfree(iov.iov_base);
+    return ret;
 }


@@ -464,7 +487,6 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
    int l1_bits, c;
    unsigned int offset_in_cluster;
    uint64_t bytes_available, bytes_needed, nb_clusters;
-    QCow2ClusterType type;
    int ret;

    offset_in_cluster = offset_into_cluster(s, offset);
@@ -487,13 +509,13 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,

    l1_index = offset >> l1_bits;
    if (l1_index >= s->l1_size) {
-        type = QCOW2_CLUSTER_UNALLOCATED;
+        ret = QCOW2_CLUSTER_UNALLOCATED;
        goto out;
    }

    l2_offset = s->l1_table[l1_index] & L1E_OFFSET_MASK;
    if (!l2_offset) {
-        type = QCOW2_CLUSTER_UNALLOCATED;
+        ret = QCOW2_CLUSTER_UNALLOCATED;
        goto out;
    }

@@ -513,7 +535,7 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,

    /* find the cluster offset for the given disk offset */

-    l2_index = offset_to_l2_index(s, offset);
+    l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);
    *cluster_offset = be64_to_cpu(l2_table[l2_index]);

    nb_clusters = size_to_clusters(s, bytes_needed);
@@ -522,37 +544,38 @@ int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
     * true */
    assert(nb_clusters <= INT_MAX);

-    type = qcow2_get_cluster_type(*cluster_offset);
-    if (s->qcow_version < 3 && (type == QCOW2_CLUSTER_ZERO_PLAIN ||
-                                type == QCOW2_CLUSTER_ZERO_ALLOC)) {
-        qcow2_signal_corruption(bs, true, -1, -1, "Zero cluster entry found"
-                                " in pre-v3 image (L2 offset: %#" PRIx64
-                                ", L2 index: %#x)", l2_offset, l2_index);
-        ret = -EIO;
-        goto fail;
-    }
-    switch (type) {
+    ret = qcow2_get_cluster_type(*cluster_offset);
+    switch (ret) {
    case QCOW2_CLUSTER_COMPRESSED:
        /* Compressed clusters can only be processed one by one */
        c = 1;
        *cluster_offset &= L2E_COMPRESSED_OFFSET_SIZE_MASK;
        break;
-    case QCOW2_CLUSTER_ZERO_PLAIN:
+    case QCOW2_CLUSTER_ZERO:
+        if (s->qcow_version < 3) {
+            qcow2_signal_corruption(bs, true, -1, -1, "Zero cluster entry found"
+                                    " in pre-v3 image (L2 offset: %#" PRIx64
+                                    ", L2 index: %#x)", l2_offset, l2_index);
+            ret = -EIO;
+            goto fail;
+        }
+        c = count_contiguous_clusters_by_type(nb_clusters, &l2_table[l2_index],
+                                              QCOW2_CLUSTER_ZERO);
+        *cluster_offset = 0;
+        break;
    case QCOW2_CLUSTER_UNALLOCATED:
        /* how many empty clusters ? */
-        c = count_contiguous_clusters_unallocated(nb_clusters,
-                                                  &l2_table[l2_index], type);
+        c = count_contiguous_clusters_by_type(nb_clusters, &l2_table[l2_index],
+                                              QCOW2_CLUSTER_UNALLOCATED);
        *cluster_offset = 0;
        break;
-    case QCOW2_CLUSTER_ZERO_ALLOC:
    case QCOW2_CLUSTER_NORMAL:
        /* how many allocated clusters ? */
        c = count_contiguous_clusters(nb_clusters, s->cluster_size,
-                                      &l2_table[l2_index], QCOW_OFLAG_ZERO);
+                &l2_table[l2_index], QCOW_OFLAG_ZERO);
        *cluster_offset &= L2E_OFFSET_MASK;
        if (offset_into_cluster(s, *cluster_offset)) {
-            qcow2_signal_corruption(bs, true, -1, -1,
-                                    "Cluster allocation offset %#"
+            qcow2_signal_corruption(bs, true, -1, -1, "Data cluster offset %#"
                                    PRIx64 " unaligned (L2 offset: %#" PRIx64
                                    ", L2 index: %#x)", *cluster_offset,
                                    l2_offset, l2_index);
@@ -579,7 +602,7 @@ out:
    assert(bytes_available - offset_in_cluster <= UINT_MAX);
    *bytes = bytes_available - offset_in_cluster;

-    return type;
+    return ret;

 fail:
    qcow2_cache_put(bs, s->l2_table_cache, (void **)&l2_table);
@@ -650,7 +673,7 @@ static int get_cluster_table(BlockDriverState *bs, uint64_t offset,

    /* find the cluster offset for the given disk offset */

-    l2_index = offset_to_l2_index(s, offset);
+    l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1);

    *new_l2_table = l2_table;
    *new_l2_index = l2_index;
@@ -718,134 +741,31 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
    return cluster_offset;
 }

-static int perform_cow(BlockDriverState *bs, QCowL2Meta *m)
+static int perform_cow(BlockDriverState *bs, QCowL2Meta *m, Qcow2COWRegion *r)
 {
    BDRVQcow2State *s = bs->opaque;
-    Qcow2COWRegion *start = &m->cow_start;
-    Qcow2COWRegion *end = &m->cow_end;
-    unsigned buffer_size;
-    unsigned data_bytes = end->offset - (start->offset + start->nb_bytes);
-    bool merge_reads;
-    uint8_t *start_buffer, *end_buffer;
-    QEMUIOVector qiov;
    int ret;

-    assert(start->nb_bytes <= UINT_MAX - end->nb_bytes);
-    assert(start->nb_bytes + end->nb_bytes <= UINT_MAX - data_bytes);
-    assert(start->offset + start->nb_bytes <= end->offset);
-    assert(!m->data_qiov || m->data_qiov->size == data_bytes);
-
-    if (start->nb_bytes == 0 && end->nb_bytes == 0) {
+    if (r->nb_bytes == 0) {
        return 0;
    }

-    /* If we have to read both the start and end COW regions and the
-     * middle region is not too large then perform just one read
-     * operation */
-    merge_reads = start->nb_bytes && end->nb_bytes && data_bytes <= 16384;
-    if (merge_reads) {
-        buffer_size = start->nb_bytes + data_bytes + end->nb_bytes;
-    } else {
-        /* If we have to do two reads, add some padding in the middle
-         * if necessary to make sure that the end region is optimally
-         * aligned. */
-        size_t align = bdrv_opt_mem_align(bs);
-        assert(align > 0 && align <= UINT_MAX);
-        assert(QEMU_ALIGN_UP(start->nb_bytes, align) <=
-               UINT_MAX - end->nb_bytes);
-        buffer_size = QEMU_ALIGN_UP(start->nb_bytes, align) + end->nb_bytes;
-    }
-
-    /* Reserve a buffer large enough to store all the data that we're
-     * going to read */
-    start_buffer = qemu_try_blockalign(bs, buffer_size);
-    if (start_buffer == NULL) {
-        return -ENOMEM;
-    }
-    /* The part of the buffer where the end region is located */
-    end_buffer = start_buffer + buffer_size - end->nb_bytes;
-
-    qemu_iovec_init(&qiov, 2 + (m->data_qiov ? m->data_qiov->niov : 0));
-
    qemu_co_mutex_unlock(&s->lock);
-    /* First we read the existing data from both COW regions. We
-     * either read the whole region in one go, or the start and end
-     * regions separately. */
-    if (merge_reads) {
-        qemu_iovec_add(&qiov, start_buffer, buffer_size);
-        ret = do_perform_cow_read(bs, m->offset, start->offset, &qiov);
-    } else {
-        qemu_iovec_add(&qiov, start_buffer, start->nb_bytes);
-        ret = do_perform_cow_read(bs, m->offset, start->offset, &qiov);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        qemu_iovec_reset(&qiov);
-        qemu_iovec_add(&qiov, end_buffer, end->nb_bytes);
-        ret = do_perform_cow_read(bs, m->offset, end->offset, &qiov);
-    }
-    if (ret < 0) {
-        goto fail;
-    }
-
-    /* Encrypt the data if necessary before writing it */
-    if (bs->encrypted) {
-        if (!do_perform_cow_encrypt(bs, m->offset, m->alloc_offset,
-                                    start->offset, start_buffer,
-                                    start->nb_bytes) ||
-            !do_perform_cow_encrypt(bs, m->offset, m->alloc_offset,
-                                    end->offset, end_buffer, end->nb_bytes)) {
-            ret = -EIO;
-            goto fail;
-        }
-    }
-
-    /* And now we can write everything. If we have the guest data we
-     * can write everything in one single operation */
-    if (m->data_qiov) {
-        qemu_iovec_reset(&qiov);
-        if (start->nb_bytes) {
-            qemu_iovec_add(&qiov, start_buffer, start->nb_bytes);
-        }
-        qemu_iovec_concat(&qiov, m->data_qiov, 0, data_bytes);
-        if (end->nb_bytes) {
-            qemu_iovec_add(&qiov, end_buffer, end->nb_bytes);
-        }
-        /* NOTE: we have a write_aio blkdebug event here followed by
-         * a cow_write one in do_perform_cow_write(), but there's only
-         * one single I/O operation */
-        BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-        ret = do_perform_cow_write(bs, m->alloc_offset, start->offset, &qiov);
-    } else {
-        /* If there's no guest data then write both COW regions separately */
-        qemu_iovec_reset(&qiov);
-        qemu_iovec_add(&qiov, start_buffer, start->nb_bytes);
-        ret = do_perform_cow_write(bs, m->alloc_offset, start->offset, &qiov);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        qemu_iovec_reset(&qiov);
-        qemu_iovec_add(&qiov, end_buffer, end->nb_bytes);
-        ret = do_perform_cow_write(bs, m->alloc_offset, end->offset, &qiov);
-    }
-
-fail:
+    ret = do_perform_cow(bs, m->offset, m->alloc_offset, r->offset, r->nb_bytes);
    qemu_co_mutex_lock(&s->lock);

+    if (ret < 0) {
+        return ret;
+    }
+
    /*
     * Before we update the L2 table to actually point to the new cluster, we
     * need to be sure that the refcounts have been increased and COW was
     * handled.
     */
-    if (ret == 0) {
-        qcow2_cache_depends_on_flush(s->l2_table_cache);
-    }
+    qcow2_cache_depends_on_flush(s->l2_table_cache);

-    qemu_vfree(start_buffer);
-    qemu_iovec_destroy(&qiov);
-    return ret;
+    return 0;
 }

 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
@@ -865,7 +785,12 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
    }

    /* copy content of unmodified sectors */
-    ret = perform_cow(bs, m);
+    ret = perform_cow(bs, m, &m->cow_start);
+    if (ret < 0) {
+        goto err;
+    }
+
+    ret = perform_cow(bs, m, &m->cow_end);
    if (ret < 0) {
        goto err;
    }
@@ -910,7 +835,7 @@ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m)
     * Don't discard clusters that reach a refcount of 0 (e.g. compressed
     * clusters), the next write will reuse them anyway.
     */
-    if (!m->keep_old_clusters && j != 0) {
+    if (j != 0) {
        for (i = 0; i < j; i++) {
            qcow2_free_any_clusters(bs, be64_to_cpu(old_cluster[i]), 1,
                                    QCOW2_DISCARD_NEVER);
@@ -935,7 +860,7 @@ static int count_cow_clusters(BDRVQcow2State *s, int nb_clusters,

    for (i = 0; i < nb_clusters; i++) {
        uint64_t l2_entry = be64_to_cpu(l2_table[l2_index + i]);
-        QCow2ClusterType cluster_type = qcow2_get_cluster_type(l2_entry);
+        int cluster_type = qcow2_get_cluster_type(l2_entry);

        switch(cluster_type) {
        case QCOW2_CLUSTER_NORMAL:
@@ -945,8 +870,7 @@ static int count_cow_clusters(BDRVQcow2State *s, int nb_clusters,
            break;
        case QCOW2_CLUSTER_UNALLOCATED:
        case QCOW2_CLUSTER_COMPRESSED:
-        case QCOW2_CLUSTER_ZERO_PLAIN:
-        case QCOW2_CLUSTER_ZERO_ALLOC:
+        case QCOW2_CLUSTER_ZERO:
            break;
        default:
            abort();
@@ -1208,9 +1132,8 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
    uint64_t entry;
    uint64_t nb_clusters;
    int ret;
-    bool keep_old_clusters = false;

-    uint64_t alloc_cluster_offset = 0;
+    uint64_t alloc_cluster_offset;

    trace_qcow2_handle_alloc(qemu_coroutine_self(), guest_offset, *host_offset,
                             *bytes);
@@ -1247,54 +1170,31 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
     * wrong with our code. */
    assert(nb_clusters > 0);

-    if (qcow2_get_cluster_type(entry) == QCOW2_CLUSTER_ZERO_ALLOC &&
-        (entry & QCOW_OFLAG_COPIED) &&
-        (!*host_offset ||
-         start_of_cluster(s, *host_offset) == (entry & L2E_OFFSET_MASK)))
-    {
-        /* Try to reuse preallocated zero clusters; contiguous normal clusters
-         * would be fine, too, but count_cow_clusters() above has limited
-         * nb_clusters already to a range of COW clusters */
-        int preallocated_nb_clusters =
-            count_contiguous_clusters(nb_clusters, s->cluster_size,
-                                      &l2_table[l2_index], QCOW_OFLAG_COPIED);
-        assert(preallocated_nb_clusters > 0);
-
-        nb_clusters = preallocated_nb_clusters;
-        alloc_cluster_offset = entry & L2E_OFFSET_MASK;
-
-        /* We want to reuse these clusters, so qcow2_alloc_cluster_link_l2()
-         * should not free them. */
-        keep_old_clusters = true;
-    }
-
    qcow2_cache_put(bs, s->l2_table_cache, (void **) &l2_table);

+    /* Allocate, if necessary at a given offset in the image file */
+    alloc_cluster_offset = start_of_cluster(s, *host_offset);
+    ret = do_alloc_cluster_offset(bs, guest_offset, &alloc_cluster_offset,
+                                  &nb_clusters);
+    if (ret < 0) {
+        goto fail;
+    }
+
+    /* Can't extend contiguous allocation */
+    if (nb_clusters == 0) {
+        *bytes = 0;
+        return 0;
+    }
+
+    /* !*host_offset would overwrite the image header and is reserved for "no
+     * host offset preferred". If 0 was a valid host offset, it'd trigger the
+     * following overlap check; do that now to avoid having an invalid value in
+     * *host_offset. */
    if (!alloc_cluster_offset) {
-        /* Allocate, if necessary at a given offset in the image file */
-        alloc_cluster_offset = start_of_cluster(s, *host_offset);
-        ret = do_alloc_cluster_offset(bs, guest_offset, &alloc_cluster_offset,
-                                      &nb_clusters);
-        if (ret < 0) {
-            goto fail;
-        }
-
-        /* Can't extend contiguous allocation */
-        if (nb_clusters == 0) {
-            *bytes = 0;
-            return 0;
-        }
-
-        /* !*host_offset would overwrite the image header and is reserved for
-         * "no host offset preferred". If 0 was a valid host offset, it'd
-         * trigger the following overlap check; do that now to avoid having an
-         * invalid value in *host_offset. */
-        if (!alloc_cluster_offset) {
-            ret = qcow2_pre_write_overlap_check(bs, 0, alloc_cluster_offset,
-                                                nb_clusters * s->cluster_size);
-            assert(ret < 0);
-            goto fail;
-        }
+        ret = qcow2_pre_write_overlap_check(bs, 0, alloc_cluster_offset,
+                                            nb_clusters * s->cluster_size);
+        assert(ret < 0);
+        goto fail;
    }

    /*
@@ -1325,8 +1225,6 @@ static int handle_alloc(BlockDriverState *bs, uint64_t guest_offset,
        .offset         = start_of_cluster(s, guest_offset),
        .nb_clusters    = nb_clusters,

-        .keep_old_clusters  = keep_old_clusters,
-
        .cow_start = {
            .offset     = 0,
            .nb_bytes   = offset_into_cluster(s, guest_offset),
@@ -1574,25 +1472,24 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
         * but rather fall through to the backing file.
         */
        switch (qcow2_get_cluster_type(old_l2_entry)) {
-        case QCOW2_CLUSTER_UNALLOCATED:
-            if (full_discard || !bs->backing) {
-                continue;
-            }
-            break;
+            case QCOW2_CLUSTER_UNALLOCATED:
+                if (full_discard || !bs->backing) {
+                    continue;
+                }
+                break;

-        case QCOW2_CLUSTER_ZERO_PLAIN:
-            if (!full_discard) {
-                continue;
-            }
-            break;
+            case QCOW2_CLUSTER_ZERO:
+                if (!full_discard) {
+                    continue;
+                }
+                break;

-        case QCOW2_CLUSTER_ZERO_ALLOC:
-        case QCOW2_CLUSTER_NORMAL:
-        case QCOW2_CLUSTER_COMPRESSED:
-            break;
+            case QCOW2_CLUSTER_NORMAL:
+            case QCOW2_CLUSTER_COMPRESSED:
+                break;

-        default:
-            abort();
+            default:
+                abort();
        }

        /* First remove L2 entries */
@@ -1612,36 +1509,35 @@ static int discard_single_l2(BlockDriverState *bs, uint64_t offset,
    return nb_clusters;
 }

-int qcow2_cluster_discard(BlockDriverState *bs, uint64_t offset,
-                          uint64_t bytes, enum qcow2_discard_type type,
-                          bool full_discard)
+int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
+    int nb_sectors, enum qcow2_discard_type type, bool full_discard)
 {
    BDRVQcow2State *s = bs->opaque;
-    uint64_t end_offset = offset + bytes;
+    uint64_t end_offset;
    uint64_t nb_clusters;
-    int64_t cleared;
    int ret;

-    /* Caller must pass aligned values, except at image end */
-    assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
-    assert(QEMU_IS_ALIGNED(end_offset, s->cluster_size) ||
-           end_offset == bs->total_sectors << BDRV_SECTOR_BITS);
+    end_offset = offset + (nb_sectors << BDRV_SECTOR_BITS);

-    nb_clusters = size_to_clusters(s, bytes);
+    /* The caller must cluster-align start; round end down except at EOF */
+    assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
+    if (end_offset != bs->total_sectors * BDRV_SECTOR_SIZE) {
+        end_offset = start_of_cluster(s, end_offset);
+    }
+
+    nb_clusters = size_to_clusters(s, end_offset - offset);

    s->cache_discards = true;

    /* Each L2 table is handled by its own loop iteration */
    while (nb_clusters > 0) {
-        cleared = discard_single_l2(bs, offset, nb_clusters, type,
-                                    full_discard);
-        if (cleared < 0) {
-            ret = cleared;
+        ret = discard_single_l2(bs, offset, nb_clusters, type, full_discard);
+        if (ret < 0) {
            goto fail;
        }

-        nb_clusters -= cleared;
-        offset += (cleared * s->cluster_size);
+        nb_clusters -= ret;
+        offset += (ret * s->cluster_size);
    }

    ret = 0;
@@ -1665,7 +1561,6 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
    int l2_index;
    int ret;
    int i;
-    bool unmap = !!(flags & BDRV_REQ_MAY_UNMAP);

    ret = get_cluster_table(bs, offset, &l2_table, &l2_index);
    if (ret < 0) {
@@ -1678,22 +1573,12 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,

    for (i = 0; i < nb_clusters; i++) {
        uint64_t old_offset;
-        QCow2ClusterType cluster_type;

        old_offset = be64_to_cpu(l2_table[l2_index + i]);

-        /*
-         * Minimize L2 changes if the cluster already reads back as
-         * zeroes with correct allocation.
-         */
-        cluster_type = qcow2_get_cluster_type(old_offset);
-        if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN ||
-            (cluster_type == QCOW2_CLUSTER_ZERO_ALLOC && !unmap)) {
-            continue;
-        }
-
+        /* Update L2 entries */
        qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table);
-        if (cluster_type == QCOW2_CLUSTER_COMPRESSED || unmap) {
+        if (old_offset & QCOW_OFLAG_COMPRESSED || flags & BDRV_REQ_MAY_UNMAP) {
            l2_table[l2_index + i] = cpu_to_be64(QCOW_OFLAG_ZERO);
            qcow2_free_any_clusters(bs, old_offset, 1, QCOW2_DISCARD_REQUEST);
        } else {
@@ -1706,39 +1591,31 @@ static int zero_single_l2(BlockDriverState *bs, uint64_t offset,
    return nb_clusters;
 }

-int qcow2_cluster_zeroize(BlockDriverState *bs, uint64_t offset,
-                          uint64_t bytes, int flags)
+int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors,
+                        int flags)
 {
    BDRVQcow2State *s = bs->opaque;
-    uint64_t end_offset = offset + bytes;
    uint64_t nb_clusters;
-    int64_t cleared;
    int ret;

-    /* Caller must pass aligned values, except at image end */
-    assert(QEMU_IS_ALIGNED(offset, s->cluster_size));
-    assert(QEMU_IS_ALIGNED(end_offset, s->cluster_size) ||
-           end_offset == bs->total_sectors << BDRV_SECTOR_BITS);
-
    /* The zero flag is only supported by version 3 and newer */
    if (s->qcow_version < 3) {
        return -ENOTSUP;
    }

    /* Each L2 table is handled by its own loop iteration */
-    nb_clusters = size_to_clusters(s, bytes);
+    nb_clusters = size_to_clusters(s, nb_sectors << BDRV_SECTOR_BITS);

    s->cache_discards = true;

    while (nb_clusters > 0) {
-        cleared = zero_single_l2(bs, offset, nb_clusters, flags);
-        if (cleared < 0) {
-            ret = cleared;
+        ret = zero_single_l2(bs, offset, nb_clusters, flags);
+        if (ret < 0) {
            goto fail;
        }

-        nb_clusters -= cleared;
-        offset += (cleared * s->cluster_size);
+        nb_clusters -= ret;
+        offset += (ret * s->cluster_size);
    }

    ret = 0;
@@ -1822,14 +1699,14 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
        for (j = 0; j < s->l2_size; j++) {
            uint64_t l2_entry = be64_to_cpu(l2_table[j]);
            int64_t offset = l2_entry & L2E_OFFSET_MASK;
-            QCow2ClusterType cluster_type = qcow2_get_cluster_type(l2_entry);
+            int cluster_type = qcow2_get_cluster_type(l2_entry);
+            bool preallocated = offset != 0;

-            if (cluster_type != QCOW2_CLUSTER_ZERO_PLAIN &&
-                cluster_type != QCOW2_CLUSTER_ZERO_ALLOC) {
+            if (cluster_type != QCOW2_CLUSTER_ZERO) {
                continue;
            }

-            if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
+            if (!preallocated) {
                if (!bs->backing) {
                    /* not backed; therefore we can simply deallocate the
                     * cluster */
@@ -1860,12 +1737,11 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,
            }

            if (offset_into_cluster(s, offset)) {
-                qcow2_signal_corruption(bs, true, -1, -1,
-                                        "Cluster allocation offset "
+                qcow2_signal_corruption(bs, true, -1, -1, "Data cluster offset "
                                        "%#" PRIx64 " unaligned (L2 offset: %#"
                                        PRIx64 ", L2 index: %#x)", offset,
                                        l2_offset, j);
-                if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
+                if (!preallocated) {
                    qcow2_free_clusters(bs, offset, s->cluster_size,
                                        QCOW2_DISCARD_ALWAYS);
                }
@@ -1875,7 +1751,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,

            ret = qcow2_pre_write_overlap_check(bs, 0, offset, s->cluster_size);
            if (ret < 0) {
-                if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
+                if (!preallocated) {
                    qcow2_free_clusters(bs, offset, s->cluster_size,
                                        QCOW2_DISCARD_ALWAYS);
                }
@@ -1884,7 +1760,7 @@ static int expand_zero_clusters_in_l1(BlockDriverState *bs, uint64_t *l1_table,

            ret = bdrv_pwrite_zeroes(bs->file, offset, s->cluster_size, 0);
            if (ret < 0) {
-                if (cluster_type == QCOW2_CLUSTER_ZERO_PLAIN) {
+                if (!preallocated) {
                    qcow2_free_clusters(bs, offset, s->cluster_size,
                                        QCOW2_DISCARD_ALWAYS);
                }
@@ -281,6 +281,25 @@ int qcow2_get_refcount(BlockDriverState *bs, int64_t cluster_index,
    return 0;
 }

+/*
+ * Rounds the refcount table size up to avoid growing the table for each single
+ * refcount block that is allocated.
+ */
+static unsigned int next_refcount_table_size(BDRVQcow2State *s,
+    unsigned int min_size)
+{
+    unsigned int min_clusters = (min_size >> (s->cluster_bits - 3)) + 1;
+    unsigned int refcount_table_clusters =
+        MAX(1, s->refcount_table_size >> (s->cluster_bits - 3));
+
+    while (min_clusters > refcount_table_clusters) {
+        refcount_table_clusters = (refcount_table_clusters * 3 + 1) / 2;
+    }
+
+    return refcount_table_clusters << (s->cluster_bits - 3);
+}
+
+
 /* Checks if two offsets are described by the same refcount block */
 static int in_same_refcount_block(BDRVQcow2State *s, uint64_t offset_a,
    uint64_t offset_b)
@@ -302,7 +321,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
 {
    BDRVQcow2State *s = bs->opaque;
    unsigned int refcount_table_index;
-    int64_t ret;
+    int ret;

    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);

@@ -377,7 +396,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
        ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
                                    refcount_block);
        if (ret < 0) {
-            goto fail;
+            goto fail_block;
        }

        memset(*refcount_block, 0, s->cluster_size);
@@ -392,12 +411,12 @@ static int alloc_refcount_block(BlockDriverState *bs,
        ret = update_refcount(bs, new_block, s->cluster_size, 1, false,
                              QCOW2_DISCARD_NEVER);
        if (ret < 0) {
-            goto fail;
+            goto fail_block;
        }

        ret = qcow2_cache_flush(bs, s->refcount_block_cache);
        if (ret < 0) {
-            goto fail;
+            goto fail_block;
        }

        /* Initialize the new refcount block only after updating its refcount,
@@ -405,7 +424,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
        ret = qcow2_cache_get_empty(bs, s->refcount_block_cache, new_block,
                                    refcount_block);
        if (ret < 0) {
-            goto fail;
+            goto fail_block;
        }

        memset(*refcount_block, 0, s->cluster_size);
@@ -416,7 +435,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
    qcow2_cache_entry_mark_dirty(bs, s->refcount_block_cache, *refcount_block);
    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
    if (ret < 0) {
-        goto fail;
+        goto fail_block;
    }

    /* If the refcount table is big enough, just hook the block up there */
@@ -427,7 +446,7 @@ static int alloc_refcount_block(BlockDriverState *bs,
            s->refcount_table_offset + refcount_table_index * sizeof(uint64_t),
            &data64, sizeof(data64));
        if (ret < 0) {
-            goto fail;
+            goto fail_block;
        }

        s->refcount_table[refcount_table_index] = new_block;
@@ -471,201 +490,74 @@ static int alloc_refcount_block(BlockDriverState *bs,
                                            (new_block >> s->cluster_bits) + 1),
                                        s->refcount_block_size);

+    if (blocks_used > QCOW_MAX_REFTABLE_SIZE / sizeof(uint64_t)) {
+        return -EFBIG;
+    }
+
+    /* And now we need at least one block more for the new metadata */
+    uint64_t table_size = next_refcount_table_size(s, blocks_used + 1);
+    uint64_t last_table_size;
+    uint64_t blocks_clusters;
+    do {
+        uint64_t table_clusters =
+            size_to_clusters(s, table_size * sizeof(uint64_t));
+        blocks_clusters = 1 +
+            DIV_ROUND_UP(table_clusters, s->refcount_block_size);
+        uint64_t meta_clusters = table_clusters + blocks_clusters;
+
+        last_table_size = table_size;
+        table_size = next_refcount_table_size(s, blocks_used +
+            DIV_ROUND_UP(meta_clusters, s->refcount_block_size));
+
+    } while (last_table_size != table_size);
+
+#ifdef DEBUG_ALLOC2
+    fprintf(stderr, "qcow2: Grow refcount table %" PRId32 " => %" PRId64 "\n",
+        s->refcount_table_size, table_size);
+#endif
+
    /* Create the new refcount table and blocks */
    uint64_t meta_offset = (blocks_used * s->refcount_block_size) *
        s->cluster_size;
+    uint64_t table_offset = meta_offset + blocks_clusters * s->cluster_size;
+    uint64_t *new_table = g_try_new0(uint64_t, table_size);
+    void *new_blocks = g_try_malloc0(blocks_clusters * s->cluster_size);

-    ret = qcow2_refcount_area(bs, meta_offset, 0, false,
-                              refcount_table_index, new_block);
-    if (ret < 0) {
-        return ret;
-    }
-
-    ret = load_refcount_block(bs, new_block, refcount_block);
-    if (ret < 0) {
-        return ret;
-    }
-
-    /* If we were trying to do the initial refcount update for some cluster
-     * allocation, we might have used the same clusters to store newly
-     * allocated metadata. Make the caller search some new space. */
-    return -EAGAIN;
-
-fail:
-    if (*refcount_block != NULL) {
-        qcow2_cache_put(bs, s->refcount_block_cache, refcount_block);
-    }
-    return ret;
-}
-
-/*
- * Starting at @start_offset, this function creates new self-covering refcount
- * structures: A new refcount table and refcount blocks which cover all of
- * themselves, and a number of @additional_clusters beyond their end.
- * @start_offset must be at the end of the image file, that is, there must be
- * only empty space beyond it.
- * If @exact_size is false, the refcount table will have 50 % more entries than
- * necessary so it will not need to grow again soon.
- * If @new_refblock_offset is not zero, it contains the offset of a refcount
- * block that should be entered into the new refcount table at index
- * @new_refblock_index.
- *
- * Returns: The offset after the new refcount structures (i.e. where the
- *          @additional_clusters may be placed) on success, -errno on error.
- */
-int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
-                            uint64_t additional_clusters, bool exact_size,
-                            int new_refblock_index,
-                            uint64_t new_refblock_offset)
-{
-    BDRVQcow2State *s = bs->opaque;
-    uint64_t total_refblock_count_u64, additional_refblock_count;
-    int total_refblock_count, table_size, area_reftable_index, table_clusters;
-    int i;
-    uint64_t table_offset, block_offset, end_offset;
-    int ret;
-    uint64_t *new_table;
-
-    assert(!(start_offset % s->cluster_size));
-
-    qcow2_refcount_metadata_size(start_offset / s->cluster_size +
-                                 additional_clusters,
-                                 s->cluster_size, s->refcount_order,
-                                 !exact_size, &total_refblock_count_u64);
-    if (total_refblock_count_u64 > QCOW_MAX_REFTABLE_SIZE) {
-        return -EFBIG;
-    }
-    total_refblock_count = total_refblock_count_u64;
-
-    /* Index in the refcount table of the first refcount block to cover the area
-     * of refcount structures we are about to create; we know that
-     * @total_refblock_count can cover @start_offset, so this will definitely
-     * fit into an int. */
-    area_reftable_index = (start_offset / s->cluster_size) /
-                          s->refcount_block_size;
-
-    if (exact_size) {
-        table_size = total_refblock_count;
-    } else {
-        table_size = total_refblock_count +
-                     DIV_ROUND_UP(total_refblock_count, 2);
-    }
-    /* The qcow2 file can only store the reftable size in number of clusters */
-    table_size = ROUND_UP(table_size, s->cluster_size / sizeof(uint64_t));
-    table_clusters = (table_size * sizeof(uint64_t)) / s->cluster_size;
-
-    if (table_size > QCOW_MAX_REFTABLE_SIZE) {
-        return -EFBIG;
-    }
-
-    new_table = g_try_new0(uint64_t, table_size);
-
-    assert(table_size > 0);
-    if (new_table == NULL) {
+    assert(table_size > 0 && blocks_clusters > 0);
+    if (new_table == NULL || new_blocks == NULL) {
        ret = -ENOMEM;
-        goto fail;
+        goto fail_table;
    }

