qemu: Update to a recent version

git-svn-id: https://svn.o-hand.com/repos/poky/trunk@1923 311d38ba-8fff-0310-9ca6-ca027cbcb966

36 files changed, 1292 insertions, 1901 deletions

diff --git a/meta/conf/distro/poky.conf b/meta/conf/distro/poky.conf
index 8f607cdc0..86a1cfd4d 100644
--- a/meta/conf/distro/poky.conf
+++ b/meta/conf/distro/poky.conf
@@ -93,8 +93,8 @@ SRCDATE_screenshot ?= "20070529"
 SRCDATE_xcalibrateext ?= "20051101"
 SRCDATE_libfakekey ?= "20051101"
 SRCDATE_xcalibrate ?= "20060312"
-SRCDATE_qemu ?= "20060723"
-SRCDATE_qemu-native ?= "20060723"
+SRCDATE_qemu ?= "20070613"
+SRCDATE_qemu-native ?= "20070613"
 SRCDATE_oprofile ?= "20070529"
 SRCDATE_oprofileui ?= "20070529"
 SRCDATE_zaurusd ?= "20070529"
diff --git a/meta/packages/qemu/files/02_snapshot_use_tmpdir.patch b/meta/packages/qemu/files/02_snapshot_use_tmpdir.patch
new file mode 100644
index 000000000..bd955b6db
--- /dev/null
+++ b/meta/packages/qemu/files/02_snapshot_use_tmpdir.patch
@@ -0,0 +1,23 @@
+#DPATCHLEVEL=0
+---
+# block.c |    6 +++++-
+# 1 file changed, 5 insertions(+), 1 deletion(-)
+#
+Index: block.c
+===================================================================
+--- block.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ block.c	2007-06-13 11:51:53.000000000 +0100
+@@ -188,8 +188,12 @@ void get_tmp_filename(char *filename, in
+ void get_tmp_filename(char *filename, int size)
+ {
+     int fd;
++    char *tmpdir;
+     /* XXX: race condition possible */
+-    pstrcpy(filename, size, "/tmp/vl.XXXXXX");
++    tmpdir = getenv("TMPDIR");
++    if (!tmpdir)
++        tmpdir = "/tmp";
++    snprintf(filename, size, "%s/vl.XXXXXX", tmpdir);
+     fd = mkstemp(filename);
+     close(fd);
+ }
diff --git a/meta/packages/qemu/files/03_machines_list_no_error.patch b/meta/packages/qemu/files/03_machines_list_no_error.patch
new file mode 100644
index 000000000..73f31550f
--- /dev/null
+++ b/meta/packages/qemu/files/03_machines_list_no_error.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=0
+---
+# vl.c |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: vl.c
+===================================================================
+--- vl.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ vl.c	2007-06-13 11:52:24.000000000 +0100
+@@ -7242,7 +7242,7 @@ int main(int argc, char **argv)
+                                m->name, m->desc, 
+                                m == first_machine ? " (default)" : "");
+                     }
+-                    exit(1);
++                    exit(strcmp(optarg, "?"));
+                 }
+                 break;
+             case QEMU_OPTION_cpu:
diff --git a/meta/packages/qemu/files/04_do_not_print_rtc_freq_if_ok.patch b/meta/packages/qemu/files/04_do_not_print_rtc_freq_if_ok.patch
new file mode 100644
index 000000000..1575cbce6
--- /dev/null
+++ b/meta/packages/qemu/files/04_do_not_print_rtc_freq_if_ok.patch
@@ -0,0 +1,25 @@
+#DPATCHLEVEL=1
+---
+# vl.c |    6 +++++-
+# 1 file changed, 5 insertions(+), 1 deletion(-)
+#
+Index: qemu/vl.c
+===================================================================
+--- qemu.orig/vl.c	2007-06-13 11:51:53.000000000 +0100
++++ qemu/vl.c	2007-06-13 11:52:19.000000000 +0100
+@@ -1026,10 +1026,14 @@ static int rtc_fd;
+ 
+ static int start_rtc_timer(void)
+ {
++    unsigned long current_rtc_freq = 0;
++
+     rtc_fd = open("/dev/rtc", O_RDONLY);
+     if (rtc_fd < 0)
+         return -1;
+-    if (ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
++    ioctl(rtc_fd, RTC_IRQP_READ, &current_rtc_freq);
++    if (current_rtc_freq != RTC_FREQ &&
++        ioctl(rtc_fd, RTC_IRQP_SET, RTC_FREQ) < 0) {
+         fprintf(stderr, "Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal\n"
+                 "error, but for better emulation accuracy either use a 2.6 host Linux kernel or\n"
+                 "type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.\n");
diff --git a/meta/packages/qemu/files/05_non-fatal_if_linux_hd_missing.patch b/meta/packages/qemu/files/05_non-fatal_if_linux_hd_missing.patch
new file mode 100644
index 000000000..b7c4732f2
--- /dev/null
+++ b/meta/packages/qemu/files/05_non-fatal_if_linux_hd_missing.patch
@@ -0,0 +1,17 @@
+#DPATCHLEVEL=1
+---
+# hw/pc.c |    1 -
+# 1 file changed, 1 deletion(-)
+#
+Index: qemu/hw/pc.c
+===================================================================
+--- qemu.orig/hw/pc.c	2007-06-13 11:51:52.000000000 +0100
++++ qemu/hw/pc.c	2007-06-13 11:51:53.000000000 +0100
+@@ -355,7 +355,6 @@ static void generate_bootsect(uint32_t g
+     if (bs_table[0] == NULL) {
+ 	fprintf(stderr, "A disk image must be given for 'hda' when booting "
+ 		"a Linux kernel\n");
+-	exit(1);
+     }
+ 
+     memset(bootsect, 0, sizeof(bootsect));
diff --git a/meta/packages/qemu/files/06_exit_segfault.patch b/meta/packages/qemu/files/06_exit_segfault.patch
new file mode 100644
index 000000000..447c3550b
--- /dev/null
+++ b/meta/packages/qemu/files/06_exit_segfault.patch
@@ -0,0 +1,45 @@
+#DPATCHLEVEL=0
+---
+# linux-user/main.c |    8 ++++----
+# 1 file changed, 4 insertions(+), 4 deletions(-)
+#
+Index: linux-user/main.c
+===================================================================
+--- linux-user/main.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ linux-user/main.c	2007-06-13 11:52:16.000000000 +0100
+@@ -642,7 +642,7 @@ void cpu_loop (CPUSPARCState *env)
+         default:
+             printf ("Unhandled trap: 0x%x\n", trapnr);
+             cpu_dump_state(env, stderr, fprintf, 0);
+-            exit (1);
++            _exit (1);
+         }
+         process_pending_signals (env);
+     }
+@@ -1471,7 +1471,7 @@ void cpu_loop (CPUState *env)
+         default:
+             printf ("Unhandled trap: 0x%x\n", trapnr);
+             cpu_dump_state(env, stderr, fprintf, 0);
+-            exit (1);
++            _exit (1);
+         }
+         process_pending_signals (env);
+     }
+@@ -1735,7 +1735,7 @@ int main(int argc, char **argv)
+                 for(item = cpu_log_items; item->mask != 0; item++) {
+                     printf("%-10s %s\n", item->name, item->help);
+                 }
+-                exit(1);
++                _exit(1);
+             }
+             cpu_set_log(mask);
+         } else if (!strcmp(r, "s")) {
+@@ -1754,7 +1754,7 @@ int main(int argc, char **argv)
+             if (qemu_host_page_size == 0 ||
+                 (qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
+                 fprintf(stderr, "page size must be a power of two\n");
+-                exit(1);
++                _exit(1);
+             }
+         } else if (!strcmp(r, "g")) {
+             gdbstub_port = atoi(argv[optind++]);
diff --git a/meta/packages/qemu/files/10_signal_jobs.patch b/meta/packages/qemu/files/10_signal_jobs.patch
new file mode 100644
index 000000000..794a53867
--- /dev/null
+++ b/meta/packages/qemu/files/10_signal_jobs.patch
@@ -0,0 +1,26 @@
+#DPATCHLEVEL=0
+---
+# linux-user/signal.c |    7 ++++++-
+# 1 file changed, 6 insertions(+), 1 deletion(-)
+#
+Index: linux-user/signal.c
+===================================================================
+--- linux-user/signal.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ linux-user/signal.c	2007-06-13 11:52:21.000000000 +0100
+@@ -341,10 +341,15 @@ int queue_signal(int sig, target_siginfo
+     k = &sigact_table[sig - 1];
+     handler = k->sa._sa_handler;
+     if (handler == TARGET_SIG_DFL) {
++        if (sig == TARGET_SIGTSTP || sig == TARGET_SIGTTIN || sig == TARGET_SIGTTOU) {
++            kill(getpid(),SIGSTOP);
++            return 0;
++        } else
+         /* default handler : ignore some signal. The other are fatal */
+         if (sig != TARGET_SIGCHLD && 
+             sig != TARGET_SIGURG && 
+-            sig != TARGET_SIGWINCH) {
++            sig != TARGET_SIGWINCH &&
++            sig != TARGET_SIGCONT) {
+             force_sig(sig);
+         } else {
+             return 0; /* indicate ignored */
diff --git a/meta/packages/qemu/files/11_signal_sigaction.patch b/meta/packages/qemu/files/11_signal_sigaction.patch
new file mode 100644
index 000000000..5446efc56
--- /dev/null
+++ b/meta/packages/qemu/files/11_signal_sigaction.patch
@@ -0,0 +1,21 @@
+#DPATCHLEVEL=0
+---
+# linux-user/signal.c |    5 +++++
+# 1 file changed, 5 insertions(+)
+#
+Index: linux-user/signal.c
+===================================================================
+--- linux-user/signal.c.orig	2007-06-13 11:51:54.000000000 +0100
++++ linux-user/signal.c	2007-06-13 11:52:20.000000000 +0100
+@@ -429,6 +429,11 @@ int do_sigaction(int sig, const struct t
+ 
+     if (sig < 1 || sig > TARGET_NSIG || sig == SIGKILL || sig == SIGSTOP)
+         return -EINVAL;
++
++    /* no point doing the stuff as those are not allowed for sigaction */
++    if ((sig == TARGET_SIGKILL) || (sig == TARGET_SIGSTOP))
++        return -EINVAL;
++
+     k = &sigact_table[sig - 1];
+ #if defined(DEBUG_SIGNAL)
+     fprintf(stderr, "sigaction sig=%d act=0x%08x, oact=0x%08x\n", 
diff --git a/meta/packages/qemu/files/12_signal_powerpc_support.patch b/meta/packages/qemu/files/12_signal_powerpc_support.patch
new file mode 100644
index 000000000..d8d419878
--- /dev/null
+++ b/meta/packages/qemu/files/12_signal_powerpc_support.patch
@@ -0,0 +1,401 @@
+#DPATCHLEVEL=1
+---
+# linux-user/signal.c |  371 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+# 1 file changed, 371 insertions(+)
+#
+Index: qemu/linux-user/signal.c
+===================================================================
+--- qemu.orig/linux-user/signal.c	2007-06-13 11:51:54.000000000 +0100
++++ qemu/linux-user/signal.c	2007-06-13 11:51:54.000000000 +0100
+@@ -2,6 +2,7 @@
+  *  Emulation of Linux signals
+  * 
+  *  Copyright (c) 2003 Fabrice Bellard
++ *  Copyright (c) 2005 Josh Triplett <josh@psas.pdx.edu>
+  *
+  *  This program is free software; you can redistribute it and/or modify
+  *  it under the terms of the GNU General Public License as published by
+@@ -16,6 +17,12 @@
+  *  You should have received a copy of the GNU General Public License
+  *  along with this program; if not, write to the Free Software
+  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
++ *
++ *  Various portions adapted from the Linux kernel:
++ *  Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
++ *    Derived from "arch/i386/kernel/signal.c"
++ *      Copyright (C) 1991, 1992 Linus Torvalds
++ *      1997-11-28  Modified for POSIX.1b signals by Richard Henderson
+  */
+ #include <stdlib.h>
+ #include <stdio.h>
+@@ -1964,6 +1971,370 @@ long do_rt_sigreturn(CPUState *env)
+     return -ENOSYS;
+ }
+ 
++#elif defined(TARGET_PPC)
++/* Adapted from the Linux kernel:
++ * arch/ppc/kernel/signal.c
++ * include/asm-ppc/elf.h
++ * include/asm-ppc/ptrace.h
++ * include/asm-ppc/sigcontext.h
++ * include/asm-ppc/ucontext.h
++ */
++
++/*
++ * When we have signals to deliver, we set up on the
++ * user stack, going down from the original stack pointer:
++ *	a sigregs struct
++ *	a sigcontext struct
++ *	a gap of __SIGNAL_FRAMESIZE bytes
++ *
++ * Each of these things must be a multiple of 16 bytes in size.
++ *
++ */
++
++#define TARGET_ELF_NGREG	48	/* includes nip, msr, lr, etc. */
++#define TARGET_ELF_NFPREG	33	/* includes fpscr */
++#define TARGET_ELF_NVRREG	33	/* includes vscr */
++
++/* General registers */
++typedef unsigned long target_elf_greg_t;
++typedef target_elf_greg_t target_elf_gregset_t[TARGET_ELF_NGREG];
++
++/* Floating point registers */
++typedef double target_elf_fpreg_t;
++typedef target_elf_fpreg_t target_elf_fpregset_t[TARGET_ELF_NFPREG];
++
++/* Altivec registers */
++/* FIXME: Altivec not supported yet. */
++/* typedef __vector128 elf_vrreg_t; */
++typedef uint64_t target_elf_vrreg_t[2];
++typedef target_elf_vrreg_t target_elf_vrregset_t[TARGET_ELF_NVRREG];
++
++struct target_mcontext {
++	target_elf_gregset_t	mc_gregs;
++	target_elf_fpregset_t	mc_fregs;
++	/* The kernel calls this mc_pad, but does #define tramp mc_pad */
++	target_ulong		tramp[2];
++	target_elf_vrregset_t	mc_vregs __attribute__((__aligned__(16)));
++};
++
++struct target_sigregs {
++	struct target_mcontext	mctx;		/* all the register values */
++	/* Programs using the rs6000/xcoff abi can save up to 19 gp regs
++	   and 18 fp regs below sp before decrementing it. */
++	int		abigap[56];
++};
++
++struct target_sigcontext {
++	target_ulong   _unused[4];
++	uint32_t       signal;
++	target_ulong   handler;
++	target_ulong   oldmask;
++	struct target_pt_regs *regs;
++};
++
++#define __SIGNAL_FRAMESIZE	64
++
++static int
++save_user_regs(CPUState *env, struct target_mcontext *frame, int sigret)
++{
++	/* save general and floating-point registers */
++#if 0 /* FIXME: handle floating-point, Altivec, SPE */
++	CHECK_FULL_REGS(regs);
++	preempt_disable();
++	if (regs->msr & MSR_FP)
++		giveup_fpu(current);
++#ifdef CONFIG_ALTIVEC
++	if (current->thread.used_vr && (regs->msr & MSR_VEC))
++		giveup_altivec(current);
++#endif /* CONFIG_ALTIVEC */
++#ifdef CONFIG_SPE
++	if (current->thread.used_spe && (regs->msr & MSR_SPE))
++		giveup_spe(current);
++#endif /* CONFIG_ALTIVEC */
++	preempt_enable();
++#endif /* 0 */
++
++	/* Note: this needs to be in the same order as target_pt_regs */
++	if(!memcpy(&frame->mc_gregs, env->gpr,
++	                  32*sizeof(target_elf_greg_t))
++	   || __put_user(env->nip, &frame->mc_gregs[32])
++	   || __put_user(do_load_msr(env), &frame->mc_gregs[33])
++	   /* FIXME: || __put_user(orig_gpr3, &frame->mc_gregs[34]) */
++	   || __put_user(env->ctr, &frame->mc_gregs[35])
++	   || __put_user(env->lr, &frame->mc_gregs[36])
++	   || __put_user(do_load_xer(env), &frame->mc_gregs[37])
++	   || __put_user(do_load_cr(env), &frame->mc_gregs[38])
++	   || __put_user(env->spr[SPR_MQ], &frame->mc_gregs[39])
++	   /* FIXME: || __put_user(trap, &frame->mc_gregs[40]) */
++	   || __put_user(env->spr[SPR_DAR], &frame->mc_gregs[41])
++	   || __put_user(env->spr[SPR_DSISR], &frame->mc_gregs[42])
++	   /* FIXME: || __put_user(result, &frame->mc_gregs[43]) */)
++		return 1;
++
++	if(!memcpy(&frame->mc_fregs, env->fpr,
++	                  32*sizeof(target_elf_fpreg_t))
++	   || __put_user(do_load_fpscr(env), &frame->mc_fregs[32]))
++
++	do_store_fpscr(env, 0, 0xFF); /* turn off all fp exceptions */
++
++#if 0 /* FIXME: handle Altivec, SPE */
++#ifdef CONFIG_ALTIVEC
++	/* save altivec registers */
++	if (current->thread.used_vr) {
++		if (!memcpy(&frame->mc_vregs, current->thread.vr,
++				   ELF_NVRREG * sizeof(vector128)))
++			return 1;
++		/* set MSR_VEC in the saved MSR value to indicate that
++		   frame->mc_vregs contains valid data */
++		if (__put_user(regs->msr | MSR_VEC, &frame->mc_gregs[PT_MSR]))
++			return 1;
++	}
++	/* else assert((regs->msr & MSR_VEC) == 0) */
++
++	/* We always copy to/from vrsave, it's 0 if we don't have or don't
++	 * use altivec. Since VSCR only contains 32 bits saved in the least
++	 * significant bits of a vector, we "cheat" and stuff VRSAVE in the
++	 * most significant bits of that same vector. --BenH
++	 */
++	if (__put_user(current->thread.vrsave, (u32 __user *)&frame->mc_vregs[32]))
++		return 1;
++#endif /* CONFIG_ALTIVEC */
++
++#ifdef CONFIG_SPE
++	/* save spe registers */
++	if (current->thread.used_spe) {
++		if (!memcpy(&frame->mc_vregs, current->thread.evr,
++				   ELF_NEVRREG * sizeof(u32)))
++			return 1;
++		/* set MSR_SPE in the saved MSR value to indicate that
++		   frame->mc_vregs contains valid data */
++		if (__put_user(regs->msr | MSR_SPE, &frame->mc_gregs[PT_MSR]))
++			return 1;
++	}
++	/* else assert((regs->msr & MSR_SPE) == 0) */
++
++	/* We always copy to/from spefscr */
++	if (__put_user(current->thread.spefscr, (u32 *)&frame->mc_vregs + ELF_NEVRREG))
++		return 1;
++#endif /* CONFIG_SPE */
++#endif /* 0 */
++
++	if (sigret) {
++		/* Set up the sigreturn trampoline: li r0,sigret; sc */
++		if (__put_user(0x38000000UL + sigret, &frame->tramp[0])
++		    || __put_user(0x44000002UL, &frame->tramp[1]))
++			return 1;
++#if 0
++		flush_icache_range((unsigned long) &frame->tramp[0],
++				   (unsigned long) &frame->tramp[2]);
++#endif
++	}
++
++	return 0;
++}
++
++static int
++restore_user_regs(CPUState *env, struct target_mcontext *sr, int sig)
++{
++	target_ulong save_r2 = 0;
++	target_ulong saved_xer;
++	target_ulong saved_cr;
++	double saved_fpscr;
++
++#if 0 /* FIXME: handle Altivec, SPE */
++#if defined(CONFIG_ALTIVEC) || defined(CONFIG_SPE)
++	unsigned long msr;
++#endif
++#endif /* 0 */
++
++	/* backup/restore the TLS as we don't want it to be modified */
++	if (!sig)
++		save_r2 = env->gpr[2];
++
++	/* Copy all registers except MSR */
++	/* Note: this needs to be in the same order as target_pt_regs */
++	if(!memcpy(env->gpr, &sr->mc_gregs,
++	                    32*sizeof(target_elf_greg_t))
++	   || __get_user(env->nip, &sr->mc_gregs[32])
++	   /* FIXME: || __get_user(orig_gpr3, &sr->mc_gregs[34]) */
++	   || __get_user(env->ctr, &sr->mc_gregs[35])
++	   || __get_user(env->lr, &sr->mc_gregs[36])
++	   || __get_user(saved_xer, &sr->mc_gregs[37])
++	   || __get_user(saved_cr, &sr->mc_gregs[38])
++	   || __get_user(env->spr[SPR_MQ], &sr->mc_gregs[39])
++	   /* FIXME: || __get_user(trap, &sr->mc_gregs[40]) */
++	   || __get_user(env->spr[SPR_DAR], &sr->mc_gregs[41])
++	   || __get_user(env->spr[SPR_DSISR], &sr->mc_gregs[42])
++	   /* FIXME: || __get_user(result, &sr->mc_gregs[43]) */)
++		return 1;
++	do_store_xer(env, saved_xer);
++	do_store_cr(env, saved_cr, 0xFF);
++
++	if (!sig)
++		env->gpr[2] = save_r2;
++
++	/* The kernel delays restoring the floating-point registers until the
++	 * thread uses floating-point again.  For simplicity, just restore the
++	 * registers now. */
++	if(!memcpy(env->fpr, &sr->mc_fregs,
++	                    32*sizeof(target_elf_fpreg_t))
++	   || __get_user(saved_fpscr, &sr->mc_fregs[32]))
++		return 1;
++	do_store_fpscr(env, saved_fpscr, 0xFF);
++
++#if 0 /* FIXME: handle Altivec, SPE */
++#ifdef CONFIG_ALTIVEC
++	/* force the process to reload the altivec registers from
++	   current->thread when it next does altivec instructions */
++	regs->msr &= ~MSR_VEC;
++	if (!__get_user(msr, &sr->mc_gregs[PT_MSR]) && (msr & MSR_VEC) != 0) {
++		/* restore altivec registers from the stack */
++		if (!memcpy(current->thread.vr, &sr->mc_vregs,
++				     sizeof(sr->mc_vregs)))
++			return 1;
++	} else if (current->thread.used_vr)
++		memset(&current->thread.vr, 0, ELF_NVRREG * sizeof(vector128));
++
++	/* Always get VRSAVE back */
++	if (__get_user(current->thread.vrsave, (u32 __user *)&sr->mc_vregs[32]))
++		return 1;
++#endif /* CONFIG_ALTIVEC */
++
++#ifdef CONFIG_SPE
++	/* force the process to reload the spe registers from
++	   current->thread when it next does spe instructions */
++	regs->msr &= ~MSR_SPE;
++	if (!__get_user(msr, &sr->mc_gregs[PT_MSR]) && (msr & MSR_SPE) != 0) {
++		/* restore spe registers from the stack */
++		if (!memcpy(current->thread.evr, &sr->mc_vregs,
++				     ELF_NEVRREG * sizeof(u32)))
++			return 1;
++	} else if (current->thread.used_spe)
++		memset(&current->thread.evr, 0, ELF_NEVRREG * sizeof(u32));
++
++	/* Always get SPEFSCR back */
++	if (__get_user(current->thread.spefscr, (u32 *)&sr->mc_vregs + ELF_NEVRREG))
++		return 1;
++#endif /* CONFIG_SPE */
++#endif /* 0 */
++
++#if 0 /* FIXME: handle floating-point, Altivec, SPE */
++#ifndef CONFIG_SMP
++	preempt_disable();
++	if (last_task_used_math == current)
++		last_task_used_math = NULL;
++	if (last_task_used_altivec == current)
++		last_task_used_altivec = NULL;
++	if (last_task_used_spe == current)
++		last_task_used_spe = NULL;
++	preempt_enable();
++#endif
++#endif /* 0 */
++	return 0;
++}
++
++static void setup_frame(int sig, struct emulated_sigaction *ka,
++                        target_sigset_t *oldset, CPUState *env)
++{
++	struct target_sigcontext *sc;
++	struct target_sigregs *frame;
++	target_ulong origsp = env->gpr[1];
++	target_ulong newsp = origsp;
++
++	/* Set up Signal Frame */
++	newsp -= sizeof(struct target_sigregs);
++	frame = (struct target_sigregs *) newsp;
++
++	/* Put a sigcontext on the stack */
++	newsp -= sizeof(*sc);
++	sc = (struct target_sigcontext *) newsp;
++
++	/* create a stack frame for the caller of the handler */
++	newsp -= __SIGNAL_FRAMESIZE;
++
++	if (!access_ok(VERIFY_WRITE, (void *) newsp, origsp - newsp))
++		goto badframe;
++
++#if TARGET_NSIG != 64
++#error "Please adjust handle_signal()"
++#endif
++	if (__put_user((target_ulong) ka->sa._sa_handler, &sc->handler)
++	    || __put_user(oldset->sig[0], &sc->oldmask)
++	    || __put_user(oldset->sig[1], &sc->_unused[3])
++	    || __put_user(frame, (target_ulong *)&sc->regs)
++	    || __put_user(sig, &sc->signal))
++		goto badframe;
++
++	if (save_user_regs(env, &frame->mctx, TARGET_NR_sigreturn))
++		goto badframe;
++
++	if (put_user(env->gpr[1], (unsigned long *)newsp))
++		goto badframe;
++	env->gpr[1] = newsp;
++	env->gpr[3] = sig;
++	env->gpr[4] = (unsigned long) sc;
++	env->nip = (unsigned long) ka->sa._sa_handler;
++	env->lr = (unsigned long) frame->mctx.tramp;
++	/* FIXME: env->trap = 0; */
++
++	return;
++
++badframe:
++#ifdef DEBUG_SIGNAL
++	fprintf(stderr,
++		"badframe in handle_signal, frame=%p newsp=%lx\n",
++		frame, newsp);
++#endif
++	force_sig(TARGET_SIGSEGV);
++}
++
++static void setup_rt_frame(int sig, struct emulated_sigaction *ka, 
++                           target_siginfo_t *info,
++                           target_sigset_t *set, CPUState *env)
++{
++    fprintf(stderr, "setup_rt_frame: not implemented\n");
++}
++
++long do_sigreturn(CPUState *env)
++{
++	struct target_sigcontext *sc;
++	struct target_sigcontext sigctx;
++	struct target_mcontext *sr;
++	target_sigset_t set;
++	sigset_t host_set;
++
++	/* Always make any pending restarted system calls return -EINTR */
++#if 0 /* FIXME */
++	current_thread_info()->restart_block.fn = do_no_restart_syscall;
++#endif
++
++	sc = (struct target_sigcontext *)(env->gpr[1] + __SIGNAL_FRAMESIZE);
++	if (!memcpy(&sigctx, sc, sizeof(sigctx)))
++		goto badframe;
++
++	set.sig[0] = sigctx.oldmask;
++	set.sig[1] = sigctx._unused[3];
++	target_to_host_sigset_internal(&host_set, &set);
++	sigprocmask(SIG_SETMASK, &host_set, NULL);
++
++	sr = (struct target_mcontext *) tswapl((target_ulong)sigctx.regs);
++	if (!access_ok(VERIFY_READ, sr, sizeof(*sr))
++	    || restore_user_regs(env, sr, 1))
++		goto badframe;
++
++	return 0;
++
++badframe:
++	force_sig(TARGET_SIGSEGV);
++	return 0;
++}
++
++long do_rt_sigreturn(CPUState *env)
++{
++    fprintf(stderr, "do_rt_sigreturn: not implemented\n");
++    return -ENOSYS;
++}
++
+ #else
+ 
+ static void setup_frame(int sig, struct emulated_sigaction *ka,
diff --git a/meta/packages/qemu/files/22_net_tuntap_stall.patch b/meta/packages/qemu/files/22_net_tuntap_stall.patch
new file mode 100644
index 000000000..e9b31dfe4
--- /dev/null
