qemu: Upgrade 0.13.0 -> 0.14.0

* ppc-hack patch is dropped.

* Other patches which were direct backports
  or has been merged upstream in 0.14.0 are
  also dropped

Signed-off-by: Khem Raj <raj.khem@gmail.com>

24 files changed, 544 insertions, 927 deletions

diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/fix-dirent.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/fix-dirent.patch
deleted file mode 100644
index 8bbfa0e88e..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/fix-dirent.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: qemu/linux-user/syscall.c
-===================================================================
---- qemu.orig/linux-user/syscall.c	2010-05-11 13:16:22.421783949 -0400
-+++ qemu/linux-user/syscall.c	2010-05-11 13:16:31.759805849 -0400
-@@ -26,6 +26,7 @@
- #include <errno.h>
- #include <unistd.h>
- #include <fcntl.h>
-+#include <dirent.h>
- #include <time.h>
- #include <limits.h>
- #include <sys/types.h>
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/glflags.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/glflags.patch
deleted file mode 100644
index 0a27c2dee1..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/glflags.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Index: git/Makefile.target
-===================================================================
---- git.orig/Makefile.target	2010-05-27 12:35:26.000000000 -0400
-+++ git/Makefile.target	2010-05-27 12:59:53.520415731 -0400
-@@ -326,7 +326,7 @@ vl.o: qemu-options.h
- 
- monitor.o: qemu-monitor.h
- 
--LIBS += -lGL -lGLU
-+LIBS += -lGL
- 
- ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
- 
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/no-strip.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/no-strip.patch
deleted file mode 100644
index 62cdec6109..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/no-strip.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Index: qemu-0.13.0/Makefile
-===================================================================
---- qemu-0.13.0.orig/Makefile	2011-01-17 16:41:59.000000000 +0800
-+++ qemu-0.13.0/Makefile	2011-01-17 16:44:57.000000000 +0800
-@@ -185,7 +185,7 @@
- install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig
- 	$(INSTALL_DIR) "$(DESTDIR)$(bindir)"
- ifneq ($(TOOLS),)
--	$(INSTALL_PROG) $(STRIP_OPT) $(TOOLS) "$(DESTDIR)$(bindir)"
-+	$(INSTALL_PROG) $(TOOLS) "$(DESTDIR)$(bindir)"
- endif
- ifneq ($(BLOBS),)
- 	$(INSTALL_DIR) "$(DESTDIR)$(datadir)"
-Index: qemu-0.13.0/Makefile.target
-===================================================================
---- qemu-0.13.0.orig/Makefile.target	2011-01-17 16:42:36.000000000 +0800
-+++ qemu-0.13.0/Makefile.target	2011-01-17 16:44:57.000000000 +0800
-@@ -351,7 +351,7 @@
- 
- install: all
- ifneq ($(PROGS),)
--	$(INSTALL) -m 755 $(STRIP_OPT) $(PROGS) "$(DESTDIR)$(bindir)"
-+	$(INSTALL) -m 755 $(PROGS) "$(DESTDIR)$(bindir)"
- endif
- 
- # Include automatically generated dependency files
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/parallel_make.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/parallel_make.patch
deleted file mode 100644
index 278b1a759d..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/parallel_make.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Make -j(>=6) always fail as some job depends on config-host.h. Added following
-patch in upstream to resolve it.
-
-Could remove it in next upgrade if necessary.
-
-Signed-off-by: Zhai Edwin <edwin.zhai@intel.com>
-
-commit f0acb38015409024683911380daa94cc974e4e0e
-Author: Paul Brook <paul@codesourcery.com>
-Date:   Fri Nov 26 18:46:03 2010 +0000
-
-    Add missing dependency.
-    
-    Teach Makefile that cmd.o depends on a generated header (specifically
-    config-host.h).
