merge of 'dbc92be1fe4742c442c336c46478ebc072b977ed'

     and 'f37c4d25879e2b68bedfa992671306a142e8181d'

81 files changed, 67 insertions, 2067 deletions

diff --git a/packages/qemu/files/.mtn2git_empty b/packages/qemu/qemu-0.9.0+cvs20070613/.mtn2git_empty
index e69de29bb2..e69de29bb2 100644
--- a/packages/qemu/files/.mtn2git_empty
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/.mtn2git_empty
diff --git a/packages/qemu/files/02_snapshot_use_tmpdir.patch b/packages/qemu/qemu-0.9.0+cvs20070613/02_snapshot_use_tmpdir.patch
index bd955b6db3..bd955b6db3 100644
--- a/packages/qemu/files/02_snapshot_use_tmpdir.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/02_snapshot_use_tmpdir.patch
diff --git a/packages/qemu/files/03_machines_list_no_error.patch b/packages/qemu/qemu-0.9.0+cvs20070613/03_machines_list_no_error.patch
index 73f31550fe..73f31550fe 100644
--- a/packages/qemu/files/03_machines_list_no_error.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/03_machines_list_no_error.patch
diff --git a/packages/qemu/files/04_do_not_print_rtc_freq_if_ok.patch b/packages/qemu/qemu-0.9.0+cvs20070613/04_do_not_print_rtc_freq_if_ok.patch
index 1575cbce63..1575cbce63 100644
--- a/packages/qemu/files/04_do_not_print_rtc_freq_if_ok.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/04_do_not_print_rtc_freq_if_ok.patch
diff --git a/packages/qemu/files/05_non-fatal_if_linux_hd_missing.patch b/packages/qemu/qemu-0.9.0+cvs20070613/05_non-fatal_if_linux_hd_missing.patch
index b7c4732f24..b7c4732f24 100644
--- a/packages/qemu/files/05_non-fatal_if_linux_hd_missing.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/05_non-fatal_if_linux_hd_missing.patch
diff --git a/packages/qemu/files/06_exit_segfault.patch b/packages/qemu/qemu-0.9.0+cvs20070613/06_exit_segfault.patch
index 447c3550b8..447c3550b8 100644
--- a/packages/qemu/files/06_exit_segfault.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/06_exit_segfault.patch
diff --git a/packages/qemu/files/10_signal_jobs.patch b/packages/qemu/qemu-0.9.0+cvs20070613/10_signal_jobs.patch
index 794a538676..794a538676 100644
--- a/packages/qemu/files/10_signal_jobs.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/10_signal_jobs.patch
diff --git a/packages/qemu/files/11_signal_sigaction.patch b/packages/qemu/qemu-0.9.0+cvs20070613/11_signal_sigaction.patch
index 5446efc562..5446efc562 100644
--- a/packages/qemu/files/11_signal_sigaction.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/11_signal_sigaction.patch
diff --git a/packages/qemu/files/12_signal_powerpc_support.patch b/packages/qemu/qemu-0.9.0+cvs20070613/12_signal_powerpc_support.patch
index d8d4198784..d8d4198784 100644
--- a/packages/qemu/files/12_signal_powerpc_support.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/12_signal_powerpc_support.patch
diff --git a/packages/qemu/files/22_net_tuntap_stall.patch b/packages/qemu/qemu-0.9.0+cvs20070613/22_net_tuntap_stall.patch
index e9b31dfe40..e9b31dfe40 100644
--- a/packages/qemu/files/22_net_tuntap_stall.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/22_net_tuntap_stall.patch
diff --git a/packages/qemu/files/30_syscall_ipc.patch b/packages/qemu/qemu-0.9.0+cvs20070613/30_syscall_ipc.patch
index 3dc58102ad..3dc58102ad 100644
--- a/packages/qemu/files/30_syscall_ipc.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/30_syscall_ipc.patch
diff --git a/packages/qemu/files/31_syscalls.patch b/packages/qemu/qemu-0.9.0+cvs20070613/31_syscalls.patch
index 3878079f19..3878079f19 100644
--- a/packages/qemu/files/31_syscalls.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/31_syscalls.patch
diff --git a/packages/qemu/files/32_syscall_sysctl.patch b/packages/qemu/qemu-0.9.0+cvs20070613/32_syscall_sysctl.patch
index d175cf96ba..d175cf96ba 100644
--- a/packages/qemu/files/32_syscall_sysctl.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/32_syscall_sysctl.patch
diff --git a/packages/qemu/files/33_syscall_ppc_clone.patch b/packages/qemu/qemu-0.9.0+cvs20070613/33_syscall_ppc_clone.patch
index a71f8b1944..a71f8b1944 100644
--- a/packages/qemu/files/33_syscall_ppc_clone.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/33_syscall_ppc_clone.patch
diff --git a/packages/qemu/files/39_syscall_fadvise64.patch b/packages/qemu/qemu-0.9.0+cvs20070613/39_syscall_fadvise64.patch
index 0a7f4c48dd..0a7f4c48dd 100644
--- a/packages/qemu/files/39_syscall_fadvise64.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/39_syscall_fadvise64.patch
diff --git a/packages/qemu/files/41_arm_fpa_sigfpe.patch b/packages/qemu/qemu-0.9.0+cvs20070613/41_arm_fpa_sigfpe.patch
index d579dbc66e..d579dbc66e 100644
--- a/packages/qemu/files/41_arm_fpa_sigfpe.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/41_arm_fpa_sigfpe.patch
diff --git a/packages/qemu/files/52_ne2000_return.patch b/packages/qemu/qemu-0.9.0+cvs20070613/52_ne2000_return.patch
index f0316c8042..f0316c8042 100644
--- a/packages/qemu/files/52_ne2000_return.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/52_ne2000_return.patch
diff --git a/packages/qemu/files/61_safe_64bit_int.patch b/packages/qemu/qemu-0.9.0+cvs20070613/61_safe_64bit_int.patch
index 553e57623e..553e57623e 100644
--- a/packages/qemu/files/61_safe_64bit_int.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/61_safe_64bit_int.patch
diff --git a/packages/qemu/files/63_sparc_build.patch b/packages/qemu/qemu-0.9.0+cvs20070613/63_sparc_build.patch
index 32a6bc0ee0..32a6bc0ee0 100644
--- a/packages/qemu/files/63_sparc_build.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/63_sparc_build.patch
diff --git a/packages/qemu/files/64_ppc_asm_constraints.patch b/packages/qemu/qemu-0.9.0+cvs20070613/64_ppc_asm_constraints.patch
index e4858b79d7..e4858b79d7 100644
--- a/packages/qemu/files/64_ppc_asm_constraints.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/64_ppc_asm_constraints.patch
diff --git a/packages/qemu/files/65_kfreebsd.patch b/packages/qemu/qemu-0.9.0+cvs20070613/65_kfreebsd.patch
index ea060811a1..ea060811a1 100644
--- a/packages/qemu/files/65_kfreebsd.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/65_kfreebsd.patch
diff --git a/packages/qemu/files/66_tls_ld.patch b/packages/qemu/qemu-0.9.0+cvs20070613/66_tls_ld.patch
index 54e02eff8b..54e02eff8b 100644
--- a/packages/qemu/files/66_tls_ld.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/66_tls_ld.patch
diff --git a/packages/qemu/files/91-oh-sdl-cursor.patch b/packages/qemu/qemu-0.9.0+cvs20070613/91-oh-sdl-cursor.patch
index 5280a5bd4a..5280a5bd4a 100644
--- a/packages/qemu/files/91-oh-sdl-cursor.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/91-oh-sdl-cursor.patch
diff --git a/packages/qemu/files/93-oh-pl110-rgb.patch b/packages/qemu/qemu-0.9.0+cvs20070613/93-oh-pl110-rgb.patch
index 4911ac131f..4911ac131f 100644
--- a/packages/qemu/files/93-oh-pl110-rgb.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/93-oh-pl110-rgb.patch
diff --git a/packages/qemu/files/arm_nptl.patch b/packages/qemu/qemu-0.9.0+cvs20070613/arm_nptl.patch
index f9b10aebc5..f9b10aebc5 100644
--- a/packages/qemu/files/arm_nptl.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/arm_nptl.patch
diff --git a/packages/qemu/files/compiler.patch b/packages/qemu/qemu-0.9.0+cvs20070613/compiler.patch
index dad18b3a61..dad18b3a61 100644
--- a/packages/qemu/files/compiler.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/compiler.patch
diff --git a/packages/qemu/files/configure.patch b/packages/qemu/qemu-0.9.0+cvs20070613/configure.patch
index ea83f8cd6d..ea83f8cd6d 100644
--- a/packages/qemu/files/configure.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/configure.patch
diff --git a/packages/qemu/files/fix_segfault.patch b/packages/qemu/qemu-0.9.0+cvs20070613/fix_segfault.patch
index 976c75cd60..976c75cd60 100644
--- a/packages/qemu/files/fix_segfault.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/fix_segfault.patch
diff --git a/packages/qemu/files/makefile.patch b/packages/qemu/qemu-0.9.0+cvs20070613/makefile.patch
index 75b5ac9c71..75b5ac9c71 100644
--- a/packages/qemu/files/makefile.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/makefile.patch
diff --git a/packages/qemu/files/no-strip.patch b/packages/qemu/qemu-0.9.0+cvs20070613/no-strip.patch
index 59ed8771fe..59ed8771fe 100644
--- a/packages/qemu/files/no-strip.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/no-strip.patch
diff --git a/packages/qemu/files/pl110_rgb-r0.patch b/packages/qemu/qemu-0.9.0+cvs20070613/pl110_rgb-r0.patch
index 09e5898d3a..09e5898d3a 100644
--- a/packages/qemu/files/pl110_rgb-r0.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/pl110_rgb-r0.patch
diff --git a/packages/qemu/files/qemu-0.9.0-nptl-update.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-0.9.0-nptl-update.patch
index 869acba2cf..869acba2cf 100644
--- a/packages/qemu/files/qemu-0.9.0-nptl-update.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-0.9.0-nptl-update.patch
diff --git a/packages/qemu/files/qemu-0.9.0-nptl.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-0.9.0-nptl.patch
index fc7b0cfa4b..fc7b0cfa4b 100644
--- a/packages/qemu/files/qemu-0.9.0-nptl.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-0.9.0-nptl.patch
diff --git a/packages/qemu/files/qemu-amd64-32b-mapping-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-amd64-32b-mapping-0.9.0.patch
index d9303e3464..d9303e3464 100644
--- a/packages/qemu/files/qemu-amd64-32b-mapping-0.9.0.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-amd64-32b-mapping-0.9.0.patch
diff --git a/packages/qemu/files/qemu-pci-irq-sharing.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-pci-irq-sharing.patch
index c47e89895f..c47e89895f 100644
--- a/packages/qemu/files/qemu-pci-irq-sharing.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-pci-irq-sharing.patch
diff --git a/packages/qemu/files/qemu-sdl-cursor.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-sdl-cursor.patch
index bd6a51a1f5..bd6a51a1f5 100644
--- a/packages/qemu/files/qemu-sdl-cursor.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-sdl-cursor.patch
diff --git a/packages/qemu/files/qemu-usb-wacom-0.8.2.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-0.8.2.patch
index 33a6db3f18..33a6db3f18 100644
--- a/packages/qemu/files/qemu-usb-wacom-0.8.2.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-0.8.2.patch
diff --git a/packages/qemu/files/qemu-usb-wacom-buttons.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-buttons.patch
index ee24c15780..ee24c15780 100644
--- a/packages/qemu/files/qemu-usb-wacom-buttons.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-buttons.patch
diff --git a/packages/qemu/files/qemu-usb-wacom-pressure.patch b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-pressure.patch
index 668d50d5f2..668d50d5f2 100644
--- a/packages/qemu/files/qemu-usb-wacom-pressure.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/qemu-usb-wacom-pressure.patch
diff --git a/packages/qemu/files/workaround_bad_futex_headers.patch b/packages/qemu/qemu-0.9.0+cvs20070613/workaround_bad_futex_headers.patch
index cc122ebdba..cc122ebdba 100644
--- a/packages/qemu/files/workaround_bad_futex_headers.patch
+++ b/packages/qemu/qemu-0.9.0+cvs20070613/workaround_bad_futex_headers.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch
deleted file mode 100644
index fe1f0945b6..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/arm_nptl-0.9.0.patch
+++ /dev/null
@@ -1,853 +0,0 @@
-diff -Naru qemu-snapshot-2007-06-24_05.orig/configure qemu-snapshot-2007-06-24_05/configure
---- qemu-snapshot-2007-06-24_05.orig/configure	2007-06-24 16:31:54.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/configure	2007-06-24 16:33:58.000000000 +0200
-@@ -101,6 +101,7 @@
- darwin_user="no"
- build_docs="no"
- uname_release=""
-+nptl="yes"
- 
- # OS specific
- targetos=`uname -s`
-@@ -287,6 +288,8 @@
-         *)     echo "undefined SPARC architecture. Exiting";exit 1;;
-       esac
-   ;;
-+  --disable-nptl) nptl="no"
-+  ;;
-   esac
- done
- 
-@@ -530,6 +533,23 @@
