14 files changed, 306 insertions, 362 deletions

diff --git a/emulators/qemu-devel/Makefile b/emulators/qemu-devel/Makefile
index c98587fb836e..07387ae8ae9d 100644
--- a/emulators/qemu-devel/Makefile
+++ b/emulators/qemu-devel/Makefile
@@ -6,18 +6,17 @@
 #
 
 PORTNAME=	qemu
-PORTVERSION=	0.13.0
+PORTVERSION=	0.14.0
 CATEGORIES=	emulators
 MASTER_SITES=	SAVANNAH:release \
-		LOCAL:snapshot \
-		http://people.freebsd.org/~nox/qemu/:snapshot
+		LOCAL:snapshot
 MASTER_SITE_SUBDIR=	qemu/:release nox/:snapshot
 PKGNAMESUFFIX=	-devel
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX}:release
 DIST_SUBDIR=	qemu
 
 MAINTAINER=	nox@FreeBSD.org
-COMMENT=	QEMU CPU Emulator - development snapshot
+COMMENT=	QEMU CPU Emulator - development version
 
 HAS_CONFIGURE=	yes
 USE_GMAKE=	yes
@@ -51,7 +50,7 @@ PLIST_SUB+=	ALLTARGETS=""
 WITHOUT_CPU_CFLAGS=yes	#to avoid problems with register allocation
 CFLAGS:=	${CFLAGS:C/-fno-tree-vrp//}
 CONFIGURE_ARGS+=	--prefix=${PREFIX} --cc=${CC} --enable-docs \
-	--extra-cflags=-DSMBD_COMMAND=\\\"${LOCALBASE}/sbin/smbd\\\"\ -I${LOCALBASE}/include\ -DPREFIX=\\\"${PREFIX}\\\"
+	--extra-cflags=-DSMBD_COMMAND=\\\"${LOCALBASE}/sbin/smbd\\\"\ -I${WRKSRC}\ -I${LOCALBASE}/include\ -DPREFIX=\\\"${PREFIX}\\\"
 
 .if defined(WITHOUT_SDL)
 CONFIGURE_ARGS+=	--disable-sdl
@@ -97,8 +96,10 @@ MAKE_ARGS+=	ARCH=x86_64
 MAKE_ARGS+=	ARCH=ppc
 .endif
 
-.if ${OSVERSION} >= 900000 && ${ARCH} == "amd64"
-BROKEN=		does not link on FreeBSD 9.X
+.if ${OSVERSION} < 900033 && ${ARCH} == "amd64"
+BUILD_DEPENDS+=	${LOCALBASE}/bin/as:${PORTSDIR}/devel/binutils
+CONFIGURE_ENV+=	COMPILER_PATH=${LOCALBASE}/bin
+MAKE_ENV+=	COMPILER_PATH=${LOCALBASE}/bin
 .endif
 
 pre-patch:
@@ -136,7 +137,7 @@ post-patch:
 		${WRKSRC}/Makefile
 	@${REINPLACE_CMD} -E \
 		-e "1s|^(#! )/usr/bin/perl|\1${PERL}|" \
-		${WRKSRC}/texi2pod.pl
+		${WRKSRC}/scripts/texi2pod.pl
 
 .if ${OSVERSION} >= 800091
 # XXX need to disable usb host code on head while it's not ported to the
diff --git a/emulators/qemu-devel/distinfo b/emulators/qemu-devel/distinfo
index 9a65b13f9444..75cf3c2517dd 100644
--- a/emulators/qemu-devel/distinfo
+++ b/emulators/qemu-devel/distinfo
@@ -1,3 +1,2 @@
-MD5 (qemu/qemu-0.13.0.tar.gz) = 397a0d665da8ba9d3b9583629f3d6421
-SHA256 (qemu/qemu-0.13.0.tar.gz) = 1e6f5851b05cea6e377c835f4668408d4124cfb845f9948d922808743c5fd877
-SIZE (qemu/qemu-0.13.0.tar.gz) = 5184531
+SHA256 (qemu/qemu-0.14.0.tar.gz) = ba21e84d7853217830e167dae9999cdbff481189c6a0bb600ac7fb7201453108
+SIZE (qemu/qemu-0.14.0.tar.gz) = 5439695
diff --git a/emulators/qemu-devel/files/patch-90_security b/emulators/qemu-devel/files/patch-90_security
index 53daab6bae92..e62c64dedb32 100644
--- a/emulators/qemu-devel/files/patch-90_security
+++ b/emulators/qemu-devel/files/patch-90_security
@@ -36,19 +36,6 @@ Index: qemu/hw/fdc.c
                  return;
              }
 Index: qemu-0.8.2/hw/pc.c
-===================================================================
---- qemu-0.8.2.orig/hw/pc.c	2007-04-20 06:05:58.000000000 +0300
-+++ qemu-0.8.2/hw/pc.c	2007-04-20 06:05:59.000000000 +0300
-@@ -312,7 +312,8 @@ void bochs_bios_write(void *opaque, uint
-     case 0x400:
-     case 0x401:
-         fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
--        exit(1);
-+        /* according to documentation, these can be safely ignored */
-+        break;
-     case 0x402:
-     case 0x403:
- #ifdef DEBUG_BIOS
 @@ -335,8 +336,9 @@ void bochs_bios_write(void *opaque, uint
          /* LGPL'ed VGA BIOS messages */
      case 0x501:
diff --git a/emulators/qemu-devel/files/patch-Makefile b/emulators/qemu-devel/files/patch-Makefile
index 15d7645265b2..28c7fce9f05d 100644
--- a/emulators/qemu-devel/files/patch-Makefile
+++ b/emulators/qemu-devel/files/patch-Makefile
@@ -11,15 +11,6 @@ Index: qemu/Makefile
  else
  DOCS=
  endif
-@@ -107,7 +111,7 @@ bt-host.o: QEMU_CFLAGS += $(BLUEZ_CFLAGS
- ######################################################################
- 
- qemu-img.o: qemu-img-cmds.h
--qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o: $(GENERATED_HEADERS)
-+qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o: $(GENERATED_HEADERS)
- 
- qemu-img$(EXESUF): qemu-img.o qemu-tool.o qemu-error.o $(block-obj-y) $(qobject-obj-y)
- 
 @@ -169,8 +173,10 @@ BLOBS=
  endif
  