-    
-    Signed-off-by: Paul Brook <paul@codesourcery.com>
-    (cherry picked from commit 6e14404aab26f74a448747d1e793ac16bde8a92b)
-    
-    Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
-
-Index: qemu-0.13.0/Makefile
-===================================================================
---- qemu-0.13.0.orig/Makefile	2011-01-18 09:45:45.000000000 +0800
-+++ qemu-0.13.0/Makefile	2011-01-18 09:45:45.000000000 +0800
-@@ -107,7 +107,7 @@
- ######################################################################
- 
- qemu-img.o: qemu-img-cmds.h
--qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o: $(GENERATED_HEADERS)
-+qemu-img.o qemu-tool.o qemu-nbd.o qemu-io.o cmd.o: $(GENERATED_HEADERS)
- 
- qemu-img$(EXESUF): qemu-img.o qemu-tool.o qemu-error.o $(block-obj-y) $(qobject-obj-y)
- 
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/port92_fix.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/port92_fix.patch
deleted file mode 100644
index e101c687c0..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/port92_fix.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-With qemu 0.13.0, poky failed to start on ppc arch because both ppc_prep_init
-and i8042_initfn try to register to port 0x92 then cause conflict. Introduce
-this patch from upstream to fix it.
-
-Could remove it in future if necessary.
-
-Signed-off-by: Zhai, Edwin <edwin.zhai@intel.com>
-
-commit 4b78a802ffaabb325a0f7b773031da92d173bde1
-Author: Blue Swirl <blauwirbel@gmail.com>
-Date:   Thu Jan 6 18:24:35 2011 +0000
-
-    pc: move port 92 stuff back to pc.c from pckbd.c
-    
-    956a3e6bb7386de48b642d4fee11f7f86a2fcf9a introduced a bug concerning
-    reset bit for port 92.
-    
-    Since the keyboard output port and port 92 are not compatible anyway,
-    let's separate them.
-    
-    Reported-by: Peter Lieven <pl@dlh.net>
-    Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
-    --
-    v2: added reset handler and VMState
-
-Index: qemu-0.13.0/hw/pc.c
-===================================================================
---- qemu-0.13.0.orig/hw/pc.c	2010-10-16 04:56:09.000000000 +0800
-+++ qemu-0.13.0/hw/pc.c	2011-01-20 20:37:37.000000000 +0800
-@@ -409,11 +409,91 @@
-     qemu_register_reset(pc_cmos_init_late, &arg);
- }
- 
-+/* port 92 stuff: could be split off */
-+typedef struct Port92State {
-+    ISADevice dev;
-+    uint8_t outport;
-+    qemu_irq *a20_out;
-+} Port92State;
-+
-+static void port92_write(void *opaque, uint32_t addr, uint32_t val)
-+{
-+    Port92State *s = opaque;
-+
-+    DPRINTF("port92: write 0x%02x\n", val);
-+    s->outport = val;
-+    qemu_set_irq(*s->a20_out, (val >> 1) & 1);
-+    if (val & 1) {
-+        qemu_system_reset_request();
-+    }
-+}
-+
-+static uint32_t port92_read(void *opaque, uint32_t addr)
-+{
-+    Port92State *s = opaque;
-+    uint32_t ret;
-+
-+    ret = s->outport;
-+    DPRINTF("port92: read 0x%02x\n", ret);
-+    return ret;
-+}
-+
-+static void port92_init(ISADevice *dev, qemu_irq *a20_out)
-+{
-+    Port92State *s = DO_UPCAST(Port92State, dev, dev);
-+
-+    s->a20_out = a20_out;
-+}
-+
-+static const VMStateDescription vmstate_port92_isa = {
-+    .name = "port92",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .minimum_version_id_old = 1,
-+    .fields      = (VMStateField []) {
-+        VMSTATE_UINT8(outport, Port92State),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void port92_reset(DeviceState *d)
-+{
-+    Port92State *s = container_of(d, Port92State, dev.qdev);
-+
-+    s->outport &= ~1;
-+}
-+
-+static int port92_initfn(ISADevice *dev)
-+{
-+    Port92State *s = DO_UPCAST(Port92State, dev, dev);