    /* Fill the new refcount table */
-    if (table_size > s->max_refcount_table_index) {
-        /* We're actually growing the reftable */
-        memcpy(new_table, s->refcount_table,
-               (s->max_refcount_table_index + 1) * sizeof(uint64_t));
-    } else {
-        /* Improbable case: We're shrinking the reftable. However, the caller
-         * has assured us that there is only empty space beyond @start_offset,
-         * so we can simply drop all of the refblocks that won't fit into the
-         * new reftable. */
-        memcpy(new_table, s->refcount_table, table_size * sizeof(uint64_t));
+    memcpy(new_table, s->refcount_table,
+        s->refcount_table_size * sizeof(uint64_t));
+    new_table[refcount_table_index] = new_block;
+
+    int i;
+    for (i = 0; i < blocks_clusters; i++) {
+        new_table[blocks_used + i] = meta_offset + (i * s->cluster_size);
    }

-    if (new_refblock_offset) {
-        assert(new_refblock_index < total_refblock_count);
-        new_table[new_refblock_index] = new_refblock_offset;
+    /* Fill the refcount blocks */
+    uint64_t table_clusters = size_to_clusters(s, table_size * sizeof(uint64_t));
+    int block = 0;
+    for (i = 0; i < table_clusters + blocks_clusters; i++) {
+        s->set_refcount(new_blocks, block++, 1);
    }

-    /* Count how many new refblocks we have to create */
-    additional_refblock_count = 0;
-    for (i = area_reftable_index; i < total_refblock_count; i++) {
-        if (!new_table[i]) {
-            additional_refblock_count++;
-        }
-    }
-
-    table_offset = start_offset + additional_refblock_count * s->cluster_size;
-    end_offset = table_offset + table_clusters * s->cluster_size;
-
-    /* Fill the refcount blocks, and create new ones, if necessary */
-    block_offset = start_offset;
-    for (i = area_reftable_index; i < total_refblock_count; i++) {
-        void *refblock_data;
-        uint64_t first_offset_covered;
-
-        /* Reuse an existing refblock if possible, create a new one otherwise */
-        if (new_table[i]) {
-            ret = qcow2_cache_get(bs, s->refcount_block_cache, new_table[i],
-                                  &refblock_data);
-            if (ret < 0) {
-                goto fail;
-            }
-        } else {
-            ret = qcow2_cache_get_empty(bs, s->refcount_block_cache,
-                                        block_offset, &refblock_data);
-            if (ret < 0) {
-                goto fail;
-            }
-            memset(refblock_data, 0, s->cluster_size);
-            qcow2_cache_entry_mark_dirty(bs, s->refcount_block_cache,
-                                         refblock_data);
-
-            new_table[i] = block_offset;
-            block_offset += s->cluster_size;
-        }
-
-        /* First host offset covered by this refblock */
-        first_offset_covered = (uint64_t)i * s->refcount_block_size *
-                               s->cluster_size;
-        if (first_offset_covered < end_offset) {
-            int j, end_index;
-
-            /* Set the refcount of all of the new refcount structures to 1 */
-
-            if (first_offset_covered < start_offset) {
-                assert(i == area_reftable_index);
-                j = (start_offset - first_offset_covered) / s->cluster_size;
-                assert(j < s->refcount_block_size);
-            } else {
-                j = 0;
-            }
-
-            end_index = MIN((end_offset - first_offset_covered) /
-                            s->cluster_size,
-                            s->refcount_block_size);
-
-            for (; j < end_index; j++) {
-                /* The caller guaranteed us this space would be empty */
-                assert(s->get_refcount(refblock_data, j) == 0);
-                s->set_refcount(refblock_data, j, 1);
-            }
-
-            qcow2_cache_entry_mark_dirty(bs, s->refcount_block_cache,
-                                         refblock_data);
-        }
-
-        qcow2_cache_put(bs, s->refcount_block_cache, &refblock_data);
-    }
-
-    assert(block_offset == table_offset);
-
    /* Write refcount blocks to disk */
    BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC_WRITE_BLOCKS);
-    ret = qcow2_cache_flush(bs, s->refcount_block_cache);
+    ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks,
+        blocks_clusters * s->cluster_size);
+    g_free(new_blocks);
+    new_blocks = NULL;
    if (ret < 0) {
-        goto fail;
+        goto fail_table;
    }

    /* Write refcount table to disk */
-    for (i = 0; i < total_refblock_count; i++) {
+    for(i = 0; i < table_size; i++) {
        cpu_to_be64s(&new_table[i]);
    }

@@ -673,10 +565,10 @@ int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
    ret = bdrv_pwrite_sync(bs->file, table_offset, new_table,
        table_size * sizeof(uint64_t));
    if (ret < 0) {
-        goto fail;
+        goto fail_table;
    }

-    for (i = 0; i < total_refblock_count; i++) {
+    for(i = 0; i < table_size; i++) {
        be64_to_cpus(&new_table[i]);
    }

@@ -692,7 +584,7 @@ int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
                           offsetof(QCowHeader, refcount_table_offset),
                           &data, sizeof(data));
    if (ret < 0) {
-        goto fail;
+        goto fail_table;
    }

    /* And switch it in memory */
@@ -709,10 +601,23 @@ int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t start_offset,
    qcow2_free_clusters(bs, old_table_offset, old_table_size * sizeof(uint64_t),
                        QCOW2_DISCARD_OTHER);

-    return end_offset;
+    ret = load_refcount_block(bs, new_block, refcount_block);
+    if (ret < 0) {
+        return ret;
+    }

-fail:
+    /* If we were trying to do the initial refcount update for some cluster
+     * allocation, we might have used the same clusters to store newly
+     * allocated metadata. Make the caller search some new space. */
+    return -EAGAIN;
+
+fail_table:
+    g_free(new_blocks);
    g_free(new_table);
+fail_block:
+    if (*refcount_block != NULL) {
+        qcow2_cache_put(bs, s->refcount_block_cache, refcount_block);
+    }
    return ret;
 }

@@ -1123,17 +1028,18 @@ void qcow2_free_any_clusters(BlockDriverState *bs, uint64_t l2_entry,
        }
        break;
    case QCOW2_CLUSTER_NORMAL:
-    case QCOW2_CLUSTER_ZERO_ALLOC:
-        if (offset_into_cluster(s, l2_entry & L2E_OFFSET_MASK)) {
-            qcow2_signal_corruption(bs, false, -1, -1,
-                                    "Cannot free unaligned cluster %#llx",
-                                    l2_entry & L2E_OFFSET_MASK);
-        } else {
-            qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
-                                nb_clusters << s->cluster_bits, type);
+    case QCOW2_CLUSTER_ZERO:
+        if (l2_entry & L2E_OFFSET_MASK) {
+            if (offset_into_cluster(s, l2_entry & L2E_OFFSET_MASK)) {
+                qcow2_signal_corruption(bs, false, -1, -1,
+                                        "Cannot free unaligned cluster %#llx",
+                                        l2_entry & L2E_OFFSET_MASK);
+            } else {
+                qcow2_free_clusters(bs, l2_entry & L2E_OFFSET_MASK,
+                                    nb_clusters << s->cluster_bits, type);
+            }
        }
        break;
-    case QCOW2_CLUSTER_ZERO_PLAIN:
    case QCOW2_CLUSTER_UNALLOCATED:
        break;
    default:
@@ -1153,9 +1059,9 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
    int64_t l1_table_offset, int l1_size, int addend)
 {
    BDRVQcow2State *s = bs->opaque;
-    uint64_t *l1_table, *l2_table, l2_offset, entry, l1_size2, refcount;
+    uint64_t *l1_table, *l2_table, l2_offset, offset, l1_size2, refcount;
    bool l1_allocated = false;
-    int64_t old_entry, old_l2_offset;
+    int64_t old_offset, old_l2_offset;
    int i, j, l1_modified = 0, nb_csectors;
    int ret;

@@ -1183,16 +1089,15 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
            goto fail;
        }

-        for (i = 0; i < l1_size; i++) {
+        for(i = 0;i < l1_size; i++)
            be64_to_cpus(&l1_table[i]);
-        }
    } else {
        assert(l1_size == s->l1_size);
        l1_table = s->l1_table;
        l1_allocated = false;
    }

-    for (i = 0; i < l1_size; i++) {
+    for(i = 0; i < l1_size; i++) {
        l2_offset = l1_table[i];
        if (l2_offset) {
            old_l2_offset = l2_offset;
@@ -1212,79 +1117,81 @@ int qcow2_update_snapshot_refcount(BlockDriverState *bs,
                goto fail;
            }

-            for (j = 0; j < s->l2_size; j++) {
+            for(j = 0; j < s->l2_size; j++) {
                uint64_t cluster_index;
-                uint64_t offset;

-                entry = be64_to_cpu(l2_table[j]);
-                old_entry = entry;
-                entry &= ~QCOW_OFLAG_COPIED;
-                offset = entry & L2E_OFFSET_MASK;
+                offset = be64_to_cpu(l2_table[j]);
+                old_offset = offset;
+                offset &= ~QCOW_OFLAG_COPIED;

-                switch (qcow2_get_cluster_type(entry)) {
-                case QCOW2_CLUSTER_COMPRESSED:
-                    nb_csectors = ((entry >> s->csize_shift) &
-                                   s->csize_mask) + 1;
-                    if (addend != 0) {
-                        ret = update_refcount(bs,
-                                (entry & s->cluster_offset_mask) & ~511,
+                switch (qcow2_get_cluster_type(offset)) {
+                    case QCOW2_CLUSTER_COMPRESSED:
+                        nb_csectors = ((offset >> s->csize_shift) &
+                                       s->csize_mask) + 1;
+                        if (addend != 0) {
+                            ret = update_refcount(bs,
+                                (offset & s->cluster_offset_mask) & ~511,
                                nb_csectors * 512, abs(addend), addend < 0,
                                QCOW2_DISCARD_SNAPSHOT);
-                        if (ret < 0) {
+                            if (ret < 0) {
+                                goto fail;
+                            }
+                        }
+                        /* compressed clusters are never modified */
+                        refcount = 2;
+                        break;
+
+                    case QCOW2_CLUSTER_NORMAL:
+                    case QCOW2_CLUSTER_ZERO:
+                        if (offset_into_cluster(s, offset & L2E_OFFSET_MASK)) {
+                            qcow2_signal_corruption(bs, true, -1, -1, "Data "
+                                                    "cluster offset %#llx "
+                                                    "unaligned (L2 offset: %#"
+                                                    PRIx64 ", L2 index: %#x)",
+                                                    offset & L2E_OFFSET_MASK,
+                                                    l2_offset, j);
+                            ret = -EIO;
                            goto fail;
                        }
-                    }
-                    /* compressed clusters are never modified */
-                    refcount = 2;
-                    break;

-                case QCOW2_CLUSTER_NORMAL:
-                case QCOW2_CLUSTER_ZERO_ALLOC:
-                    if (offset_into_cluster(s, offset)) {
-                        qcow2_signal_corruption(bs, true, -1, -1, "Cluster "
-                                                "allocation offset %#" PRIx64
-                                                " unaligned (L2 offset: %#"
-                                                PRIx64 ", L2 index: %#x)",
-                                                offset, l2_offset, j);
-                        ret = -EIO;
-                        goto fail;
-                    }
-
-                    cluster_index = offset >> s->cluster_bits;
-                    assert(cluster_index);
-                    if (addend != 0) {
-                        ret = qcow2_update_cluster_refcount(bs,
+                        cluster_index = (offset & L2E_OFFSET_MASK) >> s->cluster_bits;
+                        if (!cluster_index) {
+                            /* unallocated */
+                            refcount = 0;
+                            break;
+                        }
+                        if (addend != 0) {
+                            ret = qcow2_update_cluster_refcount(bs,
                                    cluster_index, abs(addend), addend < 0,
                                    QCOW2_DISCARD_SNAPSHOT);
+                            if (ret < 0) {
+                                goto fail;
+                            }
+                        }
+
+                        ret = qcow2_get_refcount(bs, cluster_index, &refcount);
                        if (ret < 0) {
                            goto fail;
                        }
-                    }
+                        break;

-                    ret = qcow2_get_refcount(bs, cluster_index, &refcount);
-                    if (ret < 0) {
-                        goto fail;
-                    }
-                    break;
+                    case QCOW2_CLUSTER_UNALLOCATED:
+                        refcount = 0;
+                        break;

-                case QCOW2_CLUSTER_ZERO_PLAIN:
-                case QCOW2_CLUSTER_UNALLOCATED:
-                    refcount = 0;
-                    break;
-
-                default:
-                    abort();
+                    default:
+                        abort();
                }

                if (refcount == 1) {
-                    entry |= QCOW_OFLAG_COPIED;
+                    offset |= QCOW_OFLAG_COPIED;
                }
-                if (entry != old_entry) {
+                if (offset != old_offset) {
                    if (addend > 0) {
                        qcow2_cache_set_dependency(bs, s->l2_table_cache,
                            s->refcount_block_cache);
                    }
-                    l2_table[j] = cpu_to_be64(entry);
+                    l2_table[j] = cpu_to_be64(offset);
                    qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache,
                                                 l2_table);
                }
@@ -1418,10 +1325,11 @@ static int realloc_refcount_array(BDRVQcow2State *s, void **array,
 *
 * Modifies the number of errors in res.
 */
-int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
-                             void **refcount_table,
-                             int64_t *refcount_table_size,
-                             int64_t offset, int64_t size)
+static int inc_refcounts(BlockDriverState *bs,
+                         BdrvCheckResult *res,
+                         void **refcount_table,
+                         int64_t *refcount_table_size,
+                         int64_t offset, int64_t size)
 {
    BDRVQcow2State *s = bs->opaque;
    uint64_t start, last, cluster_offset, k, refcount;
@@ -1514,9 +1422,8 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            nb_csectors = ((l2_entry >> s->csize_shift) &
                           s->csize_mask) + 1;
            l2_entry &= s->cluster_offset_mask;
-            ret = qcow2_inc_refcounts_imrt(bs, res,
-                                           refcount_table, refcount_table_size,
-                                           l2_entry & ~511, nb_csectors * 512);
+            ret = inc_refcounts(bs, res, refcount_table, refcount_table_size,
+                                l2_entry & ~511, nb_csectors * 512);
            if (ret < 0) {
                goto fail;
            }
@@ -1534,7 +1441,12 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            }
            break;

-        case QCOW2_CLUSTER_ZERO_ALLOC:
+        case QCOW2_CLUSTER_ZERO:
+            if ((l2_entry & L2E_OFFSET_MASK) == 0) {
+                break;
+            }
+            /* fall through */
+
        case QCOW2_CLUSTER_NORMAL:
        {
            uint64_t offset = l2_entry & L2E_OFFSET_MASK;
@@ -1549,9 +1461,8 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            }

            /* Mark cluster as used */
-            ret = qcow2_inc_refcounts_imrt(bs, res,
-                                           refcount_table, refcount_table_size,
-                                           offset, s->cluster_size);
+            ret = inc_refcounts(bs, res, refcount_table, refcount_table_size,
+                                offset, s->cluster_size);
            if (ret < 0) {
                goto fail;
            }
@@ -1565,7 +1476,6 @@ static int check_refcounts_l2(BlockDriverState *bs, BdrvCheckResult *res,
            break;
        }

-        case QCOW2_CLUSTER_ZERO_PLAIN:
        case QCOW2_CLUSTER_UNALLOCATED:
            break;

@@ -1604,8 +1514,8 @@ static int check_refcounts_l1(BlockDriverState *bs,
    l1_size2 = l1_size * sizeof(uint64_t);

    /* Mark L1 table as used */
-    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, refcount_table_size,
-                                   l1_table_offset, l1_size2);
+    ret = inc_refcounts(bs, res, refcount_table, refcount_table_size,
+                        l1_table_offset, l1_size2);
    if (ret < 0) {
        goto fail;
    }
@@ -1634,9 +1544,8 @@ static int check_refcounts_l1(BlockDriverState *bs,
        if (l2_offset) {
            /* Mark L2 table as used */
            l2_offset &= L1E_OFFSET_MASK;
-            ret = qcow2_inc_refcounts_imrt(bs, res,
-                                           refcount_table, refcount_table_size,
-                                           l2_offset, s->cluster_size);
+            ret = inc_refcounts(bs, res, refcount_table, refcount_table_size,
+                                l2_offset, s->cluster_size);
            if (ret < 0) {
                goto fail;
            }
@@ -1729,10 +1638,10 @@ static int check_oflag_copied(BlockDriverState *bs, BdrvCheckResult *res,
        for (j = 0; j < s->l2_size; j++) {
            uint64_t l2_entry = be64_to_cpu(l2_table[j]);
            uint64_t data_offset = l2_entry & L2E_OFFSET_MASK;
-            QCow2ClusterType cluster_type = qcow2_get_cluster_type(l2_entry);
+            int cluster_type = qcow2_get_cluster_type(l2_entry);

-            if (cluster_type == QCOW2_CLUSTER_NORMAL ||
-                cluster_type == QCOW2_CLUSTER_ZERO_ALLOC) {
+            if ((cluster_type == QCOW2_CLUSTER_NORMAL) ||
+                ((cluster_type == QCOW2_CLUSTER_ZERO) && (data_offset != 0))) {
                ret = qcow2_get_refcount(bs,
                                         data_offset >> s->cluster_bits,
                                         &refcount);
@@ -1827,7 +1736,7 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                }

                ret = bdrv_truncate(bs->file, offset + s->cluster_size,
-                                    PREALLOC_MODE_OFF, &local_err);
+                                    &local_err);
                if (ret < 0) {
                    error_report_err(local_err);
                    goto resize_fail;
@@ -1854,15 +1763,14 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
                }

                res->corruptions_fixed++;
-                ret = qcow2_inc_refcounts_imrt(bs, res,
-                                               refcount_table, nb_clusters,
-                                               offset, s->cluster_size);
+                ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
+                                    offset, s->cluster_size);
                if (ret < 0) {
                    return ret;
                }
                /* No need to check whether the refcount is now greater than 1:
                 * This area was just allocated and zeroed, so it can only be
-                 * exactly 1 after qcow2_inc_refcounts_imrt() */
+                 * exactly 1 after inc_refcounts() */
                continue;

 resize_fail:
@@ -1877,8 +1785,8 @@ resize_fail:
        }

        if (offset != 0) {
-            ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
-                                           offset, s->cluster_size);
+            ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
+                                offset, s->cluster_size);
            if (ret < 0) {
                return ret;
            }
@@ -1918,8 +1826,8 @@ static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
    }

    /* header */
-    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
-                                   0, s->cluster_size);
+    ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
+                        0, s->cluster_size);
    if (ret < 0) {
        return ret;
    }
@@ -1940,32 +1848,16 @@ static int calculate_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
            return ret;
        }
    }
-    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
-                                   s->snapshots_offset, s->snapshots_size);
+    ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
+                        s->snapshots_offset, s->snapshots_size);
    if (ret < 0) {
        return ret;
    }

    /* refcount data */
-    ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
-                                   s->refcount_table_offset,
-                                   s->refcount_table_size * sizeof(uint64_t));
-    if (ret < 0) {
-        return ret;
-    }
-
-    /* encryption */
-    if (s->crypto_header.length) {
-        ret = qcow2_inc_refcounts_imrt(bs, res, refcount_table, nb_clusters,
-                                       s->crypto_header.offset,
-                                       s->crypto_header.length);
-        if (ret < 0) {
-            return ret;
-        }
-    }
-
-    /* bitmaps */
-    ret = qcow2_check_bitmaps_refcounts(bs, res, refcount_table, nb_clusters);
+    ret = inc_refcounts(bs, res, refcount_table, nb_clusters,
+                        s->refcount_table_offset,
+                        s->refcount_table_size * sizeof(uint64_t));
    if (ret < 0) {
        return ret;
    }
@@ -2189,8 +2081,6 @@ write_refblocks:
             * this will leak that range, but we can easily fix that by running
             * a leak-fixing check after this rebuild operation */
            reftable_offset = -1;
-        } else {
-            assert(on_disk_reftable);
        }
        on_disk_reftable[refblock_index] = refblock_offset;

@@ -2260,6 +2150,8 @@ write_refblocks:
        goto write_refblocks;
    }

+    assert(on_disk_reftable);
+
    for (refblock_index = 0; refblock_index < reftable_size; refblock_index++) {
        cpu_to_be64s(&on_disk_reftable[refblock_index]);
    }
@@ -440,9 +440,10 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)

    /* The VM state isn't needed any more in the active L1 table; in fact, it
     * hurts by causing expensive COW for the next snapshot. */
-    qcow2_cluster_discard(bs, qcow2_vm_state_offset(s),
-                          align_offset(sn->vm_state_size, s->cluster_size),
-                          QCOW2_DISCARD_NEVER, false);
+    qcow2_discard_clusters(bs, qcow2_vm_state_offset(s),
+                           align_offset(sn->vm_state_size, s->cluster_size)
+                                >> BDRV_SECTOR_BITS,
+                           QCOW2_DISCARD_NEVER, false);

 #ifdef DEBUG_ALLOC
    {
@@ -25,7 +25,7 @@
 #ifndef BLOCK_QCOW2_H
 #define BLOCK_QCOW2_H

-#include "crypto/block.h"
+#include "crypto/cipher.h"
 #include "qemu/coroutine.h"

 //#define DEBUG_ALLOC
@@ -36,7 +36,6 @@

 #define QCOW_CRYPT_NONE 0
 #define QCOW_CRYPT_AES  1
-#define QCOW_CRYPT_LUKS 2

 #define QCOW_MAX_CRYPT_CLUSTERS 32
 #define QCOW_MAX_SNAPSHOTS 65536
@@ -53,10 +52,6 @@
 * space for snapshot names and IDs */
 #define QCOW_MAX_SNAPSHOTS_SIZE (1024 * QCOW_MAX_SNAPSHOTS)

-/* Bitmap header extension constraints */
-#define QCOW2_MAX_BITMAPS 65535
-#define QCOW2_MAX_BITMAP_DIRECTORY_SIZE (1024 * QCOW2_MAX_BITMAPS)
-
 /* indicate that the refcount of the referenced cluster is exactly one. */
 #define QCOW_OFLAG_COPIED     (1ULL << 63)
 /* indicate that the cluster is compressed (they never have the copied flag) */
@@ -168,11 +163,6 @@ typedef struct QCowSnapshot {
 struct Qcow2Cache;
 typedef struct Qcow2Cache Qcow2Cache;

-typedef struct Qcow2CryptoHeaderExtension {
-    uint64_t offset;
-    uint64_t length;
-} QEMU_PACKED Qcow2CryptoHeaderExtension;
-
 typedef struct Qcow2UnknownHeaderExtension {
    uint32_t magic;
    uint32_t len;
@@ -205,14 +195,6 @@ enum {
    QCOW2_COMPAT_FEAT_MASK            = QCOW2_COMPAT_LAZY_REFCOUNTS,
 };

-/* Autoclear feature bits */
-enum {
-    QCOW2_AUTOCLEAR_BITMAPS_BITNR = 0,
-    QCOW2_AUTOCLEAR_BITMAPS       = 1 << QCOW2_AUTOCLEAR_BITMAPS_BITNR,
-
-    QCOW2_AUTOCLEAR_MASK          = QCOW2_AUTOCLEAR_BITMAPS,
-};
-
 enum qcow2_discard_type {
    QCOW2_DISCARD_NEVER = 0,
    QCOW2_DISCARD_ALWAYS,
@@ -240,13 +222,6 @@ typedef uint64_t Qcow2GetRefcountFunc(const void *refcount_array,
 typedef void Qcow2SetRefcountFunc(void *refcount_array,
                                  uint64_t index, uint64_t value);

-typedef struct Qcow2BitmapHeaderExt {
-    uint32_t nb_bitmaps;
-    uint32_t reserved32;
-    uint64_t bitmap_directory_size;
-    uint64_t bitmap_directory_offset;
-} QEMU_PACKED Qcow2BitmapHeaderExt;
-
 typedef struct BDRVQcow2State {
    int cluster_bits;
    int cluster_size;
@@ -282,21 +257,13 @@ typedef struct BDRVQcow2State {

    CoMutex lock;

-    Qcow2CryptoHeaderExtension crypto_header; /* QCow2 header extension */
-    QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
-    QCryptoBlock *crypto; /* Disk encryption format driver */
-    bool crypt_physical_offset; /* Whether to use virtual or physical offset
-                                   for encryption initialization vector tweak */
+    QCryptoCipher *cipher; /* current cipher, NULL if no key yet */
    uint32_t crypt_method_header;
    uint64_t snapshots_offset;
    int snapshots_size;
    unsigned int nb_snapshots;
    QCowSnapshot *snapshots;

-    uint32_t nb_bitmaps;
-    uint64_t bitmap_directory_size;
-    uint64_t bitmap_directory_offset;
-
    int flags;
    int qcow_version;
    bool use_lazy_refcounts;
@@ -334,10 +301,10 @@ typedef struct Qcow2COWRegion {
     * Offset of the COW region in bytes from the start of the first cluster
     * touched by the request.
     */
-    unsigned    offset;
+    uint64_t    offset;

    /** Number of bytes to copy */
-    unsigned    nb_bytes;
+    int         nb_bytes;
 } Qcow2COWRegion;

 /**
@@ -355,9 +322,6 @@ typedef struct QCowL2Meta
    /** Number of newly allocated clusters */
    int nb_clusters;

-    /** Do not free the old clusters */
-    bool keep_old_clusters;
-
    /**
     * Requests that overlap with this allocation and wait to be restarted
     * when the allocating request has completed.
@@ -376,26 +340,18 @@ typedef struct QCowL2Meta
     */
    Qcow2COWRegion cow_end;

-    /**
-     * The I/O vector with the data from the actual guest write request.
-     * If non-NULL, this is meant to be merged together with the data
-     * from @cow_start and @cow_end into one single write operation.
-     */
-    QEMUIOVector *data_qiov;
-
    /** Pointer to next L2Meta of the same write request */
    struct QCowL2Meta *next;

    QLIST_ENTRY(QCowL2Meta) next_in_flight;
 } QCowL2Meta;

-typedef enum QCow2ClusterType {
+enum {
    QCOW2_CLUSTER_UNALLOCATED,
-    QCOW2_CLUSTER_ZERO_PLAIN,
-    QCOW2_CLUSTER_ZERO_ALLOC,
    QCOW2_CLUSTER_NORMAL,
    QCOW2_CLUSTER_COMPRESSED,
-} QCow2ClusterType;
+    QCOW2_CLUSTER_ZERO
+};

 typedef enum QCow2MetadataOverlap {
    QCOW2_OL_MAIN_HEADER_BITNR    = 0,
@@ -484,15 +440,12 @@ static inline uint64_t qcow2_max_refcount_clusters(BDRVQcow2State *s)
    return QCOW_MAX_REFTABLE_SIZE >> s->cluster_bits;
 }

-static inline QCow2ClusterType qcow2_get_cluster_type(uint64_t l2_entry)
+static inline int qcow2_get_cluster_type(uint64_t l2_entry)
 {
    if (l2_entry & QCOW_OFLAG_COMPRESSED) {
        return QCOW2_CLUSTER_COMPRESSED;
    } else if (l2_entry & QCOW_OFLAG_ZERO) {
-        if (l2_entry & L2E_OFFSET_MASK) {
-            return QCOW2_CLUSTER_ZERO_ALLOC;
-        }
-        return QCOW2_CLUSTER_ZERO_PLAIN;
+        return QCOW2_CLUSTER_ZERO;
    } else if (!(l2_entry & L2E_OFFSET_MASK)) {
        return QCOW2_CLUSTER_UNALLOCATED;
    } else {
@@ -525,10 +478,6 @@ static inline uint64_t refcount_diff(uint64_t r1, uint64_t r2)
 int qcow2_backing_read1(BlockDriverState *bs, QEMUIOVector *qiov,
                  int64_t sector_num, int nb_sectors);

-int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
-                                     int refcount_order, bool generous_increase,
-                                     uint64_t *refblock_count);
-
 int qcow2_mark_dirty(BlockDriverState *bs);
 int qcow2_mark_corrupt(BlockDriverState *bs);
 int qcow2_mark_consistent(BlockDriverState *bs);
@@ -549,11 +498,6 @@ int qcow2_update_cluster_refcount(BlockDriverState *bs, int64_t cluster_index,
                                  uint64_t addend, bool decrease,
                                  enum qcow2_discard_type type);

