- Update to 0.11.1 - from the official announcement:

  - fix I2C slave addressing (Juha Riihimaki)
  - Revert "vga: do not resize the screen on hw_invalidate" (Aurelien Jarno)
  - slirp: fix use-after-free (Mark McLoughlin)
  - Fix sparc.ld (Blue Swirl)
  - ELF codedump build failures (Laurent Desnogues)
  - kvm: Move KVM mp_state accessors to i386-specific code (Hollis Blanchard)
  - fix configure script with armv4l cpu (Laurent Desnogues)
  - net: disable draining tap queue in one go (Mark McLoughlin)
  - pcnet: Restart poll timer on pcnet_start (Jan Kiszka)
  - Sparc32: Fix lance (Blue Swirl)
  - mac99: fix segmentation fault on startup (Aurelien Jarno)
  - usb-linux.c: fix buffer overflow (Jim Paris)
  - ARM host: fix generated blocks linking (Laurent Desnogues)
  - qemu serial: lost tx irqs (affecting FreeBSD's new uart(4) driver)
    (Juergen Lock)
  - exec-all.h: increase MAX_OP_PER_INSTR to 96 from 64 (Aurelien Jarno)

- Added a cherry picked commit from stable branch that fixes qcow2.

22 files changed, 425 insertions, 583 deletions

diff --git a/emulators/qemu/Makefile b/emulators/qemu/Makefile
index a2fd1511e0c3..5fac48c23701 100644
--- a/emulators/qemu/Makefile
+++ b/emulators/qemu/Makefile
@@ -6,8 +6,7 @@
 #
 
 PORTNAME=	qemu
-PORTVERSION=	0.10.6
-PORTREVISION=	3
+PORTVERSION=	0.11.1
 CATEGORIES=	emulators
 MASTER_SITES=	${MASTER_SITE_SAVANNAH} \
 		http://bellard.org/qemu/
@@ -34,7 +33,6 @@ OPTIONS=	KQEMU "Build with (alpha!) accelerator module" Off \
 		GNUTLS "gnutls dependency (vnc encryption)" On \
 		PCAP "pcap dependency (networking with bpf)" On \
 		CDROM_DMA "IDE CDROM DMA" On \
-		PHYS_CDROM "Physical CDROM fixes" On \
 		ADD_AUDIO "Emulate more audio hardware (experimental!)" Off \
 		ALL_TARGETS "Also build non-x86 targets" On
 
@@ -52,7 +50,7 @@ CFLAGS:=	${CFLAGS:C/-fno-tree-vrp//}
 CONFIGURE_ARGS+=	--prefix=${PREFIX} --cc=${CC}
 
 .if defined(WITHOUT_SDL)
-CONFIGURE_ARGS+=	--disable-sdl --disable-gfx-check
+CONFIGURE_ARGS+=	--disable-sdl
 .else
 USE_SDL=	sdl
 .endif
@@ -71,6 +69,9 @@ CONFIGURE_ARGS+=	--enable-pcap
 CONFIGURE_ARGS+=	--audio-card-list=ac97,es1370,sb16,cs4231a,adlib,gus
 .endif
 
+# XXX
+CONFIGURE_ARGS+=	--disable-bsd-user
+
 .if defined(WITH_SAMBA)
 RUN_DEPENDS+=	${LOCALBASE}/sbin/smbd:${PORTSDIR}/net/samba3
 .endif
@@ -111,9 +112,6 @@ post-patch:
 .if defined(WITHOUT_CDROM_DMA)
 	@cd ${WRKSRC} && ${PATCH} --quiet < ${FILESDIR}/cdrom-dma-patch
 .endif
-.if defined(WITH_PHYS_CDROM)
-	@cd ${WRKSRC} && ${PATCH} -p1 --quiet < ${FILESDIR}/phys-cdrom-freebsd-patch
-.endif
 	@${REINPLACE_CMD} -E \
 		-e "s|^(CFLAGS=).*|\1${CFLAGS} -fno-strict-aliasing|" \
 		-e "s|^(LDFLAGS=).*|\1${LDFLAGS}|" \
diff --git a/emulators/qemu/distinfo b/emulators/qemu/distinfo
index 5c5aa9cf2958..da5aabba0a04 100644
--- a/emulators/qemu/distinfo
+++ b/emulators/qemu/distinfo
@@ -1,3 +1,3 @@
-MD5 (qemu/qemu-0.10.6.tar.gz) = e28f4b2d6faef178da44c03224feecb6
-SHA256 (qemu/qemu-0.10.6.tar.gz) = 8725298d4fd937ae41d942d0dd4a22fc02561d8c57a9fdcdbfa56427915757c7
-SIZE (qemu/qemu-0.10.6.tar.gz) = 3664559
+MD5 (qemu/qemu-0.11.1.tar.gz) = 193285b0bcf655a7f7577d05ffcb82b1
+SHA256 (qemu/qemu-0.11.1.tar.gz) = 2ecd2fc0af2ce5d96067ae82cc98a08275c596de53fc929484bedee1d6e7893a
+SIZE (qemu/qemu-0.11.1.tar.gz) = 3830070
diff --git a/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life b/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life
new file mode 100644
index 000000000000..b4ef8ae45b8f
--- /dev/null
+++ b/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life
@@ -0,0 +1,144 @@
+From 08fd2f30bd3ee5d04596da8293689af4d4f7eb6c Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 3 Dec 2009 10:28:44 +0100
+Subject: [PATCH] qcow2: Bring synchronous read/write back to life
+
+When the synchronous read and write functions were dropped, they were replaced
+by generic emulation functions. Unfortunately, these emulation functions don't
+provide the same semantics as the original functions did.
+
+The original bdrv_read would mean that we read some data synchronously and that
+we won't be interrupted during this read. The latter assumption is no longer
+true with the emulation function which needs to use qemu_aio_poll and therefore
+allows the callback of any other concurrent AIO request to be run during the
+read. Which in turn means that (meta)data read earlier could have changed and
+be invalid now. qcow2 is not prepared to work in this way and it's just scary
+how many places there are where other requests could run.
+
+I'm not sure yet where exactly it breaks, but you'll see breakage with virtio
+on qcow2 with a backing file. Providing synchronous functions again fixes the
+problem for me.
+
+Patchworks-ID: 35437
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit ef845c3bf421290153154635dc18eaa677cecb43)
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+---
+ block/qcow2-cluster.c |    6 ++--
+ block/qcow2.c         |   51 +++++++++++++++++++++++++++++++++++++++++++++++-
+ block/qcow2.h         |    3 ++
+ 3 files changed, 55 insertions(+), 5 deletions(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index d4631c3..4d0ce16 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -306,8 +306,8 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
+ }
+ 
+ 
+-static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+-                     uint8_t *buf, int nb_sectors)
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors)
+ {
+     BDRVQcowState *s = bs->opaque;
+     int ret, index_in_cluster, n, n1;
+@@ -358,7 +358,7 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
+     n = n_end - n_start;
+     if (n <= 0)
+         return 0;
+-    ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
++    ret = qcow2_read(bs, start_sect + n_start, s->cluster_data, n);
+     if (ret < 0)
+         return ret;
+     if (s->crypt_method) {
+diff --git a/block/qcow2.c b/block/qcow2.c
+index dd32ea2..ced257e 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -855,6 +855,51 @@ static int qcow_make_empty(BlockDriverState *bs)
+     return 0;
+ }
+ 
++static int qcow2_write(BlockDriverState *bs, int64_t sector_num,
++                     const uint8_t *buf, int nb_sectors)
++{
++    BDRVQcowState *s = bs->opaque;
++    int ret, index_in_cluster, n;
++    uint64_t cluster_offset;
++    int n_end;
++    QCowL2Meta l2meta;
++
++    while (nb_sectors > 0) {
++        memset(&l2meta, 0, sizeof(l2meta));
++
++        index_in_cluster = sector_num & (s->cluster_sectors - 1);
++        n_end = index_in_cluster + nb_sectors;
++        if (s->crypt_method &&
++            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
++            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
++        cluster_offset = qcow2_alloc_cluster_offset(bs, sector_num << 9,
++                                              index_in_cluster,
++                                              n_end, &n, &l2meta);
++        if (!cluster_offset)
++            return -1;
++        if (s->crypt_method) {
++            qcow2_encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
++                            &s->aes_encrypt_key);
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
++                              s->cluster_data, n * 512);
++        } else {
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
++        }
++        if (ret != n * 512 || qcow2_alloc_cluster_link_l2(bs, cluster_offset, &l2meta) < 0) {
++            qcow2_free_any_clusters(bs, cluster_offset, l2meta.nb_clusters);
++            return -1;
++        }
++        nb_sectors -= n;
++        sector_num += n;
++        buf += n * 512;
++        if (l2meta.nb_clusters != 0) {
++            LIST_REMOVE(&l2meta, next_in_flight);
++        }
++    }
++    s->cluster_cache_offset = -1; /* disable compressed cache */
++    return 0;
++}
++
+ /* XXX: put compressed sectors first, then all the cluster aligned
+    tables to avoid losing bytes in alignment */
+ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+@@ -1037,8 +1082,10 @@ static BlockDriver bdrv_qcow2 = {
+     .bdrv_set_key	= qcow_set_key,
+     .bdrv_make_empty	= qcow_make_empty,
+ 
+-    .bdrv_aio_readv	= qcow_aio_readv,
+-    .bdrv_aio_writev	= qcow_aio_writev,
++    .bdrv_read          = qcow2_read,
++    .bdrv_write         = qcow2_write,
++    .bdrv_aio_readv     = qcow_aio_readv,
++    .bdrv_aio_writev    = qcow_aio_writev,
+     .bdrv_write_compressed = qcow_write_compressed,
+ 
+     .bdrv_snapshot_create   = qcow2_snapshot_create,
+diff --git a/block/qcow2.h b/block/qcow2.h
+index 965a2f4..b41aa63 100644
+--- a/block/qcow2.h
++++ b/block/qcow2.h
+@@ -202,6 +202,9 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
+ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
+     QCowL2Meta *m);
+ 
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors);
++
+ /* qcow2-snapshot.c functions */
+ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info);
+ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id);
+-- 
+1.6.5.2
+
diff --git a/emulators/qemu/files/patch-Makefile b/emulators/qemu/files/patch-Makefile
index d6c95955fb14..93eddc846602 100644
--- a/emulators/qemu/files/patch-Makefile
+++ b/emulators/qemu/files/patch-Makefile
@@ -1,5 +1,5 @@
 Index: qemu/Makefile
-@@ -19,7 +19,11 @@
+@@ -25,7 +25,11 @@
  LDFLAGS += -static
  endif
  ifdef BUILD_DOCS
@@ -11,18 +11,19 @@ Index: qemu/Makefile
  else
  DOCS=
  endif
-@@ -221,12 +225,12 @@
+@@ -260,13 +264,13 @@
+ endif
  