+++ b/meta/packages/qemu/files/22_net_tuntap_stall.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=0
+---
+# vl.c |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: vl.c
+===================================================================
+--- vl.c.orig	2007-06-13 11:51:53.000000000 +0100
++++ vl.c	2007-06-13 11:52:10.000000000 +0100
+@@ -3617,7 +3617,7 @@ static int tap_open(char *ifname, int if
+         return -1;
+     }
+     memset(&ifr, 0, sizeof(ifr));
+-    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
++    ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE;
+     if (ifname[0] != '\0')
+         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
+     else
diff --git a/meta/packages/qemu/files/30_syscall_ipc.patch b/meta/packages/qemu/files/30_syscall_ipc.patch
new file mode 100644
index 000000000..3dc58102a
--- /dev/null
+++ b/meta/packages/qemu/files/30_syscall_ipc.patch
@@ -0,0 +1,34 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |    7 +++++--
+# 1 file changed, 5 insertions(+), 2 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-04-18 13:25:40.000000000 +0100
++++ linux-user/syscall.c	2007-04-18 13:37:27.000000000 +0100
+@@ -43,7 +43,10 @@
+ #include <sys/poll.h>
+ #include <sys/times.h>
+ #include <sys/shm.h>
++#include <sys/ipc.h>
+ #include <sys/sem.h>
++#include <sys/shm.h>
++#include <sys/msg.h>
+ #include <sys/statfs.h>
+ #include <utime.h>
+ #include <sys/sysinfo.h>
+@@ -1240,11 +1243,11 @@ static long do_ipc(long call, long first
+             ret = get_errno(shmctl(first, second, NULL));
+             break;
+         default:
+-            goto unimplemented;
++            ret = get_errno(shmctl(first, second, (struct shmid_ds *) ptr));
++            break;
+         }
+         break;
+     default:
+-    unimplemented:
+ 	gemu_log("Unsupported ipc call: %ld (version %d)\n", call, version);
+ 	ret = -ENOSYS;
+ 	break;
diff --git a/meta/packages/qemu/files/31_syscalls.patch b/meta/packages/qemu/files/31_syscalls.patch
new file mode 100644
index 000000000..e7a1b338f
--- /dev/null
+++ b/meta/packages/qemu/files/31_syscalls.patch
@@ -0,0 +1,62 @@
+#DPATCHLEVEL=0
+---
+# Makefile.target      |    2 +-
+# linux-user/syscall.c |   11 ++++++++---
+# 2 files changed, 9 insertions(+), 4 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ linux-user/syscall.c	2007-06-13 11:52:18.000000000 +0100
+@@ -180,6 +180,7 @@ extern int getresuid(uid_t *, uid_t *, u
+ extern int setresgid(gid_t, gid_t, gid_t);
+ extern int getresgid(gid_t *, gid_t *, gid_t *);
+ extern int setgroups(int, gid_t *);
++extern int uselib(const char*);
+ 
+ /*
+  * This list is the union of errno values overidden in asm-<arch>/errno.h
+@@ -3215,7 +3216,8 @@ long do_syscall(void *cpu_env, int num, 
+         break;
+ #ifdef TARGET_NR_uselib
+     case TARGET_NR_uselib:
+-        goto unimplemented;
++        ret = get_errno(uselib(path((const char*)arg1)));
++        break;
+ #endif
+ #ifdef TARGET_NR_swapon
+     case TARGET_NR_swapon:
+@@ -4405,7 +4407,9 @@ long do_syscall(void *cpu_env, int num, 
+         goto unimplemented;
+ #ifdef TARGET_NR_mincore
+     case TARGET_NR_mincore:
+-        goto unimplemented;
++        page_unprotect_range((void*)arg3, ((size_t)arg2 + TARGET_PAGE_SIZE - 1) / TARGET_PAGE_SIZE);
++        ret = get_errno(mincore((void*)arg1, (size_t)arg2, (unsigned char*)arg3));
++        break;
+ #endif
+ #ifdef TARGET_NR_madvise
+     case TARGET_NR_madvise:
+@@ -4539,7 +4543,8 @@ long do_syscall(void *cpu_env, int num, 
+         break;
+ #ifdef TARGET_NR_readahead
+     case TARGET_NR_readahead:
+-        goto unimplemented;
++        ret = get_errno(readahead((int)arg1, (off64_t)arg2, (size_t)arg3));
++        break;
+ #endif
+ #ifdef TARGET_NR_setxattr
+     case TARGET_NR_setxattr:
+Index: Makefile.target
+===================================================================
+--- Makefile.target.orig	2007-06-13 11:51:52.000000000 +0100
++++ Makefile.target	2007-06-13 11:51:54.000000000 +0100
+@@ -215,7 +215,7 @@ OP_LDFLAGS+=$(OS_LDFLAGS) $(ARCH_LDFLAGS
+ #########################################################
+ 
+ CPPFLAGS+=-D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE
+-LIBS+=-lm
++LIBS+=-lm -lrt
+ ifndef CONFIG_USER_ONLY
+ LIBS+=-lz
+ endif
diff --git a/meta/packages/qemu/files/32_syscall_sysctl.patch b/meta/packages/qemu/files/32_syscall_sysctl.patch
new file mode 100644
index 000000000..d175cf96b
--- /dev/null
+++ b/meta/packages/qemu/files/32_syscall_sysctl.patch
@@ -0,0 +1,56 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |   33 ++++++++++++++++++++++++++++++---
+# 1 file changed, 30 insertions(+), 3 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-06-13 11:51:54.000000000 +0100
++++ linux-user/syscall.c	2007-06-13 11:52:17.000000000 +0100
+@@ -52,6 +52,7 @@
+ //#include <sys/user.h>
+ #include <netinet/ip.h>
+ #include <netinet/tcp.h>
++#include <sys/sysctl.h>
+ 
+ #define termios host_termios
+ #define winsize host_winsize
+@@ -3912,9 +3913,35 @@ long do_syscall(void *cpu_env, int num, 
+         break;
+ #endif
+     case TARGET_NR__sysctl:
+-        /* We don't implement this, but ENODIR is always a safe
+-           return value. */
+-        return -ENOTDIR;
++        {
++            struct __sysctl_args *args = (struct __sysctl_args *) arg1;
++            int *name_target, *name, nlen, *oldlenp, oldlen, newlen, i;
++            void *oldval, *newval;
++
++            name_target = (int *) tswapl((long) args->name);
++            nlen = tswapl(args->nlen);
++            oldval = (void *) tswapl((long) args->oldval);
++            oldlenp = (int *) tswapl((long) args->oldlenp);
++            oldlen = tswapl(*oldlenp);
++            newval = (void *) tswapl((long) args->newval);
++            newlen = tswapl(args->newlen);
++
++            name = alloca(nlen * sizeof (int));
++            for (i = 0; i < nlen; i++)
++                name[i] = tswapl(name_target[i]);
++
++            if (nlen == 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION) {
++                ret = get_errno(
++                        sysctl(name, nlen, oldval, &oldlen, newval, newlen));
++                if (!is_error(ret)) {
++                    *oldlenp = tswapl(oldlen);
++                }
++            } else {
++                gemu_log("qemu: Unsupported sysctl name\n");
++                ret = -ENOSYS;
++            }
++        }
++        break;
+     case TARGET_NR_sched_setparam:
+         {
+             struct sched_param *target_schp;
diff --git a/meta/packages/qemu/files/33_syscall_ppc_clone.patch b/meta/packages/qemu/files/33_syscall_ppc_clone.patch
new file mode 100644
index 000000000..a71f8b194
--- /dev/null
+++ b/meta/packages/qemu/files/33_syscall_ppc_clone.patch
@@ -0,0 +1,22 @@
+#DPATCHLEVEL=0
+---
+# linux-user/syscall.c |    6 +-----
+# 1 file changed, 1 insertion(+), 5 deletions(-)
+#
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-06-13 11:51:54.000000000 +0100
++++ linux-user/syscall.c	2007-06-13 11:52:17.000000000 +0100
+@@ -2177,11 +2177,7 @@ int do_fork(CPUState *env, unsigned int 
+         if (!newsp)
+             newsp = env->gpr[1];
+         new_env->gpr[1] = newsp;
+-        { 
+-            int i;
+-            for (i = 7; i < 32; i++)
+-                new_env->gpr[i] = 0;
+-        }
++        new_env->gpr[3] = 0;
+ #elif defined(TARGET_SH4)
+ 	if (!newsp)
+ 	  newsp = env->gregs[15];
diff --git a/meta/packages/qemu/files/39_syscall_fadvise64.patch b/meta/packages/qemu/files/39_syscall_fadvise64.patch
new file mode 100644
index 000000000..0a7f4c48d
--- /dev/null
+++ b/meta/packages/qemu/files/39_syscall_fadvise64.patch
@@ -0,0 +1,21 @@
+---
+ linux-user/syscall.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Index: linux-user/syscall.c
+===================================================================
+--- linux-user/syscall.c.orig	2007-06-13 11:51:55.000000000 +0100
++++ linux-user/syscall.c	2007-06-13 11:52:13.000000000 +0100
+@@ -4434,6 +4434,12 @@ long do_syscall(void *cpu_env, int num, 
+         ret = get_errno(mincore((void*)arg1, (size_t)arg2, (unsigned char*)arg3));
+         break;
+ #endif
++#ifdef TARGET_NR_fadvise64_64
++     case TARGET_NR_fadvise64_64:
++        /* Just return success */
++        ret = get_errno(0);
++        break;
++#endif
+ #ifdef TARGET_NR_madvise
+     case TARGET_NR_madvise:
+         /* A straight passthrough may not be safe because qemu sometimes
diff --git a/meta/packages/qemu/files/41_arm_fpa_sigfpe.patch b/meta/packages/qemu/files/41_arm_fpa_sigfpe.patch
new file mode 100644
index 000000000..d579dbc66
--- /dev/null
+++ b/meta/packages/qemu/files/41_arm_fpa_sigfpe.patch
@@ -0,0 +1,105 @@
+#DPATCHLEVEL=0
+---
+# linux-user/main.c        |   53 +++++++++++++++++++++++++++++++++++++++++++++--
+# target-arm/nwfpe/fpa11.c |    7 ++++++
+# 2 files changed, 58 insertions(+), 2 deletions(-)
+#
+Index: linux-user/main.c
+===================================================================
+--- linux-user/main.c.orig	2007-06-13 11:51:53.000000000 +0100
++++ linux-user/main.c	2007-06-13 11:52:07.000000000 +0100
+@@ -339,18 +339,67 @@ void cpu_loop(CPUARMState *env)
+             {
+                 TaskState *ts = env->opaque;
+                 uint32_t opcode;
++                int rc;
+ 
+                 /* we handle the FPU emulation here, as Linux */
+                 /* we get the opcode */
+                 opcode = tget32(env->regs[15]);
+                 
+-                if (EmulateAll(opcode, &ts->fpa, env) == 0) {
++                rc = EmulateAll(opcode, &ts->fpa, env);
++                if (rc == 0) { /* illegal instruction */
+                     info.si_signo = SIGILL;
+                     info.si_errno = 0;
+                     info.si_code = TARGET_ILL_ILLOPN;
+                     info._sifields._sigfault._addr = env->regs[15];
+                     queue_signal(info.si_signo, &info);
+-                } else {
++                } else if (rc < 0) { /* FP exception */
++                    int arm_fpe=0;
++
++                    /* translate softfloat flags to FPSR flags */
++                    if (-rc & float_flag_invalid)
++                      arm_fpe |= BIT_IOC;
++                    if (-rc & float_flag_divbyzero)
++                      arm_fpe |= BIT_DZC;
++                    if (-rc & float_flag_overflow)
++                      arm_fpe |= BIT_OFC;
++                    if (-rc & float_flag_underflow)
++                      arm_fpe |= BIT_UFC;
++                    if (-rc & float_flag_inexact)
++                      arm_fpe |= BIT_IXC;
++
++                    FPSR fpsr = ts->fpa.fpsr;
++                    //printf("fpsr 0x%x, arm_fpe 0x%x\n",fpsr,arm_fpe);
++
++                    if (fpsr & (arm_fpe << 16)) { /* exception enabled? */
++                      info.si_signo = SIGFPE;
++                      info.si_errno = 0;
++
++                      /* ordered by priority, least first */
++                      if (arm_fpe & BIT_IXC) info.si_code = TARGET_FPE_FLTRES;
++                      if (arm_fpe & BIT_UFC) info.si_code = TARGET_FPE_FLTUND;
++                      if (arm_fpe & BIT_OFC) info.si_code = TARGET_FPE_FLTOVF;
++                      if (arm_fpe & BIT_DZC) info.si_code = TARGET_FPE_FLTDIV;
++                      if (arm_fpe & BIT_IOC) info.si_code = TARGET_FPE_FLTINV;
++
++                      info._sifields._sigfault._addr = env->regs[15];
++                      queue_signal(info.si_signo, &info);
++                    } else {
++                      env->regs[15] += 4;
++                    }
++
++                    /* accumulate unenabled exceptions */
++                    if ((!(fpsr & BIT_IXE)) && (arm_fpe & BIT_IXC))
++                      fpsr |= BIT_IXC;
++                    if ((!(fpsr & BIT_UFE)) && (arm_fpe & BIT_UFC))
++                      fpsr |= BIT_UFC;
++                    if ((!(fpsr & BIT_OFE)) && (arm_fpe & BIT_OFC))
++                      fpsr |= BIT_OFC;
++                    if ((!(fpsr & BIT_DZE)) && (arm_fpe & BIT_DZC))
++                      fpsr |= BIT_DZC;
++                    if ((!(fpsr & BIT_IOE)) && (arm_fpe & BIT_IOC))
++                      fpsr |= BIT_IOC;
++                    ts->fpa.fpsr=fpsr;
++                } else { /* everything OK */
+                     /* increment PC */
+                     env->regs[15] += 4;
+                 }
+Index: target-arm/nwfpe/fpa11.c
+===================================================================
+--- target-arm/nwfpe/fpa11.c.orig	2007-06-13 11:51:52.000000000 +0100
++++ target-arm/nwfpe/fpa11.c	2007-06-13 11:51:55.000000000 +0100
+@@ -162,6 +162,8 @@ unsigned int EmulateAll(unsigned int opc
+     fpa11->initflag = 1;
+   }
+ 
++  set_float_exception_flags(0, &fpa11->fp_status);  
++
+   if (TEST_OPCODE(opcode,MASK_CPRT))
+   {
+     //fprintf(stderr,"emulating CPRT\n");
+@@ -191,6 +193,11 @@ unsigned int EmulateAll(unsigned int opc
+   }
+ 
+ //  restore_flags(flags);
++  if(nRc == 1 && get_float_exception_flags(&fpa11->fp_status))
++  {
++    //printf("fef 0x%x\n",float_exception_flags);
++    nRc=-get_float_exception_flags(&fpa11->fp_status);
++  }
+ 
+   //printf("returning %d\n",nRc);
+   return(nRc);
diff --git a/meta/packages/qemu/files/52_ne2000_return.patch b/meta/packages/qemu/files/52_ne2000_return.patch
new file mode 100644
index 000000000..f0316c804
--- /dev/null
+++ b/meta/packages/qemu/files/52_ne2000_return.patch
@@ -0,0 +1,17 @@
+---
+ hw/ne2000.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: qemu/hw/ne2000.c
+===================================================================
+--- qemu.orig/hw/ne2000.c	2007-06-13 11:51:52.000000000 +0100
++++ qemu/hw/ne2000.c	2007-06-13 11:51:55.000000000 +0100
+@@ -214,7 +214,7 @@ static int ne2000_can_receive(void *opaq
+     NE2000State *s = opaque;
+     
+     if (s->cmd & E8390_STOP)
+-        return 1;
++        return 0;
+     return !ne2000_buffer_full(s);
+ }
+ 
diff --git a/meta/packages/qemu/files/61_safe_64bit_int.patch b/meta/packages/qemu/files/61_safe_64bit_int.patch
new file mode 100644
index 000000000..553e57623
--- /dev/null
+++ b/meta/packages/qemu/files/61_safe_64bit_int.patch
@@ -0,0 +1,27 @@
+#DPATCHLEVEL=0
+---
+# dyngen-exec.h |    4 ++--
+# 1 file changed, 2 insertions(+), 2 deletions(-)
+#
+Index: dyngen-exec.h
+===================================================================
+--- dyngen-exec.h.orig	2007-06-13 11:48:22.000000000 +0100
++++ dyngen-exec.h	2007-06-13 11:51:55.000000000 +0100
+@@ -38,7 +38,7 @@ typedef unsigned int uint32_t;
+ // Linux/Sparc64 defines uint64_t
+ #if !(defined (__sparc_v9__) && defined(__linux__))
+ /* XXX may be done for all 64 bits targets ? */
+-#if defined (__x86_64__) || defined(__ia64)
++#if defined (__x86_64__) || defined(__ia64) || defined(__alpha__) || defined(__sparc__)
+ typedef unsigned long uint64_t;
+ #else
+ typedef unsigned long long uint64_t;
+@@ -55,7 +55,7 @@ typedef signed short int16_t;
+ typedef signed int int32_t;
+ // Linux/Sparc64 defines int64_t
+ #if !(defined (__sparc_v9__) && defined(__linux__))
+-#if defined (__x86_64__) || defined(__ia64)
++#if defined (__x86_64__) || defined(__ia64) || defined(__alpha__) || defined(__sparc__)
+ typedef signed long int64_t;
+ #else
+ typedef signed long long int64_t;
diff --git a/meta/packages/qemu/files/63_sparc_build.patch b/meta/packages/qemu/files/63_sparc_build.patch
new file mode 100644
index 000000000..32a6bc0ee
--- /dev/null
+++ b/meta/packages/qemu/files/63_sparc_build.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=0
+---
+# sparc.ld |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: sparc.ld
+===================================================================
+--- sparc.ld.orig	2007-06-13 11:48:22.000000000 +0100
++++ sparc.ld	2007-06-13 11:51:56.000000000 +0100
+@@ -6,7 +6,7 @@ ENTRY(_start)
+ SECTIONS
+ {
+   /* Read-only sections, merged into text segment: */
+-  . = 0x60000000 + SIZEOF_HEADERS;
++  . = 0x60000000 + 0x400;
+   .interp     : { *(.interp) 	}
+   .hash          : { *(.hash)		}
+   .dynsym        : { *(.dynsym)		}
diff --git a/meta/packages/qemu/files/64_ppc_asm_constraints.patch b/meta/packages/qemu/files/64_ppc_asm_constraints.patch
new file mode 100644
index 000000000..e4858b79d
--- /dev/null
+++ b/meta/packages/qemu/files/64_ppc_asm_constraints.patch
@@ -0,0 +1,18 @@
+#DPATCHLEVEL=1
+---
+# cpu-all.h |    2 +-
+# 1 file changed, 1 insertion(+), 1 deletion(-)
+#
+Index: qemu/cpu-all.h
+===================================================================
+--- qemu.orig/cpu-all.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/cpu-all.h	2007-06-13 11:51:56.000000000 +0100
+@@ -250,7 +250,7 @@ static inline void stw_le_p(void *ptr, i
+ static inline void stl_le_p(void *ptr, int v)
+ {
+ #ifdef __powerpc__
+-    __asm__ __volatile__ ("stwbrx %1,0,%2" : "=m" (*(uint32_t *)ptr) : "r" (v), "r" (ptr));
++    __asm__ __volatile__ ("stwbrx %0,0,%1" : : "r" (v), "r" (ptr) : "memory");
+ #else
+     uint8_t *p = ptr;
+     p[0] = v;
diff --git a/meta/packages/qemu/files/65_kfreebsd.patch b/meta/packages/qemu/files/65_kfreebsd.patch
new file mode 100644
index 000000000..ea060811a
--- /dev/null
+++ b/meta/packages/qemu/files/65_kfreebsd.patch
@@ -0,0 +1,44 @@
+---
+ configure |    6 ++++++
+ vl.c      |    4 +++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+Index: configure
+===================================================================
+--- configure.orig	2007-06-13 11:48:22.000000000 +0100
++++ configure	2007-06-13 11:52:07.000000000 +0100
+@@ -112,6 +112,12 @@ OS_CFLAGS="-mno-cygwin"
+ MINGW32*)
+ mingw32="yes"
+ ;;
++GNU/kFreeBSD)
++oss="yes"
++if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
++    kqemu="yes"
++fi
++;;
+ FreeBSD)
+ bsd="yes"
+ oss="yes"
+Index: vl.c
+===================================================================
+--- vl.c.orig	2007-06-13 11:51:54.000000000 +0100
++++ vl.c	2007-06-13 11:51:56.000000000 +0100
+@@ -47,6 +47,8 @@
+ #ifndef __APPLE__
+ #include <libutil.h>
+ #endif
++#elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
++#include <freebsd/stdlib.h>
+ #else
+ #ifndef __sun__
+ #include <linux/if.h>
+@@ -3454,7 +3456,7 @@ static TAPState *net_tap_fd_init(VLANSta
+     return s;
+ }
+ 
+-#ifdef _BSD
++#if defined (_BSD) || defined (__FreeBSD_kernel__)
+ static int tap_open(char *ifname, int ifname_size)
+ {
+     int fd;
diff --git a/meta/packages/qemu/files/66_tls_ld.patch b/meta/packages/qemu/files/66_tls_ld.patch
new file mode 100644
index 000000000..54e02eff8
--- /dev/null
+++ b/meta/packages/qemu/files/66_tls_ld.patch
@@ -0,0 +1,55 @@
+---
+ arm.ld  |    7 +++++++
+ i386.ld |    7 +++++++
+ 2 files changed, 14 insertions(+)
+
+Index: arm.ld
+===================================================================
+--- arm.ld.orig	2007-06-13 11:48:22.000000000 +0100
++++ arm.ld	2007-06-13 11:51:56.000000000 +0100
+@@ -26,6 +26,10 @@ SECTIONS
+     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
+   .rela.rodata   :
+     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
++  .rel.tdata     : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
++  .rela.tdata    : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
++  .rel.tbss      : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
++  .rela.tbss     : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+   .rel.got       : { *(.rel.got)		}
+   .rela.got      : { *(.rela.got)		}
+   .rel.ctors     : { *(.rel.ctors)	}
+@@ -58,6 +62,9 @@ SECTIONS
+   .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
+    __exidx_end = .;
+   .reginfo : { *(.reginfo) }
++  /* Thread Local Storage sections  */
++  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
++  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+   /* Adjust the address for the data segment.  We want to adjust up to
+      the same address within the page on the next page up.  */
+   . = ALIGN(0x100000) + (. & (0x100000 - 1));
+Index: i386.ld
+===================================================================
+--- i386.ld.orig	2007-06-13 11:48:22.000000000 +0100
++++ i386.ld	2007-06-13 11:51:56.000000000 +0100
+@@ -28,6 +28,10 @@ SECTIONS
+     { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
+   .rela.rodata   :
+     { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
++  .rel.tdata     : { *(.rel.tdata .rel.tdata.* .rel.gnu.linkonce.td.*) }
++  .rela.tdata    : { *(.rela.tdata .rela.tdata.* .rela.gnu.linkonce.td.*) }
++  .rel.tbss      : { *(.rel.tbss .rel.tbss.* .rel.gnu.linkonce.tb.*) }
++  .rela.tbss     : { *(.rela.tbss .rela.tbss.* .rela.gnu.linkonce.tb.*) }
+   .rel.got       : { *(.rel.got)		}
+   .rela.got      : { *(.rela.got)		}
+   .rel.ctors     : { *(.rel.ctors)	}
+@@ -53,6 +57,9 @@ SECTIONS
+   _etext = .;
+   PROVIDE (etext = .);
+   .fini      : { *(.fini)    } =0x47ff041f
++  /* Thread Local Storage sections  */
++  .tdata	  : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
++  .tbss		  : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
+   . = ALIGN(32 / 8);
+   PROVIDE (__preinit_array_start = .);
+   .preinit_array     : { *(.preinit_array) }
diff --git a/meta/packages/qemu/files/qemu-sdl-cursor.patch b/meta/packages/qemu/files/91-oh-sdl-cursor.patch
index bd6a51a1f..5280a5bd4 100644
--- a/meta/packages/qemu/files/qemu-sdl-cursor.patch
+++ b/meta/packages/qemu/files/91-oh-sdl-cursor.patch
@@ -1,9 +1,14 @@
-Index: qemu/sdl.c
+=== modified file 'sdl.c'
+---
+ sdl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: sdl.c
 ===================================================================
---- qemu.orig/sdl.c	2006-10-02 17:06:12.000000000 +0100
-+++ qemu/sdl.c	2006-10-02 17:06:59.000000000 +0100
-@@ -287,7 +287,7 @@
- {
+--- sdl.c.orig	2007-06-13 11:48:22.000000000 +0100
++++ sdl.c	2007-06-13 11:51:56.000000000 +0100
+@@ -241,7 +241,7 @@ static void sdl_hide_cursor(void)
+ 
      if (kbd_mouse_is_absolute()) {
          SDL_ShowCursor(1);
 -        SDL_SetCursor(sdl_cursor_hidden);
diff --git a/meta/packages/qemu/files/pl110_rgb-r0.patch b/meta/packages/qemu/files/93-oh-pl110-rgb.patch
index 09e5898d3..4911ac131 100644
--- a/meta/packages/qemu/files/pl110_rgb-r0.patch
+++ b/meta/packages/qemu/files/93-oh-pl110-rgb.patch
@@ -1,7 +1,13 @@
-Index: qemu/hw/pl110.c
+=== modified file 'hw/pl110.c'
+---
+ hw/pl110.c          |   13 ++++--
+ hw/pl110_template.h |  107 ++++++++++++++++++++++++++++++++++++----------------
+ 2 files changed, 86 insertions(+), 34 deletions(-)
+
+Index: hw/pl110.c
 ===================================================================
---- qemu.orig/hw/pl110.c	2006-04-11 21:49:46.000000000 +0100
-+++ qemu/hw/pl110.c	2006-05-24 22:53:00.000000000 +0100
+--- hw/pl110.c.orig	2007-06-13 11:48:22.000000000 +0100
++++ hw/pl110.c	2007-06-13 11:51:57.000000000 +0100
 @@ -10,6 +10,7 @@
  #include "vl.h"
  
