Update qemu to 0.13.0. PR pkg/43994

"Looks good" from wiz@ and obache@.

ChangeLog for 0.13.0 is not updated but there is a list in announcement:

This release consists of over 2,500 commits from 145 contributors.

Some major features were added in this release including:

- vhost-net: kernel-accelerating network backend for virtio devices (using KVM)
- qmp: significant improvements covering most monitor commands
- vnc: introduction of new encodings that dramatically improve bandwidth
  (part of GSoC project)
- ivshmem: new shared memory device allowing multiple guests to share
  a memory region
- mips: introduction of fulong mini-pc
- virtio-9p: introduction of a paravirtual file system passthrough mechanism
- hpet: many enhancements
- target-s390: support for s390 usermode emulation
- many more features and bug fixes

A special note about QMP support in 0.13.0. QMP is still considered
experimental in 0.13.0. There are no plans to change the protocol
in an incompatible way but there are likely to be missing features.


ChangeLog for version 0.12.5:

 - audio/alsa: Handle SND_PCM_STATE_SETUP in alsa_poll_handler
 - block: Handle multiwrite errors only when all requests have completed
 - block: Fix early failure in multiwrite
 - vpc: Use bdrv_(p)write_sync for metadata writes
 - vmdk: Use bdrv_(p)write_sync for metadata writes
 - qcow2: Use bdrv_(p)write_sync for metadata writes
 - qcow: Use bdrv_(p)write_sync for metadata writes
 - block: Add bdrv_(p)write_sync
 - qcow2: Restore L1 entry on l2_allocate failure
 - block/vdi: Fix image opening and creation for odd disk sizes
 - block/vpc: Fix conversion from size to disk geometry
 - qcow2: Remove abort on free_clusters failure
 - vmdk: Fix COW
 - qcow2: Fix creation of large images
 - vmdk: fix double free
 - qemu-options: add documentation for stdio signal=on|off
 - target-arm : fix parallel saturated subtraction implementation
 - target-arm : fix thumb2 parallel add/sub opcode decoding
 - target-arm: fix addsub/subadd implementation
 - target-i386: fix xchg rax,r8
 - block/vvfat.c: fix warnings with _FORTIFY_SOURCE
 - audio/alsa: Spelling typo (paramters)
 - target-mips: fix DINSU instruction
 - Correct definitions for FD_CMD_SAVE and FD_CMD_RESTORE
 - qcow2: Fix corruption after error in update_refcount
 - qcow2: Fix corruption after refblock allocation
 - block: Fix multiwrite with overlapping requests
 - qcow2: Fix error handling in l2_allocate
 - qcow2: Clear L2 table cache after write error
 - ide: Fix ide_dma_cancel
 - usb-bus: fix no params
 - Avoid crash on '-usbdevice <device>' without parameters
 - Fix -usbdevice crash
 - Fix multiboot compilation
 - Fix missing symbols in .rel/.rela.plt sections
 - target-ppc: fix RFI by clearing some bits of MSR
 - Fix typo in balloon help
 - arm_timer: fix oneshot mode
 - arm_timer: reload timer when enabled
 - qemu-sockets: avoid strlen of NULL pointer
 - block: fix aio_flush segfaults for read-only protocols (e.g. curl)
 - virtio-blk: fix barrier support
 - block: fix sector comparism in multiwrite_req_compare
 - pci: irq_state vmstate breakage
 - qemu-img: use the heap instead of the huge stack array for win32


Pkgsrc changes:

patch-aa
patch-ao
patch-ba
patch-de
patch-ed
 - lifted from previous (some adjustments per upstream changes)

patch-ab
 - removed (looks similar fix applied in upstream)

patch-dd
 - adjust configure for location of man page dir (as previous)
 - fix detection for arm hosts

patch-dk
 - removed (looks no longer applicable due to reorganized upstream)

patch-ee
 - remove old e1000.c fix (pulled up to upstream)
 - pull block/sheepdog.c build fix on *BSD hosts from upstream

patch-ef
patch-eg
patch-eh
patch-ei
 - workaround for conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
   (PR lib/43832: ssp causes common names to be defines)

patch-ej
 - pull build/warning fixes in ui/vnc-enc-tight.c from upstream

patch-ek
 - pull ATA PIO fix (by jakllsch@) from upstream
 - pull warning fix from upstream

patch-el
 - workaround for missing C99 FP macro on netbsd-4
   (PR pkg/42899, but od(1) fixes for netbsd-4 not included)

patch-em
patch-en
 - build fix on NetBSD/arm host using gcc-4.1.3
   (built qemu binary on NetBSD/hpcarm host fails though)

patch-eo
patch-ep
patch-er
patch-es
 - pull ESP SCSI DMA fixes (that might affect sparc) from upstream

patch-eq
 - pull ESP SCSI DMA fixes from upstream
 - disable broken ARC JAZZ floppy that causes hang on MIPS NT 4.0 guest

Makefile
 - bump DISTNAME
 - add makeinfo to USE_TOOLS
   XXX: gets "qemu-doc.texi:7: warning: unrecognized encoding name `UTF-8'."
 - adjust SUBST_FILES.qaudio per upstream changes
 - enable nbd support *BSD per upstream update

PLIST
distinfo
 - update per each file

23 files changed, 788 insertions, 126 deletions

diff --git a/emulators/qemu/Makefile b/emulators/qemu/Makefile
index de27095f634..bc05341f497 100644
--- a/emulators/qemu/Makefile
+++ b/emulators/qemu/Makefile
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.73 2010/10/01 08:32:35 tnn Exp $
+# $NetBSD: Makefile,v 1.74 2010/10/27 13:24:09 tsutsui Exp $
 #
 
-DISTNAME=		qemu-0.12.4
-PKGREVISION=		1
+DISTNAME=		qemu-0.13.0
 CATEGORIES=		emulators
 MASTER_SITES=		http://download.savannah.gnu.org/releases/qemu/
 
@@ -16,7 +15,7 @@ PKG_DESTDIR_SUPPORT=	user-destdir
 CONFLICTS+=		qemu-bin-[0-9]*
 NOT_FOR_PLATFORM=	NetBSD-1.[0-6]*-*
 
-USE_TOOLS+=		gmake perl:build
+USE_TOOLS+=		gmake makeinfo perl:build
 HAS_CONFIGURE=		yes
 
 BUILD_DEPENDS+=		texi2html-[0-9]*:../../textproc/texi2html
@@ -33,7 +32,7 @@ pre-patch:
 
 SUBST_CLASSES+=		qaudio
 SUBST_STAGE.qaudio=	pre-configure
-SUBST_FILES.qaudio=	monitor.c savevm.c vl.c vnc.h \
+SUBST_FILES.qaudio=	arch_init.c monitor.c savevm.c vl.c \
 			audio/*.c \
 			hw/ac97.c \
 			hw/adlib.c \
@@ -41,16 +40,17 @@ SUBST_FILES.qaudio=	monitor.c savevm.c vl.c vnc.h \
 			hw/es1370.c \
 			hw/gus.c \
 			hw/marvell_88w8618_audio.c \
+			hw/mips_fulong2e.c \
 			hw/mips_jazz.c \
 			hw/mips_malta.c \
 			hw/omap2.c \
 			hw/palm.c \
-			hw/pc.c \
 			hw/pcspk.c \
 			hw/sb16.c \
 			hw/spitz.c \
 			hw/tsc210x.c \
-			hw/wm8750.c
+			hw/wm8750.c \
+			ui/vnc.h
 SUBST_SED.qaudio=	-e s,audio.h\",qaudio.h\",g
 SUBST_MESSAGE.qaudio=	Fixing audio.h confusion
 