  install-doc: $(DOCS)
 +ifndef NOPORTDOCS
- 	mkdir -p "$(DESTDIR)$(docdir)"
- 	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DIR) "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
 +endif
  ifndef CONFIG_WIN32
- 	mkdir -p "$(DESTDIR)$(mandir)/man1"
- 	$(INSTALL) -m 644 qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
--	mkdir -p "$(DESTDIR)$(mandir)/man8"
--	$(INSTALL) -m 644 qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
+ 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
+ 	$(INSTALL_DATA) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
+-	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
+-	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
  endif
  
  install: all $(if $(BUILD_DOCS),install-doc)
diff --git a/emulators/qemu/files/patch-aa b/emulators/qemu/files/patch-aa
deleted file mode 100644
index 25eaa72ab235..000000000000
--- a/emulators/qemu/files/patch-aa
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -urd --exclude=CVS ../cvs/qemu/Makefile qemu-0.5.5/Makefile
---- ../cvs/qemu/Makefile	Mon May 17 21:06:42 2004
-+++ qemu-0.5.5/Makefile	Sun May 30 05:26:19 2004
-@@ -70,7 +70,7 @@
- 
- # documentation
- %.html: %.texi
--	texi2html -monolithic -number $<
-+	-texi2html -monolithic -number $<
- 
- qemu.1: qemu-doc.texi
- 	./texi2pod.pl $< qemu.pod
diff --git a/emulators/qemu/files/patch-ac b/emulators/qemu/files/patch-ac
index 99821158695d..cc7638d0f26e 100644
--- a/emulators/qemu/files/patch-ac
+++ b/emulators/qemu/files/patch-ac
@@ -1,8 +1,8 @@
 Index: qemu/configure
-@@ -540,7 +540,7 @@
+@@ -868,7 +868,7 @@
  sdl_too_old=no
  
- if test -z "$sdl" ; then
+ if test "$sdl" = "yes" ; then
 -    sdl_config="sdl-config"
 +    sdl_config="${SDL_CONFIG}"
      sdl=no
diff --git a/emulators/qemu/files/patch-bg b/emulators/qemu/files/patch-bg
index d82921bd38f1..27c544f14341 100644
--- a/emulators/qemu/files/patch-bg
+++ b/emulators/qemu/files/patch-bg
@@ -1,23 +1,21 @@
 Index: qemu/Makefile
-@@ -11,7 +11,7 @@
- LDFLAGS += $(OS_LDFLAGS) $(ARCH_LDFLAGS)
- 
+@@ -19,6 +19,7 @@
  CPPFLAGS += -I. -I$(SRC_PATH) -MMD -MP -MT $@
--CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-+CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
+ CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+ CPPFLAGS += -U_FORTIFY_SOURCE
++CPPFLAGS += -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
  LIBS=
  ifdef CONFIG_STATIC
  LDFLAGS += -static
 Index: qemu/Makefile.target
-@@ -179,7 +179,7 @@
- 
- #########################################################
+@@ -54,6 +54,7 @@
  
--CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-+CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
+ CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+ CPPFLAGS+=-U_FORTIFY_SOURCE
++CPPFLAGS+=-DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
  LIBS+=-lm
- ifndef CONFIG_USER_ONLY
- LIBS+=-lz
+ ifdef CONFIG_WIN32
+ LIBS+=-lwinmm -lws2_32 -liphlpapi
 Index: qemu/net.h
 @@ -99,12 +99,14 @@
  int slirp_is_inited(void);
diff --git a/emulators/qemu/files/patch-configure b/emulators/qemu/files/patch-configure
index 782062a27890..a22531fd51b4 100644
--- a/emulators/qemu/files/patch-configure
+++ b/emulators/qemu/files/patch-configure
@@ -1,10 +1,10 @@
 Index: qemu/configure
-@@ -689,7 +689,7 @@
- fi # test "$curses"
+@@ -1348,7 +1348,7 @@
+ fi
  