@@ -10,7 +16,7 @@ Index: qemu/hw/pl110.c
  #define PL110_CR_BEBO 0x200
  #define PL110_CR_BEPO 0x400
  #define PL110_CR_PWR  0x800
-@@ -115,6 +116,7 @@
+@@ -114,6 +115,7 @@ static void pl110_update_display(void *o
      int first, last = 0;
      int dirty, new_dirty;
      int i;
@@ -18,7 +24,7 @@ Index: qemu/hw/pl110.c
  
      if (!pl110_enabled(s))
          return;
-@@ -146,12 +148,17 @@
+@@ -145,12 +147,17 @@ static void pl110_update_display(void *o
          fprintf(stderr, "pl110: Bad color depth\n");
          exit(1);
      }
@@ -39,10 +45,10 @@ Index: qemu/hw/pl110.c
      
      src_width = s->cols;
      switch (s->bpp) {
-Index: qemu/hw/pl110_template.h
+Index: hw/pl110_template.h
 ===================================================================
---- qemu.orig/hw/pl110_template.h	2006-02-19 12:31:32.000000000 +0000
-+++ qemu/hw/pl110_template.h	2006-05-24 23:04:03.000000000 +0100
+--- hw/pl110_template.h.orig	2007-06-13 11:48:22.000000000 +0100
++++ hw/pl110_template.h	2007-06-13 11:51:57.000000000 +0100
 @@ -24,6 +24,16 @@
  #error unknown bit depth
  #endif
@@ -70,34 +76,32 @@ Index: qemu/hw/pl110_template.h
 -    glue(pl110_draw_line8_lblp,BITS),
 -    glue(pl110_draw_line16_lblp,BITS),
 -    glue(pl110_draw_line32_lblp,BITS),
--
--    glue(pl110_draw_line1_bbbp,BITS),
--    glue(pl110_draw_line2_bbbp,BITS),
--    glue(pl110_draw_line4_bbbp,BITS),
--    glue(pl110_draw_line8_bbbp,BITS),
--    glue(pl110_draw_line16_bbbp,BITS),
--    glue(pl110_draw_line32_bbbp,BITS),
--
--    glue(pl110_draw_line1_lbbp,BITS),
--    glue(pl110_draw_line2_lbbp,BITS),
--    glue(pl110_draw_line4_lbbp,BITS),
--    glue(pl110_draw_line8_lbbp,BITS),
--    glue(pl110_draw_line16_lbbp,BITS),
--    glue(pl110_draw_line32_lbbp,BITS)
 +    glue(pl110_draw_line1_lblp_bgr,BITS),
 +    glue(pl110_draw_line2_lblp_bgr,BITS),
 +    glue(pl110_draw_line4_lblp_bgr,BITS),
 +    glue(pl110_draw_line8_lblp_bgr,BITS),
 +    glue(pl110_draw_line16_lblp_bgr,BITS),
 +    glue(pl110_draw_line32_lblp_bgr,BITS),
-+
+ 
+-    glue(pl110_draw_line1_bbbp,BITS),
+-    glue(pl110_draw_line2_bbbp,BITS),
+-    glue(pl110_draw_line4_bbbp,BITS),
+-    glue(pl110_draw_line8_bbbp,BITS),
+-    glue(pl110_draw_line16_bbbp,BITS),
+-    glue(pl110_draw_line32_bbbp,BITS),
 +    glue(pl110_draw_line1_bbbp_bgr,BITS),
 +    glue(pl110_draw_line2_bbbp_bgr,BITS),
 +    glue(pl110_draw_line4_bbbp_bgr,BITS),
 +    glue(pl110_draw_line8_bbbp_bgr,BITS),
 +    glue(pl110_draw_line16_bbbp_bgr,BITS),
 +    glue(pl110_draw_line32_bbbp_bgr,BITS),
-+
+ 
+-    glue(pl110_draw_line1_lbbp,BITS),
+-    glue(pl110_draw_line2_lbbp,BITS),
+-    glue(pl110_draw_line4_lbbp,BITS),
+-    glue(pl110_draw_line8_lbbp,BITS),
+-    glue(pl110_draw_line16_lbbp,BITS),
+-    glue(pl110_draw_line32_lbbp,BITS)
 +    glue(pl110_draw_line1_lbbp_bgr,BITS),
 +    glue(pl110_draw_line2_lbbp_bgr,BITS),
 +    glue(pl110_draw_line4_lbbp_bgr,BITS),
@@ -128,7 +132,7 @@ Index: qemu/hw/pl110_template.h
  };
  