@@ -67,6 +67,7 @@ UE_ARCHS+=		sparc64 x86_64
 
 .if !empty(OPSYS:M*BSD) || !empty(OPSYS:MDragonFly)
 USER_EMUL=		i386 x86_64 sparc sparc64
+PLIST.nbd=		YES
 .elif !empty(OPSYS:MDarwin)
 USER_EMUL=		i386 x86_64 sparc sparc64 ppc
 .elif !empty(OPSYS:MLinux)
diff --git a/emulators/qemu/PLIST b/emulators/qemu/PLIST
index 0cc76493e2a..f6342a8105f 100644
--- a/emulators/qemu/PLIST
+++ b/emulators/qemu/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.22 2010/04/10 05:57:40 sbd Exp $
+@comment $NetBSD: PLIST,v 1.23 2010/10/27 13:24:09 tsutsui Exp $
 bin/qemu
 ${PLIST.alpha}bin/qemu-alpha
 ${PLIST.arm}bin/qemu-arm
@@ -45,6 +45,8 @@ share/doc/qemu/qemu-doc.html
 share/doc/qemu/qemu-tech.html
 share/qemu/bamboo.dtb
 share/qemu/bios.bin
+share/qemu/gpxe-eepro100-80861209.rom
+share/qemu/gpxe-eepro100-80861229.rom
 share/qemu/keymaps/ar
 share/qemu/keymaps/common
 share/qemu/keymaps/da
@@ -88,11 +90,11 @@ share/qemu/openbios-sparc64
 share/qemu/petalogix-s3adsp1800.dtb
 share/qemu/ppc_rom.bin
 share/qemu/pxe-e1000.bin
-share/qemu/pxe-i82559er.bin
 share/qemu/pxe-ne2k_pci.bin
 share/qemu/pxe-pcnet.bin
 share/qemu/pxe-rtl8139.bin
 share/qemu/pxe-virtio.bin
+share/qemu/s390-zipl.rom
 share/qemu/vgabios-cirrus.bin
 share/qemu/vgabios.bin
 share/qemu/video.x
diff --git a/emulators/qemu/distinfo b/emulators/qemu/distinfo
index 1a003605aab..ecdc008ce8a 100644
--- a/emulators/qemu/distinfo
+++ b/emulators/qemu/distinfo
@@ -1,14 +1,26 @@
-$NetBSD: distinfo,v 1.60 2010/10/03 15:11:49 wiz Exp $
+$NetBSD: distinfo,v 1.61 2010/10/27 13:24:09 tsutsui Exp $
 
-SHA1 (qemu-0.12.4.tar.gz) = 1cc3200bf496c836f7c4256c1d12143dab9b82dc
-RMD160 (qemu-0.12.4.tar.gz) = dbf5e02812b0df076e4ec8c20b7c382f7507645e
-Size (qemu-0.12.4.tar.gz) = 4697077 bytes
-SHA1 (patch-aa) = df7561fa16c1b12b973557a6e9a13e82bc64df89
-SHA1 (patch-ab) = 9213602b22947abf76c8a1fbe8240b7f78499a7b
+SHA1 (qemu-0.13.0.tar.gz) = 250bba1fdb505a787c48331b6b02f54282edfc76
+RMD160 (qemu-0.13.0.tar.gz) = 4a6faaf38d5616fb7bedc1a6408de1dbb3ec360c
+Size (qemu-0.13.0.tar.gz) = 5184531 bytes
+SHA1 (patch-aa) = bc2f9ea4bd468b1c8bd5623b21ea7631fe5466c3
 SHA1 (patch-ao) = e515093b6ea99f9cba665de022fd62f3be911569
-SHA1 (patch-ba) = f317a580e849aa368f904137d4fb7ce44701a231
-SHA1 (patch-dd) = 32661203ba023bea67cd7cde1f4088f4d0e5c582
+SHA1 (patch-ba) = 217eb00a0cabd460981026a275d18b6c02914a1c
+SHA1 (patch-dd) = 3fe4e1f4eec6a91766253cd7b6ae82472a99adf2
 SHA1 (patch-de) = 225eaa996fccc02b17be0099d943c75302600ada
-SHA1 (patch-dk) = 5538bebc08b0047e501469f9cb306cb798d0eb00
 SHA1 (patch-ed) = c30e147005e41fbf6d08457634d94cd90545cbb5
-SHA1 (patch-ee) = 95e2ec397ab47ac36fd1ac66d78eafae2bd7b5eb
+SHA1 (patch-ee) = 54811c6a45dee3aa1a4ad6c956053c23aa14146a
+SHA1 (patch-ef) = 0e1c2b364cc52aa9a7295e0e025b53498082d4a7
+SHA1 (patch-eg) = f511730d3b5640f10973d70b891e28bf140beb3c
+SHA1 (patch-eh) = 008c648dd74b273bd920521f7e01da5928c7c775
+SHA1 (patch-ei) = aee213dc347808f7aabedd7a8ce9f9477b12b9f0
+SHA1 (patch-ej) = 23199fe87a0748067a54384dbe6c2677c729c234
+SHA1 (patch-ek) = a4bfeb9887c5caddaf660fecaaa59f7468eec2ed
+SHA1 (patch-el) = c8ab982a32e2c47deba9bd8a5b574d83fb80234d
+SHA1 (patch-em) = 4993ef668321e38ce63014494cb2ddb447637eb8
+SHA1 (patch-en) = d40b933f2b491ad18fb5ba43203311d6a3b28f06
+SHA1 (patch-eo) = 3617e3543d52009ab0514e78cd5175a85cd90c63
+SHA1 (patch-ep) = 03723d2f3ed666616d8e7701bfe32e104df9e3c9
+SHA1 (patch-eq) = c6854cb155be431de15ba23f19e619df8cb7fbba
+SHA1 (patch-er) = dcc723b1ecdcb78b080b5d05e2b7849e8721beec
+SHA1 (patch-es) = 23b89cbcef79fc4f817525a6b8d62b47b2a3fc2c
diff --git a/emulators/qemu/patches/patch-aa b/emulators/qemu/patches/patch-aa
index dcfa9a3e978..67411e6c964 100644
--- a/emulators/qemu/patches/patch-aa
+++ b/emulators/qemu/patches/patch-aa
@@ -1,9 +1,9 @@
-$NetBSD: patch-aa,v 1.7 2010/08/09 11:46:39 tsutsui Exp $
+$NetBSD: patch-aa,v 1.8 2010/10/27 13:24:09 tsutsui Exp $
 
---- net/tap-bsd.c.orig	2010-05-04 15:27:48.000000000 +0000
+--- net/tap-bsd.c.orig	2010-07-28 01:55:42.000000000 +0000
 +++ net/tap-bsd.c
-@@ -27,6 +27,8 @@
- #include "sysemu.h"
+@@ -28,6 +28,8 @@
+ #include "qemu-error.h"
  
  #ifdef __NetBSD__
 +#include <sys/ioctl.h>
@@ -11,7 +11,7 @@ $NetBSD: patch-aa,v 1.7 2010/08/09 11:46:39 tsutsui Exp $
  #include <net/if_tap.h>
  #endif
  
-@@ -43,8 +45,12 @@
+@@ -44,8 +46,12 @@
  int tap_open(char *ifname, int ifname_size, int *vnet_hdr, int vnet_hdr_required)
  {
      int fd;
@@ -24,7 +24,7 @@ $NetBSD: patch-aa,v 1.7 2010/08/09 11:46:39 tsutsui Exp $
  
  #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
      /* if no ifname is given, always start the search from tap0. */
-@@ -75,14 +81,26 @@ int tap_open(char *ifname, int ifname_si
+@@ -77,14 +83,26 @@ int tap_open(char *ifname, int ifname_si
  #else
      TFR(fd = open("/dev/tap", O_RDWR));
      if (fd < 0) {
diff --git a/emulators/qemu/patches/patch-ab b/emulators/qemu/patches/patch-ab
deleted file mode 100644
index 65de1fa0c56..00000000000
--- a/emulators/qemu/patches/patch-ab
+++ /dev/null
@@ -1,32 +0,0 @@
-$NetBSD: patch-ab,v 1.13 2010/10/01 08:32:35 tnn Exp $
-
-Rework 2MB stack allocation in qemu-img which causes SEGV with our
-default process limits.
-
---- qemu-img.c.orig	2010-05-04 15:27:48.000000000 +0000
-+++ qemu-img.c
-@@ -537,12 +537,15 @@ static int img_convert(int argc, char **
-     BlockDriverState **bs, *out_bs;
-     int64_t total_sectors, nb_sectors, sector_num, bs_offset;
-     uint64_t bs_sectors;
--    uint8_t buf[IO_BUF_SIZE];
-+    uint8_t *buf;
-     const uint8_t *buf1;
-     BlockDriverInfo bdi;
-     QEMUOptionParameter *param = NULL;
-     char *options = NULL;
- 
-+    buf = malloc(IO_BUF_SIZE);
-+    if (!buf)
-+        error("out of memory");
-     fmt = NULL;
-     out_fmt = "raw";
-     out_baseimg = NULL;
-@@ -792,6 +795,7 @@ static int img_convert(int argc, char **
-     for (bs_i = 0; bs_i < bs_n; bs_i++)
-         bdrv_delete(bs[bs_i]);
-     free(bs);
-+    free(buf);
-     return 0;
- }
- 
diff --git a/emulators/qemu/patches/patch-ba b/emulators/qemu/patches/patch-ba
index 565569c41f0..523bc43d59c 100644
--- a/emulators/qemu/patches/patch-ba
+++ b/emulators/qemu/patches/patch-ba
@@ -1,6 +1,6 @@
-$NetBSD: patch-ba,v 1.2 2010/08/09 11:46:39 tsutsui Exp $
+$NetBSD: patch-ba,v 1.3 2010/10/27 13:24:09 tsutsui Exp $
 
---- hw/pcspk.c.orig	2010-05-04 15:27:48.000000000 +0000
+--- hw/pcspk.c.orig	2010-07-28 01:55:42.000000000 +0000
 +++ hw/pcspk.c
 @@ -42,7 +42,6 @@ typedef struct {
      unsigned int samples;
diff --git a/emulators/qemu/patches/patch-dd b/emulators/qemu/patches/patch-dd
index ea17b0c1889..cbf79e040a8 100644
--- a/emulators/qemu/patches/patch-dd
+++ b/emulators/qemu/patches/patch-dd
@@ -1,13 +1,57 @@
-$NetBSD: patch-dd,v 1.3 2009/10/11 16:04:13 asau Exp $
+$NetBSD: patch-dd,v 1.4 2010/10/27 13:24:09 tsutsui Exp $
 
---- configure.orig	2009-09-23 23:01:31.000000000 +0400
-+++ configure	2009-09-30 14:02:37.000000000 +0400
-@@ -1384,7 +1384,7 @@
-   if test -z "$prefix" ; then
-       prefix="/usr/local"
+Install man pages into ${PREFIX}/man, not ${PREFIX}/share/man.
+
+Handle arm and armeb case on NetBSD.
+XXX: it looks mips is always treated as big endian.
+
+--- configure.orig	2010-07-28 01:55:42.000000000 +0000
++++ configure	2010-08-09 20:36:55.000000000 +0000
+@@ -199,13 +199,19 @@
+   else
+     cpu="s390"
    fi
--  mansuffix="/share/man"
-+#  mansuffix="/share/man"
-   datasuffix="/share/qemu"
-   docsuffix="/share/doc/qemu"
-   binsuffix="/bin"
++elif check_define __arm__ ; then
++  if check_define __ARMEL__ ; then
++    cpu="arm"
++  elif check_define __ARMEB__ ; then
++    cpu="armeb"
++  fi
+ else
+   cpu=`uname -m`
+ fi
+ 
+ target_list=""
+ case "$cpu" in
+-  alpha|cris|ia64|m68k|microblaze|ppc|ppc64|sparc64)
++  alpha|arm|armeb|cris|ia64|m68k|microblaze|ppc|ppc64|sparc64)
+     cpu="$cpu"
+   ;;
+   i386|i486|i586|i686|i86pc|BePC)
+@@ -285,7 +291,7 @@
+ mingw32="no"
+ EXESUF=""
+ prefix="/usr/local"
+-mandir="\${prefix}/share/man"
++mandir="\${prefix}/man"
+ datadir="\${prefix}/share/qemu"
+ docdir="\${prefix}/share/doc/qemu"
+ bindir="\${prefix}/bin"
+@@ -1036,7 +1042,7 @@
+ 
+ # if cross compiling, cannot launch a program, so make a static guess
+ case "$cpu" in
+-  armv4b|hppa|m68k|mips|mips64|ppc|ppc64|s390|s390x|sparc|sparc64)
++  armeb|armv4b|hppa|m68k|mips|mips64|ppc|ppc64|s390|s390x|sparc|sparc64)
+     bigendian=yes
+   ;;
+ esac
+@@ -2212,7 +2218,7 @@
+   i386|x86_64|alpha|cris|hppa|ia64|m68k|microblaze|mips|mips64|ppc|ppc64|s390|s390x|sparc|sparc64)
+     ARCH=$cpu
+   ;;
+-  armv4b|armv4l)
++  arm|armeb|armv4b|armv4l)
+     ARCH=arm
+   ;;
+ esac
diff --git a/emulators/qemu/patches/patch-dk b/emulators/qemu/patches/patch-dk
deleted file mode 100644
index e472d591fa7..00000000000
--- a/emulators/qemu/patches/patch-dk
+++ /dev/null
@@ -1,22 +0,0 @@
-$NetBSD: patch-dk,v 1.5 2010/02/27 23:21:13 tnn Exp $
-
---- vl.c.orig	2010-02-23 20:54:38.000000000 +0000
-+++ vl.c
-@@ -652,7 +652,7 @@ static void init_get_clock(void)
- {
-     use_rt_clock = 0;
- #if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000) \
--    || defined(__DragonFly__) || defined(__FreeBSD_kernel__)
-+    || defined(__DragonFly__) || defined(__FreeBSD_kernel__) || defined(__NetBSD__)
-     {
-         struct timespec ts;
-         if (clock_gettime(CLOCK_MONOTONIC, &ts) == 0) {
-@@ -665,7 +665,7 @@ static void init_get_clock(void)
- static int64_t get_clock(void)
- {
- #if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000) \
--	|| defined(__DragonFly__) || defined(__FreeBSD_kernel__)
-+	|| defined(__DragonFly__) || defined(__FreeBSD_kernel__) || defined(__NetBSD__)
-     if (use_rt_clock) {
-         struct timespec ts;
-         clock_gettime(CLOCK_MONOTONIC, &ts);
diff --git a/emulators/qemu/patches/patch-ee b/emulators/qemu/patches/patch-ee
index 3e920352f1f..3f2c74d3b10 100644
--- a/emulators/qemu/patches/patch-ee
+++ b/emulators/qemu/patches/patch-ee
@@ -1,37 +1,26 @@
-$NetBSD: patch-ee,v 1.2 2010/08/11 17:05:13 tsutsui Exp $
+$NetBSD: patch-ee,v 1.3 2010/10/27 13:24:09 tsutsui Exp $
 
-qemu-0.13.x will include this fix:
-http://git.qemu.org/qemu.git/commit/?id=9651ac55e5de0e1534d898316cc851af6ffc4334
+Remove unnecessary includes. "qemu_socket.h" is enough and
+including <netinet/tcp.h> without <netinet/in.h> causes errors.
+(fixed in the upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=aab2e8f79ad253c760787ff3ce4d64967fed0003
 
---- hw/e1000.c.orig	2010-02-24 05:54:38.000000000 +0900
-+++ hw/e1000.c	2010-05-08 04:04:39.000000000 +0900
-@@ -259,21 +259,20 @@
+--- block/sheepdog.c.orig	2010-07-28 01:55:42.000000000 +0000
++++ block/sheepdog.c	2010-08-08 09:17:28.000000000 +0000
+@@ -8,16 +8,6 @@
+  * You should have received a copy of the GNU General Public License
+  * along with this program. If not, see <http://www.gnu.org/licenses/>.
+  */
+-#ifdef _WIN32
+-#include <windows.h>
+-#include <winsock2.h>
+-#include <ws2tcpip.h>
+-#else
+-#include <netdb.h>
+-#include <netinet/tcp.h>
+-
+-#define closesocket(s) close(s)
+-#endif
  
-     s->eecd_state.old_eecd = val & (E1000_EECD_SK | E1000_EECD_CS |
-             E1000_EECD_DI|E1000_EECD_FWE_MASK|E1000_EECD_REQ);
-+    if (!(E1000_EECD_CS & val))			// CS inactive; nothing to do
-+	return;
-+    if (E1000_EECD_CS & (val ^ oldval)) {	// CS rise edge; reset state
-+	s->eecd_state.val_in = 0;
-+	s->eecd_state.bitnum_in = 0;
-+	s->eecd_state.bitnum_out = 0;
-+	s->eecd_state.reading = 0;
-+    }
-     if (!(E1000_EECD_SK & (val ^ oldval)))	// no clock edge
-         return;
-     if (!(E1000_EECD_SK & val)) {		// falling edge
-         s->eecd_state.bitnum_out++;
-         return;
-     }
--    if (!(val & E1000_EECD_CS)) {		// rising, no CS (EEPROM reset)
--        memset(&s->eecd_state, 0, sizeof s->eecd_state);
--        /*
--         * restore old_eecd's E1000_EECD_SK (known to be on)
--         * to avoid false detection of a clock edge
--         */
--        s->eecd_state.old_eecd = E1000_EECD_SK;
--        return;
--    }
-     s->eecd_state.val_in <<= 1;
-     if (val & E1000_EECD_DI)
-         s->eecd_state.val_in |= 1;
+ #include "qemu-common.h"
+ #include "qemu-error.h"
diff --git a/emulators/qemu/patches/patch-ef b/emulators/qemu/patches/patch-ef
new file mode 100644
index 00000000000..5f662adb428
--- /dev/null
+++ b/emulators/qemu/patches/patch-ef
@@ -0,0 +1,16 @@
+$NetBSD: patch-ef,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
+(PR lib/43832: ssp causes common names to be defines)
+
+--- audio/audio.c.orig	2010-07-28 10:55:42.000000000 +0900
++++ audio/audio.c	2010-08-08 04:02:07.000000000 +0900
+@@ -1163,7 +1163,7 @@
+         return 0;
+     }
+ 
+-    bytes = sw->hw->pcm_ops->read (sw, buf, size);
++    bytes = (*sw->hw->pcm_ops->read)(sw, buf, size);
+     return bytes;
+ }
+ 
diff --git a/emulators/qemu/patches/patch-eg b/emulators/qemu/patches/patch-eg
new file mode 100644
index 00000000000..82d07224e3d
--- /dev/null
+++ b/emulators/qemu/patches/patch-eg
@@ -0,0 +1,25 @@
+$NetBSD: patch-eg,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
+(PR lib/43832: ssp causes common names to be defines)
+
+--- hw/etraxfs_eth.c.orig	2010-07-28 10:55:42.000000000 +0900
++++ hw/etraxfs_eth.c	2010-08-08 04:14:31.000000000 +0900
+@@ -184,7 +184,7 @@
+ 
+ 	phy = bus->devs[bus->addr];
+ 	if (phy && phy->read)
+-		bus->data = phy->read(phy, bus->req);
++		bus->data = (*phy->read)(phy, bus->req);
+ 	else 
+ 		bus->data = 0xffff;
+ }
+@@ -347,7 +347,7 @@
+ 	int new_mm = 0;
+ 
+ 	phy = eth->mdio_bus.devs[eth->phyaddr];
+-	phy_duplex = !!(phy->read(phy, 18) & (1 << 11));
++	phy_duplex = !!((*phy->read)(phy, 18) & (1 << 11));
+ 	mac_duplex = !!(eth->regs[RW_REC_CTRL] & 128);
+ 
+ 	if (mac_duplex != phy_duplex)
diff --git a/emulators/qemu/patches/patch-eh b/emulators/qemu/patches/patch-eh
new file mode 100644
index 00000000000..447fd0a17ea
--- /dev/null
+++ b/emulators/qemu/patches/patch-eh
@@ -0,0 +1,30 @@
+$NetBSD: patch-eh,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
+(PR lib/43832: ssp causes common names to be defines)
+
+--- hw/omap_dss.c.orig	2010-07-28 10:55:42.000000000 +0900
++++ hw/omap_dss.c	2010-08-08 04:13:39.000000000 +0900
+@@ -774,18 +774,18 @@
+         break;
+     case 0x58:	/* RFBI_READ */
+         if ((s->rfbi.control & (1 << 2)) && s->rfbi.chip[0])
+-            s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 1);
++            s->rfbi.rxbuf = (*s->rfbi.chip[0]->read)(s->rfbi.chip[0]->opaque, 1);
+         else if ((s->rfbi.control & (1 << 3)) && s->rfbi.chip[1])
+-            s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 1);
++            s->rfbi.rxbuf = (*s->rfbi.chip[0]->read)(s->rfbi.chip[0]->opaque, 1);
+         if (!-- s->rfbi.pixels)
+             omap_rfbi_transfer_stop(s);
+         break;
+ 
+     case 0x5c:	/* RFBI_STATUS */
+         if ((s->rfbi.control & (1 << 2)) && s->rfbi.chip[0])
+-            s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 0);
++            s->rfbi.rxbuf = (*s->rfbi.chip[0]->read)(s->rfbi.chip[0]->opaque, 0);
+         else if ((s->rfbi.control & (1 << 3)) && s->rfbi.chip[1])
+-            s->rfbi.rxbuf = s->rfbi.chip[0]->read(s->rfbi.chip[0]->opaque, 0);
++            s->rfbi.rxbuf = (*s->rfbi.chip[0]->read)(s->rfbi.chip[0]->opaque, 0);
+         if (!-- s->rfbi.pixels)
+             omap_rfbi_transfer_stop(s);
+         break;
diff --git a/emulators/qemu/patches/patch-ei b/emulators/qemu/patches/patch-ei
new file mode 100644
index 00000000000..47ef41a341b
--- /dev/null
+++ b/emulators/qemu/patches/patch-ei
@@ -0,0 +1,16 @@
+$NetBSD: patch-ei,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
+(PR lib/43832: ssp causes common names to be defines)
+
+--- rwhandler.c.orig	2010-07-28 10:55:42.000000000 +0900
++++ rwhandler.c	2010-08-08 04:03:18.000000000 +0900
+@@ -13,7 +13,7 @@
+ static uint32_t name(void *opaque, type addr) \
+ { \
+     struct ReadWriteHandler *handler = opaque; \
+-    return handler->read(handler, addr, len); \
++    return (*handler->read)(handler, addr, len); \
+ }
+ 
+ RWHANDLER_WRITE(cpu_io_memory_simple_writeb, 1, target_phys_addr_t);
diff --git a/emulators/qemu/patches/patch-ej b/emulators/qemu/patches/patch-ej
new file mode 100644
index 00000000000..531b599ce9e
--- /dev/null
+++ b/emulators/qemu/patches/patch-ej
@@ -0,0 +1,108 @@
+$NetBSD: patch-ej,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+1) bswap_NN() variants are not available in CONFIG_MACHINE_BSWAP_H case
+   (fixed in upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=ba5e7f82169f32ab8163c707d97c799ca09f8924
+
+2) don't use -1 against uint8_t
+   (fixed in upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=7bccf57383cca60a778d5c543ac80c9f62d89ef2
+http://git.qemu.org/qemu.git/commit/?id=aee474ebc62686ae8827747b0b1aed85b8122979
+
+3) fix uninitialized warning
+   (fixed in upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=d167f9bc06a577d6c85b8ed6991c1efe175aae7d
+http://git.qemu.org/qemu.git/commit/?id=ad7ee4ad6c3a5388acf94dd532d291ea6d3a5972
+
+--- ui/vnc-enc-tight.c.orig	2010-07-28 10:55:42.000000000 +0900
++++ ui/vnc-enc-tight.c	2010-08-08 17:14:17.000000000 +0900
+@@ -209,7 +209,7 @@
+                      d < w - x - VNC_TIGHT_DETECT_SUBROW_WIDTH; d++) {  \
+                 pix = ((uint##bpp##_t *)buf)[(y+d)*w+x+d];              \
+                 if (endian) {                                           \
+-                    pix = bswap_##bpp(pix);                             \
++                    pix = bswap##bpp(pix);                              \
+                 }                                                       \
+                 for (c = 0; c < 3; c++) {                               \
+                     left[c] = (int)(pix >> shift[c] & max[c]);          \
+@@ -218,7 +218,7 @@
+                      dx++) {                                            \
+                     pix = ((uint##bpp##_t *)buf)[(y+d)*w+x+d+dx];       \
+                     if (endian) {                                       \
+-                        pix = bswap_##bpp(pix);                         \
++                        pix = bswap##bpp(pix);                          \
+                     }                                                   \
+                     sum = 0;                                            \
+                     for (c = 0; c < 3; c++) {                           \
+@@ -281,7 +281,7 @@
+         return 0;
+     }
+ 
+-    if (vs->tight.quality != -1) {
++    if (vs->tight.quality != (uint8_t)-1) {
+         if (w * h < VNC_TIGHT_JPEG_MIN_RECT_SIZE) {
+             return 0;
+         }
+@@ -294,7 +294,7 @@
+     if (vs->clientds.pf.bytes_per_pixel == 4) {
+         if (vs->tight.pixel24) {
+             errors = tight_detect_smooth_image24(vs, w, h);
+-            if (vs->tight.quality != -1) {
++            if (vs->tight.quality != (uint8_t)-1) {
+                 return (errors < tight_conf[quality].jpeg_threshold24);
+             }
+             return (errors < tight_conf[compression].gradient_threshold24);
+@@ -443,7 +443,7 @@
+              * Should never happen, but don't break everything          \
+              * if it does, use the first color instead                  \
+              */                                                         \
+-            if (idx == -1) {                                            \
++            if (idx == (uint8_t)-1) {                                   \
+                 idx = 0;                                                \
+             }                                                           \
+             while (rep >= 0) {                                          \
+@@ -608,7 +608,7 @@
+             for (x = 0; x < w; x++) {                                   \
+                 pix = *buf;                                             \
+                 if (endian) {                                           \
+-                    pix = bswap_##bpp(pix);                             \
++                    pix = bswap##bpp(pix);                              \
+                 }                                                       \
+                 diff = 0;                                               \
+                 for (c = 0; c < 3; c++) {                               \
+@@ -628,7 +628,7 @@
+                         << shift[c];                                    \
+                 }                                                       \
+                 if (endian) {                                           \
+-                    diff = bswap_##bpp(diff);                           \
++                    diff = bswap##bpp(diff);                           \
+                 }                                                       \
+                 *buf++ = diff;                                          \
+             }                                                           \
+@@ -1469,6 +1469,8 @@
+         ret = send_mono_rect(vs, x, y, w, h, bg, fg);
+     } else if (colors <= 256) {
+         ret = send_palette_rect(vs, x, y, w, h, palette);
++    } else {
++        ret = 0;
+     }
+     return ret;
+ }
+@@ -1500,6 +1502,8 @@
+             ret = send_jpeg_rect(vs, x, y, w, h, quality);
+         } else {
+             ret = send_palette_rect(vs, x, y, w, h, palette);
++        } else {
++	    ret = 0;
+         }
+     }
+     return ret;
+@@ -1522,7 +1526,7 @@
+     colors = tight_fill_palette(vs, x, y, w * h, &fg, &bg, &palette);
+ 
+ #ifdef CONFIG_VNC_JPEG
+-    if (vs->tight.quality != -1) {
++    if (vs->tight.quality != (uint8_t)-1) {
+         ret = send_sub_rect_jpeg(vs, x, y, w, h, bg, fg, colors, palette);
+     } else {
+         ret = send_sub_rect_nojpeg(vs, x, y, w, h, bg, fg, colors, palette);
diff --git a/emulators/qemu/patches/patch-ek b/emulators/qemu/patches/patch-ek
new file mode 100644
index 00000000000..c1138735abe
--- /dev/null
+++ b/emulators/qemu/patches/patch-ek
@@ -0,0 +1,45 @@
+$NetBSD: patch-ek,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Improve ATA IDENTIFY word 64 contents
+(fixed in upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=79d1d3311319f3390f540f547becaba9d957f84c
+
+Don't use <0 against unsigned variable
+(fixed in upstream master but not in stable-0.13 branch)
+http://git.qemu.org/qemu.git/commit/?id=7bccf57383cca60a778d5c543ac80c9f62d89ef2
+
+--- hw/ide/core.c.orig	2010-08-31 13:18:20.000000000 +0000
++++ hw/ide/core.c	2010-09-11 14:03:19.000000000 +0000
+@@ -138,6 +138,7 @@ static void ide_identify(IDEState *s)
+     put_le16(p + 61, s->nb_sectors >> 16);
+     put_le16(p + 62, 0x07); /* single word dma0-2 supported */
+     put_le16(p + 63, 0x07); /* mdma0-2 supported */
++    put_le16(p + 64, 0x03); /* pio3-4 supported */
+     put_le16(p + 65, 120);
+     put_le16(p + 66, 120);
+     put_le16(p + 67, 120);
+@@ -198,13 +199,12 @@ static void ide_atapi_identify(IDEState 
+     put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
+     put_le16(p + 62, 7);  /* single word dma0-2 supported */
+     put_le16(p + 63, 7);  /* mdma0-2 supported */
+-    put_le16(p + 64, 0x3f); /* PIO modes supported */
+ #else
+     put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
+     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
+     put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
+-    put_le16(p + 64, 1); /* PIO modes */
+ #endif
++    put_le16(p + 64, 3); /* pio3-4 supported */
+     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
+     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
+     put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
+@@ -2779,8 +2779,7 @@ static int ide_drive_pio_post_load(void 
+ {
+     IDEState *s = opaque;
+ 
+-    if (s->end_transfer_fn_idx < 0 ||
+-        s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
++    if (s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
+         return -EINVAL;
+     }
+     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
diff --git a/emulators/qemu/patches/patch-el b/emulators/qemu/patches/patch-el
new file mode 100644
index 00000000000..c831021afc4
--- /dev/null
+++ b/emulators/qemu/patches/patch-el
@@ -0,0 +1,58 @@
+$NetBSD: patch-el,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+NetBSD 4.0 (actually around 4.99.10) and prior don't have some C99 FP macro.
+(PR pkg/42899)
+
+--- fpu/softfloat-native.h.orig	2010-07-28 10:55:42.000000000 +0900
++++ fpu/softfloat-native.h	2010-08-10 22:08:51.000000000 +0900
+@@ -19,11 +19,15 @@
+  *        or Solaris 10 systems running GCC 3.x or less.
+  *   Solaris 10 with GCC4 does not need these macros as they
+  *   are defined in <iso/math_c99.h> with a compiler directive
++ *
++ *   NetBSD has got these macro around 4.99.10
++ *   (i.e. 5.0 release and later)
+  */
+ #if defined(CONFIG_SOLARIS) && \
+            ((CONFIG_SOLARIS_VERSION <= 9 ) || \
+            ((CONFIG_SOLARIS_VERSION == 10) && (__GNUC__ < 4))) \
+-    || (defined(__OpenBSD__) && (OpenBSD < 200811))
++    || (defined(__OpenBSD__) && (OpenBSD < 200811)) \
++    || (defined(__NetBSD__) && (__NetBSD_Version__ < 499001000))
+ /*
+  * C99 7.12.3 classification macros
+  * and
+@@ -32,30 +36,13 @@
+  * ... do not work on Solaris 10 using GNU CC 3.4.x.
+  * Try to workaround the missing / broken C99 math macros.
+  */
+-#if defined(__OpenBSD__)
++#if defined(__OpenBSD__) || defined(__NetBSD__)
+ #define unordered(x, y) (isnan(x) || isnan(y))
+ #endif
+ 
+-#ifdef __NetBSD__
+-#ifndef isgreater
+-#define isgreater(x, y)		__builtin_isgreater(x, y)
+-#endif
+-#ifndef isgreaterequal
+-#define isgreaterequal(x, y)	__builtin_isgreaterequal(x, y)
+-#endif
+-#ifndef isless
+-#define isless(x, y)		__builtin_isless(x, y)
+-#endif
+-#ifndef islessequal
+-#define islessequal(x, y)	__builtin_islessequal(x, y)
+-#endif
+-#ifndef isunordered
+-#define isunordered(x, y)	__builtin_isunordered(x, y)
+-#endif
+-#endif
+-
+-
++#if !defined(__NetBSD__) /* NetBSD has had isnormal() since 2.0 */
+ #define isnormal(x)             (fpclass(x) >= FP_NZERO)
++#endif
+ #define isgreater(x, y)         ((!unordered(x, y)) && ((x) > (y)))
+ #define isgreaterequal(x, y)    ((!unordered(x, y)) && ((x) >= (y)))
+ #define isless(x, y)            ((!unordered(x, y)) && ((x) < (y)))
diff --git a/emulators/qemu/patches/patch-em b/emulators/qemu/patches/patch-em
new file mode 100644
index 00000000000..a89d8da2436
--- /dev/null
+++ b/emulators/qemu/patches/patch-em
@@ -0,0 +1,24 @@
+$NetBSD: patch-em,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Export libgcc builtin __clear_cache() since it's also referred from
+tcg/arm/tcg-target.h.
+
+--- exec-all.h.orig	2010-07-28 01:55:42.000000000 +0000
++++ exec-all.h
+@@ -202,11 +202,13 @@ static inline void tb_set_jmp_target1(un
+     /* no need to flush icache explicitly */
+ }
+ #elif defined(__arm__)
++#if QEMU_GNUC_PREREQ(4, 1)
++void __clear_cache(char *beg, char *end);
++#endif
++
+ static inline void tb_set_jmp_target1(unsigned long jmp_addr, unsigned long addr)
+ {
+-#if QEMU_GNUC_PREREQ(4, 1)
+-    void __clear_cache(char *beg, char *end);
+-#else
++#if !QEMU_GNUC_PREREQ(4, 1)
+     register unsigned long _beg __asm ("a1");
+     register unsigned long _end __asm ("a2");
+     register unsigned long _flg __asm ("a3");
diff --git a/emulators/qemu/patches/patch-en b/emulators/qemu/patches/patch-en
new file mode 100644
index 00000000000..c1f71fb8337
--- /dev/null
+++ b/emulators/qemu/patches/patch-en
@@ -0,0 +1,17 @@
+$NetBSD: patch-en,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Use ligbcc builtin __clear_cache() declared in exec-all.h
+instead of original __builtin___clear_cache() because
+the latter one is not available in (at least) gcc 4.1.3.
+
+--- tcg/arm/tcg-target.h.orig	2010-07-28 01:55:42.000000000 +0000
++++ tcg/arm/tcg-target.h
+@@ -83,7 +83,7 @@ enum {
+ static inline void flush_icache_range(unsigned long start, unsigned long stop)
+ {
+ #if QEMU_GNUC_PREREQ(4, 1)
+-    __builtin___clear_cache((char *) start, (char *) stop);
++    __clear_cache((char *) start, (char *) stop); /* declared in exec-all.h */
+ #else
+     register unsigned long _beg __asm ("a1") = start;
+     register unsigned long _end __asm ("a2") = stop;
diff --git a/emulators/qemu/patches/patch-eo b/emulators/qemu/patches/patch-eo
new file mode 100644
index 00000000000..6d9293d21fb
--- /dev/null
+++ b/emulators/qemu/patches/patch-eo
@@ -0,0 +1,135 @@
+$NetBSD: patch-eo,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Pull fixes for ESP SCSI DMA from upstream master:
+http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
+
+--- hw/esp.c.orig
++++ hw/esp.c
+@@ -80,6 +80,8 @@ struct ESPState {
+     ESPDMAMemoryReadWriteFunc dma_memory_read;
+     ESPDMAMemoryReadWriteFunc dma_memory_write;
+     void *dma_opaque;
++    int dma_enabled;
++    void (*dma_cb)(ESPState *s);
+ };
+ 
+ #define ESP_TCLO   0x0
+@@ -167,6 +169,24 @@ static void esp_lower_irq(ESPState *s)
+     }
+ }
+ 
++static void esp_dma_enable(void *opaque, int irq, int level)
++{
++    DeviceState *d = opaque;
++    ESPState *s = container_of(d, ESPState, busdev.qdev);
++
++    if (level) {
++        s->dma_enabled = 1;
++        DPRINTF("Raise enable\n");
++        if (s->dma_cb) {
++            s->dma_cb(s);
++            s->dma_cb = NULL;
++        }
++    } else {
++        DPRINTF("Lower enable\n");
++        s->dma_enabled = 0;
++    }
++}
++
+ static uint32_t get_cmd(ESPState *s, uint8_t *buf)
+ {
+     uint32_t dmalen;
+@@ -243,6 +263,10 @@ static void handle_satn(ESPState *s)
+     uint8_t buf[32];
+     int len;
+ 
++    if (!s->dma_enabled) {
++        s->dma_cb = handle_satn;
++        return;
++    }
+     len = get_cmd(s, buf);
+     if (len)
+         do_cmd(s, buf);
+@@ -253,6 +277,10 @@ static void handle_s_without_atn(ESPState *s)
+     uint8_t buf[32];
+     int len;
+ 
++    if (!s->dma_enabled) {
++        s->dma_cb = handle_s_without_atn;
++        return;
++    }
+     len = get_cmd(s, buf);
+     if (len) {
+         do_busid_cmd(s, buf, 0);
+@@ -261,6 +289,10 @@ static void handle_s_without_atn(ESPState *s)
+ 
+ static void handle_satn_stop(ESPState *s)
+ {
++    if (!s->dma_enabled) {
++        s->dma_cb = handle_satn_stop;
++        return;
++    }
+     s->cmdlen = get_cmd(s, s->cmdbuf);
+     if (s->cmdlen) {
+         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
+@@ -431,6 +463,7 @@ static void esp_hard_reset(DeviceState *d)
+     s->ti_wptr = 0;
+     s->dma = 0;
+     s->do_cmd = 0;
++    s->dma_cb = NULL;
+ 
+     s->rregs[ESP_CFG1] = 7;
+ }
+@@ -450,6 +483,18 @@ static void parent_esp_reset(void *opaque, int irq, int level)
+     }
+ }
+ 
++static void esp_gpio_demux(void *opaque, int irq, int level)
++{
++    switch (irq) {
++    case 0:
++        parent_esp_reset(opaque, irq, level);
++        break;
++    case 1:
++        esp_dma_enable(opaque, irq, level);
++        break;
++    }
++}
++
+ static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
+ {
+     ESPState *s = opaque;
+@@ -646,7 +691,8 @@ static const VMStateDescription vmstate_esp = {
+ void esp_init(target_phys_addr_t espaddr, int it_shift,
+               ESPDMAMemoryReadWriteFunc dma_memory_read,
+               ESPDMAMemoryReadWriteFunc dma_memory_write,
+-              void *dma_opaque, qemu_irq irq, qemu_irq *reset)
++              void *dma_opaque, qemu_irq irq, qemu_irq *reset,
++              qemu_irq *dma_enable)
+ {
+     DeviceState *dev;
+     SysBusDevice *s;
+@@ -658,11 +704,14 @@ void esp_init(target_phys_addr_t espaddr, int it_shift,
+     esp->dma_memory_write = dma_memory_write;
+     esp->dma_opaque = dma_opaque;
+     esp->it_shift = it_shift;
++    /* XXX for now until rc4030 has been changed to use DMA enable signal */
++    esp->dma_enabled = 1;
+     qdev_init_nofail(dev);
+     s = sysbus_from_qdev(dev);
+     sysbus_connect_irq(s, 0, irq);
+     sysbus_mmio_map(s, 0, espaddr);
+     *reset = qdev_get_gpio_in(dev, 0);
++    *dma_enable = qdev_get_gpio_in(dev, 1);
+ }
+ 
+ static int esp_init1(SysBusDevice *dev)
+@@ -676,7 +725,7 @@ static int esp_init1(SysBusDevice *dev)
+     esp_io_memory = cpu_register_io_memory(esp_mem_read, esp_mem_write, s);
+     sysbus_init_mmio(dev, ESP_REGS << s->it_shift, esp_io_memory);
+ 
+-    qdev_init_gpio_in(&dev->qdev, parent_esp_reset, 1);
++    qdev_init_gpio_in(&dev->qdev, esp_gpio_demux, 2);
+ 
+     scsi_bus_new(&s->bus, &dev->qdev, 0, ESP_MAX_DEVS, esp_command_complete);
+     return scsi_bus_legacy_handle_cmdline(&s->bus);
diff --git a/emulators/qemu/patches/patch-ep b/emulators/qemu/patches/patch-ep
new file mode 100644
index 00000000000..0800222fda6
--- /dev/null
+++ b/emulators/qemu/patches/patch-ep
@@ -0,0 +1,16 @@
+$NetBSD: patch-ep,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Pull fixes for ESP SCSI DMA from upstream master:
+http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
+
+--- hw/esp.h.orig
++++ hw/esp.h
+@@ -7,6 +7,7 @@ typedef void (*ESPDMAMemoryReadWriteFunc)(void *opaque, uint8_t *buf, int len);
+ void esp_init(target_phys_addr_t espaddr, int it_shift,
+               ESPDMAMemoryReadWriteFunc dma_memory_read,
+               ESPDMAMemoryReadWriteFunc dma_memory_write,
+-              void *dma_opaque, qemu_irq irq, qemu_irq *reset);
++              void *dma_opaque, qemu_irq irq, qemu_irq *reset,
++              qemu_irq *dma_enable);
+ 
+ #endif
diff --git a/emulators/qemu/patches/patch-eq b/emulators/qemu/patches/patch-eq
new file mode 100644
index 00000000000..0f499da036f
--- /dev/null
+++ b/emulators/qemu/patches/patch-eq
@@ -0,0 +1,37 @@
+$NetBSD: patch-eq,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Pull fixes for ESP SCSI DMA from upstream master:
+http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
+
+Also disable floppy which is broken.
+
+--- hw/mips_jazz.c.orig
++++ hw/mips_jazz.c
+@@ -136,7 +136,7 @@
+     NICInfo *nd;
+     PITState *pit;
+     DriveInfo *fds[MAX_FD];
+-    qemu_irq esp_reset;
++    qemu_irq esp_reset, dma_enable;
+     qemu_irq *cpu_exit_irq;
+     ram_addr_t ram_offset;
+     ram_addr_t bios_offset;
+@@ -244,7 +244,7 @@
+     /* SCSI adapter */
+     esp_init(0x80002000, 0,
+              rc4030_dma_read, rc4030_dma_write, dmas[0],
+-             rc4030[5], &esp_reset);
++             rc4030[5], &esp_reset, &dma_enable);
+ 
+     /* Floppy */
+     if (drive_get_max_bus(IF_FLOPPY) >= MAX_FD) {
+@@ -254,7 +254,9 @@
+     for (n = 0; n < MAX_FD; n++) {
+         fds[n] = drive_get(IF_FLOPPY, 0, n);
+     }
++#if 0	/* XXX: floppy emulation uses wrong ISA DMA (should be jazz DMA) */
+     fdctrl_init_sysbus(rc4030[1], 0, 0x80003000, fds);
++#endif
+ 
+     /* Real time clock */
+     rtc_init(1980, NULL);
diff --git a/emulators/qemu/patches/patch-er b/emulators/qemu/patches/patch-er
new file mode 100644
index 00000000000..c470e380c3b
--- /dev/null
+++ b/emulators/qemu/patches/patch-er
@@ -0,0 +1,62 @@
+$NetBSD: patch-er,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Pull fixes for ESP SCSI DMA from upstream master:
+http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
+
+--- hw/sparc32_dma.c.orig
++++ hw/sparc32_dma.c
+@@ -58,6 +58,7 @@
+ #define DMA_INTR 1
+ #define DMA_INTREN 0x10
+ #define DMA_WRITE_MEM 0x100
++#define DMA_EN 0x200
+ #define DMA_LOADED 0x04000000
+ #define DMA_DRAIN_FIFO 0x40
+ #define DMA_RESET 0x80
+@@ -72,7 +73,12 @@ struct DMAState {
+     uint32_t dmaregs[DMA_REGS];
+     qemu_irq irq;
+     void *iommu;
+-    qemu_irq dev_reset;
++    qemu_irq gpio[2];
++};
++
++enum {
++    GPIO_RESET = 0,
++    GPIO_DMA,
+ };
+ 
+ /* Note: on sparc, the lance 16 bit bus is swapped */
+@@ -201,12 +207,21 @@ static void dma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+             }
+         }
+         if (val & DMA_RESET) {
+-            qemu_irq_raise(s->dev_reset);
+-            qemu_irq_lower(s->dev_reset);
++            qemu_irq_raise(s->gpio[GPIO_RESET]);
++            qemu_irq_lower(s->gpio[GPIO_RESET]);
+         } else if (val & DMA_DRAIN_FIFO) {
+             val &= ~DMA_DRAIN_FIFO;
+         } else if (val == 0)
+             val = DMA_DRAIN_FIFO;
++
++        if (val & DMA_EN && !(s->dmaregs[0] & DMA_EN)) {
++            DPRINTF("Raise DMA enable\n");
++            qemu_irq_raise(s->gpio[GPIO_DMA]);
++        } else if (!(val & DMA_EN) && !!(s->dmaregs[0] & DMA_EN)) {
++            DPRINTF("Lower DMA enable\n");
++            qemu_irq_lower(s->gpio[GPIO_DMA]);
++        }
++
+         val &= ~DMA_CSR_RO_MASK;
+         val |= DMA_VER;
+         s->dmaregs[0] = (s->dmaregs[0] & DMA_CSR_RO_MASK) | val;
+@@ -262,7 +277,7 @@ static int sparc32_dma_init1(SysBusDevice *dev)
+     sysbus_init_mmio(dev, DMA_SIZE, dma_io_memory);
+ 
+     qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
+-    qdev_init_gpio_out(&dev->qdev, &s->dev_reset, 1);
++    qdev_init_gpio_out(&dev->qdev, s->gpio, 2);
+ 
+     return 0;
+ }
diff --git a/emulators/qemu/patches/patch-es b/emulators/qemu/patches/patch-es
new file mode 100644
index 00000000000..0804c3f21c4
--- /dev/null
+++ b/emulators/qemu/patches/patch-es
@@ -0,0 +1,79 @@
+$NetBSD: patch-es,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+
+Pull fixes for ESP SCSI DMA from upstream master:
+http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
+
+--- hw/sun4m.c.orig
++++ hw/sun4m.c
+@@ -810,7 +810,7 @@ static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
+     void *iommu, *espdma, *ledma, *nvram;
+     qemu_irq *cpu_irqs[MAX_CPUS], slavio_irq[32], slavio_cpu_irq[MAX_CPUS],
+         espdma_irq, ledma_irq;
+-    qemu_irq esp_reset;
++    qemu_irq esp_reset, dma_enable;
+     qemu_irq fdc_tc;
+     qemu_irq *cpu_halt;
+     unsigned long kernel_size;
+@@ -930,11 +930,12 @@ static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
+         exit(1);
+     }
+ 
+-    esp_reset = qdev_get_gpio_in(espdma, 0);
+     esp_init(hwdef->esp_base, 2,
+              espdma_memory_read, espdma_memory_write,
+-             espdma, espdma_irq, &esp_reset);
++             espdma, espdma_irq, &esp_reset, &dma_enable);
+ 
++    qdev_connect_gpio_out(espdma, 0, esp_reset);
++    qdev_connect_gpio_out(espdma, 1, dma_enable);
+ 
+     if (hwdef->cs_base) {
+         sysbus_create_simple("SUNW,CS4231", hwdef->cs_base,
+@@ -1494,7 +1495,7 @@ static void sun4d_hw_init(const struct sun4d_hwdef *hwdef, ram_addr_t RAM_size,
+     void *iounits[MAX_IOUNITS], *espdma, *ledma, *nvram;
+     qemu_irq *cpu_irqs[MAX_CPUS], sbi_irq[32], sbi_cpu_irq[MAX_CPUS],
+         espdma_irq, ledma_irq;
+-    qemu_irq esp_reset;
++    qemu_irq esp_reset, dma_enable;
+     unsigned long kernel_size;
+     void *fw_cfg;
+     DeviceState *dev;
+@@ -1561,10 +1562,12 @@ static void sun4d_hw_init(const struct sun4d_hwdef *hwdef, ram_addr_t RAM_size,
+         exit(1);
+     }
+ 
+-    esp_reset = qdev_get_gpio_in(espdma, 0);
+     esp_init(hwdef->esp_base, 2,
+              espdma_memory_read, espdma_memory_write,
+-             espdma, espdma_irq, &esp_reset);
++             espdma, espdma_irq, &esp_reset, &dma_enable);
++
++    qdev_connect_gpio_out(espdma, 0, esp_reset);
++    qdev_connect_gpio_out(espdma, 1, dma_enable);
+ 
+     kernel_size = sun4m_load_kernel(kernel_filename, initrd_filename,
+                                     RAM_size);
+@@ -1683,7 +1686,7 @@ static void sun4c_hw_init(const struct sun4c_hwdef *hwdef, ram_addr_t RAM_size,
+ {
+     void *iommu, *espdma, *ledma, *nvram;
+     qemu_irq *cpu_irqs, slavio_irq[8], espdma_irq, ledma_irq;
+-    qemu_irq esp_reset;
++    qemu_irq esp_reset, dma_enable;
+     qemu_irq fdc_tc;
+     unsigned long kernel_size;
+     DriveInfo *fd[MAX_FD];
+@@ -1751,10 +1754,12 @@ static void sun4c_hw_init(const struct sun4c_hwdef *hwdef, ram_addr_t RAM_size,
+         exit(1);
+     }
+ 
+-    esp_reset = qdev_get_gpio_in(espdma, 0);
+     esp_init(hwdef->esp_base, 2,
+              espdma_memory_read, espdma_memory_write,
+-             espdma, espdma_irq, &esp_reset);
++             espdma, espdma_irq, &esp_reset, &dma_enable);
++
++    qdev_connect_gpio_out(espdma, 0, esp_reset);
++    qdev_connect_gpio_out(espdma, 1, dma_enable);
+ 
+     kernel_size = sun4m_load_kernel(kernel_filename, initrd_filename,
+                                     RAM_size);