diff --git a/emulators/qemu-devel/files/patch-block-sheepdog.c b/emulators/qemu-devel/files/patch-block-sheepdog.c
deleted file mode 100644
index 58c318793d62..000000000000
--- a/emulators/qemu-devel/files/patch-block-sheepdog.c
+++ /dev/null
@@ -1,15 +0,0 @@
---- a/block/sheepdog.c
-+++ b/block/sheepdog.c
-@@ -14,7 +14,12 @@
- #include <ws2tcpip.h>
- #else
- #include <netdb.h>
-+#ifdef __FreeBSD__
-+#include <sys/types.h>
-+#include <sys/socket.h>
-+#else
- #include <netinet/tcp.h>
-+#endif
- 
- #define closesocket(s) close(s)
- #endif
diff --git a/emulators/qemu-devel/files/patch-bsd-user-ld b/emulators/qemu-devel/files/patch-bsd-user-ld
index bf092894daf3..61df7d6bf8fc 100644
--- a/emulators/qemu-devel/files/patch-bsd-user-ld
+++ b/emulators/qemu-devel/files/patch-bsd-user-ld
@@ -1,46 +1,261 @@
 --- a/x86_64.ld
 +++ b/x86_64.ld
-@@ -38,16 +38,16 @@ SECTIONS
-   .rel.plt      :
-   {
-     *(.rel.plt)
+@@ -1,54 +1,58 @@
+-/* Default linker script, for normal executables */
+-OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
++/* Script for -z combreloc: combine and sort reloc sections */
++OUTPUT_FORMAT("elf64-x86-64-freebsd", "elf64-x86-64-freebsd",
++	      "elf64-x86-64-freebsd")
+ OUTPUT_ARCH(i386:x86-64)
+ ENTRY(_start)
++SEARCH_DIR("/lib"); SEARCH_DIR("/usr/lib");
+ SECTIONS
+ {
+   /* Read-only sections, merged into text segment: */
+-  . = 0x60000000 + SIZEOF_HEADERS;
++  PROVIDE (__executable_start = 0x60000000); . = 0x60000000 + SIZEOF_HEADERS;
+   .interp         : { *(.interp) }
+   .hash           : { *(.hash) }
++  .gnu.hash       : { *(.gnu.hash) }
+   .dynsym         : { *(.dynsym) }
+   .dynstr         : { *(.dynstr) }
+   .gnu.version    : { *(.gnu.version) }
+   .gnu.version_d  : { *(.gnu.version_d) }
+   .gnu.version_r  : { *(.gnu.version_r) }
+-  .rel.init       : { *(.rel.init) }
+-  .rela.init      : { *(.rela.init) }
+-  .rel.text       : { *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*) }
+-  .rela.text      : { *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*) }
+-  .rel.fini       : { *(.rel.fini) }
+-  .rela.fini      : { *(.rela.fini) }
+-  .rel.rodata     : { *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*) }
+-  .rela.rodata    : { *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*) }
+-  .rel.data       : { *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*) }
+-  .rela.data      : { *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*) }
+-  .rel.tdata	  : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
+-  .rela.tdata	  : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
+-  .rel.tbss	  : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
+-  .rela.tbss	  : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+-  .rel.ctors      : { *(.rel.ctors) }
+-  .rela.ctors     : { *(.rela.ctors) }
+-  .rel.dtors      : { *(.rel.dtors) }
+-  .rela.dtors     : { *(.rela.dtors) }
+-  .rel.got        : { *(.rel.got) }
+-  .rela.got       : { *(.rela.got) }
+-  .rel.bss        : { *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*) }
+-  .rela.bss       : { *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*) }
+-  .rel.plt      :
+-  {
+-    *(.rel.plt)
 -    PROVIDE_HIDDEN (__rel_iplt_start = .);
-+    PROVIDE (__rel_iplt_start = .);
-     *(.rel.iplt)
+-    *(.rel.iplt)
 -    PROVIDE_HIDDEN (__rel_iplt_end = .);
-+    PROVIDE (__rel_iplt_end = .);
-   }
-   .rela.plt       :
-   {
-     *(.rela.plt)
+-  }
+-  .rela.plt       :
+-  {
+-    *(.rela.plt)
 -    PROVIDE_HIDDEN (__rela_iplt_start = .);
-+    PROVIDE (__rela_iplt_start = .);
-     *(.rela.iplt)
+-    *(.rela.iplt)
 -    PROVIDE_HIDDEN (__rela_iplt_end = .);
-+    PROVIDE (__rela_iplt_end = .);
-   }
+-  }
++  .rel.dyn        :
++    {
++      *(.rel.init)
++      *(.rel.text .rel.text.* .rel.gnu.linkonce.t.*)
++      *(.rel.fini)
++      *(.rel.rodata .rel.rodata.* .rel.gnu.linkonce.r.*)
++      *(.rel.data.rel.ro* .rel.gnu.linkonce.d.rel.ro.*)
++      *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
++      *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*)
++      *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*)
++      *(.rel.ctors)
++      *(.rel.dtors)
++      *(.rel.got)
++      *(.rel.bss .rel.bss.* .rel.gnu.linkonce.b.*)
++      *(.rel.ldata .rel.ldata.* .rel.gnu.linkonce.l.*)
++      *(.rel.lbss .rel.lbss.* .rel.gnu.linkonce.lb.*)
++      *(.rel.lrodata .rel.lrodata.* .rel.gnu.linkonce.lr.*)
++    }
++  .rela.dyn       :
++    {
++      *(.rela.init)
++      *(.rela.text .rela.text.* .rela.gnu.linkonce.t.*)
++      *(.rela.fini)
++      *(.rela.rodata .rela.rodata.* .rela.gnu.linkonce.r.*)
++      *(.rela.data .rela.data.* .rela.gnu.linkonce.d.*)
++      *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*)
++      *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*)
++      *(.rela.ctors)
++      *(.rela.dtors)
++      *(.rela.got)
++      *(.rela.bss .rela.bss.* .rela.gnu.linkonce.b.*)
++      *(.rela.ldata .rela.ldata.* .rela.gnu.linkonce.l.*)
++      *(.rela.lbss .rela.lbss.* .rela.gnu.linkonce.lb.*)
++      *(.rela.lrodata .rela.lrodata.* .rela.gnu.linkonce.lr.*)
++    }
++  .rel.plt        : { *(.rel.plt) }
++  .rela.plt       : { *(.rela.plt) }
    .init           :
    {
-@@ -70,8 +70,6 @@ SECTIONS
-   .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+     KEEP (*(.init))
+@@ -57,6 +61,7 @@ SECTIONS
+   .text           :
+   {
+     *(.text .stub .text.* .gnu.linkonce.t.*)
++    KEEP (*(.text.*personality*))
+     /* .gnu.warning sections are handled specially by elf32.em.  */
+     *(.gnu.warning)
+   } =0x90909090
+@@ -71,35 +76,36 @@ SECTIONS
