Finally bring qemu 0.12.1 into ports as the new emulators/qemu-devel,

release announcement is here:
	http://lists.gnu.org/archive/html/qemu-devel/2009-12/msg02151.html

Quoting from pkg-message:

- kqemu is no longer supported in qemu upstream after the 0.11 branch
was created, which means also not in this version.  (Linux has moved
on to kvm now for qemu(-like) virtualization needs, so if you want qemu
to go faster and don't want to switch to virtualbox or stick to the older
emulators/qemu port which is at 0.11.1 atm and as such still supports
kqemu you should help getting the FreeBSD kvm port updated and
completed:
	http://wiki.freebsd.org/FabioChecconi/PortingLinuxKVMToFreeBSD
)

42 files changed, 1049 insertions, 2042 deletions

diff --git a/emulators/qemu-devel/Makefile b/emulators/qemu-devel/Makefile
index ee9aae3d0069..ab2a64487b40 100644
--- a/emulators/qemu-devel/Makefile
+++ b/emulators/qemu-devel/Makefile
@@ -6,53 +6,45 @@
 #
 
 PORTNAME=	qemu
-PORTVERSION=	0.9.1s.20080620
-PORTREVISION=	5
+PORTVERSION=	0.12.1
 CATEGORIES=	emulators
-MASTER_SITES=	http://bellard.org/qemu/:release \
-		http://qemu-forum.ipi.fi/qemu-snapshots/:snapshot \
-		${MASTER_SITE_LOCAL}:snapshot
-MASTER_SITE_SUBDIR=	nox/:snapshot
+MASTER_SITES=	${MASTER_SITE_SAVANNAH}:release \
+		${MASTER_SITE_LOCAL}:snapshot \
+		http://people.freebsd.org/~nox/qemu/:snapshot
+MASTER_SITE_SUBDIR=	qemu/:release nox/:snapshot
 PKGNAMESUFFIX=	-devel
-DISTNAME=	${PORTNAME}-snapshot-2008-06-20_19
-DISTFILES=	${DISTNAME}${EXTRACT_SUFX}:snapshot
+DISTFILES=	${DISTNAME}${EXTRACT_SUFX}:release
 DIST_SUBDIR=	qemu
-EXTRACT_ONLY=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER=	nox@FreeBSD.org
 COMMENT=	QEMU CPU Emulator - development snapshot
 
 HAS_CONFIGURE=	yes
-USE_BZIP2=	yes
 USE_GMAKE=	yes
 USE_PERL5=	yes
-PATCH_STRIP=	-lp1
+PATCH_STRIP=	-p1
 MAKE_ENV+=	BSD_MAKE="${MAKE}" LDFLAGS="${LDFLAGS}"
 MAN1=		qemu.1 qemu-img.1
 ONLY_FOR_ARCHS=	amd64 i386
 CONFLICTS=	qemu-[0-9]*
 MAKE_JOBS_SAFE=	yes
 
-# comment this if you really want to build this version:
-IGNORE=		is currently an older snapshot than emulators/qemu
-
-OPTIONS=	KQEMU "Build with (alpha!) accelerator module" Off \
-		RTL8139_TIMER "allow use of re(4) nic with FreeBSD guests" Off \
+OPTIONS=	RTL8139_TIMER "allow use of re(4) nic with FreeBSD guests" Off \
 		SAMBA "samba dependency (for -smb)" Off \
 		SDL "SDL/X dependency (graphical output)" On \
 		GNUTLS "gnutls dependency (vnc encryption)" On \
 		PCAP "pcap dependency (networking with bpf)" On \
 		CDROM_DMA "IDE CDROM DMA" On \
-		ALL_TARGETS "Also build dyngen targets (requires gcc34)" On
+		ADD_AUDIO "Emulate more audio hardware (experimental!)" Off \
+		ALL_TARGETS "Also build non-x86 and user targets" On
 
 .include <bsd.port.pre.mk>
 
 .if defined(WITHOUT_ALL_TARGETS)
-CONFIGURE_ARGS+=	--disable-gcc-check --target-list=i386-softmmu,sparc-softmmu,x86_64-softmmu,mips-softmmu,mipsel-softmmu,mips64-softmmu,mips64el-softmmu,arm-softmmu,m68k-softmmu,cris-softmmu
-PLIST_SUB+=    DYNGEN="@comment "
+CONFIGURE_ARGS+=       --target-list=i386-softmmu,x86_64-softmmu
+PLIST_SUB+=    ALLTARGETS="@comment "
 .else
-USE_GCC=	3.4
-PLIST_SUB+=    DYNGEN=""
+PLIST_SUB+=    ALLTARGETS=""
 .endif
 
 WITHOUT_CPU_CFLAGS=yes	#to avoid problems with register allocation
@@ -60,7 +52,7 @@ CFLAGS:=	${CFLAGS:C/-fno-tree-vrp//}
 CONFIGURE_ARGS+=	--prefix=${PREFIX} --cc=${CC}
 
 .if defined(WITHOUT_SDL)
-CONFIGURE_ARGS+=	--disable-sdl --disable-gfx-check
+CONFIGURE_ARGS+=	--disable-sdl
 .else
 USE_SDL=	sdl
 .endif
@@ -75,18 +67,17 @@ LIB_DEPENDS+=	gnutls:${PORTSDIR}/security/gnutls
 CONFIGURE_ARGS+=	--enable-pcap
 .endif
 
-.if defined(WITH_SAMBA)
-RUN_DEPENDS+=	${LOCALBASE}/sbin/smbd:${PORTSDIR}/net/samba3
+.if defined(WITH_ADD_AUDIO)
+CONFIGURE_ARGS+=	--audio-card-list=ac97,es1370,sb16,cs4231a,adlib,gus
 .endif
 
-.if defined(WITH_KQEMU)
-BUILD_DEPENDS+=	kqemu-kmod-devel>=1.4.0pre1:${PORTSDIR}/emulators/kqemu-kmod-devel
-.else
-CONFIGURE_ARGS+=	--disable-kqemu
+.if defined(WITH_SAMBA)
+RUN_DEPENDS+=	${LOCALBASE}/sbin/smbd:${PORTSDIR}/net/samba3
 .endif
 
 .if defined(NOPORTDOCS)
 MAKE_ARGS+=	NOPORTDOCS=${NOPORTDOCS}
+CONFIGURE_ARGS+=	--disable-docs
 .else
 BUILD_DEPENDS+=	texi2html:${PORTSDIR}/textproc/texi2html
 .endif
@@ -95,11 +86,6 @@ BUILD_DEPENDS+=	texi2html:${PORTSDIR}/textproc/texi2html
 MAKE_ARGS+=	ARCH=x86_64
 .endif
 
-post-extract:
-	@${MKDIR} ${WRKSRC}/kqemu
-	@${TOUCH} ${WRKSRC}/kqemu/Makefile
-	@${ECHO} all: > ${WRKSRC}/kqemu/Makefile.freebsd
-
 pre-patch:
 	@for A in ${ONLY_FOR_ARCHS}; do \
 		${MKDIR} ${WRKSRC}/bsd/$$A; \
diff --git a/emulators/qemu-devel/distinfo b/emulators/qemu-devel/distinfo
index 1fa68f279f9a..d95afb4e2f1d 100644
--- a/emulators/qemu-devel/distinfo
+++ b/emulators/qemu-devel/distinfo
@@ -1,3 +1,3 @@
-MD5 (qemu/qemu-snapshot-2008-06-20_19.tar.bz2) = 7201553586b59e400664b2f9ae0b17a1
-SHA256 (qemu/qemu-snapshot-2008-06-20_19.tar.bz2) = e9a3654976b923c471f572961f244f2758d15a367cfc1b32054aa2cd4391cace
-SIZE (qemu/qemu-snapshot-2008-06-20_19.tar.bz2) = 2629290
+MD5 (qemu/qemu-0.12.1.tar.gz) = df9a979ac72251036b7d0794895233a5
+SHA256 (qemu/qemu-0.12.1.tar.gz) = ee1682d3a4b84615d03941f0895a445d5f22e7583baae0a33b0439018dc0d995
+SIZE (qemu/qemu-0.12.1.tar.gz) = 4684195
diff --git a/emulators/qemu-devel/files/cdrom-dma-patch b/emulators/qemu-devel/files/cdrom-dma-patch
index 7b6bed2e6adc..4eea657e3bae 100644
--- a/emulators/qemu-devel/files/cdrom-dma-patch
+++ b/emulators/qemu-devel/files/cdrom-dma-patch
@@ -1,4 +1,4 @@
-Index: hw/ide.c
+Index: hw/ide/internal.h
 @@ -27,7 +27,7 @@
  //#define DEBUG_IDE
  //#define DEBUG_IDE_ATAPI
diff --git a/emulators/qemu-devel/files/patch-90_security b/emulators/qemu-devel/files/patch-90_security
index 40a5b54c66db..4df76e9b5e39 100644
--- a/emulators/qemu-devel/files/patch-90_security
+++ b/emulators/qemu-devel/files/patch-90_security
@@ -80,100 +80,6 @@ Index: qemu-0.8.2/hw/sb16.c
      }
  
      return dma_pos;
-Index: qemu-0.8.2/slirp/slirp.c
-===================================================================
---- qemu-0.8.2.orig/slirp/slirp.c	2006-07-22 20:23:34.000000000 +0300
-+++ qemu-0.8.2/slirp/slirp.c	2007-04-20 06:05:59.000000000 +0300
-@@ -611,6 +611,10 @@ void slirp_input(const uint8_t *pkt, int
-         if (!m)
-             return;
-         /* Note: we add to align the IP header */
-+        /* taviso: large values in ne2k TCNT register may exceed msize on transmit */
-+        if (M_FREEROOM(m) < pkt_len + 2) {
-+            m_inc(m, pkt_len + 2);
-+        }
-         m->m_len = pkt_len + 2;
-         memcpy(m->m_data + 2, pkt, pkt_len);
- 
-Index: qemu-0.8.2/target-i386/translate.c
-===================================================================
---- qemu-0.8.2.orig/target-i386/translate.c	2006-07-22 20:23:34.000000000 +0300
-+++ qemu-0.8.2/target-i386/translate.c	2007-04-20 06:05:59.000000000 +0300
-@@ -5292,6 +5297,7 @@ static target_ulong disas_insn(DisasCont
-         gen_jmp_im(pc_start - s->cs_base);
-         gen_op_into(s->pc - pc_start);
-         break;
-+#ifdef WANT_ICEBP
-     case 0xf1: /* icebp (undocumented, exits to external debugger) */
- #if 1
-         gen_debug(s, pc_start - s->cs_base);
-@@ -5301,6 +5307,7 @@ static target_ulong disas_insn(DisasCont
-         cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
- #endif
-         break;
-+#endif /* icebp */
-     case 0xfa: /* cli */
-         if (!s->vm86) {
-             if (s->cpl <= s->iopl) {
-Index: qemu-0.8.2/vl.c
-===================================================================
---- qemu-0.8.2.orig/vl.c	2007-04-20 06:05:59.000000000 +0300
-+++ qemu-0.8.2/vl.c	2007-04-20 06:05:59.000000000 +0300
-@@ -3139,8 +3139,8 @@ typedef struct NetSocketState {
-     VLANClientState *vc;
-     int fd;
-     int state; /* 0 = getting length, 1 = getting data */
--    int index;
--    int packet_len;
-+    unsigned int index;
-+    unsigned int packet_len;
-     uint8_t buf[4096];
-     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
- } NetSocketState;
-@@ -3171,7 +3171,8 @@ static void net_socket_receive_dgram(voi
- static void net_socket_send(void *opaque)
- {
-     NetSocketState *s = opaque;
--    int l, size, err;
-+    int size, err;
-+    unsigned l;
-     uint8_t buf1[4096];
-     const uint8_t *buf;
- 
-@@ -3210,7 +3211,15 @@ static void net_socket_send(void *opaque
-             l = s->packet_len - s->index;
-             if (l > size)
-                 l = size;
--            memcpy(s->buf + s->index, buf, l);
-+            if (s->index + l <= sizeof(s->buf)) {
-+                memcpy(s->buf + s->index, buf, l);
-+            } else {
-+                fprintf(stderr, "serious error: oversized packet received,"
-+                    "connection terminated.\n");
-+                s->state = 0;
-+                goto eoc;
-+            }
-+
-             s->index += l;
-             buf += l;
-             size -= l;
-Index: qemu/block.c
-@@ -539,8 +539,15 @@
-         return -ENOMEDIUM;
-     if (bs->read_only)
-         return -EACCES;
-+    if (sector_num < 0)
-+	return -EACCES;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);   
-+    }
-+    {
-+	unsigned int ns = sector_num * 512;
-+	if (ns < 0)
-+	    return -EACCES;
-     }
-     if (drv->bdrv_pwrite) {
-         int ret, len;
 Index: qemu/hw/i8259.c
 @@ -302,7 +302,8 @@
              s->init4 = val & 1;
diff --git a/emulators/qemu-devel/files/patch-CVE-2008-0928 b/emulators/qemu-devel/files/patch-CVE-2008-0928
deleted file mode 100644
index a6b07289c5c5..000000000000
--- a/emulators/qemu-devel/files/patch-CVE-2008-0928
+++ /dev/null
@@ -1,260 +0,0 @@
-Index: qemu/block-qcow.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-qcow.c,v
-retrieving revision 1.15
-retrieving revision 1.16
-diff -u -p -u -p -r1.15 -r1.16
---- block-qcow.c	11 Nov 2007 02:51:16 -0000	1.15
-+++ block-qcow.c	11 Mar 2008 17:17:58 -0000	1.16
-@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b
-     int len, i, shift, ret;
-     QCowHeader header;
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
-Index: qemu/block-qcow2.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-qcow2.c,v
-retrieving revision 1.10
-retrieving revision 1.11
-diff -u -p -u -p -r1.10 -r1.11
---- block-qcow2.c	11 Nov 2007 02:51:16 -0000	1.10
-+++ block-qcow2.c	11 Mar 2008 17:17:58 -0000	1.11
-@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b
-     int len, i, shift, ret;
-     QCowHeader header;
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
-Index: qemu/block-vmdk.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-vmdk.c,v
-retrieving revision 1.19
-retrieving revision 1.20
-diff -u -p -u -p -r1.19 -r1.20
---- block-vmdk.c	14 Jan 2008 03:48:37 -0000	1.19
-+++ block-vmdk.c	11 Mar 2008 17:17:58 -0000	1.20
-@@ -378,7 +378,7 @@ static int vmdk_open(BlockDriverState *b
-         flags = BDRV_O_RDONLY;
-     fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename);
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
-Index: qemu/block.c
-@@ -24,6 +24,9 @@
- #include "qemu-common.h"
- #ifndef QEMU_IMG
- #include "console.h"
-+extern int vm_running;
-+#else
-+int vm_running = 0;
- #endif
- #include "block_int.h"
- 
-@@ -124,6 +128,75 @@
-     }
- }
- 
-+static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
-+                                  int64_t sector_num, int nb_sectors)
-+{
-+    if (!vm_running)
-+        return 0;
-+
-+    return
-+        nb_sectors < 0 ||
-+        sector_num < 0 ||
-+        nb_sectors > bs->total_sectors ||
-+        sector_num > bs->total_sectors - nb_sectors;
-+}
-+
-+static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
-+                                int64_t offset, int count)
-+{
-+    int64_t size = bs->total_sectors << SECTOR_BITS;
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    return
-+        count < 0 ||
-+        size < 0 ||
-+        count > size ||
-+        offset > size - count;
-+}
-+
-+static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
-+                                  int64_t sector_num, int nb_sectors)
-+{
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    if (sector_num < 0 ||
-+        nb_sectors < 0)
-+        return 1;
-+
-+    if (sector_num > bs->total_sectors - nb_sectors) {
-+        if (bs->autogrow)
-+            bs->total_sectors = sector_num + nb_sectors;
-+        else
-+            return 1;
-+    }
-+    return 0;
-+}
-+
-+static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
-+                                int64_t offset, int count)
-+{
-+    int64_t size = bs->total_sectors << SECTOR_BITS;
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    if (count < 0 ||
-+        offset < 0)
-+        return 1;
-+
-+    if (offset > size - count) {
-+        if (bs->autogrow)
-+            bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
-+        else
-+            return 1;
-+    }
-+    return 0;
-+}
-+
- 
- static void bdrv_register(BlockDriver *bdrv)
- {
-@@ -335,6 +389,10 @@ int bdrv_open2(BlockDriverState *bs, con
-     bs->read_only = 0;
-     bs->is_temporary = 0;
-     bs->encrypted = 0;
-+    bs->autogrow = 0;
-+
-+    if (flags & BDRV_O_AUTOGROW)
-+        bs->autogrow = 1;
- 
-     if (flags & BDRV_O_SNAPSHOT) {
-         BlockDriverState *bs1;
-@@ -379,6 +437,7 @@ int bdrv_open2(BlockDriverState *bs, con
-     }
-     bs->drv = drv;
-     bs->opaque = qemu_mallocz(drv->instance_size);
-+    bs->total_sectors = 0; /* driver will set if it does not do getlength */
-     if (bs->opaque == NULL && drv->instance_size > 0)
-         return -1;
-     /* Note: for compatibility, we open disk image files as RDWR, and
-@@ -444,6 +503,7 @@ void bdrv_close(BlockDriverState *bs)
-         bs->drv = NULL;
- 
-         /* call the change callback */
-+        bs->total_sectors = 0;
-         bs->media_changed = 1;
-         if (bs->change_cb)
-             bs->change_cb(bs->change_opaque);
-@@ -509,6 +569,8 @@ int bdrv_read(BlockDriverState *bs, int6
-     if (!drv)
-         return -ENOMEDIUM;
- 
-+    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-             memcpy(buf, bs->boot_sector_data, 512);
-         sector_num++;
-@@ -549,6 +611,8 @@ int bdrv_write(BlockDriverState *bs, int
-         return -ENOMEDIUM;
-     if (bs->read_only)
-         return -EACCES;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);
-     }
-@@ -674,6 +738,8 @@ int bdrv_pread(BlockDriverState *bs, int
-         return -ENOMEDIUM;
-     if (!drv->bdrv_pread)
-         return bdrv_pread_em(bs, offset, buf1, count1);
-+    if (bdrv_rd_badreq_bytes(bs, offset, count1))
-+        return -EDOM;
-     return drv->bdrv_pread(bs, offset, buf1, count1);
- }
- 
-@@ -689,6 +755,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
-         return -ENOMEDIUM;
-     if (!drv->bdrv_pwrite)
-         return bdrv_pwrite_em(bs, offset, buf1, count1);
-+    if (bdrv_wr_badreq_bytes(bs, offset, count1))
-+        return -EDOM;
-     return drv->bdrv_pwrite(bs, offset, buf1, count1);
- }
- 
-@@ -955,6 +1023,8 @@ int bdrv_write_compressed(BlockDriverSta
-         return -ENOMEDIUM;
-     if (!drv->bdrv_write_compressed)
-         return -ENOTSUP;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
- }
- 
-@@ -1101,6 +1171,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
- 
-     if (!drv)
-         return NULL;
-+    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-+        return NULL;
- 
-     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-@@ -1132,6 +1204,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
-         return NULL;
-     if (bs->read_only)
-         return NULL;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return NULL;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);
-     }
-Index: qemu/block.h
-===================================================================
-RCS file: /sources/qemu/qemu/block.h,v
-retrieving revision 1.6
-retrieving revision 1.7
-diff -u -p -u -p -r1.6 -r1.7
---- block.h	24 Dec 2007 16:10:43 -0000	1.6
-+++ block.h	11 Mar 2008 17:17:59 -0000	1.7
-@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo {
-                                      it (default for
-                                      bdrv_file_open()) */
- #define BDRV_O_DIRECT      0x0020
-+#define BDRV_O_AUTOGROW    0x0040 /* Allow backing file to extend when writing past end of file */
- 
- #ifndef QEMU_IMG
- void bdrv_info(void);
-Index: qemu/block_int.h
-===================================================================
-RCS file: /sources/qemu/qemu/block_int.h,v
-retrieving revision 1.16
-retrieving revision 1.17
-diff -u -p -u -p -r1.16 -r1.17
---- block_int.h	24 Dec 2007 16:10:43 -0000	1.16
-+++ block_int.h	11 Mar 2008 17:17:59 -0000	1.17
-@@ -97,6 +97,7 @@ struct BlockDriverState {
-     int locked;    /* if true, the media cannot temporarily be ejected */
-     int encrypted; /* if true, the media is encrypted */
-     int sg;        /* if true, the device is a /dev/sg* */
-+    int autogrow;  /* if true, the backing store can auto-extend to allocate new extents */
-     /* event callback when inserting/removing */
-     void (*change_cb)(void *opaque);
-     void *change_opaque;
diff --git a/emulators/qemu-devel/files/patch-CVE-2008-4539 b/emulators/qemu-devel/files/patch-CVE-2008-4539
deleted file mode 100644
index c2348bd4cf91..000000000000
--- a/emulators/qemu-devel/files/patch-CVE-2008-4539
+++ /dev/null
@@ -1,27 +0,0 @@
-Index: qemu/hw/cirrus_vga.c
-===================================================================
---- trunk/hw/cirrus_vga.c	2008-11-01 00:53:30 UTC (rev 5586)
-+++ trunk/hw/cirrus_vga.c	2008-11-01 00:53:39 UTC (rev 5587)
-@@ -785,15 +785,14 @@
- 
- static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
- {
-+    if (BLTUNSAFE(s))
-+        return 0;
-+
-     if (s->ds->dpy_copy) {
- 	cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
- 		       s->cirrus_blt_srcaddr - s->start_addr,
- 		       s->cirrus_blt_width, s->cirrus_blt_height);
-     } else {
--
--    if (BLTUNSAFE(s))
--        return 0;
--
- 	(*s->cirrus_rop) (s, s->vram_ptr +
-                 (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 			  s->vram_ptr +
-
-
-
-
diff --git a/emulators/qemu-devel/files/patch-Makefile b/emulators/qemu-devel/files/patch-Makefile
index 9cb30cef2a6a..9bae421b6e35 100644
--- a/emulators/qemu-devel/files/patch-Makefile
+++ b/emulators/qemu-devel/files/patch-Makefile
@@ -1,7 +1,7 @@
 Index: qemu/Makefile
-@@ -17,7 +17,11 @@
- LDFLAGS += -static
- endif
+@@ -19,7 +19,11 @@
+ LIBS+=-lz $(LIBS_TOOLS)
+ 
  ifdef BUILD_DOCS
 +ifdef NOPORTDOCS
 +DOCS=qemu.1 qemu-img.1 qemu-nbd.8
@@ -11,19 +11,19 @@ Index: qemu/Makefile
  else
  DOCS=
  endif
-@@ -203,13 +211,13 @@
- common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr
+@@ -213,13 +217,13 @@
+ endif
  