-int64_t qcow2_refcount_area(BlockDriverState *bs, uint64_t offset,
-                            uint64_t additional_clusters, bool exact_size,
-                            int new_refblock_index,
-                            uint64_t new_refblock_offset);
-
 int64_t qcow2_alloc_clusters(BlockDriverState *bs, uint64_t size);
 int64_t qcow2_alloc_clusters_at(BlockDriverState *bs, uint64_t offset,
                                int64_t nb_clusters);
@@ -576,10 +520,6 @@ int qcow2_check_metadata_overlap(BlockDriverState *bs, int ign, int64_t offset,
                                 int64_t size);
 int qcow2_pre_write_overlap_check(BlockDriverState *bs, int ign, int64_t offset,
                                  int64_t size);
-int qcow2_inc_refcounts_imrt(BlockDriverState *bs, BdrvCheckResult *res,
-                             void **refcount_table,
-                             int64_t *refcount_table_size,
-                             int64_t offset, int64_t size);

 int qcow2_change_refcount_order(BlockDriverState *bs, int refcount_order,
                                BlockDriverAmendStatusCB *status_cb,
@@ -591,7 +531,8 @@ int qcow2_grow_l1_table(BlockDriverState *bs, uint64_t min_size,
 int qcow2_write_l1_entry(BlockDriverState *bs, int l1_index);
 int qcow2_decompress_cluster(BlockDriverState *bs, uint64_t cluster_offset);
 int qcow2_encrypt_sectors(BDRVQcow2State *s, int64_t sector_num,
-                          uint8_t *buf, int nb_sectors, bool enc, Error **errp);
+                          uint8_t *out_buf, const uint8_t *in_buf,
+                          int nb_sectors, bool enc, Error **errp);

 int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset,
                             unsigned int *bytes, uint64_t *cluster_offset);
@@ -603,11 +544,10 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
                                         int compressed_size);

 int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, QCowL2Meta *m);
-int qcow2_cluster_discard(BlockDriverState *bs, uint64_t offset,
-                          uint64_t bytes, enum qcow2_discard_type type,
-                          bool full_discard);
-int qcow2_cluster_zeroize(BlockDriverState *bs, uint64_t offset,
-                          uint64_t bytes, int flags);
+int qcow2_discard_clusters(BlockDriverState *bs, uint64_t offset,
+    int nb_sectors, enum qcow2_discard_type type, bool full_discard);
+int qcow2_zero_clusters(BlockDriverState *bs, uint64_t offset, int nb_sectors,
+                        int flags);

 int qcow2_expand_zero_clusters(BlockDriverState *bs,
                               BlockDriverAmendStatusCB *status_cb,
@@ -650,20 +590,4 @@ int qcow2_cache_get_empty(BlockDriverState *bs, Qcow2Cache *c, uint64_t offset,
    void **table);
 void qcow2_cache_put(BlockDriverState *bs, Qcow2Cache *c, void **table);

-/* qcow2-bitmap.c functions */
-int qcow2_check_bitmaps_refcounts(BlockDriverState *bs, BdrvCheckResult *res,
-                                  void **refcount_table,
-                                  int64_t *refcount_table_size);
-bool qcow2_load_autoloading_dirty_bitmaps(BlockDriverState *bs, Error **errp);
-int qcow2_reopen_bitmaps_rw(BlockDriverState *bs, Error **errp);
-void qcow2_store_persistent_dirty_bitmaps(BlockDriverState *bs, Error **errp);
-int qcow2_reopen_bitmaps_ro(BlockDriverState *bs, Error **errp);
-bool qcow2_can_store_new_dirty_bitmap(BlockDriverState *bs,
-                                      const char *name,
-                                      uint32_t granularity,
-                                      Error **errp);
-void qcow2_remove_persistent_dirty_bitmap(BlockDriverState *bs,
-                                          const char *name,
-                                          Error **errp);
-
 #endif
@@ -61,65 +61,37 @@ static unsigned int qed_count_contiguous_clusters(BDRVQEDState *s,
    return i - index;
 }

-/**
- * Find the offset of a data cluster
- *
- * @s:          QED state
- * @request:    L2 cache entry
- * @pos:        Byte position in device
- * @len:        Number of bytes (may be shortened on return)
- * @img_offset: Contains offset in the image file on success
- *
- * This function translates a position in the block device to an offset in the
- * image file. The translated offset or unallocated range in the image file is
- * reported back in *img_offset and *len.
- *
- * If the L2 table exists, request->l2_table points to the L2 table cache entry
- * and the caller must free the reference when they are finished.  The cache
- * entry is exposed in this way to avoid callers having to read the L2 table
- * again later during request processing.  If request->l2_table is non-NULL it
- * will be unreferenced before taking on the new cache entry.
- *
- * On success QED_CLUSTER_FOUND is returned and img_offset/len are a contiguous
- * range in the image file.
- *
- * On failure QED_CLUSTER_L2 or QED_CLUSTER_L1 is returned for missing L2 or L1
- * table offset, respectively. len is number of contiguous unallocated bytes.
- *
- * Called with table_lock held.
- */
-int coroutine_fn qed_find_cluster(BDRVQEDState *s, QEDRequest *request,
-                                  uint64_t pos, size_t *len,
-                                  uint64_t *img_offset)
+typedef struct {
+    BDRVQEDState *s;
+    uint64_t pos;
+    size_t len;
+
+    QEDRequest *request;
+
+    /* User callback */
+    QEDFindClusterFunc *cb;
+    void *opaque;
+} QEDFindClusterCB;
+
+static void qed_find_cluster_cb(void *opaque, int ret)
 {
-    uint64_t l2_offset;
+    QEDFindClusterCB *find_cluster_cb = opaque;
+    BDRVQEDState *s = find_cluster_cb->s;
+    QEDRequest *request = find_cluster_cb->request;
    uint64_t offset = 0;
+    size_t len = 0;
    unsigned int index;
    unsigned int n;
-    int ret;

-    /* Limit length to L2 boundary.  Requests are broken up at the L2 boundary
-     * so that a request acts on one L2 table at a time.
-     */
-    *len = MIN(*len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos);
-
-    l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)];
-    if (qed_offset_is_unalloc_cluster(l2_offset)) {
-        *img_offset = 0;
-        return QED_CLUSTER_L1;
-    }
-    if (!qed_check_table_offset(s, l2_offset)) {
-        *img_offset = *len = 0;
-        return -EINVAL;
-    }
-
-    ret = qed_read_l2_table(s, request, l2_offset);
+    qed_acquire(s);
    if (ret) {
        goto out;
    }

-    index = qed_l2_index(s, pos);
-    n = qed_bytes_to_clusters(s, qed_offset_into_cluster(s, pos) + *len);
+    index = qed_l2_index(s, find_cluster_cb->pos);
+    n = qed_bytes_to_clusters(s,
+                              qed_offset_into_cluster(s, find_cluster_cb->pos) +
+                              find_cluster_cb->len);
    n = qed_count_contiguous_clusters(s, request->l2_table->table,
                                      index, n, &offset);

@@ -133,10 +105,64 @@ int coroutine_fn qed_find_cluster(BDRVQEDState *s, QEDRequest *request,
        ret = -EINVAL;
    }

-    *len = MIN(*len,
-               n * s->header.cluster_size - qed_offset_into_cluster(s, pos));
+    len = MIN(find_cluster_cb->len, n * s->header.cluster_size -
+              qed_offset_into_cluster(s, find_cluster_cb->pos));

 out:
-    *img_offset = offset;
-    return ret;
+    find_cluster_cb->cb(find_cluster_cb->opaque, ret, offset, len);
+    qed_release(s);
+    g_free(find_cluster_cb);
+}
+
+/**
+ * Find the offset of a data cluster
+ *
+ * @s:          QED state
+ * @request:    L2 cache entry
+ * @pos:        Byte position in device
+ * @len:        Number of bytes
+ * @cb:         Completion function
+ * @opaque:     User data for completion function
+ *
+ * This function translates a position in the block device to an offset in the
+ * image file.  It invokes the cb completion callback to report back the
+ * translated offset or unallocated range in the image file.
+ *
+ * If the L2 table exists, request->l2_table points to the L2 table cache entry
+ * and the caller must free the reference when they are finished.  The cache
+ * entry is exposed in this way to avoid callers having to read the L2 table
+ * again later during request processing.  If request->l2_table is non-NULL it
+ * will be unreferenced before taking on the new cache entry.
+ */
+void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
+                      size_t len, QEDFindClusterFunc *cb, void *opaque)
+{
+    QEDFindClusterCB *find_cluster_cb;
+    uint64_t l2_offset;
+
+    /* Limit length to L2 boundary.  Requests are broken up at the L2 boundary
+     * so that a request acts on one L2 table at a time.
+     */
+    len = MIN(len, (((pos >> s->l1_shift) + 1) << s->l1_shift) - pos);
+
+    l2_offset = s->l1_table->offsets[qed_l1_index(s, pos)];
+    if (qed_offset_is_unalloc_cluster(l2_offset)) {
+        cb(opaque, QED_CLUSTER_L1, 0, len);
+        return;
+    }
+    if (!qed_check_table_offset(s, l2_offset)) {
+        cb(opaque, -EINVAL, 0, 0);
+        return;
+    }
+
+    find_cluster_cb = g_malloc(sizeof(*find_cluster_cb));
+    find_cluster_cb->s = s;
+    find_cluster_cb->pos = pos;
+    find_cluster_cb->len = len;
+    find_cluster_cb->cb = cb;
+    find_cluster_cb->opaque = opaque;
+    find_cluster_cb->request = request;
+
+    qed_read_l2_table(s, request, l2_offset,
+                      qed_find_cluster_cb, find_cluster_cb);
 }
@@ -0,0 +1,33 @@
+/*
+ * QEMU Enhanced Disk Format
+ *
+ * Copyright IBM, Corp. 2010
+ *
+ * Authors:
+ *  Stefan Hajnoczi   <stefanha@linux.vnet.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qed.h"
+
+void *gencb_alloc(size_t len, BlockCompletionFunc *cb, void *opaque)
+{
+    GenericCB *gencb = g_malloc(len);
+    gencb->cb = cb;
+    gencb->opaque = opaque;
+    return gencb;
+}
+
+void gencb_complete(void *opaque, int ret)
+{
+    GenericCB *gencb = opaque;
+    BlockCompletionFunc *cb = gencb->cb;
+    void *user_opaque = gencb->opaque;
+
+    g_free(gencb);
+    cb(user_opaque, ret);
+}
@@ -101,8 +101,6 @@ CachedL2Table *qed_alloc_l2_cache_entry(L2TableCache *l2_cache)
 /**
 * Decrease an entry's reference count and free if necessary when the reference
 * count drops to zero.
- *
- * Called with table_lock held.
 */
 void qed_unref_l2_cache_entry(CachedL2Table *entry)
 {
@@ -124,8 +122,6 @@ void qed_unref_l2_cache_entry(CachedL2Table *entry)
 *
 * For a cached entry, this function increases the reference count and returns
 * the entry.
- *
- * Called with table_lock held.
 */
 CachedL2Table *qed_find_l2_cache_entry(L2TableCache *l2_cache, uint64_t offset)
 {
@@ -154,8 +150,6 @@ CachedL2Table *qed_find_l2_cache_entry(L2TableCache *l2_cache, uint64_t offset)
 * N.B. This function steals a reference to the l2_table from the caller so the
 * caller must obtain a new reference by issuing a call to
 * qed_find_l2_cache_entry().
- *
- * Called with table_lock held.
 */
 void qed_commit_l2_cache_entry(L2TableCache *l2_cache, CachedL2Table *l2_table)
 {
@@ -18,43 +18,99 @@
 #include "qed.h"
 #include "qemu/bswap.h"

-/* Called either from qed_check or with table_lock held.  */
-static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)
-{
+typedef struct {
+    GenericCB gencb;
+    BDRVQEDState *s;
+    QEDTable *table;
+
+    struct iovec iov;
    QEMUIOVector qiov;
-    int noffsets;
-    int i, ret;
+} QEDReadTableCB;

-    struct iovec iov = {
-        .iov_base = table->offsets,
-        .iov_len = s->header.cluster_size * s->header.table_size,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+static void qed_read_table_cb(void *opaque, int ret)
+{
+    QEDReadTableCB *read_table_cb = opaque;
+    QEDTable *table = read_table_cb->table;
+    BDRVQEDState *s = read_table_cb->s;
+    int noffsets = read_table_cb->qiov.size / sizeof(uint64_t);
+    int i;

-    trace_qed_read_table(s, offset, table);
-
-    if (qemu_in_coroutine()) {
-        qemu_co_mutex_unlock(&s->table_lock);
-    }
-    ret = bdrv_preadv(s->bs->file, offset, &qiov);
-    if (qemu_in_coroutine()) {
-        qemu_co_mutex_lock(&s->table_lock);
-    }
-    if (ret < 0) {
+    /* Handle I/O error */
+    if (ret) {
        goto out;
    }

    /* Byteswap offsets */
-    noffsets = qiov.size / sizeof(uint64_t);
+    qed_acquire(s);
    for (i = 0; i < noffsets; i++) {
        table->offsets[i] = le64_to_cpu(table->offsets[i]);
    }
+    qed_release(s);

-    ret = 0;
 out:
    /* Completion */
-    trace_qed_read_table_cb(s, table, ret);
-    return ret;
+    trace_qed_read_table_cb(s, read_table_cb->table, ret);
+    gencb_complete(&read_table_cb->gencb, ret);
+}
+
+static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
+                           BlockCompletionFunc *cb, void *opaque)
+{
+    QEDReadTableCB *read_table_cb = gencb_alloc(sizeof(*read_table_cb),
+                                                cb, opaque);
+    QEMUIOVector *qiov = &read_table_cb->qiov;
+
+    trace_qed_read_table(s, offset, table);
+
+    read_table_cb->s = s;
+    read_table_cb->table = table;
+    read_table_cb->iov.iov_base = table->offsets,
+    read_table_cb->iov.iov_len = s->header.cluster_size * s->header.table_size,
+
+    qemu_iovec_init_external(qiov, &read_table_cb->iov, 1);
+    bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
+                   qiov->size / BDRV_SECTOR_SIZE,
+                   qed_read_table_cb, read_table_cb);
+}
+
+typedef struct {
+    GenericCB gencb;
+    BDRVQEDState *s;
+    QEDTable *orig_table;
+    QEDTable *table;
+    bool flush;             /* flush after write? */
+
+    struct iovec iov;
+    QEMUIOVector qiov;
+} QEDWriteTableCB;
+
+static void qed_write_table_cb(void *opaque, int ret)
+{
+    QEDWriteTableCB *write_table_cb = opaque;
+    BDRVQEDState *s = write_table_cb->s;
+
+    trace_qed_write_table_cb(s,
+                             write_table_cb->orig_table,
+                             write_table_cb->flush,
+                             ret);
+
+    if (ret) {
+        goto out;
+    }
+
+    if (write_table_cb->flush) {
+        /* We still need to flush first */
+        write_table_cb->flush = false;
+        qed_acquire(s);
+        bdrv_aio_flush(write_table_cb->s->bs, qed_write_table_cb,
+                       write_table_cb);
+        qed_release(s);
+        return;
+    }
+
+out:
+    qemu_vfree(write_table_cb->table);
+    gencb_complete(&write_table_cb->gencb, ret);
 }

 /**
@@ -66,19 +122,17 @@ out:
 * @index:      Index of first element
 * @n:          Number of elements
 * @flush:      Whether or not to sync to disk
- *
- * Called either from qed_check or with table_lock held.
+ * @cb:         Completion function
+ * @opaque:     Argument for completion function
 */
-static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
-                           unsigned int index, unsigned int n, bool flush)
+static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
+                            unsigned int index, unsigned int n, bool flush,
+                            BlockCompletionFunc *cb, void *opaque)
 {
+    QEDWriteTableCB *write_table_cb;
    unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
    unsigned int start, end, i;
-    QEDTable *new_table;
-    struct iovec iov;
-    QEMUIOVector qiov;
    size_t len_bytes;
-    int ret;

    trace_qed_write_table(s, offset, table, index, n);

@@ -88,120 +142,157 @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,

    len_bytes = (end - start) * sizeof(uint64_t);

-    new_table = qemu_blockalign(s->bs, len_bytes);
-    iov = (struct iovec) {
-        .iov_base = new_table->offsets,
-        .iov_len = len_bytes,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    write_table_cb = gencb_alloc(sizeof(*write_table_cb), cb, opaque);
+    write_table_cb->s = s;
+    write_table_cb->orig_table = table;
+    write_table_cb->flush = flush;
+    write_table_cb->table = qemu_blockalign(s->bs, len_bytes);
+    write_table_cb->iov.iov_base = write_table_cb->table->offsets;
+    write_table_cb->iov.iov_len = len_bytes;
+    qemu_iovec_init_external(&write_table_cb->qiov, &write_table_cb->iov, 1);

    /* Byteswap table */
    for (i = start; i < end; i++) {
        uint64_t le_offset = cpu_to_le64(table->offsets[i]);
-        new_table->offsets[i - start] = le_offset;
+        write_table_cb->table->offsets[i - start] = le_offset;
    }

    /* Adjust for offset into table */
    offset += start * sizeof(uint64_t);

-    if (qemu_in_coroutine()) {
-        qemu_co_mutex_unlock(&s->table_lock);
-    }
-    ret = bdrv_pwritev(s->bs->file, offset, &qiov);
-    if (qemu_in_coroutine()) {
-        qemu_co_mutex_lock(&s->table_lock);
-    }
-    trace_qed_write_table_cb(s, table, flush, ret);
-    if (ret < 0) {
-        goto out;
-    }
+    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
+                    &write_table_cb->qiov,
+                    write_table_cb->qiov.size / BDRV_SECTOR_SIZE,
+                    qed_write_table_cb, write_table_cb);
+}

-    if (flush) {
-        ret = bdrv_flush(s->bs);
-        if (ret < 0) {
-            goto out;
-        }
-    }
-
-    ret = 0;
-out:
-    qemu_vfree(new_table);
-    return ret;
+/**
+ * Propagate return value from async callback
+ */
+static void qed_sync_cb(void *opaque, int ret)
+{
+    *(int *)opaque = ret;
 }

 int qed_read_l1_table_sync(BDRVQEDState *s)
 {
-    return qed_read_table(s, s->header.l1_table_offset, s->l1_table);
+    int ret = -EINPROGRESS;
+
+    qed_read_table(s, s->header.l1_table_offset,
+                   s->l1_table, qed_sync_cb, &ret);
+    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+
+    return ret;
 }

-/* Called either from qed_check or with table_lock held.  */
-int qed_write_l1_table(BDRVQEDState *s, unsigned int index, unsigned int n)
+void qed_write_l1_table(BDRVQEDState *s, unsigned int index, unsigned int n,
+                        BlockCompletionFunc *cb, void *opaque)
 {
    BLKDBG_EVENT(s->bs->file, BLKDBG_L1_UPDATE);
-    return qed_write_table(s, s->header.l1_table_offset,
-                           s->l1_table, index, n, false);
+    qed_write_table(s, s->header.l1_table_offset,
+                    s->l1_table, index, n, false, cb, opaque);
 }

 int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,
                            unsigned int n)
 {
-    return qed_write_l1_table(s, index, n);
+    int ret = -EINPROGRESS;
+
+    qed_write_l1_table(s, index, n, qed_sync_cb, &ret);
+    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+
+    return ret;
 }

-/* Called either from qed_check or with table_lock held.  */
-int qed_read_l2_table(BDRVQEDState *s, QEDRequest *request, uint64_t offset)
+typedef struct {
+    GenericCB gencb;
+    BDRVQEDState *s;
+    uint64_t l2_offset;
+    QEDRequest *request;
+} QEDReadL2TableCB;
+
+static void qed_read_l2_table_cb(void *opaque, int ret)
 {
-    int ret;
+    QEDReadL2TableCB *read_l2_table_cb = opaque;
+    QEDRequest *request = read_l2_table_cb->request;
+    BDRVQEDState *s = read_l2_table_cb->s;
+    CachedL2Table *l2_table = request->l2_table;
+    uint64_t l2_offset = read_l2_table_cb->l2_offset;
+
+    qed_acquire(s);
+    if (ret) {
+        /* can't trust loaded L2 table anymore */
+        qed_unref_l2_cache_entry(l2_table);
+        request->l2_table = NULL;
+    } else {
+        l2_table->offset = l2_offset;
+
+        qed_commit_l2_cache_entry(&s->l2_cache, l2_table);
+
+        /* This is guaranteed to succeed because we just committed the entry
+         * to the cache.
+         */
+        request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, l2_offset);
+        assert(request->l2_table != NULL);
+    }
+    qed_release(s);
+
+    gencb_complete(&read_l2_table_cb->gencb, ret);
+}
+
+void qed_read_l2_table(BDRVQEDState *s, QEDRequest *request, uint64_t offset,
+                       BlockCompletionFunc *cb, void *opaque)
+{
+    QEDReadL2TableCB *read_l2_table_cb;

    qed_unref_l2_cache_entry(request->l2_table);

    /* Check for cached L2 entry */
    request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, offset);
    if (request->l2_table) {
-        return 0;
+        cb(opaque, 0);
+        return;
    }

    request->l2_table = qed_alloc_l2_cache_entry(&s->l2_cache);
    request->l2_table->table = qed_alloc_table(s);

+    read_l2_table_cb = gencb_alloc(sizeof(*read_l2_table_cb), cb, opaque);
+    read_l2_table_cb->s = s;
+    read_l2_table_cb->l2_offset = offset;
+    read_l2_table_cb->request = request;
+
    BLKDBG_EVENT(s->bs->file, BLKDBG_L2_LOAD);
-    ret = qed_read_table(s, offset, request->l2_table->table);
-
-    if (ret) {
-        /* can't trust loaded L2 table anymore */
-        qed_unref_l2_cache_entry(request->l2_table);
-        request->l2_table = NULL;
-    } else {
-        request->l2_table->offset = offset;
-
-        qed_commit_l2_cache_entry(&s->l2_cache, request->l2_table);
-
-        /* This is guaranteed to succeed because we just committed the entry
-         * to the cache.
-         */
-        request->l2_table = qed_find_l2_cache_entry(&s->l2_cache, offset);
-        assert(request->l2_table != NULL);
-    }
-
-    return ret;
+    qed_read_table(s, offset, request->l2_table->table,
+                   qed_read_l2_table_cb, read_l2_table_cb);
 }

 int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request, uint64_t offset)
 {
-    return qed_read_l2_table(s, request, offset);
+    int ret = -EINPROGRESS;
+
+    qed_read_l2_table(s, request, offset, qed_sync_cb, &ret);
+    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+
+    return ret;
 }

-/* Called either from qed_check or with table_lock held.  */
-int qed_write_l2_table(BDRVQEDState *s, QEDRequest *request,
-                       unsigned int index, unsigned int n, bool flush)
+void qed_write_l2_table(BDRVQEDState *s, QEDRequest *request,
+                        unsigned int index, unsigned int n, bool flush,
+                        BlockCompletionFunc *cb, void *opaque)
 {
    BLKDBG_EVENT(s->bs->file, BLKDBG_L2_UPDATE);
-    return qed_write_table(s, request->l2_table->offset,
-                           request->l2_table->table, index, n, flush);
+    qed_write_table(s, request->l2_table->offset,
+                    request->l2_table->table, index, n, flush, cb, opaque);
 }

 int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
                            unsigned int index, unsigned int n, bool flush)
 {
-    return qed_write_l2_table(s, request, index, n, flush);
+    int ret = -EINPROGRESS;
+
+    qed_write_l2_table(s, request, index, n, flush, qed_sync_cb, &ret);
+    BDRV_POLL_WHILE(s->bs, ret == -EINPROGRESS);
+
+    return ret;
 }
@@ -129,7 +129,8 @@ enum {
 };

 typedef struct QEDAIOCB {
-    BlockDriverState *bs;
+    BlockAIOCB common;
+    int bh_ret;                     /* final return status for completion bh */
    QSIMPLEQ_ENTRY(QEDAIOCB) next;  /* next request */
    int flags;                      /* QED_AIOCB_* bits ORed together */
    uint64_t end_pos;               /* request end on block device, in bytes */
@@ -151,25 +152,18 @@ typedef struct QEDAIOCB {

 typedef struct {
    BlockDriverState *bs;           /* device */
+    uint64_t file_size;             /* length of image file, in bytes */

-    /* Written only by an allocating write or the timer handler (the latter
-     * while allocating reqs are plugged).
-     */
    QEDHeader header;               /* always cpu-endian */
-
-    /* Protected by table_lock.  */
-    CoMutex table_lock;
    QEDTable *l1_table;
    L2TableCache l2_cache;          /* l2 table cache */
    uint32_t table_nelems;
    uint32_t l1_shift;
    uint32_t l2_shift;
    uint32_t l2_mask;
-    uint64_t file_size;             /* length of image file, in bytes */

    /* Allocating write request queue */
-    QEDAIOCB *allocating_acb;
-    CoQueue allocating_write_reqs;
+    QSIMPLEQ_HEAD(, QEDAIOCB) allocating_write_reqs;
    bool allocating_write_reqs_plugged;

    /* Periodic flush and clear need check flag */
@@ -183,6 +177,41 @@ enum {
    QED_CLUSTER_L1,            /* cluster missing in L1 */
 };

+/**
+ * qed_find_cluster() completion callback
+ *
+ * @opaque:     User data for completion callback
+ * @ret:        QED_CLUSTER_FOUND   Success
+ *              QED_CLUSTER_L2      Data cluster unallocated in L2
+ *              QED_CLUSTER_L1      L2 unallocated in L1
+ *              -errno              POSIX error occurred
+ * @offset:     Data cluster offset
+ * @len:        Contiguous bytes starting from cluster offset
+ *
+ * This function is invoked when qed_find_cluster() completes.
+ *
+ * On success ret is QED_CLUSTER_FOUND and offset/len are a contiguous range
+ * in the image file.
+ *
+ * On failure ret is QED_CLUSTER_L2 or QED_CLUSTER_L1 for missing L2 or L1
+ * table offset, respectively.  len is number of contiguous unallocated bytes.
+ */
+typedef void QEDFindClusterFunc(void *opaque, int ret, uint64_t offset, size_t len);
+
+void qed_acquire(BDRVQEDState *s);
+void qed_release(BDRVQEDState *s);
+
+/**
+ * Generic callback for chaining async callbacks
+ */
+typedef struct {
+    BlockCompletionFunc *cb;
+    void *opaque;
+} GenericCB;
+
+void *gencb_alloc(size_t len, BlockCompletionFunc *cb, void *opaque);
+void gencb_complete(void *opaque, int ret);
+
 /**
 * Header functions
 */
@@ -202,23 +231,25 @@ void qed_commit_l2_cache_entry(L2TableCache *l2_cache, CachedL2Table *l2_table);
 * Table I/O functions
 */
 int qed_read_l1_table_sync(BDRVQEDState *s);
-int qed_write_l1_table(BDRVQEDState *s, unsigned int index, unsigned int n);
+void qed_write_l1_table(BDRVQEDState *s, unsigned int index, unsigned int n,
+                        BlockCompletionFunc *cb, void *opaque);
 int qed_write_l1_table_sync(BDRVQEDState *s, unsigned int index,
                            unsigned int n);
 int qed_read_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
                           uint64_t offset);
-int qed_read_l2_table(BDRVQEDState *s, QEDRequest *request, uint64_t offset);
-int qed_write_l2_table(BDRVQEDState *s, QEDRequest *request,
-                       unsigned int index, unsigned int n, bool flush);
+void qed_read_l2_table(BDRVQEDState *s, QEDRequest *request, uint64_t offset,
+                       BlockCompletionFunc *cb, void *opaque);
+void qed_write_l2_table(BDRVQEDState *s, QEDRequest *request,
+                        unsigned int index, unsigned int n, bool flush,
+                        BlockCompletionFunc *cb, void *opaque);
 int qed_write_l2_table_sync(BDRVQEDState *s, QEDRequest *request,
                            unsigned int index, unsigned int n, bool flush);

 /**
 * Cluster functions
 */
-int coroutine_fn qed_find_cluster(BDRVQEDState *s, QEDRequest *request,
-                                  uint64_t pos, size_t *len,
-                                  uint64_t *img_offset);
+void qed_find_cluster(BDRVQEDState *s, QEDRequest *request, uint64_t pos,
+                      size_t len, QEDFindClusterFunc *cb, void *opaque);

 /**
 * Consistency check
@@ -19,6 +19,7 @@
 #include "qapi/qmp/qbool.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qlist.h"
 #include "qapi/qmp/qstring.h"
@@ -785,7 +786,8 @@ static coroutine_fn int quorum_co_flush(BlockDriverState *bs)
    for (i = 0; i < s->num_children; i++) {
        result = bdrv_co_flush(s->children[i]->bs);
        if (result) {
-            quorum_report_bad(QUORUM_OP_TYPE_FLUSH, 0, 0,
+            quorum_report_bad(QUORUM_OP_TYPE_FLUSH, 0,
+                              bdrv_getlength(s->children[i]->bs),
                              s->children[i]->bs->node_name, result);
            result_value.l = result;
            quorum_count_vote(&error_votes, &result_value, i);
@@ -259,12 +259,12 @@ static int64_t coroutine_fn raw_co_get_block_status(BlockDriverState *bs,
    *pnum = nb_sectors;
    *file = bs->file->bs;
    sector_num += s->offset / BDRV_SECTOR_SIZE;
-    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+    return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |
           (sector_num << BDRV_SECTOR_BITS);
 }

 static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,
-                                             int64_t offset, int bytes,
+                                             int64_t offset, int count,
                                             BdrvRequestFlags flags)
 {
    BDRVRawState *s = bs->opaque;
@@ -272,18 +272,18 @@ static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,
        return -EINVAL;
    }
    offset += s->offset;
-    return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
+    return bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
 }

 static int coroutine_fn raw_co_pdiscard(BlockDriverState *bs,
-                                        int64_t offset, int bytes)
+                                        int64_t offset, int count)
 {
    BDRVRawState *s = bs->opaque;
    if (offset > UINT64_MAX - s->offset) {
        return -EINVAL;
    }
    offset += s->offset;
-    return bdrv_co_pdiscard(bs->file->bs, offset, bytes);
+    return bdrv_co_pdiscard(bs->file->bs, offset, count);
 }

 static int64_t raw_getlength(BlockDriverState *bs)
@@ -312,31 +312,6 @@ static int64_t raw_getlength(BlockDriverState *bs)
    return s->size;
 }

-static BlockMeasureInfo *raw_measure(QemuOpts *opts, BlockDriverState *in_bs,
-                                     Error **errp)
-{
-    BlockMeasureInfo *info;
-    int64_t required;
-
-    if (in_bs) {
-        required = bdrv_getlength(in_bs);
-        if (required < 0) {
-            error_setg_errno(errp, -required, "Unable to get image size");
-            return NULL;
-        }
-    } else {
-        required = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0),
-                            BDRV_SECTOR_SIZE);
-    }
-
-    info = g_new(BlockMeasureInfo, 1);
-    info->required = required;
-
-    /* Unallocated sectors count towards the file size in raw images */
-    info->fully_allocated = info->required;
-    return info;
-}
-
 static int raw_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
    return bdrv_get_info(bs->file->bs, bdi);
@@ -352,24 +327,21 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
    }
 }