-+
-+    register_ioport_read(0x92, 1, 1, port92_read, s);
-+    register_ioport_write(0x92, 1, 1, port92_write, s);
-+    s->outport = 0;
-+    return 0;
-+}
-+
-+static ISADeviceInfo port92_info = {
-+    .qdev.name     = "port92",
-+    .qdev.size     = sizeof(Port92State),
-+    .qdev.vmsd     = &vmstate_port92_isa,
-+    .qdev.no_user  = 1,
-+    .qdev.reset    = port92_reset,
-+    .init          = port92_initfn,
-+};
-+
-+static void port92_register(void)
-+{
-+    isa_qdev_register(&port92_info);
-+}
-+device_init(port92_register)
-+
- static void handle_a20_line_change(void *opaque, int irq, int level)
- {
-     CPUState *cpu = opaque;
- 
-     /* XXX: send to all CPUs ? */
-+    /* XXX: add logic to handle multiple A20 line sources */
-     cpu_x86_set_a20(cpu, level);
- }
- 
-@@ -1017,7 +1097,7 @@
-     PITState *pit;
-     qemu_irq rtc_irq = NULL;
-     qemu_irq *a20_line;
--    ISADevice *i8042;
-+    ISADevice *i8042, *port92;
-     qemu_irq *cpu_exit_irq;
- 
-     register_ioport_write(0x80, 1, 1, ioport80_write, NULL);
-@@ -1051,10 +1131,12 @@
-         }
-     }
- 
--    a20_line = qemu_allocate_irqs(handle_a20_line_change, first_cpu, 1);
-+    a20_line = qemu_allocate_irqs(handle_a20_line_change, first_cpu, 2);
-     i8042 = isa_create_simple("i8042");
--    i8042_setup_a20_line(i8042, a20_line);
-+    i8042_setup_a20_line(i8042, &a20_line[0]);
-     vmmouse_init(i8042);
-+    port92 = isa_create_simple("port92");
-+    port92_init(port92, &a20_line[1]);
- 
-     cpu_exit_irq = qemu_allocate_irqs(cpu_request_exit, NULL, 1);
-     DMA_init(0, cpu_exit_irq);
-Index: qemu-0.13.0/hw/pckbd.c
-===================================================================
---- qemu-0.13.0.orig/hw/pckbd.c	2010-10-16 04:56:09.000000000 +0800
-+++ qemu-0.13.0/hw/pckbd.c	2011-01-20 20:33:44.000000000 +0800
-@@ -209,10 +209,8 @@
-         ps2_queue(s->kbd, b);
- }
- 
--static void ioport92_write(void *opaque, uint32_t addr, uint32_t val)
-+static void outport_write(KBDState *s, uint32_t val)
- {
--    KBDState *s = opaque;
--
-     DPRINTF("kbd: write outport=0x%02x\n", val);
-     s->outport = val;
-     if (s->a20_out) {
-@@ -223,16 +221,6 @@
-     }
- }
- 
--static uint32_t ioport92_read(void *opaque, uint32_t addr)
--{
--    KBDState *s = opaque;
--    uint32_t ret;
--
--    ret = s->outport;
--    DPRINTF("kbd: read outport=0x%02x\n", ret);
--    return ret;
--}
--
- static void kbd_write_command(void *opaque, uint32_t addr, uint32_t val)
- {
-     KBDState *s = opaque;
-@@ -340,7 +328,7 @@
-         kbd_queue(s, val, 1);
-         break;
-     case KBD_CCMD_WRITE_OUTPORT:
--        ioport92_write(s, 0, val);
-+        outport_write(s, val);
-         break;
-     case KBD_CCMD_WRITE_MOUSE:
-         ps2_write_mouse(s->mouse, val);
-@@ -469,8 +457,6 @@
-     register_ioport_write(0x60, 1, 1, kbd_write_data, s);
-     register_ioport_read(0x64, 1, 1, kbd_read_status, s);
-     register_ioport_write(0x64, 1, 1, kbd_write_command, s);
--    register_ioport_read(0x92, 1, 1, ioport92_read, s);
--    register_ioport_write(0x92, 1, 1, ioport92_write, s);
- 
-     s->kbd = ps2_kbd_init(kbd_update_kbd_irq, s);
-     s->mouse = ps2_mouse_init(kbd_update_aux_irq, s);
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/qemu-ppc-hack.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/qemu-ppc-hack.patch
deleted file mode 100644
index 6f45788183..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/qemu-ppc-hack.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-Quick fixes to get the ppc system model to boot a 603e based

-kernel.