- }
- EOF
- 
-+# check NPTL support
-+cat > $TMPC <<EOF
-+#include <sched.h>
-+void foo()
-+{
-+#ifndef CLONE_SETTLS
-+#error bork
-+#endif
-+}
-+EOF
-+
-+if $cc -c -o $TMPO $TMPC 2> /dev/null ; then
-+  :
-+else
-+   nptl="no"
-+fi
-+
- ##########################################
- # SDL probe
- 
-@@ -681,6 +701,7 @@
-     echo "Target Sparc Arch $sparc_cpu"
- fi
- echo "kqemu support     $kqemu"
-+echo "NPTL support      $nptl"
- echo "Documentation     $build_docs"
- [ ! -z "$uname_release" ] && \
- echo "uname -r          $uname_release"
-@@ -1063,6 +1084,14 @@
-             echo "SDL_CFLAGS=`$sdl_config --cflags`" >> $config_mak
-         fi
-     fi
-+else
-+    if test "$nptl" = "yes" ; then
-+        case "$target_cpu" in
-+          arm | armeb)
-+            echo "#define USE_NPTL 1" >> $config_h
-+          ;;
-+        esac
-+    fi
- fi
- 
- if test "$cocoa" = "yes" ; then
-diff -Naru qemu-snapshot-2007-06-24_05.orig/exec-all.h qemu-snapshot-2007-06-24_05/exec-all.h
---- qemu-snapshot-2007-06-24_05.orig/exec-all.h	2007-05-23 21:58:10.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/exec-all.h	2007-06-24 16:33:58.000000000 +0200
-@@ -360,170 +360,7 @@
- extern CPUReadMemoryFunc *io_mem_read[IO_MEM_NB_ENTRIES][4];
- extern void *io_mem_opaque[IO_MEM_NB_ENTRIES];
- 
--#if defined(__powerpc__)
--static inline int testandset (int *p)
--{
--    int ret;
--    __asm__ __volatile__ (
--                          "0:    lwarx %0,0,%1\n"
--                          "      xor. %0,%3,%0\n"
--                          "      bne 1f\n"
--                          "      stwcx. %2,0,%1\n"
--                          "      bne- 0b\n"
--                          "1:    "
--                          : "=&r" (ret)
--                          : "r" (p), "r" (1), "r" (0)
--                          : "cr0", "memory");
--    return ret;
--}
--#elif defined(__i386__)
--static inline int testandset (int *p)
--{
--    long int readval = 0;
--    
--    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
--                          : "+m" (*p), "+a" (readval)
--                          : "r" (1)
--                          : "cc");
--    return readval;
--}
--#elif defined(__x86_64__)
--static inline int testandset (int *p)
--{
--    long int readval = 0;
--    
--    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
--                          : "+m" (*p), "+a" (readval)
--                          : "r" (1)
--                          : "cc");
--    return readval;
--}
--#elif defined(__s390__)
--static inline int testandset (int *p)
--{
--    int ret;
--
--    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
--			  "   jl    0b"
--			  : "=&d" (ret)
--			  : "r" (1), "a" (p), "0" (*p) 
--			  : "cc", "memory" );
--    return ret;
--}
--#elif defined(__alpha__)
--static inline int testandset (int *p)
--{
--    int ret;
--    unsigned long one;
--
--    __asm__ __volatile__ ("0:	mov 1,%2\n"
--			  "	ldl_l %0,%1\n"
--			  "	stl_c %2,%1\n"
--			  "	beq %2,1f\n"
--			  ".subsection 2\n"
--			  "1:	br 0b\n"
--			  ".previous"
--			  : "=r" (ret), "=m" (*p), "=r" (one)
--			  : "m" (*p));
--    return ret;
--}
--#elif defined(__sparc__)
--static inline int testandset (int *p)
--{
--	int ret;
--
--	__asm__ __volatile__("ldstub	[%1], %0"
--			     : "=r" (ret)
--			     : "r" (p)
--			     : "memory");
--
--	return (ret ? 1 : 0);
--}
--#elif defined(__arm__)
--static inline int testandset (int *spinlock)
--{
--    register unsigned int ret;
--    __asm__ __volatile__("swp %0, %1, [%2]"
--                         : "=r"(ret)
--                         : "0"(1), "r"(spinlock));
--    
--    return ret;
--}
--#elif defined(__mc68000)
--static inline int testandset (int *p)
--{
--    char ret;
--    __asm__ __volatile__("tas %1; sne %0"
--                         : "=r" (ret)
--                         : "m" (p)
--                         : "cc","memory");
--    return ret;
--}
--#elif defined(__ia64)
--
--#include <ia64intrin.h>
--
--static inline int testandset (int *p)
--{
--    return __sync_lock_test_and_set (p, 1);
--}
--#elif defined(__mips__)
--static inline int testandset (int *p)
--{
--    int ret;
--
--    __asm__ __volatile__ (
--	"	.set push		\n"
--	"	.set noat		\n"
--	"	.set mips2		\n"
--	"1:	li	$1, 1		\n"
--	"	ll	%0, %1		\n"
--	"	sc	$1, %1		\n"
--	"	beqz	$1, 1b		\n"
--	"	.set pop		"
--	: "=r" (ret), "+R" (*p)
--	:
--	: "memory");
--
--    return ret;
--}
--#else
--#error unimplemented CPU support
--#endif
--
--typedef int spinlock_t;
--
--#define SPIN_LOCK_UNLOCKED 0
--
--#if defined(CONFIG_USER_ONLY)
--static inline void spin_lock(spinlock_t *lock)
--{
--    while (testandset(lock));
--}
--
--static inline void spin_unlock(spinlock_t *lock)
--{
--    *lock = 0;
--}
--
--static inline int spin_trylock(spinlock_t *lock)
--{
--    return !testandset(lock);
--}
--#else
--static inline void spin_lock(spinlock_t *lock)
--{
--}
--
--static inline void spin_unlock(spinlock_t *lock)
--{
--}
--
--static inline int spin_trylock(spinlock_t *lock)
--{
--    return 1;
--}
--#endif
-+#include "qemu_spinlock.h"
- 
- extern spinlock_t tb_lock;
- 
-diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/arm/syscall.h qemu-snapshot-2007-06-24_05/linux-user/arm/syscall.h
---- qemu-snapshot-2007-06-24_05.orig/linux-user/arm/syscall.h	2005-04-27 22:11:21.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/linux-user/arm/syscall.h	2007-06-24 16:33:58.000000000 +0200
-@@ -28,7 +28,9 @@
- #define ARM_SYSCALL_BASE	0x900000
- #define ARM_THUMB_SYSCALL	0
- 
--#define ARM_NR_cacheflush (ARM_SYSCALL_BASE + 0xf0000 + 2)
-+#define ARM_NR_BASE	  0xf0000
-+#define ARM_NR_cacheflush (ARM_NR_BASE + 2)
-+#define ARM_NR_set_tls	  (ARM_NR_BASE + 5)
- 
- #define ARM_NR_semihosting	  0x123456
- #define ARM_NR_thumb_semihosting  0xAB
-diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/main.c qemu-snapshot-2007-06-24_05/linux-user/main.c
---- qemu-snapshot-2007-06-24_05.orig/linux-user/main.c	2007-06-22 00:55:02.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/linux-user/main.c	2007-06-24 16:33:58.000000000 +0200
-@@ -325,6 +325,50 @@
-     }
- }
- 
-+/* Handle a jump to the kernel code page.  */
-+static int
-+do_kernel_trap(CPUARMState *env)
-+{
-+    uint32_t addr;
-+    uint32_t *ptr;
-+    uint32_t cpsr;
-+
-+    switch (env->regs[15]) {
-+    case 0xffff0fc0: /* __kernel_cmpxchg */
-+        /* XXX: This only works between threads, not between processes.
-+           Use native atomic operations.  */
-+        /* ??? This probably breaks horribly if the access segfaults.  */
-+        cpu_lock();
-+        ptr = (uint32_t *)env->regs[2];
-+        cpsr = cpsr_read(env);
-+        if (*ptr == env->regs[0]) {
-+            *ptr = env->regs[1];
-+            env->regs[0] = 0;
-+            cpsr |= CPSR_C;
-+        } else {
-+            env->regs[0] = -1;
-+            cpsr &= ~CPSR_C;
-+        }
-+        cpsr_write(env, cpsr, CPSR_C);
-+        cpu_unlock();
-+        break;
-+    case 0xffff0fe0: /* __kernel_get_tls */
-+        env->regs[0] = env->cp15.c13_tls;
-+        break;
-+    default:
-+        return 1;
-+    }
-+    /* Jump back to the caller.  */
-+    addr = env->regs[14];
-+    if (addr & 1) {
-+        env->thumb = 1;
-+        addr &= ~1;
-+    }
-+    env->regs[15] = addr;
-+
-+    return 0;
-+}
-+
- void cpu_loop(CPUARMState *env)
- {
-     int trapnr;
-@@ -381,10 +425,8 @@
-                     }
-                 }
- 
--                if (n == ARM_NR_cacheflush) {
--                    arm_cache_flush(env->regs[0], env->regs[1]);
--                } else if (n == ARM_NR_semihosting
--                           || n == ARM_NR_thumb_semihosting) {
-+                if (n == ARM_NR_semihosting
-+                    || n == ARM_NR_thumb_semihosting) {
-                     env->regs[0] = do_arm_semihosting (env);
-                 } else if (n == 0 || n >= ARM_SYSCALL_BASE
-                            || (env->thumb && n == ARM_THUMB_SYSCALL)) {
-@@ -395,14 +437,34 @@
-                         n -= ARM_SYSCALL_BASE;
-                         env->eabi = 0;
-                     }
--                    env->regs[0] = do_syscall(env, 
--                                              n, 
--                                              env->regs[0],
--                                              env->regs[1],
--                                              env->regs[2],
--                                              env->regs[3],
--                                              env->regs[4],
--                                              env->regs[5]);
-+                    if ( n > ARM_NR_BASE) {
-+                        switch (n)
-+                          {
-+                          case ARM_NR_cacheflush:
-+                              arm_cache_flush(env->regs[0], env->regs[1]);
-+                              break;
-+#ifdef USE_NPTL
-+                          case ARM_NR_set_tls:
-+                              cpu_set_tls(env, env->regs[0]);
-+                              env->regs[0] = 0;
-+                              break;
-+#endif
-+                          default:
-+                              printf ("Error: Bad syscall: %x\n", n);
-+                              goto error;
-+                          }
-+                      }
-+                    else
-+                      {
-+                        env->regs[0] = do_syscall(env, 
-+                                                  n, 
-+                                                  env->regs[0],
-+                                                  env->regs[1],
-+                                                  env->regs[2],
-+                                                  env->regs[3],
-+                                                  env->regs[4],
-+                                                  env->regs[5]);
-+                      }
-                 } else {
-                     goto error;
-                 }
-@@ -441,6 +503,10 @@
-                   }
-             }
-             break;
-+        case EXCP_KERNEL_TRAP:
-+            if (do_kernel_trap(env))
-+              goto error;
-+            break;
-         default:
-         error:
-             fprintf(stderr, "qemu: unhandled CPU exception 0x%x - aborting\n", 
-@@ -2074,6 +2140,10 @@
-     ts->heap_base = info->brk;
-     /* This will be filled in on the first SYS_HEAPINFO call.  */
-     ts->heap_limit = 0;
-+    /* Register the magic kernel code page.  The cpu will generate a
-+       special exception when it tries to execute code here.  We can't
-+       put real code here because it may be in use by the host kernel.  */
-+    page_set_flags(0xffff0000, 0xffff0fff, 0);
- #endif
- 
-     if (gdbstub_port) {
-diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/qemu.h qemu-snapshot-2007-06-24_05/linux-user/qemu.h
---- qemu-snapshot-2007-06-24_05.orig/linux-user/qemu.h	2007-05-26 17:09:38.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/linux-user/qemu.h	2007-06-24 16:33:58.000000000 +0200
-@@ -81,6 +81,9 @@
-     uint32_t heap_limit;
- #endif
-     int used; /* non zero if used */
-+#ifdef USE_NPTL
-+    uint32_t *child_tidptr;
-+#endif
-     struct image_info *info;
-     uint8_t stack[0];
- } __attribute__((aligned(16))) TaskState;
-diff -Naru qemu-snapshot-2007-06-24_05.orig/linux-user/syscall.c qemu-snapshot-2007-06-24_05/linux-user/syscall.c
---- qemu-snapshot-2007-06-24_05.orig/linux-user/syscall.c	2007-06-21 23:57:11.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/linux-user/syscall.c	2007-06-24 16:33:58.000000000 +0200
-@@ -70,9 +70,18 @@
- #include <linux/kd.h>
- 
- #include "qemu.h"
-+#include "qemu_spinlock.h"
- 
- //#define DEBUG
- 
-+#ifdef USE_NPTL
-+#define CLONE_NPTL_FLAGS2 (CLONE_SETTLS | \
-+    CLONE_PARENT_SETTID | CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID)
-+#else
-+/* XXX: Hardcode the above values.  */
-+#define CLONE_NPTL_FLAGS2 0
-+#endif
-+
