diff --git a/Makefile.objs b/Makefile.objs
index 1b446958c5d0fef9a54b0b562ddb58b85cfaabf1..0cbff4d29301dcb5ee7f147fe7c13ac3a10c07d8 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -285,9 +285,13 @@ sound-obj-$(CONFIG_HDA) += intel-hda.o hda-audio.o
 adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
 hw-obj-$(CONFIG_SOUND) += $(sound-obj-y)
 
-hw-obj-$(CONFIG_REALLY_VIRTFS) += virtio-9p-debug.o
-hw-obj-$(CONFIG_VIRTFS) += virtio-9p-local.o virtio-9p-xattr.o
-hw-obj-$(CONFIG_VIRTFS) += virtio-9p-xattr-user.o virtio-9p-posix-acl.o
+9pfs-nested-$(CONFIG_VIRTFS) = virtio-9p-debug.o
+9pfs-nested-$(CONFIG_VIRTFS) +=  virtio-9p-local.o virtio-9p-xattr.o
+9pfs-nested-$(CONFIG_VIRTFS) +=   virtio-9p-xattr-user.o virtio-9p-posix-acl.o
+
+hw-obj-$(CONFIG_REALLY_VIRTFS) += $(addprefix 9pfs/, $(9pfs-nested-y))
+$(addprefix 9pfs/, $(9pfs-nested-y)): CFLAGS +=  -I$(SRC_PATH)/hw/
+
 
 ######################################################################
 # libdis
diff --git a/Makefile.target b/Makefile.target
index 0e0ef36b9788dc50656999d3ad5fe76c9cd5337c..2501c63bb216365ea1a59499feb4df708e78b730 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -194,7 +194,7 @@ obj-$(CONFIG_VIRTIO) += virtio-blk.o virtio-balloon.o virtio-net.o virtio-serial
 obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
 obj-y += vhost_net.o
 obj-$(CONFIG_VHOST_NET) += vhost.o
-obj-$(CONFIG_REALLY_VIRTFS) += virtio-9p.o
+obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p.o
 obj-y += rwhandler.o
 obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
@@ -401,9 +401,11 @@ hmp-commands.h: $(SRC_PATH)/hmp-commands.hx
 qmp-commands.h: $(SRC_PATH)/qmp-commands.hx
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
 
+9pfs/virtio-9p.o: CFLAGS +=  -I$(SRC_PATH)/hw/
+
 clean:
 	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
-	rm -f *.d */*.d tcg/*.o ide/*.o
+	rm -f *.d */*.d tcg/*.o ide/*.o 9pfs/*.o
 	rm -f hmp-commands.h qmp-commands.h gdbstub-xml.c
 ifdef CONFIG_SYSTEMTAP_TRACE
 	rm -f *.stp
diff --git a/configure b/configure
index 35f7e8b7b26002131d772cb9ad1259c5ab27c949..6f75e2eb9f6442e2d46f4475060fbca7b1ba49fe 100755
--- a/configure
+++ b/configure
@@ -3062,6 +3062,7 @@ mkdir -p $target_dir
 mkdir -p $target_dir/fpu
 mkdir -p $target_dir/tcg
 mkdir -p $target_dir/ide
+mkdir -p $target_dir/9pfs
 if test "$target" = "arm-linux-user" -o "$target" = "armeb-linux-user" -o "$target" = "arm-bsd-user" -o "$target" = "armeb-bsd-user" ; then
   mkdir -p $target_dir/nwfpe
 fi
@@ -3488,6 +3489,7 @@ for hwlib in 32 64; do
   mkdir -p $d
   mkdir -p $d/ide
   symlink $source_path/Makefile.hw $d/Makefile
+  mkdir -p $d/9pfs
   echo "QEMU_CFLAGS+=-DTARGET_PHYS_ADDR_BITS=$hwlib" > $d/config.mak
 done
 
diff --git a/hw/file-op-9p.h b/fsdev/file-op-9p.h
similarity index 100%
rename from hw/file-op-9p.h
rename to fsdev/file-op-9p.h
diff --git a/fsdev/qemu-fsdev.h b/fsdev/qemu-fsdev.h
index a704043bebdd703151eb5e66e5819f5d87324122..f9f08d3e1b1ace58e53f93a2fd251712f6564923 100644
--- a/fsdev/qemu-fsdev.h
+++ b/fsdev/qemu-fsdev.h
@@ -13,7 +13,7 @@
 #ifndef QEMU_FSDEV_H
 #define QEMU_FSDEV_H
 #include "qemu-option.h"
-#include "hw/file-op-9p.h"
+#include "file-op-9p.h"
 