  # Check if tools are available to build documentation.
--if [ -x "`which texi2html 2>/dev/null`" ] && \
-+if [ "x$NOPORTDOCS" != "x" -o -x "`which texi2html 2>/dev/null`" ] && \
-    [ -x "`which pod2man 2>/dev/null`" ]; then
-   build_docs="yes"
+-if test "$build_docs" = "yes" -a \( ! -x "`which texi2html 2>/dev/null`" -o ! -x "`which pod2man 2>/dev/null`" \) ; then
++if test "$build_docs" = "yes" -a \( "x$NOPORTDOCS" != "x" -o ! -x "`which texi2html 2>/dev/null`" -o ! -x "`which pod2man 2>/dev/null`" \) ; then
+   build_docs="no"
  fi
+ 
diff --git a/emulators/qemu/files/patch-cpu-exec.c b/emulators/qemu/files/patch-cpu-exec.c
deleted file mode 100644
index f1e1123fd547..000000000000
--- a/emulators/qemu/files/patch-cpu-exec.c
+++ /dev/null
@@ -1,66 +0,0 @@
-Index: qemu/cpu-exec.c
-@@ -1158,6 +1158,12 @@
- # define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext->ss.eip))
- # define TRAP_sig(context)    ((context)->uc_mcontext->es.trapno)
- # define ERROR_sig(context)   ((context)->uc_mcontext->es.err)
-+#elif defined(__FreeBSD__) 
-+# include <sys/ucontext.h>
-+
-+# define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_eip))
-+# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
-+# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
- #else
- # define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
- # define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
-@@ -1168,7 +1174,11 @@
-                        void *puc)
- {
-     siginfo_t *info = pinfo;
-+#ifdef __FreeBSD__
-+    ucontext_t *uc = puc;
-+#else
-     struct ucontext *uc = puc;
-+#endif
-     unsigned long pc;
-     int trapno;
- 
-@@ -1194,6 +1204,12 @@
- 
- #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.__gregs[(reg)]
- #define QEMU_UC_MACHINE_PC(uc)		_UC_MACHINE_PC(uc)
-+#elif defined(__FreeBSD__) 
-+# include <sys/ucontext.h>
-+
-+# define RIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_rip))
-+# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
-+# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
- #else
- #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.gregs[(reg)]
- #define QEMU_UC_MACHINE_PC(uc)		QEMU_UC_MCONTEXT_GREGS(uc, REG_RIP)
-@@ -1204,17 +1220,25 @@
- {
-     siginfo_t *info = pinfo;
-     unsigned long pc;
--#ifdef __NetBSD__
-+#if defined(__NetBSD__) || defined(__FreeBSD__)
-     ucontext_t *uc = puc;
- #else
-     struct ucontext *uc = puc;
- #endif
- 
-+#ifdef __FreeBSD__
-+    pc = RIP_sig(uc);
-+    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-+                             TRAP_sig(uc) == 0xe ?
-+                             (ERROR_sig(uc) >> 1) & 1 : 0,
-+                             &uc->uc_sigmask, puc);
-+#else
-     pc = QEMU_UC_MACHINE_PC(uc);
-     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-                              QEMU_UC_MCONTEXT_GREGS(uc, REG_TRAPNO) == 0xe ?
-                              (QEMU_UC_MCONTEXT_GREGS(uc, REG_ERR) >> 1) & 1 : 0,
-                              &uc->uc_sigmask, puc);
-+#endif
- }
- 
- #elif defined(__powerpc__)
diff --git a/emulators/qemu/files/patch-exec-all.h b/emulators/qemu/files/patch-exec-all.h
deleted file mode 100644
index 244bfb05055a..000000000000
--- a/emulators/qemu/files/patch-exec-all.h
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/exec-all.h
-@@ -30,7 +30,7 @@
- struct TranslationBlock;
- 
- /* XXX: make safe guess about sizes */
--#define MAX_OP_PER_INSTR 64
-+#define MAX_OP_PER_INSTR 128 /* 64 */
- /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
- #define MAX_OPC_PARAM 10
- #define OPC_BUF_SIZE 512
diff --git a/emulators/qemu/files/patch-fbsd b/emulators/qemu/files/patch-fbsd
index 58aebeeb42c4..75cded3c7cae 100644
--- a/emulators/qemu/files/patch-fbsd
+++ b/emulators/qemu/files/patch-fbsd
@@ -1,26 +1,26 @@
 Index: qemu/Makefile
-@@ -38,7 +38,10 @@
+@@ -45,7 +45,10 @@
  LIBS+=-lwinmm -lws2_32 -liphlpapi
  endif
  
--all: $(TOOLS) $(DOCS) recurse-all
-+all: bsd/libmath.a $(TOOLS) $(DOCS) recurse-all
+-build-all: $(TOOLS) $(DOCS) recurse-all
++build-all: bsd/libmath.a $(TOOLS) $(DOCS) recurse-all
 +
 +bsd/libmath.a:
 +	( cd bsd ; unset MAKEFLAGS ; $(BSD_MAKE) CC=$(CC) )
  
- SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
- 
-@@ -195,6 +198,7 @@
+ config-host.mak: configure
+ ifneq ($(wildcard config-host.mak),)
+@@ -242,6 +245,7 @@
  
  clean:
  # avoid old build problems by removing potentially incorrect old files
 +	( cd bsd ; $(BSD_MAKE) clean )
  	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
  	rm -f *.o *.d *.a $(TOOLS) TAGS cscope.* *.pod *~ */*~
- 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d
+ 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d
 Index: qemu/Makefile.target
-@@ -417,7 +417,7 @@
+@@ -339,7 +339,7 @@
  # WARNING: this LDFLAGS is _very_ tricky : qemu is an ELF shared object
  # that the kernel ELF loader considers as an executable. I think this
  # is the simplest way to make it self virtualizable!
@@ -29,52 +29,48 @@ Index: qemu/Makefile.target
  endif
  endif
  
-@@ -491,7 +491,7 @@
+@@ -408,7 +408,7 @@
  # cpu_signal_handler() in cpu-exec.c.
  signal.o: CFLAGS += $(HELPER_CFLAGS)
  
--$(QEMU_PROG): $(OBJS) ../libqemu_user.a
-+$(QEMU_PROG): $(OBJS) ../libqemu_user.a ../bsd/libmath.a
- 	$(LINK)
+-ARLIBS=libqemu.a ../libqemu_user.a
++ARLIBS=libqemu.a ../libqemu_user.a ../bsd/libmath.a
  
  endif #CONFIG_BSD_USER
-@@ -717,9 +717,9 @@
- main.o: CFLAGS+=-p
- endif
  
--$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS)
-+$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) ../bsd/libmath.a
+@@ -658,7 +658,7 @@
+ monitor.o: qemu-monitor.h
  
--$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a
-+$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a ../bsd/libmath.a
- 	$(LINK)
+ LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) $(CURL_LIBS)
+-ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
++ARLIBS=../libqemu_common.a libqemu.a $(HWLIB) ../bsd/libmath.a
  
  endif # !CONFIG_USER_ONLY
+ 
 Index: qemu/fpu/softfloat-native.c
-@@ -2,11 +2,16 @@
-    context is supported */
- #include "softfloat.h"
- #include <math.h>
+@@ -6,10 +6,15 @@
+ #include <fenv.h>
+ #endif
+ 
 +#if defined(__FreeBSD__) && __FreeBSD_version < 500000
 +#include <ieeefp.h>
 +#endif
- 
++
  void set_float_rounding_mode(int val STATUS_PARAM)
  {
      STATUS(float_rounding_mode) = val;
--#if defined(_BSD) && !defined(__APPLE__) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if defined(_BSD) && !defined(__APPLE__) && !defined(__FreeBSD__) || \
+-#if defined(HOST_BSD) && !defined(__APPLE__) ||         \
++#if defined(HOST_BSD) && !defined(__APPLE__) && !defined(__FreeBSD__) || \
 +    (defined(__FreeBSD__) && __FreeBSD_version < 500000) || \
-+    (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+     (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
      fpsetround(val);
  #elif defined(__arm__)
-     /* nothing to do */
-@@ -22,7 +25,7 @@
+@@ -26,7 +31,7 @@
  }
  #endif
  