- #if defined(TARGET_I386) || defined(TARGET_ARM) || defined(TARGET_SPARC) \
-     || defined(TARGET_M68K) || defined(TARGET_SH4)
- /* 16 bit uid wrappers emulation */
-@@ -2121,20 +2130,38 @@
-    thread/process */
- #define NEW_STACK_SIZE 8192
- 
-+#ifdef USE_NPTL
-+static spinlock_t nptl_lock = SPIN_LOCK_UNLOCKED;
-+#endif
-+
- static int clone_func(void *arg)
- {
-     CPUState *env = arg;
-+#ifdef HAVE_NPTL
-+    /* Wait until the parent has finshed initializing the tls state.  */
-+    while (!spin_trylock(&nptl_lock))
-+        usleep(1);
-+    spin_unlock(&nptl_lock);
-+#endif
-     cpu_loop(env);
-     /* never exits */
-     return 0;
- }
- 
--int do_fork(CPUState *env, unsigned int flags, unsigned long newsp)
-+int do_fork(CPUState *env, unsigned int flags, unsigned long newsp,
-+            uint32_t *parent_tidptr, void *newtls,
-+            uint32_t *child_tidptr)
- {
-     int ret;
-     TaskState *ts;
-     uint8_t *new_stack;
-     CPUState *new_env;
-+#ifdef USE_NPTL
-+    unsigned int nptl_flags;
-+
-+    if (flags & CLONE_PARENT_SETTID)
-+        *parent_tidptr = gettid();
-+#endif
-     
-     if (flags & CLONE_VM) {
-         ts = malloc(sizeof(TaskState) + NEW_STACK_SIZE);
-@@ -2201,16 +2228,60 @@
- #error unsupported target CPU
- #endif
-         new_env->opaque = ts;
-+#ifdef USE_NPTL
-+     nptl_flags = flags;
-+     flags &= ~CLONE_NPTL_FLAGS2;
-+     if (nptl_flags & CLONE_CHILD_CLEARTID) {
-+          ts->child_tidptr = child_tidptr;
-+     }
-+     if (nptl_flags & CLONE_SETTLS)
-+         cpu_set_tls (new_env, newtls);
-+     /* Grab the global cpu lock so that the thread setup appears
-+        atomic.  */
-+     if (nptl_flags & CLONE_CHILD_SETTID)
-+         spin_lock(&nptl_lock);
-+#else
-+     if (flags & CLONE_NPTL_FLAGS2)
-+         return -EINVAL;
-+#endif
-+
- #ifdef __ia64__
-         ret = __clone2(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
- #else
- 	ret = clone(clone_func, new_stack + NEW_STACK_SIZE, flags, new_env);
- #endif
-+#ifdef USE_NPTL
-+     if (ret != -1) {
-+         if (nptl_flags & CLONE_CHILD_SETTID)
-+             *child_tidptr = ret;
-+     }
-+     /* Allow the child to continue.  */
-+     if (nptl_flags & CLONE_CHILD_SETTID)
-+         spin_unlock(&nptl_lock);
-+#endif
-     } else {
--        /* if no CLONE_VM, we consider it is a fork */
--        if ((flags & ~CSIGNAL) != 0)
--            return -EINVAL;
--        ret = fork();
-+    /* if no CLONE_VM, we consider it is a fork */
-+    if ((flags & ~(CSIGNAL | CLONE_NPTL_FLAGS2)) != 0)
-+          return -EINVAL;
-+      ret = fork();
-+#ifdef USE_NPTL
-+     /* There is a race condition here.  The parent process could
-+        theoretically read the TID in the child process before the child
-+        tid is set.  This would require using either ptrace
-+        (not implemented) or having *_tidptr to point at a shared memory
-+        mapping.  We can't repeat the spinlock hack used above because
-+        the child process gets its own copy of the lock.  */
-+     if (ret == 0) {
-+         /* Child Process.  */
-+         if (flags & CLONE_CHILD_SETTID)
-+             *child_tidptr = gettid();
-+         ts = (TaskState *)env->opaque;
-+         if (flags & CLONE_CHILD_CLEARTID)
-+             ts->child_tidptr = child_tidptr;
-+         if (flags & CLONE_SETTLS)
-+             cpu_set_tls (env, newtls);
-+     }
-+#endif
-     }
-     return ret;
- }
-@@ -2487,7 +2558,7 @@
-         ret = do_brk(arg1);
-         break;
-     case TARGET_NR_fork:
--        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0));
-+        ret = get_errno(do_fork(cpu_env, SIGCHLD, 0, NULL, NULL, NULL));
-         break;
- #ifdef TARGET_NR_waitpid
-     case TARGET_NR_waitpid:
-@@ -3651,7 +3722,8 @@
-         ret = get_errno(fsync(arg1));
-         break;
-     case TARGET_NR_clone:
--        ret = get_errno(do_fork(cpu_env, arg1, arg2));
-+        ret = get_errno(do_fork(cpu_env, arg1, arg2, (uint32_t *)arg3,
-+                        (void *)arg4, (uint32_t *)arg5));
-         break;
- #ifdef __NR_exit_group
-         /* new thread calls */
-@@ -4039,7 +4111,8 @@
- #endif
- #ifdef TARGET_NR_vfork
-     case TARGET_NR_vfork:
--        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0));
-+        ret = get_errno(do_fork(cpu_env, CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
-+                                NULL, NULL, NULL));
-         break;
- #endif
- #ifdef TARGET_NR_ugetrlimit
-@@ -4632,4 +4705,3 @@
- #endif
-     return ret;
- }
--
-diff -Naru qemu-snapshot-2007-06-24_05.orig/qemu_spinlock.h qemu-snapshot-2007-06-24_05/qemu_spinlock.h
---- qemu-snapshot-2007-06-24_05.orig/qemu_spinlock.h	1970-01-01 01:00:00.000000000 +0100
-+++ qemu-snapshot-2007-06-24_05/qemu_spinlock.h	2007-06-24 16:33:58.000000000 +0200
-@@ -0,0 +1,182 @@
-+/*
-+ * internal execution defines for qemu
-+ *
-+ *  Copyright (c) 2003 Fabrice Bellard
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, write to the Free Software
-+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-+ */
-+
-+#ifndef _QEMU_SPINLOCK_H
-+#define _QEMU_SPINLOCK_H
-+
-+#ifdef __powerpc__
-+static inline int testandset (int *p)
-+{
-+    int ret;
-+    __asm__ __volatile__ (
-+                          "0:    lwarx %0,0,%1\n"
-+                          "      xor. %0,%3,%0\n"
-+                          "      bne 1f\n"
-+                          "      stwcx. %2,0,%1\n"
-+                          "      bne- 0b\n"
-+                          "1:    "
-+                          : "=&r" (ret)
-+                          : "r" (p), "r" (1), "r" (0)
-+                          : "cr0", "memory");
-+    return ret;
-+}
-+#endif
-+
-+#ifdef __i386__
-+static inline int testandset (int *p)
-+{
-+    long int readval = 0;
-+
-+    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
-+                          : "+m" (*p), "+a" (readval)
-+                          : "r" (1)
-+                          : "cc");
-+    return readval;
-+}
-+#endif
-+
-+#ifdef __x86_64__
-+static inline int testandset (int *p)
-+{
-+    long int readval = 0;
-+
-+    __asm__ __volatile__ ("lock; cmpxchgl %2, %0"
-+                          : "+m" (*p), "+a" (readval)
-+                          : "r" (1)
-+                          : "cc");
-+    return readval;
-+}
-+#endif
-+
-+#ifdef __s390__
-+static inline int testandset (int *p)
-+{
-+    int ret;
-+
-+    __asm__ __volatile__ ("0: cs    %0,%1,0(%2)\n"
-+                         "   jl    0b"
-+                         : "=&d" (ret)
-+                         : "r" (1), "a" (p), "0" (*p)
-+                         : "cc", "memory" );
-+    return ret;
-+}
-+#endif
-+
-+#ifdef __alpha__
-+static inline int testandset (int *p)
-+{
-+    int ret;
-+    unsigned long one;
-+
-+    __asm__ __volatile__ ("0:  mov 1,%2\n"
-+                         "     ldl_l %0,%1\n"
-+                         "     stl_c %2,%1\n"
-+                         "     beq %2,1f\n"
-+                         ".subsection 2\n"
-+                         "1:   br 0b\n"
-+                         ".previous"
-+                         : "=r" (ret), "=m" (*p), "=r" (one)
-+                         : "m" (*p));
-+    return ret;
-+}
-+#endif
-+
-+#ifdef __sparc__
-+static inline int testandset (int *p)
-+{
-+       int ret;
-+
-+       __asm__ __volatile__("ldstub    [%1], %0"
-+                            : "=r" (ret)
-+                            : "r" (p)
-+                            : "memory");
-+
-+       return (ret ? 1 : 0);
-+}
-+#endif
-+
-+#ifdef __arm__
-+static inline int testandset (int *spinlock)
-+{
-+    register unsigned int ret;
-+    __asm__ __volatile__("swp %0, %1, [%2]"
-+                         : "=r"(ret)
-+                         : "0"(1), "r"(spinlock));
-+
-+    return ret;
-+}
-+#endif
-+
-+#ifdef __mc68000
-+static inline int testandset (int *p)
-+{
-+    char ret;
-+    __asm__ __volatile__("tas %1; sne %0"
-+                         : "=r" (ret)
-+                         : "m" (p)
-+                         : "cc","memory");
-+    return ret;
-+}
-+#endif
-+
-+#ifdef __ia64
-+#include <ia64intrin.h>
-+
-+static inline int testandset (int *p)
-+{
-+    return __sync_lock_test_and_set (p, 1);
-+}
-+#endif
-+
-+typedef int spinlock_t;
-+
-+#define SPIN_LOCK_UNLOCKED 0
-+
-+#if defined(CONFIG_USER_ONLY)
-+static inline void spin_lock(spinlock_t *lock)
-+{
-+    while (testandset(lock));
-+}
-+
-+static inline void spin_unlock(spinlock_t *lock)
-+{
-+    *lock = 0;
-+}
-+
-+static inline int spin_trylock(spinlock_t *lock)
-+{
-+    return !testandset(lock);
-+}
-+#else
-+static inline void spin_lock(spinlock_t *lock)
-+{
-+}
-+
-+static inline void spin_unlock(spinlock_t *lock)
-+{
-+}
-+
-+static inline int spin_trylock(spinlock_t *lock)
-+{
-+    return 1;
-+}
-+#endif
-+
-+#endif /* ! _QEMU_SPINLOCK_H */
-diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/cpu.h qemu-snapshot-2007-06-24_05/target-arm/cpu.h
---- qemu-snapshot-2007-06-24_05.orig/target-arm/cpu.h	2007-06-03 23:02:37.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/target-arm/cpu.h	2007-06-24 16:33:58.000000000 +0200
-@@ -37,6 +37,9 @@
- #define EXCP_IRQ             5
- #define EXCP_FIQ             6
- #define EXCP_BKPT            7
-+#define EXCP_KERNEL_TRAP     8   /* Jumped to kernel code page.  */
-+
-+
- 
- typedef void ARMWriteCPFunc(void *opaque, int cp_info,
-                             int srcreg, int operand, uint32_t value);
-@@ -97,6 +100,7 @@
-         uint32_t c9_data;
-         uint32_t c13_fcse; /* FCSE PID.  */
-         uint32_t c13_context; /* Context ID.  */
-+	uint32_t c13_tls; /* Paul Brook told me to just add this ;) */
-         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
-     } cp15;
- 
-@@ -169,6 +173,15 @@
- int cpu_arm_signal_handler(int host_signum, void *pinfo, 
-                            void *puc);
- 
-+void cpu_lock(void);
-+void cpu_unlock(void);
-+#if defined(USE_NPTL)
-+static inline void cpu_set_tls(CPUARMState *env, void *newtls)
-+{
-+  env->cp15.c13_tls = (uint32_t)newtls;
-+}
-+#endif
-+
- #define CPSR_M (0x1f)
- #define CPSR_T (1 << 5)
- #define CPSR_F (1 << 6)
-@@ -180,7 +193,11 @@
- #define CPSR_J (1 << 24)
- #define CPSR_IT_0_1 (3 << 25)
- #define CPSR_Q (1 << 27)
--#define CPSR_NZCV (0xf << 28)
-+#define CPSR_V (1 << 28)
-+#define CPSR_C (1 << 29)
-+#define CPSR_Z (1 << 30)
-+#define CPSR_N (1 << 31)
-+#define CPSR_NZCV (CPSR_N | CPSR_Z | CPSR_C | CPSR_V)
- 
- #define CACHED_CPSR_BITS (CPSR_T | CPSR_Q | CPSR_NZCV)
- /* Return the current CPSR value.  */
-diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/exec.h qemu-snapshot-2007-06-24_05/target-arm/exec.h
---- qemu-snapshot-2007-06-24_05.orig/target-arm/exec.h	2007-06-03 19:44:36.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/target-arm/exec.h	2007-06-24 16:33:58.000000000 +0200
-@@ -68,8 +68,6 @@
- 
- /* In op_helper.c */
- 
--void cpu_lock(void);
--void cpu_unlock(void);
- void helper_set_cp(CPUState *, uint32_t, uint32_t);
- uint32_t helper_get_cp(CPUState *, uint32_t);
- void helper_set_cp15(CPUState *, uint32_t, uint32_t);
-diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/op.c qemu-snapshot-2007-06-24_05/target-arm/op.c
---- qemu-snapshot-2007-06-24_05.orig/target-arm/op.c	2007-05-21 19:48:01.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/target-arm/op.c	2007-06-24 16:33:58.000000000 +0200
-@@ -891,6 +891,12 @@
-     cpu_loop_exit();
- }
- 
-+void OPPROTO op_kernel_trap(void)
-+{
-+    env->exception_index = EXCP_KERNEL_TRAP;
-+    cpu_loop_exit();
-+}
-+
- /* VFP support.  We follow the convention used for VFP instrunctions:
-    Single precition routines have a "s" suffix, double precision a
-    "d" suffix.  */
-diff -Naru qemu-snapshot-2007-06-24_05.orig/target-arm/translate.c qemu-snapshot-2007-06-24_05/target-arm/translate.c
---- qemu-snapshot-2007-06-24_05.orig/target-arm/translate.c	2007-06-11 20:59:35.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/target-arm/translate.c	2007-06-24 16:33:58.000000000 +0200