-

-Index: qemu-0.13.0/hw/m48t59.c
-===================================================================
---- qemu-0.13.0.orig/hw/m48t59.c	2010-10-16 04:56:09.000000000 +0800
-+++ qemu-0.13.0/hw/m48t59.c	2011-01-17 16:40:09.000000000 +0800
-@@ -50,6 +50,7 @@
-  */
- 
- struct M48t59State {
-+    SysBusDevice busdev;
-     /* Model parameters */
-     uint32_t type; // 2 = m48t02, 8 = m48t08, 59 = m48t59
-     /* Hardware parameters */
-@@ -74,11 +75,6 @@
-     M48t59State state;
- } M48t59ISAState;
- 
--typedef struct M48t59SysBusState {
--    SysBusDevice busdev;
--    M48t59State state;
--} M48t59SysBusState;
--
- /* Fake timer functions */
- 
- /* Alarm management */
-@@ -629,8 +625,7 @@
- 
- static void m48t59_reset_sysbus(DeviceState *d)
- {
--    M48t59SysBusState *sys = container_of(d, M48t59SysBusState, busdev.qdev);
--    M48t59State *NVRAM = &sys->state;
-+    M48t59State *NVRAM = container_of(d, M48t59State, busdev.qdev);
- 
-     m48t59_reset_common(NVRAM);
- }
-@@ -641,7 +636,7 @@
- {
-     DeviceState *dev;
-     SysBusDevice *s;
--    M48t59SysBusState *d;
-+    M48t59State *d;
- 
-     dev = qdev_create(NULL, "m48t59");
-     qdev_prop_set_uint32(dev, "type", type);
-@@ -658,9 +653,9 @@
-         sysbus_mmio_map(s, 0, mem_base);
-     }
- 
--    d = FROM_SYSBUS(M48t59SysBusState, s);
-+    d = FROM_SYSBUS(M48t59State, s);
- 
--    return &d->state;
-+    return d;
- }
- 
- M48t59State *m48t59_init_isa(uint32_t io_base, uint16_t size, int type)
-@@ -710,8 +705,7 @@
- 
- static int m48t59_init1(SysBusDevice *dev)
- {
--    M48t59SysBusState *d = FROM_SYSBUS(M48t59SysBusState, dev);
--    M48t59State *s = &d->state;
-+    M48t59State *s = FROM_SYSBUS(M48t59State, dev);
-     int mem_index;
- 
-     sysbus_init_irq(dev, &s->IRQ);
-@@ -740,12 +734,12 @@
- static SysBusDeviceInfo m48t59_info = {
-     .init = m48t59_init1,
-     .qdev.name  = "m48t59",
--    .qdev.size = sizeof(M48t59SysBusState),
-+    .qdev.size  = sizeof(M48t59State),
-     .qdev.reset = m48t59_reset_sysbus,
-     .qdev.props = (Property[]) {
--        DEFINE_PROP_UINT32("size",    M48t59SysBusState, state.size,    -1),
--        DEFINE_PROP_UINT32("type",    M48t59SysBusState, state.type,    -1),
--        DEFINE_PROP_HEX32( "io_base", M48t59SysBusState, state.io_base,  0),
-+        DEFINE_PROP_UINT32("size",    M48t59State, size,    -1),
-+        DEFINE_PROP_UINT32("type",    M48t59State, type,    -1),
-+        DEFINE_PROP_HEX32( "io_base", M48t59State, io_base,  0),
-         DEFINE_PROP_END_OF_LIST(),
-     }
- };
-Index: qemu-0.13.0/hw/ppc_prep.c
-===================================================================
---- qemu-0.13.0.orig/hw/ppc_prep.c	2010-10-16 04:56:09.000000000 +0800
-+++ qemu-0.13.0/hw/ppc_prep.c	2011-01-15 18:29:25.000000000 +0800
-@@ -74,7 +74,7 @@
- /* Constants for devices init */