    .rodata1        : { *(.rodata1) }
    .eh_frame_hdr : { *(.eh_frame_hdr) }
--  .eh_frame       : ONLY_IF_RO { KEEP (*(.eh_frame)) }
+   .eh_frame       : ONLY_IF_RO { KEEP (*(.eh_frame)) }
 -  .gcc_except_table   : ONLY_IF_RO { *(.gcc_except_table) }
++  .gcc_except_table   : ONLY_IF_RO { *(.gcc_except_table .gcc_except_table.*) }
    /* Adjust the address for the data segment.  We want to adjust up to
       the same address within the page on the next page up.  */
-   . = ALIGN (0x100000) - ((0x100000 - .) & (0x100000 - 1)); . = DATA_SEGMENT_ALIGN (0x100000, 0x1000);
-@@ -97,8 +95,8 @@ SECTIONS
-   .data1          : { *(.data1) }
+-  . = ALIGN (0x100000) - ((0x100000 - .) & (0x100000 - 1)); . = DATA_SEGMENT_ALIGN (0x100000, 0x1000);
+-  /* Ensure the __preinit_array_start label is properly aligned.  We
+-     could instead move the label definition inside the section, but
+-     the linker would then create the section even if it turns out to
+-     be empty, which isn't pretty.  */
+-  . = ALIGN(64 / 8);
+-  PROVIDE (__preinit_array_start = .);
+-  .preinit_array     : { *(.preinit_array) }
+-  PROVIDE (__preinit_array_end = .);
+-  PROVIDE (__init_array_start = .);
+-  .init_array     : { *(.init_array) }
+-  PROVIDE (__init_array_end = .);
+-  PROVIDE (__fini_array_start = .);
+-  .fini_array     : { *(.fini_array) }
+-  PROVIDE (__fini_array_end = .);
+-  .data           :
+-  {
+-    *(.data .data.* .gnu.linkonce.d.*)
+-    SORT(CONSTRUCTORS)
+-  }
+-  .data1          : { *(.data1) }
++  . = ALIGN (CONSTANT (MAXPAGESIZE)) - ((CONSTANT (MAXPAGESIZE) - .) & (CONSTANT (MAXPAGESIZE) - 1)); . = DATA_SEGMENT_ALIGN (CONSTANT (MAXPAGESIZE), CONSTANT (COMMONPAGESIZE));
++  /* Exception handling  */
++  .eh_frame       : ONLY_IF_RW { KEEP (*(.eh_frame)) }
++  .gcc_except_table   : ONLY_IF_RW { *(.gcc_except_table .gcc_except_table.*) }
++  /* Thread Local Storage sections  */
    .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
    .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
 -  .eh_frame       : ONLY_IF_RW { KEEP (*(.eh_frame)) }
 -  .gcc_except_table   : ONLY_IF_RW { *(.gcc_except_table) }
-+  .eh_frame       : { KEEP (*(.eh_frame)) }
-+  .gcc_except_table   : { *(.gcc_except_table) }
-   .dynamic        : { *(.dynamic) }
+-  .dynamic        : { *(.dynamic) }
++  .preinit_array     :
++  {
++    PROVIDE_HIDDEN (__preinit_array_start = .);
++    KEEP (*(.preinit_array))
++    PROVIDE_HIDDEN (__preinit_array_end = .);
++  }
++  .init_array     :
++  {
++     PROVIDE_HIDDEN (__init_array_start = .);
++     KEEP (*(SORT(.init_array.*)))
++     KEEP (*(.init_array))
++     PROVIDE_HIDDEN (__init_array_end = .);
++  }
++  .fini_array     :
++  {
++    PROVIDE_HIDDEN (__fini_array_start = .);
++    KEEP (*(.fini_array))
++    KEEP (*(SORT(.fini_array.*)))
++    PROVIDE_HIDDEN (__fini_array_end = .);
++  }
    .ctors          :
    {
+     /* gcc uses crtbegin.o to find the start of
+@@ -112,25 +118,37 @@ SECTIONS
+        doesn't matter which directory crtbegin.o
+        is in.  */
+     KEEP (*crtbegin.o(.ctors))
++    KEEP (*crtbegin?.o(.ctors))
+     /* We don't want to include the .ctor section from
+-       from the crtend.o file until after the sorted ctors.
++       the crtend.o file until after the sorted ctors.
+        The .ctor section from the crtend file contains the
+        end of ctors marker and it must be last */
+-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .ctors))
++    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o ) .ctors))
+     KEEP (*(SORT(.ctors.*)))
+     KEEP (*(.ctors))
+   }
+   .dtors          :
+   {
+     KEEP (*crtbegin.o(.dtors))
+-    KEEP (*(EXCLUDE_FILE (*crtend.o ) .dtors))
++    KEEP (*crtbegin?.o(.dtors))
++    KEEP (*(EXCLUDE_FILE (*crtend.o *crtend?.o ) .dtors))
+     KEEP (*(SORT(.dtors.*)))
+     KEEP (*(.dtors))
+   }
+   .jcr            : { KEEP (*(.jcr)) }
+-  .got            : { *(.got.plt) *(.got) }
+-  _edata = .;
+-  PROVIDE (edata = .);
++  .data.rel.ro : { *(.data.rel.ro.local* .gnu.linkonce.d.rel.ro.local.*) *(.data.rel.ro* .gnu.linkonce.d.rel.ro.*) }
++  .dynamic        : { *(.dynamic) }
++  .got            : { *(.got) }
++  . = DATA_SEGMENT_RELRO_END (24, .);
++  .got.plt        : { *(.got.plt) }
++  .data           :
++  {
++    *(.data .data.* .gnu.linkonce.d.*)
++    KEEP (*(.gnu.linkonce.d.*personality*))
++    SORT(CONSTRUCTORS)
++  }
++  .data1          : { *(.data1) }
++  _edata = .; PROVIDE (edata = .);
+   __bss_start = .;
+   .bss            :
+   {
+@@ -139,12 +157,29 @@ SECTIONS
+    *(COMMON)
+    /* Align here to ensure that the .bss section occupies space up to
+       _end.  Align after .bss to ensure correct alignment even if the
+-      .bss section disappears because there are no input sections.  */
+-   . = ALIGN(64 / 8);
++      .bss section disappears because there are no input sections.
++      FIXME: Why do we need it? When there is no .bss section, we don't
++      pad the .data section.  */
++   . = ALIGN(. != 0 ? 64 / 8 : 1);
++  }
++  .lbss   :
++  {
++    *(.dynlbss)
++    *(.lbss .lbss.* .gnu.linkonce.lb.*)
++    *(LARGE_COMMON)
++  }
++  . = ALIGN(64 / 8);
++  .lrodata   ALIGN(CONSTANT (MAXPAGESIZE)) + (. & (CONSTANT (MAXPAGESIZE) - 1)) :
++  {
++    *(.lrodata .lrodata.* .gnu.linkonce.lr.*)
++  }
++  .ldata   ALIGN(CONSTANT (MAXPAGESIZE)) + (. & (CONSTANT (MAXPAGESIZE) - 1)) :
++  {
++    *(.ldata .ldata.* .gnu.linkonce.l.*)
++    . = ALIGN(. != 0 ? 64 / 8 : 1);
+   }
+   . = ALIGN(64 / 8);
+-  _end = .;
+-  PROVIDE (end = .);
++  _end = .; PROVIDE (end = .);
+   . = DATA_SEGMENT_END (.);
+   /* Stabs debugging sections.  */
+   .stab          0 : { *(.stab) }