-@@ -3513,6 +3513,7 @@
-     s->is_jmp = DISAS_JUMP;
- }
- 
-+
- /* generate intermediate code in gen_opc_buf and gen_opparam_buf for
-    basic block 'tb'. If search_pc is TRUE, also generate PC
-    information for each intermediate instruction. */
-@@ -3548,6 +3549,15 @@
-     nb_gen_labels = 0;
-     lj = -1;
-     do {
-+#ifdef CONFIG_USER_ONLY
-+        /* Intercept jump to the magic kernel page.  */
-+        if (dc->pc > 0xffff0000) {
-+            gen_op_kernel_trap();
-+            dc->is_jmp = DISAS_UPDATE;
-+            break;
-+        }
-+#endif
-+
-         if (env->nb_breakpoints > 0) {
-             for(j = 0; j < env->nb_breakpoints; j++) {
-                 if (env->breakpoints[j] == dc->pc) {
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch
deleted file mode 100644
index d92f6a8264..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/configure-0.9.0.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naru qemu-snapshot-2007-06-24_05.orig/configure qemu-snapshot-2007-06-24_05/configure
---- qemu-snapshot-2007-06-24_05.orig/configure	2007-06-23 18:03:35.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/configure	2007-06-24 16:30:32.000000000 +0200
-@@ -711,7 +711,7 @@
- echo "CC=$cc" >> $config_mak
- echo "HOST_CC=$host_cc" >> $config_mak
- echo "AR=$ar" >> $config_mak
--echo "STRIP=$strip -s -R .comment -R .note" >> $config_mak
-+echo "STRIP=$strip" >> $config_mak
- echo "OS_CFLAGS=$OS_CFLAGS" >> $config_mak
- echo "OS_LDFLAGS=$OS_LDFLAGS" >> $config_mak
- echo "ARCH_CFLAGS=$ARCH_CFLAGS" >> $config_mak
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch
deleted file mode 100644
index 3ad4115e73..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/pl110_rgb-r0-0.9.0.patch
+++ /dev/null
@@ -1,217 +0,0 @@
-diff -Naru qemu-neo1973.orig/hw/pl110.c qemu-neo1973/hw/pl110.c
---- qemu-neo1973.orig/hw/pl110.c	2007-06-24 13:56:37.000000000 +0200
-+++ qemu-neo1973/hw/pl110.c	2007-06-24 14:12:09.000000000 +0200
-@@ -10,6 +10,7 @@
- #include "vl.h"
- 
- #define PL110_CR_EN   0x001
-+#define PL110_CR_BGR  0x100
- #define PL110_CR_BEBO 0x200
- #define PL110_CR_BEPO 0x400
- #define PL110_CR_PWR  0x800
-@@ -114,6 +115,7 @@
-     int first, last = 0;
-     int dirty, new_dirty;
-     int i;
-+    int bpp_offset;
- 
-     if (!pl110_enabled(s))
-         return;
-@@ -145,12 +147,17 @@
-         fprintf(stderr, "pl110: Bad color depth\n");
-         exit(1);
-     }
-+    if (s->cr & PL110_CR_BGR)
-+	bpp_offset = 0;
-+    else
-+	bpp_offset = 18;
-+
-     if (s->cr & PL110_CR_BEBO)
--      fn = fntable[s->bpp + 6];
-+      fn = fntable[s->bpp + 6 + bpp_offset];
-     else if (s->cr & PL110_CR_BEPO)
--      fn = fntable[s->bpp + 12];
-+      fn = fntable[s->bpp + 12 + bpp_offset];
-     else
--      fn = fntable[s->bpp];
-+      fn = fntable[s->bpp + bpp_offset];
-     
-     src_width = s->cols;
-     switch (s->bpp) {
-diff -Naru qemu-neo1973.orig/hw/pl110_template.h qemu-neo1973/hw/pl110_template.h
---- qemu-neo1973.orig/hw/pl110_template.h	2007-06-24 13:56:37.000000000 +0200
-+++ qemu-neo1973/hw/pl110_template.h	2007-06-24 14:12:09.000000000 +0200
-@@ -24,6 +24,16 @@
- #error unknown bit depth
- #endif
- 
-+#undef RGB
-+#define BORDER bgr
-+#define ORDER 0
-+#include "pl110_template.h"
-+#define ORDER 1
-+#include "pl110_template.h"
-+#define ORDER 2
-+#include "pl110_template.h"
-+#define RGB
-+#define BORDER rgb
- #define ORDER 0
- #include "pl110_template.h"
- #define ORDER 1
-@@ -33,26 +43,47 @@
- 
- static drawfn glue(pl110_draw_fn_,BITS)[18] =
- {
--    glue(pl110_draw_line1_lblp,BITS),
--    glue(pl110_draw_line2_lblp,BITS),
--    glue(pl110_draw_line4_lblp,BITS),
--    glue(pl110_draw_line8_lblp,BITS),
--    glue(pl110_draw_line16_lblp,BITS),
--    glue(pl110_draw_line32_lblp,BITS),
--
--    glue(pl110_draw_line1_bbbp,BITS),
--    glue(pl110_draw_line2_bbbp,BITS),
--    glue(pl110_draw_line4_bbbp,BITS),
--    glue(pl110_draw_line8_bbbp,BITS),
--    glue(pl110_draw_line16_bbbp,BITS),
--    glue(pl110_draw_line32_bbbp,BITS),
--
--    glue(pl110_draw_line1_lbbp,BITS),
--    glue(pl110_draw_line2_lbbp,BITS),
--    glue(pl110_draw_line4_lbbp,BITS),
--    glue(pl110_draw_line8_lbbp,BITS),
--    glue(pl110_draw_line16_lbbp,BITS),
--    glue(pl110_draw_line32_lbbp,BITS)
-+    glue(pl110_draw_line1_lblp_bgr,BITS),
-+    glue(pl110_draw_line2_lblp_bgr,BITS),
-+    glue(pl110_draw_line4_lblp_bgr,BITS),
-+    glue(pl110_draw_line8_lblp_bgr,BITS),
-+    glue(pl110_draw_line16_lblp_bgr,BITS),
-+    glue(pl110_draw_line32_lblp_bgr,BITS),
-+
-+    glue(pl110_draw_line1_bbbp_bgr,BITS),
-+    glue(pl110_draw_line2_bbbp_bgr,BITS),
-+    glue(pl110_draw_line4_bbbp_bgr,BITS),
-+    glue(pl110_draw_line8_bbbp_bgr,BITS),
-+    glue(pl110_draw_line16_bbbp_bgr,BITS),
-+    glue(pl110_draw_line32_bbbp_bgr,BITS),
-+
-+    glue(pl110_draw_line1_lbbp_bgr,BITS),
-+    glue(pl110_draw_line2_lbbp_bgr,BITS),
-+    glue(pl110_draw_line4_lbbp_bgr,BITS),
-+    glue(pl110_draw_line8_lbbp_bgr,BITS),
-+    glue(pl110_draw_line16_lbbp_bgr,BITS),
-+    glue(pl110_draw_line32_lbbp_bgr,BITS),
-+
-+    glue(pl110_draw_line1_lblp_rgb,BITS),
-+    glue(pl110_draw_line2_lblp_rgb,BITS),
-+    glue(pl110_draw_line4_lblp_rgb,BITS),
-+    glue(pl110_draw_line8_lblp_rgb,BITS),
-+    glue(pl110_draw_line16_lblp_rgb,BITS),
-+    glue(pl110_draw_line32_lblp_rgb,BITS),
-+
-+    glue(pl110_draw_line1_bbbp_rgb,BITS),
-+    glue(pl110_draw_line2_bbbp_rgb,BITS),
-+    glue(pl110_draw_line4_bbbp_rgb,BITS),
-+    glue(pl110_draw_line8_bbbp_rgb,BITS),
-+    glue(pl110_draw_line16_bbbp_rgb,BITS),
-+    glue(pl110_draw_line32_bbbp_rgb,BITS),
-+
-+    glue(pl110_draw_line1_lbbp_rgb,BITS),
-+    glue(pl110_draw_line2_lbbp_rgb,BITS),
-+    glue(pl110_draw_line4_lbbp_rgb,BITS),
-+    glue(pl110_draw_line8_lbbp_rgb,BITS),
-+    glue(pl110_draw_line16_lbbp_rgb,BITS),
-+    glue(pl110_draw_line32_lbbp_rgb,BITS),
- };
- 
- #undef BITS
-@@ -61,18 +92,18 @@
- #else
- 
- #if ORDER == 0
--#define NAME glue(lblp, BITS)
-+#define NAME glue(glue(lblp_, BORDER), BITS)
- #ifdef WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
- #elif ORDER == 1
--#define NAME glue(bbbp, BITS)
-+#define NAME glue(glue(bbbp_, BORDER), BITS)
- #ifndef WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
- #else
- #define SWAP_PIXELS 1
--#define NAME glue(lbbp, BITS)
-+#define NAME glue(glue(lbbp_, BORDER), BITS)
- #ifdef WORDS_BIGENDIAN
- #define SWAP_WORDS 1
- #endif
-@@ -195,27 +226,34 @@
- #ifdef SWAP_WORDS
-         data = bswap32(data);
- #endif
-+#ifdef RGB
-+#define LSB r
-+#define MSB b
-+#else
-+#define LSB b
-+#define MSB r
-+#endif
- #if 0
--        r = data & 0x1f;
-+        LSB = data & 0x1f;
-         data >>= 5;
-         g = data & 0x3f;
-         data >>= 6;
--        b = data & 0x1f;
-+        MSB = data & 0x1f;
-         data >>= 5;
- #else
--        r = (data & 0x1f) << 3;
-+        LSB = (data & 0x1f) << 3;
-         data >>= 5;
-         g = (data & 0x3f) << 2;
-         data >>= 6;
--        b = (data & 0x1f) << 3;
-+        MSB = (data & 0x1f) << 3;
-         data >>= 5;
- #endif
-         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
--        r = (data & 0x1f) << 3;
-+        LSB = (data & 0x1f) << 3;
-         data >>= 5;
-         g = (data & 0x3f) << 2;
-         data >>= 6;
--        b = (data & 0x1f) << 3;
-+        MSB = (data & 0x1f) << 3;
-         data >>= 5;
-         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-         width -= 2;
-@@ -229,14 +267,21 @@
-     unsigned int r, g, b;
-     while (width > 0) {
-         data = *(uint32_t *)src;
-+#ifdef RGB
-+#define LSB r
-+#define MSB b
-+#else
-+#define LSB b
-+#define MSB r
-+#endif
- #ifdef SWAP_WORDS
--        r = data & 0xff;
-+        LSB = data & 0xff;
-         g = (data >> 8) & 0xff;
--        b = (data >> 16) & 0xff;
-+        MSB = (data >> 16) & 0xff;
- #else
--        r = (data >> 24) & 0xff;
-+        LSB = (data >> 24) & 0xff;
-         g = (data >> 16) & 0xff;
--        b = (data >> 8) & 0xff;
-+        MSB = (data >> 8) & 0xff;
- #endif
-         COPY_PIXEL(d, glue(rgb_to_pixel,BITS)(r, g, b));
-         width--;
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch
deleted file mode 100644
index 189cd09b67..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-0.9.0-gcc4.patch
+++ /dev/null
@@ -1,881 +0,0 @@
-diff -Naru qemu-neo1973.orig/dyngen.c qemu-neo1973/dyngen.c
---- qemu-neo1973.orig/dyngen.c	2007-06-24 13:56:38.000000000 +0200
-+++ qemu-neo1973/dyngen.c	2007-06-24 14:33:11.000000000 +0200
-@@ -32,6 +32,8 @@
- 
- #include "config-host.h"
- 
-+//#define DEBUG_OP
-+
- /* NOTE: we test CONFIG_WIN32 instead of _WIN32 to enabled cross
-    compilation */
- #if defined(CONFIG_WIN32)
-@@ -1429,6 +1431,644 @@
- #endif
- 
- 
-+#if defined(HOST_I386) || defined(HOST_X86_64)
-+
-+/* This byte is the first byte of an instruction.  */
-+#define FLAG_INSN     (1 << 0)
-+/* This byte has been processed as part of an instruction.  */
-+#define FLAG_SCANNED  (1 << 1)
-+/* This instruction is a return instruction.  Gcc cometimes generates prefix
-+   bytes, so may be more than one byte long.  */
-+#define FLAG_RET      (1 << 2)
-+/* This is either the target of a jump, or the preceeding instruction uses
-+   a pc-relative offset.  */
-+#define FLAG_TARGET   (1 << 3)
-+/* This is a magic instruction that needs fixing up.  */
-+#define FLAG_EXIT     (1 << 4)
-+#define MAX_EXITS     5
-+
-+static void
-+bad_opcode(const char *name, uint32_t op)
-+{
-+    error("Unsupported opcode %0*x in %s", (op > 0xff) ? 4 : 2, op, name);
-+}
-+
-+/* Mark len bytes as scanned,  Returns insn_size + len.  Reports an error
-+   if these bytes have already been scanned.  */
-+static int
-+eat_bytes(const char *name, char *flags, int insn, int insn_size, int len)
-+{
-+    while (len > 0) {
-+        /* This should never occur in sane code.  */
-+        if (flags[insn + insn_size] & FLAG_SCANNED)
-+            error ("Overlapping instructions in %s", name);
-+        flags[insn + insn_size] |= FLAG_SCANNED;
-+        insn_size++;
-+        len--;
-+    }
-+    return insn_size;
-+}
-+
-+static void
-+trace_i386_insn (const char *name, uint8_t *start_p, char *flags, int insn,
-+                 int len)
-+{
-+    uint8_t *ptr;
-+    uint8_t op;
-+    int modrm;
-+    int is_prefix;
-+    int op_size;
-+    int addr_size;
-+    int insn_size;
-+    int is_ret;
-+    int is_condjmp;
-+    int is_jmp;
-+    int is_exit;
-+    int is_pcrel;
-+    int immed;
-+    int seen_rexw;
-+    int32_t disp;
-+
-+    ptr = start_p + insn;
-+    /* nonzero if this insn has a ModR/M byte.  */
-+    modrm = 1;
-+    /* The size of the immediate value in this instruction.  */
-+    immed = 0;
-+    /* The operand size.  */
-+    op_size = 4;
-+    /* The address size */
-+    addr_size = 4;
-+    /* The total length of this instruction.  */
-+    insn_size = 0;
-+    is_prefix = 1;
-+    is_ret = 0;
-+    is_condjmp = 0;
-+    is_jmp = 0;
-+    is_exit = 0;
-+    seen_rexw = 0;
-+    is_pcrel = 0;
-+
-+    while (is_prefix) {
-+        op = ptr[insn_size];
-+        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-+        is_prefix = 0;
-+        switch (op >> 4) {
-+        case 0:
-+        case 1:
-+        case 2:
-+        case 3:
-+            if (op == 0x0f) {
-+                /* two-byte opcode.  */
-+                op = ptr[insn_size];
-+                insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-+                switch (op >> 4) {
-+                case 0:
-+                    if ((op & 0xf) > 3)
-+                      modrm = 0;
-+                    break;
-+                case 1: /* vector move or prefetch */
-+                case 2: /* various moves and vector compares.  */
-+                case 4: /* cmov */
-+                case 5: /* vector instructions */
-+                case 6:
-+                case 13:
-+                case 14:
-+                case 15:
-+                    break;
-+                case 7: /* mmx */