- static const int ide_iobase[2] = { 0x1f0, 0x170 };
- static const int ide_iobase2[2] = { 0x3f6, 0x376 };
--static const int ide_irq[2] = { 13, 13 };
-+static const int ide_irq[2] = { 13, 14 };
- 
- #define NE2000_NB_MAX 6
- 
-@@ -631,9 +631,6 @@
-     if (filename) {
-         qemu_free(filename);
-     }
--    if (env->nip < 0xFFF80000 && bios_size < 0x00100000) {
--        hw_error("PowerPC 601 / 620 / 970 need a 1MB BIOS\n");
--    }
- 
-     if (linux_boot) {
-         kernel_base = KERNEL_LOAD_ADDR;
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/vmware-vga-fifo-rewind.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/vmware-vga-fifo-rewind.patch
deleted file mode 100644
index 867e54ba11..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/vmware-vga-fifo-rewind.patch
+++ /dev/null
@@ -1,198 +0,0 @@
-commit 4dedc07ffbbc66002e0fd2b97d5516fe6aca5eea
-Author: Andrzej Zaborowski <balrog@zabor.org>
-Date:   Fri Sep 10 02:23:31 2010 +0200
-
-    vmware_vga: Add checks to deal with non-atomic fifo writes.
-    
-    Janne Huttunen noticed that the FIFO end pointer is updated by the
-    guest after writing each word to the FIFO, at least the X.org driver
-    which is open does this.  This means that there's no way for the
-    host to know if the guest is in the middle a write operation.  Qemu
-    thus needs to read the beginning of the command up to when it's able
-    to tell how many words are expected for the given command.  It will
-    abort reading and rewind the FIFO if there aren't enough words yet,
-    this should be relatively rare but it is suspected to have been the
-    cause of the occasional FIFO overrun that killed the display.
-
-Index: qemu-0.13.0/hw/vmware_vga.c
-===================================================================
---- qemu-0.13.0.orig/hw/vmware_vga.c	2011-01-15 18:06:06.000000000 +0800
-+++ qemu-0.13.0/hw/vmware_vga.c	2011-01-15 18:17:04.000000000 +0800
-@@ -521,27 +521,37 @@
- 
- static uint32_t last_cmd;
- 
--static inline int vmsvga_fifo_empty(struct vmsvga_state_s *s)
-+static inline int vmsvga_fifo_length(struct vmsvga_state_s *s)
- {
-+    int num;
-     if (!s->config || !s->enable)
--        return 1;
--    return (s->cmd->next_cmd == s->cmd->stop);
-+        return 0;
-+    num = CMD(next_cmd) - CMD(stop);
-+    if (num < 0)
-+        num += CMD(max) - CMD(min);
-+    return num >> 2;
- }
- 
- static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s)
- {
--    int offset = CMD(stop);
-+    uint32_t cmd = s->fifo[CMD(stop) >> 2];
- 
-+    /* If parameter is not available in FIFO, return 0 rather than random
-+     * value. Also update the stop as missing parameter will be inserted
-+     * soonly, else it will be treated as new command next time.
-+     * With rewinding in vmsvga_fifo_run, this unlikely happen.