  #undef BITS
-@@ -61,18 +92,18 @@
+@@ -61,18 +92,18 @@ static drawfn glue(pl110_draw_fn_,BITS)[
  #else
  
  #if ORDER == 0
@@ -150,7 +154,7 @@ Index: qemu/hw/pl110_template.h
  #ifdef WORDS_BIGENDIAN
  #define SWAP_WORDS 1
  #endif
-@@ -195,27 +226,34 @@
+@@ -195,27 +226,34 @@ static void glue(pl110_draw_line16_,NAME
  #ifdef SWAP_WORDS
          data = bswap32(data);
  #endif
@@ -191,7 +195,7 @@ Index: qemu/hw/pl110_template.h
          data >>= 5;
          COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
          width -= 2;
-@@ -229,14 +267,21 @@
+@@ -229,14 +267,21 @@ static void glue(pl110_draw_line32_,NAME
      unsigned int r, g, b;
      while (width > 0) {
          data = *(uint32_t *)src;
diff --git a/meta/packages/qemu/files/arm_nptl.patch b/meta/packages/qemu/files/94-oh-arm-nptl.patch
index f9b10aebc..37d717198 100644
--- a/meta/packages/qemu/files/arm_nptl.patch
+++ b/meta/packages/qemu/files/94-oh-arm-nptl.patch
@@ -1,27 +1,41 @@
+---
+ configure                |   29 ++++++
+ exec-all.h               |  165 --------------------------------------
+ linux-user/arm/syscall.h |    4 
+ linux-user/main.c        |   94 ++++++++++++++++++---
+ linux-user/qemu.h        |    3 
+ linux-user/syscall.c     |   90 ++++++++++++++++++--
+ qemu_spinlock.h          |  204 +++++++++++++++++++++++++++++++++++++++++++++++
+ target-arm/cpu.h         |   19 ++++
+ target-arm/exec.h        |    2 
+ target-arm/op.c          |    6 +
+ target-arm/translate.c   |   10 ++
+ 11 files changed, 437 insertions(+), 189 deletions(-)
+
 Index: qemu/configure
 ===================================================================
---- qemu.orig/configure	2006-08-26 16:31:53.000000000 +0100
-+++ qemu/configure	2006-08-26 16:31:53.000000000 +0100
-@@ -97,6 +97,7 @@
+--- qemu.orig/configure	2007-06-13 11:51:56.000000000 +0100
++++ qemu/configure	2007-06-13 11:51:57.000000000 +0100
+@@ -101,6 +101,7 @@ linux_user="no"
+ darwin_user="no"
  build_docs="no"
- build_acpi_tables="no"
  uname_release=""
 +nptl="yes"
  
  # OS specific
  targetos=`uname -s`
-@@ -243,6 +244,8 @@
-   ;;
-   --enable-iasl) build_acpi_tables="yes"
+@@ -287,6 +288,8 @@ for opt do
+         *)     echo "undefined SPARC architecture. Exiting";exit 1;;
+       esac
    ;;
 +  --disable-nptl) nptl="no"
 +  ;;
    esac
  done
  
-@@ -441,6 +444,23 @@
-     fi
- fi
+@@ -530,6 +533,23 @@ int main(void) {
+ }
+ EOF
  
 +# check NPTL support
 +cat > $TMPC <<EOF
@@ -43,15 +57,15 @@ Index: qemu/configure
  ##########################################
  # SDL probe
  
-@@ -559,6 +579,7 @@
+@@ -681,6 +701,7 @@ if test -n "$sparc_cpu"; then
+     echo "Target Sparc Arch $sparc_cpu"
  fi
- echo "FMOD support      $fmod $fmod_support"
  echo "kqemu support     $kqemu"
 +echo "NPTL support      $nptl"
  echo "Documentation     $build_docs"
  [ ! -z "$uname_release" ] && \
  echo "uname -r          $uname_release"
-@@ -880,6 +901,14 @@
+@@ -1063,6 +1084,14 @@ if test "$target_user_only" = "no"; then
              echo "SDL_CFLAGS=`$sdl_config --cflags`" >> $config_mak
          fi
      fi
@@ -68,13 +82,13 @@ Index: qemu/configure
  if test "$cocoa" = "yes" ; then
 Index: qemu/exec-all.h
 ===================================================================
---- qemu.orig/exec-all.h	2006-08-26 16:28:32.000000000 +0100
-+++ qemu/exec-all.h	2006-08-26 16:31:53.000000000 +0100
-@@ -347,163 +347,7 @@
+--- qemu.orig/exec-all.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/exec-all.h	2007-06-13 11:51:57.000000000 +0100
+@@ -360,170 +360,7 @@ extern CPUWriteMemoryFunc *io_mem_write[
  extern CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
  extern void *io_mem_opaque[IO_MEM_NB_ENTRIES];
  
--#ifdef __powerpc__
+-#if defined(__powerpc__)
 -static inline int testandset (int *p)
 -{
 -    int ret;
@@ -90,9 +104,7 @@ Index: qemu/exec-all.h
 -                          : "cr0", "memory");
 -    return ret;
 -}
--#endif
--
--#ifdef __i386__
+-#elif defined(__i386__)
 -static inline int testandset (int *p)
 -{
 -    long int readval = 0;
@@ -103,9 +115,7 @@ Index: qemu/exec-all.h
 -                          : "cc");
 -    return readval;
 -}
--#endif
--
--#ifdef __x86_64__
+-#elif defined(__x86_64__)
 -static inline int testandset (int *p)
 -{
 -    long int readval = 0;
@@ -116,9 +126,7 @@ Index: qemu/exec-all.h
 -                          : "cc");
 -    return readval;
 -}
--#endif
--
--#ifdef __s390__
+-#elif defined(__s390__)
 -static inline int testandset (int *p)
 -{
 -    int ret;
@@ -130,9 +138,7 @@ Index: qemu/exec-all.h
 -			  : "cc", "memory" );
 -    return ret;
 -}
--#endif
--
--#ifdef __alpha__
+-#elif defined(__alpha__)
 -static inline int testandset (int *p)
 -{
 -    int ret;
@@ -149,9 +155,7 @@ Index: qemu/exec-all.h
 -			  : "m" (*p));
 -    return ret;
 -}
--#endif
--
--#ifdef __sparc__
+-#elif defined(__sparc__)
 -static inline int testandset (int *p)
 -{
 -	int ret;
@@ -163,9 +167,7 @@ Index: qemu/exec-all.h
 -
 -	return (ret ? 1 : 0);
 -}
--#endif
--
--#ifdef __arm__
+-#elif defined(__arm__)
 -static inline int testandset (int *spinlock)
 -{
 -    register unsigned int ret;
@@ -175,9 +177,7 @@ Index: qemu/exec-all.h
 -    
 -    return ret;
 -}
--#endif
--
--#ifdef __mc68000
+-#elif defined(__mc68000)
 -static inline int testandset (int *p)
 -{
 -    char ret;
@@ -187,15 +187,36 @@ Index: qemu/exec-all.h
 -                         : "cc","memory");
 -    return ret;
 -}
--#endif
+-#elif defined(__ia64)
 -
--#ifdef __ia64
 -#include <ia64intrin.h>
 -
 -static inline int testandset (int *p)
 -{
 -    return __sync_lock_test_and_set (p, 1);
 -}
+-#elif defined(__mips__)
+-static inline int testandset (int *p)
+-{
+-    int ret;
+-
+-    __asm__ __volatile__ (
+-	"	.set push		\n"
+-	"	.set noat		\n"
+-	"	.set mips2		\n"
+-	"1:	li	$1, 1		\n"
+-	"	ll	%0, %1		\n"
+-	"	sc	$1, %1		\n"
+-	"	beqz	$1, 1b		\n"
+-	"	.set pop		"
+-	: "=r" (ret), "+R" (*p)
+-	:
+-	: "memory");
+-
+-    return ret;
+-}
+-#else
+-#error unimplemented CPU support
 -#endif
 -
 -typedef int spinlock_t;
@@ -237,9 +258,9 @@ Index: qemu/exec-all.h
  
 Index: qemu/linux-user/arm/syscall.h
 ===================================================================
---- qemu.orig/linux-user/arm/syscall.h	2006-03-09 19:18:11.000000000 +0000
-+++ qemu/linux-user/arm/syscall.h	2006-08-26 16:31:53.000000000 +0100
-@@ -28,7 +28,9 @@
+--- qemu.orig/linux-user/arm/syscall.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/linux-user/arm/syscall.h	2007-06-13 11:51:57.000000000 +0100
+@@ -28,7 +28,9 @@ struct target_pt_regs {
  #define ARM_SYSCALL_BASE	0x900000
  #define ARM_THUMB_SYSCALL	0
  
@@ -252,9 +273,9 @@ Index: qemu/linux-user/arm/syscall.h
  #define ARM_NR_thumb_semihosting  0xAB
 Index: qemu/linux-user/main.c
 ===================================================================
---- qemu.orig/linux-user/main.c	2006-08-26 16:28:40.000000000 +0100
-+++ qemu/linux-user/main.c	2006-08-26 16:31:53.000000000 +0100
-@@ -309,6 +309,50 @@
+--- qemu.orig/linux-user/main.c	2007-06-13 11:51:55.000000000 +0100
++++ qemu/linux-user/main.c	2007-06-13 11:51:57.000000000 +0100
+@@ -325,6 +325,50 @@ static void arm_cache_flush(target_ulong
      }
  }
  
@@ -305,7 +326,7 @@ Index: qemu/linux-user/main.c
  void cpu_loop(CPUARMState *env)
  {
      int trapnr;
-@@ -365,10 +409,8 @@
+@@ -430,10 +474,8 @@ void cpu_loop(CPUARMState *env)
                      }
                  }
  
@@ -318,7 +339,7 @@ Index: qemu/linux-user/main.c
                      env->regs[0] = do_arm_semihosting (env);
                  } else if (n == 0 || n >= ARM_SYSCALL_BASE
                             || (env->thumb && n == ARM_THUMB_SYSCALL)) {
-@@ -379,14 +421,34 @@
+@@ -444,14 +486,34 @@ void cpu_loop(CPUARMState *env)
                          n -= ARM_SYSCALL_BASE;
                          env->eabi = 0;
                      }
@@ -361,7 +382,7 @@ Index: qemu/linux-user/main.c
                  } else {
                      goto error;
                  }
-@@ -425,6 +487,10 @@
+@@ -490,6 +552,10 @@ void cpu_loop(CPUARMState *env)
                    }
              }
              break;
@@ -372,23 +393,23 @@ Index: qemu/linux-user/main.c
          default:
          error:
              fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n", 
-@@ -1639,6 +1705,10 @@
-         ts->heap_base = info->brk;
-         /* This will be filled in on the first SYS_HEAPINFO call.  */
-         ts->heap_limit = 0;
-+        /* Register the magic kernel code page.  The cpu will generate a
-+           special exception when it tries to execute code here.  We can't
-+           put real code here because it may be in use by the host kernel.  */
-+        page_set_flags(0xffff0000, 0xffff0fff, 0);
-     }
- #elif defined(TARGET_SPARC)
-     {
+@@ -2096,6 +2162,10 @@ int main(int argc, char **argv)
+     ts->heap_base = info->brk;
+     /* This will be filled in on the first SYS_HEAPINFO call.  */
+     ts->heap_limit = 0;
++    /* Register the magic kernel code page.  The cpu will generate a
++       special exception when it tries to execute code here.  We can't
++       put real code here because it may be in use by the host kernel.  */
++    page_set_flags(0xffff0000, 0xffff0fff, 0);
+ #endif
+ 
+     if (gdbstub_port) {
 Index: qemu/linux-user/qemu.h
 ===================================================================
---- qemu.orig/linux-user/qemu.h	2006-08-26 16:28:40.000000000 +0100
-+++ qemu/linux-user/qemu.h	2006-08-26 16:33:50.000000000 +0100
-@@ -75,6 +75,9 @@
-     uint32_t v86mask;
+--- qemu.orig/linux-user/qemu.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/linux-user/qemu.h	2007-06-13 11:51:57.000000000 +0100
+@@ -81,6 +81,9 @@ typedef struct TaskState {
+     uint32_t heap_limit;
  #endif
      int used; /* non zero if used */
 +#ifdef USE_NPTL
@@ -399,9 +420,9 @@ Index: qemu/linux-user/qemu.h
  } __attribute__((aligned(16))) TaskState;
 Index: qemu/linux-user/syscall.c
 ===================================================================
---- qemu.orig/linux-user/syscall.c	2006-08-26 16:28:40.000000000 +0100
-+++ qemu/linux-user/syscall.c	2006-08-26 16:31:53.000000000 +0100
-@@ -66,9 +66,18 @@
+--- qemu.orig/linux-user/syscall.c	2007-06-13 11:51:55.000000000 +0100
++++ qemu/linux-user/syscall.c	2007-06-13 11:51:57.000000000 +0100
+@@ -71,9 +71,18 @@
  #include <linux/kd.h>
  
  #include "qemu.h"
@@ -417,10 +438,10 @@ Index: qemu/linux-user/syscall.c
 +#define CLONE_NPTL_FLAGS2 0
 +#endif
 +
- #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC)
+ #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
+     || defined(TARGET_M68K) || defined(TARGET_SH4)
  /* 16 bit uid wrappers emulation */
- #define USE_UID16
-@@ -1602,20 +1611,38 @@
+@@ -2121,20 +2130,38 @@ int do_modify_ldt(CPUX86State *env, int 
     thread/process */
  #define NEW_STACK_SIZE 8192
  
@@ -460,7 +481,7 @@ Index: qemu/linux-user/syscall.c
      
      if (flags & CLONE_VM) {
          ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
-@@ -1665,16 +1692,60 @@
+@@ -2197,16 +2224,60 @@ int do_fork(CPUState *env, unsigned int 
  #error unsupported target CPU
  #endif
          new_env->opaque = ts;
@@ -525,16 +546,16 @@ Index: qemu/linux-user/syscall.c
      }
      return ret;
  }
-@@ -1918,7 +1989,7 @@
+@@ -2483,7 +2554,7 @@ long do_syscall(void *cpu_env, int num, 
          ret = do_brk(arg1);
          break;
      case TARGET_NR_fork:
 -        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0));
 +        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0, NULL, NULL, NULL));
          break;
+ #ifdef TARGET_NR_waitpid
      case TARGET_NR_waitpid:
-         {
-@@ -2989,7 +3060,8 @@
+@@ -3648,7 +3719,8 @@ long do_syscall(void *cpu_env, int num, 
          ret = get_errno(fsync(arg1));
          break;
      case TARGET_NR_clone:
@@ -544,7 +565,7 @@ Index: qemu/linux-user/syscall.c
          break;
  #ifdef __NR_exit_group
          /* new thread calls */
-@@ -3339,7 +3411,8 @@
+@@ -4062,7 +4134,8 @@ long do_syscall(void *cpu_env, int num, 
  #endif
  #ifdef TARGET_NR_vfork
      case TARGET_NR_vfork:
@@ -554,16 +575,16 @@ Index: qemu/linux-user/syscall.c
          break;
  #endif
  #ifdef TARGET_NR_ugetrlimit
-@@ -3838,4 +3911,3 @@
+@@ -4660,4 +4733,3 @@ long do_syscall(void *cpu_env, int num, 
  #endif
      return ret;
  }
 -
 Index: qemu/target-arm/cpu.h
 ===================================================================
---- qemu.orig/target-arm/cpu.h	2006-03-09 19:18:27.000000000 +0000
-+++ qemu/target-arm/cpu.h	2006-08-26 16:31:53.000000000 +0100
-@@ -35,6 +35,9 @@
+--- qemu.orig/target-arm/cpu.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/target-arm/cpu.h	2007-06-13 11:51:57.000000000 +0100
+@@ -37,6 +37,9 @@
  #define EXCP_IRQ             5
  #define EXCP_FIQ             6
  #define EXCP_BKPT            7
@@ -571,18 +592,18 @@ Index: qemu/target-arm/cpu.h
 +
 +
  
- /* We currently assume float and double are IEEE single and double
-    precision respectively.
-@@ -85,6 +88,7 @@
+ typedef void ARMWriteCPFunc(void *opaque, int cp_info,
+                             int srcreg, int operand, uint32_t value);
+@@ -97,6 +100,7 @@ typedef struct CPUARMState {
          uint32_t c9_data;
          uint32_t c13_fcse; /* FCSE PID.  */
          uint32_t c13_context; /* Context ID.  */
 +        uint32_t c13_tls; /* Paul Brook told me to just add this ;)  */
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
      } cp15;
  
-     /* Internal CPU feature flags.  */
-@@ -135,6 +139,15 @@
- int cpu_arm_signal_handler(int host_signum, struct siginfo *info, 
+@@ -169,6 +173,15 @@ void switch_mode(CPUARMState *, int);
+ int cpu_arm_signal_handler(int host_signum, void *pinfo, 
                             void *puc);
  
 +void cpu_lock(void);
@@ -597,7 +618,7 @@ Index: qemu/target-arm/cpu.h
  #define CPSR_M (0x1f)
  #define CPSR_T (1 << 5)
  #define CPSR_F (1 << 6)
-@@ -146,7 +159,11 @@
+@@ -180,7 +193,11 @@ int cpu_arm_signal_handler(int host_sign
  #define CPSR_J (1 << 24)
  #define CPSR_IT_0_1 (3 << 25)
  #define CPSR_Q (1 << 27)
@@ -612,22 +633,22 @@ Index: qemu/target-arm/cpu.h
  /* Return the current CPSR value.  */
 Index: qemu/target-arm/exec.h
 ===================================================================
---- qemu.orig/target-arm/exec.h	2006-03-09 19:18:27.000000000 +0000
-+++ qemu/target-arm/exec.h	2006-08-26 16:31:53.000000000 +0100
-@@ -51,8 +51,6 @@
+--- qemu.orig/target-arm/exec.h	2007-06-13 11:48:22.000000000 +0100
++++ qemu/target-arm/exec.h	2007-06-13 11:51:57.000000000 +0100
+@@ -68,8 +68,6 @@ static inline int cpu_halted(CPUState *e
  
  /* In op_helper.c */
  
 -void cpu_lock(void);
 -void cpu_unlock(void);
+ void helper_set_cp(CPUState *, uint32_t, uint32_t);
+ uint32_t helper_get_cp(CPUState *, uint32_t);
  void helper_set_cp15(CPUState *, uint32_t, uint32_t);
- uint32_t helper_get_cp15(CPUState *, uint32_t);
- 
 Index: qemu/target-arm/op.c
 ===================================================================
---- qemu.orig/target-arm/op.c	2006-08-26 16:28:48.000000000 +0100
-+++ qemu/target-arm/op.c	2006-08-26 16:31:53.000000000 +0100
-@@ -891,6 +891,12 @@
+--- qemu.orig/target-arm/op.c	2007-06-13 11:48:22.000000000 +0100
++++ qemu/target-arm/op.c	2007-06-13 11:51:57.000000000 +0100
+@@ -891,6 +891,12 @@ void OPPROTO op_bkpt(void)
      cpu_loop_exit();
  }
  
