36 files changed, 983 insertions, 1801 deletions

diff --git a/emulators/qemu/Makefile b/emulators/qemu/Makefile
index 8f8fd0c60447..2d594aa7fd71 100644
--- a/emulators/qemu/Makefile
+++ b/emulators/qemu/Makefile
@@ -6,15 +6,12 @@
 #
 
 PORTNAME=	qemu
-PORTVERSION=	0.9.1
-PORTREVISION=	11
+PORTVERSION=	0.10.0
 CATEGORIES=	emulators
-MASTER_SITES=	http://bellard.org/qemu/:release \
-		http://qemu.org/:release \
-		http://people.freebsd.org/~maho/qemu/:misc
-DISTFILES=	${DISTNAME}${EXTRACT_SUFX}:release
+MASTER_SITES=	${MASTER_SITE_SAVANNAH} \
+		http://bellard.org/qemu/
+MASTER_SITE_SUBDIR=	qemu
 DIST_SUBDIR=	qemu
-EXTRACT_ONLY=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER=	nox@FreeBSD.org
 COMMENT=	QEMU CPU Emulator
@@ -22,9 +19,7 @@ COMMENT=	QEMU CPU Emulator
 HAS_CONFIGURE=	yes
 USE_GMAKE=	yes
 USE_PERL5=	yes
-USE_GCC=	3.4
-PATCH_STRIP=	-lp1
-CONFIGURE_ARGS+=	--prefix=${PREFIX} --cc=${CC}
+PATCH_STRIP=	-p1
 MAKE_ENV+=	BSD_MAKE="${MAKE}" LDFLAGS="${LDFLAGS}"
 MAN1=		qemu.1 qemu-img.1
 ONLY_FOR_ARCHS=	amd64 i386
@@ -35,12 +30,23 @@ OPTIONS=	KQEMU "Build with (alpha!) accelerator module" Off \
 		SAMBA "samba dependency (for -smb)" Off \
 		SDL "SDL/X dependency (graphical output)" On \
 		GNUTLS "gnutls dependency (vnc encryption)" On \
-		CDROM_DMA "IDE CDROM DMA" On
+		PCAP "pcap dependency (networking with bpf)" On \
+		CDROM_DMA "IDE CDROM DMA" On \
+		ADD_AUDIO "Emulate more audio hardware (experimental!)" Off \
+		ALL_TARGETS "Also build non-x86 targets" On
 
 .include <bsd.port.pre.mk>
 
+.if defined(WITHOUT_ALL_TARGETS)
+CONFIGURE_ARGS+=       --target-list=i386-softmmu,x86_64-softmmu
+PLIST_SUB+=    ALLTARGETS="@comment "
+.else
+PLIST_SUB+=    ALLTARGETS=""
+.endif
+
 WITHOUT_CPU_CFLAGS=yes	#to avoid problems with register allocation
 CFLAGS:=	${CFLAGS:C/-fno-tree-vrp//}
+CONFIGURE_ARGS+=	--prefix=${PREFIX} --cc=${CC}
 
 .if defined(WITHOUT_SDL)
 CONFIGURE_ARGS+=	--disable-sdl --disable-gfx-check
@@ -49,13 +55,17 @@ USE_SDL=	sdl
 .endif
 
 .if defined(WITHOUT_GNUTLS)
-CONFIGURE_ARGS+=       --disable-vnc-tls
+CONFIGURE_ARGS+=	--disable-vnc-tls
 .else
 LIB_DEPENDS+=	gnutls:${PORTSDIR}/security/gnutls
 .endif
 
-.if defined (WITH_HACKS_CIRRUS) || defined (WITH_HACKS)
-DISTFILES+=	patch3_cirrus:misc
+.if defined(WITH_PCAP)
+CONFIGURE_ARGS+=	--enable-pcap
+.endif
+
+.if defined(WITH_ADD_AUDIO)
+CONFIGURE_ARGS+=	--audio-card-list=ac97,es1370,sb16,cs4231a,adlib,gus
 .endif
 
 .if defined(WITH_SAMBA)
@@ -63,7 +73,7 @@ RUN_DEPENDS+=	${LOCALBASE}/sbin/smbd:${PORTSDIR}/net/samba3
 .endif
 
 .if defined(WITH_KQEMU)
-BUILD_DEPENDS+=	kqemu-kmod>=1.3.0pre5:${PORTSDIR}/emulators/kqemu-kmod
+BUILD_DEPENDS+=	kqemu-kmod-devel>=1.4.0pre1:${PORTSDIR}/emulators/kqemu-kmod-devel
 .else
 CONFIGURE_ARGS+=	--disable-kqemu
 .endif
@@ -92,6 +102,9 @@ post-patch:
 .if defined(WITH_RTL8139_TIMER)
 	@cd ${WRKSRC} && ${PATCH} --quiet < ${FILESDIR}/rtl8139-re-patch
 .endif
+.if defined(WITH_PCAP)
+	@cd ${WRKSRC} && ${PATCH} --quiet < ${FILESDIR}/pcap-patch
+.endif
 .if defined(WITHOUT_CDROM_DMA)
 	@cd ${WRKSRC} && ${PATCH} --quiet < ${FILESDIR}/cdrom-dma-patch
 .endif
diff --git a/emulators/qemu/distinfo b/emulators/qemu/distinfo
index 48e6e01d2c0c..c86741bd8259 100644
--- a/emulators/qemu/distinfo
+++ b/emulators/qemu/distinfo
@@ -1,6 +1,3 @@
-MD5 (qemu/qemu-0.9.1.tar.gz) = 6591df8e9270eb358c881de4ebea1262
-SHA256 (qemu/qemu-0.9.1.tar.gz) = 4756d0b4a4dc7dd88354bc6b37d381e4462dd328d0feef94803e90c0455835a5
-SIZE (qemu/qemu-0.9.1.tar.gz) = 2804104
-MD5 (qemu/patch3_cirrus) = ebe7ed9fce804c49e024bc93bfdfc810
-SHA256 (qemu/patch3_cirrus) = e862371834b7d895a896fbdb84fd9f70d17b5729a6f6789a48a61504fc941e11
-SIZE (qemu/patch3_cirrus) = 8817
+MD5 (qemu/qemu-0.10.0.tar.gz) = 8dc50b834fa3f5f6a17d7bc3d0559e53
+SHA256 (qemu/qemu-0.10.0.tar.gz) = 3c5ecf320996ad243b7adc4798ad5dbfd58a6d5562cc0317a4cde7c7fb3edbb2
+SIZE (qemu/qemu-0.10.0.tar.gz) = 3657649
diff --git a/emulators/qemu/files/patch-90_security b/emulators/qemu/files/patch-90_security
index 8de4cb5949f3..4df76e9b5e39 100644
--- a/emulators/qemu/files/patch-90_security
+++ b/emulators/qemu/files/patch-90_security
@@ -1,148 +1,3 @@
-Index: qemu-0.8.2/hw/cirrus_vga.c
-@@ -217,6 +217,20 @@
- #define CIRRUS_HOOK_NOT_HANDLED 0
- #define CIRRUS_HOOK_HANDLED 1
- 
-+#define BLTUNSAFE(s) \
-+    ( \
-+        ( /* check dst is within bounds */ \
-+            (s)->cirrus_blt_height * (s)->cirrus_blt_dstpitch \
-+                + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
-+                    (s)->vram_size \
-+        ) || \
-+        ( /* check src is within bounds */ \
-+            (s)->cirrus_blt_height * (s)->cirrus_blt_srcpitch \
-+                + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
-+                    (s)->vram_size \
-+        ) \
-+    )
-+
- struct CirrusVGAState;
- typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
-                                      uint8_t * dst, const uint8_t * src,
-@@ -636,7 +650,7 @@
- 
-     for (y = 0; y < lines; y++) {
- 	off_cur = off_begin;
--	off_cur_end = off_cur + bytesperline;
-+	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
- 	off_cur &= TARGET_PAGE_MASK;
- 	while (off_cur < off_cur_end) {
- 	    cpu_physical_memory_set_dirty(s->vram_offset + off_cur);
-@@ -651,7 +665,11 @@
- {
-     uint8_t *dst;
- 
--    dst = s->vram_ptr + s->cirrus_blt_dstaddr;
-+    dst = s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
-+ 
-+    if (BLTUNSAFE(s))
-+        return 0;
-+
-     (*s->cirrus_rop) (s, dst, src,
-                       s->cirrus_blt_dstpitch, 0, 
-                       s->cirrus_blt_width, s->cirrus_blt_height);
-@@ -667,8 +685,11 @@
- {
-     cirrus_fill_t rop_func;
- 
-+    if (BLTUNSAFE(s))
-+        return 0;
-+
-     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
--    rop_func(s, s->vram_ptr + s->cirrus_blt_dstaddr, 
-+    rop_func(s, s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask), 
-              s->cirrus_blt_dstpitch,
-              s->cirrus_blt_width, s->cirrus_blt_height);
-     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
-@@ -687,8 +708,8 @@
- static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
- {
-     return cirrus_bitblt_common_patterncopy(s,
--					    s->vram_ptr + 
--                                            (s->cirrus_blt_srcaddr & ~7));
-+					    s->vram_ptr + ((s->cirrus_blt_srcaddr & ~7) & 
-+                        s->cirrus_addr_mask));
- }
- 
- static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-@@ -738,8 +759,10 @@
-     if (notify)
- 	vga_hw_update();
- 
--    (*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
--		      s->vram_ptr + s->cirrus_blt_srcaddr,
-+    (*s->cirrus_rop) (s, s->vram_ptr + 
-+                (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
-+		      s->vram_ptr + 
-+                (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
- 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
- 		      s->cirrus_blt_width, s->cirrus_blt_height);
- 
-@@ -765,8 +788,14 @@
- 		       s->cirrus_blt_srcaddr - s->start_addr,
- 		       s->cirrus_blt_width, s->cirrus_blt_height);
-     } else {
--	(*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
--			  s->vram_ptr + s->cirrus_blt_srcaddr,
-+
-+    if (BLTUNSAFE(s))
-+        return 0;
-+
-+	(*s->cirrus_rop) (s, s->vram_ptr + 
-+                (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
-+			  s->vram_ptr + 
-+                (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
- 			  s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
- 			  s->cirrus_blt_width, s->cirrus_blt_height);
- 
-@@ -798,8 +827,9 @@
-         } else {
-             /* at least one scan line */
-             do {
--                (*s->cirrus_rop)(s, s->vram_ptr + s->cirrus_blt_dstaddr,
--                                 s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
-+                (*s->cirrus_rop)(s, s->vram_ptr + 
-+                    (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
-+                        s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
-                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
-                                          s->cirrus_blt_width, 1);
-                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
-@@ -1917,7 +1947,7 @@
-     unsigned val = mem_value;
-     uint8_t *dst;
- 
--    dst = s->vram_ptr + offset;
-+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
-     for (x = 0; x < 8; x++) {
- 	if (val & 0x80) {
- 	    *dst = s->cirrus_shadow_gr1;
-@@ -1940,7 +1970,7 @@
-     unsigned val = mem_value;
-     uint8_t *dst;
- 
--    dst = s->vram_ptr + offset;
-+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
-     for (x = 0; x < 8; x++) {
- 	if (val & 0x80) {
- 	    *dst = s->cirrus_shadow_gr1;
-Index: qemu-0.8.2/hw/cirrus_vga_rop.h
-===================================================================
---- qemu-0.8.2.orig/hw/cirrus_vga_rop.h	2006-07-22 20:23:34.000000000 +0300
-+++ qemu-0.8.2/hw/cirrus_vga_rop.h	2007-04-20 06:05:59.000000000 +0300
-@@ -31,6 +31,12 @@ glue(cirrus_bitblt_rop_fwd_, ROP_NAME)(C
-     int x,y;
-     dstpitch -= bltwidth;
-     srcpitch -= bltwidth;
-+
-+    if (dstpitch < 0 || srcpitch < 0) {
-+        /* is 0 valid? srcpitch == 0 could be useful */
-+        return;
-+    }
-+
-     for (y = 0; y < bltheight; y++) {
-         for (x = 0; x < bltwidth; x++) {
-             ROP_OP(*dst, *src);
 Index: qemu-0.8.2/hw/dma.c
 ===================================================================
 --- qemu-0.8.2.orig/hw/dma.c	2006-07-22 20:23:34.000000000 +0300
@@ -162,21 +17,27 @@ Index: qemu-0.8.2/hw/dma.c
      ldebug ("dma_pos %d size %d\n", n, (r->base[COUNT] + 1) << ncont);
  }
  
-Index: qemu-0.8.2/hw/fdc.c
-@@ -1247,7 +1247,12 @@
-             len = fdctrl->data_len - fdctrl->data_pos;
-             if (len > FD_SECTOR_LEN)
-                 len = FD_SECTOR_LEN;
--            bdrv_read(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1);
-+            if (cur_drv->bs) {
-+                bdrv_read(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1);
-+            } else {
-+                FLOPPY_ERROR("can't read data from drive\n");
-+                return 0;
-+           }
-         }
-     }
-     retval = fdctrl->fifo[pos];
+Index: qemu/hw/fdc.c
+@@ -1322,7 +1322,8 @@
+                                    fd_sector(cur_drv));
+                     return 0;
+                 }
+-            if (bdrv_read(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {
++            if (cur_drv->bs == NULL ||
++                bdrv_read(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {
+                 FLOPPY_DPRINTF("error getting sector %d\n",
+                                fd_sector(cur_drv));
+                 /* Sure, image size is too small... */
+@@ -1776,7 +1777,8 @@
+         if (pos == FD_SECTOR_LEN - 1 ||
+             fdctrl->data_pos == fdctrl->data_len) {
+             cur_drv = get_cur_drv(fdctrl);
+-            if (bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {
++            if (cur_drv->bs == NULL ||
++                bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {
+                 FLOPPY_ERROR("writing sector %d\n", fd_sector(cur_drv));
+                 return;
+             }
 Index: qemu-0.8.2/hw/pc.c
 ===================================================================
 --- qemu-0.8.2.orig/hw/pc.c	2007-04-20 06:05:58.000000000 +0300
@@ -219,100 +80,6 @@ Index: qemu-0.8.2/hw/sb16.c
      }
  