-+     */
-     if (unlikely(s->cmd->next_cmd == s->cmd->stop)) {
-         fprintf(stderr, "%s: FIFO empty during CMD %i\n",
-                         __FUNCTION__, last_cmd);
--        return 0x00000000;
-+        cmd = 0;
-     }
- 
--    s->cmd->stop = cpu_to_le32(offset + 4);
--    if (offset + 4 >= CMD(max))
-+    s->cmd->stop = cpu_to_le32(CMD(stop) + 4);
-+    if (CMD(stop) >= CMD(max))
-         s->cmd->stop = s->cmd->min;
--    return s->fifo[offset >> 2];
-+
-+    return cmd;
- }
- 
- static inline uint32_t vmsvga_fifo_read(struct vmsvga_state_s *s)
-@@ -552,13 +562,23 @@
- static void vmsvga_fifo_run(struct vmsvga_state_s *s)
- {
-     uint32_t colour;
--    int args = 0;
-+    int args, len;
-     int x, y, dx, dy, width, height;
-     struct vmsvga_cursor_definition_s cursor;
--    while (!vmsvga_fifo_empty(s))
-+    uint32_t cmd_start;
-+
-+    len = vmsvga_fifo_length(s);
-+    while (len > 0) {
-+        /* May need to go back to the start of the command if incomplete */
-+        cmd_start = s->cmd->stop;
-+
-         switch (last_cmd = vmsvga_fifo_read(s)) {
-         case SVGA_CMD_UPDATE:
-         case SVGA_CMD_UPDATE_VERBOSE:
-+            len -= 5;
-+            if (len <0)
-+                goto rewind;
-+
-             x = vmsvga_fifo_read(s);
-             y = vmsvga_fifo_read(s);
-             width = vmsvga_fifo_read(s);
-@@ -567,6 +587,10 @@
-             break;
- 
-         case SVGA_CMD_RECT_FILL:
-+            len -= 6;
-+            if (len < 0)
-+                goto rewind;
-+
-             colour = vmsvga_fifo_read(s);
-             x = vmsvga_fifo_read(s);
-             y = vmsvga_fifo_read(s);
-@@ -576,10 +600,15 @@
-             vmsvga_fill_rect(s, colour, x, y, width, height);
-             break;
- #else
-+            args = 0;
-             goto badcmd;
- #endif
- 
-         case SVGA_CMD_RECT_COPY:
-+            len -= 7;
-+            if (len < 0)
-+                goto rewind;
-+
-             x = vmsvga_fifo_read(s);
-             y = vmsvga_fifo_read(s);
-             dx = vmsvga_fifo_read(s);
-@@ -590,10 +619,15 @@
-             vmsvga_copy_rect(s, x, y, dx, dy, width, height);
-             break;
- #else
-+            args = 0;
-             goto badcmd;
- #endif
- 
-         case SVGA_CMD_DEFINE_CURSOR:
-+            len -= 8;
-+            if (len < 0)
-+                goto rewind;
-+
-             cursor.id = vmsvga_fifo_read(s);
-             cursor.hot_x = vmsvga_fifo_read(s);
-             cursor.hot_y = vmsvga_fifo_read(s);
-@@ -602,11 +636,14 @@
-             vmsvga_fifo_read(s);
-             cursor.bpp = vmsvga_fifo_read(s);
- 
-+            args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
- 	    if (SVGA_BITMAP_SIZE(x, y) > sizeof cursor.mask ||
--		SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image) {
--		    args = SVGA_BITMAP_SIZE(x, y) + SVGA_PIXMAP_SIZE(x, y, cursor.bpp);
-+		SVGA_PIXMAP_SIZE(x, y, cursor.bpp) > sizeof cursor.image)
- 		    goto badcmd;
--	    }
-+
-+            len -= args;
-+            if (len < 0)
-+                goto rewind;
- 
-             for (args = 0; args < SVGA_BITMAP_SIZE(x, y); args ++)
-                 cursor.mask[args] = vmsvga_fifo_read_raw(s);
-@@ -625,6 +662,10 @@
-          * for so we can avoid FIFO desync if driver uses them illegally.