--#if defined(_BSD) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if (defined(_BSD) && !defined(__FreeBSD__)) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+-#if defined(HOST_BSD) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
++#if (defined(HOST_BSD) && !defined(__FreeBSD__)) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
  #define lrint(d)		((int32_t)rint(d))
  #define llrint(d)		((int64_t)rint(d))
  #define lrintf(f)		((int32_t)rint(f))
@@ -83,7 +79,7 @@ Index: qemu/fpu/softfloat-native.h
  /* Native implementation of soft float functions */
  #include <math.h>
  
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
+-#if (defined(HOST_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
 +#ifdef __FreeBSD__
 +#include <osreldate.h>
 +long double fabsl(long double x);
@@ -94,7 +90,7 @@ Index: qemu/fpu/softfloat-native.h
 +long long llrintl(long double x);
 +#endif
 +
-+#if (defined(_BSD) && !defined(__APPLE__) && \
++#if (defined(HOST_BSD) && !defined(__APPLE__) && \
 +     (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
 +    defined(HOST_SOLARIS)
  #include <ieeefp.h>
@@ -112,8 +108,8 @@ Index: qemu/fpu/softfloat-native.h
 @@ -109,6 +109,8 @@
  | Software IEC/IEEE floating-point rounding mode.
  *----------------------------------------------------------------------------*/
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
-+#if (defined(_BSD) && !defined(__APPLE__) && \
+-#if (defined(HOST_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
++#if (defined(HOST_BSD) && !defined(__APPLE__) && \
 +      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
 +     defined(HOST_SOLARIS)
  #if defined(__OpenBSD__)
@@ -124,9 +120,9 @@ Index: qemu/fpu/softfloat.h
  #define FLOAT128
  #else
  /* native float support */
--#if (defined(__i386__) || defined(__x86_64__)) && !defined(_BSD)
+-#if (defined(__i386__) || defined(__x86_64__)) && !defined(HOST_BSD)
 +#if (defined(__i386__) || defined(__x86_64__)) && \
-+    (!defined(_BSD) || defined(__FreeBSD__))
++    (!defined(HOST_BSD) || defined(__FreeBSD__))
  #define FLOATX80
  #endif
  #endif /* !CONFIG_SOFTFLOAT */
diff --git a/emulators/qemu/files/patch-hw-serial.c b/emulators/qemu/files/patch-hw-serial.c
deleted file mode 100644
index a195b85360de..000000000000
--- a/emulators/qemu/files/patch-hw-serial.c
+++ /dev/null
@@ -1,18 +0,0 @@
-Index: qemu/hw/serial.c
-@@ -196,12 +195,10 @@ static void serial_update_irq(SerialStat
-          * this is not in the specification but is observed on existing
-          * hardware.  */
-         tmp_iir = UART_IIR_CTI;
--    } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR)) {
--        if (!(s->fcr & UART_FCR_FE)) {
--           tmp_iir = UART_IIR_RDI;
--        } else if (s->recv_fifo.count >= s->recv_fifo.itl) {
--           tmp_iir = UART_IIR_RDI;
--        }
-+    } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR) &&
-+               (!(s->fcr & UART_FCR_FE) ||
-+                s->recv_fifo.count >= s->recv_fifo.itl)) {
-+        tmp_iir = UART_IIR_RDI;
-     } else if ((s->ier & UART_IER_THRI) && s->thr_ipending) {
-         tmp_iir = UART_IIR_THRI;
-     } else if ((s->ier & UART_IER_MSI) && (s->msr & UART_MSR_ANY_DELTA)) {
diff --git a/emulators/qemu/files/patch-hw-vmware_vga.c b/emulators/qemu/files/patch-hw-vmware_vga.c
index a54b8729c7df..fb404a749946 100644
--- a/emulators/qemu/files/patch-hw-vmware_vga.c
+++ b/emulators/qemu/files/patch-hw-vmware_vga.c
@@ -72,13 +72,3 @@ Index: qemu/hw/vmware_vga.c
          badcmd:
              while (args --)
                  vmsvga_fifo_read(s);
-@@ -914,7 +914,7 @@
-     s->width = -1;
-     s->height = -1;
-     s->svgaid = SVGA_ID;
--    s->depth = 24;
-+    s->depth = 32;
-     s->bypp = (s->depth + 7) >> 3;
-     s->cursor.on = 0;
-     s->redraw_fifo_first = 0;
-
diff --git a/emulators/qemu/files/patch-osdep.c b/emulators/qemu/files/patch-osdep.c
new file mode 100644
index 000000000000..984c63bdbbcb
--- /dev/null
+++ b/emulators/qemu/files/patch-osdep.c
@@ -0,0 +1,11 @@
+Index: qemu/osdep.c
+@@ -179,7 +179,9 @@
+         }
+         unlink(phys_ram_file);
+     }
++#endif /* !(__OpenBSD__ || __FreeBSD__ || __DragonFly__) */
+     size = (size + 4095) & ~4095;
++#if !defined(__OpenBSD__) && !defined(__FreeBSD__) && !defined(__DragonFly__)
+     ftruncate(phys_ram_fd, phys_ram_size + size);
+ #endif /* !(__OpenBSD__ || __FreeBSD__ || __DragonFly__) */
+     ptr = mmap(NULL,
diff --git a/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S b/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S
new file mode 100644
index 000000000000..91a3c4e8decc
--- /dev/null
+++ b/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S
@@ -0,0 +1,16 @@
+--- a/pc-bios/optionrom/multiboot.S
++++ b/pc-bios/optionrom/multiboot.S
+@@ -113,7 +113,10 @@ mmap_loop:
+ 	/* entry size (mmap struct) & max buffer size (int15) */
+ 	movl		$20, %ecx
+ 	/* store entry size */
++	/* old as(1) doesn't like this insn so emit the bytes instead:
+ 	movl		%ecx, %es:-4(%edi)
++	*/
++	.dc.b		0x26,0x67,0x66,0x89,0x4f,0xfc
+ 	/* e820 */
+ 	movl		$0x0000e820, %eax
+ 	/* 'SMAP' magic */
+-- 
+1.6.5.2
+
diff --git a/emulators/qemu/files/patch-tapclose b/emulators/qemu/files/patch-tapclose
index 1dde3ca9342d..8da33adb673f 100644
--- a/emulators/qemu/files/patch-tapclose
+++ b/emulators/qemu/files/patch-tapclose
@@ -1,16 +1,18 @@
 Index: qemu/net.c
-@@ -788,11 +788,11 @@
- {
-     TAPState *s = vc->opaque;
+@@ -1643,12 +1643,13 @@ static void tap_cleanup(VLANClientState 
+ 
+     qemu_purge_queued_packets(vc);
  