      return dma_pos;
-Index: qemu-0.8.2/slirp/slirp.c
-===================================================================
---- qemu-0.8.2.orig/slirp/slirp.c	2006-07-22 20:23:34.000000000 +0300
-+++ qemu-0.8.2/slirp/slirp.c	2007-04-20 06:05:59.000000000 +0300
-@@ -611,6 +611,10 @@ void slirp_input(const uint8_t *pkt, int
-         if (!m)
-             return;
-         /* Note: we add to align the IP header */
-+        /* taviso: large values in ne2k TCNT register may exceed msize on transmit */
-+        if (M_FREEROOM(m) < pkt_len + 2) {
-+            m_inc(m, pkt_len + 2);
-+        }
-         m->m_len = pkt_len + 2;
-         memcpy(m->m_data + 2, pkt, pkt_len);
- 
-Index: qemu-0.8.2/target-i386/translate.c
-===================================================================
---- qemu-0.8.2.orig/target-i386/translate.c	2006-07-22 20:23:34.000000000 +0300
-+++ qemu-0.8.2/target-i386/translate.c	2007-04-20 06:05:59.000000000 +0300
-@@ -5292,6 +5297,7 @@ static target_ulong disas_insn(DisasCont
-         gen_jmp_im(pc_start - s->cs_base);
-         gen_op_into(s->pc - pc_start);
-         break;
-+#ifdef WANT_ICEBP
-     case 0xf1: /* icebp (undocumented, exits to external debugger) */
- #if 1
-         gen_debug(s, pc_start - s->cs_base);
-@@ -5301,6 +5307,7 @@ static target_ulong disas_insn(DisasCont
-         cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
- #endif
-         break;
-+#endif /* icebp */
-     case 0xfa: /* cli */
-         if (!s->vm86) {
-             if (s->cpl <= s->iopl) {
-Index: qemu-0.8.2/vl.c
-===================================================================
---- qemu-0.8.2.orig/vl.c	2007-04-20 06:05:59.000000000 +0300
-+++ qemu-0.8.2/vl.c	2007-04-20 06:05:59.000000000 +0300
-@@ -3139,8 +3139,8 @@ typedef struct NetSocketState {
-     VLANClientState *vc;
-     int fd;
-     int state; /* 0 = getting length, 1 = getting data */
--    int index;
--    int packet_len;
-+    unsigned int index;
-+    unsigned int packet_len;
-     uint8_t buf[4096];
-     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
- } NetSocketState;
-@@ -3171,7 +3171,8 @@ static void net_socket_receive_dgram(voi
- static void net_socket_send(void *opaque)
- {
-     NetSocketState *s = opaque;
--    int l, size, err;
-+    int size, err;
-+    unsigned l;
-     uint8_t buf1[4096];
-     const uint8_t *buf;
- 
-@@ -3210,7 +3211,15 @@ static void net_socket_send(void *opaque
-             l = s->packet_len - s->index;
-             if (l > size)
-                 l = size;
--            memcpy(s->buf + s->index, buf, l);
-+            if (s->index + l <= sizeof(s->buf)) {
-+                memcpy(s->buf + s->index, buf, l);
-+            } else {
-+                fprintf(stderr, "serious error: oversized packet received,"
-+                    "connection terminated.\n");
-+                s->state = 0;
-+                goto eoc;
-+            }
-+
-             s->index += l;
-             buf += l;
-             size -= l;
-Index: qemu/block.c
-@@ -539,8 +539,15 @@
-         return -ENOMEDIUM;
-     if (bs->read_only)
-         return -EACCES;
-+    if (sector_num < 0)
-+	return -EACCES;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);   
-+    }
-+    {
-+	unsigned int ns = sector_num * 512;
-+	if (ns < 0)
-+	    return -EACCES;
-     }
-     if (drv->bdrv_pwrite) {
-         int ret, len;
 Index: qemu/hw/i8259.c
 @@ -302,7 +302,8 @@
              s->init4 = val & 1;
diff --git a/emulators/qemu/files/patch-CVE-2008-0928 b/emulators/qemu/files/patch-CVE-2008-0928
deleted file mode 100644
index a6b07289c5c5..000000000000
--- a/emulators/qemu/files/patch-CVE-2008-0928
+++ /dev/null
@@ -1,260 +0,0 @@
-Index: qemu/block-qcow.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-qcow.c,v
-retrieving revision 1.15
-retrieving revision 1.16
-diff -u -p -u -p -r1.15 -r1.16
---- block-qcow.c	11 Nov 2007 02:51:16 -0000	1.15
-+++ block-qcow.c	11 Mar 2008 17:17:58 -0000	1.16
-@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b
-     int len, i, shift, ret;
-     QCowHeader header;
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
-Index: qemu/block-qcow2.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-qcow2.c,v
-retrieving revision 1.10
-retrieving revision 1.11
-diff -u -p -u -p -r1.10 -r1.11
---- block-qcow2.c	11 Nov 2007 02:51:16 -0000	1.10
-+++ block-qcow2.c	11 Mar 2008 17:17:58 -0000	1.11
-@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b
-     int len, i, shift, ret;
-     QCowHeader header;
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
-Index: qemu/block-vmdk.c
-===================================================================
-RCS file: /sources/qemu/qemu/block-vmdk.c,v
-retrieving revision 1.19
-retrieving revision 1.20
-diff -u -p -u -p -r1.19 -r1.20
---- block-vmdk.c	14 Jan 2008 03:48:37 -0000	1.19
-+++ block-vmdk.c	11 Mar 2008 17:17:58 -0000	1.20
-@@ -378,7 +378,7 @@ static int vmdk_open(BlockDriverState *b
-         flags = BDRV_O_RDONLY;
-     fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename);
- 
--    ret = bdrv_file_open(&s->hd, filename, flags);
-+    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
-     if (ret < 0)
-         return ret;
-     if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
-Index: qemu/block.c
-@@ -24,6 +24,9 @@
- #include "qemu-common.h"
- #ifndef QEMU_IMG
- #include "console.h"
-+extern int vm_running;
-+#else
-+int vm_running = 0;
- #endif
- #include "block_int.h"
- 
-@@ -124,6 +128,75 @@
-     }
- }
- 
-+static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
-+                                  int64_t sector_num, int nb_sectors)
-+{
-+    if (!vm_running)
-+        return 0;
-+
-+    return
-+        nb_sectors < 0 ||
-+        sector_num < 0 ||
-+        nb_sectors > bs->total_sectors ||
-+        sector_num > bs->total_sectors - nb_sectors;
-+}
-+
-+static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
-+                                int64_t offset, int count)
-+{
-+    int64_t size = bs->total_sectors << SECTOR_BITS;
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    return
-+        count < 0 ||
-+        size < 0 ||
-+        count > size ||
-+        offset > size - count;
-+}
-+
-+static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
-+                                  int64_t sector_num, int nb_sectors)
-+{
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    if (sector_num < 0 ||
-+        nb_sectors < 0)
-+        return 1;
-+
-+    if (sector_num > bs->total_sectors - nb_sectors) {
-+        if (bs->autogrow)
-+            bs->total_sectors = sector_num + nb_sectors;
-+        else
-+            return 1;
-+    }
-+    return 0;
-+}
-+
-+static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
-+                                int64_t offset, int count)
-+{
-+    int64_t size = bs->total_sectors << SECTOR_BITS;
-+
-+    if (!vm_running)
-+        return 0;
-+
-+    if (count < 0 ||
-+        offset < 0)
-+        return 1;
-+
-+    if (offset > size - count) {
-+        if (bs->autogrow)
-+            bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
-+        else
-+            return 1;
-+    }
-+    return 0;
-+}
-+
- 
- static void bdrv_register(BlockDriver *bdrv)
- {
-@@ -335,6 +389,10 @@ int bdrv_open2(BlockDriverState *bs, con
-     bs->read_only = 0;
-     bs->is_temporary = 0;
-     bs->encrypted = 0;
-+    bs->autogrow = 0;
-+
-+    if (flags & BDRV_O_AUTOGROW)
-+        bs->autogrow = 1;
- 
-     if (flags & BDRV_O_SNAPSHOT) {
-         BlockDriverState *bs1;
-@@ -379,6 +437,7 @@ int bdrv_open2(BlockDriverState *bs, con
-     }
-     bs->drv = drv;
-     bs->opaque = qemu_mallocz(drv->instance_size);
-+    bs->total_sectors = 0; /* driver will set if it does not do getlength */
-     if (bs->opaque == NULL && drv->instance_size > 0)
-         return -1;
-     /* Note: for compatibility, we open disk image files as RDWR, and
-@@ -444,6 +503,7 @@ void bdrv_close(BlockDriverState *bs)
-         bs->drv = NULL;
- 
-         /* call the change callback */
-+        bs->total_sectors = 0;
-         bs->media_changed = 1;
-         if (bs->change_cb)
-             bs->change_cb(bs->change_opaque);
-@@ -509,6 +569,8 @@ int bdrv_read(BlockDriverState *bs, int6
-     if (!drv)
-         return -ENOMEDIUM;
- 
-+    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-             memcpy(buf, bs->boot_sector_data, 512);
-         sector_num++;
-@@ -549,6 +611,8 @@ int bdrv_write(BlockDriverState *bs, int
-         return -ENOMEDIUM;
-     if (bs->read_only)
-         return -EACCES;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);
-     }
-@@ -674,6 +738,8 @@ int bdrv_pread(BlockDriverState *bs, int
-         return -ENOMEDIUM;
-     if (!drv->bdrv_pread)
-         return bdrv_pread_em(bs, offset, buf1, count1);
-+    if (bdrv_rd_badreq_bytes(bs, offset, count1))
-+        return -EDOM;
-     return drv->bdrv_pread(bs, offset, buf1, count1);
- }
- 
-@@ -689,6 +755,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
-         return -ENOMEDIUM;
-     if (!drv->bdrv_pwrite)
-         return bdrv_pwrite_em(bs, offset, buf1, count1);
-+    if (bdrv_wr_badreq_bytes(bs, offset, count1))
-+        return -EDOM;
-     return drv->bdrv_pwrite(bs, offset, buf1, count1);
- }
- 
-@@ -955,6 +1023,8 @@ int bdrv_write_compressed(BlockDriverSta
-         return -ENOMEDIUM;
-     if (!drv->bdrv_write_compressed)
-         return -ENOTSUP;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return -EDOM;
-     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
- }
- 
-@@ -1101,6 +1171,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
- 
-     if (!drv)
-         return NULL;
-+    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
-+        return NULL;
- 
-     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-@@ -1132,6 +1204,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
-         return NULL;
-     if (bs->read_only)
-         return NULL;
-+    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
-+        return NULL;
-     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
-         memcpy(bs->boot_sector_data, buf, 512);
-     }
-Index: qemu/block.h
-===================================================================
-RCS file: /sources/qemu/qemu/block.h,v
-retrieving revision 1.6
-retrieving revision 1.7
-diff -u -p -u -p -r1.6 -r1.7
---- block.h	24 Dec 2007 16:10:43 -0000	1.6
-+++ block.h	11 Mar 2008 17:17:59 -0000	1.7
-@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo {
-                                      it (default for
-                                      bdrv_file_open()) */
- #define BDRV_O_DIRECT      0x0020
-+#define BDRV_O_AUTOGROW    0x0040 /* Allow backing file to extend when writing past end of file */
- 
- #ifndef QEMU_IMG
- void bdrv_info(void);
-Index: qemu/block_int.h
-===================================================================
-RCS file: /sources/qemu/qemu/block_int.h,v
-retrieving revision 1.16
-retrieving revision 1.17
-diff -u -p -u -p -r1.16 -r1.17
---- block_int.h	24 Dec 2007 16:10:43 -0000	1.16
-+++ block_int.h	11 Mar 2008 17:17:59 -0000	1.17
-@@ -97,6 +97,7 @@ struct BlockDriverState {
-     int locked;    /* if true, the media cannot temporarily be ejected */
-     int encrypted; /* if true, the media is encrypted */
-     int sg;        /* if true, the device is a /dev/sg* */
-+    int autogrow;  /* if true, the backing store can auto-extend to allocate new extents */
-     /* event callback when inserting/removing */
-     void (*change_cb)(void *opaque);
-     void *change_opaque;
diff --git a/emulators/qemu/files/patch-CVE-2008-2004 b/emulators/qemu/files/patch-CVE-2008-2004
deleted file mode 100644
index 6b767fba39b3..000000000000
--- a/emulators/qemu/files/patch-CVE-2008-2004
+++ /dev/null
@@ -1,56 +0,0 @@
-Index: qemu/vl.c
-@@ -4886,13 +4886,14 @@
-     int bus_id, unit_id;
-     int cyls, heads, secs, translation;
-     BlockDriverState *bdrv;
-+    BlockDriver *drv = NULL;
-     int max_devs;
-     int index;
-     int cache;
-     int bdrv_flags;
-     char *params[] = { "bus", "unit", "if", "index", "cyls", "heads",
-                        "secs", "trans", "media", "snapshot", "file",
--                       "cache", NULL };
-+                       "cache", "format", NULL };
- 
-     if (check_params(buf, sizeof(buf), params, str) < 0) {
-          fprintf(stderr, "qemu: unknowm parameter '%s' in '%s'\n",
-@@ -5060,6 +5061,14 @@
-         }
-     }
- 
-+    if (get_param_value(buf, sizeof(buf), "format", str)) {
-+        drv = bdrv_find_format(buf);
-+        if (!drv) {
-+            fprintf(stderr, "qemu: '%s' invalid format\n", buf);
-+            return -1;
-+        }
-+    }
-+
-     get_param_value(file, sizeof(file), "file", str);
- 
-     /* compute bus and unit according index */
-@@ -5159,7 +5168,7 @@
-         bdrv_flags |= BDRV_O_SNAPSHOT;
-     if (!cache)
-         bdrv_flags |= BDRV_O_DIRECT;
--    if (bdrv_open(bdrv, file, bdrv_flags) < 0 || qemu_key_check(bdrv, file)) {
-+    if (bdrv_open2(bdrv, file, bdrv_flags, drv) < 0 || qemu_key_check(bdrv, file)) {
-         fprintf(stderr, "qemu: could not open disk image %s\n",
-                         file);
-         return -1;
-Index: qemu/qemu-doc.texi
-===================================================================
---- qemu-doc.texi	(revision 4276)
-+++ qemu-doc.texi	(revision 4277)
-@@ -261,6 +261,10 @@
- @var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
- @item cache=@var{cache}
- @var{cache} is "on" or "off" and allows to disable host cache to access data.
-+@item format=@var{format}
-+Specify which disk @var{format} will be used rather than detecting
-+the format.  Can be used to specifiy format=raw to avoid interpreting
-+an untrusted format header.
- @end table
- 
- Instead of @option{-cdrom} you can use:
diff --git a/emulators/qemu/files/patch-CVE-2008-4539 b/emulators/qemu/files/patch-CVE-2008-4539
deleted file mode 100644
index c2348bd4cf91..000000000000
--- a/emulators/qemu/files/patch-CVE-2008-4539
+++ /dev/null
@@ -1,27 +0,0 @@
-Index: qemu/hw/cirrus_vga.c
-===================================================================
---- trunk/hw/cirrus_vga.c	2008-11-01 00:53:30 UTC (rev 5586)
-+++ trunk/hw/cirrus_vga.c	2008-11-01 00:53:39 UTC (rev 5587)
-@@ -785,15 +785,14 @@
- 
- static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
- {
-+    if (BLTUNSAFE(s))
-+        return 0;
-+
-     if (s->ds->dpy_copy) {
- 	cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->start_addr,
- 		       s->cirrus_blt_srcaddr - s->start_addr,
- 		       s->cirrus_blt_width, s->cirrus_blt_height);
-     } else {
--
--    if (BLTUNSAFE(s))
--        return 0;
--
- 	(*s->cirrus_rop) (s, s->vram_ptr +
-                 (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 			  s->vram_ptr +
-
-
-
-
diff --git a/emulators/qemu/files/patch-Makefile b/emulators/qemu/files/patch-Makefile
index effe2d44222c..1de79c3bf095 100644
--- a/emulators/qemu/files/patch-Makefile
+++ b/emulators/qemu/files/patch-Makefile
@@ -1,24 +1,22 @@
 Index: qemu/Makefile
 @@ -19,7 +19,11 @@
- BASE_LDFLAGS += -static
+ LDFLAGS += -static
  endif
  ifdef BUILD_DOCS
 +ifdef NOPORTDOCS
-+DOCS=qemu.1 qemu-img.1
++DOCS=qemu.1 qemu-img.1 qemu-nbd.8
 +else
- DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1
+ DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8
 +endif
  else
  DOCS=
  endif
-@@ -60,8 +64,10 @@
- common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr
- 
- install-doc: $(DOCS)
-+ifndef NOPORTDOCS
- 	mkdir -p "$(DESTDIR)$(docdir)"
- 	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
-+endif
+@@ -225,8 +229,6 @@
  ifndef CONFIG_WIN32
  	mkdir -p "$(DESTDIR)$(mandir)/man1"
- 	$(INSTALL) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
+ 	$(INSTALL) -m 644 qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
+-	mkdir -p "$(DESTDIR)$(mandir)/man8"
+-	$(INSTALL) -m 644 qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
+ endif
+ 
+ install: all $(if $(BUILD_DOCS),install-doc)
diff --git a/emulators/qemu/files/patch-Makefile.target b/emulators/qemu/files/patch-Makefile.target
deleted file mode 100644
index 601f15c2e495..000000000000
--- a/emulators/qemu/files/patch-Makefile.target
+++ /dev/null
@@ -1,37 +0,0 @@
-Index: qemu/Makefile.target
-@@ -139,11 +139,11 @@
- endif
- endif
- 
--ifeq ($(ARCH),x86_64)
--  ifneq ($(CONFIG_SOLARIS),yes)
--    BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
--  endif
--endif
-+#ifeq ($(ARCH),x86_64)
-+#  ifneq ($(CONFIG_SOLARIS),yes)
-+#    BASE_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
-+#  endif
-+#endif
- 
- ifeq ($(ARCH),ppc)
- CPPFLAGS+= -D__powerpc__
-@@ -560,12 +560,12 @@
-   endif
- endif
- 
--ifeq ($(ARCH),x86_64)
--  VL_LDFLAGS+=-m64
--  ifneq ($(CONFIG_SOLARIS),yes)
--    VL_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
--  endif
--endif
-+#ifeq ($(ARCH),x86_64)
-+#  VL_LDFLAGS+=-m64
-+#  ifneq ($(CONFIG_SOLARIS),yes)
-+#    VL_LDFLAGS+=-Wl,-T,$(SRC_PATH)/$(ARCH).ld
-+#  endif
-+#endif
- 
- ifdef CONFIG_WIN32
- SDL_LIBS := $(filter-out -mwindows, $(SDL_LIBS)) -mconsole
diff --git a/emulators/qemu/files/patch-audio-4 b/emulators/qemu/files/patch-audio-4
deleted file mode 100644
index bb71885a2992..000000000000
--- a/emulators/qemu/files/patch-audio-4
+++ /dev/null
@@ -1,24 +0,0 @@
-Index: qemu/audio/audio_template.h
-@@ -32,6 +32,10 @@
- #define SW glue (SWVoice, In)
- #endif
- 
-+#ifndef UINT64_MAX		
-+#define UINT64_MAX		((uint64_t)(18446744073709551615ULL))
-+#endif
-+
- static void glue (audio_pcm_sw_fini_, TYPE) (SW *sw)
- {
-     glue (audio_pcm_sw_free_resources_, TYPE) (sw);
-Index: qemu/audio/audio.c
-@@ -36,6 +36,10 @@
- /* #define DEBUG_LIVE */
- /* #define DEBUG_OUT */
- 
-+#ifndef INT16_MAX		
-+#define INT16_MAX		(32767)
-+#endif
-+
- static struct audio_driver *drvtab[] = {
- #ifdef CONFIG_OSS
-     &oss_audio_driver,
diff --git a/emulators/qemu/files/patch-bc b/emulators/qemu/files/patch-bc
deleted file mode 100644
index 7ad83440d48b..000000000000
--- a/emulators/qemu/files/patch-bc
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: qemu/i386-dis.c
-@@ -2896,6 +2896,10 @@
-   OP_E (bytemode, sizeflag);
- }
- 
-+#ifndef PRIx64
-+#define PRIx64 "llx"
-+#endif
-+
- static void
- print_operand_value (buf, hex, disp)
-   char *buf;
diff --git a/emulators/qemu/files/patch-be b/emulators/qemu/files/patch-be
deleted file mode 100644
index a8a5ba663df3..000000000000
--- a/emulators/qemu/files/patch-be
+++ /dev/null
@@ -1,19 +0,0 @@
-Index: qemu/vl.c
-@@ -541,7 +541,7 @@
- static void init_get_clock(void)
- {
-     use_rt_clock = 0;
--#if defined(__linux__)
-+#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
-     {
-         struct timespec ts;
-         if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
-@@ -553,7 +553,7 @@
- 
- static int64_t get_clock(void)
- {
--#if defined(__linux__)
-+#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
-     if (use_rt_clock) {
-         struct timespec ts;
-         clock_gettime(CLOCK_MONOTONIC, &ts);
diff --git a/emulators/qemu/files/patch-bg b/emulators/qemu/files/patch-bg
index 7e645929d40e..d82921bd38f1 100644
--- a/emulators/qemu/files/patch-bg
+++ b/emulators/qemu/files/patch-bg
@@ -1,3 +1,13 @@
+Index: qemu/Makefile
+@@ -11,7 +11,7 @@
+ LDFLAGS += $(OS_LDFLAGS) $(ARCH_LDFLAGS)
+ 
+ CPPFLAGS += -I. -I$(SRC_PATH) -MMD -MP -MT $@
+-CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
++CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
+ LIBS=
+ ifdef CONFIG_STATIC
+ LDFLAGS += -static
 Index: qemu/Makefile.target
 @@ -179,7 +179,7 @@
  