  install-doc: $(DOCS)
 +ifndef NOPORTDOCS
- 	mkdir -p "$(DESTDIR)$(docdir)"
- 	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DIR) "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
 +endif
- ifndef CONFIG_WIN32
- 	mkdir -p "$(DESTDIR)$(mandir)/man1"
- 	$(INSTALL) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
--	mkdir -p "$(DESTDIR)$(mandir)/man8"
--	$(INSTALL) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
+ ifdef CONFIG_POSIX
+ 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
+ 	$(INSTALL_DATA) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
+-	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
+-	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
  endif
  
  install: all $(if $(BUILD_DOCS),install-doc)
diff --git a/emulators/qemu-devel/files/patch-aa b/emulators/qemu-devel/files/patch-aa
deleted file mode 100644
index 25eaa72ab235..000000000000
--- a/emulators/qemu-devel/files/patch-aa
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -urd --exclude=CVS ../cvs/qemu/Makefile qemu-0.5.5/Makefile
---- ../cvs/qemu/Makefile	Mon May 17 21:06:42 2004
-+++ qemu-0.5.5/Makefile	Sun May 30 05:26:19 2004
-@@ -70,7 +70,7 @@
- 
- # documentation
- %.html: %.texi
--	texi2html -monolithic -number $<
-+	-texi2html -monolithic -number $<
- 
- qemu.1: qemu-doc.texi
- 	./texi2pod.pl $< qemu.pod
diff --git a/emulators/qemu-devel/files/patch-ac b/emulators/qemu-devel/files/patch-ac
deleted file mode 100644
index 99821158695d..000000000000
--- a/emulators/qemu-devel/files/patch-ac
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/configure
-@@ -540,7 +540,7 @@
- sdl_too_old=no
- 
- if test -z "$sdl" ; then
--    sdl_config="sdl-config"
-+    sdl_config="${SDL_CONFIG}"
-     sdl=no
-     sdl_static=no
- 
diff --git a/emulators/qemu-devel/files/patch-audio-4 b/emulators/qemu-devel/files/patch-audio-4
deleted file mode 100644
index bb71885a2992..000000000000
--- a/emulators/qemu-devel/files/patch-audio-4
+++ /dev/null
@@ -1,24 +0,0 @@
-Index: qemu/audio/audio_template.h
-@@ -32,6 +32,10 @@
- #define SW glue (SWVoice, In)
- #endif
- 
-+#ifndef UINT64_MAX		
-+#define UINT64_MAX		((uint64_t)(18446744073709551615ULL))
-+#endif
-+
- static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
- {
-     glue (audio_pcm_sw_free_resources_, TYPE) (sw);
-Index: qemu/audio/audio.c
-@@ -36,6 +36,10 @@
- /* #define DEBUG_LIVE */
- /* #define DEBUG_OUT */
- 
-+#ifndef INT16_MAX		
-+#define INT16_MAX		(32767)
-+#endif
-+
- static struct audio_driver *drvtab[] = {
- #ifdef CONFIG_OSS
-     &oss_audio_driver,
diff --git a/emulators/qemu-devel/files/patch-audio-ossaudio.c b/emulators/qemu-devel/files/patch-audio-ossaudio.c
new file mode 100644
index 000000000000..3b590c4808d6
--- /dev/null
+++ b/emulators/qemu-devel/files/patch-audio-ossaudio.c
@@ -0,0 +1,110 @@
+--- a/audio/ossaudio.c
++++ b/audio/ossaudio.c
+@@ -38,6 +38,10 @@
+ #define AUDIO_CAP "oss"
+ #include "audio_int.h"
+ 
++#if defined OSS_GETVERSION && defined SNDCTL_DSP_POLICY
++#define USE_DSP_POLICY
++#endif
++
+ typedef struct OSSVoiceOut {
+     HWVoiceOut hw;
+     void *pcm_buf;
+@@ -236,14 +240,39 @@ static void oss_dump_info (struct oss_pa
+ }
+ #endif
+ 
++#ifdef USE_DSP_POLICY
++static int oss_get_version (int fd, int *version, const char *typ)
++{
++    if (ioctl (fd, OSS_GETVERSION, &version)) {
++#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
++        /*
++         * Looks like atm (20100109) FreeBSD knows OSS_GETVERSION
++         * since 7.x, but currently only on the mixer device (or in
++         * the Linuxolator), and in the native version that part of
++         * the code is in fact never reached so the ioctl fails anyway.
++         * Until this is fixed, just check the errno and if its what
++         * FreeBSD's sound drivers return atm assume they are new enough.
++         */
++        if (errno == EINVAL) {
++            *version = 0x040000;
++            return 0;
++        }
++#endif
++        oss_logerr2 (errno, typ, "Failed to get OSS version\n");
++        return -1;
++    }
++    return 0;
++}
++#endif
++
+ static int oss_open (int in, struct oss_params *req,
+                      struct oss_params *obt, int *pfd)
+ {
+     int fd;
+-    int version;
+     int oflags = conf.exclusive ? O_EXCL : 0;
+     audio_buf_info abinfo;
+     int fmt, freq, nchannels;
++    int setfragment = 1;
+     const char *dspname = in ? conf.devpath_in : conf.devpath_out;
+     const char *typ = in ? "ADC" : "DAC";
+ 
+@@ -281,27 +310,30 @@ static int oss_open (int in, struct oss_
+         goto err;
+     }
+ 
+-    if (ioctl (fd, OSS_GETVERSION, &version)) {
+-        oss_logerr2 (errno, typ, "Failed to get OSS version\n");
+-        version = 0;
+-    }
++#ifdef USE_DSP_POLICY
++    if (conf.policy >= 0) {
++        int version;
+ 
+-    if (conf.debug) {
+-        dolog ("OSS version = %#x\n", version);
+-    }
++        if (!oss_get_version (fd, &version, typ)) {
++            if (conf.debug) {
++                dolog ("OSS version = %#x\n", version);
++            }
+ 
+-#ifdef SNDCTL_DSP_POLICY
+-    if (conf.policy >= 0 && version >= 0x040000) {
+-        int policy = conf.policy;
+-        if (ioctl (fd, SNDCTL_DSP_POLICY, &policy)) {
+-            oss_logerr2 (errno, typ, "Failed to set timing policy to %d\n",
+-                         conf.policy);
+-            goto err;
++            if (version >= 0x040000) {
++                int policy = conf.policy;
++                if (ioctl (fd, SNDCTL_DSP_POLICY, &policy)) {
++                    oss_logerr2 (errno, typ,
++                                 "Failed to set timing policy to %d\n",
++                                 conf.policy);
++                    goto err;
++                }
++                setfragment = 0;
++            }
+         }
+     }
+-    else
+ #endif
+-    {
++
++    if (setfragment) {
+         int mmmmssss = (req->nfrags << 16) | ctz32 (req->fragsize);
+         if (ioctl (fd, SNDCTL_DSP_SETFRAGMENT, &mmmmssss)) {
+             oss_logerr2 (errno, typ, "Failed to set buffer length (%d, %d)\n",
+@@ -857,7 +889,7 @@ static struct audio_option oss_options[]
+         .valp  = &conf.exclusive,
+         .descr = "Open device in exclusive mode (vmix wont work)"
+     },
+-#ifdef SNDCTL_DSP_POLICY
++#ifdef USE_DSP_POLICY
+     {
+         .name  = "POLICY",
+         .tag   = AUD_OPT_INT,
diff --git a/emulators/qemu-devel/files/patch-bc b/emulators/qemu-devel/files/patch-bc
deleted file mode 100644
index 7ad83440d48b..000000000000
--- a/emulators/qemu-devel/files/patch-bc
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: qemu/i386-dis.c
-@@ -2896,6 +2896,10 @@
-   OP_E (bytemode, sizeflag);
- }
- 
-+#ifndef PRIx64
-+#define PRIx64 "llx"
-+#endif
-+
- static void
- print_operand_value (buf, hex, disp)
-   char *buf;
diff --git a/emulators/qemu-devel/files/patch-be b/emulators/qemu-devel/files/patch-be
deleted file mode 100644
index a8a5ba663df3..000000000000
--- a/emulators/qemu-devel/files/patch-be
+++ /dev/null
@@ -1,19 +0,0 @@
-Index: qemu/vl.c
-@@ -541,7 +541,7 @@
- static void init_get_clock(void)
- {
-     use_rt_clock = 0;
--#if defined(__linux__)
-+#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
-     {
-         struct timespec ts;
-         if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
-@@ -553,7 +553,7 @@
- 
- static int64_t get_clock(void)
- {
--#if defined(__linux__)
-+#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
-     if (use_rt_clock) {
-         struct timespec ts;
-         clock_gettime(CLOCK_MONOTONIC, &ts);
diff --git a/emulators/qemu-devel/files/patch-bg b/emulators/qemu-devel/files/patch-bg
index 7e645929d40e..b1a37f58345f 100644
--- a/emulators/qemu-devel/files/patch-bg
+++ b/emulators/qemu-devel/files/patch-bg
@@ -1,15 +1,26 @@
-Index: qemu/Makefile.target
-@@ -179,7 +179,7 @@
+Index: qemu/Makefile
+@@ -16,6 +16,8 @@
+ 
+ VPATH=$(SRC_PATH):$(SRC_PATH)/hw
+ 
++QEMU_CFLAGS+= -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
++
+ LIBS+=-lz $(LIBS_TOOLS)
  
- #########################################################
+ ifdef BUILD_DOCS
+Index: qemu/Makefile.target
+@@ -6,6 +6,7 @@
+ TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
+ VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw
+ QEMU_CFLAGS+= -I.. -I$(TARGET_PATH) -DNEED_CPU_H
++QEMU_CFLAGS+= -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
  
--CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-+CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
- LIBS+=-lm
- ifndef CONFIG_USER_ONLY
- LIBS+=-lz
-Index: qemu/vl.c
-@@ -133,10 +133,12 @@
+ ifdef CONFIG_USER_ONLY
+ # user emulator name
+Index: qemu/net.h
+@@ -99,12 +99,14 @@
+ int slirp_is_inited(void);
+ void net_client_check(void);
  
 -#define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
 -#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
@@ -20,7 +31,19 @@ Index: qemu/vl.c
  #define SMBD_COMMAND "/usr/sfw/sbin/smbd"
  #else
  #define SMBD_COMMAND "/usr/sbin/smbd"
+ #endif
 +#endif
+ 
  #endif
+Index: qemu/net/tap.h
+@@ -29,8 +29,8 @@
+ #include "qemu-common.h"
+ #include "qemu-option.h"
+ 
+-#define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
+-#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
++#define DEFAULT_NETWORK_SCRIPT PREFIX "/etc/qemu-ifup"
++#define DEFAULT_NETWORK_DOWN_SCRIPT PREFIX "/etc/qemu-ifdown"
+ 
+ int net_init_tap(QemuOpts *opts, Monitor *mon, const char *name, VLANState *vlan);
  