-+                    if (op & 0x77) /* emms */
-+                      modrm = 0;
-+                    break;
-+                case 3: /* wrmsr, rdtsc, rdmsr, rdpmc, sysenter, sysexit */
-+                    modrm = 0;
-+                    break;
-+                case 8: /* long conditional jump */
-+                    is_condjmp = 1;
-+                    immed = op_size;
-+                    modrm = 0;
-+                    break;
-+                case 9: /* setcc */
-+                    break;
-+                case 10:
-+                    switch (op & 0x7) {
-+                    case 0: /* push fs/gs */
-+                    case 1: /* pop fs/gs */
-+                    case 2: /* cpuid/rsm */
-+                        modrm = 0;
-+                        break;
-+                    case 4: /* shld/shrd immediate */
-+                        immed = 1;
-+                        break;
-+                    default: /* Normal instructions with a ModR/M byte.  */
-+                        break;
-+                    }
-+                    break;
-+                case 11:
-+                    switch (op & 0xf) {
-+                    case 10: /* bt, bts, btr, btc */
-+                        immed = 1;
-+                        break;
-+                    default:
-+                        /* cmpxchg, lss, btr, lfs, lgs, movzx, btc, bsf, bsr
-+                           undefined, and movsx */
-+                        break;
-+                    }
-+                    break;
-+                case 12:
-+                    if (op & 8) {
-+                        /* bswap */
-+                        modrm = 0;
-+                    } else {
-+                        switch (op & 0x7) {
-+                        case 2:
-+                        case 4:
-+                        case 5:
-+                        case 6:
-+                            immed = 1;
-+                            break;
-+                        default:
-+                            break;
-+                        }
-+                    }
-+                    break;
-+                }
-+            } else if ((op & 0x07) <= 0x3) {
-+                /* General arithmentic ax.  */
-+            } else if ((op & 0x07) <= 0x5) {
-+                /* General arithmetic ax, immediate.  */
-+                if (op & 0x01)
-+                    immed = op_size;
-+                else
-+                    immed = 1;
-+                modrm = 0;
-+            } else if ((op & 0x23) == 0x22) {
-+                /* Segment prefix.  */
-+                is_prefix = 1;
-+            } else {
-+                /* Segment register push/pop or DAA/AAA/DAS/AAS.  */
-+                modrm = 0;
-+            }
-+            break;
-+
-+#if defined(HOST_X86_64)
-+        case 4: /* rex prefix.  */
-+            is_prefix = 1;
-+            /* The address/operand size is actually 64-bit, but the immediate
-+               values in the instruction are still 32-bit.  */
-+            op_size = 4;
-+            addr_size = 4;
-+            if (op & 8)
-+                seen_rexw = 1;
-+            break;
-+#else
-+        case 4: /* inc/dec register.  */
-+#endif
-+        case 5: /* push/pop general register.  */
-+            modrm = 0;
-+            break;
-+
-+        case 6:
-+            switch (op & 0x0f) {
-+            case 0: /* pusha */
-+            case 1: /* popa */
-+                modrm = 0;
-+                break;
-+            case 2: /* bound */
-+            case 3: /* arpl */
-+                break;
-+            case 4: /* FS */
-+            case 5: /* GS */
-+                is_prefix = 1;
-+                break;
-+            case 6: /* opcode size prefix.  */
-+                op_size = 2;
-+                is_prefix = 1;
-+                break;
-+            case 7: /* Address size prefix.  */
-+                addr_size = 2;
-+                is_prefix = 1;
-+                break;
-+            case 8: /* push immediate */
-+                immed = op_size;
-+                modrm = 0;
-+                break;
-+            case 10: /* push 8-bit immediate */
-+                immed = 1;
-+                modrm = 0;
-+                break;
-+            case 9: /* imul immediate */
-+                immed = op_size;
-+                break;
-+            case 11: /* imul 8-bit immediate */
-+                immed = 1;
-+                break;
-+            case 12: /* insb */
-+            case 13: /* insw */
-+            case 14: /* outsb */
-+            case 15: /* outsw */
-+                modrm = 0;
-+                break;
-+            }
-+            break;
-+
-+        case 7: /* Short conditional jump.  */
-+            is_condjmp = 1;
-+            immed = 1;
-+            modrm = 0;
-+            break;
-+          
-+        case 8:
-+            if ((op & 0xf) <= 3) {
-+                /* arithmetic immediate.  */
-+                if ((op & 3) == 1)
-+                    immed = op_size;
-+                else
-+                    immed = 1;
-+            }
-+            /* else test, xchg, mov, lea or pop general.  */
-+            break;
-+
-+        case 9:
-+            /* Various single-byte opcodes with no modrm byte.  */
-+            modrm = 0;
-+            if (op == 10) {
-+                /* Call */
-+                immed = 4;
-+            }
-+            break;
-+
-+        case 10:
-+            switch ((op & 0xe) >> 1) {
-+            case 0: /* mov absoliute immediate.  */
-+            case 1:
-+                if (seen_rexw)
-+                    immed = 8;
-+                else
-+                    immed = addr_size;
-+                break;
-+            case 4: /* test immediate.  */
-+                if (op & 1)
-+                    immed = op_size;
-+                else
-+                    immed = 1;
-+                break;
-+            default: /* Various string ops.  */
-+                break;
-+            }
-+            modrm = 0;
-+            break;
-+
-+        case 11: /* move immediate to register */
-+            if (op & 8) {
-+                if (seen_rexw)
-+                    immed = 8;
-+                else
-+                    immed = op_size;
-+            } else {
-+                immed = 1;
-+            }
-+            modrm = 0;
-+            break;
-+
-+          case 12:
-+            switch (op & 0xf) {
-+            case 0: /* shift immediate */
-+            case 1:
-+                immed = 1;
-+                break;
-+            case 2: /* ret immediate */
-+                immed = 2;
-+                modrm = 0;
-+                bad_opcode(name, op);
-+                break;
-+            case 3: /* ret */
-+                modrm = 0;
-+                is_ret = 1;
-+            case 4: /* les */
-+            case 5: /* lds */
-+                break;
-+            case 6: /* mov immediate byte */
-+                immed = 1;
-+                break;
-+            case 7: /* mov immediate */
-+                immed = op_size;
-+                break;
-+            case 8: /* enter */
-+                /* TODO: Is this right?  */
-+                immed = 3;
-+                modrm = 0;
-+                break;
-+            case 10: /* retf immediate */
-+                immed = 2;
-+                modrm = 0;
-+                bad_opcode(name, op);
-+                break;
-+            case 13: /* int */
-+                immed = 1;
-+                modrm = 0;
-+                break;
-+            case 11: /* retf */
-+            case 15: /* iret */
-+                modrm = 0;
-+                bad_opcode(name, op);
-+                break;
-+            default: /* leave, int3 or into */
-+                modrm = 0;
-+                break;
-+            }
-+            break;
-+
-+        case 13:
-+            if ((op & 0xf) >= 8) {
-+                /* Coprocessor escape.  For our purposes this is just a normal
-+                   instruction with a ModR/M byte.  */
-+            } else if ((op & 0xf) >= 4) {
-+                /* AAM, AAD or XLAT */
-+                modrm = 0;
-+            }
-+            /* else shift instruction */
-+            break;
-+
-+        case 14:
-+            switch ((op & 0xc) >> 2) {
-+            case 0: /* loop or jcxz */
-+                is_condjmp = 1;
-+                immed = 1;
-+                break;
-+            case 1: /* in/out immed */
-+                immed = 1;
-+                break;
-+            case 2: /* call or jmp */
-+                switch (op & 3) {
-+                case 0: /* call */
-+                    immed = op_size;
-+                    break;
-+                case 1: /* long jump */
-+                    immed = 4;
-+                    is_jmp = 1;
-+                    break;
-+                case 2: /* far jmp */
-+                    bad_opcode(name, op);
-+                    break;
-+                case 3: /* short jmp */
-+                    immed = 1;
-+                    is_jmp = 1;
-+                    break;
-+                }
-+                break;
-+            case 3: /* in/out register */
-+                break;
-+            }
-+            modrm = 0;
-+            break;
-+
-+        case 15:
-+            switch ((op & 0xe) >> 1) {
-+            case 0:
-+            case 1:
-+                is_prefix = 1;
-+                break;
-+            case 2:
-+            case 4:
-+            case 5:
-+            case 6:
-+                modrm = 0;
-+                /* Some privileged insns are used as markers.  */
-+                switch (op) {
-+                case 0xf4: /* hlt: Exit translation block.  */
-+                    is_exit = 1;
-+                    break;
-+                case 0xfa: /* cli: Jump to label.  */
-+                    is_exit = 1;
-+                    immed = 4;
-+                    break;
-+                case 0xfb: /* sti: TB patch jump.  */
-+                    /* Mark the insn for patching, but continue sscanning.  */
-+                    flags[insn] |= FLAG_EXIT;
-+                    immed = 4;
-+                    break;
-+                }
-+                break;
-+            case 3: /* unary grp3 */
-+                if ((ptr[insn_size] & 0x38) == 0) {
-+                    if (op == 0xf7)
-+                        immed = op_size;
-+                    else
-+                        immed = 1; /* test immediate */
-+                }
-+                break;
-+            case 7: /* inc/dec grp4/5 */
-+                /* TODO: This includes indirect jumps.  We should fail if we
-+                   encounter one of these. */
-+                break;
-+            }
-+            break;
-+        }
-+    }
-+
-+    if (modrm) {
-+        if (addr_size != 4)
-+            error("16-bit addressing mode used in %s", name);
-+
-+        disp = 0;
-+        modrm = ptr[insn_size];
-+        insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-+        modrm &= 0xc7;
-+        switch ((modrm & 0xc0) >> 6) {
-+        case 0:
-+            if (modrm == 5)
-+              disp = 4;
-+            break;
-+        case 1:
-+            disp = 1;
-+            break;
-+        case 2:
-+            disp = 4;
-+            break;
-+        }
-+        if ((modrm & 0xc0) != 0xc0 && (modrm & 0x7) == 4) {
-+            /* SIB byte */
-+            if (modrm == 4 && (ptr[insn_size] & 0x7) == 5) {
-+                disp = 4;
-+                is_pcrel = 1;
-+            }
-+            insn_size = eat_bytes(name, flags, insn, insn_size, 1);
-+        }
-+        insn_size = eat_bytes(name, flags, insn, insn_size, disp);
-+    }
-+    insn_size = eat_bytes(name, flags, insn, insn_size, immed);
-+    if (is_condjmp || is_jmp) {
-+        if (immed == 1) {
-+            disp = (int8_t)*(ptr + insn_size - 1);
-+        } else {
-+            disp = (((int32_t)*(ptr + insn_size - 1)) << 24)
-+                   | (((int32_t)*(ptr + insn_size - 2)) << 16)