-          */
-         case SVGA_CMD_DEFINE_ALPHA_CURSOR:
-+            len -= 6;
-+            if (len < 0)
-+                goto rewind;
-+
-             vmsvga_fifo_read(s);
-             vmsvga_fifo_read(s);
-             vmsvga_fifo_read(s);
-@@ -639,6 +680,10 @@
-             args = 7;
-             goto badcmd;
-         case SVGA_CMD_DRAW_GLYPH_CLIPPED:
-+            len -= 4;
-+            if (len < 0)
-+                goto rewind;
-+
-             vmsvga_fifo_read(s);
-             vmsvga_fifo_read(s);
-             args = 7 + (vmsvga_fifo_read(s) >> 2);
-@@ -659,14 +704,22 @@
-             break; /* Nop */
- 
-         default:
-+            args = 0;
-         badcmd:
-+            len -= args;
-+            if (len < 0)
-+                goto rewind;
-             while (args --)
-                 vmsvga_fifo_read(s);
-             printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
-                             __FUNCTION__, last_cmd);
-             break;
-+        rewind:
-+            s->cmd->stop = cmd_start;
-+            break;
-         }
- 
-+    }
-     s->syncing = 0;
- }
- 
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/wacom-tablet-fix.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/wacom-tablet-fix.patch
deleted file mode 100644
index b8210db2b1..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/wacom-tablet-fix.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-qemu 0.13.0 cause seg fault in qemu_remove_mouse_event_handler, this patch from
-upstream can fix it.
-
-Should remove it in next upgrade if necessary.
-
-Signed-off-by: Zhai Edwin <edwin.zhai@intel.com>
-
-commit b2d4d8329963b13c5cebe5944dcc99f0e9d1b5c7
-Author: Gerd Hoffmann <kraxel@redhat.com>
-Date:   Fri Oct 8 12:30:14 2010 +0200
-
-    wacom tablet: activate event handlers.
-    
-    Add qemu_activate_mouse_event_handler() calls to the usb wavom tablet so
-    it actually receives events.  Also make sure we only remove the handler
-    if we registered it before.
-    
-    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-    Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
-
-Index: qemu-0.13.0/hw/usb-wacom.c
-===================================================================
---- qemu-0.13.0.orig/hw/usb-wacom.c	2010-10-16 04:56:09.000000000 +0800
-+++ qemu-0.13.0/hw/usb-wacom.c	2011-01-18 16:58:44.000000000 +0800
-@@ -160,6 +160,7 @@
-     if (!s->mouse_grabbed) {
-         s->eh_entry = qemu_add_mouse_event_handler(usb_mouse_event, s, 0,
-                         "QEMU PenPartner tablet");
-+        qemu_activate_mouse_event_handler(s->eh_entry);
-         s->mouse_grabbed = 1;
-     }
- 
-@@ -197,6 +198,7 @@
-     if (!s->mouse_grabbed) {
-         s->eh_entry = qemu_add_mouse_event_handler(usb_wacom_event, s, 1,
-                         "QEMU PenPartner tablet");
-+        qemu_activate_mouse_event_handler(s->eh_entry);
-         s->mouse_grabbed = 1;
-     }
- 
-@@ -334,8 +336,10 @@
-         ret = 0;
-         break;
-     case WACOM_SET_REPORT:
--        qemu_remove_mouse_event_handler(s->eh_entry);
--        s->mouse_grabbed = 0;
-+        if (s->mouse_grabbed) {
-+            qemu_remove_mouse_event_handler(s->eh_entry);
-+            s->mouse_grabbed = 0;
-+        }
-         s->mode = data[0];
-         ret = 0;
-         break;
-@@ -397,7 +401,10 @@
- {
-     USBWacomState *s = (USBWacomState *) dev;
- 
--    qemu_remove_mouse_event_handler(s->eh_entry);
-+    if (s->mouse_grabbed) {
-+        qemu_remove_mouse_event_handler(s->eh_entry);
-+        s->mouse_grabbed = 0;
-+    }
- }
- 