 
 /*
diff --git a/hw/virtio-9p-debug.c b/hw/9pfs/virtio-9p-debug.c
similarity index 100%
rename from hw/virtio-9p-debug.c
rename to hw/9pfs/virtio-9p-debug.c
diff --git a/hw/virtio-9p-debug.h b/hw/9pfs/virtio-9p-debug.h
similarity index 100%
rename from hw/virtio-9p-debug.h
rename to hw/9pfs/virtio-9p-debug.h
diff --git a/hw/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c
similarity index 99%
rename from hw/virtio-9p-local.c
rename to hw/9pfs/virtio-9p-local.c
index a8e7525bf60e37847a719544da75f08ff7d8ddd6..0a015de9a53bfffddd2b209318f827c8e50fc4ec 100644
--- a/hw/virtio-9p-local.c
+++ b/hw/9pfs/virtio-9p-local.c
@@ -370,7 +370,7 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
             return fd;
         }
         /* Write the oldpath (target) to the file. */
-        oldpath_size = strlen(oldpath) + 1;
+        oldpath_size = strlen(oldpath);
         do {
             write_size = write(fd, (void *)oldpath, oldpath_size);
         } while (write_size == -1 && errno == EINTR);
diff --git a/hw/virtio-9p-posix-acl.c b/hw/9pfs/virtio-9p-posix-acl.c
similarity index 88%
rename from hw/virtio-9p-posix-acl.c
rename to hw/9pfs/virtio-9p-posix-acl.c
index 3978d0cf71a62efc74ee0a2fa657afeb2ab8d55c..575abe86b0951f638e05828200159154834f219f 100644
--- a/hw/virtio-9p-posix-acl.c
+++ b/hw/9pfs/virtio-9p-posix-acl.c
@@ -15,7 +15,7 @@
 #include <attr/xattr.h>
 #include "virtio.h"
 #include "virtio-9p.h"
-#include "file-op-9p.h"
+#include "fsdev/file-op-9p.h"
 #include "virtio-9p-xattr.h"
 
 #define MAP_ACL_ACCESS "user.virtfs.system.posix_acl_access"
@@ -60,7 +60,7 @@ static int mp_pacl_removexattr(FsContext *ctx,
     ret  = lremovexattr(rpath(ctx, path), MAP_ACL_ACCESS);
     if (ret == -1 && errno == ENODATA) {
         /*
-         * We don't get ENODATA error when trying to remote a
+         * We don't get ENODATA error when trying to remove a
          * posix acl that is not present. So don't throw the error
          * even in case of mapped security model
          */
@@ -103,7 +103,18 @@ static int mp_dacl_setxattr(FsContext *ctx, const char *path, const char *name,
 static int mp_dacl_removexattr(FsContext *ctx,
                                const char *path, const char *name)
 {
-    return lremovexattr(rpath(ctx, path), MAP_ACL_DEFAULT);
+    int ret;
+    ret  = lremovexattr(rpath(ctx, path), MAP_ACL_DEFAULT);
+    if (ret == -1 && errno == ENODATA) {
+        /*
+         * We don't get ENODATA error when trying to remove a
+         * posix acl that is not present. So don't throw the error
+         * even in case of mapped security model
+         */
+        errno = 0;
+        ret = 0;
+    }
+    return ret;
 }
 
 
diff --git a/hw/virtio-9p-xattr-user.c b/hw/9pfs/virtio-9p-xattr-user.c
similarity index 98%
rename from hw/virtio-9p-xattr-user.c
rename to hw/9pfs/virtio-9p-xattr-user.c
index faa02a1911fadbdb4af645bc4caae5b0c4c55b2e..bba13ce643e6574b4f89f8989ae697445daf9ff6 100644
--- a/hw/virtio-9p-xattr-user.c
+++ b/hw/9pfs/virtio-9p-xattr-user.c
@@ -14,7 +14,7 @@
 #include <sys/types.h>
 #include "virtio.h"
 #include "virtio-9p.h"
-#include "file-op-9p.h"
+#include "fsdev/file-op-9p.h"
 #include "virtio-9p-xattr.h"
 