-+                   | (((int32_t)*(ptr + insn_size - 3)) << 8)
-+                   | *(ptr + insn_size - 4);
-+        }
-+        disp += insn_size;
-+        /* Jumps to external symbols point to the address of the offset
-+           before relocation.  */
-+        /* ??? These are probably a tailcall.  We could fix them up by
-+           replacing them with jmp to EOB + call, but it's easier to just
-+           prevent the compiler generating them.  */
-+        if (disp == 1)
-+            error("Unconditional jump (sibcall?) in %s", name);
-+        disp += insn;
-+        if (disp < 0 || disp > len)
-+            error("Jump outside instruction in %s", name);
-+
-+        if ((flags[disp] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_SCANNED)
-+            error("Overlapping instructions in %s", name);
-+
-+        flags[disp] |= (FLAG_INSN | FLAG_TARGET);
-+        is_pcrel = 1; 
-+    }
-+    if (is_pcrel) {
-+        /* Mark the following insn as a jump target.  This will stop
-+           this instruction being moved.  */
-+        flags[insn + insn_size] |= FLAG_TARGET;
-+    }
-+    if (is_ret)
-+      flags[insn] |= FLAG_RET;
-+
-+    if (is_exit)
-+      flags[insn] |= FLAG_EXIT;
-+
-+    if (!(is_jmp || is_ret || is_exit))
-+      flags[insn + insn_size] |= FLAG_INSN;
-+}
-+
-+/* Scan a function body.  Returns the position of the return sequence.
-+   Sets *patch_bytes to the number of bytes that need to be copied from that
-+   location.  If no patching is required (ie. the return is the last insn)
-+   *patch_bytes will be set to -1.  *plen is the number of code bytes to copy.
-+ */
-+static int trace_i386_op(const char * name, uint8_t *start_p, int *plen,
-+                         int *patch_bytes, int *exit_addrs)
-+{
-+    char *flags;
-+    int more;
-+    int insn;
-+    int retpos;
-+    int bytes;
-+    int num_exits;
-+    int len;
-+    int last_insn;
-+
-+    len = *plen;
-+    flags = malloc(len + 1);
-+    memset(flags, 0, len + 1);
-+    flags[0] |= FLAG_INSN;
-+    more = 1;
-+    while (more) {
-+        more = 0;
-+        for (insn = 0; insn < len; insn++) {
-+            if ((flags[insn] & (FLAG_INSN | FLAG_SCANNED)) == FLAG_INSN) {
-+                trace_i386_insn(name, start_p, flags, insn, len);
-+                more = 1;
-+            }
-+        }
-+    }
-+
-+    /* Strip any unused code at the end of the function.  */
-+    while (len > 0 && flags[len - 1] == 0)
-+      len--;
-+
-+    retpos = -1;
-+    num_exits = 0;
-+    last_insn = 0;
-+    for (insn = 0; insn < len; insn++) {
-+        if (flags[insn] & FLAG_RET) {
-+            /* ??? In theory it should be possible to handle multiple return
-+               points.  In practice it's not worth the effort.  */
-+            if (retpos != -1)
-+                error("Multiple return instructions in %s", name);
-+            retpos = insn;
-+        }
-+        if (flags[insn] & FLAG_EXIT) {
-+            if (num_exits == MAX_EXITS)
-+                error("Too many block exits in %s", name);
-+            exit_addrs[num_exits] = insn;
-+            num_exits++;
-+        }
-+        if (flags[insn] & FLAG_INSN)
-+            last_insn = insn;
-+    }
-+
-+    exit_addrs[num_exits] = -1;
-+    if (retpos == -1) {
-+        if (num_exits == 0) {
-+            error ("No return instruction found in %s", name);
-+        } else {
-+            retpos = len;
-+            last_insn = len;
-+        }
-+    }
-+    
-+    /* If the return instruction is the last instruction we can just 
-+       remove it.  */
-+    if (retpos == last_insn)
-+        *patch_bytes = -1;
-+    else
-+        *patch_bytes = 0;
-+
-+    /* Back up over any nop instructions.  */
-+    while (retpos > 0
-+           && (flags[retpos] & FLAG_TARGET) == 0
-+           && (flags[retpos - 1] & FLAG_INSN) != 0
-+           && start_p[retpos - 1] == 0x90) {
-+        retpos--;
-+    }
-+
-+    if (*patch_bytes == -1) {
-+        *plen = retpos;
-+        free (flags);
-+        return retpos;
-+    }
-+    *plen = len;
-+
-+    /* The ret is in the middle of the function.  Find four more bytes that
-+       so the ret can be replaced by a jmp. */
-+    /* ??? Use a short jump where possible. */
-+    bytes = 4;
-+    insn = retpos + 1;
-+    /* We can clobber everything up to the next jump target.  */
-+    while (insn < len && bytes > 0 && (flags[insn] & FLAG_TARGET) == 0) {
-+        insn++;
-+        bytes--;
-+    }
-+    if (bytes > 0) {
-+        /* ???: Strip out nop blocks.  */
-+        /* We can't do the replacement without clobbering anything important.
-+           Copy preceeding instructions(s) to give us some space.  */
-+        while (retpos > 0) {
-+            /* If this byte is the target of a jmp we can't move it.  */
-+            if (flags[retpos] & FLAG_TARGET)
-+                break;
-+
-+            (*patch_bytes)++;
-+            bytes--;
-+            retpos--;
-+
-+            /* Break out of the loop if we have enough space and this is either 
-+               the first byte of an instruction or a pad byte.  */
-+            if ((flags[retpos] & (FLAG_INSN | FLAG_SCANNED)) != FLAG_SCANNED
-+                && bytes <= 0) {
-+                break;
-+            }
-+        }
-+    }
-+
-+    if (bytes > 0)
-+        error("Unable to replace ret with jmp in %s\n", name);
-+
-+    free(flags);
-+    return retpos;
-+}
-+
-+#endif
-+
- #define MAX_ARGS 3
- 
- /* generate op code */
-@@ -1442,6 +2082,11 @@
-     uint8_t args_present[MAX_ARGS];
-     const char *sym_name, *p;
-     EXE_RELOC *rel;
-+#if defined(HOST_I386) || defined(HOST_X86_64)
-+    int patch_bytes;
-+    int retpos;
-+    int exit_addrs[MAX_EXITS];
-+#endif
- 
-     /* Compute exact size excluding prologue and epilogue instructions.
-      * Increment start_offset to skip epilogue instructions, then compute
-@@ -1452,33 +2097,12 @@
-     p_end = p_start + size;
-     start_offset = offset;
- #if defined(HOST_I386) || defined(HOST_X86_64)
--#ifdef CONFIG_FORMAT_COFF
--    {
--        uint8_t *p;
--        p = p_end - 1;
--        if (p == p_start)
--            error("empty code for %s", name);
--        while (*p != 0xc3) {
--            p--;
--            if (p <= p_start)
--                error("ret or jmp expected at the end of %s", name);
--        }
--        copy_size = p - p_start;
--    }
--#else
-     {
-         int len;
-         len = p_end - p_start;
--        if (len == 0)
--            error("empty code for %s", name);
--        if (p_end[-1] == 0xc3) {
--            len--;
--        } else {
--            error("ret or jmp expected at the end of %s", name);
--        }
-+        retpos = trace_i386_op(name, p_start, &len, &patch_bytes, exit_addrs);
-         copy_size = len;
-     }
--#endif    
- #elif defined(HOST_PPC)
-     {
-         uint8_t *p;
-@@ -1710,6 +2334,13 @@
-     }
- 
-     if (gen_switch == 2) {
-+#if defined(HOST_I386) || defined(HOST_X86_64)
-+        if (patch_bytes != -1)
-+            copy_size += patch_bytes;
-+#ifdef DEBUG_OP
-+        copy_size += 2;
-+#endif
-+#endif
-         fprintf(outfile, "DEF(%s, %d, %d)\n", name + 3, nb_args, copy_size);
-     } else if (gen_switch == 1) {
- 
-@@ -1915,7 +2546,43 @@
- #error unsupport object format
- #endif
-                 }
-+               }
-+                /* Replace the marker instructions with the actual opcodes.  */
-+                for (i = 0; exit_addrs[i] != -1; i++) {
-+                    int op;
-+                    switch (p_start[exit_addrs[i]])
-+                      {
-+                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
-+                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
-+                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
-+                      default: error("Internal error");
-+                      }
-+                    fprintf(outfile, 
-+                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
-+                            exit_addrs[i], op);
-                 }
-+                /* Fix up the return instruction.  */
-+                if (patch_bytes != -1) {
-+                    if (patch_bytes) {
-+                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
-+                                "gen_code_ptr + %d, %d);\n",
-+                                copy_size, retpos, patch_bytes);
-+                    }
-+                    fprintf(outfile,
-+                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
-+                            retpos);
-+                    fprintf(outfile,
-+                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
-+                            retpos + 1, copy_size - (retpos + 5));
-+                    
-+                    copy_size += patch_bytes;
-+                }
-+#ifdef DEBUG_OP
-+                fprintf(outfile,
-+                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
-+                        copy_size);
-+                copy_size += 2;
-+#endif
-             }
- #elif defined(HOST_X86_64)
-             {
-@@ -1949,6 +2616,42 @@
-                     }
-                 }
-                 }
-+                /* Replace the marker instructions with the actual opcodes.  */
-+                for (i = 0; exit_addrs[i] != -1; i++) {
-+                    int op;
-+                    switch (p_start[exit_addrs[i]])
-+                      {
-+                      case 0xf4: op = 0xc3; break; /* hlt -> ret */
-+                      case 0xfa: op = 0xe9; break; /* cli -> jmp */
-+                      case 0xfb: op = 0xe9; break; /* sti -> jmp */
-+                      default: error("Internal error");
-+                      }
-+                    fprintf(outfile, 
-+                            "    *(uint8_t *)(gen_code_ptr + %d) = 0x%x;\n",
-+                            exit_addrs[i], op);
-+                }
-+                /* Fix up the return instruction.  */
-+                if (patch_bytes != -1) {
-+                    if (patch_bytes) {
-+                        fprintf(outfile, "    memcpy(gen_code_ptr + %d,"
-+                                "gen_code_ptr + %d, %d);\n",
-+                                copy_size, retpos, patch_bytes);
-+                    }
-+                    fprintf(outfile,
-+                            "    *(uint8_t *)(gen_code_ptr + %d) = 0xe9;\n",
-+                            retpos);
-+                    fprintf(outfile,
-+                            "    *(uint32_t *)(gen_code_ptr + %d) = 0x%x;\n",
-+                            retpos + 1, copy_size - (retpos + 5));
-+                    
-+                    copy_size += patch_bytes;
-+                }
-+#ifdef DEBUG_OP
-+                fprintf(outfile,
-+                        "    *(uint16_t *)(gen_code_ptr + %d) = 0x9090;\n",
-+                        copy_size);
-+                copy_size += 2;
-+#endif
-             }
- #elif defined(HOST_PPC)
-             {
-diff -Naru qemu-neo1973.orig/dyngen-exec.h qemu-neo1973/dyngen-exec.h
---- qemu-neo1973.orig/dyngen-exec.h	2007-06-24 13:56:38.000000000 +0200
-+++ qemu-neo1973/dyngen-exec.h	2007-06-24 14:35:52.000000000 +0200
-@@ -194,7 +194,12 @@
- #endif
- 
- /* force GCC to generate only one epilog at the end of the function */
-+#if defined(__i386__) || defined(__x86_64__)
-+/* Also add 4 bytes of padding so that we can replace the ret with a jmp.  */
-+#define FORCE_RET() asm volatile ("nop;nop;nop;nop");
-+#else
- #define FORCE_RET() __asm__ __volatile__("" : : : "memory");
-+#endif
- 
- #ifndef OPPROTO
- #define OPPROTO
-@@ -244,11 +249,18 @@
- #endif
- 
- #if defined(__i386__)
--#define EXIT_TB() asm volatile ("ret")
--#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
-+/* Dyngen will replace hlt instructions with a ret instruction.  Inserting a
-+   ret directly would confuse dyngen.  */
-+#define EXIT_TB() asm volatile ("hlt")
-+/* Dyngen will replace cli with 0x9e (jmp).