-static int raw_truncate(BlockDriverState *bs, int64_t offset,
-                        PreallocMode prealloc, Error **errp)
+static int raw_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRawState *s = bs->opaque;

    if (s->has_size) {
-        error_setg(errp, "Cannot resize fixed-size raw disks");
        return -ENOTSUP;
    }

    if (INT64_MAX - offset < s->offset) {
-        error_setg(errp, "Disk size too large for the chosen offset");
        return -EINVAL;
    }

    s->size = offset;
    offset += s->offset;
-    return bdrv_truncate(bs->file, offset, prealloc, errp);
+    return bdrv_truncate(bs->file, offset, NULL);
 }

 static int raw_media_changed(BlockDriverState *bs)
@@ -505,7 +477,6 @@ BlockDriver bdrv_raw = {
    .bdrv_truncate        = &raw_truncate,
    .bdrv_getlength       = &raw_getlength,
    .has_variable_length  = true,
-    .bdrv_measure         = &raw_measure,
    .bdrv_get_info        = &raw_get_info,
    .bdrv_refresh_limits  = &raw_refresh_limits,
    .bdrv_probe_blocksizes = &raw_probe_blocksizes,
@@ -94,7 +94,7 @@ typedef struct BDRVRBDState {
    rados_t cluster;
    rados_ioctx_t io_ctx;
    rbd_image_t image;
-    char *image_name;
+    char *name;
    char *snap;
 } BDRVRBDState;

@@ -340,10 +340,6 @@ static QemuOptsList runtime_opts = {
            .type = QEMU_OPT_STRING,
            .help = "Legacy rados key/value option parameters",
        },
-        {
-            .name = "filename",
-            .type = QEMU_OPT_STRING,
-        },
        { /* end of list */ }
    },
 };
@@ -354,7 +350,7 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
    int64_t bytes = 0;
    int64_t objsize;
    int obj_order = 0;
-    const char *pool, *image_name, *conf, *user, *keypairs;
+    const char *pool, *name, *conf, *clientname, *keypairs;
    const char *secretid;
    rados_t cluster;
    rados_ioctx_t io_ctx;
@@ -397,11 +393,11 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
     */
    pool       = qdict_get_try_str(options, "pool");
    conf       = qdict_get_try_str(options, "conf");
-    user       = qdict_get_try_str(options, "user");
-    image_name = qdict_get_try_str(options, "image");
+    clientname = qdict_get_try_str(options, "user");
+    name       = qdict_get_try_str(options, "image");
    keypairs   = qdict_get_try_str(options, "=keyvalue-pairs");

-    ret = rados_create(&cluster, user);
+    ret = rados_create(&cluster, clientname);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "error initializing");
        goto exit;
@@ -438,7 +434,7 @@ static int qemu_rbd_create(const char *filename, QemuOpts *opts, Error **errp)
        goto shutdown;
    }

-    ret = rbd_create(io_ctx, image_name, bytes, &obj_order);
+    ret = rbd_create(io_ctx, name, bytes, &obj_order);
    if (ret < 0) {
        error_setg_errno(errp, -ret, "error rbd create");
    }
@@ -544,28 +540,13 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
                         Error **errp)
 {
    BDRVRBDState *s = bs->opaque;
-    const char *pool, *snap, *conf, *user, *image_name, *keypairs;
-    const char *secretid, *filename;
+    const char *pool, *snap, *conf, *clientname, *name, *keypairs;
+    const char *secretid;
    QemuOpts *opts;
    Error *local_err = NULL;
    char *mon_host = NULL;
    int r;

-    /* If we are given a filename, parse the filename, with precedence given to
-     * filename encoded options */
-    filename = qdict_get_try_str(options, "filename");
-    if (filename) {
-        warn_report("'filename' option specified. "
-                    "This is an unsupported option, and may be deprecated "
-                    "in the future");
-        qemu_rbd_parse_filename(filename, options, &local_err);
-        if (local_err) {
-            r = -EINVAL;
-            error_propagate(errp, local_err);
-            goto exit;
-        }
-    }
-
    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
    qemu_opts_absorb_qdict(opts, options, &local_err);
    if (local_err) {
@@ -586,24 +567,24 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
    pool           = qemu_opt_get(opts, "pool");
    conf           = qemu_opt_get(opts, "conf");
    snap           = qemu_opt_get(opts, "snapshot");
-    user           = qemu_opt_get(opts, "user");
-    image_name     = qemu_opt_get(opts, "image");
+    clientname     = qemu_opt_get(opts, "user");
+    name           = qemu_opt_get(opts, "image");
    keypairs       = qemu_opt_get(opts, "=keyvalue-pairs");

-    if (!pool || !image_name) {
+    if (!pool || !name) {
        error_setg(errp, "Parameters 'pool' and 'image' are required");
        r = -EINVAL;
        goto failed_opts;
    }

-    r = rados_create(&s->cluster, user);
+    r = rados_create(&s->cluster, clientname);
    if (r < 0) {
        error_setg_errno(errp, -r, "error initializing");
        goto failed_opts;
    }

    s->snap = g_strdup(snap);
-    s->image_name = g_strdup(image_name);
+    s->name = g_strdup(name);

    /* try default location when conf=NULL, but ignore failure */
    r = rados_conf_read_file(s->cluster, conf);
@@ -654,23 +635,13 @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
        goto failed_shutdown;
    }

-    /* rbd_open is always r/w */
-    r = rbd_open(s->io_ctx, s->image_name, &s->image, s->snap);
+    r = rbd_open(s->io_ctx, s->name, &s->image, s->snap);
    if (r < 0) {
-        error_setg_errno(errp, -r, "error reading header from %s",
-                         s->image_name);
+        error_setg_errno(errp, -r, "error reading header from %s", s->name);
        goto failed_open;
    }

-    /* If we are using an rbd snapshot, we must be r/o, otherwise
-     * leave as-is */
-    if (s->snap != NULL) {
-        r = bdrv_set_read_only(bs, true, &local_err);
-        if (r < 0) {
-            error_propagate(errp, local_err);
-            goto failed_open;
-        }
-    }
+    bs->read_only = (s->snap != NULL);

    qemu_opts_del(opts);
    return 0;
@@ -680,34 +651,13 @@ failed_open:
 failed_shutdown:
    rados_shutdown(s->cluster);
    g_free(s->snap);
-    g_free(s->image_name);
+    g_free(s->name);
 failed_opts:
    qemu_opts_del(opts);
    g_free(mon_host);
-exit:
    return r;
 }

-
-/* Since RBD is currently always opened R/W via the API,
- * we just need to check if we are using a snapshot or not, in
- * order to determine if we will allow it to be R/W */
-static int qemu_rbd_reopen_prepare(BDRVReopenState *state,
-                                   BlockReopenQueue *queue, Error **errp)
-{
-    BDRVRBDState *s = state->bs->opaque;
-    int ret = 0;
-
-    if (s->snap && state->flags & BDRV_O_RDWR) {
-        error_setg(errp,
-                   "Cannot change node '%s' to r/w when using RBD snapshot",
-                   bdrv_get_device_or_node_name(state->bs));
-        ret = -EINVAL;
-    }
-
-    return ret;
-}
-
 static void qemu_rbd_close(BlockDriverState *bs)
 {
    BDRVRBDState *s = bs->opaque;
@@ -715,7 +665,7 @@ static void qemu_rbd_close(BlockDriverState *bs)
    rbd_close(s->image);
    rados_ioctx_destroy(s->io_ctx);
    g_free(s->snap);
-    g_free(s->image_name);
+    g_free(s->name);
    rados_shutdown(s->cluster);
 }

@@ -936,21 +886,13 @@ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
    return info.size;
 }

-static int qemu_rbd_truncate(BlockDriverState *bs, int64_t offset,
-                             PreallocMode prealloc, Error **errp)
+static int qemu_rbd_truncate(BlockDriverState *bs, int64_t offset)
 {
    BDRVRBDState *s = bs->opaque;
    int r;

-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
    r = rbd_resize(s->image, offset);
    if (r < 0) {
-        error_setg_errno(errp, -r, "Failed to resize file");
        return r;
    }

@@ -1072,11 +1014,11 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
 #ifdef LIBRBD_SUPPORTS_DISCARD
 static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
                                         int64_t offset,
-                                         int bytes,
+                                         int count,
                                         BlockCompletionFunc *cb,
                                         void *opaque)
 {
-    return rbd_start_aio(bs, offset, NULL, bytes, cb, opaque,
+    return rbd_start_aio(bs, offset, NULL, count, cb, opaque,
                         RBD_AIO_DISCARD);
 }
 #endif
@@ -1122,7 +1064,6 @@ static BlockDriver bdrv_rbd = {
    .bdrv_parse_filename    = qemu_rbd_parse_filename,
    .bdrv_file_open         = qemu_rbd_open,
    .bdrv_close             = qemu_rbd_close,
-    .bdrv_reopen_prepare    = qemu_rbd_reopen_prepare,
    .bdrv_create            = qemu_rbd_create,
    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
    .bdrv_get_info          = qemu_rbd_getinfo,
@@ -22,17 +22,9 @@
 #include "qapi/error.h"
 #include "replication.h"

-typedef enum {
-    BLOCK_REPLICATION_NONE,             /* block replication is not started */
-    BLOCK_REPLICATION_RUNNING,          /* block replication is running */
-    BLOCK_REPLICATION_FAILOVER,         /* failover is running in background */
-    BLOCK_REPLICATION_FAILOVER_FAILED,  /* failover failed */
-    BLOCK_REPLICATION_DONE,             /* block replication is done */
-} ReplicationStage;
-
 typedef struct BDRVReplicationState {
    ReplicationMode mode;
-    ReplicationStage stage;
+    int replication_state;
    BdrvChild *active_disk;
    BdrvChild *hidden_disk;
    BdrvChild *secondary_disk;
@@ -44,6 +36,14 @@ typedef struct BDRVReplicationState {
    int error;
 } BDRVReplicationState;

+enum {
+    BLOCK_REPLICATION_NONE,             /* block replication is not started */
+    BLOCK_REPLICATION_RUNNING,          /* block replication is running */
+    BLOCK_REPLICATION_FAILOVER,         /* failover is running in background */
+    BLOCK_REPLICATION_FAILOVER_FAILED,  /* failover failed */
+    BLOCK_REPLICATION_DONE,             /* block replication is done */
+};
+
 static void replication_start(ReplicationState *rs, ReplicationMode mode,
                              Error **errp);
 static void replication_do_checkpoint(ReplicationState *rs, Error **errp);
@@ -141,10 +141,10 @@ static void replication_close(BlockDriverState *bs)
 {
    BDRVReplicationState *s = bs->opaque;

-    if (s->stage == BLOCK_REPLICATION_RUNNING) {
+    if (s->replication_state == BLOCK_REPLICATION_RUNNING) {
        replication_stop(s->rs, false, NULL);
    }
-    if (s->stage == BLOCK_REPLICATION_FAILOVER) {
+    if (s->replication_state == BLOCK_REPLICATION_FAILOVER) {
        block_job_cancel_sync(s->active_disk->bs->job);
    }

@@ -174,7 +174,7 @@ static int64_t replication_getlength(BlockDriverState *bs)

 static int replication_get_io_status(BDRVReplicationState *s)
 {
-    switch (s->stage) {
+    switch (s->replication_state) {
    case BLOCK_REPLICATION_NONE:
        return -EIO;
    case BLOCK_REPLICATION_RUNNING:
@@ -234,14 +234,10 @@ static coroutine_fn int replication_co_readv(BlockDriverState *bs,
    }

    if (job) {
-        uint64_t remaining_bytes = remaining_sectors * BDRV_SECTOR_SIZE;
-
-        backup_wait_for_overlapping_requests(child->bs->job,
-                                             sector_num * BDRV_SECTOR_SIZE,
-                                             remaining_bytes);
-        backup_cow_request_begin(&req, child->bs->job,
-                                 sector_num * BDRV_SECTOR_SIZE,
-                                 remaining_bytes);
+        backup_wait_for_overlapping_requests(child->bs->job, sector_num,
+                                             remaining_sectors);
+        backup_cow_request_begin(&req, child->bs->job, sector_num,
+                                 remaining_sectors);
        ret = bdrv_co_readv(bs->file, sector_num, remaining_sectors,
                            qiov);
        backup_cow_request_end(&req);
@@ -264,8 +260,7 @@ static coroutine_fn int replication_co_writev(BlockDriverState *bs,
    BdrvChild *top = bs->file;
    BdrvChild *base = s->secondary_disk;
    BdrvChild *target;
-    int ret;
-    int64_t n;
+    int ret, n;

    ret = replication_get_io_status(s);
    if (ret < 0) {
@@ -284,20 +279,14 @@ static coroutine_fn int replication_co_writev(BlockDriverState *bs,
     */
    qemu_iovec_init(&hd_qiov, qiov->niov);
    while (remaining_sectors > 0) {
-        int64_t count;
-
-        ret = bdrv_is_allocated_above(top->bs, base->bs,
-                                      sector_num * BDRV_SECTOR_SIZE,
-                                      remaining_sectors * BDRV_SECTOR_SIZE,
-                                      &count);
+        ret = bdrv_is_allocated_above(top->bs, base->bs, sector_num,
+                                      remaining_sectors, &n);
        if (ret < 0) {
            goto out1;
        }

-        assert(QEMU_IS_ALIGNED(count, BDRV_SECTOR_SIZE));
-        n = count >> BDRV_SECTOR_BITS;
        qemu_iovec_reset(&hd_qiov);
-        qemu_iovec_concat(&hd_qiov, qiov, bytes_done, count);
+        qemu_iovec_concat(&hd_qiov, qiov, bytes_done, n * BDRV_SECTOR_SIZE);

        target = ret ? top : base;
        ret = bdrv_co_writev(target, sector_num, n, &hd_qiov);
@@ -307,7 +296,7 @@ static coroutine_fn int replication_co_writev(BlockDriverState *bs,

        remaining_sectors -= n;
        sector_num += n;
-        bytes_done += count;
+        bytes_done += n * BDRV_SECTOR_SIZE;
    }

 out1:
@@ -414,7 +403,7 @@ static void backup_job_completed(void *opaque, int ret)
    BlockDriverState *bs = opaque;
    BDRVReplicationState *s = bs->opaque;

-    if (s->stage != BLOCK_REPLICATION_FAILOVER) {
+    if (s->replication_state != BLOCK_REPLICATION_FAILOVER) {
        /* The backup job is cancelled unexpectedly */
        s->error = -EIO;
    }
@@ -456,7 +445,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
    aio_context_acquire(aio_context);
    s = bs->opaque;

-    if (s->stage != BLOCK_REPLICATION_NONE) {
+    if (s->replication_state != BLOCK_REPLICATION_NONE) {
        error_setg(errp, "Block replication is running or done");
        aio_context_release(aio_context);
        return;
@@ -556,7 +545,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
        abort();
    }

-    s->stage = BLOCK_REPLICATION_RUNNING;
+    s->replication_state = BLOCK_REPLICATION_RUNNING;

    if (s->mode == REPLICATION_MODE_SECONDARY) {
        secondary_do_checkpoint(s, errp);
@@ -592,7 +581,7 @@ static void replication_get_error(ReplicationState *rs, Error **errp)
    aio_context_acquire(aio_context);
    s = bs->opaque;

-    if (s->stage != BLOCK_REPLICATION_RUNNING) {
+    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
        error_setg(errp, "Block replication is not running");
        aio_context_release(aio_context);
        return;
@@ -612,7 +601,7 @@ static void replication_done(void *opaque, int ret)
    BDRVReplicationState *s = bs->opaque;

    if (ret == 0) {
-        s->stage = BLOCK_REPLICATION_DONE;
+        s->replication_state = BLOCK_REPLICATION_DONE;

        /* refresh top bs's filename */
        bdrv_refresh_filename(bs);
@@ -621,7 +610,7 @@ static void replication_done(void *opaque, int ret)
        s->hidden_disk = NULL;
        s->error = 0;
    } else {
-        s->stage = BLOCK_REPLICATION_FAILOVER_FAILED;
+        s->replication_state = BLOCK_REPLICATION_FAILOVER_FAILED;
        s->error = -EIO;
    }
 }
@@ -636,7 +625,7 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
    aio_context_acquire(aio_context);
    s = bs->opaque;

-    if (s->stage != BLOCK_REPLICATION_RUNNING) {
+    if (s->replication_state != BLOCK_REPLICATION_RUNNING) {
        error_setg(errp, "Block replication is not running");
        aio_context_release(aio_context);
        return;
@@ -644,7 +633,7 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)

    switch (s->mode) {
    case REPLICATION_MODE_PRIMARY:
-        s->stage = BLOCK_REPLICATION_DONE;
+        s->replication_state = BLOCK_REPLICATION_DONE;
        s->error = 0;
        break;
    case REPLICATION_MODE_SECONDARY:
@@ -659,15 +648,15 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)

        if (!failover) {
            secondary_do_checkpoint(s, errp);
-            s->stage = BLOCK_REPLICATION_DONE;
+            s->replication_state = BLOCK_REPLICATION_DONE;
            aio_context_release(aio_context);
            return;
        }

-        s->stage = BLOCK_REPLICATION_FAILOVER;
+        s->replication_state = BLOCK_REPLICATION_FAILOVER;
        commit_active_start(NULL, s->active_disk->bs, s->secondary_disk->bs,
                            BLOCK_JOB_INTERNAL, 0, BLOCKDEV_ON_ERROR_REPORT,
-                            NULL, replication_done, bs, true, errp);
+                            NULL, replication_done, bs, errp, true);
        break;
    default:
        aio_context_release(aio_context);
@@ -16,6 +16,7 @@
 #include "qapi-visit.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qemu/uri.h"
 #include "qemu/error-report.h"
@@ -390,7 +391,6 @@ struct BDRVSheepdogState {
    QLIST_HEAD(inflight_aio_head, AIOReq) inflight_aio_head;
    QLIST_HEAD(failed_aio_head, AIOReq) failed_aio_head;

-    CoMutex queue_lock;
    CoQueue overlapping_queue;
    QLIST_HEAD(inflight_aiocb_head, SheepdogAIOCB) inflight_aiocb_head;
 };
@@ -489,7 +489,7 @@ static void wait_for_overlapping_aiocb(BDRVSheepdogState *s, SheepdogAIOCB *acb)
 retry:
    QLIST_FOREACH(cb, &s->inflight_aiocb_head, aiocb_siblings) {
        if (AIOCBOverlapping(acb, cb)) {
-            qemu_co_queue_wait(&s->overlapping_queue, &s->queue_lock);
+            qemu_co_queue_wait(&s->overlapping_queue, NULL);
            goto retry;
        }
    }
@@ -526,10 +526,8 @@ static void sd_aio_setup(SheepdogAIOCB *acb, BDRVSheepdogState *s,
        return;
    }

-    qemu_co_mutex_lock(&s->queue_lock);
    wait_for_overlapping_aiocb(s, acb);
    QLIST_INSERT_HEAD(&s->inflight_aiocb_head, acb, aiocb_siblings);
-    qemu_co_mutex_unlock(&s->queue_lock);
 }

 static SocketAddress *sd_socket_address(const char *path,
@@ -538,12 +536,14 @@ static SocketAddress *sd_socket_address(const char *path,
    SocketAddress *addr = g_new0(SocketAddress, 1);

    if (path) {
-        addr->type = SOCKET_ADDRESS_TYPE_UNIX;
-        addr->u.q_unix.path = g_strdup(path);
+        addr->type = SOCKET_ADDRESS_KIND_UNIX;
+        addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
+        addr->u.q_unix.data->path = g_strdup(path);
    } else {
-        addr->type = SOCKET_ADDRESS_TYPE_INET;
-        addr->u.inet.host = g_strdup(host ?: SD_DEFAULT_ADDR);
-        addr->u.inet.port = g_strdup(port ?: stringify(SD_DEFAULT_PORT));
+        addr->type = SOCKET_ADDRESS_KIND_INET;
+        addr->u.inet.data = g_new0(InetSocketAddress, 1);
+        addr->u.inet.data->host = g_strdup(host ?: SD_DEFAULT_ADDR);
+        addr->u.inet.data->port = g_strdup(port ?: stringify(SD_DEFAULT_PORT));
    }

    return addr;
@@ -554,6 +554,7 @@ static SocketAddress *sd_server_config(QDict *options, Error **errp)
    QDict *server = NULL;
    QObject *crumpled_server = NULL;
    Visitor *iv = NULL;
+    SocketAddressFlat *saddr_flat = NULL;
    SocketAddress *saddr = NULL;
    Error *local_err = NULL;

@@ -573,13 +574,16 @@ static SocketAddress *sd_server_config(QDict *options, Error **errp)
     * visitor expects the former.
     */
    iv = qobject_input_visitor_new(crumpled_server);
-    visit_type_SocketAddress(iv, NULL, &saddr, &local_err);
+    visit_type_SocketAddressFlat(iv, NULL, &saddr_flat, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        goto done;
    }

+    saddr = socket_address_crumple(saddr_flat);
+
 done:
+    qapi_free_SocketAddressFlat(saddr_flat);
    visit_free(iv);
    qobject_decref(crumpled_server);
    QDECREF(server);
@@ -591,9 +595,9 @@ static int connect_to_sdog(BDRVSheepdogState *s, Error **errp)
 {
    int fd;

-    fd = socket_connect(s->addr, NULL, NULL, errp);
+    fd = socket_connect(s->addr, errp, NULL, NULL);

-    if (s->addr->type == SOCKET_ADDRESS_TYPE_INET && fd >= 0) {
+    if (s->addr->type == SOCKET_ADDRESS_KIND_INET && fd >= 0) {
        int ret = socket_set_nodelay(fd);
        if (ret < 0) {
            error_report("%s", strerror(errno));
@@ -700,8 +704,7 @@ out:

    srco->co = NULL;
    srco->ret = ret;
-    /* Set srco->finished before reading bs->wakeup.  */
-    atomic_mb_set(&srco->finished, true);
+    srco->finished = true;
    if (srco->bs) {
        bdrv_wakeup(srco->bs);
    }
@@ -788,7 +791,6 @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
     * have to move all the inflight requests to the failed queue before
     * resend_aioreq() is called.
     */
-    qemu_co_mutex_lock(&s->queue_lock);
    QLIST_FOREACH_SAFE(aio_req, &s->inflight_aio_head, aio_siblings, next) {
        QLIST_REMOVE(aio_req, aio_siblings);
        QLIST_INSERT_HEAD(&s->failed_aio_head, aio_req, aio_siblings);
@@ -798,11 +800,8 @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
    while (!QLIST_EMPTY(&s->failed_aio_head)) {
        aio_req = QLIST_FIRST(&s->failed_aio_head);
        QLIST_REMOVE(aio_req, aio_siblings);
-        qemu_co_mutex_unlock(&s->queue_lock);
        resend_aioreq(s, aio_req);
-        qemu_co_mutex_lock(&s->queue_lock);
    }
-    qemu_co_mutex_unlock(&s->queue_lock);
 }

 /*
@@ -894,10 +893,7 @@ static void coroutine_fn aio_read_response(void *opaque)
    */
    s->co_recv = NULL;

-    qemu_co_mutex_lock(&s->queue_lock);
    QLIST_REMOVE(aio_req, aio_siblings);
-    qemu_co_mutex_unlock(&s->queue_lock);
-
    switch (rsp.result) {
    case SD_RES_SUCCESS:
        break;
@@ -1317,9 +1313,7 @@ static void coroutine_fn add_aio_request(BDRVSheepdogState *s, AIOReq *aio_req,
    uint64_t old_oid = aio_req->base_oid;
    bool create = aio_req->create;

-    qemu_co_mutex_lock(&s->queue_lock);
    QLIST_INSERT_HEAD(&s->inflight_aio_head, aio_req, aio_siblings);
-    qemu_co_mutex_unlock(&s->queue_lock);

    if (!nr_copies) {
        error_report("bug");
@@ -1690,7 +1684,6 @@ static int sd_open(BlockDriverState *bs, QDict *options, int flags,
    bs->total_sectors = s->inode.vdi_size / BDRV_SECTOR_SIZE;
    pstrcpy(s->name, sizeof(s->name), vdi);
    qemu_co_mutex_init(&s->lock);
-    qemu_co_mutex_init(&s->queue_lock);
    qemu_co_queue_init(&s->overlapping_queue);
    qemu_opts_del(opts);
    g_free(buf);
@@ -2166,31 +2159,26 @@ static int64_t sd_getlength(BlockDriverState *bs)
    return s->inode.vdi_size;
 }

-static int sd_truncate(BlockDriverState *bs, int64_t offset,
-                       PreallocMode prealloc, Error **errp)
+static int sd_truncate(BlockDriverState *bs, int64_t offset)
 {
+    Error *local_err = NULL;
    BDRVSheepdogState *s = bs->opaque;
    int ret, fd;
    unsigned int datalen;
    uint64_t max_vdi_size;

-    if (prealloc != PREALLOC_MODE_OFF) {
-        error_setg(errp, "Unsupported preallocation mode '%s'",
-                   PreallocMode_lookup[prealloc]);
-        return -ENOTSUP;
-    }
-
    max_vdi_size = (UINT64_C(1) << s->inode.block_size_shift) * MAX_DATA_OBJS;
    if (offset < s->inode.vdi_size) {
-        error_setg(errp, "shrinking is not supported");
+        error_report("shrinking is not supported");
        return -EINVAL;
    } else if (offset > max_vdi_size) {
-        error_setg(errp, "too big image size");
+        error_report("too big image size");
        return -EINVAL;
    }

-    fd = connect_to_sdog(s, errp);
+    fd = connect_to_sdog(s, &local_err);
    if (fd < 0) {
+        error_report_err(local_err);
        return fd;
    }

@@ -2203,7 +2191,7 @@ static int sd_truncate(BlockDriverState *bs, int64_t offset,
    close(fd);

    if (ret < 0) {
-        error_setg_errno(errp, -ret, "failed to update an inode");
+        error_report("failed to update an inode.");
    }

    return ret;
@@ -2451,16 +2439,12 @@ static void coroutine_fn sd_co_rw_vector(SheepdogAIOCB *acb)

 static void sd_aio_complete(SheepdogAIOCB *acb)
 {
-    BDRVSheepdogState *s;
    if (acb->aiocb_type == AIOCB_FLUSH_CACHE) {
        return;
    }

-    s = acb->s;
-    qemu_co_mutex_lock(&s->queue_lock);
    QLIST_REMOVE(acb, aiocb_siblings);
-    qemu_co_queue_restart_all(&s->overlapping_queue);
-    qemu_co_mutex_unlock(&s->queue_lock);
+    qemu_co_queue_restart_all(&acb->s->overlapping_queue);
 }

 static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
@@ -2472,7 +2456,7 @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
    BDRVSheepdogState *s = bs->opaque;

    if (offset > s->inode.vdi_size) {
-        ret = sd_truncate(bs, offset, PREALLOC_MODE_OFF, NULL);
+        ret = sd_truncate(bs, offset);
        if (ret < 0) {
            return ret;
        }
@@ -2959,7 +2943,7 @@ static int sd_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,


 static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
-                                      int bytes)
+                                      int count)
 {
    SheepdogAIOCB acb;
    BDRVSheepdogState *s = bs->opaque;
@@ -2977,11 +2961,11 @@ static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset,
    iov.iov_len = sizeof(zero);
    discard_iov.iov = &iov;
    discard_iov.niov = 1;
-    if (!QEMU_IS_ALIGNED(offset | bytes, BDRV_SECTOR_SIZE)) {
+    if (!QEMU_IS_ALIGNED(offset | count, BDRV_SECTOR_SIZE)) {
        return -ENOTSUP;
    }
    sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS,
-                 bytes >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
+                 count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ);
    sd_co_rw_vector(&acb);
    sd_aio_complete(&acb);

@@ -34,6 +34,7 @@
 #include "qemu/sockets.h"
 #include "qemu/uri.h"
 #include "qapi-visit.h"
+#include "qapi/qmp/qint.h"
 #include "qapi/qmp/qstring.h"
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qobject-output-visitor.h"
@@ -678,7 +679,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
    }

    /* Open the socket and connect. */
-    s->sock = inet_connect_saddr(s->inet, NULL, NULL, errp);
+    s->sock = inet_connect_saddr(s->inet, errp, NULL, NULL);
    if (s->sock < 0) {
        ret = -EIO;
        goto err;
@@ -888,22 +889,13 @@ static int ssh_has_zero_init(BlockDriverState *bs)
    return has_zero_init;
 }

-typedef struct BDRVSSHRestart {
-    BlockDriverState *bs;
-    Coroutine *co;
-} BDRVSSHRestart;
-
 static void restart_coroutine(void *opaque)
 {
-    BDRVSSHRestart *restart = opaque;
-    BlockDriverState *bs = restart->bs;
-    BDRVSSHState *s = bs->opaque;
-    AioContext *ctx = bdrv_get_aio_context(bs);
+    Coroutine *co = opaque;

-    DPRINTF("co=%p", restart->co);
-    aio_set_fd_handler(ctx, s->sock, false, NULL, NULL, NULL, NULL);
+    DPRINTF("co=%p", co);

-    aio_co_wake(restart->co);
+    aio_co_wake(co);
 }

 /* A non-blocking call returned EAGAIN, so yield, ensuring the
@@ -914,10 +906,7 @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
 {
    int r;
    IOHandler *rd_handler = NULL, *wr_handler = NULL;
-    BDRVSSHRestart restart = {
-        .bs = bs,
-        .co = qemu_coroutine_self()
-    };
+    Coroutine *co = qemu_coroutine_self();

    r = libssh2_session_block_directions(s->session);

@@ -932,9 +921,11 @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
            rd_handler, wr_handler);

    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
-                       false, rd_handler, wr_handler, NULL, &restart);
+                       false, rd_handler, wr_handler, NULL, co);
    qemu_coroutine_yield();
    DPRINTF("s->sock=%d - back", s->sock);
+    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock, false,
+                       NULL, NULL, NULL, NULL);
 }