@@ -8,8 +18,10 @@ Index: qemu/Makefile.target
  LIBS+=-lm
  ifndef CONFIG_USER_ONLY
  LIBS+=-lz
-Index: qemu/vl.c
-@@ -133,10 +133,12 @@
+Index: qemu/net.h
+@@ -99,12 +99,14 @@
+ int slirp_is_inited(void);
+ void net_client_check(void);
  
 -#define DEFAULT_NETWORK_SCRIPT "/etc/qemu-ifup"
 -#define DEFAULT_NETWORK_DOWN_SCRIPT "/etc/qemu-ifdown"
@@ -20,7 +32,7 @@ Index: qemu/vl.c
  #define SMBD_COMMAND "/usr/sfw/sbin/smbd"
  #else
  #define SMBD_COMMAND "/usr/sbin/smbd"
-+#endif
  #endif
++#endif
  
- //#define DEBUG_UNUSED_IOPORT
+ #endif
diff --git a/emulators/qemu/files/patch-block.c b/emulators/qemu/files/patch-block.c
deleted file mode 100644
index f607e8fe29c3..000000000000
--- a/emulators/qemu/files/patch-block.c
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/block.c
-@@ -381,7 +381,7 @@
-     else
-         open_flags = flags & ~(BDRV_O_FILE | BDRV_O_SNAPSHOT);
-     ret = drv->bdrv_open(bs, filename, open_flags);
--    if (ret == -EACCES && !(flags & BDRV_O_FILE)) {
-+    if ((ret == -EACCES || ret == -EPERM) && !(flags & BDRV_O_FILE)) {
-         ret = drv->bdrv_open(bs, filename, BDRV_O_RDONLY);
-         bs->read_only = 1;
-     }
diff --git a/emulators/qemu/files/patch-bsdusb.patch b/emulators/qemu/files/patch-bsdusb.patch
deleted file mode 100644
index e51144070a1d..000000000000
--- a/emulators/qemu/files/patch-bsdusb.patch
+++ /dev/null
@@ -1,691 +0,0 @@
-Index: qemu/configure
-@@ -139,6 +139,7 @@
- oss="yes"
- linux="yes"
- linux_user="yes"
-+usb="linux"
- if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
-     kqemu="yes"
- fi
-@@ -148,6 +149,7 @@
- if [ "$bsd" = "yes" ] ; then
-   if [ "$darwin" != "yes" ] ; then
-     make="gmake"
-+    usb="bsd"
-   fi
- fi
- 
-@@ -786,6 +788,19 @@
- fi
- 
- echo "#define CONFIG_UNAME_RELEASE \"$uname_release\"" >> $config_h
-+
-+# USB host support
-+case "$usb" in
-+linux)
-+  echo "HOST_USB=linux" >> $conig_mak
-+;;
-+bsd)
-+  echo "HOST_USB=bsd" >> $config_mak
-+;;
-+*)
-+  echo "HOST_USB=stub" >> $config_mak
-+;;
-+esac
- 
- for target in $target_list; do
- target_dir="$target"
-Index: qemu/Makefile
-@@ -61,7 +61,7 @@
- OBJS+=ssd0303.o ssd0323.o ads7846.o stellaris_input.o
- OBJS+=scsi-disk.o cdrom.o
- OBJS+=scsi-generic.o
--OBJS+=usb.o usb-hub.o usb-linux.o usb-hid.o usb-msd.o usb-wacom.o
-+OBJS+=usb.o usb-hub.o usb-$(HOST_USB).o usb-hid.o usb-msd.o usb-wacom.o
- OBJS+=sd.o ssi-sd.o
- 
- ifdef CONFIG_WIN32
-Index: qemu/usb-stub.c
-@@ -0,0 +1,11 @@
-+#include "vl.h"
-+
-+void usb_host_info(void)
-+{
-+    term_printf("USB host devices not supported\n");
-+}
-+
-+USBDevice *usb_host_device_open(const char *devname)
-+{
-+    return NULL;
-+}
-Index: qemu/usb-bsd.c
-@@ -0,0 +1,601 @@
-+/*
-+ * BSD host USB redirector
-+ *
-+ * Copyright (c) 2006 Lonnie Mendez
-+ * Portions of code and concepts borrowed from
-+ * usb-linux.c and libusb's bsd.c and are copyright their respective owners.
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu-common.h"
-+#include "hw/usb.h"
-+
-+/* usb.h declares these */
-+#undef USB_SPEED_HIGH
-+#undef USB_SPEED_FULL
-+#undef USB_SPEED_LOW
-+
-+#include <sys/ioctl.h>
-+#include <dev/usb/usb.h>
-+#include <signal.h>
-+
-+/* This value has maximum potential at 16.
-+ * You should also set hw.usb.debug to gain
-+ * more detailed view.
-+ */
-+//#define DEBUG
-+#define UGEN_DEBUG_LEVEL 0
-+
-+
-+typedef int USBScanFunc(void *opaque, int bus_num, int addr, int class_id,
-+                        int vendor_id, int product_id,
-+                        const char *product_name, int speed);
-+static int usb_host_find_device(int *pbus_num, int *paddr,
-+                                const char *devname);
-+
-+typedef struct USBHostDevice {
-+    USBDevice dev;
-+    int ep_fd[USB_MAX_ENDPOINTS];
-+    int devfd;
-+    char devpath[32];
-+} USBHostDevice;
-+
-+
-+static int ensure_ep_open(USBHostDevice *dev, int ep, int mode)
-+{
-+    char buf[32];
-+    int fd;
-+
-+    /* Get the address for this endpoint */
-+    ep = UE_GET_ADDR(ep);
-+
-+    if (dev->ep_fd[ep] < 0) {
-+#if __FreeBSD__
-+        snprintf(buf, sizeof(buf) - 1, "%s.%d", dev->devpath, ep);
-+#else
-+        snprintf(buf, sizeof(buf) - 1, "%s.%02d", dev->devpath, ep);
-+#endif
-+        /* Try to open it O_RDWR first for those devices which have in and out
-+         * endpoints with the same address (eg 0x02 and 0x82)
-+         */
-+        fd = open(buf, O_RDWR);
-+        if (fd < 0 && errno == ENXIO)
-+            fd = open(buf, mode);
-+        if (fd < 0) {
-+#ifdef DEBUG
-+            printf("ensure_ep_open: failed to open device endpoint %s: %s\n",
-+                   buf, strerror(errno));
-+#endif
-+        }
-+        dev->ep_fd[ep] = fd;
-+    }
-+
-+    return dev->ep_fd[ep];
-+}
-+
-+static void ensure_eps_closed(USBHostDevice *dev)
-+{
-+    int epnum = 1;
-+
-+    if (!dev)
-+        return;
-+
-+    while (epnum < USB_MAX_ENDPOINTS) {
-+        if (dev->ep_fd[epnum] >= 0) {
-+            close(dev->ep_fd[epnum]);
-+            dev->ep_fd[epnum] = -1;
-+        }
-+        epnum++;
-+    }
-+}
-+
-+static void usb_host_handle_reset(USBDevice *dev)
-+{
-+#if 0
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+#endif
-+}
-+
-+/* XXX:
-+ * -check device states against transfer requests
-+ *  and return appropriate response
-+ */
-+static int usb_host_handle_control(USBDevice *dev,
-+                                   int request,
-+                                   int value,
-+                                   int index,
-+                                   int length,
-+                                   uint8_t *data)
-+{
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+    struct usb_ctl_request req;
-+    struct usb_alt_interface aiface;
-+    int ret, timeout = 50;
-+
-+    if ((request >> 8) == UT_WRITE_DEVICE &&
-+        (request & 0xff) == UR_SET_ADDRESS) {
-+
-+        /* specific SET_ADDRESS support */
-+        dev->addr = value;
-+        return 0;
-+    } else if ((request >> 8) == UT_WRITE_DEVICE &&
-+               (request & 0xff) == UR_SET_CONFIG) {
-+
-+        ensure_eps_closed(s); /* can't do this without all eps closed */
-+
-+        ret = ioctl(s->devfd, USB_SET_CONFIG, &value);
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: failed to set configuration - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_STALL;
-+        }
-+
-+        return 0;
-+    } else if ((request >> 8) == UT_WRITE_INTERFACE &&
-+               (request & 0xff) == UR_SET_INTERFACE) {
-+
-+        aiface.uai_interface_index = index;
-+        aiface.uai_alt_no = value;
-+
-+        ensure_eps_closed(s); /* can't do this without all eps closed */
-+        ret = ioctl(s->devfd, USB_SET_ALTINTERFACE, &aiface);
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: failed to set alternate interface - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_STALL;
-+        }
-+
-+        return 0;
-+    } else {
-+        req.ucr_request.bmRequestType = request >> 8;
-+        req.ucr_request.bRequest = request & 0xff;
-+        USETW(req.ucr_request.wValue, value);
-+        USETW(req.ucr_request.wIndex, index);
-+        USETW(req.ucr_request.wLength, length);
-+        req.ucr_data = data;
-+        req.ucr_flags = USBD_SHORT_XFER_OK;
-+
-+        ret = ioctl(s->devfd, USB_SET_TIMEOUT, &timeout);
-+#if (__NetBSD__ || __OpenBSD__)
-+        if (ret < 0 && errno != EINVAL) {
-+#else
-+        if (ret < 0) {
-+#endif
-+#ifdef DEBUG
-+            printf("handle_control: setting timeout failed - %s\n",
-+                   strerror(errno));
-+#endif
-+        }
-+
-+        ret = ioctl(s->devfd, USB_DO_REQUEST, &req);
-+        /* ugen returns EIO for usbd_do_request_ no matter what
-+         * happens with the transfer */
-+        if (ret < 0) {
-+#ifdef DEBUG
-+            printf("handle_control: error after request - %s\n",
-+                   strerror(errno));
-+#endif
-+            return USB_RET_NAK; // STALL
-+        } else {
-+            return req.ucr_actlen;
-+        }
-+    }
-+}
-+
-+static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
-+{
-+    USBHostDevice *s = (USBHostDevice *)dev;
-+    int ret, fd, mode;
-+    int one = 1, shortpacket = 0, timeout = 50;
-+    sigset_t new_mask, old_mask;
-+    uint8_t devep = p->devep;
-+
-+    /* protect data transfers from SIGALRM signal */
-+    sigemptyset(&new_mask);
-+    sigaddset(&new_mask, SIGALRM);
-+    sigprocmask(SIG_BLOCK, &new_mask, &old_mask);
-+
-+    if (p->pid == USB_TOKEN_IN) {
-+        devep |= 0x80;
-+        mode = O_RDONLY;
-+        shortpacket = 1;
-+    } else {
-+        mode = O_WRONLY;
-+    }
-+
-+    fd = ensure_ep_open(s, devep, mode);
-+    if (fd < 0) {
-+        sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+        return USB_RET_NODEV;
-+    }
-+
-+    if (ioctl(fd, USB_SET_TIMEOUT, &timeout) < 0) {
-+#ifdef DEBUG
-+        printf("handle_data: failed to set timeout - %s\n",
-+               strerror(errno));
-+#endif
-+    }
-+
-+    if (shortpacket) {
-+        if (ioctl(fd, USB_SET_SHORT_XFER, &one) < 0) {
-+#ifdef DEBUG
-+            printf("handle_data: failed to set short xfer mode - %s\n",
-+                   strerror(errno));
-+#endif
-+            sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+        }
-+    }
-+
-+    if (p->pid == USB_TOKEN_IN)
-+        ret = read(fd, p->data, p->len);
-+    else
-+        ret = write(fd, p->data, p->len);
-+
-+    sigprocmask(SIG_SETMASK, &old_mask, NULL);
-+
-+    if (ret < 0) {
-+#ifdef DEBUG
-+        printf("handle_data: error after %s data - %s\n",
-+               pid == USB_TOKEN_IN ? "reading" : "writing", strerror(errno));
-+#endif
-+        switch(errno) {
-+        case ETIMEDOUT:
-+        case EINTR:
-+            return USB_RET_NAK;
-+        default:
-+            return USB_RET_STALL;
-+        }
-+    } else {
-+        return ret;
-+    }
-+}
-+
-+static void usb_host_handle_destroy(USBDevice *opaque)
-+{
-+    USBHostDevice *s = (USBHostDevice *)opaque;
-+    int i;
-+
-+    for (i = 0; i < USB_MAX_ENDPOINTS; i++)
-+        if (s->ep_fd[i] >= 0)
-+            close(s->ep_fd[i]);
-+
-+    if (s->devfd < 0)
-+        return;
-+
-+    close(s->devfd);
-+
-+    qemu_free(s);
-+}
-+
-+USBDevice *usb_host_device_open(const char *devname)
-+{
-+    struct usb_device_info bus_info, dev_info;
-+    USBHostDevice *dev;
-+    char ctlpath[PATH_MAX + 1];
-+    char buspath[PATH_MAX + 1];
-+    int bfd, dfd, bus, address, i;
-+    int ugendebug = UGEN_DEBUG_LEVEL;
-+
-+    if (usb_host_find_device(&bus, &address, devname) < 0)
-+        return NULL;
-+
-+    snprintf(buspath, PATH_MAX, "/dev/usb%d", bus);
-+
-+    bfd = open(buspath, O_RDWR);
-+    if (bfd < 0) {
-+#ifdef DEBUG
-+        printf("usb_host_device_open: failed to open usb bus - %s\n",
-+               strerror(errno));
-+#endif
-+        return NULL;
-+    }
-+
-+    bus_info.udi_addr = address;
-+    if (ioctl(bfd, USB_DEVICEINFO, &bus_info) < 0) {
-+#ifdef DEBUG
-+        printf("usb_host_device_open: failed to grab bus information - %s\n",
-+               strerror(errno));
-+#endif
-+        return NULL;
-+    }
-+
-+#if __FreeBSD__
-+    snprintf(ctlpath, PATH_MAX, "/dev/%s", bus_info.udi_devnames[0]);
-+#else
-+    snprintf(ctlpath, PATH_MAX, "/dev/%s.00", bus_info.udi_devnames[0]);
-+#endif
-+
-+    dfd  = open(ctlpath, O_RDWR);
-+    if (dfd < 0) {
-+        dfd = open(ctlpath, O_RDONLY);
-+        if (dfd < 0) {
-+#ifdef DEBUG
-+            printf("usb_host_device_open: failed to open usb device %s - %s\n",
-+                   ctlpath, strerror(errno));
-+#endif
-+        }
-+    }
-+
-+    if (dfd >= 0) {
-+        dev = qemu_mallocz(sizeof(USBHostDevice));
-+        if (!dev)
-+            goto fail;
-+        dev->devfd = dfd;
-+
-+        if (ioctl(dfd, USB_GET_DEVICEINFO, &dev_info) < 0) {
-+#ifdef DEBUG
-+            printf("usb_host_device_open: failed to grab device info - %s\n",
-+                   strerror(errno));
-+#endif
-+            goto fail;
-+        }
-+
-+        if (dev_info.udi_speed == 1)
-+            dev->dev.speed = USB_SPEED_LOW - 1;
-+        else
-+            dev->dev.speed = USB_SPEED_FULL - 1;
-+
-+        dev->dev.handle_packet = usb_generic_handle_packet;
-+
-+        dev->dev.handle_reset = usb_host_handle_reset;
-+        dev->dev.handle_control = usb_host_handle_control;
-+        dev->dev.handle_data = usb_host_handle_data;
-+        dev->dev.handle_destroy = usb_host_handle_destroy;
-+
-+        if (strncmp(dev_info.udi_product, "product", 7) != 0)
-+            pstrcpy(dev->dev.devname, sizeof(dev->dev.devname),
-+                    dev_info.udi_product);
-+        else
-+            snprintf(dev->dev.devname, sizeof(dev->dev.devname),
-+                     "host:%s", devname);
-+
-+        pstrcpy(dev->devpath, sizeof(dev->devpath), "/dev/");
-+	strcat(dev->devpath, dev_info.udi_devnames[0]);
-+
-+        /* Mark the endpoints as not yet open */
-+        for (i = 0; i < USB_MAX_ENDPOINTS; i++)
-+           dev->ep_fd[i] = -1;
-+
-+        ioctl(dfd, USB_SETDEBUG, &ugendebug);
-+
-+        return (USBDevice *)dev;
-+    }
-+
-+fail:
-+    return NULL;
-+}
-+
-+static int usb_host_scan(void *opaque, USBScanFunc *func)
-+{
-+    struct usb_device_info bus_info;
-+    struct usb_device_info dev_info;
-+    uint16_t vendor_id, product_id, class_id, speed;