@@ -642,9 +663,9 @@ Index: qemu/target-arm/op.c
     "d" suffix.  */
 Index: qemu/target-arm/translate.c
 ===================================================================
---- qemu.orig/target-arm/translate.c	2006-08-26 16:28:48.000000000 +0100
-+++ qemu/target-arm/translate.c	2006-08-26 16:31:53.000000000 +0100
-@@ -2382,6 +2382,7 @@
+--- qemu.orig/target-arm/translate.c	2007-06-13 11:48:22.000000000 +0100
++++ qemu/target-arm/translate.c	2007-06-13 11:51:57.000000000 +0100
+@@ -3513,6 +3513,7 @@ undef:
      s->is_jmp = DISAS_JUMP;
  }
  
@@ -652,7 +673,7 @@ Index: qemu/target-arm/translate.c
  /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
     basic block 'tb'. If search_pc is TRUE, also generate PC
     information for each intermediate instruction. */
-@@ -2416,6 +2417,15 @@
+@@ -3548,6 +3549,15 @@ static inline int gen_intermediate_code_
      nb_gen_labels = 0;
      lj = -1;
      do {
@@ -671,8 +692,8 @@ Index: qemu/target-arm/translate.c
 Index: qemu/qemu_spinlock.h
 ===================================================================
 --- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ qemu/qemu_spinlock.h	2006-08-26 16:31:53.000000000 +0100
-@@ -0,0 +1,182 @@
++++ qemu/qemu_spinlock.h	2007-06-13 11:51:57.000000000 +0100
+@@ -0,0 +1,204 @@
 +/*
 + * internal execution defines for qemu
 + *
@@ -820,6 +841,28 @@ Index: qemu/qemu_spinlock.h
 +}
 +#endif
 +
++#ifdef __mips__
++static inline int testandset (int *p)
++{
++    int ret;
++
++    __asm__ __volatile__ (
++	"	.set push		\n"
++	"	.set noat		\n"
++	"	.set mips2		\n"
++	"1:	li	$1, 1		\n"
++	"	ll	%0, %1		\n"
++	"	sc	$1, %1		\n"
++	"	beqz	$1, 1b		\n"
++	"	.set pop		"
++	: "=r" (ret), "+R" (*p)
++	:
++	: "memory");
++
++    return ret;
++}
++#endif
++
 +typedef int spinlock_t;
 +
 +#define SPIN_LOCK_UNLOCKED 0
diff --git a/meta/packages/qemu/files/compiler.patch b/meta/packages/qemu/files/compiler.patch
deleted file mode 100644
index dad18b3a6..000000000
--- a/meta/packages/qemu/files/compiler.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- qemu/usb-linux.c~	2006-07-19 19:06:15.000000000 +0100
-+++ qemu/usb-linux.c	2006-10-02 12:49:00.000000000 +0100
-@@ -26,7 +26,6 @@
- #if defined(__linux__)
- #include <dirent.h>
- #include <sys/ioctl.h>
--#include <linux/compiler.h>
- #include <linux/usbdevice_fs.h>
- #include <linux/version.h>
- 
diff --git a/meta/packages/qemu/files/configure.patch b/meta/packages/qemu/files/configure.patch
deleted file mode 100644
index ea83f8cd6..000000000
--- a/meta/packages/qemu/files/configure.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Index: qemu/configure
-===================================================================
---- qemu.orig/configure	2006-02-09 17:58:47.000000000 +0000
-+++ qemu/configure	2006-02-21 17:47:31.000000000 +0000
-@@ -482,7 +482,7 @@
- fi
- echo "HOST_CC=$host_cc" >> $config_mak
- echo "AR=$ar" >> $config_mak
--echo "STRIP=$strip -s -R .comment -R .note" >> $config_mak
-+echo "STRIP=$strip" >> $config_mak
- echo "CFLAGS=$CFLAGS" >> $config_mak
- echo "LDFLAGS=$LDFLAGS" >> $config_mak
- echo "EXESUF=$EXESUF" >> $config_mak
diff --git a/meta/packages/qemu/files/mouse_fix-r0.patch b/meta/packages/qemu/files/mouse_fix-r0.patch
deleted file mode 100644
index 8cc19f039..000000000
--- a/meta/packages/qemu/files/mouse_fix-r0.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-If the cursor is hidden (SDL_ShowCursor(0)) and the input is grabbed
-(SDL_WM_GrabInput(SDL_GRAB_ON)), then the mouse will give relative motion
-events even when the cursor reaches the edge fo the screen. This is currently
-only implemented on Windows and Linux/Unix-a-likes.
-
-Index: qemu/sdl.c
-===================================================================
---- qemu.orig/sdl.c	2006-04-13 12:22:22.000000000 +0100
-+++ qemu/sdl.c	2006-05-25 00:28:25.000000000 +0100
-@@ -280,13 +280,13 @@
- 
- static void sdl_hide_cursor(void)
- {
--    SDL_SetCursor(sdl_cursor_hidden);
-+    SDL_ShowCursor(0);
- }
- 
- static void sdl_show_cursor(void)
- {
-     if (!kbd_mouse_is_absolute()) {
--	SDL_SetCursor(sdl_cursor_normal);
-+        SDL_ShowCursor(1);
-     }
- }
- 
diff --git a/meta/packages/qemu/files/nodocs_cvs.patch b/meta/packages/qemu/files/nodocs_cvs.patch
deleted file mode 100644
index b52d860fb..000000000
--- a/meta/packages/qemu/files/nodocs_cvs.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-Index: qemu/Makefile
-===================================================================
---- qemu.orig/Makefile	2006-04-18 11:11:37.000000000 +0100
-+++ qemu/Makefile	2006-04-18 11:14:34.000000000 +0100
-@@ -11,7 +11,7 @@
- ifdef CONFIG_STATIC
- LDFLAGS+=-static
- endif
--DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1
-+DOCS=
- 
- all: dyngen$(EXESUF) $(TOOLS) $(DOCS)
- 	for d in $(TARGET_DIRS); do \
-@@ -51,11 +51,11 @@
- 			video.x proll.elf linux_boot.bin; do \
- 		$(INSTALL) -m 644 $(SRC_PATH)/pc-bios/$$x "$(DESTDIR)$(datadir)"; \
- 	done
--	mkdir -p "$(DESTDIR)$(docdir)"
--	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
-+#	mkdir -p "$(DESTDIR)$(docdir)"
-+#	$(INSTALL) -m 644 qemu-doc.html  qemu-tech.html "$(DESTDIR)$(docdir)"
- ifndef CONFIG_WIN32
--	mkdir -p "$(DESTDIR)$(mandir)/man1"
--	$(INSTALL) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
-+#	mkdir -p "$(DESTDIR)$(mandir)/man1"
-+#	$(INSTALL) qemu.1 qemu-img.1 "$(DESTDIR)$(mandir)/man1"
- 	mkdir -p "$(DESTDIR)$(datadir)/keymaps"
- 	for x in $(KEYMAPS); do \
- 		$(INSTALL) -m 644 $(SRC_PATH)/keymaps/$$x "$(DESTDIR)$(datadir)/keymaps"; \
-@@ -122,10 +122,10 @@
- 	$(datadir)/ppc_rom.bin \
- 	$(datadir)/video.x \
- 	$(datadir)/proll.elf \
--	$(datadir)/linux_boot.bin \
--	$(docdir)/qemu-doc.html \
--	$(docdir)/qemu-tech.html \
--	$(mandir)/man1/qemu.1 $(mandir)/man1/qemu-img.1 )
-+	$(datadir)/linux_boot.bin
-+#	$(docdir)/qemu-doc.html \
-+#	$(docdir)/qemu-tech.html \
-+#	$(mandir)/man1/qemu.1 $(mandir)/man1/qemu-img.1 )
- 
- ifneq ($(wildcard .depend),)
- include .depend
diff --git a/meta/packages/qemu/files/qemu-pci-irq-sharing.patch b/meta/packages/qemu/files/qemu-pci-irq-sharing.patch
deleted file mode 100644
index c47e89895..000000000
--- a/meta/packages/qemu/files/qemu-pci-irq-sharing.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff -pNaur qemu-cvs-ts-orig/hw/pci.c qemu-cvs-ts/hw/pci.c
---- qemu-cvs-ts-orig/hw/pci.c	2006-08-17 10:46:34.000000000 +0000
-+++ qemu-cvs-ts/hw/pci.c	2006-09-23 17:02:41.000000000 +0000
-@@ -34,6 +34,7 @@ struct PCIBus {
-     SetIRQFunc *low_set_irq;
-     void *irq_opaque;
-     PCIDevice *devices[256];
-+    int irq_count[4];
- };
- 
- static void pci_update_mappings(PCIDevice *d);
-@@ -49,6 +50,7 @@ PCIBus *pci_register_bus(pci_set_irq_fn 
-     bus->set_irq = set_irq;
-     bus->irq_opaque = pic;
-     bus->devfn_min = devfn_min;
-+    memset(bus->irq_count, 0, sizeof(bus->irq_count));
-     first_bus = bus;
-     return bus;
- }
-@@ -100,6 +102,7 @@ PCIDevice *pci_register_device(PCIBus *b
-     pci_dev->bus = bus;
-     pci_dev->devfn = devfn;
-     pstrcpy(pci_dev->name, sizeof(pci_dev->name), name);
-+    memset(pci_dev->irq_state, 0, sizeof(pci_dev->irq_state));
- 
-     if (!config_read)
-         config_read = pci_default_read_config;
-@@ -404,7 +407,10 @@ uint32_t pci_data_read(void *opaque, uin
- void pci_set_irq(PCIDevice *pci_dev, int irq_num, int level)
- {
-     PCIBus *bus = pci_dev->bus;
--    bus->set_irq(pci_dev, bus->irq_opaque, irq_num, level);
-+    bus->irq_count[irq_num] += level - pci_dev->irq_state[irq_num];
-+    pci_dev->irq_state[irq_num] = level;
-+    bus->set_irq(pci_dev, bus->irq_opaque,
-+                 irq_num, !!bus->irq_count[irq_num]);
- }
- 
- /***********************************************************/
-diff -pNaur qemu-cvs-ts-orig/vl.h qemu-cvs-ts/vl.h
---- qemu-cvs-ts-orig/vl.h	2006-09-18 01:15:29.000000000 +0000
-+++ qemu-cvs-ts/vl.h	2006-09-23 17:15:21.000000000 +0000
-@@ -733,6 +733,9 @@ struct PCIDevice {
-     PCIConfigWriteFunc *config_write;
-     /* ??? This is a PC-specific hack, and should be removed.  */
-     int irq_index;
-+
-+    /* remember last irq levels */
-+    int irq_state[4];
- };
- 
- PCIDevice *pci_register_device(PCIBus *bus, const char *name,
diff --git a/meta/packages/qemu/files/qemu-usb-wacom-0.8.2.patch b/meta/packages/qemu/files/qemu-usb-wacom-0.8.2.patch
deleted file mode 100644
index 33a6db3f1..000000000
--- a/meta/packages/qemu/files/qemu-usb-wacom-0.8.2.patch
+++ /dev/null
@@ -1,445 +0,0 @@
-diff -pNaur qemu-cvs-ts-orig/hw/usb-wacom.c qemu-cvs-ts/hw/usb-wacom.c
---- qemu-cvs-ts-orig/hw/usb-wacom.c	1970-01-01 01:00:00.000000000 +0100
-+++ qemu-cvs-ts/hw/usb-wacom.c	2006-09-22 20:44:26.000000000 +0200
-@@ -0,0 +1,408 @@
-+/*
-+ * Wacom PenPartner USB tablet emulation.
-+ *
-+ * Copyright (c) 2006 Openedhand Ltd.
-+ *
-+ * Author: Andrzej Zaborowski <balrog@zabor.org>
-+ *
-+ * Based on hw/usb-hid.c:
-+ * Copyright (c) 2005 Fabrice Bellard
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+#include "vl.h"
-+
-+/* Interface requests */
-+#define WACOM_GET_REPORT	0x2101
-+#define WACOM_SET_REPORT	0x2109
-+
-+/* HID interface requests */
-+#define HID_GET_REPORT		0xa101
-+#define HID_GET_IDLE		0xa102
-+#define HID_GET_PROTOCOL	0xa103
-+#define HID_SET_IDLE		0x210a
-+#define HID_SET_PROTOCOL	0x210b
-+
-+#define WACOM_MODE_HID		1
-+#define WACOM_MODE_WACOM	2
-+
-+typedef struct USBWacomState {
-+    USBDevice dev;
-+    int dx, dy, dz, buttons_state;
-+    int x, y;
-+    int mouse_grabbed;
-+    int mode;
-+} USBWacomState;
-+
-+static const uint8_t qemu_wacom_dev_descriptor[] = {
-+    0x12,	/*  u8 bLength; */
-+    0x01,	/*  u8 bDescriptorType; Device */
-+    0x10, 0x10,	/*  u16 bcdUSB; v1.10 */
-+
-+    0x00,	/*  u8  bDeviceClass; */
-+    0x00,	/*  u8  bDeviceSubClass; */
-+    0x00,	/*  u8  bDeviceProtocol; [ low/full speeds only ] */
-+    0x08,	/*  u8  bMaxPacketSize0; 8 Bytes */
-+
-+    0x6a, 0x05,	/*  u16 idVendor; */
-+    0x00, 0x00,	/*  u16 idProduct; */
-+    0x10, 0x42,	/*  u16 bcdDevice */
-+
-+    0x01,	/*  u8  iManufacturer; */
-+    0x02,	/*  u8  iProduct; */
-+    0x00,	/*  u8  iSerialNumber; */
-+    0x01,	/*  u8  bNumConfigurations; */
-+};
-+
-+static const uint8_t qemu_wacom_config_descriptor[] = {
-+    /* one configuration */
-+    0x09,	/*  u8  bLength; */
-+    0x02,	/*  u8  bDescriptorType; Configuration */
-+    0x22, 0x00,	/*  u16 wTotalLength; */
-+    0x01,	/*  u8  bNumInterfaces; (1) */
-+    0x01,	/*  u8  bConfigurationValue; */
-+    0x00,	/*  u8  iConfiguration; */
-+    0x80,	/*  u8  bmAttributes; 
-+				 Bit 7: must be set,
-+				     6: Self-powered,
-+				     5: Remote wakeup,
-+				     4..0: resvd */
-+    40,		/*  u8  MaxPower; */
-+
-+    /* one interface */
-+    0x09,	/*  u8  if_bLength; */
-+    0x04,	/*  u8  if_bDescriptorType; Interface */
-+    0x00,	/*  u8  if_bInterfaceNumber; */
-+    0x00,	/*  u8  if_bAlternateSetting; */
-+    0x01,	/*  u8  if_bNumEndpoints; */
-+    0x03,	/*  u8  if_bInterfaceClass; HID */
-+    0x01,	/*  u8  if_bInterfaceSubClass; Boot */
-+    0x02,	/*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
-+    0x00,	/*  u8  if_iInterface; */
-+
-+    /* HID descriptor */
-+    0x09,	/*  u8  bLength; */
-+    0x21,	/*  u8  bDescriptorType; */
-+    0x01, 0x10,	/*  u16 HID_class */
-+    0x00,	/*  u8  country_code */
-+    0x01,	/*  u8  num_descriptors */
-+    0x22,	/*  u8  type; Report */
-+    0x6e, 0x00,	/*  u16 len */
-+
-+    /* one endpoint (status change endpoint) */
-+    0x07,	/*  u8  ep_bLength; */
-+    0x05,	/*  u8  ep_bDescriptorType; Endpoint */
-+    0x81,	/*  u8  ep_bEndpointAddress; IN Endpoint 1 */
-+    0x03,	/*  u8  ep_bmAttributes; Interrupt */
-+    0x08, 0x00,	/*  u16 ep_wMaxPacketSize; */
-+    0x0a,	/*  u8  ep_bInterval; */
-+};
-+
-+static void usb_mouse_event(void *opaque,
-+                            int dx1, int dy1, int dz1, int buttons_state)
-+{
-+    USBWacomState *s = opaque;
-+
-+    s->dx += dx1;
-+    s->dy += dy1;
-+    s->dz += dz1;
-+    s->buttons_state = buttons_state;
-+}
-+
-+static void usb_wacom_event(void *opaque,
-+                            int x, int y, int dz, int buttons_state)
-+{
-+    USBWacomState *s = opaque;
-+
-+    s->x = x;
-+    s->y = y;
-+    s->dz += dz;
-+    s->buttons_state = buttons_state;
-+}
-+
-+static inline int int_clamp(int val, int vmin, int vmax)
-+{
-+    if (val < vmin)
-+        return vmin;
-+    else if (val > vmax)
-+        return vmax;
-+    else
-+        return val;
-+}
-+
-+static int usb_mouse_poll(USBWacomState *s, uint8_t *buf, int len)
-+{
-+    int dx, dy, dz, b, l;
-+
-+    if (!s->mouse_grabbed) {
-+        qemu_add_mouse_event_handler(usb_mouse_event, s, 1);
-+        s->mouse_grabbed = 1;
-+    }
-+
-+    dx = int_clamp(s->dx, -128, 127);
-+    dy = int_clamp(s->dy, -128, 127);
-+    dz = int_clamp(s->dz, -128, 127);
-+
-+    s->dx -= dx;
-+    s->dy -= dy;
-+    s->dz -= dz;
-+
-+    b = 0;
-+    if (s->buttons_state & MOUSE_EVENT_LBUTTON)
-+        b |= 0x01;
-+    if (s->buttons_state & MOUSE_EVENT_RBUTTON)
-+        b |= 0x02;
-+    if (s->buttons_state & MOUSE_EVENT_MBUTTON)
-+        b |= 0x04;
-+
-+    buf[0] = b;
-+    buf[1] = dx;
-+    buf[2] = dy;
-+    l = 3;
-+    if (len >= 4) {
-+        buf[3] = dz;
-+        l = 4;
-+    }
-+    return l;
-+}
-+
-+static int usb_wacom_poll(USBWacomState *s, uint8_t *buf, int len)
-+{
-+    int b;
-+
-+    if (!s->mouse_grabbed) {
-+        qemu_add_mouse_event_handler(usb_wacom_event, s, 1);
-+        s->mouse_grabbed = 1;
-+    }
-+
-+    b = 0;
-+    if (s->buttons_state & MOUSE_EVENT_LBUTTON)
-+        b |= 0x01;
-+    if (s->buttons_state & MOUSE_EVENT_RBUTTON)
-+        b |= 0x02;
-+    if (s->buttons_state & MOUSE_EVENT_MBUTTON)
-+        b |= 0x04;
-+
-+    if (len < 7)
-+        return 0;
-+
-+    buf[0] = s->mode;
-+    buf[1] = s->x & 0xff;
-+    buf[2] = s->x >> 8;
-+    buf[3] = s->y & 0xff;
-+    buf[4] = s->y >> 8;
-+    if (b) {
-+        buf[5] = 0x40;
-+        buf[6] = 0;
-+    } else {
-+        buf[5] = 0x00;
-+        buf[6] = (unsigned char) -120;
-+    }
-+
-+    return 7;
-+}
-+
-+static void usb_wacom_handle_reset(USBDevice *dev)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+
-+    s->dx = 0;
-+    s->dy = 0;
-+    s->dz = 0;
-+    s->x = 0;
-+    s->y = 0;
-+    s->buttons_state = 0;
-+    s->mode = WACOM_MODE_HID;
-+}
-+
-+static int usb_wacom_handle_control(USBDevice *dev, int request, int value,
-+                                    int index, int length, uint8_t *data)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+    int ret = 0;
-+
-+    switch (request) {
-+    case DeviceRequest | USB_REQ_GET_STATUS:
-+        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
-+            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
-+        data[1] = 0x00;
-+        ret = 2;
-+        break;
-+    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
-+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
-+            dev->remote_wakeup = 0;
-+        } else {
-+            goto fail;
-+        }
-+        ret = 0;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_FEATURE:
-+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
-+            dev->remote_wakeup = 1;
-+        } else {
-+            goto fail;
-+        }
-+        ret = 0;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
-+        dev->addr = value;
-+        ret = 0;
-+        break;
-+    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
-+        switch (value >> 8) {
-+        case USB_DT_DEVICE:
-+            memcpy(data, qemu_wacom_dev_descriptor, 
-+                   sizeof(qemu_wacom_dev_descriptor));
-+            ret = sizeof(qemu_wacom_dev_descriptor);
-+            break;
-+        case USB_DT_CONFIG:
-+       	    memcpy(data, qemu_wacom_config_descriptor, 
-+                   sizeof(qemu_wacom_config_descriptor));
-+            ret = sizeof(qemu_wacom_config_descriptor);
-+            break;
-+        case USB_DT_STRING:
-+            switch (value & 0xff) {
-+            case 0:
-+                /* language ids */
-+                data[0] = 4;
-+                data[1] = 3;
-+                data[2] = 0x09;
-+                data[3] = 0x04;
-+                ret = 4;
-+                break;
-+            case 1:
-+                /* serial number */
-+                ret = set_usb_string(data, "1");
-+                break;
-+            case 2:
-+		ret = set_usb_string(data, "Wacom PenPartner");
-+                break;
-+            case 3:
-+                /* vendor description */
-+                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
-+                break;
-+            case 4:
-+                ret = set_usb_string(data, "Wacom Tablet");
-+                break;
-+            case 5:
-+                ret = set_usb_string(data, "Endpoint1 Interrupt Pipe");
-+                break;
-+            default:
-+                goto fail;
-+            }
-+            break;
-+        default:
-+            goto fail;
-+        }
-+        break;
-+    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
-+        data[0] = 1;
-+        ret = 1;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
-+        ret = 0;
-+        break;
-+    case DeviceRequest | USB_REQ_GET_INTERFACE:
-+        data[0] = 0;
-+        ret = 1;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
-+        ret = 0;
-+        break;
-+    case WACOM_SET_REPORT:
-+        qemu_add_mouse_event_handler(NULL, NULL, 0);
-+	s->mouse_grabbed = 0;
-+        s->mode = data[0];