 -    if (s->down_script[0])
 -        launch_script(s->down_script, s->down_script_arg, s->fd);
 -
-     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
+     tap_read_poll(s, 0);
+     tap_write_poll(s, 0);
      close(s->fd);
 +
 +    if (s->down_script[0])
 +        launch_script(s->down_script, s->down_script_arg, -1);
++
      qemu_free(s);
  }
  
diff --git a/emulators/qemu/files/patch-vl.c b/emulators/qemu/files/patch-vl.c
index 44684c7ce36b..b979a0373046 100644
--- a/emulators/qemu/files/patch-vl.c
+++ b/emulators/qemu/files/patch-vl.c
@@ -1,28 +1,82 @@
 Index: qemu/vl.c
-@@ -75,6 +75,7 @@
+@@ -57,6 +57,7 @@
  #include <sys/stat.h>
- #ifdef __FreeBSD__
+ #if defined(__FreeBSD__) || defined(__DragonFly__)
  #include <libutil.h>
 +#include <sys/param.h>
  #else
  #include <util.h>
  #endif
-@@ -9850,15 +9850,15 @@
-         phys_ram_size += ram_size;
-     }
+@@ -4782,6 +4783,10 @@
+ 
+ #endif
+ 
++#if !defined(CONFIG_USER_ONLY)
++void io_mem_init(void);
++#endif
++
+ int main(int argc, char **argv, char **envp)
+ {
+ #ifdef CONFIG_GDBSTUB
+@@ -5621,6 +5626,10 @@
+ #ifdef CONFIG_KQEMU
+     if (smp_cpus > 1)
+         kqemu_allowed = 0;
++    if (kqemu_allowed && ram_size > (1536 << 20)) {
++        fprintf(stderr, "qemu: at most 1536 MB RAM can be simulated with kqemu\n");
++        exit(1);
++    }
+ #endif
+     if (qemu_init_main_loop()) {
+         fprintf(stderr, "qemu_init_main_loop failed\n");
+@@ -5715,6 +5724,9 @@
+     if (ram_size == 0)
+         ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
  
 +    /* init the dynamic translator */
 +    cpu_exec_init_all(tb_size * 1024 * 1024);
 +
-     phys_ram_base = qemu_vmalloc(phys_ram_size);
-     if (!phys_ram_base) {
-         fprintf(stderr, "Could not allocate physical memory\n");
-         exit(1);
+ #ifdef CONFIG_KQEMU
+     /* FIXME: This is a nasty hack because kqemu can't cope with dynamic
+        guest ram allocation.  It needs to go away.  */
+@@ -5727,9 +5739,9 @@
+         }
      }
- 
+ #endif
+-
 -    /* init the dynamic translator */
 -    cpu_exec_init_all(tb_size * 1024 * 1024);
--
++#if !defined(CONFIG_USER_ONLY)
++    io_mem_init();
++#endif
+ 
      bdrv_init();
+     dma_helper_init();
+Index: qemu/exec.c
+@@ -179,7 +179,7 @@
+ static PhysPageDesc **l1_phys_map;
+ 
+ #if !defined(CONFIG_USER_ONLY)
+-static void io_mem_init(void);
++void io_mem_init(void);
+ 
+ /* io memory support */
+ CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
+@@ -503,7 +503,7 @@
+     code_gen_alloc(tb_size);
+     code_gen_ptr = code_gen_buffer;
+     page_init();
+-#if !defined(CONFIG_USER_ONLY)
++#if 0 && !defined(CONFIG_USER_ONLY)
+     io_mem_init();
+ #endif
+ }
+@@ -2993,7 +2993,7 @@
+     return -1;
+ }
+ 
+-static void io_mem_init(void)
++void io_mem_init(void)
+ {
+     int i;
  
-     /* we always create the cdrom drive, even if no disk is there */
diff --git a/emulators/qemu/files/patch-z-bandaid-usb-current b/emulators/qemu/files/patch-z-bandaid-usb-current
index 347c8417ab7b..ad66da21f543 100644
--- a/emulators/qemu/files/patch-z-bandaid-usb-current
+++ b/emulators/qemu/files/patch-z-bandaid-usb-current
@@ -1,14 +1,14 @@
 Index: qemu/usb-bsd.c
-@@ -34,7 +34,12 @@
- #undef USB_SPEED_LOW
+@@ -35,7 +35,12 @@
  
  #include <sys/ioctl.h>
+ #ifndef __DragonFly__
 +#include <sys/param.h>
 +#if __FreeBSD_version >= 800064
 +#include <legacy/dev/usb/usb.h>
 +#else
  #include <dev/usb/usb.h>
 +#endif
- #include <signal.h>
- 
- /* This value has maximum potential at 16.
+ #else
+ #include <bus/usb/usb.h>
+ #endif
diff --git a/emulators/qemu/files/pcap-patch b/emulators/qemu/files/pcap-patch
index 1a821b4fe167..0351d0c23f9b 100644
--- a/emulators/qemu/files/pcap-patch
+++ b/emulators/qemu/files/pcap-patch
@@ -1,51 +1,55 @@
---- Makefile.target.orig	2009-09-02 16:09:39.000000000 -0400
-+++ Makefile.target	2009-09-02 16:09:39.000000000 -0400
-@@ -687,6 +687,9 @@
+--- Makefile.target.orig	2008-07-18 15:18:11.000000000 -0400
++++ Makefile.target	2008-07-18 15:23:11.000000000 -0400
+@@ -619,6 +619,13 @@
  COCOA_LIBS+=-framework CoreAudio
  endif
  endif
 +ifdef CONFIG_PCAP
-+LIBS+=$(PCAP_LIBS)
++ifdef CONFIG_WIN32
++LIBS+=-lwpcap
++else
++LIBS+=-lpcap
++endif
 +endif
  ifdef CONFIG_SLIRP
  CPPFLAGS+=-I$(SRC_PATH)/slirp
  endif
---- configure.orig	2009-09-02 16:09:39.000000000 -0400
-+++ configure	2009-09-02 16:09:39.000000000 -0400
-@@ -188,6 +188,9 @@
- blobs="yes"
- fdt="yes"
+Index: configure
+@@ -203,6 +203,9 @@
  sdl_x11="no"
+ xen="yes"
+ pkgversion=""
 +pcap="no"
 +pcap_create="no"
 +bpf="no"
  
  # OS specific
  if check_define __linux__ ; then
-@@ -388,6 +391,8 @@
+@@ -428,6 +431,8 @@
    ;;
-   --disable-vnc-tls) vnc_tls="no"
+   --disable-vnc-sasl) vnc_sasl="no"
    ;;
 +  --enable-pcap) pcap="yes"
 +  ;;
    --disable-slirp) slirp="no"
    ;;
    --disable-vde) vde="no"
-@@ -822,6 +827,47 @@
+@@ -925,6 +930,48 @@
  fi
  
  ##########################################
 +# pcap probe
++
 +if test "$pcap" = "yes" ; then
++  cat > $TMPC << EOF
++#include <pcap.h>
++int main(void) { return (pcap_lib_version() == (char *)0 ? 1 : 0); }
++EOF
 +  if test "$mingw32" = "no" ; then
 +    libpcap=-lpcap
 +  else
 +    libpcap=-lwpcap
 +  fi
-+  cat > $TMPC << EOF
-+#include <pcap.h>
-+int main(void) { return (pcap_lib_version() == (char *)0 ? 1 : 0); }
-+EOF
 +  if ! $cc $ARCH_CFLAGS -o $TMPE $libpcap $TMPC 2> /dev/null ; then
 +    echo
 +    echo "Error: Could not find pcap"
@@ -79,32 +83,38 @@
  # VNC TLS detection
  if test "$vnc_tls" = "yes" ; then
  cat > $TMPC <<EOF
-@@ -1365,6 +1411,17 @@
+@@ -1436,6 +1484,7 @@
+     echo "    SASL CFLAGS    $vnc_sasl_cflags"
+     echo "    SASL LIBS      $vnc_sasl_libs"
+ fi
++echo "pcap support      $pcap"
+ if test -n "$sparc_cpu"; then
+     echo "Target Sparc Arch $sparc_cpu"
+ fi
+@@ -1589,6 +1638,16 @@
  if test $profiler = "yes" ; then
-   echo "#define CONFIG_PROFILER 1" >> $config_h
+   echo "#define CONFIG_PROFILER 1" >> $config_host_h
  fi
 +if test "$pcap" = "yes" ; then
-+  echo "CONFIG_PCAP=yes" >> $config_mak
-+  echo "#define CONFIG_PCAP 1" >> $config_h
++  echo "CONFIG_PCAP=yes" >> $config_host_mak
++  echo "#define CONFIG_PCAP 1" >> $config_host_h
 +  if test "$pcap_create" = "yes" ; then
-+    echo "#define CONFIG_PCAP_CREATE 1" >> $config_h
++    echo "#define HAVE_PCAP_CREATE 1" >> $config_host_h
 +  fi
 +  if test "$bpf" = "yes" ; then
-+    echo "#define CONFIG_BPF 1" >> $config_h
++    echo "#define HAVE_BPF 1" >> $config_host_h
 +  fi
-+  echo "PCAP_LIBS=$libpcap" >> $config_mak
 +fi
  if test "$slirp" = "yes" ; then
-   echo "CONFIG_SLIRP=yes" >> $config_mak
-   echo "#define CONFIG_SLIRP 1" >> $config_h
---- net.c.orig	2009-09-02 16:09:39.000000000 -0400
-+++ net.c	2009-09-02 16:11:38.000000000 -0400
-@@ -481,6 +481,166 @@
-     return max_len;
+   echo "CONFIG_SLIRP=y" >> $config_host_mak
+   echo "#define CONFIG_SLIRP 1" >> $config_host_h
+Index: net.c
+@@ -688,6 +688,166 @@
+     va_end(ap);
  }
  