 
diff --git a/hw/virtio-9p-xattr.c b/hw/9pfs/virtio-9p-xattr.c
similarity index 99%
rename from hw/virtio-9p-xattr.c
rename to hw/9pfs/virtio-9p-xattr.c
index 1aab081de2ab7ce2883ed6250a668f7382e7f66d..03c3d3f6bbb0f1731ff9019e3ea097622e099736 100644
--- a/hw/virtio-9p-xattr.c
+++ b/hw/9pfs/virtio-9p-xattr.c
@@ -13,7 +13,7 @@
 
 #include "virtio.h"
 #include "virtio-9p.h"
-#include "file-op-9p.h"
+#include "fsdev/file-op-9p.h"
 #include "virtio-9p-xattr.h"
 
 
diff --git a/hw/virtio-9p-xattr.h b/hw/9pfs/virtio-9p-xattr.h
similarity index 100%
rename from hw/virtio-9p-xattr.h
rename to hw/9pfs/virtio-9p-xattr.h
diff --git a/hw/virtio-9p.c b/hw/9pfs/virtio-9p.c
similarity index 99%
rename from hw/virtio-9p.c
rename to hw/9pfs/virtio-9p.c
index 7e2953567229c239f39296503b57b059ec81ad4a..b5fc52b3eb49108b31e7d11ce886df64c27217fc 100644
--- a/hw/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -596,7 +596,10 @@ static V9fsPDU *alloc_pdu(V9fsState *s)
 static void free_pdu(V9fsState *s, V9fsPDU *pdu)
 {
     if (pdu) {
-	QLIST_INSERT_HEAD(&s->free_list, pdu, next);
+        if (debug_9p_pdu) {
+            pprint_pdu(pdu);
+        }
+        QLIST_INSERT_HEAD(&s->free_list, pdu, next);
     }
 }
 
@@ -1479,7 +1482,7 @@ static void v9fs_walk_complete(V9fsState *s, V9fsWalkState *vs, int err)
 {
     complete_pdu(s, vs->pdu, err);
 
-    if (vs->nwnames) {
+    if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
         for (vs->name_idx = 0; vs->name_idx < vs->nwnames; vs->name_idx++) {
             v9fs_string_free(&vs->wnames[vs->name_idx]);
         }
@@ -1575,7 +1578,7 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
     vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "ddw", &fid,
                                             &newfid, &vs->nwnames);
 
-    if (vs->nwnames) {
+    if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
         vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
 
         vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
@@ -1584,6 +1587,9 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
             vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
                                             &vs->wnames[i]);
         }
+    } else if (vs->nwnames > P9_MAXWELEM) {
+        err = -EINVAL;
+        goto out;
     }
 
     vs->fidp = lookup_fid(s, fid);
@@ -1768,7 +1774,7 @@ static void v9fs_post_lcreate(V9fsState *s, V9fsLcreateState *vs, int err)
         v9fs_string_copy(&vs->fidp->path, &vs->fullname);
         stat_to_qid(&vs->stbuf, &vs->qid);
         vs->offset += pdu_marshal(vs->pdu, vs->offset, "Qd", &vs->qid,
-                &vs->iounit);
+                vs->iounit);
         err = vs->offset;
     } else {
         vs->fidp->fid_type = P9_FID_NONE;
diff --git a/hw/virtio-9p.h b/hw/9pfs/virtio-9p.h
similarity index 99%
rename from hw/virtio-9p.h
rename to hw/9pfs/virtio-9p.h
index 2ae4ce7189c63d4adb767e9390e098ecde4787eb..622928fce5b815a4722cc519ffdfb9c569aa9bbc 100644
--- a/hw/virtio-9p.h
+++ b/hw/9pfs/virtio-9p.h
@@ -6,7 +6,7 @@
 #include <sys/time.h>
 #include <utime.h>
 
-#include "file-op-9p.h"
+#include "fsdev/file-op-9p.h"
 