-+    int bfd, dfd, bus, address;
-+    char busbuf[20], devbuf[20], product_name[256];
-+    int ret = 0;
-+
-+    for (bus = 0; bus < 10; bus++) {
-+
-+        snprintf(busbuf, sizeof(busbuf) - 1, "/dev/usb%d", bus);
-+        bfd = open(busbuf, O_RDWR);
-+        if (bfd < 0)
-+	    continue;
-+
-+        for (address = 1; address < 127; address++) {
-+
-+            bus_info.udi_addr = address;
-+            if (ioctl(bfd, USB_DEVICEINFO, &bus_info) < 0)
-+                continue;
-+
-+            /* only list devices that can be used by generic layer */
-+            if (strncmp(bus_info.udi_devnames[0], "ugen", 4) != 0)
-+                continue;
-+
-+#if __FreeBSD__
-+            snprintf(devbuf, sizeof(devbuf) - 1, "/dev/%s", bus_info.udi_devnames[0]);
-+#else
-+            snprintf(devbuf, sizeof(devbuf) - 1, "/dev/%s.00", bus_info.udi_devnames[0]);
-+#endif
-+
-+            dfd = open(devbuf, O_RDONLY);
-+            if (dfd < 0) {
-+#ifdef DEBUG
-+                printf("usb_host_scan: couldn't open device %s - %s\n", devbuf,
-+                       strerror(errno));
-+#endif
-+                continue;
-+            }
-+
-+            if (ioctl(dfd, USB_GET_DEVICEINFO, &dev_info) < 0)
-+                printf("usb_host_scan: couldn't get device information for %s - %s\n",
-+                       devbuf, strerror(errno));
-+
-+            // XXX: might need to fixup endianess of word values before copying over
-+
-+            vendor_id = dev_info.udi_vendorNo;
-+            product_id = dev_info.udi_productNo;
-+            class_id = dev_info.udi_class;
-+            speed = dev_info.udi_speed;
-+
-+            if (strncmp(dev_info.udi_product, "product", 7) != 0)
-+                pstrcpy(product_name, sizeof(product_name),
-+                        dev_info.udi_product);
-+            else
-+                product_name[0] = '\0';
-+
-+            ret = func(opaque, bus, address, class_id, vendor_id,
-+                       product_id, product_name, speed);
-+
-+            close(dfd);
-+
-+            if (ret)
-+                goto the_end;
-+        }
-+
-+        close(bfd);
-+    }
-+
-+the_end:
-+    return ret;
-+}
-+
-+typedef struct FindDeviceState {
-+    int vendor_id;
-+    int product_id;
-+    int bus_num;
-+    int addr;
-+} FindDeviceState;
-+
-+static int usb_host_find_device_scan(void *opaque, int bus_num, int addr,
-+                                     int class_id,
-+                                     int vendor_id, int product_id,
-+                                     const char *product_name, int speed)
-+{
-+    FindDeviceState *s = opaque;
-+    if (vendor_id == s->vendor_id &&
-+        product_id == s->product_id) {
-+        s->bus_num = bus_num;
-+        s->addr = addr;
-+        return 1;
-+     } else {
-+        return 0;
-+     }
-+}
-+
-+
-+/* the syntax is :
-+   'bus.addr' (decimal numbers) or
-+   'vendor_id:product_id' (hexa numbers) */
-+static int usb_host_find_device(int *pbus_num, int *paddr,
-+                                const char *devname)
-+{
-+    const char *p;
-+    int ret;
-+    FindDeviceState fs;
-+
-+    p = strchr(devname, '.');
-+    if (p) {
-+        *pbus_num = strtoul(devname, NULL, 0);
-+        *paddr = strtoul(p + 1, NULL, 0);
-+        return 0;
-+    }
-+    p = strchr(devname, ':');
-+    if (p) {
-+        fs.vendor_id = strtoul(devname, NULL, 16);
-+        fs.product_id = strtoul(p + 1, NULL, 16);
-+        ret = usb_host_scan(&fs, usb_host_find_device_scan);
-+        if (ret) {
-+            *pbus_num = fs.bus_num;
-+            *paddr = fs.addr;
-+            return 0;
-+        }
-+     }
-+     return -1;
-+}
-+
-+/**********************/
-+/* USB host device info */
-+
-+struct usb_class_info {
-+    int class;
-+    const char *class_name;
-+};
-+
-+static const struct usb_class_info usb_class_info[] = {
-+    { USB_CLASS_AUDIO, "Audio"},
-+    { USB_CLASS_COMM, "Communication"},
-+    { USB_CLASS_HID, "HID"},
-+    { USB_CLASS_HUB, "Hub" },
-+    { USB_CLASS_PHYSICAL, "Physical" },
-+    { USB_CLASS_PRINTER, "Printer" },
-+    { USB_CLASS_MASS_STORAGE, "Storage" },
-+    { USB_CLASS_CDC_DATA, "Data" },
-+    { USB_CLASS_APP_SPEC, "Application Specific" },
-+    { USB_CLASS_VENDOR_SPEC, "Vendor Specific" },
-+    { USB_CLASS_STILL_IMAGE, "Still Image" },
-+    { USB_CLASS_CSCID, "Smart Card" },
-+    { USB_CLASS_CONTENT_SEC, "Content Security" },
-+    { -1, NULL }
-+};
-+
-+static const char *usb_class_str(uint8_t class)
-+{
-+    const struct usb_class_info *p;
-+    for (p = usb_class_info; p->class != -1; p++) {
-+        if (p->class == class)
-+            break;
-+    }
-+    return p->class_name;
-+}
-+
-+void usb_info_device(int bus_num, int addr, int class_id,
-+                     int vendor_id, int product_id,
-+                     const char *product_name,
-+                     int speed)
-+{
-+    const char *class_str, *speed_str;
-+
-+    switch(speed) {
-+    case USB_SPEED_LOW:
-+        speed_str = "1.5";
-+        break;
-+    case USB_SPEED_FULL:
-+        speed_str = "12";
-+        break;
-+    case USB_SPEED_HIGH:
-+        speed_str = "480";
-+        break;
-+    default:
-+        speed_str = "?";
-+        break;
-+    }
-+
-+    term_printf("  Device %d.%d, speed %s Mb/s\n",
-+                bus_num, addr, speed_str);
-+    class_str = usb_class_str(class_id);
-+    if (class_str)
-+        term_printf("    %s:", class_str);
-+    else
-+        term_printf("    Class %02x:", class_id);
-+    term_printf(" USB device %04x:%04x", vendor_id, product_id);
-+    if (product_name[0] != '\0')
-+        term_printf(", %s", product_name);
-+    term_printf("\n");
-+}
-+
-+static int usb_host_info_device(void *opaque, int bus_num, int addr,
-+                                int class_id,
-+                                int vendor_id, int product_id,
-+                                const char *product_name,
-+                                int speed)
-+{
-+    usb_info_device(bus_num, addr, class_id, vendor_id, product_id,
-+                    product_name, speed);
-+    return 0;
-+}
-+
-+void usb_host_info(void)
-+{
-+    usb_host_scan(NULL, usb_host_info_device);
-+}
-Index: qemu/usb-linux.c
-@@ -23,7 +23,6 @@
-  */
- #include "vl.h"
- 
--#if defined(__linux__)
- #include <dirent.h>
- #include <sys/ioctl.h>
- #include <linux/compiler.h>
-@@ -505,18 +504,3 @@
- {
-     usb_host_scan(NULL, usb_host_info_device);
- }
--
--#else
--
--void usb_host_info(void)
--{
--    term_printf("USB host devices not supported\n");
--}
--
--/* XXX: modify configure to compile the right host driver */
--USBDevice *usb_host_device_open(const char *devname)
--{
--    return NULL;
--}
--
--#endif
diff --git a/emulators/qemu/files/patch-bt b/emulators/qemu/files/patch-bt
index 1280458f2c16..69e70482fefc 100644
--- a/emulators/qemu/files/patch-bt
+++ b/emulators/qemu/files/patch-bt
@@ -1,4 +1,4 @@
-Index: qemu/vl.c
+Index: qemu/net.c
 @@ -76,6 +76,11 @@
  #endif
  #endif
@@ -19,7 +19,7 @@ Index: qemu/vl.c
 +#define LOAD_QUIETLY	1
 +#define LOAD_VERBOSLY	2
 +
-+int
++static int
 +loadmodules(int how, const char *module, ...)
 +{
 +  int loaded = 0;
diff --git a/emulators/qemu/files/patch-cpu-exec.c b/emulators/qemu/files/patch-cpu-exec.c
new file mode 100644
index 000000000000..f1e1123fd547
--- /dev/null
+++ b/emulators/qemu/files/patch-cpu-exec.c
@@ -0,0 +1,66 @@
+Index: qemu/cpu-exec.c
+@@ -1158,6 +1158,12 @@
+ # define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext->ss.eip))
+ # define TRAP_sig(context)    ((context)->uc_mcontext->es.trapno)
+ # define ERROR_sig(context)   ((context)->uc_mcontext->es.err)
++#elif defined(__FreeBSD__) 
++# include <sys/ucontext.h>
++
++# define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_eip))
++# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
++# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
+ #else
+ # define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
+ # define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
+@@ -1168,7 +1174,11 @@
+                        void *puc)
+ {
+     siginfo_t *info = pinfo;
++#ifdef __FreeBSD__
++    ucontext_t *uc = puc;
++#else
+     struct ucontext *uc = puc;
++#endif
+     unsigned long pc;
+     int trapno;
+ 
+@@ -1194,6 +1204,12 @@
+ 
+ #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.__gregs[(reg)]
+ #define QEMU_UC_MACHINE_PC(uc)		_UC_MACHINE_PC(uc)
++#elif defined(__FreeBSD__) 
++# include <sys/ucontext.h>
++
++# define RIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_rip))
++# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
++# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
+ #else
+ #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.gregs[(reg)]
+ #define QEMU_UC_MACHINE_PC(uc)		QEMU_UC_MCONTEXT_GREGS(uc, REG_RIP)
+@@ -1204,17 +1220,25 @@
+ {
+     siginfo_t *info = pinfo;
+     unsigned long pc;
+-#ifdef __NetBSD__
++#if defined(__NetBSD__) || defined(__FreeBSD__)
+     ucontext_t *uc = puc;
+ #else
+     struct ucontext *uc = puc;
+ #endif
+ 
++#ifdef __FreeBSD__
++    pc = RIP_sig(uc);
++    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
++                             TRAP_sig(uc) == 0xe ?
++                             (ERROR_sig(uc) >> 1) & 1 : 0,
++                             &uc->uc_sigmask, puc);
++#else
+     pc = QEMU_UC_MACHINE_PC(uc);
+     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
+                              QEMU_UC_MCONTEXT_GREGS(uc, REG_TRAPNO) == 0xe ?
+                              (QEMU_UC_MCONTEXT_GREGS(uc, REG_ERR) >> 1) & 1 : 0,
+                              &uc->uc_sigmask, puc);
++#endif
+ }
+ 
+ #elif defined(__powerpc__)
diff --git a/emulators/qemu/files/patch-dynticks b/emulators/qemu/files/patch-dynticks
new file mode 100644
index 000000000000..05633653d468
--- /dev/null
+++ b/emulators/qemu/files/patch-dynticks
@@ -0,0 +1,99 @@
+Index: qemu/configure
+@@ -1025,11 +1025,26 @@
+   rt=yes
+ fi
+ 
++##########################################
++# posix timer probe
++cat > $TMPC <<EOF
++#include <time.h>
++int main(void) { timer_create(CLOCK_REALTIME, (struct sigevent *)NULL, (timer_t *)NULL); return 0; }
++EOF
++posixtimer=no
++if $cc $ARCH_CFLAGS -o $TMPE $TMPC 2> /dev/null ; then
++  posixtimer=yes
++elif $cc $ARCH_CFLAGS -o $TMPE $TMPC -lrt 2> /dev/null ; then
++  posixtimer=yes
++  rt=yes
++fi
++
+ if test "$rt" = "yes" ; then
+   # Hack, we should have a general purpose LIBS for this sort of thing
+   AIOLIBS="$AIOLIBS -lrt"
+ fi
+ 
++
+ if test "$mingw32" = "yes" ; then
+   if test -z "$prefix" ; then
+       prefix="c:\\\\Program Files\\\\Qemu"
+@@ -1403,6 +1418,9 @@
+   echo "#define HAVE_FDT 1" >> $config_h
+   echo "FDT_LIBS=-lfdt" >> $config_mak
+ fi
++if test "$posixtimer" = "yes" ; then
++  echo "#define HAVE_POSIX_TIMER 1" >> $config_h
++fi
+ 
+ # XXX: suppress that
+ if [ "$bsd" = "yes" ] ; then
+Index: qemu/vl.c
+@@ -918,12 +918,16 @@
+ static int unix_start_timer(struct qemu_alarm_timer *t);
+ static void unix_stop_timer(struct qemu_alarm_timer *t);
+ 
+-#ifdef __linux__
++#ifdef HAVE_POSIX_TIMER
+ 
+ static int dynticks_start_timer(struct qemu_alarm_timer *t);
+ static void dynticks_stop_timer(struct qemu_alarm_timer *t);
+ static void dynticks_rearm_timer(struct qemu_alarm_timer *t);
+ 
++#endif
++
++#ifdef __linux__
++
+ static int hpet_start_timer(struct qemu_alarm_timer *t);
+ static void hpet_stop_timer(struct qemu_alarm_timer *t);
+ 
+@@ -1001,9 +1005,11 @@
+ 
+ static struct qemu_alarm_timer alarm_timers[] = {
+ #ifndef _WIN32
+-#ifdef __linux__
++#ifdef HAVE_POSIX_TIMER
+     {"dynticks", ALARM_FLAG_DYNTICKS, dynticks_start_timer,
+      dynticks_stop_timer, dynticks_rearm_timer, NULL},
++#endif
++#ifdef __linux__
+     /* HPET - if available - is preferred */
+     {"hpet", 0, hpet_start_timer, hpet_stop_timer, NULL, NULL},
+     /* ...otherwise try RTC */
+@@ -1361,7 +1367,7 @@
+     return delta;
+ }
+ 
+-#if defined(__linux__) || defined(_WIN32)
++#if defined(HAVE_POSIX_TIMER) || defined(_WIN32)
+ static uint64_t qemu_next_deadline_dyntick(void)
+ {
+     int64_t delta;
+@@ -1506,6 +1512,10 @@
+     close(rtc_fd);
+ }
+ 
++#endif /* defined(__linux__) */
++
++#ifdef HAVE_POSIX_TIMER
++
+ static int dynticks_start_timer(struct qemu_alarm_timer *t)
+ {
+     struct sigevent ev;
+@@ -1577,7 +1587,7 @@
+     }
+ }
+ 
+-#endif /* defined(__linux__) */
++#endif /* defined(HAVE_POSIX_TIMER) */
+ 
+ static int unix_start_timer(struct qemu_alarm_timer *t)
+ {
diff --git a/emulators/qemu/files/patch-exec-all.h b/emulators/qemu/files/patch-exec-all.h
new file mode 100644
index 000000000000..244bfb05055a
--- /dev/null
+++ b/emulators/qemu/files/patch-exec-all.h
@@ -0,0 +1,10 @@
+Index: qemu/exec-all.h
+@@ -30,7 +30,7 @@
+ struct TranslationBlock;
+ 
+ /* XXX: make safe guess about sizes */
+-#define MAX_OP_PER_INSTR 64
++#define MAX_OP_PER_INSTR 128 /* 64 */
+ /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
+ #define MAX_OPC_PARAM 10
+ #define OPC_BUF_SIZE 512
diff --git a/emulators/qemu/files/patch-fbsd b/emulators/qemu/files/patch-fbsd
index 9fe09215c144..8eb291442d1f 100644
--- a/emulators/qemu/files/patch-fbsd
+++ b/emulators/qemu/files/patch-fbsd
@@ -1,6 +1,6 @@
 Index: qemu/Makefile
-@@ -25,7 +25,10 @@
- DOCS=
+@@ -38,7 +38,10 @@
+ LIBS+=-lwinmm -lws2_32 -liphlpapi
  endif
  