 /* SFTP has a function `libssh2_sftp_seek64' which seeks to a position
@@ -1124,8 +1115,8 @@ static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
 static void unsafe_flush_warning(BDRVSSHState *s, const char *what)
 {
    if (!s->unsafe_flush_warning) {
-        warn_report("ssh server %s does not support fsync",
-                    s->inet->host);
+        error_report("warning: ssh server %s does not support fsync",
+                     s->inet->host);
        if (what) {
            error_report("to support fsync, you need %s", what);
        }
@@ -41,24 +41,25 @@ typedef struct StreamBlockJob {
 } StreamBlockJob;

 static int coroutine_fn stream_populate(BlockBackend *blk,
-                                        int64_t offset, uint64_t bytes,
+                                        int64_t sector_num, int nb_sectors,
                                        void *buf)
 {
    struct iovec iov = {
        .iov_base = buf,
-        .iov_len  = bytes,
+        .iov_len  = nb_sectors * BDRV_SECTOR_SIZE,
    };
    QEMUIOVector qiov;

-    assert(bytes < SIZE_MAX);
    qemu_iovec_init_external(&qiov, &iov, 1);

    /* Copy-on-read the unallocated clusters */
-    return blk_co_preadv(blk, offset, qiov.size, &qiov, BDRV_REQ_COPY_ON_READ);
+    return blk_co_preadv(blk, sector_num * BDRV_SECTOR_SIZE, qiov.size, &qiov,
+                         BDRV_REQ_COPY_ON_READ);
 }

 typedef struct {
    int ret;
+    bool reached_end;
 } StreamCompleteData;

 static void stream_complete(BlockJob *job, void *opaque)
@@ -69,7 +70,7 @@ static void stream_complete(BlockJob *job, void *opaque)
    BlockDriverState *base = s->base;
    Error *local_err = NULL;

-    if (!block_job_is_cancelled(&s->common) && bs->backing &&
+    if (!block_job_is_cancelled(&s->common) && data->reached_end &&
        data->ret == 0) {
        const char *base_id = NULL, *base_fmt = NULL;
        if (base) {
@@ -107,11 +108,12 @@ static void coroutine_fn stream_run(void *opaque)
    BlockBackend *blk = s->common.blk;
    BlockDriverState *bs = blk_bs(blk);
    BlockDriverState *base = s->base;
-    int64_t offset = 0;
+    int64_t sector_num = 0;
+    int64_t end = -1;
    uint64_t delay_ns = 0;
    int error = 0;
    int ret = 0;
-    int64_t n = 0; /* bytes */
+    int n = 0;
    void *buf;

    if (!bs->backing) {
@@ -124,6 +126,7 @@ static void coroutine_fn stream_run(void *opaque)
        goto out;
    }

+    end = s->common.len >> BDRV_SECTOR_BITS;
    buf = qemu_blockalign(bs, STREAM_BUFFER_SIZE);

    /* Turn on copy-on-read for the whole block device so that guest read
@@ -135,7 +138,7 @@ static void coroutine_fn stream_run(void *opaque)
        bdrv_enable_copy_on_read(bs);
    }

-    for ( ; offset < s->common.len; offset += n) {
+    for (sector_num = 0; sector_num < end; sector_num += n) {
        bool copy;

        /* Note that even when no rate limit is applied we need to yield
@@ -148,25 +151,26 @@ static void coroutine_fn stream_run(void *opaque)

        copy = false;

-        ret = bdrv_is_allocated(bs, offset, STREAM_BUFFER_SIZE, &n);
+        ret = bdrv_is_allocated(bs, sector_num,
+                                STREAM_BUFFER_SIZE / BDRV_SECTOR_SIZE, &n);
        if (ret == 1) {
            /* Allocated in the top, no need to copy.  */
        } else if (ret >= 0) {
            /* Copy if allocated in the intermediate images.  Limit to the
-             * known-unallocated area [offset, offset+n*BDRV_SECTOR_SIZE).  */
+             * known-unallocated area [sector_num, sector_num+n).  */
            ret = bdrv_is_allocated_above(backing_bs(bs), base,
-                                          offset, n, &n);
+                                          sector_num, n, &n);

            /* Finish early if end of backing file has been reached */
            if (ret == 0 && n == 0) {
-                n = s->common.len - offset;
+                n = end - sector_num;
            }

            copy = (ret == 1);
        }
-        trace_stream_one_iteration(s, offset, n, ret);
+        trace_stream_one_iteration(s, sector_num, n, ret);
        if (copy) {
-            ret = stream_populate(blk, offset, n, buf);
+            ret = stream_populate(blk, sector_num, n, buf);
        }
        if (ret < 0) {
            BlockErrorAction action =
@@ -185,7 +189,7 @@ static void coroutine_fn stream_run(void *opaque)
        ret = 0;

        /* Publish progress */
-        s->common.offset += n;
+        s->common.offset += n * BDRV_SECTOR_SIZE;
        if (copy && s->common.speed) {
            delay_ns = ratelimit_calculate_delay(&s->limit, n);
        }
@@ -204,6 +208,7 @@ out:
    /* Modify backing chain and close BDSes in main loop */
    data = g_malloc(sizeof(*data));
    data->ret = ret;
+    data->reached_end = sector_num == end;
    block_job_defer_to_main_loop(&s->common, stream_complete, data);
 }

@@ -215,7 +220,7 @@ static void stream_set_speed(BlockJob *job, int64_t speed, Error **errp)
        error_setg(errp, QERR_INVALID_PARAMETER, "speed");
        return;
    }
-    ratelimit_set_speed(&s->limit, speed, SLICE_TIME);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE, SLICE_TIME);
 }

 static const BlockJobDriver stream_job_driver = {
@@ -49,7 +49,7 @@
 * Again, all this is handled internally and is mostly transparent to
 * the outside. The 'throttle_timers' field however has an additional
 * constraint because it may be temporarily invalid (see for example
- * blk_set_aio_context()). Therefore in this file a thread will
+ * bdrv_set_aio_context()). Therefore in this file a thread will
 * access some other BlockBackend's timers only after verifying that
 * that BlockBackend has throttled requests in the queue.
 */
@@ -61,7 +61,6 @@ typedef struct ThrottleGroup {
    QLIST_HEAD(, BlockBackendPublic) head;
    BlockBackend *tokens[2];
    bool any_timer_armed[2];
-    QEMUClockType clock_type;

    /* These two are protected by the global throttle_groups_lock */
    unsigned refcount;
@@ -99,12 +98,6 @@ ThrottleState *throttle_group_incref(const char *name)
    if (!tg) {
        tg = g_new0(ThrottleGroup, 1);
        tg->name = g_strdup(name);
-        tg->clock_type = QEMU_CLOCK_REALTIME;
-
-        if (qtest_enabled()) {
-            /* For testing block IO throttling only */
-            tg->clock_type = QEMU_CLOCK_VIRTUAL;
-        }
        qemu_mutex_init(&tg->lock);
        throttle_init(&tg->ts);
        QLIST_INIT(&tg->head);
@@ -247,7 +240,7 @@ static bool throttle_group_schedule_timer(BlockBackend *blk, bool is_write)
    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
    bool must_wait;

-    if (atomic_read(&blkp->io_limits_disabled)) {
+    if (blkp->io_limits_disabled) {
        return false;
    }

@@ -267,25 +260,6 @@ static bool throttle_group_schedule_timer(BlockBackend *blk, bool is_write)
    return must_wait;
 }

-/* Start the next pending I/O request for a BlockBackend.  Return whether
- * any request was actually pending.
- *
- * @blk:       the current BlockBackend
- * @is_write:  the type of operation (read/write)
- */
-static bool coroutine_fn throttle_group_co_restart_queue(BlockBackend *blk,
-                                                         bool is_write)
-{
-    BlockBackendPublic *blkp = blk_get_public(blk);
-    bool ret;
-
-    qemu_co_mutex_lock(&blkp->throttled_reqs_lock);
-    ret = qemu_co_queue_next(&blkp->throttled_reqs[is_write]);
-    qemu_co_mutex_unlock(&blkp->throttled_reqs_lock);
-
-    return ret;
-}
-
 /* Look for the next pending I/O request and schedule it.
 *
 * This assumes that tg->lock is held.
@@ -313,12 +287,12 @@ static void schedule_next_request(BlockBackend *blk, bool is_write)
    if (!must_wait) {
        /* Give preference to requests from the current blk */
        if (qemu_in_coroutine() &&
-            throttle_group_co_restart_queue(blk, is_write)) {
+            qemu_co_queue_next(&blkp->throttled_reqs[is_write])) {
            token = blk;
        } else {
            ThrottleTimers *tt = &blk_get_public(token)->throttle_timers;
-            int64_t now = qemu_clock_get_ns(tg->clock_type);
-            timer_mod(tt->timers[is_write], now);
+            int64_t now = qemu_clock_get_ns(tt->clock_type);
+            timer_mod(tt->timers[is_write], now + 1);
            tg->any_timer_armed[is_write] = true;
        }
        tg->tokens[is_write] = token;
@@ -352,10 +326,7 @@ void coroutine_fn throttle_group_co_io_limits_intercept(BlockBackend *blk,
    if (must_wait || blkp->pending_reqs[is_write]) {
        blkp->pending_reqs[is_write]++;
        qemu_mutex_unlock(&tg->lock);
-        qemu_co_mutex_lock(&blkp->throttled_reqs_lock);
-        qemu_co_queue_wait(&blkp->throttled_reqs[is_write],
-                           &blkp->throttled_reqs_lock);
-        qemu_co_mutex_unlock(&blkp->throttled_reqs_lock);
+        qemu_co_queue_wait(&blkp->throttled_reqs[is_write], NULL);
        qemu_mutex_lock(&tg->lock);
        blkp->pending_reqs[is_write]--;
    }
@@ -369,50 +340,15 @@ void coroutine_fn throttle_group_co_io_limits_intercept(BlockBackend *blk,
    qemu_mutex_unlock(&tg->lock);
 }

-typedef struct {
-    BlockBackend *blk;
-    bool is_write;
-} RestartData;
-
-static void coroutine_fn throttle_group_restart_queue_entry(void *opaque)
-{
-    RestartData *data = opaque;
-    BlockBackend *blk = data->blk;
-    bool is_write = data->is_write;
-    BlockBackendPublic *blkp = blk_get_public(blk);
-    ThrottleGroup *tg = container_of(blkp->throttle_state, ThrottleGroup, ts);
-    bool empty_queue;
-
-    empty_queue = !throttle_group_co_restart_queue(blk, is_write);
-
-    /* If the request queue was empty then we have to take care of
-     * scheduling the next one */
-    if (empty_queue) {
-        qemu_mutex_lock(&tg->lock);
-        schedule_next_request(blk, is_write);
-        qemu_mutex_unlock(&tg->lock);
-    }
-}
-
-static void throttle_group_restart_queue(BlockBackend *blk, bool is_write)
-{
-    Coroutine *co;
-    RestartData rd = {
-        .blk = blk,
-        .is_write = is_write
-    };
-
-    co = qemu_coroutine_create(throttle_group_restart_queue_entry, &rd);
-    aio_co_enter(blk_get_aio_context(blk), co);
-}
-
 void throttle_group_restart_blk(BlockBackend *blk)
 {
    BlockBackendPublic *blkp = blk_get_public(blk);
+    int i;

-    if (blkp->throttle_state) {
-        throttle_group_restart_queue(blk, 0);
-        throttle_group_restart_queue(blk, 1);
+    for (i = 0; i < 2; i++) {
+        while (qemu_co_enter_next(&blkp->throttled_reqs[i])) {
+            ;
+        }
    }
 }

@@ -426,13 +362,22 @@ void throttle_group_restart_blk(BlockBackend *blk)
 void throttle_group_config(BlockBackend *blk, ThrottleConfig *cfg)
 {
    BlockBackendPublic *blkp = blk_get_public(blk);
+    ThrottleTimers *tt = &blkp->throttle_timers;
    ThrottleState *ts = blkp->throttle_state;
    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
    qemu_mutex_lock(&tg->lock);
-    throttle_config(ts, tg->clock_type, cfg);
+    /* throttle_config() cancels the timers */
+    if (timer_pending(tt->timers[0])) {
+        tg->any_timer_armed[0] = false;
+    }
+    if (timer_pending(tt->timers[1])) {
+        tg->any_timer_armed[1] = false;
+    }
+    throttle_config(ts, tt, cfg);
    qemu_mutex_unlock(&tg->lock);

-    throttle_group_restart_blk(blk);
+    qemu_co_enter_next(&blkp->throttled_reqs[0]);
+    qemu_co_enter_next(&blkp->throttled_reqs[1]);
 }

 /* Get the throttle configuration from a particular group. Similar to
@@ -463,6 +408,7 @@ static void timer_cb(BlockBackend *blk, bool is_write)
    BlockBackendPublic *blkp = blk_get_public(blk);
    ThrottleState *ts = blkp->throttle_state;
    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
+    bool empty_queue;

    /* The timer has just been fired, so we can update the flag */
    qemu_mutex_lock(&tg->lock);
@@ -470,7 +416,17 @@ static void timer_cb(BlockBackend *blk, bool is_write)
    qemu_mutex_unlock(&tg->lock);

    /* Run the request that was waiting for this timer */
-    throttle_group_restart_queue(blk, is_write);
+    aio_context_acquire(blk_get_aio_context(blk));
+    empty_queue = !qemu_co_enter_next(&blkp->throttled_reqs[is_write]);
+    aio_context_release(blk_get_aio_context(blk));
+
+    /* If the request queue was empty then we have to take care of
+     * scheduling the next one */
+    if (empty_queue) {
+        qemu_mutex_lock(&tg->lock);
+        schedule_next_request(blk, is_write);
+        qemu_mutex_unlock(&tg->lock);
+    }
 }

 static void read_timer_cb(void *opaque)
@@ -496,6 +452,13 @@ void throttle_group_register_blk(BlockBackend *blk, const char *groupname)
    BlockBackendPublic *blkp = blk_get_public(blk);
    ThrottleState *ts = throttle_group_incref(groupname);
    ThrottleGroup *tg = container_of(ts, ThrottleGroup, ts);
+    int clock_type = QEMU_CLOCK_REALTIME;
+
+    if (qtest_enabled()) {
+        /* For testing block IO throttling only */
+        clock_type = QEMU_CLOCK_VIRTUAL;
+    }
+
    blkp->throttle_state = ts;

    qemu_mutex_lock(&tg->lock);
@@ -510,7 +473,7 @@ void throttle_group_register_blk(BlockBackend *blk, const char *groupname)

    throttle_timers_init(&blkp->throttle_timers,
                         blk_get_aio_context(blk),
-                         tg->clock_type,
+                         clock_type,
                         read_timer_cb,
                         write_timer_cb,
                         blk);
@@ -1,25 +1,28 @@
-# See docs/devel/tracing.txt for syntax documentation.
+# See docs/tracing.txt for syntax documentation.

 # block.c
-bdrv_open_common(void *bs, const char *filename, int flags, const char *format_name) "bs %p filename \"%s\" flags 0x%x format_name \"%s\""
+bdrv_open_common(void *bs, const char *filename, int flags, const char *format_name) "bs %p filename \"%s\" flags %#x format_name \"%s\""
 bdrv_lock_medium(void *bs, bool locked) "bs %p locked %d"

 # block/block-backend.c
-blk_co_preadv(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags) "blk %p bs %p offset %"PRId64" bytes %u flags 0x%x"
-blk_co_pwritev(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags) "blk %p bs %p offset %"PRId64" bytes %u flags 0x%x"
+blk_co_preadv(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags) "blk %p bs %p offset %"PRId64" bytes %u flags %x"
+blk_co_pwritev(void *blk, void *bs, int64_t offset, unsigned int bytes, int flags) "blk %p bs %p offset %"PRId64" bytes %u flags %x"

 # block/io.c
-bdrv_co_preadv(void *bs, int64_t offset, int64_t nbytes, unsigned int flags) "bs %p offset %"PRId64" nbytes %"PRId64" flags 0x%x"
-bdrv_co_pwritev(void *bs, int64_t offset, int64_t nbytes, unsigned int flags) "bs %p offset %"PRId64" nbytes %"PRId64" flags 0x%x"
-bdrv_co_pwrite_zeroes(void *bs, int64_t offset, int count, int flags) "bs %p offset %"PRId64" count %d flags 0x%x"
+bdrv_aio_flush(void *bs, void *opaque) "bs %p opaque %p"
+bdrv_aio_readv(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
+bdrv_aio_writev(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
+bdrv_co_readv(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
+bdrv_co_writev(void *bs, int64_t sector_num, int nb_sector) "bs %p sector_num %"PRId64" nb_sectors %d"
+bdrv_co_pwrite_zeroes(void *bs, int64_t offset, int count, int flags) "bs %p offset %"PRId64" count %d flags %#x"
 bdrv_co_do_copy_on_readv(void *bs, int64_t offset, unsigned int bytes, int64_t cluster_offset, unsigned int cluster_bytes) "bs %p offset %"PRId64" bytes %u cluster_offset %"PRId64" cluster_bytes %u"

 # block/stream.c
-stream_one_iteration(void *s, int64_t offset, uint64_t bytes, int is_allocated) "s %p offset %" PRId64 " bytes %" PRIu64 " is_allocated %d"
+stream_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
 stream_start(void *bs, void *base, void *s) "bs %p base %p s %p"

 # block/commit.c
-commit_one_iteration(void *s, int64_t offset, uint64_t bytes, int is_allocated) "s %p offset %" PRId64 " bytes %" PRIu64 " is_allocated %d"
+commit_one_iteration(void *s, int64_t sector_num, int nb_sectors, int is_allocated) "s %p sector_num %"PRId64" nb_sectors %d is_allocated %d"
 commit_start(void *bs, void *base, void *top, void *s) "bs %p base %p top %p s %p"

 # block/mirror.c
@@ -28,14 +31,14 @@ mirror_restart_iter(void *s, int64_t cnt) "s %p dirty count %"PRId64
 mirror_before_flush(void *s) "s %p"
 mirror_before_drain(void *s, int64_t cnt) "s %p dirty count %"PRId64
 mirror_before_sleep(void *s, int64_t cnt, int synced, uint64_t delay_ns) "s %p dirty count %"PRId64" synced %d delay %"PRIu64"ns"
-mirror_one_iteration(void *s, int64_t offset, uint64_t bytes) "s %p offset %" PRId64 " bytes %" PRIu64
-mirror_iteration_done(void *s, int64_t offset, uint64_t bytes, int ret) "s %p offset %" PRId64 " bytes %" PRIu64 " ret %d"
+mirror_one_iteration(void *s, int64_t sector_num, int nb_sectors) "s %p sector_num %"PRId64" nb_sectors %d"
+mirror_iteration_done(void *s, int64_t sector_num, int nb_sectors, int ret) "s %p sector_num %"PRId64" nb_sectors %d ret %d"
 mirror_yield(void *s, int64_t cnt, int buf_free_count, int in_flight) "s %p dirty count %"PRId64" free buffers %d in_flight %d"
-mirror_yield_in_flight(void *s, int64_t offset, int in_flight) "s %p offset %" PRId64 " in_flight %d"
+mirror_yield_in_flight(void *s, int64_t sector_num, int in_flight) "s %p sector_num %"PRId64" in_flight %d"

 # block/backup.c
-backup_do_cow_enter(void *job, int64_t start, int64_t offset, uint64_t bytes) "job %p start %" PRId64 " offset %" PRId64 " bytes %" PRIu64
-backup_do_cow_return(void *job, int64_t offset, uint64_t bytes, int ret) "job %p offset %" PRId64 " bytes %" PRIu64 " ret %d"
+backup_do_cow_enter(void *job, int64_t start, int64_t sector_num, int nb_sectors) "job %p start %"PRId64" sector_num %"PRId64" nb_sectors %d"
+backup_do_cow_return(void *job, int64_t sector_num, int nb_sectors, int ret) "job %p sector_num %"PRId64" nb_sectors %d ret %d"
 backup_do_cow_skip(void *job, int64_t start) "job %p start %"PRId64
 backup_do_cow_process(void *job, int64_t start) "job %p start %"PRId64
 backup_do_cow_read_fail(void *job, int64_t start, int ret) "job %p start %"PRId64" ret %d"
@@ -54,19 +57,19 @@ paio_submit_co(int64_t offset, int count, int type) "offset %"PRId64" count %d t
 paio_submit(void *acb, void *opaque, int64_t offset, int count, int type) "acb %p opaque %p offset %"PRId64" count %d type %d"

 # block/qcow2.c
-qcow2_writev_start_req(void *co, int64_t offset, int bytes) "co %p offset 0x%" PRIx64 " bytes %d"
+qcow2_writev_start_req(void *co, int64_t offset, int bytes) "co %p offset %" PRIx64 " bytes %d"
 qcow2_writev_done_req(void *co, int ret) "co %p ret %d"
 qcow2_writev_start_part(void *co) "co %p"
 qcow2_writev_done_part(void *co, int cur_bytes) "co %p cur_bytes %d"
-qcow2_writev_data(void *co, uint64_t offset) "co %p offset 0x%" PRIx64
-qcow2_pwrite_zeroes_start_req(void *co, int64_t offset, int count) "co %p offset 0x%" PRIx64 " count %d"
-qcow2_pwrite_zeroes(void *co, int64_t offset, int count) "co %p offset 0x%" PRIx64 " count %d"
+qcow2_writev_data(void *co, uint64_t offset) "co %p offset %" PRIx64
+qcow2_pwrite_zeroes_start_req(void *co, int64_t offset, int count) "co %p offset %" PRIx64 " count %d"
+qcow2_pwrite_zeroes(void *co, int64_t offset, int count) "co %p offset %" PRIx64 " count %d"

 # block/qcow2-cluster.c
-qcow2_alloc_clusters_offset(void *co, uint64_t offset, int bytes) "co %p offset 0x%" PRIx64 " bytes %d"
-qcow2_handle_copied(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offset 0x%" PRIx64 " host_offset 0x%" PRIx64 " bytes 0x%" PRIx64
-qcow2_handle_alloc(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offset 0x%" PRIx64 " host_offset 0x%" PRIx64 " bytes 0x%" PRIx64
-qcow2_do_alloc_clusters_offset(void *co, uint64_t guest_offset, uint64_t host_offset, int nb_clusters) "co %p guest_offset 0x%" PRIx64 " host_offset 0x%" PRIx64 " nb_clusters %d"
+qcow2_alloc_clusters_offset(void *co, uint64_t offset, int bytes) "co %p offset %" PRIx64 " bytes %d"
+qcow2_handle_copied(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offset %" PRIx64 " host_offset %" PRIx64 " bytes %" PRIx64
+qcow2_handle_alloc(void *co, uint64_t guest_offset, uint64_t host_offset, uint64_t bytes) "co %p guest_offset %" PRIx64 " host_offset %" PRIx64 " bytes %" PRIx64
+qcow2_do_alloc_clusters_offset(void *co, uint64_t guest_offset, uint64_t host_offset, int nb_clusters) "co %p guest_offset %" PRIx64 " host_offset %" PRIx64 " nb_clusters %d"
 qcow2_cluster_alloc_phys(void *co) "co %p"
 qcow2_cluster_link_l2(void *co, int nb_clusters) "co %p nb_clusters %d"

@@ -77,7 +80,7 @@ qcow2_l2_allocate_write_l1(void *bs, int l1_index) "bs %p l1_index %d"
 qcow2_l2_allocate_done(void *bs, int l1_index, int ret) "bs %p l1_index %d ret %d"

 # block/qcow2-cache.c
-qcow2_cache_get(void *co, int c, uint64_t offset, bool read_from_disk) "co %p is_l2_cache %d offset 0x%" PRIx64 " read_from_disk %d"
+qcow2_cache_get(void *co, int c, uint64_t offset, bool read_from_disk) "co %p is_l2_cache %d offset %" PRIx64 " read_from_disk %d"
 qcow2_cache_get_replace_entry(void *co, int c, int i) "co %p is_l2_cache %d index %d"
 qcow2_cache_get_read(void *co, int c, int i) "co %p is_l2_cache %d index %d"
 qcow2_cache_get_done(void *co, int c, int i) "co %p is_l2_cache %d index %d"
@@ -100,27 +103,10 @@ qed_need_check_timer_cb(void *s) "s %p"
 qed_start_need_check_timer(void *s) "s %p"
 qed_cancel_need_check_timer(void *s) "s %p"
 qed_aio_complete(void *s, void *acb, int ret) "s %p acb %p ret %d"
-qed_aio_setup(void *s, void *acb, int64_t sector_num, int nb_sectors, void *opaque, int flags) "s %p acb %p sector_num %"PRId64" nb_sectors %d opaque %p flags 0x%x"
+qed_aio_setup(void *s, void *acb, int64_t sector_num, int nb_sectors, void *opaque, int flags) "s %p acb %p sector_num %"PRId64" nb_sectors %d opaque %p flags %#x"
 qed_aio_next_io(void *s, void *acb, int ret, uint64_t cur_pos) "s %p acb %p ret %d cur_pos %"PRIu64
 qed_aio_read_data(void *s, void *acb, int ret, uint64_t offset, size_t len) "s %p acb %p ret %d offset %"PRIu64" len %zu"
 qed_aio_write_data(void *s, void *acb, int ret, uint64_t offset, size_t len) "s %p acb %p ret %d offset %"PRIu64" len %zu"
 qed_aio_write_prefill(void *s, void *acb, uint64_t start, size_t len, uint64_t offset) "s %p acb %p start %"PRIu64" len %zu offset %"PRIu64
 qed_aio_write_postfill(void *s, void *acb, uint64_t start, size_t len, uint64_t offset) "s %p acb %p start %"PRIu64" len %zu offset %"PRIu64
 qed_aio_write_main(void *s, void *acb, int ret, uint64_t offset, size_t len) "s %p acb %p ret %d offset %"PRIu64" len %zu"
-
-# block/vxhs.c
-vxhs_iio_callback(int error) "ctx is NULL: error %d"
-vxhs_iio_callback_chnfail(int err, int error) "QNIO channel failed, no i/o %d, %d"
-vxhs_iio_callback_unknwn(int opcode, int err) "unexpected opcode %d, errno %d"
-vxhs_aio_rw_invalid(int req) "Invalid I/O request iodir %d"
-vxhs_aio_rw_ioerr(char *guid, int iodir, uint64_t size, uint64_t off, void *acb, int ret, int err) "IO ERROR (vDisk %s) FOR : Read/Write = %d size = %"PRIu64" offset = %"PRIu64" ACB = %p. Error = %d, errno = %d"
-vxhs_get_vdisk_stat_err(char *guid, int ret, int err) "vDisk (%s) stat ioctl failed, ret = %d, errno = %d"
-vxhs_get_vdisk_stat(char *vdisk_guid, uint64_t vdisk_size) "vDisk %s stat ioctl returned size %"PRIu64
-vxhs_complete_aio(void *acb, uint64_t ret) "aio failed acb %p ret %"PRIu64
-vxhs_parse_uri_filename(const char *filename) "URI passed via bdrv_parse_filename %s"
-vxhs_open_vdiskid(const char *vdisk_id) "Opening vdisk-id %s"
-vxhs_open_hostinfo(char *of_vsa_addr, int port) "Adding host %s:%d to BDRVVXHSState"
-vxhs_open_iio_open(const char *host) "Failed to connect to storage agent on host %s"
-vxhs_parse_uri_hostinfo(char *host, int port) "Host: IP %s, Port %d"
-vxhs_close(char *vdisk_guid) "Closing vdisk %s"
-vxhs_get_creds(const char *cacert, const char *client_key, const char *client_cert) "cacert %s, client_key %s, client_cert %s"
@@ -55,7 +55,7 @@
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
 #include "qemu/bswap.h"
-#include "migration/blocker.h"
+#include "migration/migration.h"
 #include "qemu/coroutine.h"
 #include "qemu/cutils.h"
 #include "qemu/uuid.h"
@@ -172,7 +172,7 @@ typedef struct {
    /* VDI header (converted to host endianness). */
    VdiHeader header;

-    CoRwlock bmap_lock;
+    CoMutex write_lock;

    Error *migration_blocker;
 } BDRVVdiState;
@@ -485,7 +485,7 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
        goto fail_free_bmap;
    }

-    qemu_co_rwlock_init(&s->bmap_lock);
+    qemu_co_mutex_init(&s->write_lock);

    return 0;

@@ -557,9 +557,7 @@ vdi_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
               n_bytes, offset);

        /* prepare next AIO request */
-        qemu_co_rwlock_rdlock(&s->bmap_lock);
        bmap_entry = le32_to_cpu(s->bmap[block_index]);
-        qemu_co_rwlock_unlock(&s->bmap_lock);
        if (!VDI_IS_ALLOCATED(bmap_entry)) {
            /* Block not allocated, return zeros, no need to wait. */
            qemu_iovec_memset(qiov, bytes_done, 0, n_bytes);
@@ -597,7 +595,6 @@ vdi_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    uint32_t block_index;
    uint32_t offset_in_block;
    uint32_t n_bytes;
-    uint64_t data_offset;
    uint32_t bmap_first = VDI_UNALLOCATED;
    uint32_t bmap_last = VDI_UNALLOCATED;
    uint8_t *block = NULL;
@@ -617,19 +614,10 @@ vdi_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
               n_bytes, offset);

        /* prepare next AIO request */
-        qemu_co_rwlock_rdlock(&s->bmap_lock);
        bmap_entry = le32_to_cpu(s->bmap[block_index]);
        if (!VDI_IS_ALLOCATED(bmap_entry)) {
            /* Allocate new block and write to it. */
            uint64_t data_offset;
-            qemu_co_rwlock_upgrade(&s->bmap_lock);
-            bmap_entry = le32_to_cpu(s->bmap[block_index]);
-            if (VDI_IS_ALLOCATED(bmap_entry)) {
-                /* A concurrent allocation did the work for us.  */
-                qemu_co_rwlock_downgrade(&s->bmap_lock);
-                goto nonallocating_write;
-            }
-
            bmap_entry = s->header.blocks_allocated;
            s->bmap[block_index] = cpu_to_le32(bmap_entry);
            s->header.blocks_allocated++;
@@ -647,18 +635,30 @@ vdi_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
            memset(block + offset_in_block + n_bytes, 0,
                   s->block_size - n_bytes - offset_in_block);