- //#define DEBUG_UNUSED_IOPORT
diff --git a/emulators/qemu-devel/files/patch-block.c b/emulators/qemu-devel/files/patch-block.c
deleted file mode 100644
index f607e8fe29c3..000000000000
--- a/emulators/qemu-devel/files/patch-block.c
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/block.c
-@@ -381,7 +381,7 @@
-     else
-         open_flags = flags & ~(BDRV_O_FILE | BDRV_O_SNAPSHOT);
-     ret = drv->bdrv_open(bs, filename, open_flags);
--    if (ret == -EACCES && !(flags & BDRV_O_FILE)) {
-+    if ((ret == -EACCES || ret == -EPERM) && !(flags & BDRV_O_FILE)) {
-         ret = drv->bdrv_open(bs, filename, BDRV_O_RDONLY);
-         bs->read_only = 1;
-     }
diff --git a/emulators/qemu-devel/files/patch-bsd-user-ld b/emulators/qemu-devel/files/patch-bsd-user-ld
new file mode 100644
index 000000000000..0528d68f8806
--- /dev/null
+++ b/emulators/qemu-devel/files/patch-bsd-user-ld
@@ -0,0 +1,269 @@
+--- a/x86_64.ld
++++ b/x86_64.ld
+@@ -59,8 +59,6 @@
+   .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+   .rodata1        : { *(.rodata1) }
+   .eh_frame_hdr : { *(.eh_frame_hdr) }
+-  .eh_frame       : ONLY_IF_RO { KEEP (*(.eh_frame)) }
+-  .gcc_except_table   : ONLY_IF_RO { *(.gcc_except_table) }
+   /* Adjust the address for the data segment.  We want to adjust up to
+      the same address within the page on the next page up.  */
+   . = ALIGN (0x100000) - ((0x100000 - .) & (0x100000 - 1)); . = DATA_SEGMENT_ALIGN (0x100000, 0x1000);
+@@ -86,8 +84,8 @@
+   .data1          : { *(.data1) }
+   .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+   .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+-  .eh_frame       : ONLY_IF_RW { KEEP (*(.eh_frame)) }
+-  .gcc_except_table   : ONLY_IF_RW { *(.gcc_except_table) }
++  .eh_frame       : { KEEP (*(.eh_frame)) }
++  .gcc_except_table   : { *(.gcc_except_table) }
+   .dynamic        : { *(.dynamic) }
+   .ctors          :
+   {
+--- a/i386.ld
++++ b/i386.ld
+@@ -1,57 +1,76 @@
+-/* ld script to make i386 Linux kernel
+- * Written by Martin Mares <mj@atrey.karlin.mff.cuni.cz>;
+- */
+-OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
++OUTPUT_FORMAT("elf32-i386-freebsd", "elf32-i386-freebsd",
++	      "elf32-i386-freebsd")
+ OUTPUT_ARCH(i386)
+ ENTRY(_start)
+ SECTIONS
+ {
+   /* Read-only sections, merged into text segment: */
+-  . = 0x60000000 + SIZEOF_HEADERS;
+-  .interp     : { *(.interp) 	}
+-  .hash          : { *(.hash)		}
+-  .dynsym        : { *(.dynsym)		}
+-  .dynstr        : { *(.dynstr)		}
+-  .gnu.version   : { *(.gnu.version)	}
+-  .gnu.version_d   : { *(.gnu.version_d)	}
+-  .gnu.version_r   : { *(.gnu.version_r)	}
+-  .rel.text      :
+-    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
+-  .rela.text     :
+-    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
+-  .rel.data      :
+-    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
+-  .rela.data     :
+-    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
+-  .rel.rodata    :
+-    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
+-  .rela.rodata   :
+-    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
+-  .rel.got       : { *(.rel.got)		}
+-  .rela.got      : { *(.rela.got)		}
+-  .rel.ctors     : { *(.rel.ctors)	}
+-  .rela.ctors    : { *(.rela.ctors)	}
+-  .rel.dtors     : { *(.rel.dtors)	}
+-  .rela.dtors    : { *(.rela.dtors)	}
+-  .rel.init      : { *(.rel.init)	}
+-  .rela.init     : { *(.rela.init)	}
+-  .rel.fini      : { *(.rel.fini)	}
+-  .rela.fini     : { *(.rela.fini)	}
+-  .rel.bss       : { *(.rel.bss)		}
+-  .rela.bss      : { *(.rela.bss)		}
+-  .rel.plt       : { *(.rel.plt)		}
+-  .rela.plt      : { *(.rela.plt)		}
+-  .init          : { *(.init)	} =0x47ff041f
+-  .text      :
++  PROVIDE (__executable_start = 0x60000000); . = 0x60000000 + SIZEOF_HEADERS;
++  .interp         : { *(.interp) }
++  .hash           : { *(.hash) }
++  .dynsym         : { *(.dynsym) }
++  .dynstr         : { *(.dynstr) }
++  .gnu.version    : { *(.gnu.version) }
++  .gnu.version_d  : { *(.gnu.version_d) }
++  .gnu.version_r  : { *(.gnu.version_r) }
++  .rel.dyn        :
++    {
++      *(.rel.init)
++      *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*)
++      *(.rel.fini)
++      *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*)
++      *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
++      *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*)
++      *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*)
++      *(.rel.ctors)
++      *(.rel.dtors)
++      *(.rel.got)
++      *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*)
++    }
++  .rela.dyn       :
++    {
++      *(.rela.init)
++      *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*)
++      *(.rela.fini)
++      *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*)
++      *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*)
++      *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*)
++      *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*)
++      *(.rela.ctors)
++      *(.rela.dtors)
++      *(.rela.got)
++      *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*)
++    }
++  .rel.plt        : { *(.rel.plt) }
++  .rela.plt       : { *(.rela.plt) }
++  .init           :
+   {
+-    *(.text)
++    KEEP (*(.init))
++  } =0x90909090
++  .plt            : { *(.plt) }
++  .text           :
++  {
++    *(.text .stub .text.* .gnu.linkonce.t.*)
+     /* .gnu.warning sections are handled specially by elf32.em.  */
+     *(.gnu.warning)
+-    *(.gnu.linkonce.t*)
+-  } =0x47ff041f
+-  _etext = .;
++  } =0x90909090
++  .fini           :
++  {
++    KEEP (*(.fini))
++  } =0x90909090
++  PROVIDE (__etext = .);
++  PROVIDE (_etext = .);
+   PROVIDE (etext = .);
+-  .fini      : { *(.fini)    } =0x47ff041f
++  .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
++  .rodata1        : { *(.rodata1) }
++  .eh_frame_hdr : { *(.eh_frame_hdr) }
++  /* Adjust the address for the data segment.  We want to adjust up to
++     the same address within the page on the next page up.  */
++  . = ALIGN (0x1000) - ((0x1000 - .) & (0x1000 - 1)); . = DATA_SEGMENT_ALIGN (0x1000, 0x1000);
++  /* Ensure the __preinit_array_start label is properly aligned.  We
++     could instead move the label definition inside the section, but
++     the linker would then create the section even if it turns out to
++     be empty, which isn't pretty.  */
+   . = ALIGN(32 / 8);
+   PROVIDE (__preinit_array_start = .);
+   .preinit_array     : { *(.preinit_array) }
+@@ -62,56 +81,71 @@
+   PROVIDE (__fini_array_start = .);
+   .fini_array     : { *(.fini_array) }
+   PROVIDE (__fini_array_end = .);
+-  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
+-  .rodata1   : { *(.rodata1) }
+-  .reginfo : { *(.reginfo) }
+-  /* Adjust the address for the data segment.  We want to adjust up to
+-     the same address within the page on the next page up.  */
+-  . = ALIGN(0x100000) + (. & (0x100000 - 1));
+-  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+-  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+-  .data    :
++  .data           :
+   {
+-    *(.data)
+-    *(.gnu.linkonce.d*)
+-    CONSTRUCTORS
++    *(.data .data.* .gnu.linkonce.d.*)
++    SORT(CONSTRUCTORS)
+   }
+-  .data1   : { *(.data1) }
+-  .ctors         :
++  .data1          : { *(.data1) }
++  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
++  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
++  .eh_frame       : { KEEP (*(.eh_frame)) }
++  .gcc_except_table   : { *(.gcc_except_table) }
++  .dynamic        : { *(.dynamic) }
++  .ctors          :
+   {
+-    *(.ctors)
++    /* gcc uses crtbegin.o to find the start of
++       the constructors, so we make sure it is
++       first.  Because this is a wildcard, it
++       doesn't matter if the user does not
++       actually link against crtbegin.o; the
++       linker won't look for a file to match a
++       wildcard.  The wildcard also means that it
++       doesn't matter which directory crtbegin.o
++       is in.  */
++    KEEP (*crtbegin*.o(.ctors))
++    /* We don't want to include the .ctor section from
++       from the crtend.o file until after the sorted ctors.
++       The .ctor section from the crtend file contains the
++       end of ctors marker and it must be last */
++    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .ctors))
++    KEEP (*(SORT(.ctors.*)))
++    KEEP (*(.ctors))
+   }
+-  .dtors         :
++  .dtors          :
+   {
+-    *(.dtors)
++    KEEP (*crtbegin*.o(.dtors))
++    KEEP (*(EXCLUDE_FILE (*crtend*.o ) .dtors))
++    KEEP (*(SORT(.dtors.*)))
++    KEEP (*(.dtors))
+   }
+-  .plt      : { *(.plt)	}
+-  .got           : { *(.got.plt) *(.got) }
+-  .dynamic       : { *(.dynamic) }
+-  /* We want the small data sections together, so single-instruction offsets
+-     can access them all, and initialized data all before uninitialized, so
+-     we can shorten the on-disk segment size.  */
+-  .sdata     : { *(.sdata) }
+-  _edata  =  .;
++  .jcr            : { KEEP (*(.jcr)) }
++  .got            : { *(.got.plt) *(.got) }
++  _edata = .;
+   PROVIDE (edata = .);
+   __bss_start = .;
+-  .sbss      : { *(.sbss) *(.scommon) }
+-  .bss       :
++  .bss            :
+   {
+    *(.dynbss)
+-   *(.bss)
++   *(.bss .bss.* .gnu.linkonce.b.*)
+    *(COMMON)
++   /* Align here to ensure that the .bss section occupies space up to
++      _end.  Align after .bss to ensure correct alignment even if the
++      .bss section disappears because there are no input sections.  */
++   . = ALIGN(32 / 8);
+   }
+-  _end = . ;
++  . = ALIGN(32 / 8);
++  _end = .;
+   PROVIDE (end = .);
++  . = DATA_SEGMENT_END (.);
+   /* Stabs debugging sections.  */
+-  .stab 0 : { *(.stab) }
+-  .stabstr 0 : { *(.stabstr) }
+-  .stab.excl 0 : { *(.stab.excl) }
+-  .stab.exclstr 0 : { *(.stab.exclstr) }
+-  .stab.index 0 : { *(.stab.index) }
++  .stab          0 : { *(.stab) }
++  .stabstr       0 : { *(.stabstr) }
++  .stab.excl     0 : { *(.stab.excl) }
++  .stab.exclstr  0 : { *(.stab.exclstr) }
++  .stab.index    0 : { *(.stab.index) }
+   .stab.indexstr 0 : { *(.stab.indexstr) }
+-  .comment 0 : { *(.comment) }
++  .comment       0 : { *(.comment) }
+   /* DWARF debug sections.
+      Symbols in the DWARF debugging sections are relative to the beginning
+      of the section so we begin them at 0.  */
+@@ -125,7 +159,7 @@
+   .debug_aranges  0 : { *(.debug_aranges) }
+   .debug_pubnames 0 : { *(.debug_pubnames) }
+   /* DWARF 2 */
+-  .debug_info     0 : { *(.debug_info) }
++  .debug_info     0 : { *(.debug_info .gnu.linkonce.wi.*) }
+   .debug_abbrev   0 : { *(.debug_abbrev) }
+   .debug_line     0 : { *(.debug_line) }
+   .debug_frame    0 : { *(.debug_frame) }
+@@ -137,5 +171,5 @@
+   .debug_funcnames 0 : { *(.debug_funcnames) }
+   .debug_typenames 0 : { *(.debug_typenames) }
+   .debug_varnames  0 : { *(.debug_varnames) }
+-  /* These must appear regardless of  .  */
++  /DISCARD/ : { *(.note.GNU-stack) }
+ }
diff --git a/emulators/qemu-devel/files/patch-bsdusb.patch b/emulators/qemu-devel/files/patch-bsdusb.patch
deleted file mode 100644
index 091161721518..000000000000
--- a/emulators/qemu-devel/files/patch-bsdusb.patch
+++ /dev/null
@@ -1,691 +0,0 @@
-Index: qemu/configure
-@@ -139,6 +139,7 @@
- oss="yes"
- linux="yes"
- linux_user="yes"
-+usb="linux"
- if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
-     kqemu="yes"
- fi
-@@ -148,6 +149,7 @@
- if [ "$bsd" = "yes" ] ; then
-   if [ "$darwin" != "yes" ] ; then
-     make="gmake"
-+    usb="bsd"
-   fi
- fi
- 
-@@ -786,6 +788,19 @@
- fi
- 
- echo "#define CONFIG_UNAME_RELEASE \"$uname_release\"" >> $config_h
-+
-+# USB host support
-+case "$usb" in
-+linux)
-+  echo "HOST_USB=linux" >> $conig_mak
-+;;
-+bsd)
-+  echo "HOST_USB=bsd" >> $config_mak
-+;;
-+*)
-+  echo "HOST_USB=stub" >> $config_mak
-+;;
-+esac
- 
- for target in $target_list; do
- target_dir="$target"
-Index: qemu/Makefile
-@@ -58,7 +58,7 @@
- OBJS+=ssd0303.o ssd0323.o ads7846.o stellaris_input.o
- OBJS+=scsi-disk.o cdrom.o
- OBJS+=scsi-generic.o
--OBJS+=usb.o usb-hub.o usb-linux.o usb-hid.o usb-msd.o usb-wacom.o usb-serial.o
-+OBJS+=usb.o usb-hub.o usb-$(HOST_USB).o usb-hid.o usb-msd.o usb-wacom.o usb-serial.o
- OBJS+=sd.o ssi-sd.o
- 
- ifdef CONFIG_WIN32
-Index: qemu/usb-stub.c
-@@ -0,0 +1,11 @@
-+#include "vl.h"
-+
-+void usb_host_info(void)
-+{
-+    term_printf("USB host devices not supported\n");
-+}
-+
-+USBDevice *usb_host_device_open(const char *devname)
-+{
-+    return NULL;
-+}
-Index: qemu/usb-bsd.c
-@@ -0,0 +1,601 @@
-+/*
-+ * BSD host USB redirector
-+ *
-+ * Copyright (c) 2006 Lonnie Mendez
-+ * Portions of code and concepts borrowed from
-+ * usb-linux.c and libusb's bsd.c and are copyright their respective owners.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu-common.h"
-+#include "hw/usb.h"
-+
-+/* usb.h declares these */
-+#undef USB_SPEED_HIGH
-+#undef USB_SPEED_FULL
-+#undef USB_SPEED_LOW
-+
-+#include <sys/ioctl.h>
-+#include <dev/usb/usb.h>
-+#include <signal.h>
-+
-+/* This value has maximum potential at 16.
-+ * You should also set hw.usb.debug to gain
-+ * more detailed view.
-+ */
-+//#define DEBUG
-+#define UGEN_DEBUG_LEVEL 0
-+
-+
-+typedef int USBScanFunc(void *opaque, int bus_num, int addr, int class_id,
-+                        int vendor_id, int product_id,
-+                        const char *product_name, int speed);
-+static int usb_host_find_device(int *pbus_num, int *paddr,
-+                                const char *devname);
-+
-+typedef struct USBHostDevice {
-+    USBDevice dev;
-+    int ep_fd[USB_MAX_ENDPOINTS];
-+    int devfd;
-+    char devpath[32];
-+} USBHostDevice;
-+
-+
-+static int ensure_ep_open(USBHostDevice *dev, int ep, int mode)
-+{
-+    char buf[32];
-+    int fd;
-+
-+    /* Get the address for this endpoint */
-+    ep = UE_GET_ADDR(ep);
-+
-+    if (dev->ep_fd[ep] < 0) {
-+#if __FreeBSD__
-+        snprintf(buf, sizeof(buf) - 1, "%s.%d", dev->devpath, ep);
-+#else
-+        snprintf(buf, sizeof(buf) - 1, "%s.%02d", dev->devpath, ep);
-+#endif
-+        /* Try to open it O_RDWR first for those devices which have in and out
-+         * endpoints with the same address (eg 0x02 and 0x82)
-+         */
-+        fd = open(buf, O_RDWR);
-+        if (fd < 0 && errno == ENXIO)
-+            fd = open(buf, mode);
-+        if (fd < 0) {
-+#ifdef DEBUG
-+            printf("ensure_ep_open: failed to open device endpoint %s: %s\n",
-+                   buf, strerror(errno));
-+#endif
-+        }
-+        dev->ep_fd[ep] = fd;
-+    }
-+
-+    return dev->ep_fd[ep];
-+}
-+
-+static void ensure_eps_closed(USBHostDevice *dev)
-+{
-+    int epnum = 1;
-+
-+    if (!dev)
-+        return;
-+
-+    while (epnum < USB_MAX_ENDPOINTS) {
-+        if (dev->ep_fd[epnum] >= 0) {
-+            close(dev->ep_fd[epnum]);
-+            dev->ep_fd[epnum] = -1;
-+        }
-+        epnum++;
-+    }
-+}
-+
-+static void usb_host_handle_reset(USBDevice *dev)
-+{
-+#if 0
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+#endif
-+}
-+
-+/* XXX:
-+ * -check device states against transfer requests
-+ *  and return appropriate response
-+ */
-+static int usb_host_handle_control(USBDevice *dev,
-+                                   int request,
-+                                   int value,
-+                                   int index,
-+                                   int length,
-+                                   uint8_t *data)
-+{
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+    struct usb_ctl_request req;
-+    struct usb_alt_interface aiface;
-+    int ret, timeout = 50;
-+
-+    if ((request >> 8) == UT_WRITE_DEVICE &&
-+        (request & 0xff) == UR_SET_ADDRESS) {
-+
-+        /* specific SET_ADDRESS support */
-+        dev->addr = value;
-+        return 0;
-+    } else if ((request >> 8) == UT_WRITE_DEVICE &&
-+               (request & 0xff) == UR_SET_CONFIG) {
-+
-+        ensure_eps_closed(s); /* can't do this without all eps closed */
-+
-+        ret = ioctl(s->devfd, USB_SET_CONFIG, &value);
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: failed to set configuration - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_STALL;
-+        }
-+
-+        return 0;
-+    } else if ((request >> 8) == UT_WRITE_INTERFACE &&
-+               (request & 0xff) == UR_SET_INTERFACE) {
-+
-+        aiface.uai_interface_index = index;
-+        aiface.uai_alt_no = value;
-+
-+        ensure_eps_closed(s); /* can't do this without all eps closed */
-+        ret = ioctl(s->devfd, USB_SET_ALTINTERFACE, &aiface);
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: failed to set alternate interface - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_STALL;
-+        }
-+
-+        return 0;
-+    } else {
-+        req.ucr_request.bmRequestType = request >> 8;
-+        req.ucr_request.bRequest = request & 0xff;
-+        USETW(req.ucr_request.wValue, value);
-+        USETW(req.ucr_request.wIndex, index);
-+        USETW(req.ucr_request.wLength, length);
-+        req.ucr_data = data;
-+        req.ucr_flags = USBD_SHORT_XFER_OK;
-+
-+        ret = ioctl(s->devfd, USB_SET_TIMEOUT, &timeout);
-+#if (__NetBSD__ || __OpenBSD__)
-+        if (ret < 0 && errno != EINVAL) {
-+#else
-+        if (ret < 0) {
-+#endif
-+#ifdef DEBUG
-+            printf("handle_control: setting timeout failed - %s\n",
-+                   strerror(errno));
-+#endif
-+        }
-+
-+        ret = ioctl(s->devfd, USB_DO_REQUEST, &req);
-+        /* ugen returns EIO for usbd_do_request_ no matter what
-+         * happens with the transfer */
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: error after request - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_NAK; // STALL
-+        } else {
-+            return req.ucr_actlen;
-+        }
-+    }
-+}
-+
-+static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
-+{
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+    int ret, fd, mode;
-+    int one = 1, shortpacket = 0, timeout = 50;
-+    sigset_t new_mask, old_mask;
-+    uint8_t devep = p->devep;
-+
-+    /* protect data transfers from SIGALRM signal */
-+    sigemptyset(&new_mask);
-+    sigaddset(&new_mask, SIGALRM);
-+    sigprocmask(SIG_BLOCK, &new_mask, &old_mask);
-+
-+    if (p->pid == USB_TOKEN_IN) {
-+        devep |= 0x80;
-+        mode = O_RDONLY;
-+        shortpacket = 1;
-+    } else {
-+        mode = O_WRONLY;
-+    }
-+
-+    fd = ensure_ep_open(s, devep, mode);
-+    if (fd < 0) {
-+        sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+        return USB_RET_NODEV;
-+    }
-+
-+    if (ioctl(fd, USB_SET_TIMEOUT, &timeout) < 0) {
-+#ifdef DEBUG
-+        printf("handle_data: failed to set timeout - %s\n",
-+               strerror(errno));
-+#endif
-+    }
-+
-+    if (shortpacket) {
-+        if (ioctl(fd, USB_SET_SHORT_XFER, &one) < 0) {
-+#ifdef DEBUG
-+            printf("handle_data: failed to set short xfer mode - %s\n",
-+                   strerror(errno));
-+#endif
-+            sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+        }
-+    }
-+
-+    if (p->pid == USB_TOKEN_IN)
-+        ret = read(fd, p->data, p->len);
-+    else
-+        ret = write(fd, p->data, p->len);
-+
-+    sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+
-+    if (ret < 0) {
-+#ifdef DEBUG
-+        printf("handle_data: error after %s data - %s\n",
-+               pid == USB_TOKEN_IN ? "reading" : "writing", strerror(errno));
-+#endif
-+        switch(errno) {
-+        case ETIMEDOUT:
-+        case EINTR:
-+            return USB_RET_NAK;
-+        default:
-+            return USB_RET_STALL;
-+        }
-+    } else {
-+        return ret;
-+    }
-+}
-+
-+static void usb_host_handle_destroy(USBDevice *opaque)
-+{
-+    USBHostDevice *s = (USBHostDevice *)opaque;
-+    int i;
-+
-+    for (i = 0; i < USB_MAX_ENDPOINTS; i++)
-+        if (s->ep_fd[i] >= 0)
-+            close(s->ep_fd[i]);
-+
-+    if (s->devfd < 0)
-+        return;
-+
-+    close(s->devfd);
-+
-+    qemu_free(s);
-+}
-+
-+USBDevice *usb_host_device_open(const char *devname)
-+{
-+    struct usb_device_info bus_info, dev_info;
-+    USBHostDevice *dev;
-+    char ctlpath[PATH_MAX + 1];
-+    char buspath[PATH_MAX + 1];
-+    int bfd, dfd, bus, address, i;
-+    int ugendebug = UGEN_DEBUG_LEVEL;
-+
-+    if (usb_host_find_device(&bus, &address, devname) < 0)
-+        return NULL;
-+
-+    snprintf(buspath, PATH_MAX, "/dev/usb%d", bus);
-+
-+    bfd = open(buspath, O_RDWR);
-+    if (bfd < 0) {
-+#ifdef DEBUG
-+        printf("usb_host_device_open: failed to open usb bus - %s\n",
-+               strerror(errno));
-+#endif
-+        return NULL;
-+    }
-+
-+    bus_info.udi_addr = address;
-+    if (ioctl(bfd, USB_DEVICEINFO, &bus_info) < 0) {
-+#ifdef DEBUG
-+        printf("usb_host_device_open: failed to grab bus information - %s\n",
-+               strerror(errno));
-+#endif
-+        return NULL;
-+    }
-+
-+#if __FreeBSD__
-+    snprintf(ctlpath, PATH_MAX, "/dev/%s", bus_info.udi_devnames[0]);
-+#else
-+    snprintf(ctlpath, PATH_MAX, "/dev/%s.00", bus_info.udi_devnames[0]);
-+#endif
-+
-+    dfd  = open(ctlpath, O_RDWR);
-+    if (dfd < 0) {
-+        dfd = open(ctlpath, O_RDONLY);
-+        if (dfd < 0) {
-+#ifdef DEBUG
-+            printf("usb_host_device_open: failed to open usb device %s - %s\n",
-+                   ctlpath, strerror(errno));
-+#endif
-+        }
-+    }
-+
-+    if (dfd >= 0) {
-+        dev = qemu_mallocz(sizeof(USBHostDevice));
-+        if (!dev)
-+            goto fail;
-+        dev->devfd = dfd;
-+
-+        if (ioctl(dfd, USB_GET_DEVICEINFO, &dev_info) < 0) {
-+#ifdef DEBUG
-+            printf("usb_host_device_open: failed to grab device info - %s\n",
-+                   strerror(errno));
-+#endif
-+            goto fail;
-+        }
-+
-+        if (dev_info.udi_speed == 1)
-+            dev->dev.speed = USB_SPEED_LOW - 1;
-+        else
-+            dev->dev.speed = USB_SPEED_FULL - 1;
-+
-+        dev->dev.handle_packet = usb_generic_handle_packet;
-+
-+        dev->dev.handle_reset = usb_host_handle_reset;
-+        dev->dev.handle_control = usb_host_handle_control;
-+        dev->dev.handle_data = usb_host_handle_data;
-+        dev->dev.handle_destroy = usb_host_handle_destroy;
-+
-+        if (strncmp(dev_info.udi_product, "product", 7) != 0)
-+            pstrcpy(dev->dev.devname, sizeof(dev->dev.devname),
-+                    dev_info.udi_product);
-+        else
-+            snprintf(dev->dev.devname, sizeof(dev->dev.devname),
-+                     "host:%s", devname);
-+
-+        pstrcpy(dev->devpath, sizeof(dev->devpath), "/dev/");
-+	strcat(dev->devpath, dev_info.udi_devnames[0]);
-+
-+        /* Mark the endpoints as not yet open */
-+        for (i = 0; i < USB_MAX_ENDPOINTS; i++)
-+           dev->ep_fd[i] = -1;
-+
-+        ioctl(dfd, USB_SETDEBUG, &ugendebug);
-+
-+        return (USBDevice *)dev;
-+    }
-+
-+fail:
-+    return NULL;
-+}
-+
-+static int usb_host_scan(void *opaque, USBScanFunc *func)
-+{
-+    struct usb_device_info bus_info;
-+    struct usb_device_info dev_info;
-+    uint16_t vendor_id, product_id, class_id, speed;
-+    int bfd, dfd, bus, address;
-+    char busbuf[20], devbuf[20], product_name[256];
-+    int ret = 0;
-+
-+    for (bus = 0; bus < 10; bus++) {
-+
-+        snprintf(busbuf, sizeof(busbuf) - 1, "/dev/usb%d", bus);
-+        bfd = open(busbuf, O_RDWR);
-+        if (bfd < 0)
-+	    continue;
-+
-+        for (address = 1; address < 127; address++) {
-+
-+            bus_info.udi_addr = address;
-+            if (ioctl(bfd, USB_DEVICEINFO, &bus_info) < 0)
-+                continue;
-+
-+            /* only list devices that can be used by generic layer */
-+            if (strncmp(bus_info.udi_devnames[0], "ugen", 4) != 0)
-+                continue;
-+
-+#if __FreeBSD__
-+            snprintf(devbuf, sizeof(devbuf) - 1, "/dev/%s", bus_info.udi_devnames[0]);
-+#else
-+            snprintf(devbuf, sizeof(devbuf) - 1, "/dev/%s.00", bus_info.udi_devnames[0]);
-+#endif
-+
-+            dfd = open(devbuf, O_RDONLY);
-+            if (dfd < 0) {
-+#ifdef DEBUG
-+                printf("usb_host_scan: couldn't open device %s - %s\n", devbuf,
-+                       strerror(errno));
-+#endif
-+                continue;
-+            }
-+
-+            if (ioctl(dfd, USB_GET_DEVICEINFO, &dev_info) < 0)
-+                printf("usb_host_scan: couldn't get device information for %s - %s\n",
-+                       devbuf, strerror(errno));
-+
-+            // XXX: might need to fixup endianess of word values before copying over
-+
-+            vendor_id = dev_info.udi_vendorNo;
-+            product_id = dev_info.udi_productNo;
-+            class_id = dev_info.udi_class;
-+            speed = dev_info.udi_speed;
-+
-+            if (strncmp(dev_info.udi_product, "product", 7) != 0)
-+                pstrcpy(product_name, sizeof(product_name),
-+                        dev_info.udi_product);
-+            else
-+                product_name[0] = '\0';
-+
-+            ret = func(opaque, bus, address, class_id, vendor_id,
-+                       product_id, product_name, speed);
-+
-+            close(dfd);
-+
-+            if (ret)
-+                goto the_end;
-+        }
-+
-+        close(bfd);
-+    }
-+
-+the_end:
-+    return ret;
-+}
-+
-+typedef struct FindDeviceState {
-+    int vendor_id;
-+    int product_id;
-+    int bus_num;
-+    int addr;
-+} FindDeviceState;
-+
-+static int usb_host_find_device_scan(void *opaque, int bus_num, int addr,
-+                                     int class_id,
-+                                     int vendor_id, int product_id,
-+                                     const char *product_name, int speed)
-+{
-+    FindDeviceState *s = opaque;
-+    if (vendor_id == s->vendor_id &&
-+        product_id == s->product_id) {
-+        s->bus_num = bus_num;
-+        s->addr = addr;
-+        return 1;
-+     } else {
-+        return 0;
-+     }
-+}
-+
-+
-+/* the syntax is :
-+   'bus.addr' (decimal numbers) or
-+   'vendor_id:product_id' (hexa numbers) */
-+static int usb_host_find_device(int *pbus_num, int *paddr,
-+                                const char *devname)
-+{
-+    const char *p;
-+    int ret;
-+    FindDeviceState fs;
-+
-+    p = strchr(devname, '.');
-+    if (p) {
-+        *pbus_num = strtoul(devname, NULL, 0);
-+        *paddr = strtoul(p + 1, NULL, 0);
-+        return 0;
-+    }
-+    p = strchr(devname, ':');
-+    if (p) {
-+        fs.vendor_id = strtoul(devname, NULL, 16);
-+        fs.product_id = strtoul(p + 1, NULL, 16);
-+        ret = usb_host_scan(&fs, usb_host_find_device_scan);
-+        if (ret) {
-+            *pbus_num = fs.bus_num;
-+            *paddr = fs.addr;
-+            return 0;
-+        }
-+     }
-+     return -1;
-+}
-+
-+/**********************/
-+/* USB host device info */
-+
-+struct usb_class_info {
-+    int class;
-+    const char *class_name;
-+};
-+
-+static const struct usb_class_info usb_class_info[] = {
-+    { USB_CLASS_AUDIO, "Audio"},
-+    { USB_CLASS_COMM, "Communication"},
-+    { USB_CLASS_HID, "HID"},
-+    { USB_CLASS_HUB, "Hub" },
-+    { USB_CLASS_PHYSICAL, "Physical" },
-+    { USB_CLASS_PRINTER, "Printer" },
-+    { USB_CLASS_MASS_STORAGE, "Storage" },
-+    { USB_CLASS_CDC_DATA, "Data" },
-+    { USB_CLASS_APP_SPEC, "Application Specific" },
-+    { USB_CLASS_VENDOR_SPEC, "Vendor Specific" },
-+    { USB_CLASS_STILL_IMAGE, "Still Image" },
-+    { USB_CLASS_CSCID, "Smart Card" },
-+    { USB_CLASS_CONTENT_SEC, "Content Security" },
-+    { -1, NULL }
-+};
-+
-+static const char *usb_class_str(uint8_t class)
-+{
-+    const struct usb_class_info *p;
-+    for (p = usb_class_info; p->class != -1; p++) {
-+        if (p->class == class)
-+            break;
-+    }
-+    return p->class_name;
-+}
-+
-+void usb_info_device(int bus_num, int addr, int class_id,
-+                     int vendor_id, int product_id,
-+                     const char *product_name,
-+                     int speed)
-+{
-+    const char *class_str, *speed_str;
-+
-+    switch(speed) {
-+    case USB_SPEED_LOW:
-+        speed_str = "1.5";
-+        break;
-+    case USB_SPEED_FULL:
-+        speed_str = "12";
-+        break;
-+    case USB_SPEED_HIGH:
-+        speed_str = "480";
-+        break;
-+    default:
-+        speed_str = "?";
-+        break;
-+    }
-+
-+    term_printf("  Device %d.%d, speed %s Mb/s\n",
-+                bus_num, addr, speed_str);
-+    class_str = usb_class_str(class_id);
-+    if (class_str)
-+        term_printf("    %s:", class_str);
-+    else
-+        term_printf("    Class %02x:", class_id);
-+    term_printf(" USB device %04x:%04x", vendor_id, product_id);
-+    if (product_name[0] != '\0')
-+        term_printf(", %s", product_name);
-+    term_printf("\n");
-+}
-+
-+static int usb_host_info_device(void *opaque, int bus_num, int addr,
-+                                int class_id,
-+                                int vendor_id, int product_id,
-+                                const char *product_name,
-+                                int speed)
-+{
-+    usb_info_device(bus_num, addr, class_id, vendor_id, product_id,
-+                    product_name, speed);
-+    return 0;
-+}
-+
-+void usb_host_info(void)
-+{
-+    usb_host_scan(NULL, usb_host_info_device);
-+}
-Index: qemu/usb-linux.c
-@@ -23,7 +23,6 @@
-  */
- #include "vl.h"
- 
--#if defined(__linux__)
- #include <dirent.h>
- #include <sys/ioctl.h>
- #include <linux/compiler.h>
-@@ -505,18 +504,3 @@
- {
-     usb_host_scan(NULL, usb_host_info_device);
- }
--
--#else
--
--void usb_host_info(void)
--{
--    term_printf("USB host devices not supported\n");
--}
--
--/* XXX: modify configure to compile the right host driver */
--USBDevice *usb_host_device_open(const char *devname)
--{
--    return NULL;
--}
--
--#endif
diff --git a/emulators/qemu-devel/files/patch-bt b/emulators/qemu-devel/files/patch-bt
deleted file mode 100644
index 1280458f2c16..000000000000
--- a/emulators/qemu-devel/files/patch-bt
+++ /dev/null
@@ -1,109 +0,0 @@
-Index: qemu/vl.c
-@@ -76,6 +76,11 @@
- #endif
- #endif
- #endif
-+#ifdef __FreeBSD__
-+#include <sys/param.h>
-+#include <sys/module.h>
-+#include <sys/linker.h>
-+#endif
- 
- #if defined(CONFIG_SLIRP)
- #include "libslirp.h"
-@@ -3407,6 +3410,34 @@
- 
- #endif /* CONFIG_SLIRP */
- 
-+#ifdef __FreeBSD__
-+#define LOAD_QUIETLY	1
-+#define LOAD_VERBOSLY	2
-+
-+int
-+loadmodules(int how, const char *module, ...)
-+{
-+  int loaded = 0;
-+  va_list ap;
-+
-+  va_start(ap, module);
-+#ifndef NO_MODULES
-+  while (module != NULL) {
-+    if (modfind(module) == -1) {
-+      if (kldload(module) == -1) {
-+        if (how == LOAD_VERBOSLY)
-+          fprintf(stderr, "%s: Cannot load module\n", module);
-+      } else
-+        loaded++;
-+    }
-+    module = va_arg(ap, const char *);
-+  }
-+  va_end(ap);
-+#endif
-+  return loaded;
-+}
-+#endif
-+
- #if !defined(_WIN32)
- 
- typedef struct TAPState {
-@@ -3470,11 +3501,59 @@
-     char *dev;
-     struct stat s;
- 
-+#ifdef __FreeBSD__
-+    int i, kldtried = 0, enoentcount = 0, err = 0;
-+    char dname[100];
-+#ifdef USE_DEVTAP
-+    /*
-+     * 5.x has /dev/tap, but that seems to just blindly increase its
-+     * couter on every open() for some people(??), i.e. on every qemu run.
-+     */
-+    i = -1;
-+#else
-+    i = 0;
-+#endif
-+    for (; i < 10; i++) {
-+        if (*ifname)
-+            snprintf(dname, sizeof dname, "/dev/%s", ifname);
-+        else if (i == -1)
-+            strcpy(dname, "/dev/tap");
-+        else
-+            snprintf(dname, sizeof dname, "%s%d",
-+        	     "/dev/tap", i);
-+        TFR(fd = open(dname, O_RDWR));
-+        if (fd >= 0)
-+            break;
-+        else if (errno == ENXIO || errno == ENOENT) {
-+            if (i == 0 && !kldtried++) {
-+                /*
-+                 * Attempt to load the tunnel interface KLD if it isn't loaded
-+                 * already.
-+                 */
-+                if (loadmodules(LOAD_VERBOSLY, "if_tap", NULL))
-+                    i = -1;
-+                continue;
-+            }
-+            if (errno != ENOENT || ++enoentcount > 3) {
-+                err = errno;
-+                break;
-+            }
-+        } else
-+            err = errno;
-+        if (*ifname)
-+            break;
-+    }
-+    if (fd < 0) {
-+        fprintf(stderr, "warning: could not open %s (%s): no virtual network emulation\n", dname, strerror(err));
-+        return -1;
-+    }
-+#else
-     TFR(fd = open("/dev/tap", O_RDWR));
-     if (fd < 0) {
--        fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
-+        fprintf(stderr, "warning: could not open /dev/tap (%s): no virtual network emulation\n", strerror(errno));
-         return -1;
-     }
-+#endif
- 
-     fstat(fd, &s);
-     dev = devname(s.st_rdev, S_IFCHR);
diff --git a/emulators/qemu-devel/files/patch-configure b/emulators/qemu-devel/files/patch-configure
index 782062a27890..1014b55f4776 100644
--- a/emulators/qemu-devel/files/patch-configure
+++ b/emulators/qemu-devel/files/patch-configure
@@ -1,10 +1,31 @@
 Index: qemu/configure
-@@ -689,7 +689,7 @@
- fi # test "$curses"
+@@ -1605,17 +1605,18 @@
+ fi
  