-+        ret = 0;
-+        break;
-+    case WACOM_GET_REPORT:
-+        data[0] = 0;
-+        data[1] = s->mode;
-+        ret = 2;
-+        break;
-+    /* USB HID requests */
-+    case HID_GET_REPORT:
-+        if (s->mode == WACOM_MODE_HID)
-+            ret = usb_mouse_poll(s, data, length);
-+        else if (s->mode == WACOM_MODE_WACOM)
-+            ret = usb_wacom_poll(s, data, length);
-+        break;
-+    case HID_SET_IDLE:
-+        ret = 0;
-+        break;
-+    default:
-+    fail:
-+        ret = USB_RET_STALL;
-+        break;
-+    }
-+    return ret;
-+}
-+
-+static int usb_wacom_handle_data(USBDevice *dev, int pid, 
-+                                 uint8_t devep, uint8_t *data, int len)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+    int ret = 0;
-+
-+    switch (pid) {
-+    case USB_TOKEN_IN:
-+        if (devep == 1) {
-+            if (s->mode == WACOM_MODE_HID)
-+                ret = usb_mouse_poll(s, data, len);
-+            else if (s->mode == WACOM_MODE_WACOM)
-+                ret = usb_wacom_poll(s, data, len);
-+            break;
-+        }
-+        /* Fall through.  */
-+    case USB_TOKEN_OUT:
-+    default:
-+        ret = USB_RET_STALL;
-+        break;
-+    }
-+    return ret;
-+}
-+
-+static void usb_wacom_handle_destroy(USBDevice *dev)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+
-+    qemu_add_mouse_event_handler(NULL, NULL, 0);
-+    qemu_free(s);
-+}
-+
-+USBDevice *usb_wacom_init(void)
-+{
-+    USBWacomState *s;
-+
-+    s = qemu_mallocz(sizeof(USBWacomState));
-+    if (!s)
-+        return NULL;
-+    s->dev.speed = USB_SPEED_FULL;
-+    s->dev.handle_packet = usb_generic_handle_packet;
-+
-+    s->dev.handle_reset = usb_wacom_handle_reset;
-+    s->dev.handle_control = usb_wacom_handle_control;
-+    s->dev.handle_data = usb_wacom_handle_data;
-+    s->dev.handle_destroy = usb_wacom_handle_destroy;
-+
-+    pstrcpy(s->dev.devname, sizeof(s->dev.devname),
-+            "QEMU PenPartner Tablet");
-+
-+    return (USBDevice *) s;
-+}
-diff -pNaur qemu-cvs-ts-orig/hw/usb.h qemu-cvs-ts/hw/usb.h
---- qemu-cvs-ts-orig/hw/usb.h	2006-08-12 03:04:27.000000000 +0200
-+++ qemu-cvs-ts/hw/usb.h	2006-09-21 01:40:40.000000000 +0200
-@@ -218,3 +218,6 @@ USBDevice *usb_tablet_init(void);
- 
- /* usb-msd.c */
- USBDevice *usb_msd_init(const char *filename);
-+
-+/* usb-wacom.c */
-+USBDevice *usb_wacom_init(void);
-diff -pNaur qemu-cvs-ts-orig/vl.c qemu-cvs-ts/vl.c
---- qemu-cvs-ts-orig/vl.c	2006-09-10 16:39:54.000000000 +0200
-+++ qemu-cvs-ts/vl.c	2006-09-21 01:45:16.000000000 +0200
-@@ -3765,6 +3765,8 @@ static int usb_device_add(const char *de
- 	dev = usb_tablet_init();
-     } else if (strstart(devname, "disk:", &p)) {
-         dev = usb_msd_init(p);
-+    } else if (!strcmp(devname, "wacom-tablet")) {
-+        dev = usb_wacom_init();
-     } else {
-         return -1;
-     }
-diff -pNaur qemu-cvs-ts-orig/Makefile.target qemu-cvs-ts/Makefile.target
---- qemu-cvs-ts-orig/Makefile.target	2006-09-18 03:15:29.000000000 +0200
-+++ qemu-cvs-ts/Makefile.target	2006-09-21 02:32:19.000000000 +0200
-@@ -330,6 +330,7 @@ VL_OBJS+= scsi-disk.o cdrom.o lsi53c895a
- 
- # USB layer
- VL_OBJS+= usb.o usb-hub.o usb-linux.o usb-hid.o usb-ohci.o usb-msd.o
-+VL_OBJS+= usb-wacom.o
- 
- # PCI network cards
- VL_OBJS+= ne2000.o rtl8139.o pcnet.o
diff --git a/meta/packages/qemu/files/qemu-usb-wacom-buttons.patch b/meta/packages/qemu/files/qemu-usb-wacom-buttons.patch
deleted file mode 100644
index ee24c1578..000000000
--- a/meta/packages/qemu/files/qemu-usb-wacom-buttons.patch
+++ /dev/null
@@ -1,23 +0,0 @@
---- qemu-cvs-ts-orig/hw/usb-wacom.c	2006-09-29 22:53:06.000000000 +0000
-+++ qemu-cvs-ts/hw/usb-wacom.c	2006-09-29 22:44:14.000000000 +0000
-@@ -203,19 +203,18 @@ static int usb_wacom_poll(USBWacomState 
-         return 0;
- 
-     buf[0] = s->mode;
-+    buf[5] = 0x00;
-     if (b) {
-         buf[1] = s->x & 0xff;
-         buf[2] = s->x >> 8;
-         buf[3] = s->y & 0xff;
-         buf[4] = s->y >> 8;
--        buf[5] = 0x40;
-         buf[6] = 0;
-     } else {
-         buf[1] = 0;
-         buf[2] = 0;
-         buf[3] = 0;
-         buf[4] = 0;
--        buf[5] = 0x00;
-         buf[6] = (unsigned char) -127;
-     }
- 
diff --git a/meta/packages/qemu/files/qemu-usb-wacom-pressure.patch b/meta/packages/qemu/files/qemu-usb-wacom-pressure.patch
deleted file mode 100644
index 668d50d5f..000000000
--- a/meta/packages/qemu/files/qemu-usb-wacom-pressure.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- qemu-cvs-ts-orig/hw/usb-wacom.c	2006-09-29 17:27:43.000000000 +0000
-+++ qemu-cvs-ts/hw/usb-wacom.c	2006-09-29 17:48:13.000000000 +0000
-@@ -203,16 +203,20 @@ static int usb_wacom_poll(USBWacomState 
-         return 0;
- 
-     buf[0] = s->mode;
--    buf[1] = s->x & 0xff;
--    buf[2] = s->x >> 8;
--    buf[3] = s->y & 0xff;
--    buf[4] = s->y >> 8;
-     if (b) {
-+        buf[1] = s->x & 0xff;
-+        buf[2] = s->x >> 8;
-+        buf[3] = s->y & 0xff;
-+        buf[4] = s->y >> 8;
-         buf[5] = 0x40;
-         buf[6] = 0;
-     } else {
-+        buf[1] = 0;
-+        buf[2] = 0;
-+        buf[3] = 0;
-+        buf[4] = 0;
-         buf[5] = 0x00;
--        buf[6] = (unsigned char) -120;
-+        buf[6] = (unsigned char) -127;
-     }
- 
-     return 7;
diff --git a/meta/packages/qemu/files/qemu-usb-wacom.patch b/meta/packages/qemu/files/qemu-usb-wacom.patch
deleted file mode 100644
index c1c39ecca..000000000
--- a/meta/packages/qemu/files/qemu-usb-wacom.patch
+++ /dev/null
@@ -1,444 +0,0 @@
-diff -pNaur qemu-cvs-ts-orig/hw/usb-wacom.c qemu-cvs-ts/hw/usb-wacom.c
---- qemu-cvs-ts-orig/hw/usb-wacom.c	1970-01-01 01:00:00.000000000 +0100
-+++ qemu-cvs-ts/hw/usb-wacom.c	2006-09-22 20:44:26.000000000 +0200
-@@ -0,0 +1,407 @@
-+/*
-+ * Wacom PenPartner USB tablet emulation.
-+ *
-+ * Copyright (c) 2006 Openedhand Ltd.
-+ *
-+ * Author: Andrzej Zaborowski <balrog@zabor.org>
-+ *
-+ * Based on hw/usb-hid.c:
-+ * Copyright (c) 2005 Fabrice Bellard
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+#include "vl.h"
-+
-+/* Interface requests */
-+#define WACOM_GET_REPORT	0x2101
-+#define WACOM_SET_REPORT	0x2109
-+
-+/* HID interface requests */
-+#define HID_GET_REPORT		0xa101
-+#define HID_GET_IDLE		0xa102
-+#define HID_GET_PROTOCOL	0xa103
-+#define HID_SET_IDLE		0x210a
-+#define HID_SET_PROTOCOL	0x210b
-+
-+#define WACOM_MODE_HID		1
-+#define WACOM_MODE_WACOM	2
-+
-+typedef struct USBWacomState {
-+    USBDevice dev;
-+    int dx, dy, dz, buttons_state;
-+    int x, y;
-+    int mouse_grabbed;
-+    int mode;
-+} USBWacomState;
-+
-+static const uint8_t qemu_wacom_dev_descriptor[] = {
-+    0x12,	/*  u8 bLength; */
-+    0x01,	/*  u8 bDescriptorType; Device */
-+    0x10, 0x10,	/*  u16 bcdUSB; v1.10 */
-+
-+    0x00,	/*  u8  bDeviceClass; */
-+    0x00,	/*  u8  bDeviceSubClass; */
-+    0x00,	/*  u8  bDeviceProtocol; [ low/full speeds only ] */
-+    0x08,	/*  u8  bMaxPacketSize0; 8 Bytes */
-+
-+    0x6a, 0x05,	/*  u16 idVendor; */
-+    0x00, 0x00,	/*  u16 idProduct; */
-+    0x10, 0x42,	/*  u16 bcdDevice */
-+
-+    0x01,	/*  u8  iManufacturer; */
-+    0x02,	/*  u8  iProduct; */
-+    0x00,	/*  u8  iSerialNumber; */
-+    0x01,	/*  u8  bNumConfigurations; */
-+};
-+
-+static const uint8_t qemu_wacom_config_descriptor[] = {
-+    /* one configuration */
-+    0x09,	/*  u8  bLength; */
-+    0x02,	/*  u8  bDescriptorType; Configuration */
-+    0x22, 0x00,	/*  u16 wTotalLength; */
-+    0x01,	/*  u8  bNumInterfaces; (1) */
-+    0x01,	/*  u8  bConfigurationValue; */
-+    0x00,	/*  u8  iConfiguration; */
-+    0x80,	/*  u8  bmAttributes; 
-+				 Bit 7: must be set,
-+				     6: Self-powered,
-+				     5: Remote wakeup,
-+				     4..0: resvd */
-+    40,		/*  u8  MaxPower; */
-+
-+    /* one interface */
-+    0x09,	/*  u8  if_bLength; */
-+    0x04,	/*  u8  if_bDescriptorType; Interface */
-+    0x00,	/*  u8  if_bInterfaceNumber; */
-+    0x00,	/*  u8  if_bAlternateSetting; */
-+    0x01,	/*  u8  if_bNumEndpoints; */
-+    0x03,	/*  u8  if_bInterfaceClass; HID */
-+    0x01,	/*  u8  if_bInterfaceSubClass; Boot */
-+    0x02,	/*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
-+    0x00,	/*  u8  if_iInterface; */
-+
-+    /* HID descriptor */
-+    0x09,	/*  u8  bLength; */
-+    0x21,	/*  u8  bDescriptorType; */
-+    0x01, 0x10,	/*  u16 HID_class */
-+    0x00,	/*  u8  country_code */
-+    0x01,	/*  u8  num_descriptors */
-+    0x22,	/*  u8  type; Report */
-+    0x6e, 0x00,	/*  u16 len */
-+
-+    /* one endpoint (status change endpoint) */
-+    0x07,	/*  u8  ep_bLength; */
-+    0x05,	/*  u8  ep_bDescriptorType; Endpoint */
-+    0x81,	/*  u8  ep_bEndpointAddress; IN Endpoint 1 */
-+    0x03,	/*  u8  ep_bmAttributes; Interrupt */
-+    0x08, 0x00,	/*  u16 ep_wMaxPacketSize; */
-+    0x0a,	/*  u8  ep_bInterval; */
-+};
-+
-+static void usb_mouse_event(void *opaque,
-+                            int dx1, int dy1, int dz1, int buttons_state)
-+{
-+    USBWacomState *s = opaque;
-+
-+    s->dx += dx1;
-+    s->dy += dy1;
-+    s->dz += dz1;
-+    s->buttons_state = buttons_state;
-+}
-+
-+static void usb_wacom_event(void *opaque,
-+                            int x, int y, int dz, int buttons_state)
-+{
-+    USBWacomState *s = opaque;
-+
-+    s->x = x;
-+    s->y = y;
-+    s->dz += dz;
-+    s->buttons_state = buttons_state;
-+}
-+
-+static inline int int_clamp(int val, int vmin, int vmax)
-+{
-+    if (val < vmin)
-+        return vmin;
-+    else if (val > vmax)
-+        return vmax;
-+    else
-+        return val;
-+}
-+
-+static int usb_mouse_poll(USBWacomState *s, uint8_t *buf, int len)
-+{
-+    int dx, dy, dz, b, l;
-+
-+    if (!s->mouse_grabbed) {
-+        qemu_add_mouse_event_handler(usb_mouse_event, s, 1);
-+        s->mouse_grabbed = 1;
-+    }
-+
-+    dx = int_clamp(s->dx, -128, 127);
-+    dy = int_clamp(s->dy, -128, 127);
-+    dz = int_clamp(s->dz, -128, 127);
-+
-+    s->dx -= dx;
-+    s->dy -= dy;
-+    s->dz -= dz;
-+
-+    b = 0;
-+    if (s->buttons_state & MOUSE_EVENT_LBUTTON)
-+        b |= 0x01;
-+    if (s->buttons_state & MOUSE_EVENT_RBUTTON)
-+        b |= 0x02;
-+    if (s->buttons_state & MOUSE_EVENT_MBUTTON)
-+        b |= 0x04;
-+
-+    buf[0] = b;
-+    buf[1] = dx;
-+    buf[2] = dy;
-+    l = 3;
-+    if (len >= 4) {
-+        buf[3] = dz;
-+        l = 4;
-+    }
-+    return l;
-+}
-+
-+static int usb_wacom_poll(USBWacomState *s, uint8_t *buf, int len)
-+{
-+    int b;
-+
-+    if (!s->mouse_grabbed) {
-+        qemu_add_mouse_event_handler(usb_wacom_event, s, 1);
-+        s->mouse_grabbed = 1;
-+    }
-+
-+    b = 0;
-+    if (s->buttons_state & MOUSE_EVENT_LBUTTON)
-+        b |= 0x01;
-+    if (s->buttons_state & MOUSE_EVENT_RBUTTON)
-+        b |= 0x02;
-+    if (s->buttons_state & MOUSE_EVENT_MBUTTON)
-+        b |= 0x04;
-+
-+    if (len < 7)
-+        return 0;
-+
-+    buf[0] = s->mode;
-+    buf[1] = s->x & 0xff;
-+    buf[2] = s->x >> 8;
-+    buf[3] = s->y & 0xff;
-+    buf[4] = s->y >> 8;
-+    if (b) {
-+        buf[5] = 0x40;
-+        buf[6] = 0;
-+    } else {
-+        buf[5] = 0x00;
-+        buf[6] = (unsigned char) -120;
-+    }
-+
-+    return 7;
-+}
-+
-+static void usb_wacom_handle_reset(USBDevice *dev)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+
-+    s->dx = 0;
-+    s->dy = 0;
-+    s->dz = 0;
-+    s->x = 0;
-+    s->y = 0;
-+    s->buttons_state = 0;
-+    s->mode = WACOM_MODE_HID;
-+}
-+
-+static int usb_wacom_handle_control(USBDevice *dev, int request, int value,
-+                                    int index, int length, uint8_t *data)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+    int ret = 0;
-+
-+    switch (request) {
-+    case DeviceRequest | USB_REQ_GET_STATUS:
-+        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
-+            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
-+        data[1] = 0x00;
-+        ret = 2;
-+        break;
-+    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
-+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
-+            dev->remote_wakeup = 0;
-+        } else {
-+            goto fail;
-+        }
-+        ret = 0;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_FEATURE:
-+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
-+            dev->remote_wakeup = 1;
-+        } else {
-+            goto fail;
-+        }
-+        ret = 0;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
-+        dev->addr = value;
-+        ret = 0;
-+        break;
-+    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
-+        switch (value >> 8) {
-+        case USB_DT_DEVICE:
-+            memcpy(data, qemu_wacom_dev_descriptor, 
-+                   sizeof(qemu_wacom_dev_descriptor));
-+            ret = sizeof(qemu_wacom_dev_descriptor);
-+            break;
-+        case USB_DT_CONFIG:
-+       	    memcpy(data, qemu_wacom_config_descriptor, 
-+                   sizeof(qemu_wacom_config_descriptor));
-+            ret = sizeof(qemu_wacom_config_descriptor);
-+            break;
-+        case USB_DT_STRING:
-+            switch (value & 0xff) {
-+            case 0:
-+                /* language ids */
-+                data[0] = 4;
-+                data[1] = 3;
-+                data[2] = 0x09;
-+                data[3] = 0x04;
-+                ret = 4;
-+                break;
-+            case 1:
-+                /* serial number */
-+                ret = set_usb_string(data, "1");
-+                break;
-+            case 2:
-+		ret = set_usb_string(data, "Wacom PenPartner");
-+                break;
-+            case 3:
-+                /* vendor description */
-+                ret = set_usb_string(data, "QEMU " QEMU_VERSION);
-+                break;
-+            case 4:
-+                ret = set_usb_string(data, "Wacom Tablet");
-+                break;
-+            case 5:
-+                ret = set_usb_string(data, "Endpoint1 Interrupt Pipe");
-+                break;
-+            default:
-+                goto fail;
-+            }
-+            break;
-+        default:
-+            goto fail;
-+        }
-+        break;
-+    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
-+        data[0] = 1;
-+        ret = 1;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
-+        ret = 0;
-+        break;
-+    case DeviceRequest | USB_REQ_GET_INTERFACE:
-+        data[0] = 0;
-+        ret = 1;
-+        break;
-+    case DeviceOutRequest | USB_REQ_SET_INTERFACE:
-+        ret = 0;
-+        break;
-+    case WACOM_SET_REPORT:
-+        qemu_add_mouse_event_handler(NULL, NULL, 0);
-+	s->mouse_grabbed = 0;
-+        s->mode = data[0];
-+        ret = 0;
-+        break;
-+    case WACOM_GET_REPORT:
-+        data[0] = 0;
-+        data[1] = s->mode;
-+        ret = 2;
-+        break;
-+    /* USB HID requests */
-+    case HID_GET_REPORT:
-+        if (s->mode == WACOM_MODE_HID)
-+            ret = usb_mouse_poll(s, data, length);
-+        else if (s->mode == WACOM_MODE_WACOM)
-+            ret = usb_wacom_poll(s, data, length);
-+        break;
-+    case HID_SET_IDLE:
-+        ret = 0;
-+        break;
-+    default:
-+    fail:
-+        ret = USB_RET_STALL;
-+        break;
-+    }
-+    return ret;
-+}
-+
-+static int usb_wacom_handle_data(USBDevice *dev, USBPacket *p)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+    int ret = 0;
-+
-+    switch (p->pid) {
-+    case USB_TOKEN_IN:
-+        if (p->devep == 1) {
-+            if (s->mode == WACOM_MODE_HID)
-+                ret = usb_mouse_poll(s, p->data, p->len);
-+            else if (s->mode == WACOM_MODE_WACOM)
-+                ret = usb_wacom_poll(s, p->data, p->len);
-+            break;
-+        }
-+        /* Fall through.  */
-+    case USB_TOKEN_OUT:
-+    default:
-+        ret = USB_RET_STALL;
-+        break;
-+    }
-+    return ret;
-+}
-+
-+static void usb_wacom_handle_destroy(USBDevice *dev)
-+{
-+    USBWacomState *s = (USBWacomState *) dev;
-+
-+    qemu_add_mouse_event_handler(NULL, NULL, 0);
-+    qemu_free(s);
-+}
-+
-+USBDevice *usb_wacom_init(void)
-+{
-+    USBWacomState *s;
-+
-+    s = qemu_mallocz(sizeof(USBWacomState));
-+    if (!s)
-+        return NULL;
-+    s->dev.speed = USB_SPEED_FULL;
-+    s->dev.handle_packet = usb_generic_handle_packet;
-+
-+    s->dev.handle_reset = usb_wacom_handle_reset;
-+    s->dev.handle_control = usb_wacom_handle_control;
-+    s->dev.handle_data = usb_wacom_handle_data;
-+    s->dev.handle_destroy = usb_wacom_handle_destroy;
-+
-+    pstrcpy(s->dev.devname, sizeof(s->dev.devname),
-+            "QEMU PenPartner Tablet");
-+
-+    return (USBDevice *) s;
-+}
-diff -pNaur qemu-cvs-ts-orig/hw/usb.h qemu-cvs-ts/hw/usb.h
---- qemu-cvs-ts-orig/hw/usb.h	2006-08-12 03:04:27.000000000 +0200
-+++ qemu-cvs-ts/hw/usb.h	2006-09-21 01:40:40.000000000 +0200
-@@ -218,3 +218,6 @@ USBDevice *usb_tablet_init(void);
- 
- /* usb-msd.c */
- USBDevice *usb_msd_init(const char *filename);
-+
-+/* usb-wacom.c */
-+USBDevice *usb_wacom_init(void);
-diff -pNaur qemu-cvs-ts-orig/vl.c qemu-cvs-ts/vl.c
---- qemu-cvs-ts-orig/vl.c	2006-09-10 16:39:54.000000000 +0200
-+++ qemu-cvs-ts/vl.c	2006-09-21 01:45:16.000000000 +0200
-@@ -3765,6 +3765,8 @@ static int usb_device_add(const char *de
- 	dev = usb_tablet_init();
-     } else if (strstart(devname, "disk:", &p)) {
-         dev = usb_msd_init(p);
-+    } else if (!strcmp(devname, "wacom-tablet")) {
-+        dev = usb_wacom_init();
-     } else {
-         return -1;
-     }
-diff -pNaur qemu-cvs-ts-orig/Makefile.target qemu-cvs-ts/Makefile.target