+@@ -179,4 +214,9 @@ SECTIONS
+   .debug_funcnames 0 : { *(.debug_funcnames) }
+   .debug_typenames 0 : { *(.debug_typenames) }
+   .debug_varnames  0 : { *(.debug_varnames) }
++  /* DWARF 3 */
++  .debug_pubtypes 0 : { *(.debug_pubtypes) }
++  .debug_ranges   0 : { *(.debug_ranges) }
++  .gnu.attributes 0 : { KEEP (*(.gnu.attributes)) }
++  /DISCARD/ : { *(.note.GNU-stack) }
+ }
 --- a/i386.ld
 +++ b/i386.ld
 @@ -1,69 +1,88 @@
diff --git a/emulators/qemu-devel/files/patch-hw-vmware_vga.c b/emulators/qemu-devel/files/patch-hw-vmware_vga.c
deleted file mode 100644
index fb404a749946..000000000000
--- a/emulators/qemu-devel/files/patch-hw-vmware_vga.c
+++ /dev/null
@@ -1,74 +0,0 @@
-Index: qemu/hw/vmware_vga.c
-@@ -28,9 +28,9 @@
- #define VERBOSE
- #define EMBED_STDVGA
- #undef DIRECT_VRAM
--#define HW_RECT_ACCEL
--#define HW_FILL_ACCEL
--#define HW_MOUSE_ACCEL
-+/* #define HW_RECT_ACCEL */
-+/* #define HW_FILL_ACCEL */
-+/* #define HW_MOUSE_ACCEL */
- 
- #ifdef EMBED_STDVGA
- # include "vga_int.h"
-@@ -76,6 +76,7 @@
-     uint32_t wblue;
-     int syncing;
-     int fb_size;
-+    int empty;
- 
-     union {
-         uint32_t *fifo;
-@@ -487,7 +488,7 @@
- 
- static inline int vmsvga_fifo_empty(struct vmsvga_state_s *s)
- {
--    if (!s->config || !s->enable)
-+    if (!s->config || !s->enable || s->empty)
-         return 1;
-     return (s->cmd->next_cmd == s->cmd->stop);
- }
-@@ -495,6 +496,10 @@
- static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
- {
-     uint32_t cmd = s->fifo[CMD(stop) >> 2];
-+    if (s->cmd->next_cmd == s->cmd->stop) {
-+        s->empty = 1;
-+        return 0;
-+    }
-     s->cmd->stop = cpu_to_le32(CMD(stop) + 4);
-     if (CMD(stop) >= CMD(max))
-         s->cmd->stop = s->cmd->min;
-@@ -512,6 +517,7 @@
-     int args = 0;
-     int x, y, dx, dy, width, height;
-     struct vmsvga_cursor_definition_s cursor;
-+    s->empty = 0;
-     while (!vmsvga_fifo_empty(s))
-         switch (cmd = vmsvga_fifo_read(s)) {
-         case SVGA_CMD_UPDATE:
-@@ -533,6 +539,7 @@
-             vmsvga_fill_rect(s, colour, x, y, width, height);
-             break;
- #else
-+            args = 0;
-             goto badcmd;
- #endif
- 
-@@ -547,6 +554,7 @@
-             vmsvga_copy_rect(s, x, y, dx, dy, width, height);
-             break;
- #else
-+            args = 0;
-             goto badcmd;
- #endif
- 
-@@ -609,6 +617,7 @@
-             break; /* Nop */
- 
-         default:
-+            args = 0;
-         badcmd:
-             while (args --)
-                 vmsvga_fifo_read(s);
diff --git a/emulators/qemu-devel/files/patch-hw-zaurus.c b/emulators/qemu-devel/files/patch-hw-zaurus.c
deleted file mode 100644
index 59b2415a458c..000000000000
--- a/emulators/qemu-devel/files/patch-hw-zaurus.c
+++ /dev/null
@@ -1,24 +0,0 @@
---- a/hw/zaurus.c
-+++ b/hw/zaurus.c
-@@ -70,6 +70,10 @@ static uint32_t scoop_readb(void *opaque
- {
-     ScoopInfo *s = (ScoopInfo *) opaque;
- 
-+    // XXX Workaround for base address (0x08800040 in this case)
-+    //     rounded down to start of page
-+    addr &= 0x3f;
-+
-     switch (addr) {
-     case SCOOP_MCR:
-         return s->mcr;
-@@ -104,6 +108,10 @@ static void scoop_writeb(void *opaque, t
-     ScoopInfo *s = (ScoopInfo *) opaque;
-     value &= 0xffff;
- 
-+    // XXX Workaround for base address (0x08800040 in this case)
-+    //     rounded down to start of page
-+    addr &= 0x3f;
-+
-     switch (addr) {
-     case SCOOP_MCR:
-         s->mcr = value;
diff --git a/emulators/qemu-devel/files/patch-omap-uart b/emulators/qemu-devel/files/patch-omap-uart
deleted file mode 100644
index d4916cb73b68..000000000000
--- a/emulators/qemu-devel/files/patch-omap-uart
+++ /dev/null
@@ -1,146 +0,0 @@
-From 6a8aabd3c132188ee8e0e82ef4aba09f782cbe96 Mon Sep 17 00:00:00 2001
-From: Stefan Weil <weil@mail.berlios.de>
-Date: Sun, 8 Aug 2010 14:09:26 +0200
-Subject: [PATCH] hw/omap: Fix default setup for OMAP UART devices
-
-Character devices created by qemu_chr_open don't
-allow duplicate device names, so naming all
-UART devices "null" no longer works.
-
-Running "qemu-system-arm -M n800" (and some other machines)
-results in this error message:
-
-	qemu-system-arm: Duplicate ID 'null' for chardev
-	Can't create serial device, empty char device
-
-This is fixed by setting a default label "uart1",
-"uart2" or "uart3".
-
-Cc: Andrzej Zaborowski <andrew.zaborowski@intel.com>
-Signed-off-by: Stefan Weil <weil@mail.berlios.de>
----
- hw/omap.h      |    6 ++++--
- hw/omap1.c     |    3 +++
- hw/omap2.c     |    6 +++++-
- hw/omap_uart.c |   12 +++++++-----
- 4 files changed, 19 insertions(+), 8 deletions(-)
-
-diff --git a/hw/omap.h b/hw/omap.h
-index 18eb72b..fe32ca5 100644
---- a/hw/omap.h
-+++ b/hw/omap.h
-@@ -664,10 +664,12 @@ void omap_synctimer_reset(struct omap_synctimer_s *s);
- struct omap_uart_s;
- struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
-                 qemu_irq irq, omap_clk fclk, omap_clk iclk,
--                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr);
-+                qemu_irq txdma, qemu_irq rxdma,
-+                const char *label, CharDriverState *chr);
- struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
-                 qemu_irq irq, omap_clk fclk, omap_clk iclk,
--                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr);
-+                qemu_irq txdma, qemu_irq rxdma,
-+                const char *label, CharDriverState *chr);
- void omap_uart_reset(struct omap_uart_s *s);
- void omap_uart_attach(struct omap_uart_s *s, CharDriverState *chr);
- 
-diff --git a/hw/omap1.c b/hw/omap1.c
-index 06370b6..1ee5514 100644