-+   We generate the offset manually.  */
-+#define GOTO_LABEL_PARAM(n) \
-+    asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
- #elif defined(__x86_64__)
--#define EXIT_TB() asm volatile ("ret")
--#define GOTO_LABEL_PARAM(n) asm volatile ("jmp " ASM_NAME(__op_gen_label) #n)
-+/* The same as i386.  */
-+#define EXIT_TB() asm volatile ("hlt")
-+#define GOTO_LABEL_PARAM(n) \
-+    asm volatile ("cli;.long " ASM_NAME(__op_gen_label) #n " - 1f;1:")
- #elif defined(__powerpc__)
- #define EXIT_TB() asm volatile ("blr")
- #define GOTO_LABEL_PARAM(n) asm volatile ("b " ASM_NAME(__op_gen_label) #n)
-diff -Naru qemu-neo1973.orig/exec-all.h qemu-neo1973/exec-all.h
---- qemu-neo1973.orig/exec-all.h	2007-06-24 14:31:58.000000000 +0200
-+++ qemu-neo1973/exec-all.h	2007-06-24 14:33:11.000000000 +0200
-@@ -329,14 +329,15 @@
- 
- #elif defined(__i386__) && defined(USE_DIRECT_JUMP)
- 
--/* we patch the jump instruction directly */
-+/* we patch the jump instruction directly.  Use sti in place of the actual
-+   jmp instruction so that dyngen can patch in the correct result.  */
- #define GOTO_TB(opname, tbparam, n)\
- do {\
-     asm volatile (".section .data\n"\
- 		  ASM_OP_LABEL_NAME(n, opname) ":\n"\
- 		  ".long 1f\n"\
- 		  ASM_PREVIOUS_SECTION \
--                  "jmp " ASM_NAME(__op_jmp) #n "\n"\
-+                  "sti;.long " ASM_NAME(__op_jmp) #n " - 1f\n"\
- 		  "1:\n");\
- } while (0)
- 
-diff -Naru qemu-neo1973.orig/target-ppc/exec.h qemu-neo1973/target-ppc/exec.h
---- qemu-neo1973.orig/target-ppc/exec.h	2007-06-24 13:56:32.000000000 +0200
-+++ qemu-neo1973/target-ppc/exec.h	2007-06-24 14:33:11.000000000 +0200
-@@ -66,11 +66,7 @@
- #define FT1 (env->ft1)
- #define FT2 (env->ft2)
- 
--#if defined (DEBUG_OP)
--# define RETURN() __asm__ __volatile__("nop" : : : "memory");
--#else
--# define RETURN() __asm__ __volatile__("" : : : "memory");
--#endif
-+#define RETURN() FORCE_RET()
- 
- static inline target_ulong rotl8 (target_ulong i, int n)
- {
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch
deleted file mode 100644
index 8f5e9d8b4b..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-amd64-32b-mapping-0.9.0.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Naru qemu-snapshot-2007-07-01_05.orig/linux-user/mmap.c qemu-snapshot-2007-07-01_05/linux-user/mmap.c
---- qemu-snapshot-2007-07-01_05.orig/linux-user/mmap.c	2007-06-03 17:31:32.000000000 +0200
-+++ qemu-snapshot-2007-07-01_05/linux-user/mmap.c	2007-07-02 14:00:30.000000000 +0200
-@@ -234,7 +234,7 @@
-             host_offset = offset & qemu_host_page_mask;
-             host_len = len + offset - host_offset;
-             host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
--                                    host_len, prot, flags, fd, host_offset);
-+                                    host_len, prot, (flags | MAP_32BIT), fd, host_offset);
-             if (host_start == -1)
-                 return host_start;
-             /* update start so that it points to the file position at 'offset' */
-@@ -388,7 +388,7 @@
-     int prot;
- 
-     /* XXX: use 5 args syscall */
--    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
-+    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, (flags | MAP_32BIT));
-     if (new_addr == -1)
-         return new_addr;
-     new_addr = h2g(new_addr);
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch b/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch
deleted file mode 100644
index 08d5513f36..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20070701/qemu-sdl-cursor-0.9.0.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naru qemu-snapshot-2007-06-24_05.orig/sdl.c qemu-snapshot-2007-06-24_05/sdl.c
---- qemu-snapshot-2007-06-24_05.orig/sdl.c	2007-06-21 23:08:02.000000000 +0200
-+++ qemu-snapshot-2007-06-24_05/sdl.c	2007-06-24 16:33:20.000000000 +0200
-@@ -245,7 +245,7 @@
- 
-     if (kbd_mouse_is_absolute()) {
-         SDL_ShowCursor(1);
--        SDL_SetCursor(sdl_cursor_hidden);
-+        /* SDL_SetCursor(sdl_cursor_hidden); */
-     } else {
-         SDL_ShowCursor(0);
-     }
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty b/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty
deleted file mode 100644
index e69de29bb2..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20071121/.mtn2git_empty
+++ /dev/null
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch b/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch
deleted file mode 100644
index fe90f36182..0000000000
--- a/packages/qemu/qemu-0.9.0+cvs20071121/no-strip.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/Makefile.org	2007-11-18 23:33:07.000000000 +0200
-+++ a/Makefile	2008-01-01 19:09:25.000000000 +0200
-@@ -165,7 +165,7 @@
- install: all $(if $(BUILD_DOCS),install-doc)
- 	mkdir -p "$(DESTDIR)$(bindir)"
- ifneq ($(TOOLS),)
--	$(INSTALL) -m 755 -s $(TOOLS) "$(DESTDIR)$(bindir)"
-+	$(INSTALL) -m 755 $(TOOLS) "$(DESTDIR)$(bindir)"
- endif
- 	mkdir -p "$(DESTDIR)$(datadir)"
- 	for x in bios.bin vgabios.bin vgabios-cirrus.bin ppc_rom.bin \
---- a/Makefile.target.org	2007-11-19 00:34:46.000000000 +0200
-+++ a/Makefile.target	2008-01-01 19:10:02.000000000 +0200
-@@ -629,7 +629,7 @@
- 
- install: all
- ifneq ($(PROGS),)
--	$(INSTALL) -m 755 -s $(PROGS) "$(DESTDIR)$(bindir)"
-+	$(INSTALL) -m 755 $(PROGS) "$(DESTDIR)$(bindir)"
- endif
- 
- ifneq ($(wildcard .depend),)
diff --git a/packages/qemu/qemu-0.9.0+cvs20070701/.mtn2git_empty b/packages/qemu/qemu-0.9.1/.mtn2git_empty
index e69de29bb2..e69de29bb2 100644
--- a/packages/qemu/qemu-0.9.0+cvs20070701/.mtn2git_empty
+++ b/packages/qemu/qemu-0.9.1/.mtn2git_empty
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/02_snapshot_use_tmpdir.patch b/packages/qemu/qemu-0.9.1/02_snapshot_use_tmpdir.patch
index 40264ed443..40264ed443 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/02_snapshot_use_tmpdir.patch
+++ b/packages/qemu/qemu-0.9.1/02_snapshot_use_tmpdir.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/04_do_not_print_rtc_freq_if_ok.patch b/packages/qemu/qemu-0.9.1/04_do_not_print_rtc_freq_if_ok.patch
index 31c9da491d..31c9da491d 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/04_do_not_print_rtc_freq_if_ok.patch
+++ b/packages/qemu/qemu-0.9.1/04_do_not_print_rtc_freq_if_ok.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/05_non-fatal_if_linux_hd_missing.patch b/packages/qemu/qemu-0.9.1/05_non-fatal_if_linux_hd_missing.patch
index fdd922605e..fdd922605e 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/05_non-fatal_if_linux_hd_missing.patch
+++ b/packages/qemu/qemu-0.9.1/05_non-fatal_if_linux_hd_missing.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/06_exit_segfault.patch b/packages/qemu/qemu-0.9.1/06_exit_segfault.patch
index 06123d0626..06123d0626 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/06_exit_segfault.patch
+++ b/packages/qemu/qemu-0.9.1/06_exit_segfault.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/10_signal_jobs.patch b/packages/qemu/qemu-0.9.1/10_signal_jobs.patch
index 34282adc9d..34282adc9d 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/10_signal_jobs.patch
+++ b/packages/qemu/qemu-0.9.1/10_signal_jobs.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/11_signal_sigaction.patch b/packages/qemu/qemu-0.9.1/11_signal_sigaction.patch
index 33c5e8b12d..33c5e8b12d 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/11_signal_sigaction.patch
+++ b/packages/qemu/qemu-0.9.1/11_signal_sigaction.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/22_net_tuntap_stall.patch b/packages/qemu/qemu-0.9.1/22_net_tuntap_stall.patch
index 6017df0f6d..6017df0f6d 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/22_net_tuntap_stall.patch
+++ b/packages/qemu/qemu-0.9.1/22_net_tuntap_stall.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/31_syscalls.patch b/packages/qemu/qemu-0.9.1/31_syscalls.patch
index 95a7332ee8..95a7332ee8 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/31_syscalls.patch
+++ b/packages/qemu/qemu-0.9.1/31_syscalls.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/32_syscall_sysctl.patch b/packages/qemu/qemu-0.9.1/32_syscall_sysctl.patch
index 5e8dd75b0e..5e8dd75b0e 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/32_syscall_sysctl.patch
+++ b/packages/qemu/qemu-0.9.1/32_syscall_sysctl.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/33_syscall_ppc_clone.patch b/packages/qemu/qemu-0.9.1/33_syscall_ppc_clone.patch
index 3f733b6ab8..3f733b6ab8 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/33_syscall_ppc_clone.patch
+++ b/packages/qemu/qemu-0.9.1/33_syscall_ppc_clone.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/39_syscall_fadvise64.patch b/packages/qemu/qemu-0.9.1/39_syscall_fadvise64.patch
index 54ee3e0948..54ee3e0948 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/39_syscall_fadvise64.patch
+++ b/packages/qemu/qemu-0.9.1/39_syscall_fadvise64.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/41_arm_fpa_sigfpe.patch b/packages/qemu/qemu-0.9.1/41_arm_fpa_sigfpe.patch
index cea3afc7ff..cea3afc7ff 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/41_arm_fpa_sigfpe.patch
+++ b/packages/qemu/qemu-0.9.1/41_arm_fpa_sigfpe.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/52_ne2000_return.patch b/packages/qemu/qemu-0.9.1/52_ne2000_return.patch
index e4ea33f2c6..e4ea33f2c6 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/52_ne2000_return.patch
+++ b/packages/qemu/qemu-0.9.1/52_ne2000_return.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/61_safe_64bit_int.patch b/packages/qemu/qemu-0.9.1/61_safe_64bit_int.patch
index bdb0d2e232..9b1ace81a5 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/61_safe_64bit_int.patch
+++ b/packages/qemu/qemu-0.9.1/61_safe_64bit_int.patch
@@ -5,22 +5,22 @@
 #
 Index: dyngen-exec.h
 ===================================================================
---- dyngen-exec.h.orig	2007-12-03 15:40:26.000000000 +0000