-            /* Write the new block under CoRwLock write-side protection,
-             * so this full-cluster write does not overlap a partial write
-             * of the same cluster, issued from the "else" branch.
-             */
+            /* Note that this coroutine does not yield anywhere from reading the
+             * bmap entry until here, so in regards to all the coroutines trying
+             * to write to this cluster, the one doing the allocation will
+             * always be the first to try to acquire the lock.
+             * Therefore, it is also the first that will actually be able to
+             * acquire the lock and thus the padded cluster is written before
+             * the other coroutines can write to the affected area. */
+            qemu_co_mutex_lock(&s->write_lock);
            ret = bdrv_pwrite(bs->file, data_offset, block, s->block_size);
-            qemu_co_rwlock_unlock(&s->bmap_lock);
+            qemu_co_mutex_unlock(&s->write_lock);
        } else {
-nonallocating_write:
-            data_offset = s->header.offset_data +
-                           (uint64_t)bmap_entry * s->block_size +
-                           offset_in_block;
-            qemu_co_rwlock_unlock(&s->bmap_lock);
+            uint64_t data_offset = s->header.offset_data +
+                                   (uint64_t)bmap_entry * s->block_size +
+                                   offset_in_block;
+            qemu_co_mutex_lock(&s->write_lock);
+            /* This lock is only used to make sure the following write operation
+             * is executed after the write issued by the coroutine allocating
+             * this cluster, therefore we do not need to keep it locked.
+             * As stated above, the allocating coroutine will always try to lock
+             * the mutex before all the other concurrent accesses to that
+             * cluster, therefore at this point we can be absolutely certain
+             * that that write operation has returned (there may be other writes
+             * in flight, but they do not concern this very operation). */
+            qemu_co_mutex_unlock(&s->write_lock);

            qemu_iovec_reset(&local_qiov);
            qemu_iovec_concat(&local_qiov, qiov, bytes_done, n_bytes);
@@ -832,8 +832,7 @@ static int vdi_create(const char *filename, QemuOpts *opts, Error **errp)
    }

    if (image_type == VDI_TYPE_STATIC) {
-        ret = blk_truncate(blk, offset + blocks * block_size,
-                           PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, offset + blocks * block_size, errp);
        if (ret < 0) {
            error_prepend(errp, "Failed to statically allocate %s", filename);
            goto exit;
@@ -491,7 +491,6 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
    uint32_t cnt, sectors_read;
    uint64_t new_file_size;
    void *data = NULL;
-    int64_t file_length;
    VHDXLogDescEntries *desc_entries = NULL;
    VHDXLogEntryHeader hdr_tmp = { 0 };

@@ -511,15 +510,10 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
        if (ret < 0) {
            goto exit;
        }
-        file_length = bdrv_getlength(bs->file->bs);
-        if (file_length < 0) {
-            ret = file_length;
-            goto exit;
-        }
        /* if the log shows a FlushedFileOffset larger than our current file
         * size, then that means the file has been truncated / corrupted, and
         * we must refused to open it / use it */
-        if (hdr_tmp.flushed_file_offset > file_length) {
+        if (hdr_tmp.flushed_file_offset > bdrv_getlength(bs->file->bs)) {
            ret = -EINVAL;
            goto exit;
        }
@@ -549,30 +543,19 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
                goto exit;
            }
        }
-        if (file_length < desc_entries->hdr.last_file_offset) {
+        if (bdrv_getlength(bs->file->bs) < desc_entries->hdr.last_file_offset) {
            new_file_size = desc_entries->hdr.last_file_offset;
            if (new_file_size % (1024*1024)) {
                /* round up to nearest 1MB boundary */
-                new_file_size = QEMU_ALIGN_UP(new_file_size, MiB);
-                if (new_file_size > INT64_MAX) {
-                    ret = -EINVAL;
-                    goto exit;
-                }
-                ret = bdrv_truncate(bs->file, new_file_size, PREALLOC_MODE_OFF,
-                                    NULL);
-                if (ret < 0) {
-                    goto exit;
-                }
+                new_file_size = ((new_file_size >> 20) + 1) << 20;
+                bdrv_truncate(bs->file, new_file_size, NULL);
            }
        }
        qemu_vfree(desc_entries);
        desc_entries = NULL;
    }

-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        goto exit;
-    }
+    bdrv_flush(bs);
    /* once the log is fully flushed, indicate that we have an empty log
     * now.  This also sets the log guid to 0, to indicate an empty log */
    vhdx_log_reset(bs, s);
@@ -868,7 +851,6 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
    uint32_t partial_sectors = 0;
    uint32_t bytes_written = 0;
    uint64_t file_offset;
-    int64_t file_length;
    VHDXHeader *header;
    VHDXLogEntryHeader new_hdr;
    VHDXLogDescriptor *new_desc = NULL;
@@ -922,12 +904,6 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,

    sectors += partial_sectors;

-    file_length = bdrv_getlength(bs->file->bs);
-    if (file_length < 0) {
-        ret = file_length;
-        goto exit;
-    }
-
    /* sectors is now how many sectors the data itself takes, not
     * including the header and descriptor metadata */

@@ -937,11 +913,11 @@ static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
                .sequence_number     = s->log.sequence,
                .descriptor_count    = sectors,
                .reserved            = 0,
-                .flushed_file_offset = file_length,
-                .last_file_offset    = file_length,
-                .log_guid            = header->log_guid,
+                .flushed_file_offset = bdrv_getlength(bs->file->bs),
+                .last_file_offset    = bdrv_getlength(bs->file->bs),
              };

+    new_hdr.log_guid = header->log_guid;

    desc_sectors = vhdx_compute_desc_sectors(new_hdr.descriptor_count);

@@ -1046,11 +1022,7 @@ int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,

    /* Make sure data written (new and/or changed blocks) is stable
     * on disk, before creating log entry */
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        goto exit;
-    }
-
+    bdrv_flush(bs);
    ret = vhdx_log_write(bs, s, data, length, offset);
    if (ret < 0) {
        goto exit;
@@ -1058,11 +1030,7 @@ int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
    logs.log = s->log;

    /* Make sure log is stable on disk */
-    ret = bdrv_flush(bs);
-    if (ret < 0) {
-        goto exit;
-    }
-
+    bdrv_flush(bs);
    ret = vhdx_log_flush(bs, s, &logs);
    if (ret < 0) {
        goto exit;
@@ -24,7 +24,7 @@
 #include "qemu/crc32c.h"
 #include "qemu/bswap.h"
 #include "block/vhdx.h"
-#include "migration/blocker.h"
+#include "migration/migration.h"
 #include "qemu/uuid.h"

 /* Options for VHDX creation */
@@ -1166,23 +1166,12 @@ exit:
 static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
                                    uint64_t *new_offset)
 {
-    int64_t current_len;
-
-    current_len = bdrv_getlength(bs->file->bs);
-    if (current_len < 0) {
-        return current_len;
-    }
-
-    *new_offset = current_len;
+    *new_offset = bdrv_getlength(bs->file->bs);

    /* per the spec, the address for a block is in units of 1MB */
    *new_offset = ROUND_UP(*new_offset, 1024 * 1024);
-    if (*new_offset > INT64_MAX) {
-        return -EINVAL;
-    }

-    return bdrv_truncate(bs->file, *new_offset + s->block_size,
-                         PREALLOC_MODE_OFF, NULL);
+    return bdrv_truncate(bs->file, *new_offset + s->block_size, NULL);
 }

 /*
@@ -1618,14 +1607,17 @@ static int vhdx_create_bat(BlockBackend *blk, BDRVVHDXState *s,
    if (type == VHDX_TYPE_DYNAMIC) {
        /* All zeroes, so we can just extend the file - the end of the BAT
         * is the furthest thing we have written yet */
-        ret = blk_truncate(blk, data_file_offset, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, data_file_offset, errp);
        if (ret < 0) {
+            error_setg_errno(errp, -ret,
+                            "Failed to resize the underlying file");
            goto exit;
        }
    } else if (type == VHDX_TYPE_FIXED) {
-        ret = blk_truncate(blk, data_file_offset + image_size,
-                           PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, data_file_offset + image_size, errp);
        if (ret < 0) {
+            error_setg_errno(errp, -ret,
+                            "Failed to resize the underlying file");
            goto exit;
        }
    } else {
@@ -31,7 +31,7 @@
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "qemu/bswap.h"
-#include "migration/blocker.h"
+#include "migration/migration.h"
 #include "qemu/cutils.h"
 #include <zlib.h>

@@ -242,11 +242,10 @@ static void vmdk_free_last_extent(BlockDriverState *bs)
    s->extents = g_renew(VmdkExtent, s->extents, s->num_extents);
 }

-/* Return -ve errno, or 0 on success and write CID into *pcid. */
-static int vmdk_read_cid(BlockDriverState *bs, int parent, uint32_t *pcid)
+static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
 {
    char *desc;
-    uint32_t cid;
+    uint32_t cid = 0xffffffff;
    const char *p_name, *cid_str;
    size_t cid_str_size;
    BDRVVmdkState *s = bs->opaque;
@@ -255,7 +254,8 @@ static int vmdk_read_cid(BlockDriverState *bs, int parent, uint32_t *pcid)
    desc = g_malloc0(DESC_SIZE);
    ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
    if (ret < 0) {
-        goto out;
+        g_free(desc);
+        return 0;
    }

    if (parent) {
@@ -268,21 +268,13 @@ static int vmdk_read_cid(BlockDriverState *bs, int parent, uint32_t *pcid)

    desc[DESC_SIZE - 1] = '\0';
    p_name = strstr(desc, cid_str);
-    if (p_name == NULL) {
-        ret = -EINVAL;
-        goto out;
+    if (p_name != NULL) {
+        p_name += cid_str_size;
+        sscanf(p_name, "%" SCNx32, &cid);
    }
-    p_name += cid_str_size;
-    if (sscanf(p_name, "%" SCNx32, &cid) != 1) {
-        ret = -EINVAL;
-        goto out;
-    }
-    *pcid = cid;
-    ret = 0;

-out:
    g_free(desc);
-    return ret;
+    return cid;
 }

 static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
@@ -330,10 +322,7 @@ static int vmdk_is_cid_valid(BlockDriverState *bs)
    if (!s->cid_checked && bs->backing) {
        BlockDriverState *p_bs = bs->backing->bs;

-        if (vmdk_read_cid(p_bs, 0, &cur_pcid) != 0) {
-            /* read failure: report as not valid */
-            return 0;
-        }
+        cur_pcid = vmdk_read_cid(p_bs, 0);
        if (s->parent_cid != cur_pcid) {
            /* CID not valid */
            return 0;
@@ -986,14 +975,8 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
    if (ret) {
        goto fail;
    }
-    ret = vmdk_read_cid(bs, 0, &s->cid);
-    if (ret) {
-        goto fail;
-    }
-    ret = vmdk_read_cid(bs, 1, &s->parent_cid);
-    if (ret) {
-        goto fail;
-    }
+    s->cid = vmdk_read_cid(bs, 0);
+    s->parent_cid = vmdk_read_cid(bs, 1);
    qemu_co_mutex_init(&s->lock);

    /* Disable migration when VMDK images are used */
@@ -1731,7 +1714,7 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
    blk_set_allow_write_beyond_eof(blk, true);

    if (flat) {
-        ret = blk_truncate(blk, filesize, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(blk, filesize, errp);
        goto exit;
    }
    magic = cpu_to_be32(VMDK4_MAGIC);
@@ -1794,8 +1777,7 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
        goto exit;
    }

-    ret = blk_truncate(blk, le64_to_cpu(header.grain_offset) << 9,
-                       PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, le64_to_cpu(header.grain_offset) << 9, errp);
    if (ret < 0) {
        goto exit;
    }
@@ -2025,11 +2007,8 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
            ret = -EINVAL;
            goto exit;
        }
-        ret = vmdk_read_cid(blk_bs(blk), 0, &parent_cid);
+        parent_cid = vmdk_read_cid(blk_bs(blk), 0);
        blk_unref(blk);
-        if (ret) {
-            goto exit;
-        }
        snprintf(parent_desc_line, BUF_SIZE,
                "parentFileNameHint=\"%s\"", backing_file);
    }
@@ -2107,7 +2086,7 @@ static int vmdk_create(const char *filename, QemuOpts *opts, Error **errp)
    /* bdrv_pwrite write padding zeros to align to sector, we don't need that
     * for description file */
    if (desc_offset == 0) {
-        ret = blk_truncate(new_blk, desc_len, PREALLOC_MODE_OFF, errp);
+        ret = blk_truncate(new_blk, desc_len, errp);
    }
 exit:
    if (new_blk) {
@@ -2236,7 +2215,6 @@ static int vmdk_check(BlockDriverState *bs, BdrvCheckResult *result,
            fprintf(stderr,
                    "ERROR: could not find extent for sector %" PRId64 "\n",
                    sector_num);
-            ret = -EINVAL;
            break;
        }
        ret = get_cluster_offset(bs, extent, NULL,
@@ -2248,28 +2226,19 @@ static int vmdk_check(BlockDriverState *bs, BdrvCheckResult *result,
                    PRId64 "\n", sector_num);
            break;
        }
-        if (ret == VMDK_OK) {
-            int64_t extent_len = bdrv_getlength(extent->file->bs);
-            if (extent_len < 0) {
-                fprintf(stderr,
-                        "ERROR: could not get extent file length for sector %"
-                        PRId64 "\n", sector_num);
-                ret = extent_len;
-                break;
-            }
-            if (cluster_offset >= extent_len) {
-                fprintf(stderr,
-                        "ERROR: cluster offset for sector %"
-                        PRId64 " points after EOF\n", sector_num);
-                ret = -EINVAL;
-                break;
-            }
+        if (ret == VMDK_OK &&
+            cluster_offset >= bdrv_getlength(extent->file->bs))
+        {
+            fprintf(stderr,
+                    "ERROR: cluster offset for sector %"
+                    PRId64 " points after EOF\n", sector_num);
+            break;
        }
        sector_num += extent->cluster_sectors;
    }

    result->corruptions++;
-    return ret;
+    return 0;
 }

 static ImageInfoSpecific *vmdk_get_specific_info(BlockDriverState *bs)
@@ -28,7 +28,7 @@
 #include "block/block_int.h"
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
-#include "migration/blocker.h"
+#include "migration/migration.h"
 #include "qemu/bswap.h"
 #include "qemu/uuid.h"

@@ -219,7 +219,6 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
    uint64_t pagetable_size;
    int disk_type = VHD_DYNAMIC;
    int ret;
-    int64_t bs_size;

    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file,
                               false, errp);
@@ -412,13 +411,7 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
            }
        }

-        bs_size = bdrv_getlength(bs->file->bs);
-        if (bs_size < 0) {
-            error_setg_errno(errp, -bs_size, "Unable to learn image size");
-            ret = bs_size;
-            goto fail;
-        }
-        if (s->free_data_block_offset > bs_size) {
+        if (s->free_data_block_offset > bdrv_getlength(bs->file->bs)) {
            error_setg(errp, "block-vpc: free_data_block_offset points after "
                             "the end of file. The image has been truncated.");
            ret = -EINVAL;
@@ -467,23 +460,17 @@ static int vpc_reopen_prepare(BDRVReopenState *state,
 /*
 * Returns the absolute byte offset of the given sector in the image file.
 * If the sector is not allocated, -1 is returned instead.
- * If an error occurred trying to write an updated block bitmap back to
- * the file, -2 is returned, and the error value is written to *err.
- * This can only happen for a write operation.
 *
 * The parameter write must be 1 if the offset will be used for a write
 * operation (the block bitmaps is updated then), 0 otherwise.
- * If write is true then err must not be NULL.
 */
 static inline int64_t get_image_offset(BlockDriverState *bs, uint64_t offset,
-                                       bool write, int *err)
+                                       bool write)
 {
    BDRVVPCState *s = bs->opaque;
    uint64_t bitmap_offset, block_offset;
    uint32_t pagetable_index, offset_in_block;

-    assert(!(write && err == NULL));
-
    pagetable_index = offset / s->block_size;
    offset_in_block = offset % s->block_size;

@@ -500,20 +487,21 @@ static inline int64_t get_image_offset(BlockDriverState *bs, uint64_t offset,
       correctness. */
    if (write && (s->last_bitmap_offset != bitmap_offset)) {
        uint8_t bitmap[s->bitmap_size];
-        int r;

        s->last_bitmap_offset = bitmap_offset;
        memset(bitmap, 0xff, s->bitmap_size);
-        r = bdrv_pwrite_sync(bs->file, bitmap_offset, bitmap, s->bitmap_size);
-        if (r < 0) {
-            *err = r;
-            return -2;
-        }
+        bdrv_pwrite_sync(bs->file, bitmap_offset, bitmap, s->bitmap_size);
    }

    return block_offset;
 }

+static inline int64_t get_sector_offset(BlockDriverState *bs,
+                                        int64_t sector_num, bool write)
+{
+    return get_image_offset(bs, sector_num * BDRV_SECTOR_SIZE, write);
+}
+
 /*
 * Writes the footer to the end of the image file. This is needed when the
 * file grows as it overwrites the old footer
@@ -579,7 +567,7 @@ static int64_t alloc_block(BlockDriverState* bs, int64_t offset)
    if (ret < 0)
        goto fail;

-    return get_image_offset(bs, offset, false, NULL);
+    return get_image_offset(bs, offset, false);

 fail:
    s->free_data_block_offset -= (s->block_size + s->bitmap_size);
@@ -619,7 +607,7 @@ vpc_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    qemu_iovec_init(&local_qiov, qiov->niov);

    while (bytes > 0) {
-        image_offset = get_image_offset(bs, offset, false, NULL);
+        image_offset = get_image_offset(bs, offset, false);
        n_bytes = MIN(bytes, s->block_size - (offset % s->block_size));

        if (image_offset == -1) {
@@ -656,7 +644,7 @@ vpc_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    int64_t image_offset;
    int64_t n_bytes;
    int64_t bytes_done = 0;
-    int ret = 0;
+    int ret;
    VHDFooter *footer =  (VHDFooter *) s->footer_buf;
    QEMUIOVector local_qiov;

@@ -668,11 +656,7 @@ vpc_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
    qemu_iovec_init(&local_qiov, qiov->niov);

    while (bytes > 0) {
-        image_offset = get_image_offset(bs, offset, true, &ret);
-        if (image_offset == -2) {
-            /* Failed to write block bitmap: can't proceed with write */
-            goto fail;
-        }
+        image_offset = get_image_offset(bs, offset, true);
        n_bytes = MIN(bytes, s->block_size - (offset % s->block_size));

        if (image_offset == -1) {
@@ -712,23 +696,19 @@ static int64_t coroutine_fn vpc_co_get_block_status(BlockDriverState *bs,
    VHDFooter *footer = (VHDFooter*) s->footer_buf;
    int64_t start, offset;
    bool allocated;
-    int64_t ret;
    int n;

    if (be32_to_cpu(footer->type) == VHD_FIXED) {
        *pnum = nb_sectors;
        *file = bs->file->bs;
-        return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID |
+        return BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID | BDRV_BLOCK_DATA |
               (sector_num << BDRV_SECTOR_BITS);
    }

-    qemu_co_mutex_lock(&s->lock);
-
-    offset = get_image_offset(bs, sector_num << BDRV_SECTOR_BITS, false, NULL);
+    offset = get_sector_offset(bs, sector_num, 0);
    start = offset;
    allocated = (offset != -1);
    *pnum = 0;
-    ret = 0;

    do {
        /* All sectors in a block are contiguous (without using the bitmap) */
@@ -743,18 +723,15 @@ static int64_t coroutine_fn vpc_co_get_block_status(BlockDriverState *bs,
         * sectors since there is always a bitmap in between. */
        if (allocated) {
            *file = bs->file->bs;
-            ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
-            break;
+            return BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID | start;
        }
        if (nb_sectors == 0) {
            break;
        }
-        offset = get_image_offset(bs, sector_num << BDRV_SECTOR_BITS, false,
-                                  NULL);
+        offset = get_sector_offset(bs, sector_num, 0);
    } while (offset == -1);

-    qemu_co_mutex_unlock(&s->lock);
-    return ret;
+    return 0;
 }

 /*
@@ -881,7 +858,7 @@ static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
    /* Add footer to total size */
    total_size += HEADER_SIZE;

-    ret = blk_truncate(blk, total_size, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, total_size, errp);
    if (ret < 0) {
        return ret;
    }
@@ -1,575 +0,0 @@
-/*
- * QEMU Block driver for Veritas HyperScale (VxHS)
- *
- * Copyright (c) 2017 Veritas Technologies LLC.
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include <qnio/qnio_api.h>
-#include <sys/param.h>
-#include "block/block_int.h"
-#include "qapi/qmp/qerror.h"
-#include "qapi/qmp/qdict.h"
-#include "qapi/qmp/qstring.h"
-#include "trace.h"
-#include "qemu/uri.h"
-#include "qapi/error.h"
-#include "qemu/uuid.h"
-#include "crypto/tlscredsx509.h"
-
-#define VXHS_OPT_FILENAME           "filename"
-#define VXHS_OPT_VDISK_ID           "vdisk-id"
-#define VXHS_OPT_SERVER             "server"
-#define VXHS_OPT_HOST               "host"
-#define VXHS_OPT_PORT               "port"
-
-/* Only accessed under QEMU global mutex */
-static uint32_t vxhs_ref;
-
-typedef enum {
-    VDISK_AIO_READ,
-    VDISK_AIO_WRITE,
-} VDISKAIOCmd;
-
-/*
- * HyperScale AIO callbacks structure
- */
-typedef struct VXHSAIOCB {
-    BlockAIOCB common;
-    int err;
-} VXHSAIOCB;
-
-typedef struct VXHSvDiskHostsInfo {
-    void *dev_handle; /* Device handle */
-    char *host; /* Host name or IP */
-    int port; /* Host's port number */
-} VXHSvDiskHostsInfo;
-
-/*
- * Structure per vDisk maintained for state
- */
-typedef struct BDRVVXHSState {
-    VXHSvDiskHostsInfo vdisk_hostinfo; /* Per host info */
-    char *vdisk_guid;
-    char *tlscredsid; /* tlscredsid */
-} BDRVVXHSState;
-
-static void vxhs_complete_aio_bh(void *opaque)
-{
-    VXHSAIOCB *acb = opaque;
-    BlockCompletionFunc *cb = acb->common.cb;
-    void *cb_opaque = acb->common.opaque;
-    int ret = 0;
-
-    if (acb->err != 0) {
-        trace_vxhs_complete_aio(acb, acb->err);
-        ret = (-EIO);
-    }
-
-    qemu_aio_unref(acb);
-    cb(cb_opaque, ret);
-}
-
-/*
- * Called from a libqnio thread
- */
-static void vxhs_iio_callback(void *ctx, uint32_t opcode, uint32_t error)
-{
-    VXHSAIOCB *acb = NULL;
-
-    switch (opcode) {
-    case IRP_READ_REQUEST:
-    case IRP_WRITE_REQUEST:
-
-        /*
-         * ctx is VXHSAIOCB*
-         * ctx is NULL if error is QNIOERROR_CHANNEL_HUP
-         */
-        if (ctx) {
-            acb = ctx;
-        } else {
-            trace_vxhs_iio_callback(error);
-            goto out;
-        }
-
-        if (error) {
-            if (!acb->err) {
-                acb->err = error;
-            }
-            trace_vxhs_iio_callback(error);
-        }
-
-        aio_bh_schedule_oneshot(bdrv_get_aio_context(acb->common.bs),
-                                vxhs_complete_aio_bh, acb);
-        break;
-
-    default:
-        if (error == QNIOERROR_HUP) {
-            /*
-             * Channel failed, spontaneous notification,
-             * not in response to I/O
-             */
-            trace_vxhs_iio_callback_chnfail(error, errno);
-        } else {
-            trace_vxhs_iio_callback_unknwn(opcode, error);
-        }
-        break;
-    }
-out:
-    return;
-}
-
-static QemuOptsList runtime_opts = {
-    .name = "vxhs",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
-    .desc = {
-        {
-            .name = VXHS_OPT_FILENAME,
-            .type = QEMU_OPT_STRING,
-            .help = "URI to the Veritas HyperScale image",
-        },
-        {
-            .name = VXHS_OPT_VDISK_ID,
-            .type = QEMU_OPT_STRING,
-            .help = "UUID of the VxHS vdisk",
-        },
-        {
-            .name = "tls-creds",
-            .type = QEMU_OPT_STRING,
-            .help = "ID of the TLS/SSL credentials to use",
-        },
-        { /* end of list */ }
-    },
-};
-
-static QemuOptsList runtime_tcp_opts = {
-    .name = "vxhs_tcp",
-    .head = QTAILQ_HEAD_INITIALIZER(runtime_tcp_opts.head),
-    .desc = {
-        {
-            .name = VXHS_OPT_HOST,
-            .type = QEMU_OPT_STRING,
-            .help = "host address (ipv4 addresses)",
-        },
-        {
-            .name = VXHS_OPT_PORT,
-            .type = QEMU_OPT_NUMBER,
-            .help = "port number on which VxHSD is listening (default 9999)",
-            .def_value_str = "9999"
-        },
-        { /* end of list */ }
-    },
-};
-
-/*
- * Parse incoming URI and populate *options with the host
- * and device information
- */
-static int vxhs_parse_uri(const char *filename, QDict *options)
-{
-    URI *uri = NULL;
-    char *port;
-    int ret = 0;
-
-    trace_vxhs_parse_uri_filename(filename);
-    uri = uri_parse(filename);
-    if (!uri || !uri->server || !uri->path) {
-        uri_free(uri);
-        return -EINVAL;
-    }
-
-    qdict_put_str(options, VXHS_OPT_SERVER ".host", uri->server);
-
-    if (uri->port) {
-        port = g_strdup_printf("%d", uri->port);
-        qdict_put_str(options, VXHS_OPT_SERVER ".port", port);
-        g_free(port);
-    }
-
-    qdict_put_str(options, "vdisk-id", uri->path);
-
-    trace_vxhs_parse_uri_hostinfo(uri->server, uri->port);
-    uri_free(uri);
-
-    return ret;
-}
-
-static void vxhs_parse_filename(const char *filename, QDict *options,
-                                Error **errp)
-{
-    if (qdict_haskey(options, "vdisk-id") || qdict_haskey(options, "server")) {
-        error_setg(errp, "vdisk-id/server and a file name may not be specified "
-                         "at the same time");
-        return;
-    }
-
-    if (strstr(filename, "://")) {
-        int ret = vxhs_parse_uri(filename, options);
-        if (ret < 0) {
-            error_setg(errp, "Invalid URI. URI should be of the form "
-                       "  vxhs://<host_ip>:<port>/<vdisk-id>");
-        }
-    }
-}
-
-static int vxhs_init_and_ref(void)
-{
-    if (vxhs_ref++ == 0) {
-        if (iio_init(QNIO_VERSION, vxhs_iio_callback)) {
-            return -ENODEV;
-        }
-    }
-    return 0;
-}
-
-static void vxhs_unref(void)
-{
-    if (--vxhs_ref == 0) {
-        iio_fini();
-    }
-}
-
-static void vxhs_get_tls_creds(const char *id, char **cacert,
-                               char **key, char **cert, Error **errp)
-{
-    Object *obj;
-    QCryptoTLSCreds *creds;
-    QCryptoTLSCredsX509 *creds_x509;
-
-    obj = object_resolve_path_component(
-        object_get_objects_root(), id);
-
-    if (!obj) {
-        error_setg(errp, "No TLS credentials with id '%s'",
-                   id);
-        return;
-    }
-
-    creds_x509 = (QCryptoTLSCredsX509 *)
-        object_dynamic_cast(obj, TYPE_QCRYPTO_TLS_CREDS_X509);
-
-    if (!creds_x509) {
-        error_setg(errp, "Object with id '%s' is not TLS credentials",
-                   id);
-        return;
-    }
-
-    creds = &creds_x509->parent_obj;
-
-    if (creds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
-        error_setg(errp,
-                   "Expecting TLS credentials with a client endpoint");
-        return;
-    }
-
-    /*
-     * Get the cacert, client_cert and client_key file names.
-     */
-    if (!creds->dir) {
-        error_setg(errp, "TLS object missing 'dir' property value");
-        return;
-    }
-
-    *cacert = g_strdup_printf("%s/%s", creds->dir,
-                              QCRYPTO_TLS_CREDS_X509_CA_CERT);
-    *cert = g_strdup_printf("%s/%s", creds->dir,
-                            QCRYPTO_TLS_CREDS_X509_CLIENT_CERT);
-    *key = g_strdup_printf("%s/%s", creds->dir,
-                           QCRYPTO_TLS_CREDS_X509_CLIENT_KEY);
-}
-
-static int vxhs_open(BlockDriverState *bs, QDict *options,
-                     int bdrv_flags, Error **errp)
-{
-    BDRVVXHSState *s = bs->opaque;
-    void *dev_handlep;
-    QDict *backing_options = NULL;
-    QemuOpts *opts = NULL;
-    QemuOpts *tcp_opts = NULL;
-    char *of_vsa_addr = NULL;
-    Error *local_err = NULL;
-    const char *vdisk_id_opt;
-    const char *server_host_opt;
-    int ret = 0;
-    char *cacert = NULL;
-    char *client_key = NULL;
-    char *client_cert = NULL;
-
-    ret = vxhs_init_and_ref();
-    if (ret < 0) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    /* Create opts info from runtime_opts and runtime_tcp_opts list */
-    opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort);
-    tcp_opts = qemu_opts_create(&runtime_tcp_opts, NULL, 0, &error_abort);
-
-    qemu_opts_absorb_qdict(opts, options, &local_err);
-    if (local_err) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    /* vdisk-id is the disk UUID */
-    vdisk_id_opt = qemu_opt_get(opts, VXHS_OPT_VDISK_ID);
-    if (!vdisk_id_opt) {
-        error_setg(&local_err, QERR_MISSING_PARAMETER, VXHS_OPT_VDISK_ID);
-        ret = -EINVAL;
-        goto out;
-    }
-
-    /* vdisk-id may contain a leading '/' */
-    if (strlen(vdisk_id_opt) > UUID_FMT_LEN + 1) {
-        error_setg(&local_err, "vdisk-id cannot be more than %d characters",
-                   UUID_FMT_LEN);
-        ret = -EINVAL;
-        goto out;
-    }
-
-    s->vdisk_guid = g_strdup(vdisk_id_opt);
-    trace_vxhs_open_vdiskid(vdisk_id_opt);
-
-    /* get the 'server.' arguments */
-    qdict_extract_subqdict(options, &backing_options, VXHS_OPT_SERVER".");
-
-    qemu_opts_absorb_qdict(tcp_opts, backing_options, &local_err);
-    if (local_err != NULL) {
-        ret = -EINVAL;
-        goto out;
-    }
-
-    server_host_opt = qemu_opt_get(tcp_opts, VXHS_OPT_HOST);
-    if (!server_host_opt) {
-        error_setg(&local_err, QERR_MISSING_PARAMETER,
-                   VXHS_OPT_SERVER"."VXHS_OPT_HOST);
-        ret = -EINVAL;
-        goto out;
-    }
-
-    if (strlen(server_host_opt) > MAXHOSTNAMELEN) {
-        error_setg(&local_err, "server.host cannot be more than %d characters",
-                   MAXHOSTNAMELEN);
-        ret = -EINVAL;
-        goto out;
-    }
-
-    /* check if we got tls-creds via the --object argument */
-    s->tlscredsid = g_strdup(qemu_opt_get(opts, "tls-creds"));
-    if (s->tlscredsid) {
-        vxhs_get_tls_creds(s->tlscredsid, &cacert, &client_key,
-                           &client_cert, &local_err);
-        if (local_err != NULL) {
-            ret = -EINVAL;
-            goto out;
-        }
-        trace_vxhs_get_creds(cacert, client_key, client_cert);
-    }
-
-    s->vdisk_hostinfo.host = g_strdup(server_host_opt);
-    s->vdisk_hostinfo.port = g_ascii_strtoll(qemu_opt_get(tcp_opts,
-                                                          VXHS_OPT_PORT),
-                                                          NULL, 0);
-
-    trace_vxhs_open_hostinfo(s->vdisk_hostinfo.host,
-                             s->vdisk_hostinfo.port);
-
-    of_vsa_addr = g_strdup_printf("of://%s:%d",
-                                  s->vdisk_hostinfo.host,
-                                  s->vdisk_hostinfo.port);
-
-    /*
-     * Open qnio channel to storage agent if not opened before
-     */
-    dev_handlep = iio_open(of_vsa_addr, s->vdisk_guid, 0,
-                           cacert, client_key, client_cert);
-    if (dev_handlep == NULL) {
-        trace_vxhs_open_iio_open(of_vsa_addr);
-        ret = -ENODEV;
-        goto out;
-    }
-    s->vdisk_hostinfo.dev_handle = dev_handlep;
-
-out:
-    g_free(of_vsa_addr);
-    QDECREF(backing_options);
-    qemu_opts_del(tcp_opts);
-    qemu_opts_del(opts);
-    g_free(cacert);
-    g_free(client_key);
-    g_free(client_cert);
-
-    if (ret < 0) {
-        vxhs_unref();
-        error_propagate(errp, local_err);
-        g_free(s->vdisk_hostinfo.host);
-        g_free(s->vdisk_guid);
-        g_free(s->tlscredsid);
-        s->vdisk_guid = NULL;
-    }
-
-    return ret;
-}
-
-static const AIOCBInfo vxhs_aiocb_info = {
-    .aiocb_size = sizeof(VXHSAIOCB)
-};
-
-/*
- * This allocates QEMU-VXHS callback for each IO
- * and is passed to QNIO. When QNIO completes the work,
- * it will be passed back through the callback.
- */
-static BlockAIOCB *vxhs_aio_rw(BlockDriverState *bs, int64_t sector_num,
-                               QEMUIOVector *qiov, int nb_sectors,
-                               BlockCompletionFunc *cb, void *opaque,
-                               VDISKAIOCmd iodir)
-{
-    VXHSAIOCB *acb = NULL;
-    BDRVVXHSState *s = bs->opaque;
-    size_t size;
-    uint64_t offset;
-    int iio_flags = 0;
-    int ret = 0;
-    void *dev_handle = s->vdisk_hostinfo.dev_handle;
-
-    offset = sector_num * BDRV_SECTOR_SIZE;
-    size = nb_sectors * BDRV_SECTOR_SIZE;
-    acb = qemu_aio_get(&vxhs_aiocb_info, bs, cb, opaque);
-
-    /*
-     * Initialize VXHSAIOCB.
-     */
-    acb->err = 0;
-
-    iio_flags = IIO_FLAG_ASYNC;
-
-    switch (iodir) {
-    case VDISK_AIO_WRITE:
-            ret = iio_writev(dev_handle, acb, qiov->iov, qiov->niov,
-                             offset, (uint64_t)size, iio_flags);
-            break;
-    case VDISK_AIO_READ:
-            ret = iio_readv(dev_handle, acb, qiov->iov, qiov->niov,
-                            offset, (uint64_t)size, iio_flags);
-            break;
-    default:
-            trace_vxhs_aio_rw_invalid(iodir);
-            goto errout;
-    }
-
-    if (ret != 0) {
-        trace_vxhs_aio_rw_ioerr(s->vdisk_guid, iodir, size, offset,
-                                acb, ret, errno);
-        goto errout;
-    }
-    return &acb->common;
-
-errout:
-    qemu_aio_unref(acb);
-    return NULL;
-}
-
-static BlockAIOCB *vxhs_aio_readv(BlockDriverState *bs,
-                                   int64_t sector_num, QEMUIOVector *qiov,
-                                   int nb_sectors,
-                                   BlockCompletionFunc *cb, void *opaque)
-{
-    return vxhs_aio_rw(bs, sector_num, qiov, nb_sectors, cb,
-                       opaque, VDISK_AIO_READ);
-}
-
-static BlockAIOCB *vxhs_aio_writev(BlockDriverState *bs,
-                                   int64_t sector_num, QEMUIOVector *qiov,
-                                   int nb_sectors,
-                                   BlockCompletionFunc *cb, void *opaque)
-{
-    return vxhs_aio_rw(bs, sector_num, qiov, nb_sectors,
-                       cb, opaque, VDISK_AIO_WRITE);
-}
-
-static void vxhs_close(BlockDriverState *bs)
-{
-    BDRVVXHSState *s = bs->opaque;
-
-    trace_vxhs_close(s->vdisk_guid);
-
-    g_free(s->vdisk_guid);
-    s->vdisk_guid = NULL;
-
-    /*
-     * Close vDisk device
-     */
-    if (s->vdisk_hostinfo.dev_handle) {
-        iio_close(s->vdisk_hostinfo.dev_handle);
-        s->vdisk_hostinfo.dev_handle = NULL;
-    }
-
-    vxhs_unref();
-
-    /*
-     * Free the dynamically allocated host string etc
-     */
-    g_free(s->vdisk_hostinfo.host);
-    g_free(s->tlscredsid);
-    s->tlscredsid = NULL;
-    s->vdisk_hostinfo.host = NULL;
-    s->vdisk_hostinfo.port = 0;
-}
-
-static int64_t vxhs_get_vdisk_stat(BDRVVXHSState *s)
-{
-    int64_t vdisk_size = -1;
-    int ret = 0;
-    void *dev_handle = s->vdisk_hostinfo.dev_handle;
-
-    ret = iio_ioctl(dev_handle, IOR_VDISK_STAT, &vdisk_size, 0);
-    if (ret < 0) {
-        trace_vxhs_get_vdisk_stat_err(s->vdisk_guid, ret, errno);
-        return -EIO;
-    }
-
-    trace_vxhs_get_vdisk_stat(s->vdisk_guid, vdisk_size);
-    return vdisk_size;
-}
-
-/*
- * Returns the size of vDisk in bytes. This is required
- * by QEMU block upper block layer so that it is visible
- * to guest.
- */
-static int64_t vxhs_getlength(BlockDriverState *bs)
-{
-    BDRVVXHSState *s = bs->opaque;
-    int64_t vdisk_size;
-
-    vdisk_size = vxhs_get_vdisk_stat(s);
-    if (vdisk_size < 0) {
-        return -EIO;
-    }
-
-    return vdisk_size;
-}
-
-static BlockDriver bdrv_vxhs = {
-    .format_name                  = "vxhs",
-    .protocol_name                = "vxhs",
-    .instance_size                = sizeof(BDRVVXHSState),
-    .bdrv_file_open               = vxhs_open,
-    .bdrv_parse_filename          = vxhs_parse_filename,
-    .bdrv_close                   = vxhs_close,
-    .bdrv_getlength               = vxhs_getlength,
-    .bdrv_aio_readv               = vxhs_aio_readv,
-    .bdrv_aio_writev              = vxhs_aio_writev,
-};
-
-static void bdrv_vxhs_init(void)
-{
-    bdrv_register(&bdrv_vxhs);
-}
-
-block_init(bdrv_vxhs_init);
@@ -103,8 +103,9 @@ static QCryptoTLSCreds *nbd_get_tls_creds(const char *id, Error **errp)
 }