 -all: $(TOOLS) $(DOCS) recurse-all
@@ -9,27 +9,47 @@ Index: qemu/Makefile
 +bsd/libmath.a:
 +	( cd bsd ; $(BSD_MAKE) CC=$(CC) )
  
- subdir-%: dyngen$(EXESUF)
- 	$(MAKE) -C $(subst subdir-,,$@) all
-@@ -40,6 +43,7 @@
+ SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
+ 
+@@ -195,6 +198,7 @@
  
  clean:
  # avoid old build problems by removing potentially incorrect old files
 +	( cd bsd ; $(BSD_MAKE) clean )
- 	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h 
- 	rm -f *.o *.a $(TOOLS) dyngen$(EXESUF) TAGS *.pod *~ */*~
- 	$(MAKE) -C tests clean
+ 	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
+ 	rm -f *.o *.d *.a $(TOOLS) TAGS cscope.* *.pod *~ */*~
+ 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d
 Index: qemu/Makefile.target
-@@ -571,7 +571,7 @@
- SDL_LIBS := $(filter-out -mwindows, $(SDL_LIBS)) -mconsole
+@@ -417,7 +417,7 @@
+ # WARNING: this LDFLAGS is _very_ tricky : qemu is an ELF shared object
+ # that the kernel ELF loader considers as an executable. I think this
+ # is the simplest way to make it self virtualizable!
+-LDFLAGS+=-Wl,-shared
++#LDFLAGS+=-Wl,-shared
+ endif
  endif
  
--$(QEMU_SYSTEM): $(VL_OBJS) ../libqemu_common.a libqemu.a
-- 	$(CC) $(VL_LDFLAGS) $(LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(VL_LIBS)
-+$(QEMU_SYSTEM): $(VL_OBJS) ../libqemu_common.a libqemu.a ../bsd/libmath.a
-+	$(CC) $(VL_LDFLAGS) $(LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(VL_LIBS) ../bsd/libmath.a
+@@ -491,7 +491,7 @@
+ # cpu_signal_handler() in cpu-exec.c.
+ signal.o: CFLAGS += $(HELPER_CFLAGS)
+ 
+-$(QEMU_PROG): $(OBJS) ../libqemu_user.a
++$(QEMU_PROG): $(OBJS) ../libqemu_user.a ../bsd/libmath.a
+ 	$(LINK)
+ 
+ endif #CONFIG_BSD_USER
+@@ -717,9 +717,9 @@
+ main.o: CFLAGS+=-p
+ endif
+ 
+-$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS)
++$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) ../bsd/libmath.a
+ 
+-$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a
++$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a ../bsd/libmath.a
+ 	$(LINK)
  
- depend: $(SRCS)
+ endif # !CONFIG_USER_ONLY
 Index: qemu/fpu/softfloat-native.c
 @@ -2,11 +2,16 @@
     context is supported */
@@ -89,17 +109,16 @@ Index: qemu/fpu/softfloat-native.h
  #define fabsf(f) ((float)fabs(f))
  #else
  #include <fenv.h>
-@@ -60,7 +80,9 @@
- /*----------------------------------------------------------------------------
+@@ -109,6 +109,8 @@
  | Software IEC/IEEE floating-point rounding mode.
  *----------------------------------------------------------------------------*/
 -#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
 +#if (defined(_BSD) && !defined(__APPLE__) && \
-+     (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
-+    defined(HOST_SOLARIS)
- enum {
-     float_round_nearest_even = FP_RN,
-     float_round_down         = FP_RM,
++      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
++     defined(HOST_SOLARIS)
+ #if defined(__OpenBSD__)
+ #define FE_RM FP_RM
+ #define FE_RP FP_RP
 Index: qemu/fpu/softfloat.h
 @@ -84,7 +84,8 @@
  #define FLOAT128
@@ -112,20 +131,20 @@ Index: qemu/fpu/softfloat.h
  #endif
  #endif /* !CONFIG_SOFTFLOAT */
 Index: qemu/target-ppc/op_helper.c
-@@ -303,6 +303,13 @@
-     FT0 = sqrt(FT0);
+@@ -293,6 +293,13 @@
+     uint32_t exp = (u.ll >> 52) & 0x7FF;
+     return ((0 < exp) && (exp < 0x7FF));
  }
- 
++#else
 +#ifndef isnormal
 +#define isnormal(x)					\
 +    ((sizeof (x) == sizeof (float)) ? __isnormalf(x)	\
 +    : (sizeof (x) == sizeof (double)) ? __isnormal(x)	\
 +    : __isnormall(x))
 +#endif
-+
- void do_fres (void)
- {
-     union {
+ #endif
+ 
+ uint32_t helper_compute_fprf (uint64_t arg, uint32_t set_fprf)
 Index: qemu/x86_64.ld
 @@ -2,7 +2,7 @@
  OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
@@ -136,3 +155,23 @@ Index: qemu/x86_64.ld
  SECTIONS
  {
    /* Read-only sections, merged into text segment: */
+@@ -59,8 +59,6 @@
+   .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
+   .rodata1        : { *(.rodata1) }
+   .eh_frame_hdr : { *(.eh_frame_hdr) }
+-  .eh_frame       : ONLY_IF_RO { KEEP (*(.eh_frame)) }
+-  .gcc_except_table   : ONLY_IF_RO { *(.gcc_except_table) }
+   /* Adjust the address for the data segment.  We want to adjust up to
+      the same address within the page on the next page up.  */
+   . = ALIGN (0x100000) - ((0x100000 - .) & (0x100000 - 1)); . = DATA_SEGMENT_ALIGN (0x100000, 0x1000);
+@@ -86,8 +84,8 @@
+   .data1          : { *(.data1) }
+   .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+   .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+-  .eh_frame       : ONLY_IF_RW { KEEP (*(.eh_frame)) }
+-  .gcc_except_table   : ONLY_IF_RW { *(.gcc_except_table) }
++  .eh_frame       : { KEEP (*(.eh_frame)) }
++  .gcc_except_table   : { *(.gcc_except_table) }
+   .dynamic        : { *(.dynamic) }
+   .ctors          :
+   {
diff --git a/emulators/qemu/files/patch-fpu-softfloat-native.c b/emulators/qemu/files/patch-fpu-softfloat-native.c
deleted file mode 100644
index 7e2662eb7457..000000000000
--- a/emulators/qemu/files/patch-fpu-softfloat-native.c
+++ /dev/null
@@ -1,17 +0,0 @@
-Index: qemu/fpu/softfloat-native.c
-@@ -228,7 +228,15 @@
- *----------------------------------------------------------------------------*/
- float64 float64_trunc_to_int( float64 a STATUS_PARAM )
- {
-+#if defined(__FreeBSD__) && __FreeBSD__ <= 4
-+    float64 ret;
-+    fpsetround(FP_RZ);
-+    ret = rint(a);
-+    fpsetround(STATUS(float_rounding_mode));
-+    return ret;
-+#else
-     return trunc(a);
-+#endif
- }
- 
- float64 float64_round_to_int( float64 a STATUS_PARAM )
diff --git a/emulators/qemu/files/patch-hw-vmware_vga.c b/emulators/qemu/files/patch-hw-vmware_vga.c
index 83273bf17c9a..a54b8729c7df 100644
--- a/emulators/qemu/files/patch-hw-vmware_vga.c
+++ b/emulators/qemu/files/patch-hw-vmware_vga.c
@@ -1,12 +1,84 @@
 Index: qemu/hw/vmware_vga.c
-@@ -26,8 +26,8 @@
+@@ -28,9 +28,9 @@
  #define VERBOSE
  #define EMBED_STDVGA
  #undef DIRECT_VRAM
 -#define HW_RECT_ACCEL
 -#define HW_FILL_ACCEL
+-#define HW_MOUSE_ACCEL
 +/* #define HW_RECT_ACCEL */
 +/* #define HW_FILL_ACCEL */
- #define HW_MOUSE_ACCEL
++/* #define HW_MOUSE_ACCEL */
  