-+++ dyngen-exec.h	2007-12-03 16:03:29.000000000 +0000
-@@ -38,7 +38,7 @@ typedef unsigned int uint32_t;
+--- dyngen-exec.h.orig	2007-12-31 13:06:21.000000000 +0000
++++ dyngen-exec.h	2007-12-31 13:08:54.000000000 +0000
+@@ -38,7 +38,7 @@
  // Linux/Sparc64 defines uint64_t
  #if !(defined (__sparc_v9__) && defined(__linux__))
  /* XXX may be done for all 64 bits targets ? */
--#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
+-#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) 
 +#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__sparc__)
  typedef unsigned long uint64_t;
  #else
  typedef unsigned long long uint64_t;
-@@ -55,7 +55,7 @@ typedef signed short int16_t;
+@@ -55,7 +55,7 @@
  typedef signed int int32_t;
  // Linux/Sparc64 defines int64_t
  #if !(defined (__sparc_v9__) && defined(__linux__))
--#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__)
+-#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__)
 +#if defined (__x86_64__) || defined(__ia64) || defined(__s390x__) || defined(__alpha__) || defined(__sparc__)
  typedef signed long int64_t;
  #else
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/63_sparc_build.patch b/packages/qemu/qemu-0.9.1/63_sparc_build.patch
index 37b38f641b..37b38f641b 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/63_sparc_build.patch
+++ b/packages/qemu/qemu-0.9.1/63_sparc_build.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/64_ppc_asm_constraints.patch b/packages/qemu/qemu-0.9.1/64_ppc_asm_constraints.patch
index e4858b79d7..e4858b79d7 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/64_ppc_asm_constraints.patch
+++ b/packages/qemu/qemu-0.9.1/64_ppc_asm_constraints.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/65_kfreebsd.patch b/packages/qemu/qemu-0.9.1/65_kfreebsd.patch
index dfece800ac..dfece800ac 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/65_kfreebsd.patch
+++ b/packages/qemu/qemu-0.9.1/65_kfreebsd.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/66_tls_ld.patch b/packages/qemu/qemu-0.9.1/66_tls_ld.patch
index 54e02eff8b..54e02eff8b 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/66_tls_ld.patch
+++ b/packages/qemu/qemu-0.9.1/66_tls_ld.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/91-oh-sdl-cursor.patch b/packages/qemu/qemu-0.9.1/91-oh-sdl-cursor.patch
index 0d60c1c306..0d60c1c306 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/91-oh-sdl-cursor.patch
+++ b/packages/qemu/qemu-0.9.1/91-oh-sdl-cursor.patch
diff --git a/packages/qemu/qemu-0.9.1/configure_symlinkpath_fix.patch b/packages/qemu/qemu-0.9.1/configure_symlinkpath_fix.patch
new file mode 100644
index 0000000000..3ec304a38c
--- /dev/null
+++ b/packages/qemu/qemu-0.9.1/configure_symlinkpath_fix.patch
@@ -0,0 +1,28 @@
+Index: qemu-0.9.1/configure
+===================================================================
+--- qemu-0.9.1.orig/configure	2008-01-24 15:33:13.000000000 +0000
++++ qemu-0.9.1/configure	2008-01-24 15:45:50.000000000 +0000
+@@ -209,15 +209,17 @@
+ 
+ # find source path
+ source_path=`dirname "$0"`
++source_path_used="no"
++workdir=`pwd`
++workdir=`readlink -f $workdir`
+ if [ -z "$source_path" ]; then
+-    source_path=`pwd`
++    source_path=$workdir
+ else
+     source_path=`cd "$source_path"; pwd`
+-fi
+-if test "$source_path" = `pwd` ; then
+-    source_path_used="no"
+-else
+-    source_path_used="yes"
++    source_path=`readlink -f $source_path`
++    if test "$source_path" != "$workdir" ; then
++        source_path_used="yes"
++    fi
+ fi
+ 
+ werror="no"
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/disable-error-in-configure.patch b/packages/qemu/qemu-0.9.1/disable-error-in-configure.patch
index 017f9f6355..017f9f6355 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/disable-error-in-configure.patch
+++ b/packages/qemu/qemu-0.9.1/disable-error-in-configure.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/fix_segfault.patch b/packages/qemu/qemu-0.9.1/fix_segfault.patch
index 443c330650..443c330650 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/fix_segfault.patch
+++ b/packages/qemu/qemu-0.9.1/fix_segfault.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl-update.patch b/packages/qemu/qemu-0.9.1/qemu-0.9.0-nptl-update.patch
index ebc996e873..ebc996e873 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl-update.patch
+++ b/packages/qemu/qemu-0.9.1/qemu-0.9.0-nptl-update.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl.patch b/packages/qemu/qemu-0.9.1/qemu-0.9.0-nptl.patch
index 10e3cc04a5..10e3cc04a5 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-0.9.0-nptl.patch
+++ b/packages/qemu/qemu-0.9.1/qemu-0.9.0-nptl.patch
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-amd64-32b-mapping-0.9.0.patch b/packages/qemu/qemu-0.9.1/qemu-amd64-32b-mapping-0.9.0.patch
index c7f36d8110..c7f36d8110 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/qemu-amd64-32b-mapping-0.9.0.patch
+++ b/packages/qemu/qemu-0.9.1/qemu-amd64-32b-mapping-0.9.0.patch
diff --git a/packages/qemu/qemu-0.9.1/series b/packages/qemu/qemu-0.9.1/series
new file mode 100644
index 0000000000..e6ffdcc6bd
--- /dev/null
+++ b/packages/qemu/qemu-0.9.1/series
@@ -0,0 +1,25 @@
+02_snapshot_use_tmpdir.patch -p0
+04_do_not_print_rtc_freq_if_ok.patch -p1
+05_non-fatal_if_linux_hd_missing.patch -p1
+06_exit_segfault.patch -p0
+10_signal_jobs.patch -p0
+11_signal_sigaction.patch -p0
+22_net_tuntap_stall.patch -p0
+31_syscalls.patch -p0
+32_syscall_sysctl.patch -p0
+33_syscall_ppc_clone.patch -p0
+39_syscall_fadvise64.patch -p0
+41_arm_fpa_sigfpe.patch -p0
+52_ne2000_return.patch -p1
+61_safe_64bit_int.patch -p0
+63_sparc_build.patch -p0
+64_ppc_asm_constraints.patch -p1
+65_kfreebsd.patch -p0
+66_tls_ld.patch -p0
+91-oh-sdl-cursor.patch -p0
+qemu-0.9.0-nptl.patch -p1
+qemu-0.9.0-nptl-update.patch -p1
+qemu-amd64-32b-mapping-0.9.0.patch -p1
+workaround_bad_futex_headers.patch -p1
+fix_segfault.patch -p1
+disable-error-in-configure.patch -p1
diff --git a/packages/qemu/qemu-0.9.0+cvs20071121/workaround_bad_futex_headers.patch b/packages/qemu/qemu-0.9.1/workaround_bad_futex_headers.patch
index cc122ebdba..cc122ebdba 100644
--- a/packages/qemu/qemu-0.9.0+cvs20071121/workaround_bad_futex_headers.patch
+++ b/packages/qemu/qemu-0.9.1/workaround_bad_futex_headers.patch
diff --git a/packages/qemu/qemu-native_0.9.0+cvs.bb b/packages/qemu/qemu-native_0.9.0+cvs.bb
deleted file mode 100644
index 65a7908a5c..0000000000
--- a/packages/qemu/qemu-native_0.9.0+cvs.bb
+++ /dev/null
@@ -1,3 +0,0 @@
-require qemu_0.9.0+cvs.bb
-inherit native
-require qemu-native.inc
diff --git a/packages/qemu/qemu-native_0.9.1.bb b/packages/qemu/qemu-native_0.9.1.bb
new file mode 100644
index 0000000000..16984a3f6a
--- /dev/null
+++ b/packages/qemu/qemu-native_0.9.1.bb
@@ -0,0 +1,2 @@
+require qemu_${PV}.bb
+require qemu-native.inc
diff --git a/packages/qemu/qemu-native_20071121.bb b/packages/qemu/qemu-native_20071121.bb
deleted file mode 100644
index a813528d87..0000000000
--- a/packages/qemu/qemu-native_20071121.bb
+++ /dev/null
@@ -1,8 +0,0 @@
-SRCDATE_qemu-native = "20071121"
-require qemu_${PV}.bb
-inherit native
-PR = "r1"
-DEPENDS = "zlib-native"
-prefix = "${STAGING_DIR_NATIVE}/${layout_prefix}"
-
-require qemu-gcc3-check.inc
diff --git a/packages/qemu/qemu_0.9.0+cvs.bb b/packages/qemu/qemu_0.9.0+cvs.bb
deleted file mode 100644
index 8a89b805a2..0000000000
--- a/packages/qemu/qemu_0.9.0+cvs.bb
+++ /dev/null
@@ -1,22 +0,0 @@
-DESCRIPTION = "Qemu is an open source processor emulator."
-HOMEPAGE = "http://fabrice.bellard.free.fr/qemu/"
-SECTION = "devel"
-LICENSE = "GPL"
-SRCDATE="20070701"
-PV = "0.9.0+cvs${SRCDATE}"
-PR = "r1"
-
-SRC_URI = "cvs://anonymous@cvs.savannah.nongnu.org/sources/qemu;method=pserver;rsh=ssh;module=qemu;date=${SRCDATE} \
-           file://configure-0.9.0.patch;patch=1 \
-           file://qemu-sdl-cursor-0.9.0.patch;patch=1 \
-           file://arm_nptl-0.9.0.patch;patch=1 \
-           file://pl110_rgb-r0-0.9.0.patch;patch=1 \
-           file://qemu-0.9.0-gcc4.patch;patch=1 \
-	   file://qemu-amd64-32b-mapping-0.9.0.patch;patch=1"
-S = "${WORKDIR}/qemu"
-
-EXTRA_OECONF="--disable-gcc-check"
-
-inherit autotools
-
-DEFAULT_PREFERENCE = "-1"
diff --git a/packages/qemu/qemu_20071121.bb b/packages/qemu/qemu_0.9.1.bb
index 2b6f289974..41194ff73f 100644
--- a/packages/qemu/qemu_20071121.bb
+++ b/packages/qemu/qemu_0.9.1.bb
@@ -1,16 +1,12 @@
 LICENSE = "GPL"
 DEPENDS = "zlib"
-SRCDATE = "20071121"
-PV = "0.9.0+cvs${SRCDATE}"
-PR = "r1"
-
-DEFAULT_PREFERENCE = "-1"
+PR = "r4"
 
 FILESPATH = "${FILE_DIRNAME}/qemu-${PV}:${FILE_DIRNAME}/files"
 FILESDIR = "${WORKDIR}"
 
 SRC_URI = "\
-    cvs://anonymous@cvs.savannah.nongnu.org/sources/qemu;method=pserver;rsh=ssh;module=qemu \
+    http://fabrice.bellard.free.fr/qemu/qemu-0.9.1.tar.gz \
     file://02_snapshot_use_tmpdir.patch;patch=1;pnum=0 \
     file://04_do_not_print_rtc_freq_if_ok.patch;patch=1;pnum=1 \
     file://05_non-fatal_if_linux_hd_missing.patch;patch=1;pnum=1 \
@@ -35,8 +31,8 @@ SRC_URI = "\
     file://qemu-amd64-32b-mapping-0.9.0.patch;patch=1 \
     file://workaround_bad_futex_headers.patch;patch=1 \
     file://fix_segfault.patch;patch=1 \
-    file://disable-error-in-configure.patch;patch=1 \
-    file://no-strip.patch;patch=1"
+    file://configure_symlinkpath_fix.patch;patch=1 \
+    file://disable-error-in-configure.patch;patch=1"
 
 #    svn://svn.o-hand.com/repos/misc/trunk/qemu-packaging/qemu;module=debian;proto=http;srcdate=20070119 \
 #    file://debian/patches/21_net_soopts.patch;patch=1;pnum=0 \
@@ -47,10 +43,10 @@ SRC_URI = "\
 #    file://debian/patches/80_ui_curses.patch;patch=1;pnum=0 \
 #    file://debian/patches/96-x.patch;patch=1"
 
-S = "${WORKDIR}/qemu"
+S = "${WORKDIR}/qemu-${PV}"
 
 #EXTRA_OECONF += "--disable-sdl"
-#EXTRA_OECONF += "--target-list=arm-linux-user"
+#EXTRA_OECONF += "--target-list=arm-linux-user,arm-softmmu"
 EXTRA_OECONF += "--disable-gfx-check"
 
 inherit autotools