-void nbd_server_start(SocketAddress *addr, const char *tls_creds,
-                      Error **errp)
+void qmp_nbd_server_start(SocketAddress *addr,
+                          bool has_tls_creds, const char *tls_creds,
+                          Error **errp)
 {
    if (nbd_server) {
        error_setg(errp, "NBD server already running");
@@ -121,14 +122,14 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds,
        goto error;
    }

-    if (tls_creds) {
+    if (has_tls_creds) {
        nbd_server->tlscreds = nbd_get_tls_creds(tls_creds, errp);
        if (!nbd_server->tlscreds) {
            goto error;
        }

-        /* TODO SOCKET_ADDRESS_TYPE_FD where fd has AF_INET or AF_INET6 */
-        if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
+        /* TODO SOCKET_ADDRESS_KIND_FD where fd has AF_INET or AF_INET6 */
+        if (addr->type != SOCKET_ADDRESS_KIND_INET) {
            error_setg(errp, "TLS is only supported with IPv4/IPv6");
            goto error;
        }
@@ -148,16 +149,6 @@ void nbd_server_start(SocketAddress *addr, const char *tls_creds,
    nbd_server = NULL;
 }

-void qmp_nbd_server_start(SocketAddressLegacy *addr,
-                          bool has_tls_creds, const char *tls_creds,
-                          Error **errp)
-{
-    SocketAddress *addr_flat = socket_address_flatten(addr);
-
-    nbd_server_start(addr_flat, tls_creds, errp);
-    qapi_free_SocketAddress(addr_flat);
-}
-
 void qmp_nbd_server_add(const char *device, bool has_writable, bool writable,
                        Error **errp)
 {
@@ -50,7 +50,6 @@
 #include "qmp-commands.h"
 #include "block/trace.h"
 #include "sysemu/arch_init.h"
-#include "sysemu/qtest.h"
 #include "qemu/cutils.h"
 #include "qemu/help_option.h"
 #include "qemu/throttle-options.h"
@@ -335,9 +334,8 @@ static bool parse_stats_intervals(BlockAcctStats *stats, QList *intervals,
            break;
        }

-        case QTYPE_QNUM: {
-            int64_t length = qnum_get_int(qobject_to_qnum(entry->value));
-
+        case QTYPE_QINT: {
+            int64_t length = qint_get_int(qobject_to_qint(entry->value));
            if (length > 0 && length <= UINT_MAX) {
                block_acct_add_interval(stats, (unsigned) length);
            } else {
@@ -593,7 +591,11 @@ static BlockBackend *blockdev_init(const char *file, QDict *bs_opts,

        bs->detect_zeroes = detect_zeroes;

-        block_acct_setup(blk_get_stats(blk), account_invalid, account_failed);
+        if (bdrv_key_required(bs)) {
+            autostart = 0;
+        }
+
+        block_acct_init(blk_get_stats(blk), account_invalid, account_failed);

        if (!parse_stats_intervals(blk_get_stats(blk), interval_list, errp)) {
            blk_unref(blk);
@@ -795,9 +797,6 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
    const char *filename;
    Error *local_err = NULL;
    int i;
-    const char *deprecated[] = {
-        "serial", "trans", "secs", "heads", "cyls", "addr"
-    };

    /* Change legacy command line options into QMP ones */
    static const struct {
@@ -881,16 +880,6 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
                "update your scripts.\n");
    }

-    /* Other deprecated options */
-    if (!qtest_enabled()) {
-        for (i = 0; i < ARRAY_SIZE(deprecated); i++) {
-            if (qemu_opt_get(legacy_opts, deprecated[i]) != NULL) {
-                error_report("'%s' is deprecated, please use the corresponding "
-                             "option of '-device' instead", deprecated[i]);
-            }
-        }
-    }
-
    /* Media type */
    value = qemu_opt_get(legacy_opts, "media");
    if (value) {
@@ -910,7 +899,7 @@ DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type)
    copy_on_read = qemu_opt_get_bool(legacy_opts, "copy-on-read", false);

    if (read_only && copy_on_read) {
-        warn_report("disabling copy-on-read on read-only drive");
+        error_report("warning: disabling copy-on-read on read-only drive");
        copy_on_read = false;
    }

@@ -1373,10 +1362,12 @@ out_aio_context:
 static BdrvDirtyBitmap *block_dirty_bitmap_lookup(const char *node,
                                                  const char *name,
                                                  BlockDriverState **pbs,
+                                                  AioContext **paio,
                                                  Error **errp)
 {
    BlockDriverState *bs;
    BdrvDirtyBitmap *bitmap;
+    AioContext *aio_context;

    if (!node) {
        error_setg(errp, "Node cannot be NULL");
@@ -1392,17 +1383,29 @@ static BdrvDirtyBitmap *block_dirty_bitmap_lookup(const char *node,
        return NULL;
    }

+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+
    bitmap = bdrv_find_dirty_bitmap(bs, name);
    if (!bitmap) {
        error_setg(errp, "Dirty bitmap '%s' not found", name);
-        return NULL;
+        goto fail;
    }

    if (pbs) {
        *pbs = bs;
    }
+    if (paio) {
+        *paio = aio_context;
+    } else {
+        aio_context_release(aio_context);
+    }

    return bitmap;
+
+ fail:
+    aio_context_release(aio_context);
+    return NULL;
 }

 /* New and old BlockDriverState structs for atomic group operations */
@@ -1710,8 +1713,7 @@ static void external_snapshot_prepare(BlkActionState *common,
        }

        flags = state->old_bs->open_flags;
-        flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_COPY_ON_READ);
-        flags |= BDRV_O_NO_BACKING;
+        flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);

        /* create new image w/backing file */
        mode = s->has_mode ? s->mode : NEW_IMAGE_MODE_ABSOLUTE_PATHS;
@@ -1724,7 +1726,7 @@ static void external_snapshot_prepare(BlkActionState *common,
            bdrv_img_create(new_image_file, format,
                            state->old_bs->filename,
                            state->old_bs->drv->format_name,
-                            NULL, size, flags, false, &local_err);
+                            NULL, size, flags, &local_err, false);
            if (local_err) {
                error_propagate(errp, local_err);
                return;
@@ -1736,6 +1738,8 @@ static void external_snapshot_prepare(BlkActionState *common,
            qdict_put_str(options, "node-name", snapshot_node_name);
        }
        qdict_put_str(options, "driver", format);
+
+        flags |= BDRV_O_NO_BACKING;
    }

    state->new_bs = bdrv_open(new_image_file, snapshot_ref, options, flags,
@@ -1787,7 +1791,7 @@ static void external_snapshot_commit(BlkActionState *common)
    /* We don't need (or want) to use the transactional
     * bdrv_reopen_multiple() across all the entries at once, because we
     * don't want to abort all of them if one of them fails the reopen */
-    if (!atomic_read(&state->old_bs->copy_on_read)) {
+    if (!state->old_bs->copy_on_read) {
        bdrv_reopen(state->old_bs, state->old_bs->open_flags & ~BDRV_O_RDWR,
                    NULL);
    }
@@ -1799,11 +1803,7 @@ static void external_snapshot_abort(BlkActionState *common)
                             DO_UPCAST(ExternalSnapshotState, common, common);
    if (state->new_bs) {
        if (state->overlay_appended) {
-            bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
-                                          close state->old_bs; we need it */
-            bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
            bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
-            bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
        }
    }
 }
@@ -1982,8 +1982,6 @@ static void block_dirty_bitmap_add_prepare(BlkActionState *common,
    /* AIO context taken and released within qmp_block_dirty_bitmap_add */
    qmp_block_dirty_bitmap_add(action->node, action->name,
                               action->has_granularity, action->granularity,
-                               action->has_persistent, action->persistent,
-                               action->has_autoload, action->autoload,
                               &local_err);

    if (!local_err) {
@@ -2023,6 +2021,7 @@ static void block_dirty_bitmap_clear_prepare(BlkActionState *common,
    state->bitmap = block_dirty_bitmap_lookup(action->node,
                                              action->name,
                                              &state->bs,
+                                              &state->aio_context,
                                              errp);
    if (!state->bitmap) {
        return;
@@ -2034,9 +2033,6 @@ static void block_dirty_bitmap_clear_prepare(BlkActionState *common,
    } else if (!bdrv_dirty_bitmap_enabled(state->bitmap)) {
        error_setg(errp, "Cannot clear a disabled bitmap");
        return;
-    } else if (bdrv_dirty_bitmap_readonly(state->bitmap)) {
-        error_setg(errp, "Cannot clear a readonly bitmap");
-        return;
    }

    bdrv_clear_dirty_bitmap(state->bitmap, &state->backup);
@@ -2265,8 +2261,24 @@ void qmp_block_passwd(bool has_device, const char *device,
                      bool has_node_name, const char *node_name,
                      const char *password, Error **errp)
 {
-    error_setg(errp,
-               "Setting block passwords directly is no longer supported");
+    Error *local_err = NULL;
+    BlockDriverState *bs;
+    AioContext *aio_context;
+
+    bs = bdrv_lookup_bs(has_device ? device : NULL,
+                        has_node_name ? node_name : NULL,
+                        &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+
+    bdrv_add_key(bs, password, errp);
+
+    aio_context_release(aio_context);
 }

 /*
@@ -2575,6 +2587,12 @@ void qmp_blockdev_change_medium(bool has_device, const char *device,
        goto fail;
    }

+    bdrv_add_key(medium_bs, NULL, &err);
+    if (err) {
+        error_propagate(errp, err);
+        goto fail;
+    }
+
    rc = do_open_tray(has_device ? device : NULL,
                      has_id ? id : NULL,
                      false, &err);
@@ -2709,12 +2727,10 @@ out:

 void qmp_block_dirty_bitmap_add(const char *node, const char *name,
                                bool has_granularity, uint32_t granularity,
-                                bool has_persistent, bool persistent,
-                                bool has_autoload, bool autoload,
                                Error **errp)
 {
+    AioContext *aio_context;
    BlockDriverState *bs;
-    BdrvDirtyBitmap *bitmap;

    if (!name || name[0] == '\0') {
        error_setg(errp, "Bitmap name cannot be empty");
@@ -2726,53 +2742,34 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
        return;
    }

+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+
    if (has_granularity) {
        if (granularity < 512 || !is_power_of_2(granularity)) {
            error_setg(errp, "Granularity must be power of 2 "
                             "and at least 512");
-            return;
+            goto out;
        }
    } else {
        /* Default to cluster size, if available: */
        granularity = bdrv_get_default_bitmap_granularity(bs);
    }

-    if (!has_persistent) {
-        persistent = false;
-    }
-    if (!has_autoload) {
-        autoload = false;
-    }
+    bdrv_create_dirty_bitmap(bs, granularity, name, errp);

-    if (has_autoload && !persistent) {
-        error_setg(errp, "Autoload flag must be used only for persistent "
-                         "bitmaps");
-        return;
-    }
-
-    if (persistent &&
-        !bdrv_can_store_new_dirty_bitmap(bs, name, granularity, errp))
-    {
-        return;
-    }
-
-    bitmap = bdrv_create_dirty_bitmap(bs, granularity, name, errp);
-    if (bitmap == NULL) {
-        return;
-    }
-
-    bdrv_dirty_bitmap_set_persistance(bitmap, persistent);
-    bdrv_dirty_bitmap_set_autoload(bitmap, autoload);
+ out:
+    aio_context_release(aio_context);
 }

 void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
                                   Error **errp)
 {
+    AioContext *aio_context;
    BlockDriverState *bs;
    BdrvDirtyBitmap *bitmap;
-    Error *local_err = NULL;

-    bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
+    bitmap = block_dirty_bitmap_lookup(node, name, &bs, &aio_context, errp);
    if (!bitmap || !bs) {
        return;
    }
@@ -2781,19 +2778,13 @@ void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
        error_setg(errp,
                   "Bitmap '%s' is currently frozen and cannot be removed",
                   name);
-        return;
+        goto out;
    }
-
-    if (bdrv_dirty_bitmap_get_persistance(bitmap)) {
-        bdrv_remove_persistent_dirty_bitmap(bs, name, &local_err);
-        if (local_err != NULL) {
-            error_propagate(errp, local_err);
-            return;
-        }
-    }
-
    bdrv_dirty_bitmap_make_anon(bitmap);
    bdrv_release_dirty_bitmap(bs, bitmap);
+
+ out:
+    aio_context_release(aio_context);
 }

 /**
@@ -2803,10 +2794,11 @@ void qmp_block_dirty_bitmap_remove(const char *node, const char *name,
 void qmp_block_dirty_bitmap_clear(const char *node, const char *name,
                                  Error **errp)
 {
+    AioContext *aio_context;
    BdrvDirtyBitmap *bitmap;
    BlockDriverState *bs;

-    bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
+    bitmap = block_dirty_bitmap_lookup(node, name, &bs, &aio_context, errp);
    if (!bitmap || !bs) {
        return;
    }
@@ -2815,43 +2807,18 @@ void qmp_block_dirty_bitmap_clear(const char *node, const char *name,
        error_setg(errp,
                   "Bitmap '%s' is currently frozen and cannot be modified",
                   name);
-        return;
+        goto out;
    } else if (!bdrv_dirty_bitmap_enabled(bitmap)) {
        error_setg(errp,
                   "Bitmap '%s' is currently disabled and cannot be cleared",
                   name);
-        return;
-    } else if (bdrv_dirty_bitmap_readonly(bitmap)) {
-        error_setg(errp, "Bitmap '%s' is readonly and cannot be cleared", name);
-        return;
+        goto out;
    }

    bdrv_clear_dirty_bitmap(bitmap, NULL);
-}

-BlockDirtyBitmapSha256 *qmp_x_debug_block_dirty_bitmap_sha256(const char *node,
-                                                              const char *name,
-                                                              Error **errp)
-{
-    BdrvDirtyBitmap *bitmap;
-    BlockDriverState *bs;
-    BlockDirtyBitmapSha256 *ret = NULL;
-    char *sha256;
-
-    bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
-    if (!bitmap || !bs) {
-        return NULL;
-    }
-
-    sha256 = bdrv_dirty_bitmap_sha256(bitmap, errp);
-    if (sha256 == NULL) {
-        return NULL;
-    }
-
-    ret = g_new(BlockDirtyBitmapSha256, 1);
-    ret->sha256 = sha256;
-
-    return ret;
+ out:
+    aio_context_release(aio_context);
 }

 void hmp_drive_del(Monitor *mon, const QDict *qdict)
@@ -2957,7 +2924,7 @@ void qmp_block_resize(bool has_device, const char *device,
    }

    bdrv_drained_begin(bs);
-    ret = blk_truncate(blk, size, PREALLOC_MODE_OFF, errp);
+    ret = blk_truncate(blk, size, errp);
    bdrv_drained_end(bs);

 out:
@@ -3151,7 +3118,7 @@ void qmp_block_commit(bool has_job_id, const char *job_id, const char *device,
        }
        commit_active_start(has_job_id ? job_id : NULL, bs, base_bs,
                            BLOCK_JOB_DEFAULT, speed, on_error,
-                            filter_node_name, NULL, NULL, false, &local_err);
+                            filter_node_name, NULL, NULL, &local_err, false);
    } else {
        BlockDriverState *overlay_bs = bdrv_find_overlay(bs, top_bs);
        if (bdrv_op_is_blocked(overlay_bs, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
@@ -3249,10 +3216,10 @@ static BlockJob *do_drive_backup(DriveBackup *backup, BlockJobTxn *txn,
        if (source) {
            bdrv_img_create(backup->target, backup->format, source->filename,
                            source->drv->format_name, NULL,
-                            size, flags, false, &local_err);
+                            size, flags, &local_err, false);
        } else {
            bdrv_img_create(backup->target, backup->format, NULL, NULL, NULL,
-                            size, flags, false, &local_err);
+                            size, flags, &local_err, false);
        }
    }

@@ -3547,16 +3514,13 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
        backing_mode = MIRROR_OPEN_BACKING_CHAIN;
    }

-    /* Don't open backing image in create() */
-    flags |= BDRV_O_NO_BACKING;
-
    if ((arg->sync == MIRROR_SYNC_MODE_FULL || !source)
        && arg->mode != NEW_IMAGE_MODE_EXISTING)
    {
        /* create new image w/o backing file */
        assert(format);
        bdrv_img_create(arg->target, format,
-                        NULL, NULL, NULL, size, flags, false, &local_err);
+                        NULL, NULL, NULL, size, flags, &local_err, false);
    } else {
        switch (arg->mode) {
        case NEW_IMAGE_MODE_EXISTING:
@@ -3566,7 +3530,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
            bdrv_img_create(arg->target, format,
                            source->filename,
                            source->drv->format_name,
-                            NULL, size, flags, false, &local_err);
+                            NULL, size, flags, &local_err, false);
            break;
        default:
            abort();
@@ -3589,7 +3553,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
    /* Mirroring takes care of copy-on-write using the source's backing
     * file.
     */
-    target_bs = bdrv_open(arg->target, NULL, options, flags, errp);
+    target_bs = bdrv_open(arg->target, NULL, options,
+                          flags | BDRV_O_NO_BACKING, errp);
    if (!target_bs) {
        goto out;
    }
@@ -3750,6 +3715,7 @@ void qmp_block_job_resume(const char *device, Error **errp)
    }

    trace_qmp_block_job_resume(job);
+    block_job_iostatus_reset(job);
    block_job_user_resume(job);
    aio_context_release(aio_context);
 }
@@ -3887,7 +3853,6 @@ void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
    QObject *obj;
    Visitor *v = qobject_output_visitor_new(&obj);
    QDict *qdict;
-    const QDictEntry *ent;
    Error *local_err = NULL;

    visit_type_BlockdevOptions(v, NULL, &options, &local_err);
@@ -3901,19 +3866,6 @@ void qmp_blockdev_add(BlockdevOptions *options, Error **errp)

    qdict_flatten(qdict);

-    /*
-     * Rewrite "backing": null to "backing": ""
-     * TODO Rewrite "" to null instead, and perhaps not even here
-     */
-    for (ent = qdict_first(qdict); ent; ent = qdict_next(qdict, ent)) {
-        char *dot = strrchr(ent->key, '.');
-
-        if (!strcmp(dot ? dot + 1 : ent->key, "backing")
-            && qobject_type(ent->value) == QTYPE_QNULL) {
-            qdict_put(qdict, ent->key, qstring_new());
-        }
-    }
-
    if (!qdict_get_try_str(qdict, "node-name")) {
        error_setg(errp, "'node-name' must be specified for the root node");
        goto fail;
@@ -3926,6 +3878,13 @@ void qmp_blockdev_add(BlockdevOptions *options, Error **errp)

    QTAILQ_INSERT_TAIL(&monitor_bdrv_states, bs, monitor_list);

+    if (bs && bdrv_key_required(bs)) {
+        QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
+        bdrv_unref(bs);
+        error_setg(errp, "blockdev-add doesn't support encrypted devices");
+        goto fail;
+    }
+
 fail:
    visit_free(v);
 }
@@ -55,20 +55,35 @@ struct BlockJobTxn {

 static QLIST_HEAD(, BlockJob) block_jobs = QLIST_HEAD_INITIALIZER(block_jobs);

-/*
- * The block job API is composed of two categories of functions.
- *
- * The first includes functions used by the monitor.  The monitor is
- * peculiar in that it accesses the block job list with block_job_get, and
- * therefore needs consistency across block_job_get and the actual operation
- * (e.g. block_job_set_speed).  The consistency is achieved with
- * aio_context_acquire/release.  These functions are declared in blockjob.h.
- *
- * The second includes functions used by the block job drivers and sometimes
- * by the core block layer.  These do not care about locking, because the
- * whole coroutine runs under the AioContext lock, and are declared in
- * blockjob_int.h.
- */
+static char *child_job_get_parent_desc(BdrvChild *c)
+{
+    BlockJob *job = c->opaque;
+    return g_strdup_printf("%s job '%s'",
+                           BlockJobType_lookup[job->driver->job_type],
+                           job->id);
+}
+
+static const BdrvChildRole child_job = {
+    .get_parent_desc    = child_job_get_parent_desc,
+    .stay_at_node       = true,
+};
+
+static void block_job_drained_begin(void *opaque)
+{
+    BlockJob *job = opaque;
+    block_job_pause(job);
+}
+
+static void block_job_drained_end(void *opaque)
+{
+    BlockJob *job = opaque;
+    block_job_resume(job);
+}
+
+static const BlockDevOps block_job_dev_ops = {
+    .drained_begin = block_job_drained_begin,
+    .drained_end = block_job_drained_end,
+};

 BlockJob *block_job_next(BlockJob *job)
 {
@@ -91,80 +106,6 @@ BlockJob *block_job_get(const char *id)
    return NULL;
 }

-BlockJobTxn *block_job_txn_new(void)
-{
-    BlockJobTxn *txn = g_new0(BlockJobTxn, 1);
-    QLIST_INIT(&txn->jobs);
-    txn->refcnt = 1;
-    return txn;
-}
-
-static void block_job_txn_ref(BlockJobTxn *txn)
-{
-    txn->refcnt++;
-}
-
-void block_job_txn_unref(BlockJobTxn *txn)
-{
-    if (txn && --txn->refcnt == 0) {
-        g_free(txn);
-    }
-}
-
-void block_job_txn_add_job(BlockJobTxn *txn, BlockJob *job)
-{
-    if (!txn) {
-        return;
-    }
-
-    assert(!job->txn);
-    job->txn = txn;
-
-    QLIST_INSERT_HEAD(&txn->jobs, job, txn_list);
-    block_job_txn_ref(txn);
-}
-
-static void block_job_pause(BlockJob *job)
-{
-    job->pause_count++;
-}
-
-static void block_job_resume(BlockJob *job)
-{
-    assert(job->pause_count > 0);
-    job->pause_count--;
-    if (job->pause_count) {
-        return;
-    }
-    block_job_enter(job);
-}
-
-void block_job_ref(BlockJob *job)
-{
-    ++job->refcnt;
-}
-
-static void block_job_attached_aio_context(AioContext *new_context,
-                                           void *opaque);
-static void block_job_detach_aio_context(void *opaque);
-
-void block_job_unref(BlockJob *job)
-{
-    if (--job->refcnt == 0) {
-        BlockDriverState *bs = blk_bs(job->blk);
-        bs->job = NULL;
-        block_job_remove_all_bdrv(job);
-        blk_remove_aio_context_notifier(job->blk,
-                                        block_job_attached_aio_context,
-                                        block_job_detach_aio_context, job);
-        blk_unref(job->blk);
-        error_free(job->blocker);
-        g_free(job->id);
-        QLIST_REMOVE(job, job_list);
-        g_free(job);
-    }
-}
-
 static void block_job_attached_aio_context(AioContext *new_context,
                                           void *opaque)
 {
@@ -204,36 +145,6 @@ static void block_job_detach_aio_context(void *opaque)
    block_job_unref(job);
 }