---- a/hw/omap1.c
-+++ b/hw/omap1.c
-@@ -3809,16 +3809,19 @@ struct omap_mpu_state_s *omap310_mpu_init(unsigned long sdram_size,
-                     omap_findclk(s, "uart1_ck"),
-                     omap_findclk(s, "uart1_ck"),
-                     s->drq[OMAP_DMA_UART1_TX], s->drq[OMAP_DMA_UART1_RX],
-+                    "uart1",
-                     serial_hds[0]);
-     s->uart[1] = omap_uart_init(0xfffb0800, s->irq[1][OMAP_INT_UART2],
-                     omap_findclk(s, "uart2_ck"),
-                     omap_findclk(s, "uart2_ck"),
-                     s->drq[OMAP_DMA_UART2_TX], s->drq[OMAP_DMA_UART2_RX],
-+                    "uart2",
-                     serial_hds[0] ? serial_hds[1] : NULL);
-     s->uart[2] = omap_uart_init(0xfffb9800, s->irq[0][OMAP_INT_UART3],
-                     omap_findclk(s, "uart3_ck"),
-                     omap_findclk(s, "uart3_ck"),
-                     s->drq[OMAP_DMA_UART3_TX], s->drq[OMAP_DMA_UART3_RX],
-+                    "uart3",
-                     serial_hds[0] && serial_hds[1] ? serial_hds[2] : NULL);
- 
-     omap_dpll_init(&s->dpll[0], 0xfffecf00, omap_findclk(s, "dpll1"));
-diff --git a/hw/omap2.c b/hw/omap2.c
-index 179075e..e35a56e 100644
---- a/hw/omap2.c
-+++ b/hw/omap2.c
-@@ -2291,13 +2291,16 @@ struct omap_mpu_state_s *omap2420_mpu_init(unsigned long sdram_size,
-                     omap_findclk(s, "uart1_fclk"),
-                     omap_findclk(s, "uart1_iclk"),
-                     s->drq[OMAP24XX_DMA_UART1_TX],
--                    s->drq[OMAP24XX_DMA_UART1_RX], serial_hds[0]);
-+                    s->drq[OMAP24XX_DMA_UART1_RX],
-+                    "uart1",
-+                    serial_hds[0]);
-     s->uart[1] = omap2_uart_init(omap_l4ta(s->l4, 20),
-                     s->irq[0][OMAP_INT_24XX_UART2_IRQ],
-                     omap_findclk(s, "uart2_fclk"),
-                     omap_findclk(s, "uart2_iclk"),
-                     s->drq[OMAP24XX_DMA_UART2_TX],
-                     s->drq[OMAP24XX_DMA_UART2_RX],
-+                    "uart2",
-                     serial_hds[0] ? serial_hds[1] : NULL);
-     s->uart[2] = omap2_uart_init(omap_l4ta(s->l4, 21),
-                     s->irq[0][OMAP_INT_24XX_UART3_IRQ],
-@@ -2305,6 +2308,7 @@ struct omap_mpu_state_s *omap2420_mpu_init(unsigned long sdram_size,
-                     omap_findclk(s, "uart3_iclk"),
-                     s->drq[OMAP24XX_DMA_UART3_TX],
-                     s->drq[OMAP24XX_DMA_UART3_RX],
-+                    "uart3",
-                     serial_hds[0] && serial_hds[1] ? serial_hds[2] : NULL);
- 
-     s->gptimer[0] = omap_gp_timer_init(omap_l4ta(s->l4, 7),
-diff --git a/hw/omap_uart.c b/hw/omap_uart.c
-index 395bf0c..cc66cd9 100644
---- a/hw/omap_uart.c
-+++ b/hw/omap_uart.c
-@@ -51,7 +51,8 @@ void omap_uart_reset(struct omap_uart_s *s)
- 
- struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
-                 qemu_irq irq, omap_clk fclk, omap_clk iclk,
--                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr)
-+                qemu_irq txdma, qemu_irq rxdma,
-+                const char *label, CharDriverState *chr)
- {
-     struct omap_uart_s *s = (struct omap_uart_s *)
-             qemu_mallocz(sizeof(struct omap_uart_s));
-@@ -61,11 +62,11 @@ struct omap_uart_s *omap_uart_init(target_phys_addr_t base,
-     s->irq = irq;
- #ifdef TARGET_WORDS_BIGENDIAN
-     s->serial = serial_mm_init(base, 2, irq, omap_clk_getrate(fclk)/16,
--                               chr ?: qemu_chr_open("null", "null", NULL), 1,
-+                               chr ?: qemu_chr_open(label, "null", NULL), 1,
-                                1);
- #else
-     s->serial = serial_mm_init(base, 2, irq, omap_clk_getrate(fclk)/16,
--                               chr ?: qemu_chr_open("null", "null", NULL), 1,
-+                               chr ?: qemu_chr_open(label, "null", NULL), 1,
-                                0);
- #endif
-     return s;
-@@ -162,11 +163,12 @@ static CPUWriteMemoryFunc * const omap_uart_writefn[] = {
- 
- struct omap_uart_s *omap2_uart_init(struct omap_target_agent_s *ta,
-                 qemu_irq irq, omap_clk fclk, omap_clk iclk,
--                qemu_irq txdma, qemu_irq rxdma, CharDriverState *chr)
-+                qemu_irq txdma, qemu_irq rxdma,
-+                const char *label, CharDriverState *chr)
- {
-     target_phys_addr_t base = omap_l4_attach(ta, 0, 0);
-     struct omap_uart_s *s = omap_uart_init(base, irq,
--                    fclk, iclk, txdma, rxdma, chr);
-+                    fclk, iclk, txdma, rxdma, label, chr);
-     int iomemtype = cpu_register_io_memory(omap_uart_readfn,
-                     omap_uart_writefn, s);
- 
--- 
-1.7.2.3
-
diff --git a/emulators/qemu-devel/files/patch-qemu-timer.h b/emulators/qemu-devel/files/patch-qemu-timer.h
new file mode 100644
index 000000000000..998a7aca5d50
--- /dev/null
+++ b/emulators/qemu-devel/files/patch-qemu-timer.h
@@ -0,0 +1,13 @@
+--- a/qemu-timer.h
++++ b/qemu-timer.h
+@@ -4,6 +4,10 @@
+ #include "qemu-common.h"
+ #include <time.h>
+ #include <sys/time.h>
++#ifdef __FreeBSD__	/* for __FreeBSD_version */
++#include <sys/param.h>
++#endif
++#include <sys/time.h>
+ 
+ #ifdef _WIN32
+ #include <windows.h>
diff --git a/emulators/qemu-devel/files/patch-tapclose b/emulators/qemu-devel/files/patch-tapclose
index 8a96e3592a05..a5b8dfb0bf3f 100644
--- a/emulators/qemu-devel/files/patch-tapclose
+++ b/emulators/qemu-devel/files/patch-tapclose
@@ -1,5 +1,5 @@
 Index: qemu/net/tap.c
-@@ -254,12 +254,12 @@ static void tap_cleanup(VLANClientState 
+@@ -287,12 +287,13 @@ static void tap_cleanup(VLANClientState 
  