  #ifdef EMBED_STDVGA
+ # include "vga_int.h"
+@@ -76,6 +76,7 @@
+     uint32_t wblue;
+     int syncing;
+     int fb_size;
++    int empty;
+ 
+     union {
+         uint32_t *fifo;
+@@ -487,7 +488,7 @@
+ 
+ static inline int vmsvga_fifo_empty(struct vmsvga_state_s *s)
+ {
+-    if (!s->config || !s->enable)
++    if (!s->config || !s->enable || s->empty)
+         return 1;
+     return (s->cmd->next_cmd == s->cmd->stop);
+ }
+@@ -495,6 +496,10 @@
+ static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
+ {
+     uint32_t cmd = s->fifo[CMD(stop) >> 2];
++    if (s->cmd->next_cmd == s->cmd->stop) {
++        s->empty = 1;
++        return 0;
++    }
+     s->cmd->stop = cpu_to_le32(CMD(stop) + 4);
+     if (CMD(stop) >= CMD(max))
+         s->cmd->stop = s->cmd->min;
+@@ -512,6 +517,7 @@
+     int args = 0;
+     int x, y, dx, dy, width, height;
+     struct vmsvga_cursor_definition_s cursor;
++    s->empty = 0;
+     while (!vmsvga_fifo_empty(s))
+         switch (cmd = vmsvga_fifo_read(s)) {
+         case SVGA_CMD_UPDATE:
+@@ -533,6 +539,7 @@
+             vmsvga_fill_rect(s, colour, x, y, width, height);
+             break;
+ #else
++            args = 0;
+             goto badcmd;
+ #endif
+ 
+@@ -547,6 +554,7 @@
+             vmsvga_copy_rect(s, x, y, dx, dy, width, height);
+             break;
+ #else
++            args = 0;
+             goto badcmd;
+ #endif
+ 
+@@ -609,6 +617,7 @@
+             break; /* Nop */
+ 
+         default:
++            args = 0;
+         badcmd:
+             while (args --)
+                 vmsvga_fifo_read(s);
+@@ -914,7 +914,7 @@
+     s->width = -1;
+     s->height = -1;
+     s->svgaid = SVGA_ID;
+-    s->depth = 24;
++    s->depth = 32;
+     s->bypp = (s->depth + 7) >> 3;
+     s->cursor.on = 0;
+     s->redraw_fifo_first = 0;
+
diff --git a/emulators/qemu/files/patch-iopl-workaround b/emulators/qemu/files/patch-iopl-workaround
new file mode 100644
index 000000000000..b123bd600976
--- /dev/null
+++ b/emulators/qemu/files/patch-iopl-workaround
@@ -0,0 +1,64 @@
+Index: qemu/target-i386/op_helper.c
+@@ -517,6 +517,12 @@
+ #endif
+ }
+ 
++#if 1
++#define IOPL_WORKAROUND
++#define VMPORT 0x5658
++int vmware_svga_io_base;
++#endif
++
+ /* check if Port I/O is allowed in TSS */
+ static inline void check_io(int addr, int size)
+ {
+@@ -527,6 +533,27 @@
+         ((env->tr.flags >> DESC_TYPE_SHIFT) & 0xf) != 9 ||
+         env->tr.limit < 103)
+         goto fail;
++#ifdef IOPL_WORKAROUND
++    if (addr == VMPORT) {
++        static int last_vmport_iopl = -1;
++        int iopl = (env->eflags >> IOPL_SHIFT) & 3;
++        if (iopl != last_vmport_iopl) {
++            printf("check_io: vmport workaround: iopl = %d\n", iopl);
++            last_vmport_iopl = iopl;
++        }
++        return;
++    }
++    if (vmware_svga_io_base &&
++        addr >= vmware_svga_io_base && addr < vmware_svga_io_base + 3) {
++        static int last_svga_iopl = -1;
++        int iopl = (env->eflags >> IOPL_SHIFT) & 3;
++        if (iopl != last_svga_iopl) {
++            printf("check_io: vmware svga workaround: iopl = %d\n", iopl);
++            last_svga_iopl = iopl;
++        }
++        return;
++    }
++#endif
+     io_offset = lduw_kernel(env->tr.base + 0x66);
+     io_offset += (addr >> 3);
+     /* Note: the check needs two bytes */
+Index: qemu/hw/vmware_vga.c
+@@ -1175,12 +1175,20 @@
+     return 0;
+ }
+ 
++#if 1 && defined(TARGET_I386)
++#define IOPL_WORKAROUND
++extern int vmware_svga_io_base;
++#endif
++
+ static void pci_vmsvga_map_ioport(PCIDevice *pci_dev, int region_num,
+                 uint32_t addr, uint32_t size, int type)
+ {
+     struct pci_vmsvga_state_s *d = (struct pci_vmsvga_state_s *) pci_dev;
+     struct vmsvga_state_s *s = &d->chip;
+ 
++#ifdef IOPL_WORKAROUND
++    vmware_svga_io_base = addr + SVGA_IO_MUL * SVGA_INDEX_PORT;
++#endif
+     register_ioport_read(addr + SVGA_IO_MUL * SVGA_INDEX_PORT,
+                     1, 4, vmsvga_index_read, s);
+     register_ioport_write(addr + SVGA_IO_MUL * SVGA_INDEX_PORT,
diff --git a/emulators/qemu/files/patch-libmath2 b/emulators/qemu/files/patch-libmath2
index a6f6475ee8b4..ecff96d0d89e 100644
--- a/emulators/qemu/files/patch-libmath2
+++ b/emulators/qemu/files/patch-libmath2
@@ -55,13 +55,3 @@ Index: qemu/bsd/amd64/s_ldexpl.c
 +}
 +
 +weak_alias(__ldexpl,ldexpl)
-Index: qemu/target-i386/helper.c
-@@ -2886,6 +2886,8 @@
-     ST0 = floatx_round_to_int(ST0, &env->fp_status);
- }
- 
-+long double	ldexpl(long double, int);
-+
- void helper_fscale(void)
- {
-     ST0 = ldexp (ST0, (int)(ST1)); 
diff --git a/emulators/qemu/files/patch-libmath4 b/emulators/qemu/files/patch-libmath4
deleted file mode 100644
index 0c482370b8ba..000000000000
--- a/emulators/qemu/files/patch-libmath4
+++ /dev/null
@@ -1,45 +0,0 @@
-Index: qemu/bsd/i386/s_ldexpl.c
-@@ -2,6 +2,30 @@
- #include <errno.h>
- #include <sysdep.h>
- 
-+/* 4.x doesnt have isfinite */
-+#ifndef isfinite
-+#define isfinite __isfinitel
-+
-+union IEEEl2bits {
-+	long double	e;
-+	struct {
-+		unsigned int	manl	:32;
-+		unsigned int	manh	:32;
-+		unsigned int	exp	:15;
-+		unsigned int	sign	:1;
-+		unsigned int	junk	:16;
-+	} bits;
-+};
-+
-+static int __isfinitel(long double x)
-+{
-+	union IEEEl2bits u;
-+
-+	u.e = x;
-+	return (u.bits.exp != 32767);
-+}
-+#endif
-+
- long double __ldexpl(long double x, int expn)
- {
-   long double res;
-Index: qemu/bsd/i386/s_round.c
-@@ -29,6 +29,11 @@
- 
- #include <math.h>
- 
-+/* 4.x doesnt have isfinite */
-+#ifndef isfinite
-+#define isfinite(x) (!isnan(x) && !isinf(x))
-+#endif
-+
- double
- round(double x)
- {
diff --git a/emulators/qemu/files/patch-libmath_FreeBSD-version b/emulators/qemu/files/patch-libmath_FreeBSD-version
new file mode 100644
index 000000000000..dcf87c0ef8c5
--- /dev/null
+++ b/emulators/qemu/files/patch-libmath_FreeBSD-version
@@ -0,0 +1,150 @@
+diff -ru qemu.orig/bsd/Makefile qemu/bsd/Makefile
+--- qemu.orig/bsd/Makefile	2009-01-19 23:30:09.124413041 -0600
++++ qemu/bsd/Makefile	2009-01-19 23:40:20.180704580 -0600
+@@ -1,23 +1,90 @@
+-SRCS=	${MACHINE_ARCH}/e_atan2l.c 	\
+-	${MACHINE_ARCH}/e_logl.S	\
+-	${MACHINE_ARCH}/e_powl.S	\
+-	${MACHINE_ARCH}/e_remainderl.S	\
+-	${MACHINE_ARCH}/e_sqrtl.c	\
+-	${MACHINE_ARCH}/s_ceill.S	\
+-	${MACHINE_ARCH}/s_cosl.S	\
+-	${MACHINE_ARCH}/s_floorl.S	\
+-	${MACHINE_ARCH}/s_isnormal.c	\
+-	${MACHINE_ARCH}/s_llrint.S	\
+-	${MACHINE_ARCH}/s_llrintf.S	\
+-	${MACHINE_ARCH}/s_llrintl.S	\
+-	${MACHINE_ARCH}/s_lrint.S	\
+-	${MACHINE_ARCH}/s_lrintf.S	\
+-	${MACHINE_ARCH}/s_lrintl.S	\
+-	${MACHINE_ARCH}/s_rintl.c	\
+-	${MACHINE_ARCH}/s_round.c	\
+-	${MACHINE_ARCH}/s_sinl.S	\
+-	${MACHINE_ARCH}/s_tanl.S	\
+-	${MACHINE_ARCH}/s_ldexpl.c
++AWK=	/usr/bin/awk
++SYSCTL=	/sbin/sysctl
++
++.if !defined(OSVERSION)
++.if exists(/usr/include/sys/param.h)
++OSVERSION!=	${AWK} '/^\#define[[:blank:]]__FreeBSD_version/ {print $$3}' < /usr/include/sys/param.h
++.elif exists(/usr/src/sys/sys/param.h)
++OSVERSION!=	${AWK} '/^\#define[[:blank::]]__FreeBSD_version/ {print $$3}' < /usr/src/sys/sys/param.h
++.else
++OSVERSION!=	${SYSCTL} -n kern.osreldate
++.endif
++.endif
++
++# Need to be implemented
++_logl=		${MACHINE_ARCH}/e_logl.S
++_powl=		${MACHINE_ARCH}/e_powl.S
++
++# Implemented in -CURRENT
++.if ${OSVERSION} < 800042
++_atan2l=	${MACHINE_ARCH}/e_atan2l.c
++.endif
++
++.if ${OSVERSION} < 800030
++_remainderl=	${MACHINE_ARCH}/e_remainderl.S
++.endif
++
++.if ${OSVERSION} < 800025
++_sqrtl=		${MACHINE_ARCH}/e_sqrtl.c
++.endif
++
++.if ${OSVERSION} < 800022
++_cosl=		${MACHINE_ARCH}/s_cosl.S
++_sinl=		${MACHINE_ARCH}/s_sinl.S
++_tanl=		${MACHINE_ARCH}/s_tanl.S
++.endif
++
++.if ${OSVERSION} < 800012
++_lrintl=	${MACHINE_ARCH}/s_lrintl.S
++_llrintl=	${MACHINE_ARCH}/s_llrintl.S
++_rintl=		${MACHINE_ARCH}/s_rintl.c
++.endif
++
++.if ${OSVERSION} < 600020
++_ldexpl=	${MACHINE_ARCH}/s_ldexpl.c
++.endif
++
++.if ${OSVERSION} < 600008
++_ceill=		${MACHINE_ARCH}/s_ceill.S
++_floorl=	${MACHINE_ARCH}/s_floorl.S
++_llrint=	${MACHINE_ARCH}/s_llrint.S
++_llrintf=	${MACHINE_ARCH}/s_llrintf.S
++_lrint=		${MACHINE_ARCH}/s_lrint.S
++_lrintf=	${MACHINE_ARCH}/s_lrintf.S
++.endif
++
++.if ${OSVERSION} < 502121
++_isnormal=	${MACHINE_ARCH}/s_isnormal.c
++.endif
++
++.if ${OSVERSION} < 502114
++_round=		${MACHINE_ARCH}/s_round.c
++.endif
++
++#.if ${OSVERSION} < 501113
++#_fabsl=		${MACHINE_ARCH}/e_fabsl.c
++#.endif
++
++SRCS=	${_atan2l} 	\
++	${_logl}	\
++	${_powl}	\
++	${_remainderl}	\
++	${_sqrtl}	\
++	${_ceill}	\
++	${_cosl}	\
++	${_floorl}	\
++	${_isnormal}	\
++	${_llrint}	\
++	${_llrintf}	\
++	${_llrintl}	\
++	${_lrint}	\
++	${_lrintf}	\
++	${_lrintl}	\
++	${_rintl}	\
++	${_round}	\
++	${_sinl}	\
++	${_tanl}	\
++	${_ldexpl}
+ 
+ OBJS=	${SRCS:R:S/$/.o/}
+ 
+diff -ru qemu.orig/fpu/softfloat-native.h qemu/fpu/softfloat-native.h
+--- qemu.orig/fpu/softfloat-native.h	2009-01-19 23:30:08.833416100 -0600
++++ qemu/fpu/softfloat-native.h	2009-01-19 23:28:08.682949000 -0600
+@@ -1,15 +1,26 @@
++#ifndef SOFTFLOAT_NATIVE_H
++#define SOFTFLOAT_NATIVE_H
++
+ /* Native implementation of soft float functions */
+ #include <math.h>
+ 
+ #ifdef __FreeBSD__
+ #include <osreldate.h>
++#if __FreeBSD_version < 501113
+ long double fabsl(long double x);
++#endif
++#if __FreeBSD_version < 800030
+ long double remainderl(long double x, long double y);
++#endif
++#if __FreeBSD_version < 800025
+ long double sqrtl(long double x);
++#endif
++#if __FreeBSD_version < 800012
+ long double rintl(long double x);
+ long lrintl(long double x);
+ long long llrintl(long double x);
+ #endif
++#endif
+ 
+ #if (defined(_BSD) && !defined(__APPLE__) && \
+      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
+@@ -516,3 +527,5 @@
+ }
+ 
+ #endif
++
++#endif /* SOFTFLOAT_NATIVE_H */
diff --git a/emulators/qemu/files/patch-osdep.c b/emulators/qemu/files/patch-osdep.c
deleted file mode 100644
index 36adcdbb7667..000000000000
--- a/emulators/qemu/files/patch-osdep.c
+++ /dev/null
@@ -1,40 +0,0 @@
-Index: qemu/osdep.c
-@@ -79,7 +79,9 @@
- 
- #if defined(USE_KQEMU)
- 
-+#ifndef __FreeBSD__
- #include <sys/vfs.h>
-+#endif
- #include <sys/mman.h>
- #include <fcntl.h>
- 
-@@ -90,6 +92,7 @@
-     const char *tmpdir;
-     char phys_ram_file[1024];
-     void *ptr;
-+#ifndef __FreeBSD__
- #ifdef HOST_SOLARIS
-     struct statvfs stfs;
- #else
-@@ -151,12 +154,20 @@
-         }
-         unlink(phys_ram_file);
-     }
-+#endif
-     size = (size + 4095) & ~4095;
-+#ifndef __FreeBSD__
-     ftruncate(phys_ram_fd, phys_ram_size + size);
-     ptr = mmap(NULL, 
-                size, 
-                PROT_WRITE | PROT_READ, MAP_SHARED, 
-                phys_ram_fd, phys_ram_size);
-+#else
-+    ptr = mmap(NULL, 
-+               size, 
-+               PROT_WRITE | PROT_READ, MAP_PRIVATE|MAP_ANON, 
-+               -1, 0);
-+#endif
-     if (ptr == MAP_FAILED) {
-         fprintf(stderr, "Could not map physical memory\n");
-         exit(1);
diff --git a/emulators/qemu/files/patch-qemu-img.c b/emulators/qemu/files/patch-qemu-img.c
deleted file mode 100644
index ff80ba070532..000000000000
--- a/emulators/qemu/files/patch-qemu-img.c
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/qemu-img.c
-@@ -90,7 +90,7 @@
-            "Command syntax:\n"
-            "  create [-e] [-6] [-b base_image] [-f fmt] filename [size]\n"
-            "  commit [-f fmt] filename\n"
--           "  convert [-c] [-e] [-6] [-f fmt] filename [filename2 [...]] [-O output_fmt] output_filename\n"
-+           "  convert [-c] [-e] [-6] [-f fmt] [-O output_fmt] filename [filename2 [...]] output_filename\n"
-            "  info [-f fmt] filename\n"
-            "\n"
-            "Command parameters:\n"
diff --git a/emulators/qemu/files/patch-qemu-img.texi b/emulators/qemu/files/patch-qemu-img.texi
deleted file mode 100644
index f89d1ea66664..000000000000
--- a/emulators/qemu/files/patch-qemu-img.texi
+++ /dev/null
@@ -1,19 +0,0 @@
-Index: qemu/qemu-img.texi
-@@ -10,7 +10,7 @@
- @table @option
- @item create [-e] [-6] [-b @var{base_image}] [-f @var{fmt}] @var{filename} [@var{size}]
- @item commit [-f @var{fmt}] @var{filename}
--@item convert [-c] [-e] [-6] [-f @var{fmt}] @var{filename} [-O @var{output_fmt}] @var{output_filename}
-+@item convert [-c] [-e] [-6] [-f @var{fmt}] [-O @var{output_fmt}] @var{filename} @var{output_filename}
- @item info [-f @var{fmt}] @var{filename}
- @end table
- 
-@@ -83,7 +83,7 @@
- 
- Commit the changes recorded in @var{filename} in its base image.
- 
--@item convert [-c] [-e] [-f @var{fmt}] @var{filename} [-O @var{output_fmt}] @var{output_filename}
-+@item convert [-c] [-e] [-f @var{fmt}] [-O @var{output_fmt}] @var{filename} @var{output_filename}
- 
- Convert the disk image @var{filename} to disk image @var{output_filename}
- using format @var{output_fmt}. It can be optionnaly encrypted
diff --git a/emulators/qemu/files/patch-target-mips-cpu.h b/emulators/qemu/files/patch-target-mips-cpu.h
deleted file mode 100644
index 52d83af15fb2..000000000000
--- a/emulators/qemu/files/patch-target-mips-cpu.h
+++ /dev/null
@@ -1,15 +0,0 @@
-Index: qemu/target-mips/cpu.h
-@@ -8,6 +8,13 @@
- #include "config.h"
- #include "softfloat.h"
- 
-+#ifdef __FreeBSD__
-+#if __FreeBSD__ <= 4
-+typedef uint32_t uint_fast8_t;
-+typedef uint32_t uint_fast16_t;
-+#endif
-+#endif
-+
- typedef union fpr_t fpr_t;
- union fpr_t {
-     double d;
diff --git a/emulators/qemu/files/patch-vl.c b/emulators/qemu/files/patch-vl.c
index a69e42ffd8ba..44684c7ce36b 100644
--- a/emulators/qemu/files/patch-vl.c
+++ b/emulators/qemu/files/patch-vl.c
@@ -1,55 +1,28 @@
 Index: qemu/vl.c
-@@ -1727,6 +1728,7 @@
-     chr->chr_ioctl = pp_ioctl;
-     return chr;
- }
-+#endif /* defined(__linux__) */
- 
+@@ -75,6 +75,7 @@
+ #include <sys/stat.h>
+ #ifdef __FreeBSD__
+ #include <libutil.h>
++#include <sys/param.h>
  #else
- CharDriverState *qemu_chr_open_pty(void)
-@@ -1771,14 +1771,14 @@
-     return chr;
- }
- 
--#if defined(__linux__) || defined(__sun__)
-+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)
- static CharDriverState *qemu_chr_open_pty(void)
- {
-     struct termios tty;
-     char slave_name[1024];
-     int master_fd, slave_fd;
-  
--#if defined(__linux__)
-+#if defined(__linux__) || defined(__FreeBSD__)
-     /* Not satisfying */
-     if (openpty(&master_fd, &slave_fd, slave_name, NULL, NULL) < 0) {
-         return NULL;
-@@ -3036,7 +3036,7 @@
-         return qemu_chr_open_pp(filename);
-     } else 
+ #include <util.h>
  #endif
--#if defined(__linux__) || defined(__sun__)
-+#if defined(__linux__) || defined(__sun__) || defined(__FreeBSD__)
-     if (strstart(filename, "/dev/", NULL)) {
-         return qemu_chr_open_tty(filename);
-     } else
-@@ -8423,6 +8423,11 @@
-     nb_nics = 0;
-     /* default mac address of the first network interface */
+@@ -9850,15 +9850,15 @@
+         phys_ram_size += ram_size;
+     }
  