-static char *child_job_get_parent_desc(BdrvChild *c)
-{
-    BlockJob *job = c->opaque;
-    return g_strdup_printf("%s job '%s'",
-                           BlockJobType_lookup[job->driver->job_type],
-                           job->id);
-}
-
-static const BdrvChildRole child_job = {
-    .get_parent_desc    = child_job_get_parent_desc,
-    .stay_at_node       = true,
-};
-
-static void block_job_drained_begin(void *opaque)
-{
-    BlockJob *job = opaque;
-    block_job_pause(job);
-}
-
-static void block_job_drained_end(void *opaque)
-{
-    BlockJob *job = opaque;
-    block_job_resume(job);
-}
-
-static const BlockDevOps block_job_dev_ops = {
-    .drained_begin = block_job_drained_begin,
-    .drained_end = block_job_drained_end,
-};
-
 void block_job_remove_all_bdrv(BlockJob *job)
 {
    GSList *l;
@@ -264,350 +175,6 @@ int block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
    return 0;
 }

-bool block_job_is_internal(BlockJob *job)
-{
-    return (job->id == NULL);
-}
-
-static bool block_job_started(BlockJob *job)
-{
-    return job->co;
-}
-
-/**
- * All jobs must allow a pause point before entering their job proper. This
- * ensures that jobs can be paused prior to being started, then resumed later.
- */
-static void coroutine_fn block_job_co_entry(void *opaque)
-{
-    BlockJob *job = opaque;
-
-    assert(job && job->driver && job->driver->start);
-    block_job_pause_point(job);
-    job->driver->start(job);
-}
-
-void block_job_start(BlockJob *job)
-{
-    assert(job && !block_job_started(job) && job->paused &&
-           job->driver && job->driver->start);
-    job->co = qemu_coroutine_create(block_job_co_entry, job);
-    job->pause_count--;
-    job->busy = true;
-    job->paused = false;
-    bdrv_coroutine_enter(blk_bs(job->blk), job->co);
-}
-
-static void block_job_completed_single(BlockJob *job)
-{
-    assert(job->completed);
-
-    if (!job->ret) {
-        if (job->driver->commit) {
-            job->driver->commit(job);
-        }
-    } else {
-        if (job->driver->abort) {
-            job->driver->abort(job);
-        }
-    }
-    if (job->driver->clean) {
-        job->driver->clean(job);
-    }
-
-    if (job->cb) {
-        job->cb(job->opaque, job->ret);
-    }
-
-    /* Emit events only if we actually started */
-    if (block_job_started(job)) {
-        if (block_job_is_cancelled(job)) {
-            block_job_event_cancelled(job);
-        } else {
-            const char *msg = NULL;
-            if (job->ret < 0) {
-                msg = strerror(-job->ret);
-            }
-            block_job_event_completed(job, msg);
-        }
-    }
-
-    if (job->txn) {
-        QLIST_REMOVE(job, txn_list);
-        block_job_txn_unref(job->txn);
-    }
-    block_job_unref(job);
-}
-
-static void block_job_cancel_async(BlockJob *job)
-{
-    if (job->iostatus != BLOCK_DEVICE_IO_STATUS_OK) {
-        block_job_iostatus_reset(job);
-    }
-    if (job->user_paused) {
-        /* Do not call block_job_enter here, the caller will handle it.  */
-        job->user_paused = false;
-        job->pause_count--;
-    }
-    job->cancelled = true;
-}
-
-static int block_job_finish_sync(BlockJob *job,
-                                 void (*finish)(BlockJob *, Error **errp),
-                                 Error **errp)
-{
-    Error *local_err = NULL;
-    int ret;
-
-    assert(blk_bs(job->blk)->job == job);
-
-    block_job_ref(job);
-
-    if (finish) {
-        finish(job, &local_err);
-    }
-    if (local_err) {
-        error_propagate(errp, local_err);
-        block_job_unref(job);
-        return -EBUSY;
-    }
-    /* block_job_drain calls block_job_enter, and it should be enough to
-     * induce progress until the job completes or moves to the main thread.
-    */
-    while (!job->deferred_to_main_loop && !job->completed) {
-        block_job_drain(job);
-    }
-    while (!job->completed) {
-        aio_poll(qemu_get_aio_context(), true);
-    }
-    ret = (job->cancelled && job->ret == 0) ? -ECANCELED : job->ret;
-    block_job_unref(job);
-    return ret;
-}
-
-static void block_job_completed_txn_abort(BlockJob *job)
-{
-    AioContext *ctx;
-    BlockJobTxn *txn = job->txn;
-    BlockJob *other_job;
-
-    if (txn->aborting) {
-        /*
-         * We are cancelled by another job, which will handle everything.
-         */
-        return;
-    }
-    txn->aborting = true;
-    block_job_txn_ref(txn);
-
-    /* We are the first failed job. Cancel other jobs. */
-    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
-        ctx = blk_get_aio_context(other_job->blk);
-        aio_context_acquire(ctx);
-    }
-
-    /* Other jobs are effectively cancelled by us, set the status for
-     * them; this job, however, may or may not be cancelled, depending
-     * on the caller, so leave it. */
-    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
-        if (other_job != job) {
-            block_job_cancel_async(other_job);
-        }
-    }
-    while (!QLIST_EMPTY(&txn->jobs)) {
-        other_job = QLIST_FIRST(&txn->jobs);
-        ctx = blk_get_aio_context(other_job->blk);
-        if (!other_job->completed) {
-            assert(other_job->cancelled);
-            block_job_finish_sync(other_job, NULL, NULL);
-        }
-        block_job_completed_single(other_job);
-        aio_context_release(ctx);
-    }
-
-    block_job_txn_unref(txn);
-}
-
-static void block_job_completed_txn_success(BlockJob *job)
-{
-    AioContext *ctx;
-    BlockJobTxn *txn = job->txn;
-    BlockJob *other_job, *next;
-    /*
-     * Successful completion, see if there are other running jobs in this
-     * txn.
-     */
-    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
-        if (!other_job->completed) {
-            return;
-        }
-    }
-    /* We are the last completed job, commit the transaction. */
-    QLIST_FOREACH_SAFE(other_job, &txn->jobs, txn_list, next) {
-        ctx = blk_get_aio_context(other_job->blk);
-        aio_context_acquire(ctx);
-        assert(other_job->ret == 0);
-        block_job_completed_single(other_job);
-        aio_context_release(ctx);
-    }
-}
-
-void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
-{
-    Error *local_err = NULL;
-
-    if (!job->driver->set_speed) {
-        error_setg(errp, QERR_UNSUPPORTED);
-        return;
-    }
-    job->driver->set_speed(job, speed, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
-    job->speed = speed;
-}
-
-void block_job_complete(BlockJob *job, Error **errp)
-{
-    /* Should not be reachable via external interface for internal jobs */
-    assert(job->id);
-    if (job->pause_count || job->cancelled ||
-        !block_job_started(job) || !job->driver->complete) {
-        error_setg(errp, "The active block job '%s' cannot be completed",
-                   job->id);
-        return;
-    }
-
-    job->driver->complete(job, errp);
-}
-
-void block_job_user_pause(BlockJob *job)
-{
-    job->user_paused = true;
-    block_job_pause(job);
-}
-
-bool block_job_user_paused(BlockJob *job)
-{
-    return job->user_paused;
-}
-
-void block_job_user_resume(BlockJob *job)
-{
-    if (job && job->user_paused && job->pause_count > 0) {
-        block_job_iostatus_reset(job);
-        job->user_paused = false;
-        block_job_resume(job);
-    }
-}
-
-void block_job_cancel(BlockJob *job)
-{
-    if (block_job_started(job)) {
-        block_job_cancel_async(job);
-        block_job_enter(job);
-    } else {
-        block_job_completed(job, -ECANCELED);
-    }
-}
-
-/* A wrapper around block_job_cancel() taking an Error ** parameter so it may be
- * used with block_job_finish_sync() without the need for (rather nasty)
- * function pointer casts there. */
-static void block_job_cancel_err(BlockJob *job, Error **errp)
-{
-    block_job_cancel(job);
-}
-
-int block_job_cancel_sync(BlockJob *job)
-{
-    return block_job_finish_sync(job, &block_job_cancel_err, NULL);
-}
-
-void block_job_cancel_sync_all(void)
-{
-    BlockJob *job;
-    AioContext *aio_context;
-
-    while ((job = QLIST_FIRST(&block_jobs))) {
-        aio_context = blk_get_aio_context(job->blk);
-        aio_context_acquire(aio_context);
-        block_job_cancel_sync(job);
-        aio_context_release(aio_context);
-    }
-}
-
-int block_job_complete_sync(BlockJob *job, Error **errp)
-{
-    return block_job_finish_sync(job, &block_job_complete, errp);
-}
-
-BlockJobInfo *block_job_query(BlockJob *job, Error **errp)
-{
-    BlockJobInfo *info;
-
-    if (block_job_is_internal(job)) {
-        error_setg(errp, "Cannot query QEMU internal jobs");
-        return NULL;
-    }
-    info = g_new0(BlockJobInfo, 1);
-    info->type      = g_strdup(BlockJobType_lookup[job->driver->job_type]);
-    info->device    = g_strdup(job->id);
-    info->len       = job->len;
-    info->busy      = job->busy;
-    info->paused    = job->pause_count > 0;
-    info->offset    = job->offset;
-    info->speed     = job->speed;
-    info->io_status = job->iostatus;
-    info->ready     = job->ready;
-    return info;
-}
-
-static void block_job_iostatus_set_err(BlockJob *job, int error)
-{
-    if (job->iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
-        job->iostatus = error == ENOSPC ? BLOCK_DEVICE_IO_STATUS_NOSPACE :
-                                          BLOCK_DEVICE_IO_STATUS_FAILED;
-    }
-}
-
-static void block_job_event_cancelled(BlockJob *job)
-{
-    if (block_job_is_internal(job)) {
-        return;
-    }
-
-    qapi_event_send_block_job_cancelled(job->driver->job_type,
-                                        job->id,
-                                        job->len,
-                                        job->offset,
-                                        job->speed,
-                                        &error_abort);
-}
-
-static void block_job_event_completed(BlockJob *job, const char *msg)
-{
-    if (block_job_is_internal(job)) {
-        return;
-    }
-
-    qapi_event_send_block_job_completed(job->driver->job_type,
-                                        job->id,
-                                        job->len,
-                                        job->offset,
-                                        job->speed,
-                                        !!msg,
-                                        msg,
-                                        &error_abort);
-}
-
-/*
- * API for block job drivers and the block layer.  These functions are
- * declared in blockjob_int.h.
- */
-
 void *block_job_create(const char *job_id, const BlockJobDriver *driver,
                       BlockDriverState *bs, uint64_t perm,
                       uint64_t shared_perm, int64_t speed, int flags,
@@ -692,23 +259,163 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
    return job;
 }

-void block_job_pause_all(void)
+bool block_job_is_internal(BlockJob *job)
 {
-    BlockJob *job = NULL;
-    while ((job = block_job_next(job))) {
-        AioContext *aio_context = blk_get_aio_context(job->blk);
+    return (job->id == NULL);
+}

-        aio_context_acquire(aio_context);
-        block_job_pause(job);
-        aio_context_release(aio_context);
+static bool block_job_started(BlockJob *job)
+{
+    return job->co;
+}
+
+/**
+ * All jobs must allow a pause point before entering their job proper. This
+ * ensures that jobs can be paused prior to being started, then resumed later.
+ */
+static void coroutine_fn block_job_co_entry(void *opaque)
+{
+    BlockJob *job = opaque;
+
+    assert(job && job->driver && job->driver->start);
+    block_job_pause_point(job);
+    job->driver->start(job);
+}
+
+void block_job_start(BlockJob *job)
+{
+    assert(job && !block_job_started(job) && job->paused &&
+           job->driver && job->driver->start);
+    job->co = qemu_coroutine_create(block_job_co_entry, job);
+    job->pause_count--;
+    job->busy = true;
+    job->paused = false;
+    bdrv_coroutine_enter(blk_bs(job->blk), job->co);
+}
+
+void block_job_ref(BlockJob *job)
+{
+    ++job->refcnt;
+}
+
+void block_job_unref(BlockJob *job)
+{
+    if (--job->refcnt == 0) {
+        BlockDriverState *bs = blk_bs(job->blk);
+        bs->job = NULL;
+        block_job_remove_all_bdrv(job);
+        blk_remove_aio_context_notifier(job->blk,
+                                        block_job_attached_aio_context,
+                                        block_job_detach_aio_context, job);
+        blk_unref(job->blk);
+        error_free(job->blocker);
+        g_free(job->id);
+        QLIST_REMOVE(job, job_list);
+        g_free(job);
    }
 }

-void block_job_early_fail(BlockJob *job)
+static void block_job_completed_single(BlockJob *job)
 {
+    if (!job->ret) {
+        if (job->driver->commit) {
+            job->driver->commit(job);
+        }
+    } else {
+        if (job->driver->abort) {
+            job->driver->abort(job);
+        }
+    }
+    if (job->driver->clean) {
+        job->driver->clean(job);
+    }
+
+    if (job->cb) {
+        job->cb(job->opaque, job->ret);
+    }
+
+    /* Emit events only if we actually started */
+    if (block_job_started(job)) {
+        if (block_job_is_cancelled(job)) {
+            block_job_event_cancelled(job);
+        } else {
+            const char *msg = NULL;
+            if (job->ret < 0) {
+                msg = strerror(-job->ret);
+            }
+            block_job_event_completed(job, msg);
+        }
+    }
+
+    if (job->txn) {
+        QLIST_REMOVE(job, txn_list);
+        block_job_txn_unref(job->txn);
+    }
    block_job_unref(job);
 }

+static void block_job_completed_txn_abort(BlockJob *job)
+{
+    AioContext *ctx;
+    BlockJobTxn *txn = job->txn;
+    BlockJob *other_job, *next;
+
+    if (txn->aborting) {
+        /*
+         * We are cancelled by another job, which will handle everything.
+         */
+        return;
+    }
+    txn->aborting = true;
+    /* We are the first failed job. Cancel other jobs. */
+    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
+        ctx = blk_get_aio_context(other_job->blk);
+        aio_context_acquire(ctx);
+    }
+    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
+        if (other_job == job || other_job->completed) {
+            /* Other jobs are "effectively" cancelled by us, set the status for
+             * them; this job, however, may or may not be cancelled, depending
+             * on the caller, so leave it. */
+            if (other_job != job) {
+                other_job->cancelled = true;
+            }
+            continue;
+        }
+        block_job_cancel_sync(other_job);
+        assert(other_job->completed);
+    }
+    QLIST_FOREACH_SAFE(other_job, &txn->jobs, txn_list, next) {
+        ctx = blk_get_aio_context(other_job->blk);
+        block_job_completed_single(other_job);
+        aio_context_release(ctx);
+    }
+}
+
+static void block_job_completed_txn_success(BlockJob *job)
+{
+    AioContext *ctx;
+    BlockJobTxn *txn = job->txn;
+    BlockJob *other_job, *next;
+    /*
+     * Successful completion, see if there are other running jobs in this
+     * txn.
+     */
+    QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
+        if (!other_job->completed) {
+            return;
+        }
+    }
+    /* We are the last completed job, commit the transaction. */
+    QLIST_FOREACH_SAFE(other_job, &txn->jobs, txn_list, next) {
+        ctx = blk_get_aio_context(other_job->blk);
+        aio_context_acquire(ctx);
+        assert(other_job->ret == 0);
+        block_job_completed_single(other_job);
+        aio_context_release(ctx);
+    }
+}
+
 void block_job_completed(BlockJob *job, int ret)
 {
    assert(blk_bs(job->blk)->job == job);
@@ -724,11 +431,58 @@ void block_job_completed(BlockJob *job, int ret)
    }
 }

+void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
+{
+    Error *local_err = NULL;
+
+    if (!job->driver->set_speed) {
+        error_setg(errp, QERR_UNSUPPORTED);
+        return;
+    }
+    job->driver->set_speed(job, speed, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    job->speed = speed;
+}
+
+void block_job_complete(BlockJob *job, Error **errp)
+{
+    /* Should not be reachable via external interface for internal jobs */
+    assert(job->id);
+    if (job->pause_count || job->cancelled ||
+        !block_job_started(job) || !job->driver->complete) {
+        error_setg(errp, "The active block job '%s' cannot be completed",
+                   job->id);
+        return;
+    }
+
+    job->driver->complete(job, errp);
+}
+
+void block_job_pause(BlockJob *job)
+{
+    job->pause_count++;
+}
+
+void block_job_user_pause(BlockJob *job)
+{
+    job->user_paused = true;
+    block_job_pause(job);
+}
+
 static bool block_job_should_pause(BlockJob *job)
 {
    return job->pause_count > 0;
 }

+bool block_job_user_paused(BlockJob *job)
+{
+    return job ? job->user_paused : 0;
+}
+
 void coroutine_fn block_job_pause_point(BlockJob *job)
 {
    assert(job && block_job_started(job));
@@ -757,37 +511,117 @@ void coroutine_fn block_job_pause_point(BlockJob *job)
    }
 }

-void block_job_resume_all(void)
+void block_job_resume(BlockJob *job)
 {
-    BlockJob *job = NULL;
-    while ((job = block_job_next(job))) {
-        AioContext *aio_context = blk_get_aio_context(job->blk);
+    assert(job->pause_count > 0);
+    job->pause_count--;
+    if (job->pause_count) {
+        return;
+    }
+    block_job_enter(job);
+}

-        aio_context_acquire(aio_context);
+void block_job_user_resume(BlockJob *job)
+{
+    if (job && job->user_paused && job->pause_count > 0) {
+        job->user_paused = false;
        block_job_resume(job);
-        aio_context_release(aio_context);
    }
 }

 void block_job_enter(BlockJob *job)
 {
-    if (!block_job_started(job)) {
-        return;
-    }
-    if (job->deferred_to_main_loop) {
-        return;
-    }
-
-    if (!job->busy) {
+    if (job->co && !job->busy) {
        bdrv_coroutine_enter(blk_bs(job->blk), job->co);
    }
 }

+void block_job_cancel(BlockJob *job)
+{
+    if (block_job_started(job)) {
+        job->cancelled = true;
+        block_job_iostatus_reset(job);
+        block_job_enter(job);
+    } else {
+        block_job_completed(job, -ECANCELED);
+    }
+}
+
 bool block_job_is_cancelled(BlockJob *job)
 {
    return job->cancelled;
 }

+void block_job_iostatus_reset(BlockJob *job)
+{
+    job->iostatus = BLOCK_DEVICE_IO_STATUS_OK;
+    if (job->driver->iostatus_reset) {
+        job->driver->iostatus_reset(job);
+    }
+}
+
+static int block_job_finish_sync(BlockJob *job,
+                                 void (*finish)(BlockJob *, Error **errp),
+                                 Error **errp)
+{
+    Error *local_err = NULL;
+    int ret;
+
+    assert(blk_bs(job->blk)->job == job);
+
+    block_job_ref(job);
+
+    finish(job, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        block_job_unref(job);
+        return -EBUSY;
+    }
+    /* block_job_drain calls block_job_enter, and it should be enough to
+     * induce progress until the job completes or moves to the main thread.
+    */
+    while (!job->deferred_to_main_loop && !job->completed) {
+        block_job_drain(job);
+    }
+    while (!job->completed) {
+        aio_poll(qemu_get_aio_context(), true);
+    }
+    ret = (job->cancelled && job->ret == 0) ? -ECANCELED : job->ret;
+    block_job_unref(job);
+    return ret;
+}
+
+/* A wrapper around block_job_cancel() taking an Error ** parameter so it may be
+ * used with block_job_finish_sync() without the need for (rather nasty)
+ * function pointer casts there. */
+static void block_job_cancel_err(BlockJob *job, Error **errp)
+{
+    block_job_cancel(job);
+}
+
+int block_job_cancel_sync(BlockJob *job)
+{
+    return block_job_finish_sync(job, &block_job_cancel_err, NULL);
+}
+
+void block_job_cancel_sync_all(void)
+{
+    BlockJob *job;
+    AioContext *aio_context;
+
+    while ((job = QLIST_FIRST(&block_jobs))) {
+        aio_context = blk_get_aio_context(job->blk);
+        aio_context_acquire(aio_context);
+        block_job_cancel_sync(job);
+        aio_context_release(aio_context);
+    }
+}
+
+int block_job_complete_sync(BlockJob *job, Error **errp)
+{
+    return block_job_finish_sync(job, &block_job_complete, errp);
+}
+
 void block_job_sleep_ns(BlockJob *job, QEMUClockType type, int64_t ns)
 {
    assert(job->busy);
@@ -824,13 +658,63 @@ void block_job_yield(BlockJob *job)
    block_job_pause_point(job);
 }

-void block_job_iostatus_reset(BlockJob *job)
+BlockJobInfo *block_job_query(BlockJob *job, Error **errp)
+{
+    BlockJobInfo *info;
+
+    if (block_job_is_internal(job)) {
+        error_setg(errp, "Cannot query QEMU internal jobs");
+        return NULL;
+    }
+    info = g_new0(BlockJobInfo, 1);
+    info->type      = g_strdup(BlockJobType_lookup[job->driver->job_type]);
+    info->device    = g_strdup(job->id);
+    info->len       = job->len;
+    info->busy      = job->busy;
+    info->paused    = job->pause_count > 0;
+    info->offset    = job->offset;
+    info->speed     = job->speed;
+    info->io_status = job->iostatus;
+    info->ready     = job->ready;
+    return info;
+}
+
+static void block_job_iostatus_set_err(BlockJob *job, int error)
 {
    if (job->iostatus == BLOCK_DEVICE_IO_STATUS_OK) {
+        job->iostatus = error == ENOSPC ? BLOCK_DEVICE_IO_STATUS_NOSPACE :
+                                          BLOCK_DEVICE_IO_STATUS_FAILED;
+    }
+}
+
+static void block_job_event_cancelled(BlockJob *job)
+{
+    if (block_job_is_internal(job)) {
        return;
    }
-    assert(job->user_paused && job->pause_count > 0);
-    job->iostatus = BLOCK_DEVICE_IO_STATUS_OK;
+
+    qapi_event_send_block_job_cancelled(job->driver->job_type,
+                                        job->id,
+                                        job->len,
+                                        job->offset,
+                                        job->speed,
+                                        &error_abort);
+}
+
+static void block_job_event_completed(BlockJob *job, const char *msg)
+{
+    if (block_job_is_internal(job)) {
+        return;
+    }
+
+    qapi_event_send_block_job_completed(job->driver->job_type,
+                                        job->id,
+                                        job->len,
+                                        job->offset,
+                                        job->speed,
+                                        !!msg,
+                                        msg,
+                                        &error_abort);
 }

 void block_job_event_ready(BlockJob *job)
@@ -906,6 +790,7 @@ static void block_job_defer_to_main_loop_bh(void *opaque)
        aio_context_acquire(aio_context);
    }

+    data->job->deferred_to_main_loop = false;
    data->fn(data->job, data->opaque);

    if (aio_context != data->aio_context) {
@@ -931,3 +816,36 @@ void block_job_defer_to_main_loop(BlockJob *job,
    aio_bh_schedule_oneshot(qemu_get_aio_context(),
                            block_job_defer_to_main_loop_bh, data);
 }
+
+BlockJobTxn *block_job_txn_new(void)
+{
+    BlockJobTxn *txn = g_new0(BlockJobTxn, 1);
+    QLIST_INIT(&txn->jobs);
+    txn->refcnt = 1;
+    return txn;
+}
+
+static void block_job_txn_ref(BlockJobTxn *txn)
+{
+    txn->refcnt++;
+}
+
+void block_job_txn_unref(BlockJobTxn *txn)
+{
+    if (txn && --txn->refcnt == 0) {
+        g_free(txn);
+    }
+}
+
+void block_job_txn_add_job(BlockJobTxn *txn, BlockJob *job)
+{
+    if (!txn) {
+        return;
+    }
+
+    assert(!job->txn);
+    job->txn = txn;
+
+    QLIST_INSERT_HEAD(&txn->jobs, job, txn_list);
+    block_job_txn_ref(txn);
+}
@@ -27,7 +27,7 @@
 #include "sysemu/sysemu.h"
 #include "qapi/visitor.h"
 #include "qemu/error-report.h"
-#include "sysemu/reset.h"
+#include "hw/hw.h"
 #include "hw/qdev-core.h"

 typedef struct FWBootEntry FWBootEntry;
@@ -20,6 +20,22 @@ abi_long memcpy_to_target(abi_ulong dest, const void *src,
    return 0;
 }

+static int in_group_p(gid_t g)
+{
+    /* return TRUE if we're in the specified group, FALSE otherwise */
+    int         ngroup;
+    int         i;
+    gid_t       grouplist[TARGET_NGROUPS];
+
+    ngroup = getgroups(TARGET_NGROUPS, grouplist);
+    for(i = 0; i < ngroup; i++) {
+        if(grouplist[i] == g) {
+            return 1;
+        }
+    }
+    return 0;
+}
+
 static int count(char ** vec)
 {
    int         i;
@@ -35,7 +51,7 @@ static int prepare_binprm(struct linux_binprm *bprm)
 {
    struct stat         st;
    int mode;
-    int retval;
+    int retval, id_change;

    if(fstat(bprm->fd, &st) < 0) {
        return(-errno);
@@ -51,10 +67,14 @@ static int prepare_binprm(struct linux_binprm *bprm)

    bprm->e_uid = geteuid();
    bprm->e_gid = getegid();
+    id_change = 0;

    /* Set-uid? */
    if(mode & S_ISUID) {
        bprm->e_uid = st.st_uid;
+        if(bprm->e_uid != geteuid()) {
+            id_change = 1;
+        }
    }

    /* Set-gid? */
@@ -65,6 +85,9 @@ static int prepare_binprm(struct linux_binprm *bprm)
     */
    if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
        bprm->e_gid = st.st_gid;
+        if (!in_group_p(bprm->e_gid)) {
+                id_change = 1;
+        }
    }

    memset(bprm->buf, 0, sizeof(bprm->buf));
@@ -1155,20 +1155,21 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
    unsigned int interpreter_type = INTERPRETER_NONE;
    unsigned char ibcs2_interpreter;
    int i;
+    abi_ulong mapped_addr;
    struct elf_phdr * elf_ppnt;
    struct elf_phdr *elf_phdata;
    abi_ulong elf_bss, k, elf_brk;
    int retval;
    char * elf_interpreter;
    abi_ulong elf_entry, interp_load_addr = 0;
+    int status;
    abi_ulong start_code, end_code, start_data, end_data;
    abi_ulong reloc_func_desc = 0;
-#ifdef LOW_ELF_STACK
-    abi_ulong elf_stack = ~((abi_ulong)0UL);
-#endif
+    abi_ulong elf_stack;
    char passed_fileno[6];

    ibcs2_interpreter = 0;
+    status = 0;
    load_addr = 0;
    load_bias = 0;
    elf_ex = *((struct elfhdr *) bprm->buf);          /* exec-header */
@@ -1220,6 +1221,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
    elf_brk = 0;


+    elf_stack = ~((abi_ulong)0UL);
    elf_interpreter = NULL;
    start_code = ~((abi_ulong)0UL);
    end_code = 0;
@@ -1544,7 +1546,7 @@ int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs,
               and some applications "depend" upon this behavior.
               Since we do not have the power to recompile these, we
               emulate the SVr4 behavior.  Sigh.  */
-            target_mmap(0, qemu_host_page_size, PROT_READ | PROT_EXEC,
+            mapped_addr = target_mmap(0, qemu_host_page_size, PROT_READ | PROT_EXEC,
                                      MAP_FIXED | MAP_PRIVATE, -1, 0);
    }

@@ -25,6 +25,7 @@
 #include "qemu/config-file.h"
 #include "qemu/path.h"
 #include "qemu/help_option.h"
+/* For tb_lock */
 #include "cpu.h"
 #include "exec/exec-all.h"
 #include "tcg.h"
@@ -619,10 +620,9 @@ void cpu_loop(CPUSPARCState *env)
            break;
        case EXCP_DEBUG:
            {
-#if 0
-                int sig =
-#endif
-                gdb_handlesig(cs, TARGET_SIGTRAP);
+                int sig;
+
+                sig = gdb_handlesig(cs, TARGET_SIGTRAP);
 #if 0
                if (sig)
                  {
@@ -686,8 +686,6 @@ static void usage(void)
           "    -E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG\n"
           "Note that if you provide several changes to single variable\n"
           "last change will stay in effect.\n"
-           "\n"
-           QEMU_HELP_BOTTOM "\n"
           ,
           TARGET_NAME,
           interp_prefix,
@@ -746,7 +744,10 @@ int main(int argc, char **argv)
    qemu_init_cpu_list();
    module_call_init(MODULE_INIT_QOM);

-    envlist = envlist_create();
+    if ((envlist = envlist_create()) == NULL) {
+        (void) fprintf(stderr, "Unable to allocate envlist\n");
+        exit(1);
+    }

    /* add current environment into the list */
    for (wrk = environ; *wrk != NULL; wrk++) {
@@ -784,7 +785,10 @@ int main(int argc, char **argv)
                usage();
        } else if (!strcmp(r, "ignore-environment")) {
            envlist_free(envlist);
-            envlist = envlist_create();
+            if ((envlist = envlist_create()) == NULL) {
+                (void) fprintf(stderr, "Unable to allocate envlist\n");
+                exit(1);
+            }
        } else if (!strcmp(r, "U")) {
            r = argv[optind++];
            if (envlist_unsetenv(envlist, r) != 0)
@@ -952,10 +956,10 @@ int main(int argc, char **argv)
    }

    for (wrk = target_environ; *wrk; wrk++) {
-        g_free(*wrk);
+        free(*wrk);
    }

-    g_free(target_environ);
+    free(target_environ);

    if (qemu_loglevel_mask(CPU_LOG_PAGE)) {
        qemu_log("guest_base  0x%lx\n", guest_base);
@@ -1 +1 @@
 .10.0
 .9.1