  # Check if tools are available to build documentation.
--if [ -x "`which texi2html 2>/dev/null`" ] && \
-+if [ "x$NOPORTDOCS" != "x" -o -x "`which texi2html 2>/dev/null`" ] && \
-    [ -x "`which pod2man 2>/dev/null`" ]; then
-   build_docs="yes"
- fi
+-if test "$docs" != "no" ; then
+-  if test -x "`which texi2html 2>/dev/null`" -a \
+-          -x "`which pod2man 2>/dev/null`" ; then
+-    docs=yes
+-  else
+-    if test "$docs" = "yes" ; then
+-      feature_not_found "docs"
+-    fi
+-    docs=no
+-  fi
+-fi
++#if test "$docs" != "no" ; then
++#  if test -x "`which texi2html 2>/dev/null`" -a \
++#          -x "`which pod2man 2>/dev/null`" ; then
++#    docs=yes
++#  else
++#    if test "$docs" = "yes" ; then
++#      feature_not_found "docs"
++#    fi
++#    docs=no
++#  fi
++#fi
++docs=yes
+ 
+ # Search for bswap_32 function
+ byteswap_h=no
diff --git a/emulators/qemu-devel/files/patch-cpu-exec.c b/emulators/qemu-devel/files/patch-cpu-exec.c
deleted file mode 100644
index 708a76a0eaec..000000000000
--- a/emulators/qemu-devel/files/patch-cpu-exec.c
+++ /dev/null
@@ -1,27 +0,0 @@
-Index: qemu/cpu-exec.c
-@@ -394,16 +394,18 @@
-                                      (env->eflags & IF_MASK && 
-                                       !(env->hflags & HF_INHIBIT_IRQ_MASK))))) {
-                             int intno;
--                            svm_check_intercept(SVM_EXIT_INTR);
-                             env->interrupt_request &= ~(CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
-                             intno = cpu_get_pic_interrupt(env);
--                            if (loglevel & CPU_LOG_TB_IN_ASM) {
--                                fprintf(logfile, "Servicing hardware INT=0x%02x\n", intno);
-+                            if (intno>=0) {
-+                                svm_check_intercept(SVM_EXIT_INTR);
-+                                if (loglevel & CPU_LOG_TB_IN_ASM) {
-+                                    fprintf(logfile, "Servicing hardware INT=0x%02x\n", intno);
-+                                }
-+                                do_interrupt(intno, 0, 0, 0, 1);
-+                                /* ensure that no TB jump will be modified as
-+                                   the program flow was changed */
-+                                next_tb = 0;
-                             }
--                            do_interrupt(intno, 0, 0, 0, 1);
--                            /* ensure that no TB jump will be modified as
--                               the program flow was changed */
--                            next_tb = 0;
- #if !defined(CONFIG_USER_ONLY)
-                         } else if ((interrupt_request & CPU_INTERRUPT_VIRQ) &&
-                                    (env->eflags & IF_MASK) && 
diff --git a/emulators/qemu-devel/files/patch-exec-all.h b/emulators/qemu-devel/files/patch-exec-all.h
deleted file mode 100644
index 244bfb05055a..000000000000
--- a/emulators/qemu-devel/files/patch-exec-all.h
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/exec-all.h
-@@ -30,7 +30,7 @@
- struct TranslationBlock;
- 
- /* XXX: make safe guess about sizes */
--#define MAX_OP_PER_INSTR 64
-+#define MAX_OP_PER_INSTR 128 /* 64 */
- /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
- #define MAX_OPC_PARAM 10
- #define OPC_BUF_SIZE 512
diff --git a/emulators/qemu-devel/files/patch-exec.c b/emulators/qemu-devel/files/patch-exec.c
deleted file mode 100644
index 64fc4723e24b..000000000000
--- a/emulators/qemu-devel/files/patch-exec.c
+++ /dev/null
@@ -1,30 +0,0 @@
-Index: qemu/exec.c
-@@ -405,6 +405,28 @@
-             exit(1);
-         }
-     }
-+#elif defined(__FreeBSD__)
-+    {
-+        int flags;
-+        void *addr = NULL;
-+        flags = MAP_PRIVATE | MAP_ANONYMOUS;
-+#if defined(__x86_64__)
-+        /* FreeBSD doesn't have MAP_32BIT, use MAP_FIXED and assume
-+         * 0x40000000 is free */
-+        flags |= MAP_FIXED;
-+        addr = (void *)0x40000000;
-+        /* Cannot map more than that */
-+        if (code_gen_buffer_size > (800 * 1024 * 1024))
-+            code_gen_buffer_size = (800 * 1024 * 1024);
-+#endif
-+        code_gen_buffer = mmap(addr, code_gen_buffer_size,
-+                               PROT_WRITE | PROT_READ | PROT_EXEC, 
-+                               flags, -1, 0);
-+        if (code_gen_buffer == MAP_FAILED) {
-+            fprintf(stderr, "Could not allocate dynamic translator buffer\n");
-+            exit(1);
-+        }
-+    }
- #else
-     code_gen_buffer = qemu_malloc(code_gen_buffer_size);
-     if (!code_gen_buffer) {
diff --git a/emulators/qemu-devel/files/patch-fbsd b/emulators/qemu-devel/files/patch-fbsd
index 12593966b389..3442b0c8279e 100644
--- a/emulators/qemu-devel/files/patch-fbsd
+++ b/emulators/qemu-devel/files/patch-fbsd
@@ -1,70 +1,68 @@
 Index: qemu/Makefile
-@@ -25,7 +25,10 @@
- DOCS=
- endif
+@@ -49,7 +49,10 @@
  