---- qemu-cvs-ts-orig/Makefile.target	2006-09-18 03:15:29.000000000 +0200
-+++ qemu-cvs-ts/Makefile.target	2006-09-21 02:32:19.000000000 +0200
-@@ -330,6 +330,7 @@ VL_OBJS+= scsi-disk.o cdrom.o lsi53c895a
- 
- # USB layer
- VL_OBJS+= usb.o usb-hub.o usb-linux.o usb-hid.o usb-ohci.o usb-msd.o
-+VL_OBJS+= usb-wacom.o
- 
- # PCI network cards
- VL_OBJS+= ne2000.o rtl8139.o pcnet.o
diff --git a/meta/packages/qemu/files/qemu-x-no-sdl.patch b/meta/packages/qemu/files/qemu-x-no-sdl.patch
deleted file mode 100644
index eb00d9806..000000000
--- a/meta/packages/qemu/files/qemu-x-no-sdl.patch
+++ /dev/null
@@ -1,630 +0,0 @@
-diff -urN qemu-0.8.2/configure qemu-0.8.2-x/configure
---- qemu-0.8.2/configure	2006-07-22 18:23:34.000000000 +0100
-+++ qemu-0.8.2-x/configure	2006-08-24 14:24:33.000000000 +0100
-@@ -492,6 +492,21 @@
- fi # cross compilation
- fi # -z $sdl
- 
-+##########################################
-+# X Probe
-+
-+x11=no
-+if test -z "$sdl" || test "$sdl" = "no"; then
-+  x11=yes
-+fi
-+
-+if test "$x11" = "yes"; then
-+  x11=no
-+  if `pkg-config --exists x11 xext`; then
-+    x11=yes
-+  fi
-+fi
-+
- # Check if tools are available to build documentation.
- if [ -x "`which texi2html`" ] && [ -x "`which pod2man`" ]; then
-   build_docs="yes"
-@@ -540,6 +555,7 @@
- if test "$sdl" != "no" ; then
-     echo "SDL static link   $sdl_static"
- fi
-+echo "X11 support       $x11"
- echo "mingw32 support   $mingw32"
- echo "Adlib support     $adlib"
- echo "CoreAudio support $coreaudio"
-@@ -748,14 +764,14 @@
- fi
- 
- if test "$target_user_only" = "no" -a "$check_gfx" = "yes" \
--        -a "$sdl" = "no" -a "$cocoa" = "no" ; then
-+        -a "$sdl" = "no" -a "$x11" = "no" -a "$cocoa" = "no" ; then
-     echo "ERROR: QEMU requires SDL or Cocoa for graphical output"
-     echo "To build QEMU without graphical output configure with --disable-gfx-check"
-     echo "Note that this will disable all output from the virtual graphics card."
-     exit 1;
- fi
- 
--#echo "Creating $config_mak, $config_h and $target_dir/Makefile"
-+echo "Creating $config_mak, $config_h and $target_dir/Makefile"
- 
- mkdir -p $target_dir
- mkdir -p $target_dir/fpu
-@@ -882,6 +898,14 @@
-     fi
- fi
- 
-+# x11
-+if test "$x11" = "yes"; then
-+  echo "#define CONFIG_X11 1" >> $config_h
-+  echo "CONFIG_X11=yes" >> $config_mak
-+  echo "X11_LIBS=`pkg-config --libs x11 xext`" >> $config_mak
-+  echo "X11_CFLAGS=`pkg-config --cflags x11 xext`" >> $config_mak
-+fi
-+
- if test "$cocoa" = "yes" ; then
-     echo "#define CONFIG_COCOA 1" >> $config_h
-     echo "CONFIG_COCOA=yes" >> $config_mak
-diff -urN qemu-0.8.2/Makefile.target qemu-0.8.2-x/Makefile.target
---- qemu-0.8.2/Makefile.target	2006-07-22 18:23:34.000000000 +0100
-+++ qemu-0.8.2-x/Makefile.target	2006-08-23 14:47:17.000000000 +0100
-@@ -376,6 +376,9 @@
- ifdef CONFIG_SDL
- VL_OBJS+=sdl.o
- endif
-+ifdef CONFIG_X11
-+VL_OBJS+=x.o
-+endif
- VL_OBJS+=vnc.o
- ifdef CONFIG_COCOA
- VL_OBJS+=cocoa.o
-@@ -426,7 +429,7 @@
- endif
- 
- $(QEMU_SYSTEM): $(VL_OBJS) libqemu.a
--	$(CC) $(VL_LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(COCOA_LIBS) $(VL_LIBS)
-+	$(CC) $(VL_LDFLAGS) -o $@ $^ $(LIBS) $(SDL_LIBS) $(X11_LIBS) $(COCOA_LIBS) $(VL_LIBS)
- 
- cocoa.o: cocoa.m
- 	$(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
-@@ -434,6 +437,10 @@
- sdl.o: sdl.c keymaps.c sdl_keysym.h
- 	$(CC) $(CFLAGS) $(DEFINES) $(SDL_CFLAGS) -c -o $@ $<
- 
-+x.o: x.c keymaps.c
-+	$(CC) $(CFLAGS) $(DEFINES) $(X11_CFLAGS) -c -o $@ $<
-+
-+
- vnc.o: vnc.c keymaps.c sdl_keysym.h vnchextile.h
- 	$(CC) $(CFLAGS) $(DEFINES) -c -o $@ $<
- 
-diff -urN qemu-0.8.2/vl.c qemu-0.8.2-x/vl.c
---- qemu-0.8.2/vl.c	2006-07-22 18:23:34.000000000 +0100
-+++ qemu-0.8.2-x/vl.c	2006-09-29 18:58:26.000000000 +0100
-@@ -5217,6 +5217,9 @@
- #ifdef USE_CODE_COPY
-            "-no-code-copy   disable code copy acceleration\n"
- #endif
-+#if defined(CONFIG_X11)
-+	   "-parent xid    Use pre-existing window as qemu output window\n"
-+#endif
- #ifdef TARGET_I386
-            "-std-vga        simulate a standard VGA card with VESA Bochs Extensions\n"
-            "                (default is CL-GD5446 PCI VGA)\n"
-@@ -5302,6 +5305,8 @@
-     QEMU_OPTION_smp,
-     QEMU_OPTION_vnc,
-     QEMU_OPTION_no_acpi,
-+
-+    QEMU_OPTION_parent_xid,
- };
- 
- typedef struct QEMUOption {
-@@ -5361,6 +5366,9 @@
- #if defined(TARGET_PPC) || defined(TARGET_SPARC)
-     { "g", 1, QEMU_OPTION_g },
- #endif
-+#if defined(CONFIG_X11)
-+    { "parent", HAS_ARG, QEMU_OPTION_parent_xid },
-+#endif
-     { "localtime", 0, QEMU_OPTION_localtime },
-     { "std-vga", 0, QEMU_OPTION_std_vga },
-     { "monitor", 1, QEMU_OPTION_monitor },
-@@ -5608,6 +5616,10 @@
-     char usb_devices[MAX_USB_CMDLINE][128];
-     int usb_devices_index;
- 
-+#if defined(CONFIG_X11)
-+    unsigned long parent_xid = 0;
-+#endif
-+
-     LIST_INIT (&vm_change_state_head);
- #ifndef _WIN32
-     {
-@@ -6021,6 +6033,11 @@
-             case QEMU_OPTION_no_acpi:
-                 acpi_enabled = 0;
-                 break;
-+#if defined(CONFIG_X11)
-+	    case QEMU_OPTION_parent_xid:
-+	      parent_xid = strtol(optarg, NULL, 0);
-+	      break;
-+#endif
-             }
-         }
-     }
-@@ -6142,6 +6159,8 @@
-         sdl_display_init(ds, full_screen);
- #elif defined(CONFIG_COCOA)
-         cocoa_display_init(ds, full_screen);
-+#elif defined(CONFIG_X11)
-+        x_display_init(ds, full_screen, parent_xid);
- #else
-         dumb_display_init(ds);
- #endif
-diff -urN qemu-0.8.2/vl.h qemu-0.8.2-x/vl.h
---- qemu-0.8.2/vl.h	2006-07-22 18:23:34.000000000 +0100
-+++ qemu-0.8.2-x/vl.h	2006-09-29 18:35:32.000000000 +0100
-@@ -767,6 +767,9 @@
- /* vnc.c */
- void vnc_display_init(DisplayState *ds, int display);
- 
-+/* x.c */
-+void x_display_init(DisplayState *ds, int display, unsigned long parent_xid);
-+
- /* ide.c */
- #define MAX_DISKS 4
- 
-diff -urN qemu-0.8.2/x.c qemu-0.8.2-x/x.c
---- qemu-0.8.2/x.c	1970-01-01 01:00:00.000000000 +0100
-+++ qemu-0.8.2-x/x.c	2006-09-29 18:35:02.000000000 +0100
-@@ -0,0 +1,451 @@
-+#include "vl.h"
-+
-+#include <X11/Xlib.h>
-+#include <X11/Xutil.h>
-+#include <X11/Xatom.h>
-+#include <X11/keysym.h>
-+#include <X11/extensions/XShm.h>
-+
-+#include <sys/ipc.h>
-+#include <sys/shm.h>
-+
-+typedef struct XHostScreen
-+{
-+  Display        *xdpy;
-+  int             xscreen;
-+  Visual         *xvisual;
-+  Window          xwin, xwinroot;
-+  GC              xgc;
-+  int             xdepth;
-+  XImage         *ximg;
-+  int             xwin_width, xwin_height;
-+  Bool            use_fullscreen;
-+  Bool            have_shm;
-+  unsigned char  *fb_data;   
-+  unsigned long   cmap[256];
-+  XShmSegmentInfo shminfo;
-+}
-+XHostScreen;
-+
-+static XHostScreen *xscreen;
-+static int          trapped_error_code = 0;
-+static int          (*old_error_handler) (Display *d, XErrorEvent *e);
-+
-+static void 
-+x_update(DisplayState *ds, int x, int y, int w, int h);
-+
-+static int
-+error_handler(Display     *display,
-+              XErrorEvent *error)
-+{
-+  trapped_error_code = error->error_code;
-+  return 0;
-+}
-+
-+static void
-+x_errors_trap(void)
-+{
-+  trapped_error_code = 0;
-+  old_error_handler = XSetErrorHandler(error_handler);
-+}
-+
-+static int
-+x_errors_untrap(void)
-+{
-+  XSetErrorHandler(old_error_handler);
-+  return trapped_error_code;
-+}
-+
-+static void 
-+x_update(DisplayState *ds, int x, int y, int w, int h)
-+{
-+  if (xscreen->have_shm)
-+    {
-+      XShmPutImage(xscreen->xdpy, xscreen->xwin, xscreen->xgc, xscreen->ximg, 
-+		   x, y, x, y, w, h, False);
-+    }
-+  else
-+    {
-+      XPutImage(xscreen->xdpy, xscreen->xwin, xscreen->xgc, xscreen->ximg, 
-+		x, y, x, y, w, h);
-+    }
-+
-+  XSync(xscreen->xdpy, False);
-+}
-+
-+static void 
-+x_resize(DisplayState *ds, int w, int h)
-+{
-+  Bool        shm_success = False;
-+  int         bitmap_pad;
-+  XSizeHints *size_hints;
-+
-+  if (xscreen->ximg != NULL)
-+    {
-+      if (xscreen->have_shm)
-+	{
-+	  XShmDetach(xscreen->xdpy, &xscreen->shminfo);
-+	  XDestroyImage (xscreen->ximg);
-+	  shmdt(xscreen->shminfo.shmaddr);
-+	  shmctl(xscreen->shminfo.shmid, IPC_RMID, 0);
-+	}
-+      else
-+	{
-+	  if (xscreen->ximg->data) 
-+	    {
-+	      free(xscreen->ximg->data);
-+	      xscreen->ximg->data = NULL;
-+	    } 
-+
-+	  XDestroyImage(xscreen->ximg);
-+	}
-+    }
-+
-+  if (xscreen->have_shm)
-+    {
-+      xscreen->ximg = XShmCreateImage(xscreen->xdpy, 
-+				      xscreen->xvisual, 
-+				      xscreen->xdepth, 
-+				      ZPixmap, 
-+				      NULL, 
-+				      &xscreen->shminfo,
-+				      w, h );
-+      
-+      xscreen->shminfo.shmid 
-+	= shmget(IPC_PRIVATE,
-+		 xscreen->ximg->bytes_per_line * h,
-+		 IPC_CREAT|0777);
-+      xscreen->shminfo.shmaddr = xscreen->ximg->data 
-+	= shmat(xscreen->shminfo.shmid, 0, 0);
-+
-+      if (xscreen->ximg->data == (char *)-1)
-+	{
-+	  xscreen->have_shm = False;
-+	  XDestroyImage(xscreen->ximg);
-+	  shmctl(xscreen->shminfo.shmid, IPC_RMID, 0);
-+	}
-+      else
-+	{
-+	  xscreen->shminfo.readOnly = False;
-+	  XShmAttach(xscreen->xdpy, &xscreen->shminfo);
-+	  shm_success = True;
-+	}
-+    }
-+
-+  if (!shm_success)
-+    {
-+      bitmap_pad = ( xscreen->xdepth > 16 ) ? 
-+	                    32 : (( xscreen->xdepth > 8 )? 16 : 8 );
-+	  
-+      xscreen->ximg = XCreateImage( xscreen->xdpy, 
-+				    xscreen->xvisual, 
-+				    xscreen->xdepth, 
-+				    ZPixmap, 0, 0,
-+				    w, 
-+				    h, 
-+				    bitmap_pad, 
-+				    0);
-+
-+      xscreen->ximg->data 
-+	 = malloc( xscreen->ximg->bytes_per_line * h );
-+    }
-+
-+  XResizeWindow(xscreen->xdpy, xscreen->xwin, w, h);
-+
-+  /* Ask the WM to keep our size static */
-+  size_hints = XAllocSizeHints();
-+  size_hints->max_width = size_hints->min_width = w;
-+  size_hints->max_height = size_hints->min_height = h;
-+  size_hints->flags = PMinSize|PMaxSize;
-+  XSetWMNormalHints(xscreen->xdpy, xscreen->xwin, size_hints);
-+  XFree(size_hints);
-+
-+  XMapWindow(xscreen->xdpy, xscreen->xwin);
-+
-+  XSync(xscreen->xdpy, False);
-+
-+  xscreen->xwin_width  = w;
-+  xscreen->xwin_height = h;
-+
-+  if (1) // (ds->depth == xscreen->xdepth)
-+    {
-+      ds->data = xscreen->ximg->data;
-+    }
-+  else
-+    {
-+      xscreen->fb_data = malloc(w*h*(ds->depth>>3));
-+      ds->data = xscreen->fb_data;
-+    }
-+  
-+  ds->linesize = xscreen->ximg->bytes_per_line;
-+  ds->depth    = (xscreen->xdepth >= 24) ? 32 : xscreen->xdepth;
-+  ds->bgr      = 0;
-+
-+#if 0
-+    if (ds->depth == 32 && screen->format->Rshift == 0) {
-+        ds->bgr = 1;
-+    } else {
-+        ds->bgr = 0;
-+    }
-+#endif
-+
-+    ds->width = w;
-+    ds->height = h;
-+
-+}
-+
-+static void 
-+x_refresh(DisplayState *ds)
-+{
-+  vga_hw_update();
-+}
-+
-+static int 
-+x_listen_poll(void *opaque)
-+{
-+  return XPending(xscreen->xdpy);
-+}
-+
-+static void
-+x_grab(void)
-+{
-+  static Bool grab = False;
-+
-+  if (!grab)
-+    {
-+      if (XGrabPointer (xscreen->xdpy, xscreen->xwin,
-+			True, 
-+			NoEventMask, 
-+			GrabModeAsync, 
-+			GrabModeAsync, 
-+			xscreen->xwin, None, CurrentTime) == 0
-+	  && XGrabKeyboard (xscreen->xdpy, xscreen->xwin, True, 
-+			    GrabModeAsync, 
-+			    GrabModeAsync, 
-+			    CurrentTime) == 0)
-+	{
-+	  grab = True;
-+	  XStoreName(xscreen->xdpy, xscreen->xwin, 
-+		     "QEmu (ctrl+shift releases mouse and keyboard )");
-+	}
-+    }
-+  else
-+    {
-+      XUngrabPointer (xscreen->xdpy, CurrentTime);
-+      XUngrabKeyboard (xscreen->xdpy, CurrentTime);
-+      grab = False;
-+      XStoreName(xscreen->xdpy, xscreen->xwin, 
-+		 "QEmu (ctrl+shift grabs mouse and keyboard )");
-+    }
-+}
-+
-+static void 
-+x_listen_read(void *opaque)
-+{
-+  XEvent        xev;
-+  DisplayState *ds = opaque;
-+  Bool          grabbed = False;
-+  static  int   last_x = 0, last_y = 0, button_state = 0, state;
-+
-+  if (XPending(xscreen->xdpy))
-+    {
-+      XNextEvent(xscreen->xdpy, &xev);
-+
-+      switch (xev.type) 
-+	{
-+	case EnterNotify:
-+	case LeaveNotify:
-+	  break;
-+	case FocusIn:
-+	  if (!kbd_mouse_is_absolute()) 
-+	    x_grab();
-+	  break;
-+	case FocusOut:
-+	  break;
-+	case Expose:
-+	  while (XCheckTypedWindowEvent(xscreen->xdpy, xev.xexpose.window, 
-+					Expose, &xev));
-+	  x_update(ds, 0, 0, 
-+		   xscreen->xwin_width,
-+		   xscreen->xwin_height);
-+	  break;
-+	case KeyRelease:
-+	  if ((XKeycodeToKeysym(xscreen->xdpy,
-+				xev.xkey.keycode,0) == XK_Shift_L
-+	       || XKeycodeToKeysym(xscreen->xdpy,
-+				   xev.xkey.keycode,0) == XK_Shift_R)
-+	      && (xev.xkey.state & ControlMask))
-+	    {
-+	      x_grab();
-+	      break;
-+	    }
-+	case KeyPress:
-+	  {
-+	    int keycode = xev.xkey.keycode-8; /* X adds 8 to keycode  */
-+
-+	    /* FIXME: LUT needed here me thinks */
-+
-+	    if (keycode & 0x80)  	      /* Extended */
-+	      kbd_put_keycode(0xe0);
-+	    
-+	    if (xev.type == KeyPress)
-+	      kbd_put_keycode(keycode & 0x7f);
-+	    else
-+	      kbd_put_keycode(keycode | 0x80);
-+	  }
-+	  break;
-+	case ButtonPress:
-+	case ButtonRelease:
-+	case MotionNotify:
-+	  {
-+	    int ev_state, ev_x, ev_y, dx, dy;
-+
-+	    state = 0;
-+
-+	    if (xev.type == MotionNotify)
-+	      {
-+		ev_state = xev.xmotion.state;
-+		ev_x     = xev.xmotion.x;
-+		ev_y     = xev.xmotion.y;
-+
-+		if (ev_state & Button1Mask)
-+		  state |= MOUSE_EVENT_LBUTTON;
-+		if (ev_state & Button2Mask)
-+		  state |= MOUSE_EVENT_RBUTTON;
-+		if (ev_state & Button3Mask)
-+		  state |= MOUSE_EVENT_MBUTTON;
-+
-+		/* Touchscreen dont send motion notifys */
-+		if (kbd_mouse_is_absolute() && state == 0) 
-+		  break;
-+	      }
-+	    else
-+	      {
-+		ev_state = xev.xbutton.state;
-+		ev_x     = xev.xbutton.x;
-+		ev_y     = xev.xbutton.y;
-+
-+		if (xev.type == ButtonPress) 
-+		  {
-+		    if (xev.xbutton.button == Button1)
-+		      state |= MOUSE_EVENT_LBUTTON;
-+		    if (xev.xbutton.state == Button1)
-+		      state |= MOUSE_EVENT_RBUTTON;
-+		    if (xev.xbutton.state & Button3)
-+		      state |= MOUSE_EVENT_MBUTTON;
-+		  }
-+	      }
-+
-+	    if (kbd_mouse_is_absolute()) 
-+	      {
-+		dx = ev_x * 0x7FFF / xscreen->xwin_width;
-+		dy = ev_y * 0x7FFF / xscreen->xwin_height;
-+	      }
-+	    else
-+	      {
-+		dx = ev_x - last_x;
-+		dy = ev_y - last_y;
-+	      }
-+
-+	    kbd_mouse_event(dx, dy, 0, state);
-+	    
-+	    last_x = ev_x;
-+	    last_y = ev_y;
-+	  }
-+	  break;
-+	default:
-+	  break;
-+
-+	}
-+    }
-+  return;
-+}
-+
-+void 
-+x_display_init(DisplayState *ds, int full_screen, unsigned long parent_xid)
-+{
-+  Cursor                empty_cursor;
-+  Pixmap                cursor_pxm;
-+  XColor                col;
-+  XSetWindowAttributes  attr;
-+
-+  xscreen = malloc(sizeof(XHostScreen));
-+  memset(xscreen, 0, sizeof(XHostScreen));
-+  
-+  if ((xscreen->xdpy = XOpenDisplay(getenv("DISPLAY"))) == NULL)
-+    {
-+      fprintf(stderr, "\nqemu cannot open host display. Is DISPLAY set?\n");
-+      exit(-1);
-+    }
-+  
-+  xscreen->xscreen  = DefaultScreen(xscreen->xdpy);
-+  xscreen->xwinroot = RootWindow(xscreen->xdpy, xscreen->xscreen);
-+  xscreen->xgc      = XCreateGC(xscreen->xdpy, xscreen->xwinroot, 0, NULL);
-+  xscreen->xdepth   = DefaultDepth(xscreen->xdpy, xscreen->xscreen);
-+  xscreen->xvisual  = DefaultVisual(xscreen->xdpy, xscreen->xscreen); 
-+  
-+  attr.event_mask = ButtonPressMask|ButtonReleaseMask|PointerMotionMask
-+                      |KeyPressMask|KeyReleaseMask|ExposureMask
-+                      |FocusChangeMask|EnterWindowMask|LeaveWindowMask;
-+  
-+  xscreen->xwin = XCreateWindow(xscreen->xdpy,
-+				xscreen->xwinroot,
-+				0,0,640,480,
-+				0,
-+				CopyFromParent,
-+				CopyFromParent,
-+				CopyFromParent,
-+				CWEventMask,
-+				&attr);
-+
-+  xscreen->have_shm = True;
-+
-+  if (!XShmQueryExtension(xscreen->xdpy) || getenv("QEMU_X_NO_SHM")) 
-+    {
-+      xscreen->have_shm = False;
-+    } 
-+  else 		            
-+    {	
-+      XShmSegmentInfo shminfo; 
-+
-+      shminfo.shmid=shmget(IPC_PRIVATE, 1, IPC_CREAT|0777);
-+      shminfo.shmaddr=shmat(shminfo.shmid,0,0);
-+      shminfo.readOnly=True;
-+
-+      x_errors_trap();
-+      
-+      XShmAttach(xscreen->xdpy, &shminfo);
-+      XSync(xscreen->xdpy, False);
-+
-+      if (x_errors_untrap())
-+	{
-+	  fprintf(stderr, "QEmu unable to use SHM XImages\n");
-+	  xscreen->have_shm = False;
-+	}
-+
-+      shmdt(shminfo.shmaddr);
-+      shmctl(shminfo.shmid, IPC_RMID, 0);
-+    }
-+
-+  if (!kbd_mouse_is_absolute()) 
-+    {
-+      /* Only hide cursor if were not a touchscreen */
-+      cursor_pxm = XCreatePixmap (xscreen->xdpy, xscreen->xwinroot, 1, 1, 1);
-+      memset (&col, 0, sizeof (col));
-+      empty_cursor = XCreatePixmapCursor (xscreen->xdpy, 
-+					  cursor_pxm, cursor_pxm, 
-+					  &col, &col, 1, 1);
-+      XDefineCursor (xscreen->xdpy, xscreen->xwin, empty_cursor);
-+      XFreePixmap (xscreen->xdpy, cursor_pxm);
-+    }
-+
-+  ds->dpy_update =  x_update;
-+  ds->dpy_resize =  x_resize;
-+  ds->dpy_refresh = x_refresh;
-+
-+  if ((qemu_set_fd_handler2 (ConnectionNumber(xscreen->xdpy), 
-+			     x_listen_poll, x_listen_read, NULL, ds)) == -1)
-+    exit(-1);
-+
-+  x_resize(ds, 640, 480);
-+}
diff --git a/meta/packages/qemu/qemu_cvs.bb b/meta/packages/qemu/qemu_cvs.bb
index 38cd35705..2531df15f 100644
--- a/meta/packages/qemu/qemu_cvs.bb
+++ b/meta/packages/qemu/qemu_cvs.bb
@@ -1,64 +1,44 @@
 LICENSE = "GPL"
 DEPENDS = "zlib"
-PV = "0.8.2+cvs${SRCDATE}"
-PR = "r4"
+PV = "0.9.0+cvs${SRCDATE}"
+PR = "r0"
 