-+#ifdef __FreeBSD__
-+    if (modfind("aio") == -1)
-+        fprintf(stderr, "warning: aio not (kld)loaded, may cause `Invalid system call' traps on disk IO\n");
-+#endif
++    /* init the dynamic translator */
++    cpu_exec_init_all(tb_size * 1024 * 1024);
 +
-     optind = 1;
-     for(;;) {
-         if (optind >= argc)
-@@ -8784,6 +8784,7 @@
- #ifdef TARGET_ARM
-             case QEMU_OPTION_old_param:
-                 old_param = 1;
-+                break;
- #endif
-             case QEMU_OPTION_clock:
-                 configure_alarms(optarg);
+     phys_ram_base = qemu_vmalloc(phys_ram_size);
+     if (!phys_ram_base) {
+         fprintf(stderr, "Could not allocate physical memory\n");
+         exit(1);
+     }
+ 
+-    /* init the dynamic translator */
+-    cpu_exec_init_all(tb_size * 1024 * 1024);
+-
+     bdrv_init();
+ 
+     /* we always create the cdrom drive, even if no disk is there */
diff --git a/emulators/qemu/files/patch-vl.c-nographic b/emulators/qemu/files/patch-vl.c-nographic
deleted file mode 100644
index eafbd45705af..000000000000
--- a/emulators/qemu/files/patch-vl.c-nographic
+++ /dev/null
@@ -1,9 +0,0 @@
-Index: qemu/vl.c
-@@ -7131,6 +7131,7 @@
-             case QEMU_OPTION_nographic:
-                 pstrcpy(serial_devices[0], sizeof(serial_devices[0]), "stdio");
-                 pstrcpy(monitor_device, sizeof(monitor_device), "stdio");
-+                pstrcpy(parallel_devices[0], sizeof(parallel_devices[0]), "null");
-                 nographic = 1;
-                 break;
-             case QEMU_OPTION_kernel:
diff --git a/emulators/qemu/files/patch-vl.c-ppbus b/emulators/qemu/files/patch-vl.c-ppbus
deleted file mode 100644
index 28cf485493d2..000000000000
--- a/emulators/qemu/files/patch-vl.c-ppbus
+++ /dev/null
@@ -1,92 +0,0 @@
-Index: qemu/vl.c
-@@ -78,8 +78,10 @@
- #endif
- #ifdef __FreeBSD__
- #include <sys/param.h>
- #include <sys/module.h>
- #include <sys/linker.h>
-+#include <dev/ppbus/ppi.h>
-+#include <dev/ppbus/ppbconf.h>
- #endif
- 
- #if defined(CONFIG_SLIRP)
-@@ -1728,7 +1730,64 @@
-     chr->chr_ioctl = pp_ioctl;
-     return chr;
- }
--#endif /* defined(__linux__) */
-+#if defined(__FreeBSD__)
-+static int pp_ioctl(CharDriverState *chr, int cmd, void *arg)
-+{
-+    int fd = (int)chr->opaque;
-+    uint8_t b;
-+
-+    switch(cmd) {
-+    case CHR_IOCTL_PP_READ_DATA:
-+        if (ioctl(fd, PPIGDATA, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    case CHR_IOCTL_PP_WRITE_DATA:
-+        b = *(uint8_t *)arg;
-+        if (ioctl(fd, PPISDATA, &b) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case CHR_IOCTL_PP_READ_CONTROL:
-+        if (ioctl(fd, PPIGCTRL, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    case CHR_IOCTL_PP_WRITE_CONTROL:
-+        b = *(uint8_t *)arg;
-+        if (ioctl(fd, PPISCTRL, &b) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case CHR_IOCTL_PP_READ_STATUS:
-+        if (ioctl(fd, PPIGSTATUS, &b) < 0)
-+            return -ENOTSUP;
-+        *(uint8_t *)arg = b;
-+        break;
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+CharDriverState *qemu_chr_open_pp(const char *filename)
-+{
-+    CharDriverState *chr;
-+    int fd;
-+
-+    fd = open(filename, O_RDWR);
-+    if (fd < 0)
-+        return NULL;
-+
-+    chr = qemu_mallocz(sizeof(CharDriverState));
-+    if (!chr) {
-+        close(fd);
-+        return NULL;
-+    }
-+    chr->opaque = (void *)fd;
-+    chr->chr_write = null_chr_write;
-+    chr->chr_ioctl = pp_ioctl;
-+    return chr;
-+}
-+#endif
- 
- #else
- CharDriverState *qemu_chr_open_pty(void)
-@@ -2562,6 +2622,13 @@
- #endif
- #if defined(__linux__)
-     if (strstart(filename, "/dev/parport", NULL)) {
-+        return qemu_chr_open_pp(filename);
-+    } else 
-+    if (strstart(filename, "/dev/", NULL)) {
-+        return qemu_chr_open_tty(filename);
-+    } else 
-+#elif defined(__FreeBSD__)
-+    if (strstart(filename, "/dev/ppi", NULL)) {
-         return qemu_chr_open_pp(filename);
-     } else 
-     if (strstart(filename, "/dev/", NULL)) {
diff --git a/emulators/qemu/files/patch-vl.c-serial b/emulators/qemu/files/patch-vl.c-serial
index 76c290e28abb..0918cd7a724f 100644
--- a/emulators/qemu/files/patch-vl.c-serial
+++ b/emulators/qemu/files/patch-vl.c-serial
@@ -1,4 +1,4 @@
-Index: qemu/vl.c
+Index: qemu/qemu-char.c
 @@ -1606,10 +1606,13 @@
      cfsetospeed(&tty, spd);
  
