Update to 0.14.1

* New features are not tested yet, for example SPICE protocol support.
* I have tested on NetBSD/i386 5.99.54 and DragonFly/i386 2.10.1 as host,
  NetBSD/{amd64, i386, sparc} as guest.

Changelog:

0.14.1
    virtio-blk: fail unaligned requests
    qed: Fix consistency check on 32-bit hosts
    exit if -drive specified is invalid instead of ignoring the "wrong" -drive
    vhost: fix dirty page handling
    Do not delete BlockDriverState when deleting the drive
    vnc: tight: Fix crash after 2GB of output
    lan9118: Ignore write to MAC_VLAN1 register
    Don't allow multiwrites against a block device without     lsi53c895a: add support for ABORT messages
    virtio-pci: fix bus master work around on load
    fix applesmc REV key
    rbd: don't link with -lcrypto
    net: Add the missing option declaration of "vhostforce"
    lsi53c895a: Update dnad when skipping MSGOUT bytes
    Revert "prep: Disable second IDE channel, as long as ISA IDE emulation doesn't support same irq for both channels"
    isa-bus: Remove bogus IRQ sharing check
    virtio-net: Fix lduw_p() pointer argument of wrong size
    hw/sd.c: Add missing state change for SD_STATUS, SEND_NUM_WR_BLOCKS
    vnc: Fix fatal crash with vnc reverse mode
    qemu-char: Check for missing backend name

0.14.0
Targets
ARM
    Most of the changes are related to bug fixes and improvements to match what the real hardware does. For now there is no new board or CPU.

MIPS
    Host CPU consumption for idle guests
    Timer fixes
    FPU improvements

SH4
    Various bug fixes and improvements including
        SM501 2D engine copyrect support, needed to boot recent kernels
        MMU mmaped TLB access, needed to boot recent kernels
        Floating point exceptions and correct NaN support.

PPC
    Fix running recent PPC64 kernels
    New maintainer: Alexander Graf
    Improve interrupt injection with KVM
    Enable PV enabled guests for speedup with KVM
    Floating point fixes
    Add a ppc-440x5 Xilinx model
    Add a virtex5 ml507 refdesign board for ppc-440x5
    BookE MMU emulation improvements

s390x
    No news, business as usual.

SPARC
    Fix div(cc) and sdiv(cc) instruction emulation, fixes Xorg crash in the guest

Hosts
ARM
    Fix random crashes
    Fix 64-bit big-endian targets support

MIPS
    Fix random crashes

IA64
    Fix random crashes for 32-bit targets

Devices
IDE / AHCI
    Added emulation layer for an ICH-9 AHCI controller (not yet stable). Tested with Linux, OpenBSD, Windows Vista and Windows 7. The AHCI emulation supports NCQ, so multiple read or write requests can be outstanding at the same time.
        to use it, use the following command line snippet: -drive id=disk,file=<your image goes here>,if=none -device ahci,id=ahci -device ide-drive,drive=disk,bus=ahci.0

SCSI
    Various bug fixes, no new features.

USB
    Added USB support for remote wakeup, allowing the guest to suspend the USB bus when idle, which in turn reduces the CPU overhead of an idle machine.
    The USB subsystem also got a bunch of patches to prepare it for USB 2.0 support.

virtio
    virtio-pci can use ioeventfd for virtqueue notify. On systems that support KVM, the ioeventfd mechanism can be used to make virtqueue notify a lightweight exit by deferring hardware emulation to the iothread and allowing the VM to continue execution. This model is similar to how vhost receives virtqueue notifies. The result of this change is improved performance for userspace virtio devices. Virtio-blk throughput increases especially for multithreaded scenarios and virtio-net transmit throughput increases substantially. Read the commit message for more details.
    Various fixes and stabilization for live-migration:
    Various virtio-net improvements:
        Make tx_timer timeout configurable
        Limit number of packets sent per TX flush
        Introduce a new bottom half packet TX
        Fix cross-endianness support

PCI/PCI Express
    Improved PCI Express support and functionalities with the implementation of:
        flr (Function Level Reset)
        aer (Advanced Error Reporting) and other improvements
        A new monitor command to inject errors into the PCI bus: pcie_aer_inject_error
    Implementation of Message Signaled Interrupts (MSI/MSI-X) support
    Separation of the PCI bridge code from the main PCI code.

Sound
    New Intel HD Audio support, adding three new devices:
        intel-hda: Intel HD Audio Controller, the PCI device.
        hda-duplex: HDA Codec. Attaches to the HDA bus. Supports 16bit stereo, rates 16k -> 96k, playback, recording and volume control (with CONFIG_MIXEMU=y).
        hda-output: HDA Codec without recording support. Subset of the hda-duplex codec. Use this if you don't want your guests access your mic.
    Usage: add '-device intel-hda -device hda-duplex' to your command line.
    Tested guests:
        Linux works.
        Win7 works.
        DOS (mpxplay) works.
        WinXP doesn't work.

Real Time Clock
    Fix binary/BCD mode switch

Video
    Fix cirrus VGA crash with some guests
    Fix curses big endian support

Block Drivers
qcow2
    Added a writeback metadata cache. This improves performance of scenarios with lots of cluster allocations noticably (e.g. installation or after taking a snapshot), in some benchmarks by a factor of ten or more. Use cache=none or cache=writeback to take advantage from this change.
    Copy snapshots out of QCOW2 disk, eg: qemu-img convert -f qcow2 -O qcow2 -s snapshot_name src_img bck_img
    Zero-copy read and write operations
    Other fixes and code cleanups:
        qcow2: Invalidate cache after failed read
        block: Allow bdrv_flush to return errors
        qcow2: Simplify image creation
        qcow2: Fixes unaligned access on IA64

qed
    Introduction of the QEMU Enhanced Disk (qed) image format. It is a disk image format that forgoes features found in qcow2 in favor of better levels of performance and data integrity. Due to its simpler on-disk layout, it is possible to safely perform metadata updates more efficiently.
    More information about qed: http://wiki.qemu.org/Features/QED
    Initial thread discussion: http://lists.nongnu.org/archive/html/qemu-devel/2010-09/msg00310.html

ceph/rbd
    Introduction of the new ceph/rbd block driver. RBD is an block driver for the distributed file system Ceph.
    More information about ceph: http://ceph.newdream.net/

nbd
    Improve qemu-nbd performance by 4400 %. This patch combines the reply header and payload send operation.
    Introduce NBD named exports.

Spice
    New support for the SPICE protocol. The project main focus is to provide high-quality remote access to QEMU virtual machines. More information about SPICE can be found at the project's web site: http://spice-space.org/
    New qxl device. qxl is a paravirtual graphics card. The qxl device is the bridge between the guest and the spice server (aka libspice-server). The spice server will send the rendering commands to the spice client, which will actually render them. The spice server is also able to render locally, which is done in case the guest wants read something from video memory. Local rendering is also used to support display over vnc and sdl. qxl is activated using -vga qxl. qxl supports multihead, additional cards can be added via '-device qxl.
    Relevant commits:
        spice: core bits
        spice: add keyboard
        spice: add mouse
        spice: simple display
        spice: add tablet support
        spice: tls support
        spice: make compression configurable.
        spice: add config options for channel security.
        spice: add config options for the listening address
        spice: add misc config options
        spice: add audio
        spice: add qxl device
        spice: connection events.

QMP / monitor

    TODO: QMP is now stable, except for error reporting?
    The work to facilitate the management of QEMU instances has been improved. QMP has received various fixes. Now it is possible to call a traditional monitor command through QMP, in case your application depends on the output or the command is not yet ported to QMP.
    New commands:
        query-spice / info spice
        human-monitor-command
        set_password
        drive_del
        block_resize command, allowing resizing of block devices while qemu is running. For virtio-blk the size is updated automatically when this command is issued on the host. IDE is not supported. For SCSI devices the new size can be updated in Linux guests by doing the following shell command:

echo > /sys/class/scsi_device/0:0:0:0/device/rescan

Tracing
    Introduction of platform-independent tracing, more information about it: http://wiki.qemu.org/Features/Tracing
    Documentation and tutorial: http://git.qemu.org/qemu.git/plain/docs/tracing.txt
    Some relevant commits:
        Add trace-events file for declaring trace events
        Add a DTrace tracing backend targetted for SystemTAP compatibility
        Add LTTng Userspace Tracer backend
        Add simple built-in tracing backend
        Add stderr trace-event backend:
        Support for dynamically enabling/disabling trace events
        Specify trace file name
        Add trace-file command to open/close/flush trace file

Other stuff
    Extend -option-rom command to have additional parameter bootindex
    Little endian / big endian MMIO framework. Until now, most devices had special hacks to allow them to work on big and little endian systems (ppc / x86). With that framework, they should mostly work with both and not require and device specific hacks anymore.

27 files changed, 111 insertions, 691 deletions

diff --git a/emulators/qemu/Makefile b/emulators/qemu/Makefile
index 2c5ddd3b910..67786843f1b 100644
--- a/emulators/qemu/Makefile
+++ b/emulators/qemu/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.79 2011/04/05 08:38:00 wiz Exp $
+# $NetBSD: Makefile,v 1.80 2011/07/11 09:57:18 ryoon Exp $
 
-DISTNAME=		qemu-0.13.0
-PKGREVISION=		1
+DISTNAME=		qemu-0.14.1
 CATEGORIES=		emulators
 MASTER_SITES=		http://download.savannah.gnu.org/releases/qemu/
 
@@ -49,6 +48,7 @@ SUBST_FILES.qaudio=	arch_init.c monitor.c savevm.c vl.c \
 			hw/cs4231a.c \
 			hw/es1370.c \
 			hw/gus.c \
+			hw/hda-audio.c \
 			hw/marvell_88w8618_audio.c \
 			hw/mips_fulong2e.c \
 			hw/mips_jazz.c \
diff --git a/emulators/qemu/PLIST b/emulators/qemu/PLIST
index e991b6f5d14..8bf0d203b28 100644
--- a/emulators/qemu/PLIST
+++ b/emulators/qemu/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.24 2010/11/09 10:37:12 jmmv Exp $
+@comment $NetBSD: PLIST,v 1.25 2011/07/11 09:57:18 ryoon Exp $
 bin/qemu
 ${PLIST.alpha}bin/qemu-alpha
 ${PLIST.arm}bin/qemu-arm
@@ -47,7 +47,6 @@ share/examples/qemu/target-x86_64.conf
 share/qemu/bamboo.dtb
 share/qemu/bios.bin
 share/qemu/gpxe-eepro100-80861209.rom
-share/qemu/gpxe-eepro100-80861229.rom
 share/qemu/keymaps/ar
 share/qemu/keymaps/common
 share/qemu/keymaps/da
@@ -98,4 +97,6 @@ share/qemu/pxe-virtio.bin
 share/qemu/s390-zipl.rom
 share/qemu/vgabios-cirrus.bin
 share/qemu/vgabios.bin
-share/qemu/video.x
+share/qemu/vgabios-qxl.bin
+share/qemu/vgabios-stdvga.bin
+share/qemu/vgabios-vmware.bin
diff --git a/emulators/qemu/distinfo b/emulators/qemu/distinfo
index 609f4cf6b2e..7b97110ddb6 100644
--- a/emulators/qemu/distinfo
+++ b/emulators/qemu/distinfo
@@ -1,28 +1,18 @@
-$NetBSD: distinfo,v 1.65 2011/04/03 09:56:39 shattered Exp $
+$NetBSD: distinfo,v 1.66 2011/07/11 09:57:18 ryoon Exp $
 
-SHA1 (qemu-0.13.0.tar.gz) = 250bba1fdb505a787c48331b6b02f54282edfc76
-RMD160 (qemu-0.13.0.tar.gz) = 4a6faaf38d5616fb7bedc1a6408de1dbb3ec360c
-Size (qemu-0.13.0.tar.gz) = 5184531 bytes
-SHA1 (patch-aa) = bc2f9ea4bd468b1c8bd5623b21ea7631fe5466c3
-SHA1 (patch-ao) = e515093b6ea99f9cba665de022fd62f3be911569
-SHA1 (patch-ba) = 217eb00a0cabd460981026a275d18b6c02914a1c
-SHA1 (patch-bb) = 5d3d034a9ac0f7f35cd5dc9a8f5814f5cb3e42dc
-SHA1 (patch-dd) = bd8016bdeab043f2b2c12728b11e8b54e75dcce9
-SHA1 (patch-de) = 225eaa996fccc02b17be0099d943c75302600ada
-SHA1 (patch-ed) = c30e147005e41fbf6d08457634d94cd90545cbb5
-SHA1 (patch-ee) = 54811c6a45dee3aa1a4ad6c956053c23aa14146a
-SHA1 (patch-ef) = 0e1c2b364cc52aa9a7295e0e025b53498082d4a7
-SHA1 (patch-eg) = f511730d3b5640f10973d70b891e28bf140beb3c
-SHA1 (patch-eh) = 008c648dd74b273bd920521f7e01da5928c7c775
-SHA1 (patch-ei) = aee213dc347808f7aabedd7a8ce9f9477b12b9f0
-SHA1 (patch-ej) = e4226a53a314f02012f188d65765ab2f2de08176
-SHA1 (patch-ek) = a4bfeb9887c5caddaf660fecaaa59f7468eec2ed
-SHA1 (patch-el) = c8ab982a32e2c47deba9bd8a5b574d83fb80234d
-SHA1 (patch-em) = 4993ef668321e38ce63014494cb2ddb447637eb8
-SHA1 (patch-en) = d40b933f2b491ad18fb5ba43203311d6a3b28f06
-SHA1 (patch-eo) = 3617e3543d52009ab0514e78cd5175a85cd90c63
-SHA1 (patch-ep) = 03723d2f3ed666616d8e7701bfe32e104df9e3c9
-SHA1 (patch-eq) = c6854cb155be431de15ba23f19e619df8cb7fbba
-SHA1 (patch-er) = dcc723b1ecdcb78b080b5d05e2b7849e8721beec
-SHA1 (patch-es) = 23b89cbcef79fc4f817525a6b8d62b47b2a3fc2c
-SHA1 (patch-et) = 1d3fb0fee7fcea551aaa1c2a59cf70aeff85028d
+SHA1 (qemu-0.14.1.tar.gz) = 1a5003a03004b62b52562d1cbb8f50c5f135e0b8
+RMD160 (qemu-0.14.1.tar.gz) = 0601ff4e613fea0a6ce80907e2bfa11704048b36
+Size (qemu-0.14.1.tar.gz) = 5439697 bytes
+SHA1 (patch-ao) = 332f53e573e5ed52df81a1162e6cd0eb0be04654
+SHA1 (patch-ba) = 802597199b574a6680620908612510d0094a44c3
+SHA1 (patch-dd) = 8c67f9bc491c33d36563e00006ca91940004a31f
+SHA1 (patch-ed) = 489f9da73852cbce66dde7506136040a1f6fc95f
+SHA1 (patch-ef) = f05a2b2a394114ea039bd8be5bd4d9a1fac8be76
+SHA1 (patch-eg) = d78fdb8fb5a0cc6b7e5c41ffc749285866bb5243
+SHA1 (patch-eh) = 3d2c69d52bfa1ef0a64427db09a27a63f281ea58
+SHA1 (patch-ei) = f575651f2f5653e3e24649c4c9dbd1a627cdee77
+SHA1 (patch-ej) = 6d0904ab75d57bfcf8abae1518b1dee4033eac65
+SHA1 (patch-el) = 3e2dd725ca3cf658b43a9ec07dc8d596f65bf3c9
+SHA1 (patch-en) = 9ea3b764e0bb7161d593ac830a0e24b598a179b6
+SHA1 (patch-et) = 09129c2eac330f83af7ac27a43fc7f19dbca8859
+SHA1 (patch-ioport.c) = 438f0437df17585daf8edc346dffa9b3024fff2d
diff --git a/emulators/qemu/patches/patch-aa b/emulators/qemu/patches/patch-aa
deleted file mode 100644
index 67411e6c964..00000000000
--- a/emulators/qemu/patches/patch-aa
+++ /dev/null
@@ -1,55 +0,0 @@
-$NetBSD: patch-aa,v 1.8 2010/10/27 13:24:09 tsutsui Exp $
-
---- net/tap-bsd.c.orig	2010-07-28 01:55:42.000000000 +0000
-+++ net/tap-bsd.c
-@@ -28,6 +28,8 @@
- #include "qemu-error.h"
- 
- #ifdef __NetBSD__
-+#include <sys/ioctl.h>
-+#include <net/if.h>
- #include <net/if_tap.h>
- #endif
- 
-@@ -44,8 +46,12 @@
- int tap_open(char *ifname, int ifname_size, int *vnet_hdr, int vnet_hdr_required)
- {
-     int fd;
-+#ifdef TAPGIFNAME
-+    struct ifreq ifr;
-+#else
-     char *dev;
-     struct stat s;
-+#endif
- 
- #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
-     /* if no ifname is given, always start the search from tap0. */
-@@ -77,14 +83,26 @@ int tap_open(char *ifname, int ifname_si
- #else
-     TFR(fd = open("/dev/tap", O_RDWR));
-     if (fd < 0) {
--        fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
-+        fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation: %s\n", strerror(errno));
-         return -1;
-     }
- #endif
- 
--    fstat(fd, &s);
-+#ifdef TAPGIFNAME
-+    if (ioctl (fd, TAPGIFNAME, (void*)&ifr) < 0) {
-+       fprintf(stderr, "warning: could not open get tap name: %s\n",
-+           strerror(errno));
-+       return -1;
-+    }
-+    pstrcpy(ifname, ifname_size, ifr.ifr_name);
-+#else
-+    if (fstat(fd, &s) < 0) {
-+        fprintf(stderr, "warning: could not stat /dev/tap: no virtual network emulation: %s\n", strerror(errno));
-+        return -1;
-+    }
-     dev = devname(s.st_rdev, S_IFCHR);
-     pstrcpy(ifname, ifname_size, dev);
-+#endif
- 
-     if (*vnet_hdr) {
-         /* BSD doesn't have IFF_VNET_HDR */
diff --git a/emulators/qemu/patches/patch-ao b/emulators/qemu/patches/patch-ao
index b69649eeef9..c73e7420fb3 100644
--- a/emulators/qemu/patches/patch-ao
+++ b/emulators/qemu/patches/patch-ao
@@ -1,8 +1,8 @@
-$NetBSD: patch-ao,v 1.3 2009/01/22 07:27:28 jmmv Exp $
+$NetBSD: patch-ao,v 1.4 2011/07/11 09:57:18 ryoon Exp $
 
---- audio/mixeng.c.orig	2008-01-06 20:38:41.000000000 +0100
+--- audio/mixeng.c.orig	2011-05-06 19:01:43.000000000 +0000
 +++ audio/mixeng.c
-@@ -145,56 +145,64 @@
+@@ -143,56 +143,64 @@
  #undef IN_T
  #undef SHIFT
  
@@ -91,7 +91,7 @@ $NetBSD: patch-ao,v 1.3 2009/01/22 07:27:28 jmmv Exp $
              }
          }
      }
-@@ -204,52 +212,52 @@ f_sample *mixeng_clip[2][2][2][3] = {
+@@ -202,52 +210,52 @@ f_sample *mixeng_clip[2][2][2][3] = {
      {
          {
              {
diff --git a/emulators/qemu/patches/patch-ba b/emulators/qemu/patches/patch-ba
index 523bc43d59c..47be0a7d2bf 100644
--- a/emulators/qemu/patches/patch-ba
+++ b/emulators/qemu/patches/patch-ba
@@ -1,6 +1,6 @@
-$NetBSD: patch-ba,v 1.3 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-ba,v 1.4 2011/07/11 09:57:18 ryoon Exp $
 
---- hw/pcspk.c.orig	2010-07-28 01:55:42.000000000 +0000
+--- hw/pcspk.c.orig	2011-05-06 19:01:43.000000000 +0000
 +++ hw/pcspk.c
 @@ -42,7 +42,6 @@ typedef struct {
      unsigned int samples;
diff --git a/emulators/qemu/patches/patch-bb b/emulators/qemu/patches/patch-bb
deleted file mode 100644
index de893688d3a..00000000000
--- a/emulators/qemu/patches/patch-bb
+++ /dev/null
@@ -1,19 +0,0 @@
-$NetBSD: patch-bb,v 1.1 2011/04/03 09:56:39 shattered Exp $
-
---- pc-bios/optionrom/signrom.sh.orig	2010-02-23 20:54:38.000000000 +0000
-+++ pc-bios/optionrom/signrom.sh	2010-04-09 06:18:25.000000000 +0000
-@@ -26,12 +26,12 @@
- sum=0
- 
- # find out the file size
--x=`dd if="$1" bs=1 count=1 skip=2 2>/dev/null | od -t u1 -A n`
-+x=`dd if="$1" bs=1 count=1 skip=2 2>/dev/null | od -t u1 | sed -e 's/^[0-9]* *//' -e 's/^00*\([0-9]\)/\1/'`
- #size=`expr $x \* 512 - 1`
- size=$(( $x * 512 - 1 ))
- 
- # now get the checksum
--nums=`od -A n -t u1 -v "$1"`
-+nums=`od -t u1 -v "$1" | sed -e 's/^[0-9]* *//' -e 's/^00*\([0-9]\)/\1/' -e 's/ 00*\([0-9]\)/ \1/g'`
- for i in ${nums}; do
-     # add each byte's value to sum
-     sum=`expr $sum + $i`
diff --git a/emulators/qemu/patches/patch-dd b/emulators/qemu/patches/patch-dd
index 4b4823cc219..31e20c2f09d 100644
--- a/emulators/qemu/patches/patch-dd
+++ b/emulators/qemu/patches/patch-dd
@@ -1,4 +1,4 @@
-$NetBSD: patch-dd,v 1.5 2010/11/09 10:37:12 jmmv Exp $
+$NetBSD: patch-dd,v 1.6 2011/07/11 09:57:18 ryoon Exp $
 
 Remove confsuffix from sysconfdir so that our PKG_SYSCONFSUBDIR setting
 works.
@@ -8,9 +8,24 @@ Install man pages into ${PREFIX}/man, not ${PREFIX}/share/man.
 Handle arm and armeb case on NetBSD.
 XXX: it looks mips is always treated as big endian.
 
---- configure.orig	2010-10-15 20:56:09.000000000 +0000
+--- configure.orig	2011-05-06 19:01:43.000000000 +0000
 +++ configure
-@@ -199,13 +199,19 @@ elif check_define __s390__ ; then
+@@ -140,12 +140,12 @@ bigendian="no"
+ mingw32="no"
+ EXESUF=""
+ prefix="/usr/local"
+-mandir="\${prefix}/share/man"
++mandir="\${prefix}/man"
+ datadir="\${prefix}/share/qemu"
+ docdir="\${prefix}/share/doc/qemu"
+ bindir="\${prefix}/bin"
+ sysconfdir="\${prefix}/etc"
+-confsuffix="/qemu"
++confsuffix=""
+ slirp="yes"
+ fmod_lib=""
+ fmod_inc=""
+@@ -275,12 +275,18 @@ elif check_define __s390__ ; then
    else
      cpu="s390"
    fi
@@ -24,29 +39,13 @@ XXX: it looks mips is always treated as big endian.
    cpu=`uname -m`
  fi
  
- target_list=""
  case "$cpu" in
 -  alpha|cris|ia64|m68k|microblaze|ppc|ppc64|sparc64)
 +  alpha|arm|armeb|cris|ia64|m68k|microblaze|ppc|ppc64|sparc64)
      cpu="$cpu"
    ;;
    i386|i486|i586|i686|i86pc|BePC)
-@@ -285,12 +291,12 @@ bigendian="no"
- mingw32="no"
- EXESUF=""
- prefix="/usr/local"
--mandir="\${prefix}/share/man"
-+mandir="\${prefix}/man"
- datadir="\${prefix}/share/qemu"
- docdir="\${prefix}/share/doc/qemu"
- bindir="\${prefix}/bin"
- sysconfdir="\${prefix}/etc"
--confsuffix="/qemu"
-+confsuffix=""
- slirp="yes"
- fmod_lib=""
- fmod_inc=""
-@@ -1036,7 +1042,7 @@ else
+@@ -1080,7 +1086,7 @@ else
  
  # if cross compiling, cannot launch a program, so make a static guess
  case "$cpu" in
@@ -55,7 +54,7 @@ XXX: it looks mips is always treated as big endian.
      bigendian=yes
    ;;
  esac
-@@ -2212,7 +2218,7 @@ case "$cpu" in
+@@ -2498,7 +2504,7 @@ case "$cpu" in
    i386|x86_64|alpha|cris|hppa|ia64|m68k|microblaze|mips|mips64|ppc|ppc64|s390|s390x|sparc|sparc64)
      ARCH=$cpu
    ;;
diff --git a/emulators/qemu/patches/patch-de b/emulators/qemu/patches/patch-de
deleted file mode 100644
index 90b8496dddd..00000000000
--- a/emulators/qemu/patches/patch-de
+++ /dev/null
@@ -1,13 +0,0 @@
-$NetBSD: patch-de,v 1.4 2010/02/27 23:21:13 tnn Exp $
-
---- exec.c.orig	2010-02-23 20:54:38.000000000 +0000
-+++ exec.c
-@@ -463,7 +463,7 @@ static void code_gen_alloc(unsigned long
-             exit(1);
-         }
-     }
--#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
-+#elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__) || defined(__NetBSD__)
-     {
-         int flags;
-         void *addr = NULL;
diff --git a/emulators/qemu/patches/patch-ed b/emulators/qemu/patches/patch-ed
index 561f93bded6..4758d5ca5da 100644
--- a/emulators/qemu/patches/patch-ed
+++ b/emulators/qemu/patches/patch-ed
@@ -1,8 +1,8 @@
-$NetBSD: patch-ed,v 1.2 2010/08/09 21:19:09 tsutsui Exp $
+$NetBSD: patch-ed,v 1.3 2011/07/11 09:57:18 ryoon Exp $
 
---- target-i386/translate.c.orig	2010-05-04 15:27:48.000000000 +0000
+--- target-i386/translate.c.orig	2011-05-06 19:01:44.000000000 +0000
 +++ target-i386/translate.c
-@@ -4879,20 +4879,23 @@ static target_ulong disas_insn(DisasCont
+@@ -4857,20 +4857,23 @@ static target_ulong disas_insn(DisasCont
              tcg_gen_sub_tl(t2, cpu_regs[R_EAX], t0);
              gen_extu(ot, t2);
              tcg_gen_brcondi_tl(TCG_COND_EQ, t2, 0, label1);
diff --git a/emulators/qemu/patches/patch-ee b/emulators/qemu/patches/patch-ee
deleted file mode 100644
index 3f2c74d3b10..00000000000
--- a/emulators/qemu/patches/patch-ee
+++ /dev/null
@@ -1,26 +0,0 @@
-$NetBSD: patch-ee,v 1.3 2010/10/27 13:24:09 tsutsui Exp $
-
-Remove unnecessary includes. "qemu_socket.h" is enough and
-including <netinet/tcp.h> without <netinet/in.h> causes errors.
-(fixed in the upstream master but not in stable-0.13 branch)
-http://git.qemu.org/qemu.git/commit/?id=aab2e8f79ad253c760787ff3ce4d64967fed0003
-
---- block/sheepdog.c.orig	2010-07-28 01:55:42.000000000 +0000
-+++ block/sheepdog.c	2010-08-08 09:17:28.000000000 +0000
-@@ -8,16 +8,6 @@
-  * You should have received a copy of the GNU General Public License
-  * along with this program. If not, see <http://www.gnu.org/licenses/>.
-  */
--#ifdef _WIN32
--#include <windows.h>
--#include <winsock2.h>
--#include <ws2tcpip.h>
--#else
--#include <netdb.h>
--#include <netinet/tcp.h>
--
--#define closesocket(s) close(s)
--#endif
- 
- #include "qemu-common.h"
- #include "qemu-error.h"
diff --git a/emulators/qemu/patches/patch-ef b/emulators/qemu/patches/patch-ef
index 5f662adb428..cec74b0df19 100644
--- a/emulators/qemu/patches/patch-ef
+++ b/emulators/qemu/patches/patch-ef
@@ -1,11 +1,11 @@
-$NetBSD: patch-ef,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-ef,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
 (PR lib/43832: ssp causes common names to be defines)
 
---- audio/audio.c.orig	2010-07-28 10:55:42.000000000 +0900
-+++ audio/audio.c	2010-08-08 04:02:07.000000000 +0900
-@@ -1163,7 +1163,7 @@
+--- audio/audio.c.orig	2011-05-06 19:01:43.000000000 +0000
++++ audio/audio.c
+@@ -1162,7 +1162,7 @@ int AUD_read (SWVoiceIn *sw, void *buf, 
          return 0;
      }
  
diff --git a/emulators/qemu/patches/patch-eg b/emulators/qemu/patches/patch-eg
index 82d07224e3d..b73eec14fc8 100644
--- a/emulators/qemu/patches/patch-eg
+++ b/emulators/qemu/patches/patch-eg
@@ -1,11 +1,11 @@
-$NetBSD: patch-eg,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-eg,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
 (PR lib/43832: ssp causes common names to be defines)
 
---- hw/etraxfs_eth.c.orig	2010-07-28 10:55:42.000000000 +0900
-+++ hw/etraxfs_eth.c	2010-08-08 04:14:31.000000000 +0900
-@@ -184,7 +184,7 @@
+--- hw/etraxfs_eth.c.orig	2011-05-06 19:01:43.000000000 +0000
++++ hw/etraxfs_eth.c
+@@ -184,7 +184,7 @@ static void mdio_read_req(struct qemu_md
  
  	phy = bus->devs[bus->addr];
  	if (phy && phy->read)
@@ -14,7 +14,7 @@ Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
  	else 
  		bus->data = 0xffff;
  }
-@@ -347,7 +347,7 @@
+@@ -347,7 +347,7 @@ static void eth_validate_duplex(struct f
  	int new_mm = 0;
  
  	phy = eth->mdio_bus.devs[eth->phyaddr];
diff --git a/emulators/qemu/patches/patch-eh b/emulators/qemu/patches/patch-eh
index 447fd0a17ea..7bcfc45c370 100644
--- a/emulators/qemu/patches/patch-eh
+++ b/emulators/qemu/patches/patch-eh
@@ -1,11 +1,11 @@
-$NetBSD: patch-eh,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-eh,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
 (PR lib/43832: ssp causes common names to be defines)
 
---- hw/omap_dss.c.orig	2010-07-28 10:55:42.000000000 +0900
-+++ hw/omap_dss.c	2010-08-08 04:13:39.000000000 +0900
-@@ -774,18 +774,18 @@
+--- hw/omap_dss.c.orig	2011-05-06 19:01:43.000000000 +0000
++++ hw/omap_dss.c
+@@ -774,18 +774,18 @@ static void omap_rfbi_write(void *opaque
          break;
      case 0x58:	/* RFBI_READ */
          if ((s->rfbi.control & (1 << 2)) && s->rfbi.chip[0])
diff --git a/emulators/qemu/patches/patch-ei b/emulators/qemu/patches/patch-ei
index 47ef41a341b..59a87acf552 100644
--- a/emulators/qemu/patches/patch-ei
+++ b/emulators/qemu/patches/patch-ei
@@ -1,11 +1,11 @@
-$NetBSD: patch-ei,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-ei,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 Avoid conflicts with SSP read() macro in NetBSD's <ssp/unistd.h>
 (PR lib/43832: ssp causes common names to be defines)
 
---- rwhandler.c.orig	2010-07-28 10:55:42.000000000 +0900
-+++ rwhandler.c	2010-08-08 04:03:18.000000000 +0900
-@@ -13,7 +13,7 @@
+--- rwhandler.c.orig	2011-05-06 19:01:44.000000000 +0000
++++ rwhandler.c
+@@ -13,7 +13,7 @@ static void name(void *opaque, type addr
  static uint32_t name(void *opaque, type addr) \
  { \
      struct ReadWriteHandler *handler = opaque; \
diff --git a/emulators/qemu/patches/patch-ej b/emulators/qemu/patches/patch-ej
index 420083bf3b8..b8c2c6d9071 100644
--- a/emulators/qemu/patches/patch-ej
+++ b/emulators/qemu/patches/patch-ej
@@ -1,4 +1,4 @@
-$NetBSD: patch-ej,v 1.3 2011/03/04 13:03:48 tsutsui Exp $
+$NetBSD: patch-ej,v 1.4 2011/07/11 09:57:18 ryoon Exp $
 
 1) bswap_NN() variants are not available in CONFIG_MACHINE_BSWAP_H case
    (fixed in upstream master but not in stable-0.13 branch)
@@ -16,7 +16,7 @@ http://git.qemu.org/qemu.git/commit/?id=ad7ee4ad6c3a5388acf94dd532d291ea6d3a5972
 
 4) include <sys/types.h> to fix build on Mac OS X
 
---- ui/vnc-enc-tight.c.orig	2010-10-15 20:56:09.000000000 +0000
+--- ui/vnc-enc-tight.c.orig	2011-05-06 19:01:44.000000000 +0000
 +++ ui/vnc-enc-tight.c
 @@ -35,6 +35,7 @@
  #include <stdio.h>
@@ -26,93 +26,3 @@ http://git.qemu.org/qemu.git/commit/?id=ad7ee4ad6c3a5388acf94dd532d291ea6d3a5972
  
  #include "qemu-common.h"
  
-@@ -209,7 +210,7 @@
-                      d < w - x - VNC_TIGHT_DETECT_SUBROW_WIDTH; d++) {  \
-                 pix = ((uint##bpp##_t *)buf)[(y+d)*w+x+d];              \
-                 if (endian) {                                           \
--                    pix = bswap_##bpp(pix);                             \
-+                    pix = bswap##bpp(pix);                              \
-                 }                                                       \
-                 for (c = 0; c < 3; c++) {                               \
-                     left[c] = (int)(pix >> shift[c] & max[c]);          \
-@@ -218,7 +219,7 @@
-                      dx++) {                                            \
-                     pix = ((uint##bpp##_t *)buf)[(y+d)*w+x+d+dx];       \
-                     if (endian) {                                       \
--                        pix = bswap_##bpp(pix);                         \
-+                        pix = bswap##bpp(pix);                          \
-                     }                                                   \
-                     sum = 0;                                            \
-                     for (c = 0; c < 3; c++) {                           \
-@@ -281,7 +282,7 @@
-         return 0;
-     }
- 
--    if (vs->tight.quality != -1) {
-+    if (vs->tight.quality != (uint8_t)-1) {
-         if (w * h < VNC_TIGHT_JPEG_MIN_RECT_SIZE) {
-             return 0;
-         }
-@@ -294,7 +295,7 @@
-     if (vs->clientds.pf.bytes_per_pixel == 4) {
-         if (vs->tight.pixel24) {
-             errors = tight_detect_smooth_image24(vs, w, h);
--            if (vs->tight.quality != -1) {
-+            if (vs->tight.quality != (uint8_t)-1) {
-                 return (errors < tight_conf[quality].jpeg_threshold24);
-             }
-             return (errors < tight_conf[compression].gradient_threshold24);
-@@ -443,7 +444,7 @@
-              * Should never happen, but don't break everything          \
-              * if it does, use the first color instead                  \
-              */                                                         \
--            if (idx == -1) {                                            \
-+            if (idx == (uint8_t)-1) {                                   \
-                 idx = 0;                                                \
-             }                                                           \
-             while (rep >= 0) {                                          \
-@@ -608,7 +609,7 @@
-             for (x = 0; x < w; x++) {                                   \
-                 pix = *buf;                                             \
-                 if (endian) {                                           \
--                    pix = bswap_##bpp(pix);                             \
-+                    pix = bswap##bpp(pix);                              \
-                 }                                                       \
-                 diff = 0;                                               \
-                 for (c = 0; c < 3; c++) {                               \
-@@ -628,7 +629,7 @@
-                         << shift[c];                                    \
-                 }                                                       \
-                 if (endian) {                                           \
--                    diff = bswap_##bpp(diff);                           \
-+                    diff = bswap##bpp(diff);                           \
-                 }                                                       \
-                 *buf++ = diff;                                          \
-             }                                                           \
-@@ -1469,6 +1470,8 @@
-         ret = send_mono_rect(vs, x, y, w, h, bg, fg);
-     } else if (colors <= 256) {
-         ret = send_palette_rect(vs, x, y, w, h, palette);
-+    } else {
-+        ret = 0;
-     }
-     return ret;
- }
-@@ -1501,6 +1504,8 @@
-         } else {
-             ret = send_palette_rect(vs, x, y, w, h, palette);
-         }
-+    } else {
-+	    ret = 0;
-     }
-     return ret;
- }
-@@ -1522,7 +1527,7 @@
-     colors = tight_fill_palette(vs, x, y, w * h, &fg, &bg, &palette);
- 
- #ifdef CONFIG_VNC_JPEG
--    if (vs->tight.quality != -1) {
-+    if (vs->tight.quality != (uint8_t)-1) {
-         ret = send_sub_rect_jpeg(vs, x, y, w, h, bg, fg, colors, palette);
-     } else {
-         ret = send_sub_rect_nojpeg(vs, x, y, w, h, bg, fg, colors, palette);
diff --git a/emulators/qemu/patches/patch-ek b/emulators/qemu/patches/patch-ek
deleted file mode 100644
index c1138735abe..00000000000
--- a/emulators/qemu/patches/patch-ek
+++ /dev/null
@@ -1,45 +0,0 @@
-$NetBSD: patch-ek,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Improve ATA IDENTIFY word 64 contents
-(fixed in upstream master but not in stable-0.13 branch)
-http://git.qemu.org/qemu.git/commit/?id=79d1d3311319f3390f540f547becaba9d957f84c
-
-Don't use <0 against unsigned variable
-(fixed in upstream master but not in stable-0.13 branch)
-http://git.qemu.org/qemu.git/commit/?id=7bccf57383cca60a778d5c543ac80c9f62d89ef2
-
---- hw/ide/core.c.orig	2010-08-31 13:18:20.000000000 +0000
-+++ hw/ide/core.c	2010-09-11 14:03:19.000000000 +0000
-@@ -138,6 +138,7 @@ static void ide_identify(IDEState *s)
-     put_le16(p + 61, s->nb_sectors >> 16);
-     put_le16(p + 62, 0x07); /* single word dma0-2 supported */
-     put_le16(p + 63, 0x07); /* mdma0-2 supported */
-+    put_le16(p + 64, 0x03); /* pio3-4 supported */
-     put_le16(p + 65, 120);
-     put_le16(p + 66, 120);
-     put_le16(p + 67, 120);
-@@ -198,13 +199,12 @@ static void ide_atapi_identify(IDEState 
-     put_le16(p + 53, 7); /* words 64-70, 54-58, 88 valid */
-     put_le16(p + 62, 7);  /* single word dma0-2 supported */
-     put_le16(p + 63, 7);  /* mdma0-2 supported */
--    put_le16(p + 64, 0x3f); /* PIO modes supported */
- #else
-     put_le16(p + 49, 1 << 9); /* LBA supported, no DMA */
-     put_le16(p + 53, 3); /* words 64-70, 54-58 valid */
-     put_le16(p + 63, 0x103); /* DMA modes XXX: may be incorrect */
--    put_le16(p + 64, 1); /* PIO modes */
- #endif
-+    put_le16(p + 64, 3); /* pio3-4 supported */
-     put_le16(p + 65, 0xb4); /* minimum DMA multiword tx cycle time */
-     put_le16(p + 66, 0xb4); /* recommended DMA multiword tx cycle time */
-     put_le16(p + 67, 0x12c); /* minimum PIO cycle time without flow control */
-@@ -2779,8 +2779,7 @@ static int ide_drive_pio_post_load(void 
- {
-     IDEState *s = opaque;
- 
--    if (s->end_transfer_fn_idx < 0 ||
--        s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
-+    if (s->end_transfer_fn_idx > ARRAY_SIZE(transfer_end_table)) {
-         return -EINVAL;
-     }
-     s->end_transfer_func = transfer_end_table[s->end_transfer_fn_idx];
diff --git a/emulators/qemu/patches/patch-el b/emulators/qemu/patches/patch-el
index c831021afc4..eb9a94daea4 100644
--- a/emulators/qemu/patches/patch-el
+++ b/emulators/qemu/patches/patch-el
@@ -1,10 +1,10 @@
-$NetBSD: patch-el,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-el,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 NetBSD 4.0 (actually around 4.99.10) and prior don't have some C99 FP macro.
 (PR pkg/42899)
 
---- fpu/softfloat-native.h.orig	2010-07-28 10:55:42.000000000 +0900
-+++ fpu/softfloat-native.h	2010-08-10 22:08:51.000000000 +0900
+--- fpu/softfloat-native.h.orig	2011-05-06 19:01:43.000000000 +0000
++++ fpu/softfloat-native.h
 @@ -19,11 +19,15 @@
   *        or Solaris 10 systems running GCC 3.x or less.
   *   Solaris 10 with GCC4 does not need these macros as they
diff --git a/emulators/qemu/patches/patch-em b/emulators/qemu/patches/patch-em
deleted file mode 100644
index a89d8da2436..00000000000
--- a/emulators/qemu/patches/patch-em
+++ /dev/null
@@ -1,24 +0,0 @@
-$NetBSD: patch-em,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Export libgcc builtin __clear_cache() since it's also referred from
-tcg/arm/tcg-target.h.
-
---- exec-all.h.orig	2010-07-28 01:55:42.000000000 +0000
-+++ exec-all.h
-@@ -202,11 +202,13 @@ static inline void tb_set_jmp_target1(un
-     /* no need to flush icache explicitly */
- }
- #elif defined(__arm__)
-+#if QEMU_GNUC_PREREQ(4, 1)
-+void __clear_cache(char *beg, char *end);
-+#endif
-+
- static inline void tb_set_jmp_target1(unsigned long jmp_addr, unsigned long addr)
- {
--#if QEMU_GNUC_PREREQ(4, 1)
--    void __clear_cache(char *beg, char *end);
--#else
-+#if !QEMU_GNUC_PREREQ(4, 1)
-     register unsigned long _beg __asm ("a1");
-     register unsigned long _end __asm ("a2");
-     register unsigned long _flg __asm ("a3");
diff --git a/emulators/qemu/patches/patch-en b/emulators/qemu/patches/patch-en
index c1f71fb8337..c2860473711 100644
--- a/emulators/qemu/patches/patch-en
+++ b/emulators/qemu/patches/patch-en
@@ -1,10 +1,10 @@
-$NetBSD: patch-en,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
+$NetBSD: patch-en,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
 Use ligbcc builtin __clear_cache() declared in exec-all.h
 instead of original __builtin___clear_cache() because
 the latter one is not available in (at least) gcc 4.1.3.
 
---- tcg/arm/tcg-target.h.orig	2010-07-28 01:55:42.000000000 +0000
+--- tcg/arm/tcg-target.h.orig	2011-05-06 19:01:44.000000000 +0000
 +++ tcg/arm/tcg-target.h
 @@ -83,7 +83,7 @@ enum {
  static inline void flush_icache_range(unsigned long start, unsigned long stop)
diff --git a/emulators/qemu/patches/patch-eo b/emulators/qemu/patches/patch-eo
deleted file mode 100644
index 6d9293d21fb..00000000000
--- a/emulators/qemu/patches/patch-eo
+++ /dev/null
@@ -1,135 +0,0 @@
-$NetBSD: patch-eo,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Pull fixes for ESP SCSI DMA from upstream master:
-http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
-
---- hw/esp.c.orig
-+++ hw/esp.c
-@@ -80,6 +80,8 @@ struct ESPState {
-     ESPDMAMemoryReadWriteFunc dma_memory_read;
-     ESPDMAMemoryReadWriteFunc dma_memory_write;
-     void *dma_opaque;
-+    int dma_enabled;
-+    void (*dma_cb)(ESPState *s);
- };
- 
- #define ESP_TCLO   0x0
-@@ -167,6 +169,24 @@ static void esp_lower_irq(ESPState *s)
-     }
- }
- 
-+static void esp_dma_enable(void *opaque, int irq, int level)
-+{
-+    DeviceState *d = opaque;
-+    ESPState *s = container_of(d, ESPState, busdev.qdev);
-+
-+    if (level) {
-+        s->dma_enabled = 1;
-+        DPRINTF("Raise enable\n");
-+        if (s->dma_cb) {
-+            s->dma_cb(s);
-+            s->dma_cb = NULL;
-+        }
-+    } else {
-+        DPRINTF("Lower enable\n");
-+        s->dma_enabled = 0;
-+    }
-+}
-+
- static uint32_t get_cmd(ESPState *s, uint8_t *buf)
- {
-     uint32_t dmalen;
-@@ -243,6 +263,10 @@ static void handle_satn(ESPState *s)
-     uint8_t buf[32];
-     int len;
- 
-+    if (!s->dma_enabled) {
-+        s->dma_cb = handle_satn;
-+        return;
-+    }
-     len = get_cmd(s, buf);
-     if (len)
-         do_cmd(s, buf);
-@@ -253,6 +277,10 @@ static void handle_s_without_atn(ESPState *s)
-     uint8_t buf[32];
-     int len;
- 
-+    if (!s->dma_enabled) {
-+        s->dma_cb = handle_s_without_atn;
-+        return;
-+    }
-     len = get_cmd(s, buf);
-     if (len) {
-         do_busid_cmd(s, buf, 0);
-@@ -261,6 +289,10 @@ static void handle_s_without_atn(ESPState *s)
- 
- static void handle_satn_stop(ESPState *s)
- {
-+    if (!s->dma_enabled) {
-+        s->dma_cb = handle_satn_stop;
-+        return;
-+    }
-     s->cmdlen = get_cmd(s, s->cmdbuf);
-     if (s->cmdlen) {
-         DPRINTF("Set ATN & Stop: cmdlen %d\n", s->cmdlen);
-@@ -431,6 +463,7 @@ static void esp_hard_reset(DeviceState *d)
-     s->ti_wptr = 0;
-     s->dma = 0;
-     s->do_cmd = 0;
-+    s->dma_cb = NULL;
- 
-     s->rregs[ESP_CFG1] = 7;
- }
-@@ -450,6 +483,18 @@ static void parent_esp_reset(void *opaque, int irq, int level)
-     }
- }
- 
-+static void esp_gpio_demux(void *opaque, int irq, int level)
-+{
-+    switch (irq) {
-+    case 0:
-+        parent_esp_reset(opaque, irq, level);
-+        break;
-+    case 1:
-+        esp_dma_enable(opaque, irq, level);
-+        break;
-+    }
-+}
-+
- static uint32_t esp_mem_readb(void *opaque, target_phys_addr_t addr)
- {
-     ESPState *s = opaque;
-@@ -646,7 +691,8 @@ static const VMStateDescription vmstate_esp = {
- void esp_init(target_phys_addr_t espaddr, int it_shift,
-               ESPDMAMemoryReadWriteFunc dma_memory_read,
-               ESPDMAMemoryReadWriteFunc dma_memory_write,
--              void *dma_opaque, qemu_irq irq, qemu_irq *reset)
-+              void *dma_opaque, qemu_irq irq, qemu_irq *reset,
-+              qemu_irq *dma_enable)
- {
-     DeviceState *dev;
-     SysBusDevice *s;
-@@ -658,11 +704,14 @@ void esp_init(target_phys_addr_t espaddr, int it_shift,
-     esp->dma_memory_write = dma_memory_write;
-     esp->dma_opaque = dma_opaque;
-     esp->it_shift = it_shift;
-+    /* XXX for now until rc4030 has been changed to use DMA enable signal */
-+    esp->dma_enabled = 1;
-     qdev_init_nofail(dev);
-     s = sysbus_from_qdev(dev);
-     sysbus_connect_irq(s, 0, irq);
-     sysbus_mmio_map(s, 0, espaddr);
-     *reset = qdev_get_gpio_in(dev, 0);
-+    *dma_enable = qdev_get_gpio_in(dev, 1);
- }
- 
- static int esp_init1(SysBusDevice *dev)
-@@ -676,7 +725,7 @@ static int esp_init1(SysBusDevice *dev)
-     esp_io_memory = cpu_register_io_memory(esp_mem_read, esp_mem_write, s);
-     sysbus_init_mmio(dev, ESP_REGS << s->it_shift, esp_io_memory);
- 
--    qdev_init_gpio_in(&dev->qdev, parent_esp_reset, 1);
-+    qdev_init_gpio_in(&dev->qdev, esp_gpio_demux, 2);
- 
-     scsi_bus_new(&s->bus, &dev->qdev, 0, ESP_MAX_DEVS, esp_command_complete);
-     return scsi_bus_legacy_handle_cmdline(&s->bus);
diff --git a/emulators/qemu/patches/patch-ep b/emulators/qemu/patches/patch-ep
deleted file mode 100644
index 0800222fda6..00000000000
--- a/emulators/qemu/patches/patch-ep
+++ /dev/null
@@ -1,16 +0,0 @@
-$NetBSD: patch-ep,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Pull fixes for ESP SCSI DMA from upstream master:
-http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
-
---- hw/esp.h.orig
-+++ hw/esp.h
-@@ -7,6 +7,7 @@ typedef void (*ESPDMAMemoryReadWriteFunc)(void *opaque, uint8_t *buf, int len);
- void esp_init(target_phys_addr_t espaddr, int it_shift,
-               ESPDMAMemoryReadWriteFunc dma_memory_read,
-               ESPDMAMemoryReadWriteFunc dma_memory_write,
--              void *dma_opaque, qemu_irq irq, qemu_irq *reset);
-+              void *dma_opaque, qemu_irq irq, qemu_irq *reset,
-+              qemu_irq *dma_enable);
- 
- #endif
diff --git a/emulators/qemu/patches/patch-eq b/emulators/qemu/patches/patch-eq
deleted file mode 100644
index 0f499da036f..00000000000
--- a/emulators/qemu/patches/patch-eq
+++ /dev/null
@@ -1,37 +0,0 @@
-$NetBSD: patch-eq,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Pull fixes for ESP SCSI DMA from upstream master:
-http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
-
-Also disable floppy which is broken.
-
---- hw/mips_jazz.c.orig
-+++ hw/mips_jazz.c
-@@ -136,7 +136,7 @@
-     NICInfo *nd;
-     PITState *pit;
-     DriveInfo *fds[MAX_FD];
--    qemu_irq esp_reset;
-+    qemu_irq esp_reset, dma_enable;
-     qemu_irq *cpu_exit_irq;
-     ram_addr_t ram_offset;
-     ram_addr_t bios_offset;
-@@ -244,7 +244,7 @@
-     /* SCSI adapter */
-     esp_init(0x80002000, 0,
-              rc4030_dma_read, rc4030_dma_write, dmas[0],
--             rc4030[5], &esp_reset);
-+             rc4030[5], &esp_reset, &dma_enable);
- 
-     /* Floppy */
-     if (drive_get_max_bus(IF_FLOPPY) >= MAX_FD) {
-@@ -254,7 +254,9 @@
-     for (n = 0; n < MAX_FD; n++) {
-         fds[n] = drive_get(IF_FLOPPY, 0, n);
-     }
-+#if 0	/* XXX: floppy emulation uses wrong ISA DMA (should be jazz DMA) */
-     fdctrl_init_sysbus(rc4030[1], 0, 0x80003000, fds);
-+#endif
- 
-     /* Real time clock */
-     rtc_init(1980, NULL);
diff --git a/emulators/qemu/patches/patch-er b/emulators/qemu/patches/patch-er
deleted file mode 100644
index c470e380c3b..00000000000
--- a/emulators/qemu/patches/patch-er
+++ /dev/null
@@ -1,62 +0,0 @@
-$NetBSD: patch-er,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Pull fixes for ESP SCSI DMA from upstream master:
-http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
-
---- hw/sparc32_dma.c.orig
-+++ hw/sparc32_dma.c
-@@ -58,6 +58,7 @@
- #define DMA_INTR 1
- #define DMA_INTREN 0x10
- #define DMA_WRITE_MEM 0x100
-+#define DMA_EN 0x200
- #define DMA_LOADED 0x04000000
- #define DMA_DRAIN_FIFO 0x40
- #define DMA_RESET 0x80
-@@ -72,7 +73,12 @@ struct DMAState {
-     uint32_t dmaregs[DMA_REGS];
-     qemu_irq irq;
-     void *iommu;
--    qemu_irq dev_reset;
-+    qemu_irq gpio[2];
-+};
-+
-+enum {
-+    GPIO_RESET = 0,
-+    GPIO_DMA,
- };
- 
- /* Note: on sparc, the lance 16 bit bus is swapped */
-@@ -201,12 +207,21 @@ static void dma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
-             }
-         }
-         if (val & DMA_RESET) {
--            qemu_irq_raise(s->dev_reset);
--            qemu_irq_lower(s->dev_reset);
-+            qemu_irq_raise(s->gpio[GPIO_RESET]);
-+            qemu_irq_lower(s->gpio[GPIO_RESET]);
-         } else if (val & DMA_DRAIN_FIFO) {
-             val &= ~DMA_DRAIN_FIFO;
-         } else if (val == 0)
-             val = DMA_DRAIN_FIFO;
-+
-+        if (val & DMA_EN && !(s->dmaregs[0] & DMA_EN)) {
-+            DPRINTF("Raise DMA enable\n");
-+            qemu_irq_raise(s->gpio[GPIO_DMA]);
-+        } else if (!(val & DMA_EN) && !!(s->dmaregs[0] & DMA_EN)) {
-+            DPRINTF("Lower DMA enable\n");
-+            qemu_irq_lower(s->gpio[GPIO_DMA]);
-+        }
-+
-         val &= ~DMA_CSR_RO_MASK;
-         val |= DMA_VER;
-         s->dmaregs[0] = (s->dmaregs[0] & DMA_CSR_RO_MASK) | val;
-@@ -262,7 +277,7 @@ static int sparc32_dma_init1(SysBusDevice *dev)
-     sysbus_init_mmio(dev, DMA_SIZE, dma_io_memory);
- 
-     qdev_init_gpio_in(&dev->qdev, dma_set_irq, 1);
--    qdev_init_gpio_out(&dev->qdev, &s->dev_reset, 1);
-+    qdev_init_gpio_out(&dev->qdev, s->gpio, 2);
- 
-     return 0;
- }
diff --git a/emulators/qemu/patches/patch-es b/emulators/qemu/patches/patch-es
deleted file mode 100644
index 0804c3f21c4..00000000000
--- a/emulators/qemu/patches/patch-es
+++ /dev/null
@@ -1,79 +0,0 @@
-$NetBSD: patch-es,v 1.1 2010/10/27 13:24:09 tsutsui Exp $
-
-Pull fixes for ESP SCSI DMA from upstream master:
-http://git.qemu.org/qemu.git/commit/?id=73d7434279e390505164afd02360eebe4b43c7fa
-
---- hw/sun4m.c.orig
-+++ hw/sun4m.c
-@@ -810,7 +810,7 @@ static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
-     void *iommu, *espdma, *ledma, *nvram;
-     qemu_irq *cpu_irqs[MAX_CPUS], slavio_irq[32], slavio_cpu_irq[MAX_CPUS],
-         espdma_irq, ledma_irq;
--    qemu_irq esp_reset;
-+    qemu_irq esp_reset, dma_enable;
-     qemu_irq fdc_tc;
-     qemu_irq *cpu_halt;
-     unsigned long kernel_size;
-@@ -930,11 +930,12 @@ static void sun4m_hw_init(const struct sun4m_hwdef *hwdef, ram_addr_t RAM_size,
-         exit(1);
-     }
- 
--    esp_reset = qdev_get_gpio_in(espdma, 0);
-     esp_init(hwdef->esp_base, 2,
-              espdma_memory_read, espdma_memory_write,
--             espdma, espdma_irq, &esp_reset);
-+             espdma, espdma_irq, &esp_reset, &dma_enable);
- 
-+    qdev_connect_gpio_out(espdma, 0, esp_reset);
-+    qdev_connect_gpio_out(espdma, 1, dma_enable);
- 
-     if (hwdef->cs_base) {
-         sysbus_create_simple("SUNW,CS4231", hwdef->cs_base,
-@@ -1494,7 +1495,7 @@ static void sun4d_hw_init(const struct sun4d_hwdef *hwdef, ram_addr_t RAM_size,
-     void *iounits[MAX_IOUNITS], *espdma, *ledma, *nvram;
-     qemu_irq *cpu_irqs[MAX_CPUS], sbi_irq[32], sbi_cpu_irq[MAX_CPUS],
-         espdma_irq, ledma_irq;
--    qemu_irq esp_reset;
-+    qemu_irq esp_reset, dma_enable;
-     unsigned long kernel_size;
-     void *fw_cfg;
-     DeviceState *dev;
-@@ -1561,10 +1562,12 @@ static void sun4d_hw_init(const struct sun4d_hwdef *hwdef, ram_addr_t RAM_size,
-         exit(1);
-     }
- 
--    esp_reset = qdev_get_gpio_in(espdma, 0);
-     esp_init(hwdef->esp_base, 2,
-              espdma_memory_read, espdma_memory_write,
--             espdma, espdma_irq, &esp_reset);
-+             espdma, espdma_irq, &esp_reset, &dma_enable);
-+
-+    qdev_connect_gpio_out(espdma, 0, esp_reset);
-+    qdev_connect_gpio_out(espdma, 1, dma_enable);
- 
-     kernel_size = sun4m_load_kernel(kernel_filename, initrd_filename,
-                                     RAM_size);
-@@ -1683,7 +1686,7 @@ static void sun4c_hw_init(const struct sun4c_hwdef *hwdef, ram_addr_t RAM_size,
- {
-     void *iommu, *espdma, *ledma, *nvram;
-     qemu_irq *cpu_irqs, slavio_irq[8], espdma_irq, ledma_irq;
--    qemu_irq esp_reset;
-+    qemu_irq esp_reset, dma_enable;
-     qemu_irq fdc_tc;
-     unsigned long kernel_size;
-     DriveInfo *fd[MAX_FD];
-@@ -1751,10 +1754,12 @@ static void sun4c_hw_init(const struct sun4c_hwdef *hwdef, ram_addr_t RAM_size,
-         exit(1);
-     }
- 
--    esp_reset = qdev_get_gpio_in(espdma, 0);
-     esp_init(hwdef->esp_base, 2,
-              espdma_memory_read, espdma_memory_write,
--             espdma, espdma_irq, &esp_reset);
-+             espdma, espdma_irq, &esp_reset, &dma_enable);
-+
-+    qdev_connect_gpio_out(espdma, 0, esp_reset);
-+    qdev_connect_gpio_out(espdma, 1, dma_enable);
- 
-     kernel_size = sun4m_load_kernel(kernel_filename, initrd_filename,
-                                     RAM_size);
diff --git a/emulators/qemu/patches/patch-et b/emulators/qemu/patches/patch-et
index f04d2e74ea3..815e5728423 100644
--- a/emulators/qemu/patches/patch-et
+++ b/emulators/qemu/patches/patch-et
@@ -1,8 +1,8 @@
-$NetBSD: patch-et,v 1.1 2010/11/09 10:37:12 jmmv Exp $
+$NetBSD: patch-et,v 1.2 2011/07/11 09:57:18 ryoon Exp $
 
---- Makefile.orig	2010-10-15 20:56:09.000000000 +0000
+--- Makefile.orig	2011-05-06 19:01:43.000000000 +0000
 +++ Makefile
-@@ -179,8 +179,8 @@ ifdef CONFIG_POSIX
+@@ -229,8 +229,8 @@ ifdef CONFIG_POSIX
  endif
  
  install-sysconfig:
diff --git a/emulators/qemu/patches/patch-ioport.c b/emulators/qemu/patches/patch-ioport.c
new file mode 100644
index 00000000000..c1743a967e1
--- /dev/null
+++ b/emulators/qemu/patches/patch-ioport.c
@@ -0,0 +1,31 @@
+$NetBSD: patch-ioport.c,v 1.1 2011/07/11 09:57:18 ryoon Exp $
+
+--- ioport.c.orig	2011-05-06 19:01:44.000000000 +0000
++++ ioport.c
+@@ -179,7 +179,7 @@ static uint32_t ioport_readb_thunk(void 
+     IORange *ioport = opaque;
+     uint64_t data;
+ 
+-    ioport->ops->read(ioport, addr - ioport->base, 1, &data);
++    (ioport->ops->read)(ioport, addr - ioport->base, 1, &data);
+     return data;
+ }
+ 
+@@ -188,7 +188,7 @@ static uint32_t ioport_readw_thunk(void 
+     IORange *ioport = opaque;
+     uint64_t data;
+ 
+-    ioport->ops->read(ioport, addr - ioport->base, 2, &data);
++    (ioport->ops->read)(ioport, addr - ioport->base, 2, &data);
+     return data;
+ }
+ 
+@@ -197,7 +197,7 @@ static uint32_t ioport_readl_thunk(void 
+     IORange *ioport = opaque;
+     uint64_t data;
+ 
+-    ioport->ops->read(ioport, addr - ioport->base, 4, &data);
++    (ioport->ops->read)(ioport, addr - ioport->base, 4, &data);
+     return data;
+ }
+