      qemu_purge_queued_packets(nc);
  
@@ -11,7 +11,8 @@ Index: qemu/net/tap.c
      close(s->fd);
 +
 +    if (s->down_script[0])
-+        launch_script(s->down_script, s->down_script_arg, -1);
++        launch_script(s->down_script, s->down_script_arg, s->fd);
++
+     s->fd = -1;
  }
  
- /* fd support */
diff --git a/emulators/qemu-devel/files/pcap-patch b/emulators/qemu-devel/files/pcap-patch
index 509cf9516843..137f54e42331 100644
--- a/emulators/qemu-devel/files/pcap-patch
+++ b/emulators/qemu-devel/files/pcap-patch
@@ -1,25 +1,25 @@
 --- configure.orig	2010-01-29 14:36:00.000000000 -0500
 +++ configure	2010-01-29 14:36:00.000000000 -0500
-@@ -257,6 +257,9 @@ pkgversion=""
- check_utests="no"
- user_pie="no"
- zero_malloc=""
+@@ -174,6 +174,9 @@ trace_backend="nop"
+ trace_file="trace"
+ spice=""
+ rbd=""
 +pcap="no"
 +pcap_create="no"
 +bpf="no"
  
- # OS specific
- if check_define __linux__ ; then
-@@ -492,6 +495,8 @@ for opt do
+ # parse CC options first
+ for opt do
+@@ -592,6 +595,8 @@ for opt do
    ;;
-   --enable-vnc-sasl) vnc_sasl="yes"
+   --enable-vnc-thread) vnc_thread="yes"
    ;;
 +  --enable-pcap) pcap="yes"
 +  ;;
    --disable-slirp) slirp="no"
    ;;
    --disable-uuid) uuid="no"
-@@ -1041,6 +1046,49 @@ EOF
+@@ -1269,6 +1274,49 @@ EOF
  fi
  