 +#if defined(CONFIG_PCAP)
-+#if defined(CONFIG_BPF)
++#if defined(HAVE_BPF)
 +#define PCAP_DONT_INCLUDE_PCAP_BPF_H
 +#include <net/bpf.h>
 +#endif
@@ -115,11 +125,11 @@
 +    pcap_t *handle;
 +} PCAPState;
 +
-+static void pcap_receive(void *opaque, const uint8_t *buf, int size)
++static ssize_t pcap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 +{
-+    PCAPState *s = (PCAPState *)opaque;
++    PCAPState *s = (PCAPState *)vc->opaque;
 +
-+    pcap_sendpacket(s->handle, (u_char*)buf, size);
++    return pcap_inject(s->handle, (u_char*)buf, size);
 +}
 +
 +static void pcap_callback(u_char *user, struct pcap_pkthdr *phdr, u_char *pdata)
@@ -158,11 +168,11 @@
 +	return -1;
 +
 +    if (ifname == NULL && (ifname = pcap_lookupdev(errbuf)) == NULL) {
-+	fprintf(stderr, "qemu: pcap_create: %s\n", errbuf);
++	fprintf(stderr, "qemu: pcap_lookupdev: %s\n", errbuf);
 +	goto fail;
 +    }
 +
-+#if defined(CONFIG_PCAP_CREATE) || defined(_WIN32)
++#if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
 +    /*
 +     * Create pcap handle for the device, set promiscuous mode and activate.
 +     */
@@ -203,7 +213,7 @@
 +	goto fail;
 +    }
 +#else /* !_WIN32 */
-+#if defined(CONFIG_BPF)
++#if defined(HAVE_BPF)
 +#if defined(BIOCIMMEDIATE)
 +    /*
 +     * Tell the kernel that the packet has to be seen immediately.
@@ -230,10 +240,10 @@
 +	}
 +    }
 +#endif /* BIOCFEEDBACK */
-+#endif /* CONFIG_BPF */
++#endif /* HAVE_BPF */
 +#endif /* _WIN32 */
 +
-+    s->vc = qemu_new_vlan_client(vlan, model, name, pcap_receive, NULL, pcap_cleanup, s);
++    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, pcap_receive, NULL, pcap_cleanup, s);
 +    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "pcap redirector");
 +
 +#if defined(_WIN32)
@@ -266,7 +276,7 @@
  #if defined(CONFIG_SLIRP)
  