--all: $(TOOLS) $(DOCS) recurse-all
-+all: bsd/libmath.a $(TOOLS) $(DOCS) recurse-all
+ -include config-all-devices.mak
+ 
+-build-all: $(DOCS) $(TOOLS) recurse-all
++build-all: $(DOCS) $(TOOLS) bsd/libmath.a recurse-all
 +
 +bsd/libmath.a:
 +	( cd bsd ; unset MAKEFLAGS ; $(BSD_MAKE) CC=$(CC) )
  
- subdir-%: dyngen$(EXESUF)
- 	$(MAKE) -C $(subst subdir-,,$@) all
-@@ -40,6 +43,7 @@
+ config-host.h: config-host.h-timestamp
+ config-host.h-timestamp: config-host.mak
+@@ -237,6 +240,7 @@
  
  clean:
  # avoid old build problems by removing potentially incorrect old files
 +	( cd bsd ; $(BSD_MAKE) clean )
- 	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h 
- 	rm -f *.o *.a $(TOOLS) dyngen$(EXESUF) TAGS *.pod *~ */*~
- 	$(MAKE) -C tests clean
+ 	rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
+ 	rm -f *.o *.d *.a $(TOOLS) TAGS cscope.* *.pod *~ */*~
+ 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d
 Index: qemu/Makefile.target
-@@ -651,8 +651,8 @@
- main.o: CFLAGS+=-p
- endif
+@@ -137,7 +137,7 @@
  
--$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a
--	$(CC) $(LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS)
-+$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a ../bsd/libmath.a
-+	$(CC) $(LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) ../bsd/libmath.a
+ obj-i386-y += ioport-user.o
  
- endif # !CONFIG_USER_ONLY
+-ARLIBS=../libuser/libuser.a libqemu.a
++ARLIBS=../libuser/libuser.a libqemu.a ../bsd/libmath.a
  
-Index: qemu/fpu/softfloat-native.c
-@@ -2,11 +2,16 @@
-    context is supported */
- #include "softfloat.h"
- #include <math.h>
-+#if defined(__FreeBSD__) && __FreeBSD_version < 500000
-+#include <ieeefp.h>
-+#endif
+ endif #CONFIG_BSD_USER
+ 
+@@ -293,7 +293,7 @@
  
+ monitor.o: qemu-monitor.h
+ 
+-ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
++ARLIBS=../libqemu_common.a libqemu.a $(HWLIB) ../bsd/libmath.a
+ 
+ endif # CONFIG_SOFTMMU
+ 
+Index: qemu/fpu/softfloat-native.c
+@@ -9,7 +9,8 @@
  void set_float_rounding_mode(int val STATUS_PARAM)
  {
      STATUS(float_rounding_mode) = val;
--#if defined(_BSD) && !defined(__APPLE__) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if defined(_BSD) && !defined(__APPLE__) && !defined(__FreeBSD__) || \
-+    (defined(__FreeBSD__) && __FreeBSD_version < 500000) || \
-+    (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+-#if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__)) || \
++#if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__) && \
++     !defined(__FreeBSD__)) || \
+     (defined(CONFIG_SOLARIS) && CONFIG_SOLARIS_VERSION < 10)
      fpsetround(val);
  #elif defined(__arm__)
-     /* nothing to do */
-@@ -22,7 +25,7 @@
+@@ -26,7 +27,7 @@ void set_floatx80_rounding_precision(int
  }
  #endif
  
--#if defined(_BSD) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if (defined(_BSD) && !defined(__FreeBSD__)) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+-#if defined(CONFIG_BSD) || \
++#if (defined(CONFIG_BSD) && !defined(__FreeBSD__)) || \
+     (defined(CONFIG_SOLARIS) && CONFIG_SOLARIS_VERSION < 10)
  #define lrint(d)		((int32_t)rint(d))
  #define llrint(d)		((int64_t)rint(d))
- #define lrintf(f)		((int32_t)rint(f))
 Index: qemu/fpu/softfloat-native.h
-@@ -1,8 +1,28 @@
- /* Native implementation of soft float functions */
- #include <math.h>
+@@ -3,7 +3,28 @@
  
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
+ #if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__)) \
+     || defined(CONFIG_SOLARIS)
 +#ifdef __FreeBSD__
 +#include <osreldate.h>
 +long double fabsl(long double x);
@@ -75,9 +73,9 @@ Index: qemu/fpu/softfloat-native.h
 +long long llrintl(long double x);
 +#endif
 +
-+#if (defined(_BSD) && !defined(__APPLE__) && \
++#if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__) && \
 +     (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
-+    defined(HOST_SOLARIS)
++    defined(CONFIG_SOLARIS)
  #include <ieeefp.h>
 +#if defined(__FreeBSD__)
 +#define isgreater(x, y)		__builtin_isgreater((x), (y))
@@ -90,50 +88,41 @@ Index: qemu/fpu/softfloat-native.h
  #define fabsf(f) ((float)fabs(f))
  #else
  #include <fenv.h>
-@@ -60,7 +80,9 @@
+@@ -113,8 +134,9 @@ typedef union {
  /*----------------------------------------------------------------------------
  | Software IEC/IEEE floating-point rounding mode.
  *----------------------------------------------------------------------------*/
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
-+#if (defined(_BSD) && !defined(__APPLE__) && \
-+     (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
-+    defined(HOST_SOLARIS)
- enum {
-     float_round_nearest_even = FP_RN,
-     float_round_down         = FP_RM,
+-#if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__)) \
+-    || defined(CONFIG_SOLARIS)
++#if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__) && \
++      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
++     defined(CONFIG_SOLARIS)
+ #if defined(__OpenBSD__)
+ #define FE_RM FP_RM
+ #define FE_RP FP_RP
 Index: qemu/fpu/softfloat.h
-@@ -84,7 +84,8 @@
+@@ -90,7 +90,8 @@
  #define FLOAT128
  #else
  /* native float support */
--#if (defined(__i386__) || defined(__x86_64__)) && !defined(_BSD)
+-#if (defined(__i386__) || defined(__x86_64__)) && !defined(CONFIG_BSD)
 +#if (defined(__i386__) || defined(__x86_64__)) && \
-+    (!defined(_BSD) || defined(__FreeBSD__))
++    (!defined(CONFIG_BSD) || defined(__FreeBSD__))
  #define FLOATX80
  #endif
  #endif /* !CONFIG_SOFTFLOAT */
 Index: qemu/target-ppc/op_helper.c
-@@ -303,6 +303,13 @@
-     FT0 = sqrt(FT0);
+@@ -293,6 +293,13 @@
+     uint32_t exp = (u.ll >> 52) & 0x7FF;
+     return ((0 < exp) && (exp < 0x7FF));
  }
- 
++#else
 +#ifndef isnormal
 +#define isnormal(x)					\
 +    ((sizeof (x) == sizeof (float)) ? __isnormalf(x)	\
 +    : (sizeof (x) == sizeof (double)) ? __isnormal(x)	\
 +    : __isnormall(x))
 +#endif
-+
- void do_fres (void)
- {
-     union {
-Index: qemu/x86_64.ld
-@@ -2,7 +2,7 @@
- OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
- OUTPUT_ARCH(i386:x86-64)
- ENTRY(_start)
--SEARCH_DIR("/lib64"); SEARCH_DIR("/usr/lib64"); SEARCH_DIR("/usr/local/lib64");
-+SEARCH_DIR("/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/local/lib");
- SECTIONS
- {
-   /* Read-only sections, merged into text segment: */
+ #endif
+ 
+ uint32_t helper_compute_fprf (uint64_t arg, uint32_t set_fprf)
diff --git a/emulators/qemu-devel/files/patch-fpu-softfloat-native.c b/emulators/qemu-devel/files/patch-fpu-softfloat-native.c
deleted file mode 100644
index 7e2662eb7457..000000000000
--- a/emulators/qemu-devel/files/patch-fpu-softfloat-native.c
+++ /dev/null
@@ -1,17 +0,0 @@
-Index: qemu/fpu/softfloat-native.c
-@@ -228,7 +228,15 @@
- *----------------------------------------------------------------------------*/
- float64 float64_trunc_to_int( float64 a STATUS_PARAM )
- {
-+#if defined(__FreeBSD__) && __FreeBSD__ <= 4
-+    float64 ret;
-+    fpsetround(FP_RZ);
-+    ret = rint(a);
-+    fpsetround(STATUS(float_rounding_mode));
-+    return ret;
-+#else
-     return trunc(a);
-+#endif
- }
- 
- float64 float64_round_to_int( float64 a STATUS_PARAM )
diff --git a/emulators/qemu-devel/files/patch-hw-eepro100.c b/emulators/qemu-devel/files/patch-hw-eepro100.c
deleted file mode 100644
index 79337757bde1..000000000000
--- a/emulators/qemu-devel/files/patch-hw-eepro100.c
+++ /dev/null
@@ -1,50 +0,0 @@
-Index: qemu/hw/eepro100.c
-@@ -729,6 +729,7 @@
-                 logout
-                     ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
-                      tx_buffer_address, tx_buffer_size);
-+                assert(size + tx_buffer_size <= sizeof(buf));
-                 cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                          tx_buffer_size);
-                 size += tx_buffer_size;
-@@ -749,9 +750,13 @@
-                         logout
-                             ("TBD (extended mode): buffer address 0x%08x, size 0x%04x\n",
-                              tx_buffer_address, tx_buffer_size);
--                        cpu_physical_memory_read(tx_buffer_address, &buf[size],
--                                                 tx_buffer_size);
--                        size += tx_buffer_size;
-+                        if (size + tx_buffer_size > sizeof(buf)) {
-+                            logout("bad extended TCB with size 0x%04x\n", tx_buffer_size);
-+                        } else {
-+                            cpu_physical_memory_read(tx_buffer_address, &buf[size],
-+                                                     tx_buffer_size);
-+                            size += tx_buffer_size;
-+                        }
-                         if (tx_buffer_el & 1) {
-                             break;
-                         }
-@@ -766,14 +771,20 @@
-                     logout
-                         ("TBD (flexible mode): buffer address 0x%08x, size 0x%04x\n",
-                          tx_buffer_address, tx_buffer_size);
--                    cpu_physical_memory_read(tx_buffer_address, &buf[size],
--                                             tx_buffer_size);
--                    size += tx_buffer_size;
-+                    if (size + tx_buffer_size > sizeof(buf)) {
-+                        logout("bad flexible TCB with size 0x%04x\n", tx_buffer_size);
-+                    } else {
-+                        cpu_physical_memory_read(tx_buffer_address, &buf[size],
-+                                                 tx_buffer_size);
-+                        size += tx_buffer_size;
-+                    }
-                     if (tx_buffer_el & 1) {
-                         break;
-                     }
-                 }
-             }
-+            logout("%p sending frame, len=%d,%s\n", s, size, nic_dump(buf, size));
-+            assert(size <= sizeof(buf));
-             qemu_send_packet(s->vc, buf, size);
-             s->statistics.tx_good_frames++;
-             /* Transmit with bad status would raise an CX/TNO interrupt.
diff --git a/emulators/qemu-devel/files/patch-hw-vmware_vga.c b/emulators/qemu-devel/files/patch-hw-vmware_vga.c
index 83273bf17c9a..fb404a749946 100644
--- a/emulators/qemu-devel/files/patch-hw-vmware_vga.c
+++ b/emulators/qemu-devel/files/patch-hw-vmware_vga.c
@@ -1,12 +1,74 @@
 Index: qemu/hw/vmware_vga.c
-@@ -26,8 +26,8 @@
+@@ -28,9 +28,9 @@
  #define VERBOSE
  #define EMBED_STDVGA
  #undef DIRECT_VRAM
 -#define HW_RECT_ACCEL
 -#define HW_FILL_ACCEL
+-#define HW_MOUSE_ACCEL
 +/* #define HW_RECT_ACCEL */
 +/* #define HW_FILL_ACCEL */
- #define HW_MOUSE_ACCEL
++/* #define HW_MOUSE_ACCEL */
  