  ##########################################
@@ -69,7 +69,7 @@
  # VNC TLS detection
  if test "$vnc_tls" != "no" ; then
    cat > $TMPC <<EOF
-@@ -1976,6 +2024,15 @@ fi
+@@ -2565,6 +2613,15 @@ fi
  if test $profiler = "yes" ; then
    echo "CONFIG_PROFILER=y" >> $config_host_mak
  fi
@@ -84,7 +84,7 @@
 +fi
  if test "$slirp" = "yes" ; then
    echo "CONFIG_SLIRP=y" >> $config_host_mak
-   QEMU_CFLAGS="-I\$(SRC_PATH)/slirp $QEMU_CFLAGS"
+   QEMU_INCLUDES="-I\$(SRC_PATH)/slirp $QEMU_INCLUDES"
 --- net.h.orig	2010-01-29 14:36:00.000000000 -0500
 +++ net.h	2010-01-29 14:36:00.000000000 -0500
 @@ -33,7 +33,8 @@ typedef enum {
diff --git a/emulators/qemu-devel/pkg-message b/emulators/qemu-devel/pkg-message
index 7411d72c4b8f..0d6b8f58b8e4 100644
--- a/emulators/qemu-devel/pkg-message
+++ b/emulators/qemu-devel/pkg-message
@@ -21,29 +21,32 @@ FreeBSD host notes
   kernel'...)  Enabling /dev/rtc doesn't seem to help either (not included
   since it needs a patch to emulators/rtc.)
 