diff --git a/emulators/qemu/files/pcap-patch b/emulators/qemu/files/pcap-patch
new file mode 100644
index 000000000000..a0b70c83ff67
--- /dev/null
+++ b/emulators/qemu/files/pcap-patch
@@ -0,0 +1,298 @@
+--- Makefile.target.orig	2008-07-18 15:18:11.000000000 -0400
++++ Makefile.target	2008-07-18 15:23:11.000000000 -0400
+@@ -619,6 +619,13 @@
+ COCOA_LIBS+=-framework CoreAudio
+ endif
+ endif
++ifdef CONFIG_PCAP
++ifdef CONFIG_WIN32
++LIBS+=-lwpcap
++else
++LIBS+=-lpcap
++endif
++endif
+ ifdef CONFIG_SLIRP
+ CPPFLAGS+=-I$(SRC_PATH)/slirp
+ endif
+--- configure.orig	2008-07-18 15:18:42.000000000 -0400
++++ configure	2008-07-18 15:22:24.000000000 -0400
+@@ -88,6 +88,7 @@
+ mingw32="no"
+ EXESUF=""
+ gdbstub="yes"
++pcap="no"
+ slirp="yes"
+ fmod_lib=""
+ fmod_inc=""
+@@ -278,6 +279,8 @@
+   ;;
+   --enable-mingw32) mingw32="yes" ; cross_prefix="i386-mingw32-" ; linux_user="no"
+   ;;
++  --enable-pcap) pcap="yes"
++  ;;
+   --disable-slirp) slirp="no"
+   ;;
+   --disable-kqemu) kqemu="no"
+@@ -712,6 +715,28 @@
+ fi # -z $sdl
+ 
+ ##########################################
++# pcap probe
++
++if test "$pcap" = "yes" ; then
++  cat > $TMPC << EOF
++#include <pcap.h>
++int main(void) { return (pcap_lib_version() == (char *)0 ? 1 : 0); }
++EOF
++  if test "$mingw32" = "no" ; then
++    libpcap=-lpcap
++  else
++    libpcap=-lwpcap
++  fi
++  if ! $cc $ARCH_CFLAGS -o $TMPE $TMPC $libpcap 2> /dev/null ; then
++    echo
++    echo "Error: Could not find pcap"
++    echo "Make sure to have the pcap libs and headers installed."
++    echo
++    exit 1
++  fi
++fi # test "$pcap"
++
++##########################################
+ # VNC TLS detection
+ if test "$vnc_tls" = "yes" ; then
+   `pkg-config gnutls` || vnc_tls="no"
+@@ -865,6 +890,7 @@
+     echo "    TLS CFLAGS    $vnc_tls_cflags"
+     echo "    TLS LIBS      $vnc_tls_libs"
+ fi
++echo "pcap support      $pcap"
+ if test -n "$sparc_cpu"; then
+     echo "Target Sparc Arch $sparc_cpu"
+ fi
+@@ -1034,6 +1060,15 @@
+ if test $profiler = "yes" ; then
+   echo "#define CONFIG_PROFILER 1" >> $config_h
+ fi
++if test "$pcap" = "yes" ; then
++  echo "CONFIG_PCAP=yes" >> $config_mak
++  echo "#define CONFIG_PCAP 1" >> $config_h
++  if test "$mingw32" = "no" ; then
++    if test -c /dev/bpf0 ; then
++      echo "#define HAVE_BPF 1" >> $config_h
++    fi
++  fi
++fi
+ if test "$slirp" = "yes" ; then
+   echo "CONFIG_SLIRP=yes" >> $config_mak
+   echo "#define CONFIG_SLIRP 1" >> $config_h
+Index: net.c
+@@ -105,6 +105,13 @@
+ 
+ #include "qemu_socket.h"
+ 
++#if defined(CONFIG_PCAP)
++#if defined(_WIN32)
++#define WPCAP 1
++#endif
++#include <pcap.h>
++#endif
++
+ #if defined(CONFIG_SLIRP)
+ #include "libslirp.h"
+ #endif
+@@ -450,6 +457,164 @@
+     return max_len;
+ }
+ 
++#if defined(CONFIG_PCAP)
++
++typedef struct PCAPState {
++    VLANClientState *vc;
++    pcap_t *handle;
++} PCAPState;
++
++static void pcap_receive(void *opaque, const uint8_t *buf, int size)
++{
++    PCAPState *s = (PCAPState *)opaque;
++
++    pcap_sendpacket(s->handle, (u_char*)buf, size);
++}
++
++static void pcap_callback(u_char *user, struct pcap_pkthdr *phdr, u_char *pdata)
++{
++    VLANClientState *vc = (VLANClientState *)user;
++
++    qemu_send_packet(vc, pdata, phdr->len);
++}
++
++static void pcap_send(void *opaque)
++{
++    PCAPState *s = (PCAPState *)opaque;
++
++    pcap_dispatch(s->handle, 1, (pcap_handler)&pcap_callback, (u_char *)s->vc);
++}
++
++static int net_pcap_init(VLANState *vlan, const char *model, const char *name, char *ifname)
++{
++    PCAPState *s = NULL;
++    struct bpf_program fcode = { 0, NULL };
++    char pcap_program[64];
++    char macstr[] = "xx:xx:xx:xx:xx:xx";
++    char errbuf[PCAP_ERRBUF_SIZE];
++#if defined(_WIN32)
++    HANDLE h;
++#endif
++    int i;
++
++    /* Find guest's MAC address. */
++    for (i = 0; i < nb_nics; i++)
++	if (nd_table[i].vlan == vlan) {
++	    u_char *mac = nd_table[i].macaddr;
++	    snprintf(macstr, sizeof(macstr), "%02x:%02x:%02x:%02x:%02x:%02x",
++		mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
++	    break;
++	}
++    if (macstr[0] == 'x') {
++	fprintf(stderr, "qemu: net_pcap_init: no matching NIC found\n");
++	return -1;
++    }
++
++    s = qemu_mallocz(sizeof(PCAPState));
++    if (!s)
++	return -1;
++
++    if (ifname == NULL && (ifname = pcap_lookupdev(errbuf)) == NULL) {
++	fprintf(stderr, "qemu: pcap_lookupdev: %s\n", errbuf);
++	goto fail;
++    }
++
++    /* Attempt to connect device. */
++    s->handle = (void *)pcap_open_live(ifname, 65535, 1, 0, errbuf);
++    if (!s->handle) {
++	fprintf(stderr, "qemu: pcap_open_live: %s\n", errbuf);
++	goto fail;
++    }
++
++    /* Set filter program. */
++    snprintf(pcap_program, 64, "ether dst %s or multicast", macstr);
++    if (pcap_compile(s->handle, &fcode, pcap_program, 1, 0) < 0) {
++	fprintf(stderr, "qemu: pcap_compile failed\n");
++	goto fail;
++    }
++    if (pcap_setfilter(s->handle, &fcode) < 0) {
++	fprintf(stderr, "qemu: pcap_setfilter failed\n");
++	goto fail;
++    }
++
++    /* Set non-blocking mode. */
++    if (pcap_setnonblock(s->handle, 1, errbuf) < 0) {
++	fprintf(stderr, "qemu: pcap_setnonblock: %s\n", errbuf);
++	goto fail;
++    }
++
++#if defined(_WIN32)
++    /*
++     * Tell the kernel that the packet has to be seen immediately.
++     */
++    if (pcap_setmintocopy(s->handle, 0) < 0) {
++	fprintf(stderr, "qemu: pcap failed to set immediate mode\n");
++	goto fail;
++    }
++#else /* !_WIN32 */
++#if defined(HAVE_BPF)
++#if defined(BIOCIMMEDIATE)
++    /*
++     * Tell the kernel that the packet has to be seen immediately.
++     */
++    {
++	unsigned int one = 1;
++	if (ioctl(pcap_fileno(s->handle), BIOCIMMEDIATE, &one) < 0) {
++	    fprintf(stderr, "qemu: pcap failed to set immediate mode\n");
++	    goto fail;
++	}
++    }
++#endif /* BIOCIMMEDIATE */
++
++#if defined(BIOCFEEDBACK)
++    /*
++     * Tell the kernel that the sent packet has to be fed back.
++     * This is necessary to connect host and guest.
++     */
++    {
++	unsigned int one = 1;
++	if (ioctl(pcap_fileno(s->handle), BIOCFEEDBACK, &one) < 0) {
++	    fprintf(stderr, "qemu: pcap failed to set feedback mode\n");
++	    goto fail;
++	}
++    }
++#endif /* BIOCFEEDBACK */
++#endif /* HAVE_BPF */
++#endif /* _WIN32 */
++
++    s->vc = qemu_new_vlan_client(vlan, model, name, pcap_receive, NULL, s);
++    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "pcap redirector");
++
++#if defined(_WIN32)
++    if ((h = pcap_getevent(s->handle)) == NULL) {
++	fprintf(stderr, "qemu: pcap_getevent failed\n");
++	goto fail;
++    }
++    qemu_add_wait_object(h, pcap_send, s);
++#else /* !_WIN32 */
++    if ((i = pcap_get_selectable_fd(s->handle)) < 0) {
++	fprintf(stderr, "qemu: pcap_get_selectable_fd failed\n");
++	goto fail;
++    }
++    qemu_set_fd_handler(i, pcap_send, NULL, s);
++#endif /* _WIN32 */
++
++    return 0;
++
++fail:
++    if (s) {
++	if (s->handle) {
++	    if (fcode.bf_len)
++		pcap_freecode(&fcode);
++	    pcap_close(s->handle);
++	}
++	qemu_free(s);
++    }
++
++    return -1;
++}
++#endif /* CONFIG_PCAP */
++
+ #if defined(CONFIG_SLIRP)
+ 
+ /* slirp network adapter */
+@@ -1681,6 +1846,16 @@
+            are wanted */
+         ret = 0;
+     } else
++#ifdef CONFIG_PCAP
++    if (!strcmp(device, "pcap")) {
++	char ifname[64];
++	vlan->nb_host_devs++;
++	if (get_param_value(ifname, sizeof(ifname), "ifname", p) <= 0)
++	    ret = net_pcap_init(vlan, device, name, NULL);
++	else
++	    ret = net_pcap_init(vlan, device, name, ifname);
++    } else
++#endif
+ #ifdef CONFIG_SLIRP
+     if (!strcmp(device, "user")) {
+         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
+--- vl.c.orig	2008-07-18 15:19:26.000000000 -0400
++++ vl.c	2008-07-18 15:31:25.000000000 -0400
+@@ -7398,6 +7575,10 @@
+            "Network options:\n"
+            "-net nic[,vlan=n][,macaddr=addr][,model=type]\n"
+            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
++#ifdef CONFIG_PCAP
++           "-net pcap[,vlan=n][,ifname=name]\n"
++           "                connect the host network interface using PCAP to VLAN 'n'\n"
++#endif
+ #ifdef CONFIG_SLIRP
+            "-net user[,vlan=n][,hostname=host]\n"
+            "                connect the user mode network stack to VLAN 'n' and send\n"
diff --git a/emulators/qemu/pkg-message b/emulators/qemu/pkg-message
index 65c104957ac0..7f4695dc34fb 100644
--- a/emulators/qemu/pkg-message
+++ b/emulators/qemu/pkg-message
@@ -34,12 +34,14 @@ in this message: http://docs.freebsd.org/cgi/mid.cgi?200510131428.21211.jkim
 really match the emulated nic exactly, it just `happens' to work with
 6.0-RC1's driver.)
 - if you want to use usb devices connected to the host in the guest
-(usb_add host:... monitor command) you need to make sure the host isn't
-claiming them, e.g. for umass devices (like memory sticks or external
-harddrives) make sure umass isn't in the kernel (you can then still load it
-as a kld when needed), also unless you are running qemu as root you then
-need to fix permissions for /dev/ugen* device nodes: if you are on 5.x or
-later (devfs) put a rule in /etc/devfs.rules, activate it in /etc/rc.conf
+(usb_add host:... monitor command; this doesn't work on -current atm
+because of the new usb stack - help updating the usb-bsd.c code is
+more than welcome here!) you need to make sure the host isn't claiming
+them, e.g. for umass devices (like memory sticks or external harddrives)
+make sure umass isn't in the kernel (you can then still load it as a kld
+when needed), also unless you are running qemu as root you then need to
+fix permissions for /dev/ugen* device nodes: if you are on 5.x or later
+(devfs) put a rule in /etc/devfs.rules, activate it in /etc/rc.conf
 and run /etc/rc.d/devfs restart.  example devfs.rules:
 	[ugen_ruleset=20]
 	add path 'ugen*' mode 660 group operator
@@ -56,9 +58,10 @@ rtl8139 timer by building the port with RTL8139_TIMER enabled.
 (the rtl8139c+ that model=rtl8139 emulates needs less cpu than qemu's
 default ne2k nic which is driven by ed(4), it has not been made default
 only because it may not work with all guests yet.  btw qemu now also can
-emulate a few intel eepro100 nics which seem to be a tad more efficient
-even, and at least i82557b works without tweaks for FreeBSD guests - driven
-by fxp(4) - and Linux guests too.)
+emulate a few intel eepro100 and e1000 nics which seem to be a tad more
+efficient even, and at least i82557b and e1000 work without tweaks for
+FreeBSD guests - driven by fxp(4) and em(4) repectively - and Linux
+guests too.)
 - if you get repeated `atapi_poll called!' console messages with FreeBSD
 guests or other weird cdrom problems then thats probably because the guest
 has atapicam loaded, which for reasons still to be determined has problems
@@ -80,21 +83,13 @@ itself also.
 kernel (like with any kld installed outside of base), i.e.  rebuild its
 port whenever you update the kernel - especially if you are switching
 branches or are following a -stable or even -current branch!
-- you can enable autoloading of kqemu (and aio) at boot by adding a line
+- you can enable autoloading of kqemu at boot by adding a line
 	kqemu_enable=YES
 to /etc/rc.conf
 - kqemu liked to panic the host on amd64 SMP until before 1.3.0.p11_6
 (revision 1.25 of /usr/ports/emulators/kqemu-kmod/Makefile), so if your
 host is such you might want to make sure your kqemu-kmod port is new enough.
 (and don't forget to reload it...)
-- also remember that on amd64 you need to run the amd64 (x86_64) system
-emulation if you want to use kqemu, i.e. run qemu-system-x86_64 instead of
-qemu (the latter only emulates a 32 bit system.)  Unfortunately there can
-still be guests that don't run correctly in the amd64 emulation even when
-they do run in the 32 bit one, the same is true about kqemu and -kernel-kqemu
-on amd64 - not much you can do about that other than help debugging (k)qemu's
-amd64 emulation... (well or falling back to unaccellerated, possibly 32 bit
-qemu/leaving out -kernel-kqemu if its that what's causing the problems.)
 - qemu's network boot roms (-boot n) have a bug when bootfiles sizes are a
 multiple of blksize, if this affects you (like with FreeBSD's /boot/pxeboot)
 you can do like
@@ -106,8 +101,25 @@ extracted out of
 	ftp://ftp.freebsd.org/pub/FreeBSD/snapshots/200805/7.0-STABLE-200805-i386-bootonly.iso
 and placed it here:
 	http://people.freebsd.org/~nox/qemu/pxeboot-qemu
-- qemu now uses aio at least for ide dma, so if you get `Invalid system call'
-crashes that is because aio is not (kld)loaded.
+- if you use slirp (usernet, the default) and want to mount nfs into the
+guest and you are not running qemu as root, then mountd(8) on the exporting
+box needs to be run with -n in order to accept requests from ports >= 1024.
+- unfortunately there can still be guests that don't run correctly with
+kqemu and -kernel-kqemu especially on amd64 - not much you can do about that
+other than help debugging (k)qemu... (well or falling back to unaccellerated
+qemu/leaving out -kernel-kqemu if its that what's causing the problems.
+note however that kqemu now can also be used with the 32 bit qemu even
+on amd64 hosts as of the 20080620 update.)
+- the new (optional) pcap code cannot talk to the host on 6.x because
+the necessary bpf feature (BIOCFEEDBACK) hasn't (yet?) been merged there.
+- kqemu passes the host tsc to the guest as-is so depending on your cpu and
+guest you _may_ need to tell the guest to avoid relying on the tsc (notsc
+kernel parameter with linux), or if that doesn't work force qemu onto
+a single cpu by doing e.g. `cpuset -l 0 qemu ..' (see the cpuset(1) manpage
+for details; cpuset isn't avalable before 7.1.  This can only be a problem
+on smp hosts.)
+- the new sparc64-bsd-user target (qemu-sparc64) is entirely untested and
+probably only works on amd64 hosts, if at all.
 - The default configuration location (qemu-ifup script etc.) has been
 changed from /etc to PREFIX/etc (usually /usr/local/etc).  Move your
 files accordingly.
diff --git a/emulators/qemu/pkg-plist b/emulators/qemu/pkg-plist
index 35b4c135d69e..40aeea74b660 100644
--- a/emulators/qemu/pkg-plist
+++ b/emulators/qemu/pkg-plist
@@ -1,18 +1,19 @@
 bin/qemu
 bin/qemu-img
-bin/qemu-system-arm
-bin/qemu-system-cris
-bin/qemu-system-m68k
-bin/qemu-system-mips
-bin/qemu-system-mips64
-bin/qemu-system-mips64el
-bin/qemu-system-mipsel
-bin/qemu-system-ppc
-bin/qemu-system-ppc64
-bin/qemu-system-ppcemb
-bin/qemu-system-sh4
-bin/qemu-system-sh4eb
-bin/qemu-system-sparc
+%%ALLTARGETS%%bin/qemu-sparc64
+%%ALLTARGETS%%bin/qemu-system-arm
+%%ALLTARGETS%%bin/qemu-system-cris
+%%ALLTARGETS%%bin/qemu-system-m68k
+%%ALLTARGETS%%bin/qemu-system-mips
+%%ALLTARGETS%%bin/qemu-system-mips64
+%%ALLTARGETS%%bin/qemu-system-mips64el
+%%ALLTARGETS%%bin/qemu-system-mipsel
+%%ALLTARGETS%%bin/qemu-system-ppc
+%%ALLTARGETS%%bin/qemu-system-ppc64
+%%ALLTARGETS%%bin/qemu-system-ppcemb
+%%ALLTARGETS%%bin/qemu-system-sh4
+%%ALLTARGETS%%bin/qemu-system-sh4eb
+%%ALLTARGETS%%bin/qemu-system-sparc
 bin/qemu-system-x86_64
 @unexec if cmp -s %D/etc/qemu-ifup.sample %D/etc/qemu-ifup; then rm -f %D/etc/qemu-ifup; fi
 etc/qemu-ifup.sample
@@ -27,11 +28,15 @@ etc/qemu-ifdown.sample
 %%DATADIR%%/vgabios.bin
 %%DATADIR%%/vgabios-cirrus.bin
 %%DATADIR%%/ppc_rom.bin
+%%DATADIR%%/openbios-ppc
 %%DATADIR%%/openbios-sparc32
+%%DATADIR%%/openbios-sparc64
 %%DATADIR%%/video.x
+%%DATADIR%%/pxe-e1000.bin
 %%DATADIR%%/pxe-ne2k_pci.bin
 %%DATADIR%%/pxe-rtl8139.bin
 %%DATADIR%%/pxe-pcnet.bin
+%%DATADIR%%/bamboo.dtb
 %%DATADIR%%/keymaps/ar
 %%DATADIR%%/keymaps/common
 %%DATADIR%%/keymaps/da