 FILESDIR = "${WORKDIR}"
 
 SRC_URI = "\
     cvs://anonymous@cvs.savannah.nongnu.org/sources/qemu;method=pserver;rsh=ssh;module=qemu \
-    svn://svn.o-hand.com/repos/misc/trunk/qemu-packaging/qemu;module=debian;proto=http;srcdate=20070119 \
-    file://debian/patches/01_doc_typos.patch;patch=1;pnum=1 \
-    file://debian/patches/02_snapshot_use_tmpdir.patch;patch=1;pnum=0 \
-    file://debian/patches/03_machines_list_no_error.patch;patch=1;pnum=0 \
-    file://debian/patches/04_do_not_print_rtc_freq_if_ok.patch;patch=1;pnum=1 \
-    file://debian/patches/05_non-fatal_if_linux_hd_missing.patch;patch=1;pnum=1 \
-    file://debian/patches/06_exit_segfault.patch;patch=1;pnum=0 \
-    file://debian/patches/10_signal_jobs.patch;patch=1;pnum=0 \
-    file://debian/patches/11_signal_sigaction.patch;patch=1;pnum=0 \
-    file://debian/patches/12_signal_powerpc_support.patch;patch=1;pnum=1 \
-    file://debian/patches/21_net_soopts.patch;patch=1;pnum=0 \
-    file://debian/patches/22_net_tuntap_stall.patch;patch=1;pnum=0 \
-    file://debian/patches/30_syscall_ipc.patch;patch=1;pnum=0 \
-    file://debian/patches/31_syscalls.patch;patch=1;pnum=0 \
-    file://debian/patches/32_syscall_sysctl.patch;patch=1;pnum=0 \
-    file://debian/patches/33_syscall_ppc_clone.patch;patch=1;pnum=0 \
-    file://debian/patches/35_syscall_sockaddr.patch;patch=1;pnum=0 \
-    file://debian/patches/36_syscall_prctl.patch;patch=1;pnum=0 \
-    file://debian/patches/37_syscall_mount.patch;patch=1;pnum=0 \
-    file://debian/patches/38_syscall_arm_statfs64.patch;patch=1;pnum=0 \
-    file://debian/patches/39_syscall_fadvise64.patch;patch=1;pnum=0 \
-    file://debian/patches/41_arm_fpa_sigfpe.patch;patch=1;pnum=0 \
-    file://debian/patches/43_arm_cpustate.patch;patch=1;pnum=0 \
-    file://debian/patches/51_serial_small_divider.patch;patch=1;pnum=1 \
-    file://debian/patches/52_ne2000_return.patch;patch=1;pnum=1 \
-    file://debian/patches/55_unmux_socketcall.patch;patch=1;pnum=0 \
-    file://debian/patches/60_ppc_ld.patch;patch=1;pnum=1 \
-    file://debian/patches/61_safe_64bit_int.patch;patch=1;pnum=0 \
-    file://debian/patches/62_linux_boot_nasm.patch;patch=1;pnum=0 \
-    file://debian/patches/63_sparc_build.patch;patch=1;pnum=0 \
-    file://debian/patches/64_ppc_asm_constraints.patch;patch=1;pnum=1 \
-    file://debian/patches/65_kfreebsd.patch;patch=1;pnum=0 \
-    file://debian/patches/66_tls_ld.patch;patch=1;pnum=0 \
-    file://debian/patches/67_ppc_ftbfs.patch;patch=1;pnum=0 \
-    file://debian/patches/90-oh-wacom.patch;patch=1;pnum=0 \
-    file://debian/patches/91-oh-sdl-cursor.patch;patch=1;pnum=0 \
-    file://debian/patches/92-oh-pci-irq-sharing.patch;patch=1;pnum=0 \
-    file://debian/patches/93-oh-pl110-rgb.patch;patch=1;pnum=0 \
-    file://debian/patches/94-oh-arm-nptl.patch;patch=1;pnum=1 \
-    file://debian/patches/95-oh-compiler.patch;patch=1 \
-    file://debian/patches/96-x.patch;patch=1"
-#    file://debian/patches/80_ui_curses.patch;patch=1;pnum=0 \
+    file://02_snapshot_use_tmpdir.patch;patch=1;pnum=0 \
+    file://03_machines_list_no_error.patch;patch=1;pnum=0 \
+    file://04_do_not_print_rtc_freq_if_ok.patch;patch=1;pnum=1 \
+    file://05_non-fatal_if_linux_hd_missing.patch;patch=1;pnum=1 \
+    file://06_exit_segfault.patch;patch=1;pnum=0 \
+    file://10_signal_jobs.patch;patch=1;pnum=0 \
+    file://11_signal_sigaction.patch;patch=1;pnum=0 \
+    file://12_signal_powerpc_support.patch;patch=1;pnum=1 \
+    file://22_net_tuntap_stall.patch;patch=1;pnum=0 \
+    file://31_syscalls.patch;patch=1;pnum=0 \
+    file://32_syscall_sysctl.patch;patch=1;pnum=0 \
+    file://33_syscall_ppc_clone.patch;patch=1;pnum=0 \
+    file://39_syscall_fadvise64.patch;patch=1;pnum=0 \
+    file://41_arm_fpa_sigfpe.patch;patch=1;pnum=0 \
+    file://52_ne2000_return.patch;patch=1;pnum=1 \
+    file://61_safe_64bit_int.patch;patch=1;pnum=0 \
+    file://63_sparc_build.patch;patch=1;pnum=0 \
+    file://64_ppc_asm_constraints.patch;patch=1;pnum=1 \
+    file://65_kfreebsd.patch;patch=1;pnum=0 \
+    file://66_tls_ld.patch;patch=1;pnum=0 \
+    file://91-oh-sdl-cursor.patch;patch=1;pnum=0 \
+    file://93-oh-pl110-rgb.patch;patch=1;pnum=0 \
+    file://94-oh-arm-nptl.patch;patch=1;pnum=1"
 
-#           file://configure.patch;patch=1;pnum=1    \
-#           file://qemu-sdl-cursor.patch;patch=1;pnum=1    \
-#	   file://arm_nptl.patch;patch=1;pnum=1     \
-#	   file://pl110_rgb-r0.patch;patch=1;pnum=1 \
-#	   file://qemu-pci-irq-sharing.patch;patch=1;pnum=1 \
-#	   file://compiler.patch;patch=1;pnum=1 \
-#	   file://qemu-usb-wacom-0.8.2.patch;patch=1;pnum=1 \
-#           file://qemu-usb-wacom-pressure.patch;patch=1;pnum=1 \
-#	   file://qemu-usb-wacom-buttons.patch;patch=1"
+#    svn://svn.o-hand.com/repos/misc/trunk/qemu-packaging/qemu;module=debian;proto=http;srcdate=20070119 \
+#    file://debian/patches/21_net_soopts.patch;patch=1;pnum=0 \
+#    file://debian/patches/35_syscall_sockaddr.patch;patch=1;pnum=0 \
+#    file://debian/patches/43_arm_cpustate.patch;patch=1;pnum=0 \
+#    file://debian/patches/62_linux_boot_nasm.patch;patch=1;pnum=0 \
+#    file://debian/patches/67_ppc_ftbfs.patch;patch=1;pnum=0 \
+#    file://debian/patches/80_ui_curses.patch;patch=1;pnum=0 \
+#    file://debian/patches/96-x.patch;patch=1"
 
 S = "${WORKDIR}/qemu"