-- update: the above problem has gotten worse with FreeBSD guests somewhere
-  before 8.0, mainly since the kernel now usually wants double or even
-  quadruple number of timer irqs compared to HZ if it detects an apic (and at
-  least early versions of FreeBSD 8 had a bug that essentially halved qemu's
-  clock rate too); the only reason you usually don't see symptoms of this with
-  FreeBSD 8 guests is they automatically reduce their HZ to 100 when running
+- Update: the above problem has gotten worse with FreeBSD guests
+  somewhere before 8.0, mainly since the kernel now usually wants
+  double or even quadruple number of timer irqs compared to HZ if
+  it detects an apic (and at least early versions of FreeBSD 8 had
+  a bug that essentially halved qemu's clock rate too); the only
+  reason you usually don't see symptoms of this with FreeBSD 8
+  guests is they automatically reduce their HZ to 100 when running
   in a VM while the default for the host kernel is still HZ=1000.
-  workarounds:  for i386 guests you can disable the apic in the guest by
-  setting
+  Workaround: you can disable the apic clock in the guest by setting
 
-	hint.apic.0.disabled=1
+	hint.apic.0.clock="0"
 
-  in loader.conf(5) (or manually at the loader prompt), otherwise the only thing
-  you can do is either reduce the guest's HZ to, say, 100 by setting e.g.
+  in loader.conf(5) (or manually at the loader prompt), if that
+  doesn't work the only things you can do is either reduce the
+  guest's HZ to, say, 100 by setting e.g.
 
 	kern.hz="100"
 
-  from the loader as above (which usually is a good idea in a VM anyway and
-  FreeBSD 8 now does by itself as mentioned), or if that's not possible
-  increase the host's HZ to 2000 or even 4000 from the loader in the same way.
+  from the loader as above (which usually is a good idea in a VM
+  anyway and FreeBSD 8 now does by itself as mentioned), or otherwise
+  increase the host's HZ to 2000 or even 4000 from the loader in
+  the same way.
 
-- The -smb option (smb-export local dir to guest) needs the net/samba3
-  port/package installed in addition to qemu.
+- The -smb option (smb-export local dir to guest using the default
+  slirp networking) needs the net/samba34 port/package installed
+  in addition to qemu.
 
 - If you want to use usb devices connected to the host in the guest
   (usb_add host:... monitor command; this doesn't work on FreeBSD 8 and
@@ -73,27 +76,22 @@ FreeBSD host notes
   guests or other weird cdrom problems then thats probably because the guest
   has atapicam loaded, which for reasons still to be determined has problems
   with qemu's now by default enabled cdrom dma.  You can build the port with
-  CDROM_DMA disabled to disable it.
+  CDROM_DMA disabled to disable it.  [Looks like this is fixed in recent
+  FreeBSD guest versions.]
 
 - If you build qemu wihout SDL and then get crashes running it try passing it
   -nographic.  This should probably be default in that case...
 
-- Perhaps it should be noted that if you want to use qemu with -m 512 or
-  larger on 6.x/i386 hosts you need to increase the kern.maxdsiz tunable in
-  loader.conf(5) since the default is 512 MB, and qemu needs memory for itself
-  also.  (7.0 and up now use jemalloc which uses mmap(2) and isn't affected by
-  kern.maxdsiz anymore.)
-
 - qemu's network boot roms (-boot n) have a bug when bootfiles sizes are a
   multiple of blksize, if this affects you (like with FreeBSD's /boot/pxeboot)
   you can do like
 
 	cp /boot/pxeboot pxeboot-qemu && chmod +w pxeboot-qemu && echo >>pxeboot-qemu
 
-  and then use pxeboot-qemu.  Actually you need latest -stable or -current btx
-  code (from after 7.0 was released) because of the real mode boot problem, so
-  use at least pxeboot from there.  And I just did that for the pxeboot
-  extracted out of
+  and then use pxeboot-qemu.  Actually you need recent btx code
+  (from after 7.0 was released) because of the real mode boot
+  problem, so use at least pxeboot from there.  And I just did that
+  for the pxeboot extracted out of
 
 	ftp://ftp.freebsd.org/pub/FreeBSD/snapshots/200805/7.0-STABLE-200805-i386-bootonly.iso
 
@@ -105,9 +103,6 @@ FreeBSD host notes
   and you are not running qemu as root, then mountd(8) on the exporting box
   needs to be run with -n in order to accept requests from ports >= 1024.
 
-- The new (optional) pcap code cannot talk to the host on 6.x because the
-  necessary bpf feature (BIOCFEEDBACK) hasn't (yet?) been merged there.
-
 - (not FreeBSD-specific:) There have been reports of qcow2 corruption with (at
   least) win2k guests on recent kvm (which uses similar qcow2 code than qemu
   now, see this thread:
diff --git a/emulators/qemu-devel/pkg-plist b/emulators/qemu-devel/pkg-plist
index b90f2edede40..8c42f0990522 100644
--- a/emulators/qemu-devel/pkg-plist
+++ b/emulators/qemu-devel/pkg-plist
@@ -38,18 +38,19 @@ etc/qemu/target-x86_64.conf.sample
 %%DATADIR%%/bios.bin
 %%DATADIR%%/vgabios.bin
 %%DATADIR%%/vgabios-cirrus.bin
+%%DATADIR%%/vgabios-qxl.bin
+%%DATADIR%%/vgabios-stdvga.bin
+%%DATADIR%%/vgabios-vmware.bin
 %%DATADIR%%/ppc_rom.bin
 %%DATADIR%%/openbios-ppc
 %%DATADIR%%/openbios-sparc32
 %%DATADIR%%/openbios-sparc64
-%%DATADIR%%/video.x
 %%DATADIR%%/pxe-e1000.bin
 %%DATADIR%%/pxe-ne2k_pci.bin
 %%DATADIR%%/pxe-rtl8139.bin
 %%DATADIR%%/pxe-pcnet.bin
 %%DATADIR%%/pxe-virtio.bin
 %%DATADIR%%/gpxe-eepro100-80861209.rom
-%%DATADIR%%/gpxe-eepro100-80861229.rom
 %%DATADIR%%/s390-zipl.rom
 %%DATADIR%%/linuxboot.bin
 %%DATADIR%%/multiboot.bin