  #ifdef EMBED_STDVGA
+ # include "vga_int.h"
+@@ -76,6 +76,7 @@
+     uint32_t wblue;
+     int syncing;
+     int fb_size;
++    int empty;
+ 
+     union {
+         uint32_t *fifo;
+@@ -487,7 +488,7 @@
+ 
+ static inline int vmsvga_fifo_empty(struct vmsvga_state_s *s)
+ {
+-    if (!s->config || !s->enable)
++    if (!s->config || !s->enable || s->empty)
+         return 1;
+     return (s->cmd->next_cmd == s->cmd->stop);
+ }
+@@ -495,6 +496,10 @@
+ static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
+ {
+     uint32_t cmd = s->fifo[CMD(stop) >> 2];
++    if (s->cmd->next_cmd == s->cmd->stop) {
++        s->empty = 1;
++        return 0;
++    }
+     s->cmd->stop = cpu_to_le32(CMD(stop) + 4);
+     if (CMD(stop) >= CMD(max))
+         s->cmd->stop = s->cmd->min;
+@@ -512,6 +517,7 @@
+     int args = 0;
+     int x, y, dx, dy, width, height;
+     struct vmsvga_cursor_definition_s cursor;
++    s->empty = 0;
+     while (!vmsvga_fifo_empty(s))
+         switch (cmd = vmsvga_fifo_read(s)) {
+         case SVGA_CMD_UPDATE:
+@@ -533,6 +539,7 @@
+             vmsvga_fill_rect(s, colour, x, y, width, height);
+             break;
+ #else
++            args = 0;
+             goto badcmd;
+ #endif
+ 
+@@ -547,6 +554,7 @@
+             vmsvga_copy_rect(s, x, y, dx, dy, width, height);
+             break;
+ #else
++            args = 0;
+             goto badcmd;
+ #endif
+ 
+@@ -609,6 +617,7 @@
+             break; /* Nop */
+ 
+         default:
++            args = 0;
+         badcmd:
+             while (args --)
+                 vmsvga_fifo_read(s);
diff --git a/emulators/qemu-devel/files/patch-libmath4 b/emulators/qemu-devel/files/patch-libmath4
deleted file mode 100644
index 0c482370b8ba..000000000000
--- a/emulators/qemu-devel/files/patch-libmath4
+++ /dev/null
@@ -1,45 +0,0 @@
-Index: qemu/bsd/i386/s_ldexpl.c
-@@ -2,6 +2,30 @@
- #include <errno.h>
- #include <sysdep.h>
- 
-+/* 4.x doesnt have isfinite */
-+#ifndef isfinite
-+#define isfinite __isfinitel
-+
-+union IEEEl2bits {
-+	long double	e;
-+	struct {
-+		unsigned int	manl	:32;
-+		unsigned int	manh	:32;
-+		unsigned int	exp	:15;
-+		unsigned int	sign	:1;
-+		unsigned int	junk	:16;
-+	} bits;
-+};
-+
-+static int __isfinitel(long double x)
-+{
-+	union IEEEl2bits u;
-+
-+	u.e = x;
-+	return (u.bits.exp != 32767);
-+}
-+#endif
-+
- long double __ldexpl(long double x, int expn)
- {
-   long double res;
-Index: qemu/bsd/i386/s_round.c
-@@ -29,6 +29,11 @@
- 
- #include <math.h>
- 
-+/* 4.x doesnt have isfinite */
-+#ifndef isfinite
-+#define isfinite(x) (!isnan(x) && !isinf(x))
-+#endif
-+
- double
- round(double x)
- {
diff --git a/emulators/qemu-devel/files/patch-libmath_FreeBSD-version b/emulators/qemu-devel/files/patch-libmath_FreeBSD-version
new file mode 100644
index 000000000000..223199715c0f
--- /dev/null
+++ b/emulators/qemu-devel/files/patch-libmath_FreeBSD-version
@@ -0,0 +1,151 @@
+diff -ru qemu.orig/bsd/Makefile qemu/bsd/Makefile
+--- qemu.orig/bsd/Makefile	2009-01-19 23:30:09.124413041 -0600
++++ qemu/bsd/Makefile	2009-01-19 23:40:20.180704580 -0600
+@@ -1,23 +1,90 @@
+-SRCS=	${MACHINE_ARCH}/e_atan2l.c 	\
+-	${MACHINE_ARCH}/e_logl.S	\
+-	${MACHINE_ARCH}/e_powl.S	\
+-	${MACHINE_ARCH}/e_remainderl.S	\
+-	${MACHINE_ARCH}/e_sqrtl.c	\
+-	${MACHINE_ARCH}/s_ceill.S	\
+-	${MACHINE_ARCH}/s_cosl.S	\
+-	${MACHINE_ARCH}/s_floorl.S	\
+-	${MACHINE_ARCH}/s_isnormal.c	\
+-	${MACHINE_ARCH}/s_llrint.S	\
+-	${MACHINE_ARCH}/s_llrintf.S	\
+-	${MACHINE_ARCH}/s_llrintl.S	\
+-	${MACHINE_ARCH}/s_lrint.S	\
+-	${MACHINE_ARCH}/s_lrintf.S	\
+-	${MACHINE_ARCH}/s_lrintl.S	\
+-	${MACHINE_ARCH}/s_rintl.c	\
+-	${MACHINE_ARCH}/s_round.c	\
+-	${MACHINE_ARCH}/s_sinl.S	\
+-	${MACHINE_ARCH}/s_tanl.S	\
+-	${MACHINE_ARCH}/s_ldexpl.c
++AWK=	/usr/bin/awk
++SYSCTL=	/sbin/sysctl
++
++.if !defined(OSVERSION)
++.if exists(/usr/include/sys/param.h)
++OSVERSION!=	${AWK} '/^\#define[[:blank:]]__FreeBSD_version/ {print $$3}' < /usr/include/sys/param.h
++.elif exists(/usr/src/sys/sys/param.h)
++OSVERSION!=	${AWK} '/^\#define[[:blank::]]__FreeBSD_version/ {print $$3}' < /usr/src/sys/sys/param.h
++.else
++OSVERSION!=	${SYSCTL} -n kern.osreldate
++.endif
++.endif
++
++# Need to be implemented
++_logl=		${MACHINE_ARCH}/e_logl.S
++_powl=		${MACHINE_ARCH}/e_powl.S
++
++# Implemented in -CURRENT
++.if ${OSVERSION} < 800042
++_atan2l=	${MACHINE_ARCH}/e_atan2l.c
++.endif
++
++.if ${OSVERSION} < 800030
++_remainderl=	${MACHINE_ARCH}/e_remainderl.S
++.endif
++
++.if ${OSVERSION} < 800025
++_sqrtl=		${MACHINE_ARCH}/e_sqrtl.c
++.endif
++
++.if ${OSVERSION} < 800022
++_cosl=		${MACHINE_ARCH}/s_cosl.S
++_sinl=		${MACHINE_ARCH}/s_sinl.S
++_tanl=		${MACHINE_ARCH}/s_tanl.S
++.endif
++
++.if ${OSVERSION} < 800012
++_lrintl=	${MACHINE_ARCH}/s_lrintl.S
++_llrintl=	${MACHINE_ARCH}/s_llrintl.S
++_rintl=		${MACHINE_ARCH}/s_rintl.c
++.endif
++
++.if ${OSVERSION} < 600020
++_ldexpl=	${MACHINE_ARCH}/s_ldexpl.c
++.endif
++
++.if ${OSVERSION} < 600008
++_ceill=		${MACHINE_ARCH}/s_ceill.S
++_floorl=	${MACHINE_ARCH}/s_floorl.S
++_llrint=	${MACHINE_ARCH}/s_llrint.S
++_llrintf=	${MACHINE_ARCH}/s_llrintf.S
++_lrint=		${MACHINE_ARCH}/s_lrint.S
++_lrintf=	${MACHINE_ARCH}/s_lrintf.S
++.endif
++
++.if ${OSVERSION} < 502121
++_isnormal=	${MACHINE_ARCH}/s_isnormal.c
++.endif
++
++.if ${OSVERSION} < 502114
++_round=		${MACHINE_ARCH}/s_round.c
++.endif
++
++#.if ${OSVERSION} < 501113
++#_fabsl=		${MACHINE_ARCH}/e_fabsl.c
++#.endif
++
++SRCS=	${_atan2l} 	\
++	${_logl}	\
++	${_powl}	\
++	${_remainderl}	\
++	${_sqrtl}	\
++	${_ceill}	\
++	${_cosl}	\
++	${_floorl}	\
++	${_isnormal}	\
++	${_llrint}	\
++	${_llrintf}	\
++	${_llrintl}	\
++	${_lrint}	\
++	${_lrintf}	\
++	${_lrintl}	\
++	${_rintl}	\
++	${_round}	\
++	${_sinl}	\
++	${_tanl}	\
++	${_ldexpl}
+ 
+ OBJS=	${SRCS:R:S/$/.o/}
+ 
+Index: qemu/fpu/softfloat-native.h
+@@ -1,17 +1,29 @@
++#ifndef SOFTFLOAT_NATIVE_H
++#define SOFTFLOAT_NATIVE_H
++
+ /* Native implementation of soft float functions */
+ #include <math.h>
+ 
+ #if (defined(CONFIG_BSD) && !defined(__APPLE__) && !defined(__GLIBC__)) \
+     || defined(CONFIG_SOLARIS)
+ #ifdef __FreeBSD__
+ #include <osreldate.h>
++#if __FreeBSD_version < 501113
+ long double fabsl(long double x);
++#endif
++#if __FreeBSD_version < 800030
+ long double remainderl(long double x, long double y);
++#endif
++#if __FreeBSD_version < 800025
+ long double sqrtl(long double x);
++#endif
++#if __FreeBSD_version < 800012
+ long double rintl(long double x);
+ long lrintl(long double x);
+ long long llrintl(long double x);
+ #endif
++#endif
++#endif
+ 
+ #if (defined(CONFIG_BSD) && !defined(__APPLE__) && \
+      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
+@@ -518,3 +529,5 @@
+ }
+ 
+ #endif
++
++#endif /* SOFTFLOAT_NATIVE_H */
diff --git a/emulators/qemu-devel/files/patch-osdep.c b/emulators/qemu-devel/files/patch-osdep.c
deleted file mode 100644
index 409dadea8b5f..000000000000
--- a/emulators/qemu-devel/files/patch-osdep.c
+++ /dev/null
@@ -1,43 +0,0 @@
-Index: qemu/osdep.c
-@@ -68,7 +68,9 @@
- 
- #if defined(USE_KQEMU)
- 
-+#ifndef __FreeBSD__
- #include <sys/vfs.h>
-+#endif
- #include <sys/mman.h>
- #include <fcntl.h>
- 
-@@ -79,6 +81,7 @@
-     const char *tmpdir;
-     char phys_ram_file[1024];
-     void *ptr;
-+#ifndef __FreeBSD__
- #ifdef HOST_SOLARIS
-     struct statvfs stfs;
- #else
-@@ -138,7 +141,9 @@
-         }
-         unlink(phys_ram_file);
-     }
-+#endif
-     size = (size + 4095) & ~4095;
-+#ifndef __FreeBSD__
-     ftruncate(phys_ram_fd, phys_ram_size + size);
-     ptr = mmap(NULL,
-                size,
-@@ -148,6 +153,13 @@
-         fprintf(stderr, "Could not map physical memory\n");
-         exit(1);
-     }
-+#else
-+    ptr = malloc(size);
-+    if (ptr == NULL) {
-+        fprintf(stderr, "Could not allocate physical memory\n");
-+        exit(1);
-+    }
-+#endif
-     phys_ram_size += size;
-     return ptr;
- }
diff --git a/emulators/qemu-devel/files/patch-tapclose b/emulators/qemu-devel/files/patch-tapclose
new file mode 100644
index 000000000000..8a96e3592a05
--- /dev/null
+++ b/emulators/qemu-devel/files/patch-tapclose
@@ -0,0 +1,17 @@
+Index: qemu/net/tap.c
+@@ -254,12 +254,12 @@ static void tap_cleanup(VLANClientState 
+ 
+     qemu_purge_queued_packets(nc);
+ 
+-    if (s->down_script[0])
+-        launch_script(s->down_script, s->down_script_arg, s->fd);
+-
+     tap_read_poll(s, 0);
+     tap_write_poll(s, 0);
+     close(s->fd);
++
++    if (s->down_script[0])
++        launch_script(s->down_script, s->down_script_arg, -1);
+ }
+ 
+ /* fd support */
diff --git a/emulators/qemu-devel/files/patch-target-i386-translate.c b/emulators/qemu-devel/files/patch-target-i386-translate.c
deleted file mode 100644
index 332ce9fcd26e..000000000000
--- a/emulators/qemu-devel/files/patch-target-i386-translate.c
+++ /dev/null
@@ -1,16 +0,0 @@
-Index: qemu/target-i386/translate.c
-@@ -3330,8 +3330,12 @@
-             op1_offset = offsetof(CPUX86State,xmm_regs[reg]);
-             tcg_gen_addi_ptr(cpu_ptr0, cpu_env, op1_offset);
-             sse_op2 = sse_op_table3[(s->dflag == 2) * 2 + ((b >> 8) - 2)];
--            tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
--            tcg_gen_helper_0_2(sse_op2, cpu_ptr0, cpu_tmp2_i32);
-+            if (ot == OT_LONG) {
-+                tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T[0]);
-+                tcg_gen_helper_0_2(sse_op2, cpu_ptr0, cpu_tmp2_i32);
-+            } else {
-+                tcg_gen_helper_0_2(sse_op2, cpu_ptr0, cpu_T[0]);
-+            }
-             break;
-         case 0x02c: /* cvttps2pi */
-         case 0x12c: /* cvttpd2pi */
diff --git a/emulators/qemu-devel/files/patch-target-mips-cpu.h b/emulators/qemu-devel/files/patch-target-mips-cpu.h
deleted file mode 100644
index 52d83af15fb2..000000000000
--- a/emulators/qemu-devel/files/patch-target-mips-cpu.h
+++ /dev/null
@@ -1,15 +0,0 @@
-Index: qemu/target-mips/cpu.h
-@@ -8,6 +8,13 @@
- #include "config.h"
- #include "softfloat.h"
- 
-+#ifdef __FreeBSD__
-+#if __FreeBSD__ <= 4
-+typedef uint32_t uint_fast8_t;
-+typedef uint32_t uint_fast16_t;
-+#endif
-+#endif
-+
- typedef union fpr_t fpr_t;
- union fpr_t {
-     double d;
diff --git a/emulators/qemu-devel/files/patch-tcg-i386-tcg-target.c b/emulators/qemu-devel/files/patch-tcg-i386-tcg-target.c
deleted file mode 100644
index 73b90d3ad4e7..000000000000
--- a/emulators/qemu-devel/files/patch-tcg-i386-tcg-target.c
+++ /dev/null
@@ -1,28 +0,0 @@
-Index: qemu/tcg/i386/tcg-target.c
-@@ -360,22 +360,22 @@
-     case TCG_COND_LT:
-         tcg_out_brcond(s, TCG_COND_LT, args[1], args[3], const_args[3], args[5]);
-         tcg_out_jxx(s, JCC_JNE, label_next);
--        tcg_out_brcond(s, TCG_COND_LT, args[0], args[2], const_args[2], args[5]);
-+        tcg_out_brcond(s, TCG_COND_LTU, args[0], args[2], const_args[2], args[5]);
-         break;
-     case TCG_COND_LE:
-         tcg_out_brcond(s, TCG_COND_LT, args[1], args[3], const_args[3], args[5]);
-         tcg_out_jxx(s, JCC_JNE, label_next);
--        tcg_out_brcond(s, TCG_COND_LE, args[0], args[2], const_args[2], args[5]);
-+        tcg_out_brcond(s, TCG_COND_LEU, args[0], args[2], const_args[2], args[5]);
-         break;
-     case TCG_COND_GT:
-         tcg_out_brcond(s, TCG_COND_GT, args[1], args[3], const_args[3], args[5]);
-         tcg_out_jxx(s, JCC_JNE, label_next);
--        tcg_out_brcond(s, TCG_COND_GT, args[0], args[2], const_args[2], args[5]);
-+        tcg_out_brcond(s, TCG_COND_GTU, args[0], args[2], const_args[2], args[5]);
-         break;
-     case TCG_COND_GE:
-         tcg_out_brcond(s, TCG_COND_GT, args[1], args[3], const_args[3], args[5]);
-         tcg_out_jxx(s, JCC_JNE, label_next);
--        tcg_out_brcond(s, TCG_COND_GE, args[0], args[2], const_args[2], args[5]);
-+        tcg_out_brcond(s, TCG_COND_GEU, args[0], args[2], const_args[2], args[5]);
-         break;
-     case TCG_COND_LTU:
-         tcg_out_brcond(s, TCG_COND_LTU, args[1], args[3], const_args[3], args[5]);
diff --git a/emulators/qemu-devel/files/patch-usb-stub.c b/emulators/qemu-devel/files/patch-usb-stub.c
deleted file mode 100644
index b01b9076521f..000000000000
--- a/emulators/qemu-devel/files/patch-usb-stub.c
+++ /dev/null
@@ -1,9 +0,0 @@
-Index: qemu/usb-stub.c
-@@ -1,4 +1,6 @@
--#include "vl.h"
-+#include "qemu-common.h"
-+#include "console.h"
-+#include "hw/usb.h"
- 
- void usb_host_info(void)
- {
diff --git a/emulators/qemu-devel/files/patch-vl.c b/emulators/qemu-devel/files/patch-vl.c
index 557508452062..890da597f323 100644
--- a/emulators/qemu-devel/files/patch-vl.c
+++ b/emulators/qemu-devel/files/patch-vl.c
@@ -1,39 +1,9 @@
 Index: qemu/vl.c
-@@ -1727,6 +1728,7 @@
-     chr->chr_ioctl = pp_ioctl;
-     return chr;
- }
-+#endif /* defined(__linux__) */
- 
+@@ -57,6 +57,7 @@
+ #include <sys/stat.h>
+ #if defined(__FreeBSD__) || defined(__DragonFly__)
+ #include <libutil.h>
++#include <sys/param.h>
  #else
- CharDriverState *qemu_chr_open_pty(void)
-@@ -2334,7 +2334,7 @@
- }
+ #include <util.h>
  #endif
- 
--#if defined(__linux__) || defined(__sun__)
-+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)
- static CharDriverState *qemu_chr_open_pty(void)
- {
-     struct termios tty;
-@@ -3036,7 +3036,7 @@
-         return qemu_chr_open_pp(filename);
-     } else 
- #endif
--#if defined(__linux__) || defined(__sun__)
-+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)
-     if (strstart(filename, "/dev/", NULL)) {
-         return qemu_chr_open_tty(filename);
-     } else
-@@ -8423,6 +8423,11 @@
-     nb_nics = 0;
-     /* default mac address of the first network interface */
- 
-+#ifdef __FreeBSD__
-+    if (modfind("aio") == -1)
-+        fprintf(stderr, "warning: aio not (kld)loaded, may cause `Invalid system call' traps on disk IO\n");
-+#endif
-+
-     optind = 1;
-     for(;;) {
-         if (optind >= argc)
diff --git a/emulators/qemu-devel/files/patch-vl.c-ppbus b/emulators/qemu-devel/files/patch-vl.c-ppbus
deleted file mode 100644
index 28cf485493d2..000000000000
--- a/emulators/qemu-devel/files/patch-vl.c-ppbus
+++ /dev/null
@@ -1,92 +0,0 @@
-Index: qemu/vl.c
-@@ -78,8 +78,10 @@
- #endif
- #ifdef __FreeBSD__
- #include <sys/param.h>
- #include <sys/module.h>
- #include <sys/linker.h>
-+#include <dev/ppbus/ppi.h>
-+#include <dev/ppbus/ppbconf.h>
- #endif
- 
- #if defined(CONFIG_SLIRP)
-@@ -1728,7 +1730,64 @@
-     chr->chr_ioctl = pp_ioctl;
-     return chr;
- }
--#endif /* defined(__linux__) */
-+#if defined(__FreeBSD__)
-+static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
-+{
-+    int fd = (int)chr->opaque;
-+    uint8_t b;
-+
-+    switch(cmd) {
-+    case CHR_IOCTL_PP_READ_DATA:
-+        if (ioctl(fd, PPIGDATA, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    case CHR_IOCTL_PP_WRITE_DATA:
-+        b = *(uint8_t *)arg;
-+        if (ioctl(fd, PPISDATA, &b) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case CHR_IOCTL_PP_READ_CONTROL:
-+        if (ioctl(fd, PPIGCTRL, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    case CHR_IOCTL_PP_WRITE_CONTROL:
-+        b = *(uint8_t *)arg;
-+        if (ioctl(fd, PPISCTRL, &b) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case CHR_IOCTL_PP_READ_STATUS:
-+        if (ioctl(fd, PPIGSTATUS, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+CharDriverState *qemu_chr_open_pp(const char *filename)
-+{
-+    CharDriverState *chr;
-+    int fd;
-+
-+    fd = open(filename, O_RDWR);
-+    if (fd < 0)
-+        return NULL;
-+
-+    chr = qemu_mallocz(sizeof(CharDriverState));
-+    if (!chr) {
-+        close(fd);
-+        return NULL;
-+    }
-+    chr->opaque = (void *)fd;
-+    chr->chr_write = null_chr_write;
-+    chr->chr_ioctl = pp_ioctl;
-+    return chr;
-+}
-+#endif
- 
- #else
- CharDriverState *qemu_chr_open_pty(void)
-@@ -2562,6 +2622,13 @@
- #endif
- #if defined(__linux__)
-     if (strstart(filename, "/dev/parport", NULL)) {
-+        return qemu_chr_open_pp(filename);
-+    } else 
-+    if (strstart(filename, "/dev/", NULL)) {
-+        return qemu_chr_open_tty(filename);
-+    } else 
-+#elif defined(__FreeBSD__)
-+    if (strstart(filename, "/dev/ppi", NULL)) {
-         return qemu_chr_open_pp(filename);
-     } else 
-     if (strstart(filename, "/dev/", NULL)) {
diff --git a/emulators/qemu-devel/files/patch-vl.c-serial b/emulators/qemu-devel/files/patch-vl.c-serial
index 76c290e28abb..0918cd7a724f 100644
--- a/emulators/qemu-devel/files/patch-vl.c-serial
+++ b/emulators/qemu-devel/files/patch-vl.c-serial
@@ -1,4 +1,4 @@
-Index: qemu/vl.c
+Index: qemu/qemu-char.c
 @@ -1606,10 +1606,13 @@
      cfsetospeed(&tty, spd);
  