  /* slirp network adapter */
-@@ -1755,6 +1915,16 @@
+@@ -2598,6 +2758,16 @@
             are wanted */
          ret = 0;
      } else
@@ -282,17 +292,16 @@
 +#endif
  #ifdef CONFIG_SLIRP
      if (!strcmp(device, "user")) {
-         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
---- vl.c.orig	2009-09-02 16:09:39.000000000 -0400
-+++ vl.c	2009-09-02 16:09:39.000000000 -0400
-@@ -3990,6 +3990,10 @@
-            "Network options:\n"
-            "-net nic[,vlan=n][,macaddr=addr][,model=type][,name=str]\n"
-            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
+         static const char * const slirp_params[] = {
+Index: qemu-options.hx
+@@ -782,6 +782,10 @@
+     "                connect the user mode network stack to VLAN 'n', configure its\n"
+     "                DHCP server and enabled optional services\n"
+ #endif
 +#ifdef CONFIG_PCAP
-+           "-net pcap[,vlan=n][,name=str][,ifname=name]\n"
-+           "                connect the host network interface using PCAP to VLAN 'n'\n"
++    "-net pcap[,vlan=n][,name=str][,ifname=name]\n"
++    "                connect the host network interface using PCAP to VLAN 'n'\n"
 +#endif
- #ifdef CONFIG_SLIRP
-            "-net user[,vlan=n][,name=str][,hostname=host]\n"
-            "                connect the user mode network stack to VLAN 'n' and send\n"
+ #ifdef _WIN32
+     "-net tap[,vlan=n][,name=str],ifname=name\n"
+     "                connect the host TAP network interface to VLAN 'n'\n"
diff --git a/emulators/qemu/files/phys-cdrom-freebsd-patch b/emulators/qemu/files/phys-cdrom-freebsd-patch
deleted file mode 100644
index 6f477c4339cb..000000000000
--- a/emulators/qemu/files/phys-cdrom-freebsd-patch
+++ /dev/null
@@ -1,282 +0,0 @@
-Index: qemu/block-raw-posix.c
-@@ -55,6 +55,7 @@
- #ifdef __FreeBSD__
- #include <signal.h>
- #include <sys/disk.h>
-+#include <sys/cdio.h>
- #endif
- 
- #ifdef __OpenBSD__
-@@ -105,6 +106,9 @@
-     int fd_got_error;
-     int fd_media_changed;
- #endif
-+#if defined(__FreeBSD__)
-+    int cd_open_flags;
-+#endif
-     uint8_t* aligned_buf;
- } BDRVRawState;
- 
-@@ -112,6 +116,12 @@
- 
- static int fd_open(BlockDriverState *bs);
- 
-+#if defined(__FreeBSD__)
-+static int cd_open(BlockDriverState *bs);
-+#endif
-+
-+static int raw_is_inserted(BlockDriverState *bs);
-+
- static int raw_open(BlockDriverState *bs, const char *filename, int flags)
- {
-     BDRVRawState *s = bs->opaque;
-@@ -747,6 +757,9 @@
-     int64_t size;
- #ifdef _BSD
-     struct stat sb;
-+#ifdef __FreeBSD__
-+    int reopened = 0;
-+#endif
- #endif
- #ifdef __sun__
-     struct dk_minfo minfo;
-@@ -759,6 +772,9 @@
-         return ret;
- 
- #ifdef _BSD
-+#ifdef __FreeBSD__
-+again:
-+#endif
-     if (!fstat(fd, &sb) && (S_IFCHR & sb.st_mode)) {
- #ifdef DIOCGMEDIASIZE
- 	if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
-@@ -768,6 +784,19 @@
- #else
-         size = lseek(fd, 0LL, SEEK_END);
- #endif
-+#ifdef __FreeBSD__
-+        switch(s->type) {
-+        case FTYPE_CD:
-+            /* XXX FreeBSD acd returns UINT_MAX sectors for an empty drive */
-+            if (size == 2048LL * (unsigned)-1)
-+                size = 0;
-+            /* XXX no disc?  maybe we need to reopen... */
-+            if (size <= 0 && !reopened && cd_open(bs) >= 0) {
-+                reopened = 1;
-+                goto again;
-+            }
-+        }
-+#endif
-     } else
- #endif
- #ifdef __sun__
-@@ -958,6 +987,14 @@
-         bs->sg = 1;
-     }
- #endif
-+#if defined(__FreeBSD__)
-+    if (strstart(filename, "/dev/cd", NULL) ||
-+        strstart(filename, "/dev/acd", NULL)) {
-+        s->type = FTYPE_CD;
-+        s->cd_open_flags = open_flags;
-+    }
-+#endif
-+    s->fd = -1;
-     fd = open(filename, open_flags, 0644);
-     if (fd < 0) {
-         ret = -errno;
-@@ -966,6 +1003,11 @@
-         return ret;
-     }
-     s->fd = fd;
-+#if defined(__FreeBSD__)
-+    /* make sure the door isnt locked at this time */
-+    if (s->type == FTYPE_CD)
-+        ioctl (s->fd, CDIOCALLOW);
-+#endif
- #if defined(__linux__)
-     /* close fd so that we can reopen it as needed */
-     if (s->type == FTYPE_FD) {
-@@ -1132,7 +1174,116 @@
- 
-     return ioctl(s->fd, req, buf);
- }
--#else
-+#elif defined(__FreeBSD__)
-+
-+static int fd_open(BlockDriverState *bs)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    /* this is just to ensure s->fd is sane (its called by io ops) */
-+    if (s->fd >= 0)
-+        return 0;
-+    return -EIO;
-+}
-+
-+static int cd_open(BlockDriverState *bs)
-+{
-+#if defined(__FreeBSD__)
-+    BDRVRawState *s = bs->opaque;
-+    int fd;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        /* XXX force reread of possibly changed/newly loaded disc,
-+         * FreeBSD seems to not notice sometimes... */
-+        if (s->fd >= 0)
-+            close (s->fd);
-+        fd = open(bs->filename, s->cd_open_flags, 0644);
-+        if (fd < 0) {
-+            s->fd = -1;
-+            return -EIO;
-+        }
-+        s->fd = fd;
-+        /* make sure the door isnt locked at this time */
-+        ioctl (s->fd, CDIOCALLOW);
-+    }
-+#endif
-+    return 0;
-+}
-+
-+static int raw_is_inserted(BlockDriverState *bs)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        return (raw_getlength(bs) > 0);
-+    case FTYPE_FD:
-+        /* XXX handle this */
-+        /* FALLTHRU */
-+    default:
-+        return 1;
-+    }
-+}
-+
-+static int raw_media_changed(BlockDriverState *bs)
-+{
-+    return -ENOTSUP;
-+}
-+
-+static int raw_eject(BlockDriverState *bs, int eject_flag)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        if (s->fd < 0)
-+            return -ENOTSUP;
-+        (void) ioctl (s->fd, CDIOCALLOW);
-+        if (eject_flag) {
-+            if (ioctl (s->fd, CDIOCEJECT) < 0)
-+                perror("CDIOCEJECT");
-+        } else {
-+            if (ioctl (s->fd, CDIOCCLOSE) < 0)
-+                perror("CDIOCCLOSE");
-+        }
-+        if (cd_open(bs) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case FTYPE_FD:
-+        /* XXX handle this */
-+        /* FALLTHRU */
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+static int raw_set_locked(BlockDriverState *bs, int locked)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        if (s->fd < 0)
-+            return -ENOTSUP;
-+        if (ioctl (s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
-+            /* Note: an error can happen if the distribution automatically
-+               mounts the CD-ROM */
-+            //        perror("CDROM_LOCKDOOR");
-+        }
-+        break;
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
-+{
-+    return -ENOTSUP;
-+}
-+#else /* !linux && !FreeBSD */
- 
- static int fd_open(BlockDriverState *bs)
- {
-@@ -1163,7 +1314,7 @@
- {
-     return -ENOTSUP;
- }
--#endif /* !linux */
-+#endif /* !linux && !FreeBSD */
- 
- BlockDriver bdrv_host_device = {
-     "host_device",
-Index: qemu/hw/scsi-disk.c
-@@ -417,16 +417,26 @@
-     switch (command) {
-     case 0x0:
- 	DPRINTF("Test Unit Ready\n");
-+        if (!bdrv_is_inserted(s->bdrv))
-+            goto notready;
- 	break;
-     case 0x03:
-         DPRINTF("Request Sense (len %d)\n", len);
-         if (len < 4)
-             goto fail;
-         memset(outbuf, 0, 4);
-+        r->buf_len = 4;
-+        if (s->sense == SENSE_NOT_READY && len >= 18) {
-+            memset(outbuf, 0, 18);
-+            r->buf_len = 18;
-+            outbuf[7] = 10;
-+            /* asc 0x3a, ascq 0: Medium not present */
-+            outbuf[12] = 0x3a;
-+            outbuf[13] = 0;
-+        }
-         outbuf[0] = 0xf0;
-         outbuf[1] = 0;
-         outbuf[2] = s->sense;
--        r->buf_len = 4;
-         break;
-     case 0x12:
-         DPRINTF("Inquiry (len %d)\n", len);
-@@ -725,6 +735,10 @@
-         break;
-     case 0x1b:
-         DPRINTF("Start Stop Unit\n");
-+        if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM &&
-+            (buf[4] & 2))
-+            /* load/eject medium */
-+            bdrv_eject(s->bdrv, !(buf[4] & 1));
- 	break;
-     case 0x1e:
-         DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);
-@@ -754,6 +768,7 @@
-             outbuf[7] = 0;
-             r->buf_len = 8;
-         } else {
-+        notready:
-             scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
-             return 0;
-         }
-@@ -790,6 +805,7 @@
-             start_track = buf[6];
-             bdrv_get_geometry(s->bdrv, &nb_sectors);
-             DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
-+            nb_sectors /= s->cluster_size;
-             switch(format) {
-             case 0:
-                 toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);
diff --git a/emulators/qemu/pkg-message b/emulators/qemu/pkg-message
index ac90a8758934..5a1393ea7b77 100644
--- a/emulators/qemu/pkg-message
+++ b/emulators/qemu/pkg-message
@@ -15,34 +15,41 @@ for example time sleep 1 takes 49 seconds and booting sleeps for
 minutes at the acd0 probe with a FreeSBIE 1.0 guest, thats because
 its kernel is built with HZ=5000, and FreeBSD's default is 100...
 (no longer a problem with FreeSBIE 1.1.)  The linux 2.6 kernel uses
-1000 by default btw (changed to 250 recently).  Enabling /dev/rtc doesn't
-seem to help either (not included since it needs a patch to emulators/rtc.)
-- using physical media doesn't work on 4.x hosts (missing DIOCGMEDIASIZE
-ioctl.)
+1000 by default btw. (changed to 250 later, and recent linux kernels now
+no longer have a fixed HZ, aka `tickless kernel'...)  Enabling /dev/rtc
+doesn't seem to help either (not included since it needs a patch to
+emulators/rtc.)
+- update: the above problem has gotten worse with FreeBSD guests
+somewhere before 8.0, mainly since the kernel now usually wants
+double or even quadruple number of timer irqs compared to HZ if it
+detects an apic (and at least early versions of FreeBSD 8 had a bug that
+essentially halved qemu's clock rate too); the only reason you usually
+don't see symptoms of this with FreeBSD 8 guests is they automatically
+reduce their HZ to 100 when running in a VM while the default for the
+host kernel is still HZ=1000.  workarounds:  for i386 guests you can
+disable the apic in the guest by setting
+	hint.apic.0.disabled=1
+in loader.conf(5) (or manually at the loader prompt), otherwise the
+only thing you can do is either reduce the guest's HZ to, say, 100
+by setting e.g.
+	kern.hz="100"
+from the loader as above (which usually is a good idea in a VM anyway
+and FreeBSD 8 now does by itself as mentioned), or if that's not
+possible increase the host's HZ to 2000 or even 4000 from the loader
+in the same way.
 - the -smb option (smb-export local dir to guest) needs the net/samba3
 port/package installed in addition to qemu.
-- RELENG_6 and up guests often crash while accessing the emulated cdrom
-(see kern/84102, http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/84102),
-using a kernel without PREEMPTION has been reported to fix this problem.
-(or do an ftp install instead of installing from the emulated cdrom, and
-then make a new kernel.)  [fixed since 6.0-R.]
-- 6.0-RC1 was released with an ed driver that doesn't like qemu's emulated
-RTL8029 nic, this has been fixed in the meantime but if for some reason
-you need to use that version as a guest you can temporarily add the patch
-in this message: http://docs.freebsd.org/cgi/mid.cgi?200510131428.21211.jkim
-(not included in the port since the used VIA VT86C926 PCI ID does not
-really match the emulated nic exactly, it just `happens' to work with
-6.0-RC1's driver.)
 - if you want to use usb devices connected to the host in the guest
-(usb_add host:... monitor command; this doesn't work on -current atm
-because of the new usb stack - help updating the usb-bsd.c code is
-more than welcome here!) you need to make sure the host isn't claiming
-them, e.g. for umass devices (like memory sticks or external harddrives)
-make sure umass isn't in the kernel (you can then still load it as a kld
-when needed), also unless you are running qemu as root you then need to
-fix permissions for /dev/ugen* device nodes: if you are on 5.x or later
-(devfs) put a rule in /etc/devfs.rules, activate it in /etc/rc.conf
-and run /etc/rc.d/devfs restart.  example devfs.rules:
+(usb_add host:... monitor command; this doesn't work on FreeBSD 8 and
+-current atm because of the new usb stack - help updating the usb-bsd.c
+code is more than welcome here!) you need to make sure the host isn't
+claiming them, e.g. for umass devices (like memory sticks or external
+harddrives) make sure umass isn't in the kernel (you can then still
+load it as a kld when needed), also unless you are running qemu as
+root you then need to fix permissions for /dev/ugen* device nodes:
+if you are on 5.x or later (devfs) put a rule in /etc/devfs.rules,
+activate it in /etc/rc.conf and run /etc/rc.d/devfs restart.
+example devfs.rules:
 	[ugen_ruleset=20]
 	add path 'ugen*' mode 660 group operator
 corresponding rc.conf line:
@@ -102,7 +109,7 @@ box needs to be run with -n in order to accept requests from ports >= 1024.
 - unfortunately there can still be guests that don't run correctly with
 kqemu and -kernel-kqemu especially on amd64 - not much you can do about that
 other than help debugging (k)qemu... (well or falling back to unaccellerated
-qemu/leaving out -kernel-kqemu if its that what's causing the problems.
+qemu/using only -enable-kqemu if its that what's causing the problems.
 note however that kqemu now can also be used with the 32 bit qemu even
 on amd64 hosts as of the 20080620 update.)
 - the new (optional) pcap code cannot talk to the host on 6.x because
@@ -113,8 +120,6 @@ kernel parameter with linux), or if that doesn't work force qemu onto
 a single cpu by doing e.g. `cpuset -l 0 qemu ..' (see the cpuset(1) manpage
 for details; cpuset isn't avalable before 7.1.  This can only be a problem
 on smp hosts.)
-- the new sparc64-bsd-user target (qemu-sparc64) is entirely untested and
-probably only works on amd64 hosts, if at all.
 - (not FreeBSD-specific:) there have been reports of qcow2 corruption with
 (at least) win2k guests on recent kvm (which uses similar qcow2 code than
 qemu now, see this thread:
@@ -124,20 +129,23 @@ been experimental and you should use raw images if you want reliability;
 raw is also usually faster.)  You should be able to migrate existing images
 to raw using qemu-img(1)'s convert function; raw doesn't support advanced
 features like snapshots tho.
-[an important qcow2 bugfix has been committed in the meantime so this
-_might_ be less of an issue now.]
+[a few important qcow2 bugfixed have been committed in the meantime so
+this _might_ be less of an issue now.]
 - (also not FreeBSD-specific:)  It is recommended to pass raw images using
 the new -drive syntax, specifying format=raw explicitly in order to avoid
 malicious guests being able to exploit the format autodetection thats
 otherwise getting used.  (Not that you should run malicious guests anyway,
 but this eleminates at least a known attack vector.)
-- The patch currently applied by the PHYS_CDROM knob improves physical
-cdrom support, but still has at least one known problem: you need to have
-the guest eject the disc if you want to change it/take it out, or otherwise
-the guest may continue using state (like size) of the old disc.  (You can
-also do like `change ide1-cd0 /dev/acd0' in the monitor after taking out
-the disc if a guest cannot eject it itself.)
+- qemu now has improved physical cdrom support, but still there still
+is at least one known problem: you need to have the guest eject the disc
+if you want to change it/take it out, or otherwise the guest may continue
+using state (like size) of the old disc.  (You can also do like
+`change ide1-cd0 /dev/acd0' in the monitor after taking out the disc
+if a guest cannot eject it itself.)
 - The default configuration location (qemu-ifup script etc.) has been
 changed from /etc to PREFIX/etc (usually /usr/local/etc).  Move your
 files accordingly.
+- kqemu still works in the 0.11 branch, but is disabled by default now
+so you'll have to pass -enable-kqemu (or -kernel-kqemu as with the
+previous versions) if you want to use it.
 ====
diff --git a/emulators/qemu/pkg-plist b/emulators/qemu/pkg-plist
index 40aeea74b660..f6e1d8e229f7 100644
--- a/emulators/qemu/pkg-plist
+++ b/emulators/qemu/pkg-plist
@@ -1,9 +1,9 @@
 bin/qemu
 bin/qemu-img
-%%ALLTARGETS%%bin/qemu-sparc64
 %%ALLTARGETS%%bin/qemu-system-arm
 %%ALLTARGETS%%bin/qemu-system-cris
 %%ALLTARGETS%%bin/qemu-system-m68k
+%%ALLTARGETS%%bin/qemu-system-microblaze
 %%ALLTARGETS%%bin/qemu-system-mips
 %%ALLTARGETS%%bin/qemu-system-mips64
 %%ALLTARGETS%%bin/qemu-system-mips64el
@@ -14,6 +14,7 @@ bin/qemu-img
 %%ALLTARGETS%%bin/qemu-system-sh4
 %%ALLTARGETS%%bin/qemu-system-sh4eb
 %%ALLTARGETS%%bin/qemu-system-sparc
+%%ALLTARGETS%%bin/qemu-system-sparc64
 bin/qemu-system-x86_64
 @unexec if cmp -s %D/etc/qemu-ifup.sample %D/etc/qemu-ifup; then rm -f %D/etc/qemu-ifup; fi
 etc/qemu-ifup.sample
@@ -36,6 +37,8 @@ etc/qemu-ifdown.sample
 %%DATADIR%%/pxe-ne2k_pci.bin
 %%DATADIR%%/pxe-rtl8139.bin
 %%DATADIR%%/pxe-pcnet.bin
+%%DATADIR%%/multiboot.bin
+%%DATADIR%%/petalogix-s3adsp1800.dtb
 %%DATADIR%%/bamboo.dtb
 %%DATADIR%%/keymaps/ar
 %%DATADIR%%/keymaps/common