- static int usb_wacom_initfn(USBDevice *dev)
diff --git a/meta/recipes-devtools/qemu/qemu-0.13.0/workaround_bad_futex_headers.patch b/meta/recipes-devtools/qemu/qemu-0.13.0/workaround_bad_futex_headers.patch
deleted file mode 100644
index a08e2d9acd..0000000000
--- a/meta/recipes-devtools/qemu/qemu-0.13.0/workaround_bad_futex_headers.patch
+++ /dev/null
@@ -1,24 +0,0 @@
----
- linux-user/syscall.c |   10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-Index: qemu-0.13.0/linux-user/syscall.c
-===================================================================
---- qemu-0.13.0.orig/linux-user/syscall.c	2011-01-17 16:52:18.000000000 +0800
-+++ qemu-0.13.0/linux-user/syscall.c	2011-01-17 16:52:20.000000000 +0800
-@@ -99,6 +99,15 @@
- #define CLONE_NPTL_FLAGS2 0
- #endif
- 
-+#define FUTEX_WAIT              0
-+#define FUTEX_WAKE              1
-+#define FUTEX_FD                2
-+#define FUTEX_REQUEUE           3
-+#define FUTEX_CMP_REQUEUE       4
-+#define FUTEX_WAKE_OP           5
-+#define FUTEX_LOCK_PI           6
-+#define FUTEX_UNLOCK_PI         7
-+
- //#define DEBUG
- 
- //#include <linux/msdos_fs.h>
diff --git a/meta/recipes-devtools/qemu/qemu-0.14.0/Detect-and-use-GCC-atomic-builtins-for-locking.patch b/meta/recipes-devtools/qemu/qemu-0.14.0/Detect-and-use-GCC-atomic-builtins-for-locking.patch
new file mode 100644
index 0000000000..dc69bfbbd5
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu-0.14.0/Detect-and-use-GCC-atomic-builtins-for-locking.patch
@@ -0,0 +1,84 @@
+From de01f17a2cb88dc5ff53cc321342b888c33b120a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lo=C3=AFc=20Minier?= <lool@dooz.org>
+Date: Thu, 11 Feb 2010 17:42:33 +0100
+Subject: [PATCH] Detect and use GCC atomic builtins for locking
+
+---
+ configure   |   17 +++++++++++++++++
+ qemu-lock.h |   13 +++++++++++++
+ 2 files changed, 30 insertions(+), 0 deletions(-)
+
+Index: qemu-0.14.0/configure
+===================================================================
+--- qemu-0.14.0.orig/configure
++++ qemu-0.14.0/configure
+@@ -2243,6 +2243,20 @@ fi
+ ##########################################
+ 
+ ##########################################
++# check if we have gcc atomic built-ins
++gcc_atomic_builtins=no
++cat > $TMPC << EOF
++int main(void) {
++    int i;
++    __sync_lock_test_and_set(&i, 1);
++    __sync_lock_release(&i);
++}
++EOF
++if compile_prog "" ""; then
++    gcc_atomic_builtins=yes
++fi
++
++##########################################
+ # check if we have fdatasync
+ 
+ fdatasync=no
+@@ -2731,6 +2745,9 @@ fi
+ if test "$gcc_attribute_warn_unused_result" = "yes" ; then
+   echo "CONFIG_GCC_ATTRIBUTE_WARN_UNUSED_RESULT=y" >> $config_host_mak
+ fi
++if test "$gcc_atomic_builtins" = "yes" ; then
++  echo "CONFIG_GCC_ATOMIC_BUILTINS=y" >> $config_host_mak
++fi
+ if test "$fdatasync" = "yes" ; then
+   echo "CONFIG_FDATASYNC=y" >> $config_host_mak
+ fi
+Index: qemu-0.14.0/qemu-lock.h
+===================================================================
+--- qemu-0.14.0.orig/qemu-lock.h
++++ qemu-0.14.0/qemu-lock.h
+@@ -33,6 +33,14 @@
+ 
+ #else
+ 
++#ifdef CONFIG_GCC_ATOMIC_BUILTINS
++typedef int spinlock_t;
++
++#define SPIN_LOCK_UNLOCKED 0
++
++#define resetlock(p) __sync_lock_release((p))
++#else /* CONFIG_GCC_ATOMIC_BUILTINS */
++
+ #if defined(__hppa__)
+ 
+ typedef int spinlock_t[4];
+@@ -56,7 +64,11 @@ static inline void resetlock (spinlock_t
+ }
+ 
+ #endif
++#endif /* !CONFIG_GCC_ATOMIC_BUILTINS */
+ 
++#ifdef CONFIG_GCC_ATOMIC_BUILTINS
++#define testandset(p) __sync_lock_test_and_set((p), 1)
++#else /* CONFIG_GCC_ATOMIC_BUILTINS */