diff --git a/emulators/qemu-devel/files/patch-z-bandaid-usb-current b/emulators/qemu-devel/files/patch-z-bandaid-usb-current
index 347c8417ab7b..ad66da21f543 100644
--- a/emulators/qemu-devel/files/patch-z-bandaid-usb-current
+++ b/emulators/qemu-devel/files/patch-z-bandaid-usb-current
@@ -1,14 +1,14 @@
 Index: qemu/usb-bsd.c
-@@ -34,7 +34,12 @@
- #undef USB_SPEED_LOW
+@@ -35,7 +35,12 @@
  
  #include <sys/ioctl.h>
+ #ifndef __DragonFly__
 +#include <sys/param.h>
 +#if __FreeBSD_version >= 800064
 +#include <legacy/dev/usb/usb.h>
 +#else
  #include <dev/usb/usb.h>
 +#endif
- #include <signal.h>
- 
- /* This value has maximum potential at 16.
+ #else
+ #include <bus/usb/usb.h>
+ #endif
diff --git a/emulators/qemu-devel/files/pcap-patch b/emulators/qemu-devel/files/pcap-patch
index 7e740976e378..d5d8b0cb466f 100644
--- a/emulators/qemu-devel/files/pcap-patch
+++ b/emulators/qemu-devel/files/pcap-patch
@@ -1,40 +1,25 @@
---- Makefile.target.orig	2008-07-18 15:18:11.000000000 -0400
-+++ Makefile.target	2008-07-18 15:23:11.000000000 -0400
-@@ -619,6 +619,13 @@
- COCOA_LIBS+=-framework CoreAudio
- endif
- endif
-+ifdef CONFIG_PCAP
-+ifdef CONFIG_WIN32
-+LIBS+=-lwpcap
-+else
-+LIBS+=-lpcap
-+endif
-+endif
- ifdef CONFIG_SLIRP
- CPPFLAGS+=-I$(SRC_PATH)/slirp
- endif
---- configure.orig	2008-07-18 15:18:42.000000000 -0400
-+++ configure	2008-07-18 15:22:24.000000000 -0400
-@@ -88,6 +88,7 @@
- mingw32="no"
- EXESUF=""
- gdbstub="yes"
+Index: configure
+@@ -257,6 +257,9 @@ pkgversion=""
+ check_utests="no"
+ user_pie="no"
+ zero_malloc=""
 +pcap="no"
- slirp="yes"
- fmod_lib=""
- fmod_inc=""
-@@ -278,6 +279,8 @@
++pcap_create="no"
++bpf="no"
+ 
+ # OS specific
+ if check_define __linux__ ; then
+@@ -492,6 +495,8 @@ for opt do
    ;;
-   --enable-mingw32) mingw32="yes" ; cross_prefix="i386-mingw32-" ; linux_user="no"
+   --enable-vnc-sasl) vnc_sasl="yes"
    ;;
 +  --enable-pcap) pcap="yes"
 +  ;;
    --disable-slirp) slirp="no"
    ;;
-   --disable-kqemu) kqemu="no"
-@@ -712,6 +715,28 @@
- fi # -z $sdl
+   --disable-uuid) uuid="no"
+@@ -1041,6 +1046,49 @@ EOF
+ fi
  
  ##########################################
 +# pcap probe
@@ -49,142 +34,194 @@
 +  else
 +    libpcap=-lwpcap
 +  fi
-+  if ! $cc $ARCH_CFLAGS -o $TMPE $TMPC $libpcap 2> /dev/null ; then
++  if ! $cc $ARCH_CFLAGS -o $TMPE $libpcap $TMPC 2> /dev/null ; then
 +    echo
 +    echo "Error: Could not find pcap"
 +    echo "Make sure to have the pcap libs and headers installed."
 +    echo
 +    exit 1
 +  fi
++  cat > $TMPC << EOF
++#include <pcap.h>
++int main(void)
++{
++  char errbuf[PCAP_ERRBUF_SIZE];
++  return (pcap_create("foo", errbuf) == (pcap_t *)0 ? 1 : 0);
++}
++EOF
++  if $cc $ARCH_CFLAGS -o $TMPE $libpcap $TMPC 2> /dev/null ; then
++    pcap_create="yes"
++  fi
++  cat > $TMPC << EOF
++#define PCAP_DONT_INCLUDE_PCAP_BPF_H
++#include <pcap.h>
++#include <net/bpf.h>
++int main(void) { return (BPF_MAJOR_VERSION); }
++EOF
++  if $cc $ARCH_CFLAGS -o $TMPE $TMPC 2> /dev/null ; then
++    bpf="yes"
++  fi
++  libs_softmmu="$libpcap $libs_softmmu"
 +fi # test "$pcap"
 +
 +##########################################
  # VNC TLS detection
- if test "$vnc_tls" = "yes" ; then
-   `pkg-config gnutls` || vnc_tls="no"
-@@ -865,6 +890,7 @@
-     echo "    TLS CFLAGS    $vnc_tls_cflags"
-     echo "    TLS LIBS      $vnc_tls_libs"
- fi
-+echo "pcap support      $pcap"
- if test -n "$sparc_cpu"; then
-     echo "Target Sparc Arch $sparc_cpu"
- fi
-@@ -1034,6 +1060,15 @@
+ if test "$vnc_tls" != "no" ; then
+   cat > $TMPC <<EOF
+@@ -1976,6 +2024,15 @@ fi
  if test $profiler = "yes" ; then
-   echo "#define CONFIG_PROFILER 1" >> $config_h
+   echo "CONFIG_PROFILER=y" >> $config_host_mak
  fi
 +if test "$pcap" = "yes" ; then
-+  echo "CONFIG_PCAP=yes" >> $config_mak
-+  echo "#define CONFIG_PCAP 1" >> $config_h
-+  if test "$mingw32" = "no" ; then
-+    if test -c /dev/bpf0 ; then
-+      echo "#define HAVE_BPF 1" >> $config_h
-+    fi
++  echo "CONFIG_PCAP=y" >> $config_host_mak
++  if test "$pcap_create" = "yes" ; then
++    echo "CONFIG_PCAP_CREATE=y" >> $config_host_mak
++  fi
++  if test "$bpf" = "yes" ; then
++    echo "CONFIG_BPF=y" >> $config_host_mak
 +  fi
 +fi
  if test "$slirp" = "yes" ; then
-   echo "CONFIG_SLIRP=yes" >> $config_mak
-   echo "#define CONFIG_SLIRP 1" >> $config_h
---- vl.c.orig	2008-07-18 15:19:26.000000000 -0400
-+++ vl.c	2008-07-18 15:31:25.000000000 -0400
-@@ -102,6 +102,13 @@
- int inet_aton(const char *cp, struct in_addr *ia);
- #endif
+   echo "CONFIG_SLIRP=y" >> $config_host_mak
+   QEMU_CFLAGS="-I\$(SRC_PATH)/slirp $QEMU_CFLAGS"
+Index: net.h
+@@ -33,7 +33,8 @@ typedef enum {
+     NET_CLIENT_TYPE_TAP,
+     NET_CLIENT_TYPE_SOCKET,
+     NET_CLIENT_TYPE_VDE,
+-    NET_CLIENT_TYPE_DUMP
++    NET_CLIENT_TYPE_DUMP,
++    NET_CLIENT_TYPE_PCAP
+ } net_client_type;
  
-+#if defined(CONFIG_PCAP)
-+#if defined(_WIN32)
-+#define WPCAP 1
-+#endif
-+#include <pcap.h>
-+#endif
+ typedef int (NetCanReceive)(VLANClientState *);
+Index: net.c
+@@ -36,6 +36,8 @@
+ #include "qemu-common.h"
+ #include "qemu_socket.h"
+ 
++#include <sys/ioctl.h>
 +
- #if defined(CONFIG_SLIRP)
- #include "libslirp.h"
- #endif
-@@ -3914,6 +3921,164 @@
-     }
+ static QTAILQ_HEAD(, VLANState) vlans;
+ static QTAILQ_HEAD(, VLANClientState) non_vlan_clients;
+ 
+@@ -820,6 +822,212 @@ static int net_init_nic(QemuOpts *opts,
+     return idx;
  }
  
 +#if defined(CONFIG_PCAP)
++#if defined(CONFIG_BPF)
++#define PCAP_DONT_INCLUDE_PCAP_BPF_H
++#include <net/bpf.h>
++#endif
++#include <pcap.h>
 +
 +typedef struct PCAPState {
-+    VLANClientState *vc;
++    VLANClientState nc;
 +    pcap_t *handle;
 +} PCAPState;
 +
-+static void pcap_receive(void *opaque, const uint8_t *buf, int size)
++static ssize_t pcap_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
 +{
-+    PCAPState *s = (PCAPState *)opaque;
++    PCAPState *s = DO_UPCAST(PCAPState, nc, nc);
 +
-+    pcap_sendpacket(s->handle, (u_char*)buf, size);
++    return pcap_inject(s->handle, (u_char*)buf, size);
 +}
 +
++#define MAX_ETH_FRAME_SIZE 1514
++
 +static void pcap_callback(u_char *user, struct pcap_pkthdr *phdr, u_char *pdata)
 +{
 +    VLANClientState *vc = (VLANClientState *)user;
++    int len = phdr->len;
 +
-+    qemu_send_packet(vc, pdata, phdr->len);
++    if (len > MAX_ETH_FRAME_SIZE) {
++        fprintf(stderr,
++            "pcap_send: packet size > %d (%d), truncating\n",
++            MAX_ETH_FRAME_SIZE, len);
++        len = MAX_ETH_FRAME_SIZE;
++    }
++    qemu_send_packet(vc, pdata, len);
 +}
 +
 +static void pcap_send(void *opaque)
 +{
 +    PCAPState *s = (PCAPState *)opaque;
 +
-+    pcap_dispatch(s->handle, 1, (pcap_handler)&pcap_callback, (u_char *)s->vc);
++    pcap_dispatch(s->handle, 1, (pcap_handler)&pcap_callback, (u_char *)&s->nc);
 +}
 +
-+static int net_pcap_init(VLANState *vlan, char *ifname)
++static void pcap_cleanup(VLANClientState *nc)
 +{
++    PCAPState *s = DO_UPCAST(PCAPState, nc, nc);
++
++    pcap_close(s->handle);
++}
++
++static NetClientInfo net_pcap_info = {
++    .type = NET_CLIENT_TYPE_PCAP,
++    .size = sizeof(PCAPState),
++    .receive = pcap_receive,
++#if 0
++    .receive_raw = tap_receive_raw,
++    .receive_iov = tap_receive_iov,
++#endif
++    .cleanup = pcap_cleanup,
++};
++
++static int net_pcap_init(VLANState *vlan, const char *model, const char *name, const char *ifname)
++{
++    VLANClientState *nc;
 +    PCAPState *s = NULL;
-+    struct bpf_program fcode = { 0, NULL };
-+    char pcap_program[64];
-+    char macstr[] = "xx:xx:xx:xx:xx:xx";
 +    char errbuf[PCAP_ERRBUF_SIZE];
 +#if defined(_WIN32)
 +    HANDLE h;
 +#endif
 +    int i;
 +
-+    /* Find guest's MAC address. */
-+    for (i = 0; i < nb_nics; i++)
-+	if (nd_table[i].vlan == vlan) {
-+	    u_char *mac = nd_table[i].macaddr;
-+	    snprintf(macstr, sizeof(macstr), "%02x:%02x:%02x:%02x:%02x:%02x",
-+		mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-+	    break;
-+	}
-+    if (macstr[0] == 'x') {
-+	fprintf(stderr, "qemu: net_pcap_init: no matching NIC found\n");
-+	return -1;
-+    }
-+
 +    s = qemu_mallocz(sizeof(PCAPState));
++    nc = qemu_new_net_client(&net_pcap_info, vlan, NULL, model, name);
++#if 0
++    nc = qemu_new_vlan_client(NET_CLIENT_TYPE_PCAP,
++                                 vlan, NULL, model, name, NULL,
++				 pcap_receive, NULL, NULL,
++				 pcap_cleanup, s);
++#endif
++
++    s = DO_UPCAST(PCAPState, nc, nc);
 +    if (!s)
 +	return -1;
 +
 +    if (ifname == NULL && (ifname = pcap_lookupdev(errbuf)) == NULL) {
-+	fprintf(stderr, "qemu: pcap_lookupdev: %s\n", errbuf);
++	fprintf(stderr, "qemu: pcap_create: %s\n", errbuf);
 +	goto fail;
 +    }
 +
-+    /* Attempt to connect device. */
-+    s->handle = (void *)pcap_open_live(ifname, 65535, 1, 0, errbuf);
++#if defined(CONFIG_PCAP_CREATE) || defined(_WIN32)
++    /*
++     * Create pcap handle for the device, set promiscuous mode and activate.
++     */
++    s->handle = (void *)pcap_create(ifname, errbuf);
 +    if (!s->handle) {
-+	fprintf(stderr, "qemu: pcap_open_live: %s\n", errbuf);
++	fprintf(stderr, "qemu: pcap_create: %s\n", errbuf);
 +	goto fail;
 +    }
-+
-+    /* Set filter program. */
-+    snprintf(pcap_program, 64, "ether dst %s or multicast", macstr);
-+    if (pcap_compile(s->handle, &fcode, pcap_program, 1, 0) < 0) {
-+	fprintf(stderr, "qemu: pcap_compile failed\n");
++    if (pcap_set_promisc(s->handle, 1) != 0) {
++	pcap_perror(s->handle, "qemu: pcap_set_promisc:");
++	goto fail;
++    }
++    if (pcap_activate(s->handle) != 0) {
++	pcap_perror(s->handle, "qemu: pcap_activate:");
 +	goto fail;
 +    }
-+    if (pcap_setfilter(s->handle, &fcode) < 0) {
-+	fprintf(stderr, "qemu: pcap_setfilter failed\n");
++#else
++    /* Attempt to connect device. */
++    s->handle = (void *)pcap_open_live(ifname, 65535, 1, 0, errbuf);
++    if (!s->handle) {
++	fprintf(stderr, "qemu: pcap_open_live: %s\n", errbuf);
 +	goto fail;
 +    }
++#endif
 +
 +    /* Set non-blocking mode. */
 +    if (pcap_setnonblock(s->handle, 1, errbuf) < 0) {
@@ -201,7 +238,7 @@
 +	goto fail;
 +    }
 +#else /* !_WIN32 */
-+#if defined(HAVE_BPF)
++#if defined(CONFIG_BPF)
 +#if defined(BIOCIMMEDIATE)
 +    /*
 +     * Tell the kernel that the packet has to be seen immediately.
@@ -228,11 +265,10 @@
 +	}
 +    }
 +#endif /* BIOCFEEDBACK */
-+#endif /* HAVE_BPF */
++#endif /* CONFIG_BPF */
 +#endif /* _WIN32 */
 +
-+    s->vc = qemu_new_vlan_client(vlan, pcap_receive, NULL, s);
-+    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "pcap redirector");
++    snprintf(s->nc.info_str, sizeof(s->nc.info_str), "pcap redirector");
 +
 +#if defined(_WIN32)
 +    if ((h = pcap_getevent(s->handle)) == NULL) {
@@ -252,46 +288,67 @@
 +
 +fail:
 +    if (s) {
-+	if (s->handle) {
-+	    if (fcode.bf_len)
-+		pcap_freecode(&fcode);
++	if (s->handle)
 +	    pcap_close(s->handle);
-+	}
 +	qemu_free(s);
 +    }
 +
 +    return -1;
 +}
++
++static int net_init_pcap(QemuOpts *opts,
++                          Monitor *mon,
++                          const char *name,
++                          VLANState *vlan)
++{
++    const char *ifname;
++
++    ifname = qemu_opt_get(opts, "ifname");
++
++    if (net_pcap_init(vlan, "pcap", name, ifname) == -1) {
++        return -1;
++    }
++
++    vlan->nb_host_devs++;
++
++    return 0;
++}
 +#endif /* CONFIG_PCAP */
 +
- #if defined(CONFIG_SLIRP)
- 
- /* slirp network adapter */
-@@ -4983,6 +5150,16 @@
-            are wanted */
-         ret = 0;
-     } else
+ #define NET_COMMON_PARAMS_DESC                     \
+     {                                              \
+         .name = "type",                            \
+@@ -980,6 +1188,20 @@ static struct {
+ #endif /* _WIN32 */
+             { /* end of list */ }
+         },
 +#ifdef CONFIG_PCAP
-+    if (!strcmp(device, "pcap")) {
-+	char ifname[64];
-+	vlan->nb_host_devs++;
-+	if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0)
-+	    ret = net_pcap_init(vlan, NULL);
-+	else
-+	    ret = net_pcap_init(vlan, ifname);
-+    } else
++    }, {
++        .type = "pcap",
++        .init = net_init_pcap,
++        .desc = {
++            NET_COMMON_PARAMS_DESC,
++            {
++                .name = "ifname",
++                .type = QEMU_OPT_STRING,
++                .help = "interface name",
++            },
++            { /* end of list */ }
++        },
 +#endif
- #ifdef CONFIG_SLIRP
-     if (!strcmp(device, "user")) {
-         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
-@@ -7398,6 +7575,10 @@
-            "Network options:\n"
-            "-net nic[,vlan=n][,macaddr=addr][,model=type]\n"
-            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
+     }, {
+         .type = "socket",
+         .init = net_init_socket,
+--- qemu-options.hx.orig	2009-08-28 16:46:21.000000000 -0400
++++ qemu-options.hx	2009-09-02 16:20:14.000000000 -0400
+@@ -783,6 +783,10 @@
+ DEF("net", HAS_ARG, QEMU_OPTION_net,
+     "-net nic[,vlan=n][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
+     "                create a new Network Interface Card and connect it to VLAN 'n'\n"
 +#ifdef CONFIG_PCAP
-+           "-net pcap[,vlan=n][,ifname=name]\n"
-+           "                connect the host network interface using PCAP to VLAN 'n'\n"
++    "-net pcap[,vlan=n][,name=str][,ifname=name]\n"
++    "                connect the host network interface using PCAP to VLAN 'n'\n"
 +#endif
  #ifdef CONFIG_SLIRP
-            "-net user[,vlan=n][,hostname=host]\n"
-            "                connect the user mode network stack to VLAN 'n' and send\n"
+     "-net user[,vlan=n][,name=str][,net=addr[/mask]][,host=addr][,restrict=y|n]\n"
+     "         [,hostname=host][,dhcpstart=addr][,dns=addr][,tftp=dir][,bootfile=f]\n"
diff --git a/emulators/qemu-devel/pkg-descr b/emulators/qemu-devel/pkg-descr
index d994c805e53f..c26d1bed623b 100644
--- a/emulators/qemu-devel/pkg-descr
+++ b/emulators/qemu-devel/pkg-descr
@@ -12,9 +12,8 @@ launch the Wine Windows API emulator or to ease cross-compilation and
 cross-debugging. 
 