 /* The feature bitmap for virtio 9P */
 /* The mount point is specified in a config variable */
@@ -282,7 +282,7 @@ typedef struct V9fsStatStateDotl {
 typedef struct V9fsWalkState {
     V9fsPDU *pdu;
     size_t offset;
-    int16_t nwnames;
+    uint16_t nwnames;
     int name_idx;
     V9fsQID *qids;
     V9fsFidState *fidp;
diff --git a/vl.c b/vl.c
index b46ee663bfd4a953fbfc013e17dec1aad98f7d5c..6b9a2f61e3a7752765ef21630736bd7d2746beb3 100644
--- a/vl.c
+++ b/vl.c
@@ -2447,9 +2447,8 @@ int main(int argc, char **argv, char **envp)
                 }
                 break;
             case QEMU_OPTION_virtfs: {
-                char *arg_fsdev = NULL;
-                char *arg_9p = NULL;
-                int len = 0;
+                QemuOpts *fsdev;
+                QemuOpts *device;
 
                 olist = qemu_find_opts("virtfs");
                 if (!olist) {
@@ -2468,45 +2467,28 @@ int main(int argc, char **argv, char **envp)
                         qemu_opt_get(opts, "security_model") == NULL) {
                     fprintf(stderr, "Usage: -virtfs fstype,path=/share_path/,"
                             "security_model=[mapped|passthrough|none],"
-                            "mnt_tag=tag.\n");
+                            "mount_tag=tag.\n");
                     exit(1);
                 }
 
-                len = strlen(",id=,path=,security_model=");
-                len += strlen(qemu_opt_get(opts, "fstype"));
-                len += strlen(qemu_opt_get(opts, "mount_tag"));
-                len += strlen(qemu_opt_get(opts, "path"));
-                len += strlen(qemu_opt_get(opts, "security_model"));
-                arg_fsdev = qemu_malloc((len + 1) * sizeof(*arg_fsdev));
-
-                snprintf(arg_fsdev, (len + 1) * sizeof(*arg_fsdev),
-                         "%s,id=%s,path=%s,security_model=%s",
-                         qemu_opt_get(opts, "fstype"),
-                         qemu_opt_get(opts, "mount_tag"),
-                         qemu_opt_get(opts, "path"),
-                         qemu_opt_get(opts, "security_model"));
-
-                len = strlen("virtio-9p,fsdev=,mount_tag=");
-                len += 2*strlen(qemu_opt_get(opts, "mount_tag"));
-                arg_9p = qemu_malloc((len + 1) * sizeof(*arg_9p));
-
-                snprintf(arg_9p, (len + 1) * sizeof(*arg_9p),
-                         "virtio-9p,fsdev=%s,mount_tag=%s",
-                         qemu_opt_get(opts, "mount_tag"),
-                         qemu_opt_get(opts, "mount_tag"));
-
-                if (!qemu_opts_parse(qemu_find_opts("fsdev"), arg_fsdev, 1)) {
-                    fprintf(stderr, "parse error [fsdev]: %s\n", optarg);
+                fsdev = qemu_opts_create(qemu_find_opts("fsdev"),
+                                         qemu_opt_get(opts, "mount_tag"), 1);
+                if (!fsdev) {
+                    fprintf(stderr, "duplicate fsdev id: %s\n",
+                            qemu_opt_get(opts, "mount_tag"));
                     exit(1);
                 }
-
-                if (!qemu_opts_parse(qemu_find_opts("device"), arg_9p, 1)) {
-                    fprintf(stderr, "parse error [device]: %s\n", optarg);
-                    exit(1);
-                }
-
-                qemu_free(arg_fsdev);
-                qemu_free(arg_9p);
+                qemu_opt_set(fsdev, "fstype", qemu_opt_get(opts, "fstype"));
+                qemu_opt_set(fsdev, "path", qemu_opt_get(opts, "path"));
+                qemu_opt_set(fsdev, "security_model",
+                             qemu_opt_get(opts, "security_model"));
+
+                device = qemu_opts_create(qemu_find_opts("device"), NULL, 0);
+                qemu_opt_set(device, "driver", "virtio-9p-pci");
+                qemu_opt_set(device, "fsdev",
+                             qemu_opt_get(opts, "mount_tag"));
+                qemu_opt_set(device, "mount_tag",
+                             qemu_opt_get(opts, "mount_tag"));
                 break;
             }
             case QEMU_OPTION_serial: