- Update to 0.11.1 - from the official announcement:

  - fix I2C slave addressing (Juha Riihimaki)
  - Revert "vga: do not resize the screen on hw_invalidate" (Aurelien Jarno)
  - slirp: fix use-after-free (Mark McLoughlin)
  - Fix sparc.ld (Blue Swirl)
  - ELF codedump build failures (Laurent Desnogues)
  - kvm: Move KVM mp_state accessors to i386-specific code (Hollis Blanchard)
  - fix configure script with armv4l cpu (Laurent Desnogues)
  - net: disable draining tap queue in one go (Mark McLoughlin)
  - pcnet: Restart poll timer on pcnet_start (Jan Kiszka)
  - Sparc32: Fix lance (Blue Swirl)
  - mac99: fix segmentation fault on startup (Aurelien Jarno)
  - usb-linux.c: fix buffer overflow (Jim Paris)
  - ARM host: fix generated blocks linking (Laurent Desnogues)
  - qemu serial: lost tx irqs (affecting FreeBSD's new uart(4) driver)
    (Juergen Lock)
  - exec-all.h: increase MAX_OP_PER_INSTR to 96 from 64 (Aurelien Jarno)

- Added a cherry picked commit from stable branch that fixes qcow2.

18 files changed, 369 insertions, 536 deletions

diff --git a/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life b/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life
new file mode 100644
index 000000000000..b4ef8ae45b8f
--- /dev/null
+++ b/emulators/qemu/files/patch-0001-qcow2-Bring-synchronous-read-write-back-to-life
@@ -0,0 +1,144 @@
+From 08fd2f30bd3ee5d04596da8293689af4d4f7eb6c Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 3 Dec 2009 10:28:44 +0100
+Subject: [PATCH] qcow2: Bring synchronous read/write back to life
+
+When the synchronous read and write functions were dropped, they were replaced
+by generic emulation functions. Unfortunately, these emulation functions don't
+provide the same semantics as the original functions did.
+
+The original bdrv_read would mean that we read some data synchronously and that
+we won't be interrupted during this read. The latter assumption is no longer
+true with the emulation function which needs to use qemu_aio_poll and therefore
+allows the callback of any other concurrent AIO request to be run during the
+read. Which in turn means that (meta)data read earlier could have changed and
+be invalid now. qcow2 is not prepared to work in this way and it's just scary
+how many places there are where other requests could run.
+
+I'm not sure yet where exactly it breaks, but you'll see breakage with virtio
+on qcow2 with a backing file. Providing synchronous functions again fixes the
+problem for me.
+
+Patchworks-ID: 35437
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
+(cherry picked from commit ef845c3bf421290153154635dc18eaa677cecb43)
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+---
+ block/qcow2-cluster.c |    6 ++--
+ block/qcow2.c         |   51 +++++++++++++++++++++++++++++++++++++++++++++++-
+ block/qcow2.h         |    3 ++
+ 3 files changed, 55 insertions(+), 5 deletions(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index d4631c3..4d0ce16 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -306,8 +306,8 @@ void qcow2_encrypt_sectors(BDRVQcowState *s, int64_t sector_num,
+ }
+ 
+ 
+-static int qcow_read(BlockDriverState *bs, int64_t sector_num,
+-                     uint8_t *buf, int nb_sectors)
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors)
+ {
+     BDRVQcowState *s = bs->opaque;
+     int ret, index_in_cluster, n, n1;
+@@ -358,7 +358,7 @@ static int copy_sectors(BlockDriverState *bs, uint64_t start_sect,
+     n = n_end - n_start;
+     if (n <= 0)
+         return 0;
+-    ret = qcow_read(bs, start_sect + n_start, s->cluster_data, n);
++    ret = qcow2_read(bs, start_sect + n_start, s->cluster_data, n);
+     if (ret < 0)
+         return ret;
+     if (s->crypt_method) {
+diff --git a/block/qcow2.c b/block/qcow2.c
+index dd32ea2..ced257e 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -855,6 +855,51 @@ static int qcow_make_empty(BlockDriverState *bs)
+     return 0;
+ }
+ 
++static int qcow2_write(BlockDriverState *bs, int64_t sector_num,
++                     const uint8_t *buf, int nb_sectors)
++{
++    BDRVQcowState *s = bs->opaque;
++    int ret, index_in_cluster, n;
++    uint64_t cluster_offset;
++    int n_end;
++    QCowL2Meta l2meta;
++
++    while (nb_sectors > 0) {
++        memset(&l2meta, 0, sizeof(l2meta));
++
++        index_in_cluster = sector_num & (s->cluster_sectors - 1);
++        n_end = index_in_cluster + nb_sectors;
++        if (s->crypt_method &&
++            n_end > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors)
++            n_end = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors;
++        cluster_offset = qcow2_alloc_cluster_offset(bs, sector_num << 9,
++                                              index_in_cluster,
++                                              n_end, &n, &l2meta);
++        if (!cluster_offset)
++            return -1;
++        if (s->crypt_method) {
++            qcow2_encrypt_sectors(s, sector_num, s->cluster_data, buf, n, 1,
++                            &s->aes_encrypt_key);
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512,
++                              s->cluster_data, n * 512);
++        } else {
++            ret = bdrv_pwrite(s->hd, cluster_offset + index_in_cluster * 512, buf, n * 512);
++        }
++        if (ret != n * 512 || qcow2_alloc_cluster_link_l2(bs, cluster_offset, &l2meta) < 0) {
++            qcow2_free_any_clusters(bs, cluster_offset, l2meta.nb_clusters);
++            return -1;
++        }
++        nb_sectors -= n;
++        sector_num += n;
++        buf += n * 512;
++        if (l2meta.nb_clusters != 0) {
++            LIST_REMOVE(&l2meta, next_in_flight);
++        }
++    }
++    s->cluster_cache_offset = -1; /* disable compressed cache */
++    return 0;
++}
++
+ /* XXX: put compressed sectors first, then all the cluster aligned
+    tables to avoid losing bytes in alignment */
+ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
+@@ -1037,8 +1082,10 @@ static BlockDriver bdrv_qcow2 = {
+     .bdrv_set_key	= qcow_set_key,
+     .bdrv_make_empty	= qcow_make_empty,
+ 
+-    .bdrv_aio_readv	= qcow_aio_readv,
+-    .bdrv_aio_writev	= qcow_aio_writev,
++    .bdrv_read          = qcow2_read,
++    .bdrv_write         = qcow2_write,
++    .bdrv_aio_readv     = qcow_aio_readv,
++    .bdrv_aio_writev    = qcow_aio_writev,
+     .bdrv_write_compressed = qcow_write_compressed,
+ 
+     .bdrv_snapshot_create   = qcow2_snapshot_create,
+diff --git a/block/qcow2.h b/block/qcow2.h
+index 965a2f4..b41aa63 100644
+--- a/block/qcow2.h
++++ b/block/qcow2.h
+@@ -202,6 +202,9 @@ uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs,
+ int qcow2_alloc_cluster_link_l2(BlockDriverState *bs, uint64_t cluster_offset,
+     QCowL2Meta *m);
+ 
++int qcow2_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf,
++    int nb_sectors);
++
+ /* qcow2-snapshot.c functions */
+ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info);
+ int qcow2_snapshot_goto(BlockDriverState *bs, const char *snapshot_id);
+-- 
+1.6.5.2
+
diff --git a/emulators/qemu/files/patch-Makefile b/emulators/qemu/files/patch-Makefile
index d6c95955fb14..93eddc846602 100644
--- a/emulators/qemu/files/patch-Makefile
+++ b/emulators/qemu/files/patch-Makefile
@@ -1,5 +1,5 @@
 Index: qemu/Makefile
-@@ -19,7 +19,11 @@
+@@ -25,7 +25,11 @@
  LDFLAGS += -static
  endif
  ifdef BUILD_DOCS
@@ -11,18 +11,19 @@ Index: qemu/Makefile
  else
  DOCS=
  endif
-@@ -221,12 +225,12 @@
+@@ -260,13 +264,13 @@
+ endif
  
  install-doc: $(DOCS)
 +ifndef NOPORTDOCS
- 	mkdir -p "$(DESTDIR)$(docdir)"
- 	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DIR) "$(DESTDIR)$(docdir)"
+ 	$(INSTALL_DATA) qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
 +endif
  ifndef CONFIG_WIN32
- 	mkdir -p "$(DESTDIR)$(mandir)/man1"
- 	$(INSTALL) -m 644 qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
--	mkdir -p "$(DESTDIR)$(mandir)/man8"
--	$(INSTALL) -m 644 qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
+ 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
+ 	$(INSTALL_DATA) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
+-	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man8"
+-	$(INSTALL_DATA) qemu-nbd.8 "$(DESTDIR)$(mandir)/man8"
  endif
  
  install: all $(if $(BUILD_DOCS),install-doc)
diff --git a/emulators/qemu/files/patch-aa b/emulators/qemu/files/patch-aa
deleted file mode 100644
index 25eaa72ab235..000000000000
--- a/emulators/qemu/files/patch-aa
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -urd --exclude=CVS ../cvs/qemu/Makefile qemu-0.5.5/Makefile
---- ../cvs/qemu/Makefile	Mon May 17 21:06:42 2004
-+++ qemu-0.5.5/Makefile	Sun May 30 05:26:19 2004
-@@ -70,7 +70,7 @@
- 
- # documentation
- %.html: %.texi
--	texi2html -monolithic -number $<
-+	-texi2html -monolithic -number $<
- 
- qemu.1: qemu-doc.texi
- 	./texi2pod.pl $< qemu.pod
diff --git a/emulators/qemu/files/patch-ac b/emulators/qemu/files/patch-ac
index 99821158695d..cc7638d0f26e 100644
--- a/emulators/qemu/files/patch-ac
+++ b/emulators/qemu/files/patch-ac
@@ -1,8 +1,8 @@
 Index: qemu/configure
-@@ -540,7 +540,7 @@
+@@ -868,7 +868,7 @@
  sdl_too_old=no
  
- if test -z "$sdl" ; then
+ if test "$sdl" = "yes" ; then
 -    sdl_config="sdl-config"
 +    sdl_config="${SDL_CONFIG}"
      sdl=no
diff --git a/emulators/qemu/files/patch-bg b/emulators/qemu/files/patch-bg
index d82921bd38f1..27c544f14341 100644
--- a/emulators/qemu/files/patch-bg
+++ b/emulators/qemu/files/patch-bg
@@ -1,23 +1,21 @@
 Index: qemu/Makefile
-@@ -11,7 +11,7 @@
- LDFLAGS += $(OS_LDFLAGS) $(ARCH_LDFLAGS)
- 
+@@ -19,6 +19,7 @@
  CPPFLAGS += -I. -I$(SRC_PATH) -MMD -MP -MT $@
--CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-+CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
+ CPPFLAGS += -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+ CPPFLAGS += -U_FORTIFY_SOURCE
++CPPFLAGS += -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
  LIBS=
  ifdef CONFIG_STATIC
  LDFLAGS += -static
 Index: qemu/Makefile.target
-@@ -179,7 +179,7 @@
- 
- #########################################################
+@@ -54,6 +54,7 @@
  
--CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
-+CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
+ CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+ CPPFLAGS+=-U_FORTIFY_SOURCE
++CPPFLAGS+=-DSMBD_COMMAND=\"${LOCALBASE}/sbin/smbd\" -I${LOCALBASE}/include -DPREFIX=\"${PREFIX}\"
  LIBS+=-lm
- ifndef CONFIG_USER_ONLY
- LIBS+=-lz
+ ifdef CONFIG_WIN32
+ LIBS+=-lwinmm -lws2_32 -liphlpapi
 Index: qemu/net.h
 @@ -99,12 +99,14 @@
  int slirp_is_inited(void);
diff --git a/emulators/qemu/files/patch-configure b/emulators/qemu/files/patch-configure
index 782062a27890..a22531fd51b4 100644
--- a/emulators/qemu/files/patch-configure
+++ b/emulators/qemu/files/patch-configure
@@ -1,10 +1,10 @@
 Index: qemu/configure
-@@ -689,7 +689,7 @@
- fi # test "$curses"
+@@ -1348,7 +1348,7 @@
+ fi
  
  # Check if tools are available to build documentation.
--if [ -x "`which texi2html 2>/dev/null`" ] && \
-+if [ "x$NOPORTDOCS" != "x" -o -x "`which texi2html 2>/dev/null`" ] && \
-    [ -x "`which pod2man 2>/dev/null`" ]; then
-   build_docs="yes"
+-if test "$build_docs" = "yes" -a \( ! -x "`which texi2html 2>/dev/null`" -o ! -x "`which pod2man 2>/dev/null`" \) ; then
++if test "$build_docs" = "yes" -a \( "x$NOPORTDOCS" != "x" -o ! -x "`which texi2html 2>/dev/null`" -o ! -x "`which pod2man 2>/dev/null`" \) ; then
+   build_docs="no"
  fi
+ 
diff --git a/emulators/qemu/files/patch-cpu-exec.c b/emulators/qemu/files/patch-cpu-exec.c
deleted file mode 100644
index f1e1123fd547..000000000000
--- a/emulators/qemu/files/patch-cpu-exec.c
+++ /dev/null
@@ -1,66 +0,0 @@
-Index: qemu/cpu-exec.c
-@@ -1158,6 +1158,12 @@
- # define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext->ss.eip))
- # define TRAP_sig(context)    ((context)->uc_mcontext->es.trapno)
- # define ERROR_sig(context)   ((context)->uc_mcontext->es.err)
-+#elif defined(__FreeBSD__) 
-+# include <sys/ucontext.h>
-+
-+# define EIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_eip))
-+# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
-+# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
- #else
- # define EIP_sig(context)     ((context)->uc_mcontext.gregs[REG_EIP])
- # define TRAP_sig(context)    ((context)->uc_mcontext.gregs[REG_TRAPNO])
-@@ -1168,7 +1174,11 @@
-                        void *puc)
- {
-     siginfo_t *info = pinfo;
-+#ifdef __FreeBSD__
-+    ucontext_t *uc = puc;
-+#else
-     struct ucontext *uc = puc;
-+#endif
-     unsigned long pc;
-     int trapno;
- 
-@@ -1194,6 +1204,12 @@
- 
- #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.__gregs[(reg)]
- #define QEMU_UC_MACHINE_PC(uc)		_UC_MACHINE_PC(uc)
-+#elif defined(__FreeBSD__) 
-+# include <sys/ucontext.h>
-+
-+# define RIP_sig(context)  (*((unsigned long*)&(context)->uc_mcontext.mc_rip))
-+# define TRAP_sig(context)    ((context)->uc_mcontext.mc_trapno)
-+# define ERROR_sig(context)   ((context)->uc_mcontext.mc_err)
- #else
- #define QEMU_UC_MCONTEXT_GREGS(uc, reg)	(uc)->uc_mcontext.gregs[(reg)]
- #define QEMU_UC_MACHINE_PC(uc)		QEMU_UC_MCONTEXT_GREGS(uc, REG_RIP)
-@@ -1204,17 +1220,25 @@
- {
-     siginfo_t *info = pinfo;
-     unsigned long pc;
--#ifdef __NetBSD__
-+#if defined(__NetBSD__) || defined(__FreeBSD__)
-     ucontext_t *uc = puc;
- #else
-     struct ucontext *uc = puc;
- #endif
- 
-+#ifdef __FreeBSD__
-+    pc = RIP_sig(uc);
-+    return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-+                             TRAP_sig(uc) == 0xe ?
-+                             (ERROR_sig(uc) >> 1) & 1 : 0,
-+                             &uc->uc_sigmask, puc);
-+#else
-     pc = QEMU_UC_MACHINE_PC(uc);
-     return handle_cpu_signal(pc, (unsigned long)info->si_addr,
-                              QEMU_UC_MCONTEXT_GREGS(uc, REG_TRAPNO) == 0xe ?
-                              (QEMU_UC_MCONTEXT_GREGS(uc, REG_ERR) >> 1) & 1 : 0,
-                              &uc->uc_sigmask, puc);
-+#endif
- }
- 
- #elif defined(__powerpc__)
diff --git a/emulators/qemu/files/patch-exec-all.h b/emulators/qemu/files/patch-exec-all.h
deleted file mode 100644
index 244bfb05055a..000000000000
--- a/emulators/qemu/files/patch-exec-all.h
+++ /dev/null
@@ -1,10 +0,0 @@
-Index: qemu/exec-all.h
-@@ -30,7 +30,7 @@
- struct TranslationBlock;
- 
- /* XXX: make safe guess about sizes */
--#define MAX_OP_PER_INSTR 64
-+#define MAX_OP_PER_INSTR 128 /* 64 */
- /* A Call op needs up to 6 + 2N parameters (N = number of arguments).  */
- #define MAX_OPC_PARAM 10
- #define OPC_BUF_SIZE 512
diff --git a/emulators/qemu/files/patch-fbsd b/emulators/qemu/files/patch-fbsd
index 58aebeeb42c4..75cded3c7cae 100644
--- a/emulators/qemu/files/patch-fbsd
+++ b/emulators/qemu/files/patch-fbsd
@@ -1,26 +1,26 @@
 Index: qemu/Makefile
-@@ -38,7 +38,10 @@
+@@ -45,7 +45,10 @@
  LIBS+=-lwinmm -lws2_32 -liphlpapi
  endif
  
--all: $(TOOLS) $(DOCS) recurse-all
-+all: bsd/libmath.a $(TOOLS) $(DOCS) recurse-all
+-build-all: $(TOOLS) $(DOCS) recurse-all
++build-all: bsd/libmath.a $(TOOLS) $(DOCS) recurse-all
 +
 +bsd/libmath.a:
 +	( cd bsd ; unset MAKEFLAGS ; $(BSD_MAKE) CC=$(CC) )
  
- SUBDIR_RULES=$(patsubst %,subdir-%, $(TARGET_DIRS))
- 
-@@ -195,6 +198,7 @@
+ config-host.mak: configure
+ ifneq ($(wildcard config-host.mak),)
+@@ -242,6 +245,7 @@
  
  clean:
  # avoid old build problems by removing potentially incorrect old files
 +	( cd bsd ; $(BSD_MAKE) clean )
  	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h
  	rm -f *.o *.d *.a $(TOOLS) TAGS cscope.* *.pod *~ */*~
- 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d
+ 	rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d
 Index: qemu/Makefile.target
-@@ -417,7 +417,7 @@
+@@ -339,7 +339,7 @@
  # WARNING: this LDFLAGS is _very_ tricky : qemu is an ELF shared object
  # that the kernel ELF loader considers as an executable. I think this
  # is the simplest way to make it self virtualizable!
@@ -29,52 +29,48 @@ Index: qemu/Makefile.target
  endif
  endif
  
-@@ -491,7 +491,7 @@
+@@ -408,7 +408,7 @@
  # cpu_signal_handler() in cpu-exec.c.
  signal.o: CFLAGS += $(HELPER_CFLAGS)
  
--$(QEMU_PROG): $(OBJS) ../libqemu_user.a
-+$(QEMU_PROG): $(OBJS) ../libqemu_user.a ../bsd/libmath.a
- 	$(LINK)
+-ARLIBS=libqemu.a ../libqemu_user.a
++ARLIBS=libqemu.a ../libqemu_user.a ../bsd/libmath.a
  
  endif #CONFIG_BSD_USER
-@@ -717,9 +717,9 @@
- main.o: CFLAGS+=-p
- endif
  
--$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS)
-+$(QEMU_PROG): LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) ../bsd/libmath.a
+@@ -658,7 +658,7 @@
+ monitor.o: qemu-monitor.h
  
--$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a
-+$(QEMU_PROG): $(OBJS) ../libqemu_common.a libqemu.a ../bsd/libmath.a
- 	$(LINK)
+ LIBS += $(SDL_LIBS) $(COCOA_LIBS) $(CURSES_LIBS) $(BRLAPI_LIBS) $(VDE_LIBS) $(CURL_LIBS)
+-ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
++ARLIBS=../libqemu_common.a libqemu.a $(HWLIB) ../bsd/libmath.a
  
  endif # !CONFIG_USER_ONLY
+ 
 Index: qemu/fpu/softfloat-native.c
-@@ -2,11 +2,16 @@
-    context is supported */
- #include "softfloat.h"
- #include <math.h>
+@@ -6,10 +6,15 @@
+ #include <fenv.h>
+ #endif
+ 
 +#if defined(__FreeBSD__) && __FreeBSD_version < 500000
 +#include <ieeefp.h>
 +#endif
- 
++
  void set_float_rounding_mode(int val STATUS_PARAM)
  {
      STATUS(float_rounding_mode) = val;
--#if defined(_BSD) && !defined(__APPLE__) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if defined(_BSD) && !defined(__APPLE__) && !defined(__FreeBSD__) || \
+-#if defined(HOST_BSD) && !defined(__APPLE__) ||         \
++#if defined(HOST_BSD) && !defined(__APPLE__) && !defined(__FreeBSD__) || \
 +    (defined(__FreeBSD__) && __FreeBSD_version < 500000) || \
-+    (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+     (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
      fpsetround(val);
  #elif defined(__arm__)
-     /* nothing to do */
-@@ -22,7 +25,7 @@
+@@ -26,7 +31,7 @@
  }
  #endif
  
--#if defined(_BSD) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
-+#if (defined(_BSD) && !defined(__FreeBSD__)) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
+-#if defined(HOST_BSD) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
++#if (defined(HOST_BSD) && !defined(__FreeBSD__)) || (defined(HOST_SOLARIS) && HOST_SOLARIS < 10)
  #define lrint(d)		((int32_t)rint(d))
  #define llrint(d)		((int64_t)rint(d))
  #define lrintf(f)		((int32_t)rint(f))
@@ -83,7 +79,7 @@ Index: qemu/fpu/softfloat-native.h
  /* Native implementation of soft float functions */
  #include <math.h>
  
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
+-#if (defined(HOST_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
 +#ifdef __FreeBSD__
 +#include <osreldate.h>
 +long double fabsl(long double x);
@@ -94,7 +90,7 @@ Index: qemu/fpu/softfloat-native.h
 +long long llrintl(long double x);
 +#endif
 +
-+#if (defined(_BSD) && !defined(__APPLE__) && \
++#if (defined(HOST_BSD) && !defined(__APPLE__) && \
 +     (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
 +    defined(HOST_SOLARIS)
  #include <ieeefp.h>
@@ -112,8 +108,8 @@ Index: qemu/fpu/softfloat-native.h
 @@ -109,6 +109,8 @@
  | Software IEC/IEEE floating-point rounding mode.
  *----------------------------------------------------------------------------*/
--#if (defined(_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
-+#if (defined(_BSD) && !defined(__APPLE__) && \
+-#if (defined(HOST_BSD) && !defined(__APPLE__)) || defined(HOST_SOLARIS)
++#if (defined(HOST_BSD) && !defined(__APPLE__) && \
 +      (!defined(__FreeBSD__) || __FreeBSD_version < 500000)) || \
 +     defined(HOST_SOLARIS)
  #if defined(__OpenBSD__)
@@ -124,9 +120,9 @@ Index: qemu/fpu/softfloat.h
  #define FLOAT128
  #else
  /* native float support */
--#if (defined(__i386__) || defined(__x86_64__)) && !defined(_BSD)
+-#if (defined(__i386__) || defined(__x86_64__)) && !defined(HOST_BSD)
 +#if (defined(__i386__) || defined(__x86_64__)) && \
-+    (!defined(_BSD) || defined(__FreeBSD__))
++    (!defined(HOST_BSD) || defined(__FreeBSD__))
  #define FLOATX80
  #endif
  #endif /* !CONFIG_SOFTFLOAT */
diff --git a/emulators/qemu/files/patch-hw-serial.c b/emulators/qemu/files/patch-hw-serial.c
deleted file mode 100644
index a195b85360de..000000000000
--- a/emulators/qemu/files/patch-hw-serial.c
+++ /dev/null
@@ -1,18 +0,0 @@
-Index: qemu/hw/serial.c
-@@ -196,12 +195,10 @@ static void serial_update_irq(SerialStat
-          * this is not in the specification but is observed on existing
-          * hardware.  */
-         tmp_iir = UART_IIR_CTI;
--    } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR)) {
--        if (!(s->fcr & UART_FCR_FE)) {
--           tmp_iir = UART_IIR_RDI;
--        } else if (s->recv_fifo.count >= s->recv_fifo.itl) {
--           tmp_iir = UART_IIR_RDI;
--        }
-+    } else if ((s->ier & UART_IER_RDI) && (s->lsr & UART_LSR_DR) &&
-+               (!(s->fcr & UART_FCR_FE) ||
-+                s->recv_fifo.count >= s->recv_fifo.itl)) {
-+        tmp_iir = UART_IIR_RDI;
-     } else if ((s->ier & UART_IER_THRI) && s->thr_ipending) {
-         tmp_iir = UART_IIR_THRI;
-     } else if ((s->ier & UART_IER_MSI) && (s->msr & UART_MSR_ANY_DELTA)) {
diff --git a/emulators/qemu/files/patch-hw-vmware_vga.c b/emulators/qemu/files/patch-hw-vmware_vga.c
index a54b8729c7df..fb404a749946 100644
--- a/emulators/qemu/files/patch-hw-vmware_vga.c
+++ b/emulators/qemu/files/patch-hw-vmware_vga.c
@@ -72,13 +72,3 @@ Index: qemu/hw/vmware_vga.c
          badcmd:
              while (args --)
                  vmsvga_fifo_read(s);
-@@ -914,7 +914,7 @@
-     s->width = -1;
-     s->height = -1;
-     s->svgaid = SVGA_ID;
--    s->depth = 24;
-+    s->depth = 32;
-     s->bypp = (s->depth + 7) >> 3;
-     s->cursor.on = 0;
-     s->redraw_fifo_first = 0;
-
diff --git a/emulators/qemu/files/patch-osdep.c b/emulators/qemu/files/patch-osdep.c
new file mode 100644
index 000000000000..984c63bdbbcb
--- /dev/null
+++ b/emulators/qemu/files/patch-osdep.c
@@ -0,0 +1,11 @@
+Index: qemu/osdep.c
+@@ -179,7 +179,9 @@
+         }
+         unlink(phys_ram_file);
+     }
++#endif /* !(__OpenBSD__ || __FreeBSD__ || __DragonFly__) */
+     size = (size + 4095) & ~4095;
++#if !defined(__OpenBSD__) && !defined(__FreeBSD__) && !defined(__DragonFly__)
+     ftruncate(phys_ram_fd, phys_ram_size + size);
+ #endif /* !(__OpenBSD__ || __FreeBSD__ || __DragonFly__) */
+     ptr = mmap(NULL,
diff --git a/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S b/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S
new file mode 100644
index 000000000000..91a3c4e8decc
--- /dev/null
+++ b/emulators/qemu/files/patch-pc-bios-optionrom-multiboot.S
@@ -0,0 +1,16 @@
+--- a/pc-bios/optionrom/multiboot.S
++++ b/pc-bios/optionrom/multiboot.S
+@@ -113,7 +113,10 @@ mmap_loop:
+ 	/* entry size (mmap struct) & max buffer size (int15) */
+ 	movl		$20, %ecx
+ 	/* store entry size */
++	/* old as(1) doesn't like this insn so emit the bytes instead:
+ 	movl		%ecx, %es:-4(%edi)
++	*/
++	.dc.b		0x26,0x67,0x66,0x89,0x4f,0xfc
+ 	/* e820 */
+ 	movl		$0x0000e820, %eax
+ 	/* 'SMAP' magic */
+-- 
+1.6.5.2
+
diff --git a/emulators/qemu/files/patch-tapclose b/emulators/qemu/files/patch-tapclose
index 1dde3ca9342d..8da33adb673f 100644
--- a/emulators/qemu/files/patch-tapclose
+++ b/emulators/qemu/files/patch-tapclose
@@ -1,16 +1,18 @@
 Index: qemu/net.c
-@@ -788,11 +788,11 @@
- {
-     TAPState *s = vc->opaque;
+@@ -1643,12 +1643,13 @@ static void tap_cleanup(VLANClientState 
+ 
+     qemu_purge_queued_packets(vc);
  
 -    if (s->down_script[0])
 -        launch_script(s->down_script, s->down_script_arg, s->fd);
 -
-     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
+     tap_read_poll(s, 0);
+     tap_write_poll(s, 0);
      close(s->fd);
 +
 +    if (s->down_script[0])
 +        launch_script(s->down_script, s->down_script_arg, -1);
++
      qemu_free(s);
  }
  
diff --git a/emulators/qemu/files/patch-vl.c b/emulators/qemu/files/patch-vl.c
index 44684c7ce36b..b979a0373046 100644
--- a/emulators/qemu/files/patch-vl.c
+++ b/emulators/qemu/files/patch-vl.c
@@ -1,28 +1,82 @@
 Index: qemu/vl.c
-@@ -75,6 +75,7 @@
+@@ -57,6 +57,7 @@
  #include <sys/stat.h>
- #ifdef __FreeBSD__
+ #if defined(__FreeBSD__) || defined(__DragonFly__)
  #include <libutil.h>
 +#include <sys/param.h>
  #else
  #include <util.h>
  #endif
-@@ -9850,15 +9850,15 @@
-         phys_ram_size += ram_size;
-     }
+@@ -4782,6 +4783,10 @@
+ 
+ #endif
+ 
++#if !defined(CONFIG_USER_ONLY)
++void io_mem_init(void);
++#endif
++
+ int main(int argc, char **argv, char **envp)
+ {
+ #ifdef CONFIG_GDBSTUB
+@@ -5621,6 +5626,10 @@
+ #ifdef CONFIG_KQEMU
+     if (smp_cpus > 1)
+         kqemu_allowed = 0;
++    if (kqemu_allowed && ram_size > (1536 << 20)) {
++        fprintf(stderr, "qemu: at most 1536 MB RAM can be simulated with kqemu\n");
++        exit(1);
++    }
+ #endif
+     if (qemu_init_main_loop()) {
+         fprintf(stderr, "qemu_init_main_loop failed\n");
+@@ -5715,6 +5724,9 @@
+     if (ram_size == 0)
+         ram_size = DEFAULT_RAM_SIZE * 1024 * 1024;
  
 +    /* init the dynamic translator */
 +    cpu_exec_init_all(tb_size * 1024 * 1024);
 +
-     phys_ram_base = qemu_vmalloc(phys_ram_size);
-     if (!phys_ram_base) {
-         fprintf(stderr, "Could not allocate physical memory\n");
-         exit(1);
+ #ifdef CONFIG_KQEMU
+     /* FIXME: This is a nasty hack because kqemu can't cope with dynamic
+        guest ram allocation.  It needs to go away.  */
+@@ -5727,9 +5739,9 @@
+         }
      }
- 
+ #endif
+-
 -    /* init the dynamic translator */
 -    cpu_exec_init_all(tb_size * 1024 * 1024);
--
++#if !defined(CONFIG_USER_ONLY)
++    io_mem_init();
++#endif
+ 
      bdrv_init();
+     dma_helper_init();
+Index: qemu/exec.c
+@@ -179,7 +179,7 @@
+ static PhysPageDesc **l1_phys_map;
+ 
+ #if !defined(CONFIG_USER_ONLY)
+-static void io_mem_init(void);
++void io_mem_init(void);
+ 
+ /* io memory support */
+ CPUWriteMemoryFunc *io_mem_write[IO_MEM_NB_ENTRIES][4];
+@@ -503,7 +503,7 @@
+     code_gen_alloc(tb_size);
+     code_gen_ptr = code_gen_buffer;
+     page_init();
+-#if !defined(CONFIG_USER_ONLY)
++#if 0 && !defined(CONFIG_USER_ONLY)
+     io_mem_init();
+ #endif
+ }
+@@ -2993,7 +2993,7 @@
+     return -1;
+ }
+ 
+-static void io_mem_init(void)
++void io_mem_init(void)
+ {
+     int i;
  
-     /* we always create the cdrom drive, even if no disk is there */
diff --git a/emulators/qemu/files/patch-z-bandaid-usb-current b/emulators/qemu/files/patch-z-bandaid-usb-current
index 347c8417ab7b..ad66da21f543 100644
--- a/emulators/qemu/files/patch-z-bandaid-usb-current
+++ b/emulators/qemu/files/patch-z-bandaid-usb-current
@@ -1,14 +1,14 @@
 Index: qemu/usb-bsd.c
-@@ -34,7 +34,12 @@
- #undef USB_SPEED_LOW
+@@ -35,7 +35,12 @@
  
  #include <sys/ioctl.h>
+ #ifndef __DragonFly__
 +#include <sys/param.h>
 +#if __FreeBSD_version >= 800064
 +#include <legacy/dev/usb/usb.h>
 +#else
  #include <dev/usb/usb.h>
 +#endif
- #include <signal.h>
- 
- /* This value has maximum potential at 16.
+ #else
+ #include <bus/usb/usb.h>
+ #endif
diff --git a/emulators/qemu/files/pcap-patch b/emulators/qemu/files/pcap-patch
index 1a821b4fe167..0351d0c23f9b 100644
--- a/emulators/qemu/files/pcap-patch
+++ b/emulators/qemu/files/pcap-patch
@@ -1,51 +1,55 @@
---- Makefile.target.orig	2009-09-02 16:09:39.000000000 -0400
-+++ Makefile.target	2009-09-02 16:09:39.000000000 -0400
-@@ -687,6 +687,9 @@
+--- Makefile.target.orig	2008-07-18 15:18:11.000000000 -0400
++++ Makefile.target	2008-07-18 15:23:11.000000000 -0400
+@@ -619,6 +619,13 @@
  COCOA_LIBS+=-framework CoreAudio
  endif
  endif
 +ifdef CONFIG_PCAP
-+LIBS+=$(PCAP_LIBS)
++ifdef CONFIG_WIN32
++LIBS+=-lwpcap
++else
++LIBS+=-lpcap
++endif
 +endif
  ifdef CONFIG_SLIRP
  CPPFLAGS+=-I$(SRC_PATH)/slirp
  endif
---- configure.orig	2009-09-02 16:09:39.000000000 -0400
-+++ configure	2009-09-02 16:09:39.000000000 -0400
-@@ -188,6 +188,9 @@
- blobs="yes"
- fdt="yes"
+Index: configure
+@@ -203,6 +203,9 @@
  sdl_x11="no"
+ xen="yes"
+ pkgversion=""
 +pcap="no"
 +pcap_create="no"
 +bpf="no"
  
  # OS specific
  if check_define __linux__ ; then
-@@ -388,6 +391,8 @@
+@@ -428,6 +431,8 @@
    ;;
-   --disable-vnc-tls) vnc_tls="no"
+   --disable-vnc-sasl) vnc_sasl="no"
    ;;
 +  --enable-pcap) pcap="yes"
 +  ;;
    --disable-slirp) slirp="no"
    ;;
    --disable-vde) vde="no"
-@@ -822,6 +827,47 @@
+@@ -925,6 +930,48 @@
  fi
  
  ##########################################
 +# pcap probe
++
 +if test "$pcap" = "yes" ; then
++  cat > $TMPC << EOF
++#include <pcap.h>
++int main(void) { return (pcap_lib_version() == (char *)0 ? 1 : 0); }
++EOF
 +  if test "$mingw32" = "no" ; then
 +    libpcap=-lpcap
 +  else
 +    libpcap=-lwpcap
 +  fi
-+  cat > $TMPC << EOF
-+#include <pcap.h>
-+int main(void) { return (pcap_lib_version() == (char *)0 ? 1 : 0); }
-+EOF
 +  if ! $cc $ARCH_CFLAGS -o $TMPE $libpcap $TMPC 2> /dev/null ; then
 +    echo
 +    echo "Error: Could not find pcap"
@@ -79,32 +83,38 @@
  # VNC TLS detection
  if test "$vnc_tls" = "yes" ; then
  cat > $TMPC <<EOF
-@@ -1365,6 +1411,17 @@
+@@ -1436,6 +1484,7 @@
+     echo "    SASL CFLAGS    $vnc_sasl_cflags"
+     echo "    SASL LIBS      $vnc_sasl_libs"
+ fi
++echo "pcap support      $pcap"
+ if test -n "$sparc_cpu"; then
+     echo "Target Sparc Arch $sparc_cpu"
+ fi
+@@ -1589,6 +1638,16 @@
  if test $profiler = "yes" ; then
-   echo "#define CONFIG_PROFILER 1" >> $config_h
+   echo "#define CONFIG_PROFILER 1" >> $config_host_h
  fi
 +if test "$pcap" = "yes" ; then
-+  echo "CONFIG_PCAP=yes" >> $config_mak
-+  echo "#define CONFIG_PCAP 1" >> $config_h
++  echo "CONFIG_PCAP=yes" >> $config_host_mak
++  echo "#define CONFIG_PCAP 1" >> $config_host_h
 +  if test "$pcap_create" = "yes" ; then
-+    echo "#define CONFIG_PCAP_CREATE 1" >> $config_h
++    echo "#define HAVE_PCAP_CREATE 1" >> $config_host_h
 +  fi
 +  if test "$bpf" = "yes" ; then
-+    echo "#define CONFIG_BPF 1" >> $config_h
++    echo "#define HAVE_BPF 1" >> $config_host_h
 +  fi
-+  echo "PCAP_LIBS=$libpcap" >> $config_mak
 +fi
  if test "$slirp" = "yes" ; then
-   echo "CONFIG_SLIRP=yes" >> $config_mak
-   echo "#define CONFIG_SLIRP 1" >> $config_h
---- net.c.orig	2009-09-02 16:09:39.000000000 -0400
-+++ net.c	2009-09-02 16:11:38.000000000 -0400
-@@ -481,6 +481,166 @@
-     return max_len;
+   echo "CONFIG_SLIRP=y" >> $config_host_mak
+   echo "#define CONFIG_SLIRP 1" >> $config_host_h
+Index: net.c
+@@ -688,6 +688,166 @@
+     va_end(ap);
  }
  
 +#if defined(CONFIG_PCAP)
-+#if defined(CONFIG_BPF)
++#if defined(HAVE_BPF)
 +#define PCAP_DONT_INCLUDE_PCAP_BPF_H
 +#include <net/bpf.h>
 +#endif
@@ -115,11 +125,11 @@
 +    pcap_t *handle;
 +} PCAPState;
 +
-+static void pcap_receive(void *opaque, const uint8_t *buf, int size)
++static ssize_t pcap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 +{
-+    PCAPState *s = (PCAPState *)opaque;
++    PCAPState *s = (PCAPState *)vc->opaque;
 +
-+    pcap_sendpacket(s->handle, (u_char*)buf, size);
++    return pcap_inject(s->handle, (u_char*)buf, size);
 +}
 +
 +static void pcap_callback(u_char *user, struct pcap_pkthdr *phdr, u_char *pdata)
@@ -158,11 +168,11 @@
 +	return -1;
 +
 +    if (ifname == NULL && (ifname = pcap_lookupdev(errbuf)) == NULL) {
-+	fprintf(stderr, "qemu: pcap_create: %s\n", errbuf);
++	fprintf(stderr, "qemu: pcap_lookupdev: %s\n", errbuf);
 +	goto fail;
 +    }
 +
-+#if defined(CONFIG_PCAP_CREATE) || defined(_WIN32)
++#if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
 +    /*
 +     * Create pcap handle for the device, set promiscuous mode and activate.
 +     */
@@ -203,7 +213,7 @@
 +	goto fail;
 +    }
 +#else /* !_WIN32 */
-+#if defined(CONFIG_BPF)
++#if defined(HAVE_BPF)
 +#if defined(BIOCIMMEDIATE)
 +    /*
 +     * Tell the kernel that the packet has to be seen immediately.
@@ -230,10 +240,10 @@
 +	}
 +    }
 +#endif /* BIOCFEEDBACK */
-+#endif /* CONFIG_BPF */
++#endif /* HAVE_BPF */
 +#endif /* _WIN32 */
 +
-+    s->vc = qemu_new_vlan_client(vlan, model, name, pcap_receive, NULL, pcap_cleanup, s);
++    s->vc = qemu_new_vlan_client(vlan, model, name, NULL, pcap_receive, NULL, pcap_cleanup, s);
 +    snprintf(s->vc->info_str, sizeof(s->vc->info_str), "pcap redirector");
 +
 +#if defined(_WIN32)
@@ -266,7 +276,7 @@
  #if defined(CONFIG_SLIRP)
  
  /* slirp network adapter */
-@@ -1755,6 +1915,16 @@
+@@ -2598,6 +2758,16 @@
             are wanted */
          ret = 0;
      } else
@@ -282,17 +292,16 @@
 +#endif
  #ifdef CONFIG_SLIRP
      if (!strcmp(device, "user")) {
-         if (get_param_value(buf, sizeof(buf), "hostname", p)) {
---- vl.c.orig	2009-09-02 16:09:39.000000000 -0400
-+++ vl.c	2009-09-02 16:09:39.000000000 -0400
-@@ -3990,6 +3990,10 @@
-            "Network options:\n"
-            "-net nic[,vlan=n][,macaddr=addr][,model=type][,name=str]\n"
-            "                create a new Network Interface Card and connect it to VLAN 'n'\n"
+         static const char * const slirp_params[] = {
+Index: qemu-options.hx
+@@ -782,6 +782,10 @@
+     "                connect the user mode network stack to VLAN 'n', configure its\n"
+     "                DHCP server and enabled optional services\n"
+ #endif
 +#ifdef CONFIG_PCAP
-+           "-net pcap[,vlan=n][,name=str][,ifname=name]\n"
-+           "                connect the host network interface using PCAP to VLAN 'n'\n"
++    "-net pcap[,vlan=n][,name=str][,ifname=name]\n"
++    "                connect the host network interface using PCAP to VLAN 'n'\n"
 +#endif
- #ifdef CONFIG_SLIRP
-            "-net user[,vlan=n][,name=str][,hostname=host]\n"
-            "                connect the user mode network stack to VLAN 'n' and send\n"
+ #ifdef _WIN32
+     "-net tap[,vlan=n][,name=str],ifname=name\n"
+     "                connect the host TAP network interface to VLAN 'n'\n"
diff --git a/emulators/qemu/files/phys-cdrom-freebsd-patch b/emulators/qemu/files/phys-cdrom-freebsd-patch
deleted file mode 100644
index 6f477c4339cb..000000000000
--- a/emulators/qemu/files/phys-cdrom-freebsd-patch
+++ /dev/null
@@ -1,282 +0,0 @@
-Index: qemu/block-raw-posix.c
-@@ -55,6 +55,7 @@
- #ifdef __FreeBSD__
- #include <signal.h>
- #include <sys/disk.h>
-+#include <sys/cdio.h>
- #endif
- 
- #ifdef __OpenBSD__
-@@ -105,6 +106,9 @@
-     int fd_got_error;
-     int fd_media_changed;
- #endif
-+#if defined(__FreeBSD__)
-+    int cd_open_flags;
-+#endif
-     uint8_t* aligned_buf;
- } BDRVRawState;
- 
-@@ -112,6 +116,12 @@
- 
- static int fd_open(BlockDriverState *bs);
- 
-+#if defined(__FreeBSD__)
-+static int cd_open(BlockDriverState *bs);
-+#endif
-+
-+static int raw_is_inserted(BlockDriverState *bs);
-+
- static int raw_open(BlockDriverState *bs, const char *filename, int flags)
- {
-     BDRVRawState *s = bs->opaque;
-@@ -747,6 +757,9 @@
-     int64_t size;
- #ifdef _BSD
-     struct stat sb;
-+#ifdef __FreeBSD__
-+    int reopened = 0;
-+#endif
- #endif
- #ifdef __sun__
-     struct dk_minfo minfo;
-@@ -759,6 +772,9 @@
-         return ret;
- 
- #ifdef _BSD
-+#ifdef __FreeBSD__
-+again:
-+#endif
-     if (!fstat(fd, &sb) && (S_IFCHR & sb.st_mode)) {
- #ifdef DIOCGMEDIASIZE
- 	if (ioctl(fd, DIOCGMEDIASIZE, (off_t *)&size))
-@@ -768,6 +784,19 @@
- #else
-         size = lseek(fd, 0LL, SEEK_END);
- #endif
-+#ifdef __FreeBSD__
-+        switch(s->type) {
-+        case FTYPE_CD:
-+            /* XXX FreeBSD acd returns UINT_MAX sectors for an empty drive */
-+            if (size == 2048LL * (unsigned)-1)
-+                size = 0;
-+            /* XXX no disc?  maybe we need to reopen... */
-+            if (size <= 0 && !reopened && cd_open(bs) >= 0) {
-+                reopened = 1;
-+                goto again;
-+            }
-+        }
-+#endif
-     } else
- #endif
- #ifdef __sun__
-@@ -958,6 +987,14 @@
-         bs->sg = 1;
-     }
- #endif
-+#if defined(__FreeBSD__)
-+    if (strstart(filename, "/dev/cd", NULL) ||
-+        strstart(filename, "/dev/acd", NULL)) {
-+        s->type = FTYPE_CD;
-+        s->cd_open_flags = open_flags;
-+    }
-+#endif
-+    s->fd = -1;
-     fd = open(filename, open_flags, 0644);
-     if (fd < 0) {
-         ret = -errno;
-@@ -966,6 +1003,11 @@
-         return ret;
-     }
-     s->fd = fd;
-+#if defined(__FreeBSD__)
-+    /* make sure the door isnt locked at this time */
-+    if (s->type == FTYPE_CD)
-+        ioctl (s->fd, CDIOCALLOW);
-+#endif
- #if defined(__linux__)
-     /* close fd so that we can reopen it as needed */
-     if (s->type == FTYPE_FD) {
-@@ -1132,7 +1174,116 @@
- 
-     return ioctl(s->fd, req, buf);
- }
--#else
-+#elif defined(__FreeBSD__)
-+
-+static int fd_open(BlockDriverState *bs)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    /* this is just to ensure s->fd is sane (its called by io ops) */
-+    if (s->fd >= 0)
-+        return 0;
-+    return -EIO;
-+}
-+
-+static int cd_open(BlockDriverState *bs)
-+{
-+#if defined(__FreeBSD__)
-+    BDRVRawState *s = bs->opaque;
-+    int fd;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        /* XXX force reread of possibly changed/newly loaded disc,
-+         * FreeBSD seems to not notice sometimes... */
-+        if (s->fd >= 0)
-+            close (s->fd);
-+        fd = open(bs->filename, s->cd_open_flags, 0644);
-+        if (fd < 0) {
-+            s->fd = -1;
-+            return -EIO;
-+        }
-+        s->fd = fd;
-+        /* make sure the door isnt locked at this time */
-+        ioctl (s->fd, CDIOCALLOW);
-+    }
-+#endif
-+    return 0;
-+}
-+
-+static int raw_is_inserted(BlockDriverState *bs)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        return (raw_getlength(bs) > 0);
-+    case FTYPE_FD:
-+        /* XXX handle this */
-+        /* FALLTHRU */
-+    default:
-+        return 1;
-+    }
-+}
-+
-+static int raw_media_changed(BlockDriverState *bs)
-+{
-+    return -ENOTSUP;
-+}
-+
-+static int raw_eject(BlockDriverState *bs, int eject_flag)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        if (s->fd < 0)
-+            return -ENOTSUP;
-+        (void) ioctl (s->fd, CDIOCALLOW);
-+        if (eject_flag) {
-+            if (ioctl (s->fd, CDIOCEJECT) < 0)
-+                perror("CDIOCEJECT");
-+        } else {
-+            if (ioctl (s->fd, CDIOCCLOSE) < 0)
-+                perror("CDIOCCLOSE");
-+        }
-+        if (cd_open(bs) < 0)
-+            return -ENOTSUP;
-+        break;
-+    case FTYPE_FD:
-+        /* XXX handle this */
-+        /* FALLTHRU */
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+static int raw_set_locked(BlockDriverState *bs, int locked)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    switch(s->type) {
-+    case FTYPE_CD:
-+        if (s->fd < 0)
-+            return -ENOTSUP;
-+        if (ioctl (s->fd, (locked ? CDIOCPREVENT : CDIOCALLOW)) < 0) {
-+            /* Note: an error can happen if the distribution automatically
-+               mounts the CD-ROM */
-+            //        perror("CDROM_LOCKDOOR");
-+        }
-+        break;
-+    default:
-+        return -ENOTSUP;
-+    }
-+    return 0;
-+}
-+
-+static int raw_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
-+{
-+    return -ENOTSUP;
-+}
-+#else /* !linux && !FreeBSD */
- 
- static int fd_open(BlockDriverState *bs)
- {
-@@ -1163,7 +1314,7 @@
- {
-     return -ENOTSUP;
- }
--#endif /* !linux */
-+#endif /* !linux && !FreeBSD */
- 
- BlockDriver bdrv_host_device = {
-     "host_device",
-Index: qemu/hw/scsi-disk.c
-@@ -417,16 +417,26 @@
-     switch (command) {
-     case 0x0:
- 	DPRINTF("Test Unit Ready\n");
-+        if (!bdrv_is_inserted(s->bdrv))
-+            goto notready;
- 	break;
-     case 0x03:
-         DPRINTF("Request Sense (len %d)\n", len);
-         if (len < 4)
-             goto fail;
-         memset(outbuf, 0, 4);
-+        r->buf_len = 4;
-+        if (s->sense == SENSE_NOT_READY && len >= 18) {
-+            memset(outbuf, 0, 18);
-+            r->buf_len = 18;
-+            outbuf[7] = 10;
-+            /* asc 0x3a, ascq 0: Medium not present */
-+            outbuf[12] = 0x3a;
-+            outbuf[13] = 0;
-+        }
-         outbuf[0] = 0xf0;
-         outbuf[1] = 0;
-         outbuf[2] = s->sense;
--        r->buf_len = 4;
-         break;
-     case 0x12:
-         DPRINTF("Inquiry (len %d)\n", len);
-@@ -725,6 +735,10 @@
-         break;
-     case 0x1b:
-         DPRINTF("Start Stop Unit\n");
-+        if (bdrv_get_type_hint(s->bdrv) == BDRV_TYPE_CDROM &&
-+            (buf[4] & 2))
-+            /* load/eject medium */
-+            bdrv_eject(s->bdrv, !(buf[4] & 1));
- 	break;
-     case 0x1e:
-         DPRINTF("Prevent Allow Medium Removal (prevent = %d)\n", buf[4] & 3);
-@@ -754,6 +768,7 @@
-             outbuf[7] = 0;
-             r->buf_len = 8;
-         } else {
-+        notready:
-             scsi_command_complete(r, STATUS_CHECK_CONDITION, SENSE_NOT_READY);
-             return 0;
-         }
-@@ -790,6 +805,7 @@
-             start_track = buf[6];
-             bdrv_get_geometry(s->bdrv, &nb_sectors);
-             DPRINTF("Read TOC (track %d format %d msf %d)\n", start_track, format, msf >> 1);
-+            nb_sectors /= s->cluster_size;
-             switch(format) {
-             case 0:
-                 toclen = cdrom_read_toc(nb_sectors, outbuf, msf, start_track);