 As QEMU requires no host kernel patches to run, it is very safe and easy to use.
-(but kqemu is now also supported for the i386 on i386 and amd64 case)
 
 See also the preconfigured system images on http://oszoo.org/
 Many live cd isos also work.
 
-WWW: http://bellard.org/qemu/
+WWW: http://www.nongnu.org/qemu/
diff --git a/emulators/qemu-devel/pkg-message b/emulators/qemu-devel/pkg-message
index 664ff40a0f95..59754d8909f6 100644
--- a/emulators/qemu-devel/pkg-message
+++ b/emulators/qemu-devel/pkg-message
@@ -15,34 +15,41 @@ for example time sleep 1 takes 49 seconds and booting sleeps for
 minutes at the acd0 probe with a FreeSBIE 1.0 guest, thats because
 its kernel is built with HZ=5000, and FreeBSD's default is 100...
 (no longer a problem with FreeSBIE 1.1.)  The linux 2.6 kernel uses
-1000 by default btw (changed to 250 recently).  Enabling /dev/rtc doesn't
-seem to help either (not included since it needs a patch to emulators/rtc.)
-- using physical media doesn't work on 4.x hosts (missing DIOCGMEDIASIZE
-ioctl.)
+1000 by default btw. (changed to 250 later, and recent linux kernels now
+no longer have a fixed HZ, aka `tickless kernel'...)  Enabling /dev/rtc
+doesn't seem to help either (not included since it needs a patch to
+emulators/rtc.)
+- update: the above problem has gotten worse with FreeBSD guests
+somewhere before 8.0, mainly since the kernel now usually wants
+double or even quadruple number of timer irqs compared to HZ if it
+detects an apic (and at least early versions of FreeBSD 8 had a bug that
+essentially halved qemu's clock rate too); the only reason you usually
+don't see symptoms of this with FreeBSD 8 guests is they automatically
+reduce their HZ to 100 when running in a VM while the default for the
+host kernel is still HZ=1000.  workarounds:  for i386 guests you can
+disable the apic in the guest by setting
+	hint.apic.0.disabled=1
+in loader.conf(5) (or manually at the loader prompt), otherwise the
+only thing you can do is either reduce the guest's HZ to, say, 100
+by setting e.g.
+	kern.hz="100"
+from the loader as above (which usually is a good idea in a VM anyway
+and FreeBSD 8 now does it by itself as mentioned), or if that's not
+possible increase the host's HZ to 2000 or even 4000 from the loader
+in the same way.
 - the -smb option (smb-export local dir to guest) needs the net/samba3
 port/package installed in addition to qemu.
-- RELENG_6 and up guests often crash while accessing the emulated cdrom
-(see kern/84102, http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/84102),
-using a kernel without PREEMPTION has been reported to fix this problem.
-(or do an ftp install instead of installing from the emulated cdrom, and
-then make a new kernel.)  [fixed since 6.0-R.]
-- 6.0-RC1 was released with an ed driver that doesn't like qemu's emulated
-RTL8029 nic, this has been fixed in the meantime but if for some reason
-you need to use that version as a guest you can temporarily add the patch
-in this message: http://docs.freebsd.org/cgi/mid.cgi?200510131428.21211.jkim
-(not included in the port since the used VIA VT86C926 PCI ID does not
-really match the emulated nic exactly, it just `happens' to work with
-6.0-RC1's driver.)
 - if you want to use usb devices connected to the host in the guest
-(usb_add host:... monitor command; this doesn't work on -current atm
-because of the new usb stack - help updating the usb-bsd.c code is
-more than welcome here!) you need to make sure the host isn't claiming
-them, e.g. for umass devices (like memory sticks or external harddrives)
-make sure umass isn't in the kernel (you can then still load it as a kld
-when needed), also unless you are running qemu as root you then need to
-fix permissions for /dev/ugen* device nodes: if you are on 5.x or later
-(devfs) put a rule in /etc/devfs.rules, activate it in /etc/rc.conf
-and run /etc/rc.d/devfs restart.  example devfs.rules:
+(usb_add host:... monitor command; this doesn't work on FreeBSD 8 and
+-current atm because of the new usb stack - help updating the usb-bsd.c
+code is more than welcome here!) you need to make sure the host isn't
+claiming them, e.g. for umass devices (like memory sticks or external
+harddrives) make sure umass isn't in the kernel (you can then still
+load it as a kld when needed), also unless you are running qemu as
+root you then need to fix permissions for /dev/ugen* device nodes:
+if you are on 5.x or later (devfs) put a rule in /etc/devfs.rules,
+activate it in /etc/rc.conf and run /etc/rc.d/devfs restart.
+example devfs.rules:
 	[ugen_ruleset=20]
 	add path 'ugen*' mode 660 group operator
 corresponding rc.conf line:
@@ -69,28 +76,11 @@ with qemu's now by default enabled cdrom dma.  You can build the port with
 CDROM_DMA disabled to disable it.
 - if you build qemu wihout SDL and then get crashes running it try
 passing it -nographic.  This should probably be default in that case...
-- slirp (-net user) seems to be unstable on amd64 hosts, if this affects
-you please use tuntap for now.  Scott Robbins posted a tap howto for
--current here:
-	http://forums.bsdnexus.com/viewtopic.php?id=1563
-and one for 6 and 5(?) is here:
-	http://acidos.bandwidth-junkies.net/index.php?Sect=qemu
 - perhaps it should be noted that if you want to use qemu with -m 512
 or larger on 6.x/i386 hosts you need to increase the kern.maxdsiz tunable
 in loader.conf(5) since the default is 512 MB, and qemu needs memory for
 itself also.  (7.0 and up now use jemalloc which uses mmap(2) and
 isn't affected by kern.maxdsiz anymore.)
-- if you use kqemu make sure your kqemu.ko is always in sync with your
-kernel (like with any kld installed outside of base), i.e.  rebuild its
-port whenever you update the kernel - especially if you are switching
-branches or are following a -stable or even -current branch!
-- you can enable autoloading of kqemu (and aio) at boot by adding a line
-	kqemu_enable=YES
-to /etc/rc.conf
-- kqemu liked to panic the host on amd64 SMP until before 1.3.0.p11_6
-(revision 1.25 of /usr/ports/emulators/kqemu-kmod/Makefile), so if your
-host is such you might want to make sure your kqemu-kmod port is new enough.
-(and don't forget to reload it...)
 - qemu's network boot roms (-boot n) have a bug when bootfiles sizes are a
 multiple of blksize, if this affects you (like with FreeBSD's /boot/pxeboot)
 you can do like
@@ -105,22 +95,8 @@ and placed it here:
 - if you use slirp (usernet, the default) and want to mount nfs into the
 guest and you are not running qemu as root, then mountd(8) on the exporting
 box needs to be run with -n in order to accept requests from ports >= 1024.
-- unfortunately there can still be guests that don't run correctly with
-kqemu and -kernel-kqemu especially on amd64 - not much you can do about that
-other than help debugging (k)qemu... (well or falling back to unaccellerated
-qemu/leaving out -kernel-kqemu if its that what's causing the problems.
-note however that kqemu now can also be used with the 32 bit qemu even
-on amd64 hosts as of the 20080620 update.)
 - the new (optional) pcap code cannot talk to the host on 6.x because
 the necessary bpf feature (BIOCFEEDBACK) hasn't (yet?) been merged there.
-- kqemu passes the host tsc to the guest as-is so depending on your cpu and
-guest you _may_ need to tell the guest to avoid relying on the tsc (notsc
-kernel parameter with linux), or if that doesn't work force qemu onto
-a single cpu by doing e.g. `cpuset -l 0 qemu ..' (see the cpuset(1) manpage
-for details; cpuset isn't avalable before 7.1.  This can only be a problem
-on smp hosts.)
-- the new sparc64-bsd-user target (qemu-sparc64) is entirely untested and
-probably only works on amd64 hosts, if at all.
 - (not FreeBSD-specific:) there have been reports of qcow2 corruption with
 (at least) win2k guests on recent kvm (which uses similar qcow2 code than
 qemu now, see this thread:
@@ -130,17 +106,29 @@ been experimental and you should use raw images if you want reliability;
 raw is also usually faster.)  You should be able to migrate existing images
 to raw using qemu-img(1)'s convert function; raw doesn't support advanced
 features like snapshots tho.
+[a few important qcow2 bugfixed have been committed in the meantime so
+this _might_ be less of an issue now.]
 - (also not FreeBSD-specific:)  It is recommended to pass raw images using
 the new -drive syntax, specifying format=raw explicitly in order to avoid
 malicious guests being able to exploit the format autodetection thats
 otherwise getting used.  (Not that you should run malicious guests anyway,
 but this eleminates at least a known attack vector.)
-- qemu now uses aio at least for ide dma, so if you get `Invalid system call'
-crashes that is because aio is not (kld)loaded.
+- qemu now has improved physical cdrom support, but there still is
+at least one known problem: you need to have the guest eject the disc
+if you want to change it/take it out, or otherwise the guest may continue
+using state (like size) of the old disc.  (You can also do like
+`change ide1-cd0 /dev/acd0' in the monitor after taking out the disc
+if a guest cannot eject it itself.)
 - The default configuration location (qemu-ifup script etc.) has been
 changed from /etc to PREFIX/etc (usually /usr/local/etc).  Move your
 files accordingly.
-- *** This port (qemu-devel) is currently at an older version
-(0.9.1s.20080620) than the main port (qemu), so probably should only be
-used if there are specific problems with the latter. ***
+- kqemu is no longer supported in qemu upstream after the 0.11 branch
+was created, which means also not in this version.  (Linux has moved
+on to kvm now for qemu(-like) virtualization needs, so if you want qemu
+to go faster and don't want to switch to virtualbox or stick to the older
+emulators/qemu port which is at 0.11.1 atm and as such still supports
+kqemu you should help getting the FreeBSD kvm port updated and
+completed:
+	http://wiki.freebsd.org/FabioChecconi/PortingLinuxKVMToFreeBSD
+)
 ====
diff --git a/emulators/qemu-devel/pkg-plist b/emulators/qemu-devel/pkg-plist
index 2c22b24ac510..1f689561075d 100644
--- a/emulators/qemu-devel/pkg-plist
+++ b/emulators/qemu-devel/pkg-plist
@@ -1,18 +1,25 @@
 bin/qemu
 bin/qemu-img
-bin/qemu-system-arm
-bin/qemu-system-cris
-bin/qemu-system-m68k
-bin/qemu-system-mips
-bin/qemu-system-mips64
-bin/qemu-system-mips64el
-bin/qemu-system-mipsel
-%%DYNGEN%%bin/qemu-system-ppc
-%%DYNGEN%%bin/qemu-system-ppc64
-%%DYNGEN%%bin/qemu-system-ppcemb
-%%DYNGEN%%bin/qemu-system-sh4
-%%DYNGEN%%bin/qemu-system-sh4eb
-bin/qemu-system-sparc
+bin/qemu-io
+%%ALLTARGETS%%bin/qemu-system-arm
+%%ALLTARGETS%%bin/qemu-system-cris
+%%ALLTARGETS%%bin/qemu-system-m68k
+%%ALLTARGETS%%bin/qemu-system-microblaze
+%%ALLTARGETS%%bin/qemu-system-mips
+%%ALLTARGETS%%bin/qemu-system-mips64
+%%ALLTARGETS%%bin/qemu-system-mips64el
+%%ALLTARGETS%%bin/qemu-system-mipsel
+%%ALLTARGETS%%bin/qemu-system-ppc
+%%ALLTARGETS%%bin/qemu-system-ppc64
+%%ALLTARGETS%%bin/qemu-system-ppcemb
+%%ALLTARGETS%%bin/qemu-system-sh4
+%%ALLTARGETS%%bin/qemu-system-sh4eb
+%%ALLTARGETS%%bin/qemu-system-sparc
+%%ALLTARGETS%%bin/qemu-system-sparc64
+%%ALLTARGETS%%bin/qemu-i386
+%%ALLTARGETS%%bin/qemu-sparc
+%%ALLTARGETS%%bin/qemu-sparc64
+%%ALLTARGETS%%bin/qemu-x86_64
 bin/qemu-system-x86_64
 @unexec if cmp -s %D/etc/qemu-ifup.sample %D/etc/qemu-ifup; then rm -f %D/etc/qemu-ifup; fi
 etc/qemu-ifup.sample
@@ -27,12 +34,20 @@ etc/qemu-ifdown.sample
 %%DATADIR%%/vgabios.bin
 %%DATADIR%%/vgabios-cirrus.bin
 %%DATADIR%%/ppc_rom.bin
+%%DATADIR%%/openbios-ppc
 %%DATADIR%%/openbios-sparc32
 %%DATADIR%%/openbios-sparc64
 %%DATADIR%%/video.x
+%%DATADIR%%/pxe-e1000.bin
+%%DATADIR%%/pxe-i82559er.bin
 %%DATADIR%%/pxe-ne2k_pci.bin
 %%DATADIR%%/pxe-rtl8139.bin
 %%DATADIR%%/pxe-pcnet.bin
+%%DATADIR%%/pxe-virtio.bin
+%%DATADIR%%/linuxboot.bin
+%%DATADIR%%/multiboot.bin
+%%DATADIR%%/petalogix-s3adsp1800.dtb
+%%DATADIR%%/bamboo.dtb
 %%DATADIR%%/keymaps/ar
 %%DATADIR%%/keymaps/common
 %%DATADIR%%/keymaps/da