main/qemu: upgrade to 2.5.0

remove unused patches
made simple & clean init script for guest-agent

8 files changed, 35 insertions, 1471 deletions

diff --git a/main/qemu/APKBUILD b/main/qemu/APKBUILD
index e3263e663b..63e3585490 100644
--- a/main/qemu/APKBUILD
+++ b/main/qemu/APKBUILD
@@ -1,7 +1,8 @@
+# Contributor: Valery Kartel <valery.kartel@gmail.com>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=qemu
-pkgver=2.4.1
-pkgrel=3
+pkgver=2.5.0
+pkgrel=0
 pkgdesc="QEMU is a generic machine emulator and virtualizer"
 url="http://qemu.org/"
 arch="all"
@@ -35,7 +36,7 @@ makedepends="
 	zlib-dev
 	"
 depends=
-install="qemu.pre-install"
+install="$pkgname.pre-install"
 subpackages="
 $pkgname-aarch64:aarch64
 $pkgname-alpha:alpha
@@ -112,19 +113,19 @@ esac
 
 subpackages="$subpackages $pkgname-img"
 
-source="http://wiki.qemu-project.org/download/qemu-$pkgver.tar.bz2
+source="http://wiki.qemu-project.org/download/$pkgname-$pkgver.tar.bz2
 	0001-elfload-load-PIE-executables-to-right-address.patch
 	0006-linux-user-signal.c-define-__SIGRTMIN-MAX-for-non-GN.patch
-
 	musl-F_SHLCK-and-F_EXLCK.patch
 	fix-sigevent-and-sigval_t.patch
-
-	qemu-guest-agent.confd
-	qemu-guest-agent.initd
+	$pkgname-guest-agent.confd
+	$pkgname-guest-agent.initd
 	80-kvm.rules"
 
+_builddir="$srcdir"/$pkgname-$pkgver
+
 prepare() {
-	cd "$srcdir"/$pkgname-$pkgver
+	cd "$_builddir"
 	for i in $source; do
 		case $i in
 		*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
@@ -164,7 +165,6 @@ _compile() {
 		--disable-debug-info \
 		--disable-bsd-user \
 		--disable-werror \
-		--disable-smartcard-nss \
 		--disable-sdl \
 		--disable-xen \
 		--cc="${CC:-gcc}" \
@@ -174,14 +174,14 @@ _compile() {
 }
 
 build() {
-	mkdir -p "$srcdir"/qemu-$pkgver/build "$srcdir"/qem \
-		"$srcdir"/qemu-$pkgver/build-gtk
-	cd "$srcdir"/qemu-$pkgver/build
+	mkdir -p "$_builddir"/build \
+		"$_builddir"/build-gtk
+	cd "$_builddir"/build
 
 	_compile \
 		--enable-vnc \
 		--enable-vnc-png \
-		--enable-vnc-tls \
+		--enable-vnc-jpeg \
 		--enable-spice \
 		--enable-linux-user \
 		--enable-guest-agent \
@@ -193,11 +193,9 @@ build() {
 # http://web.archiveorange.com/archive/v/21oVv8wOfpQGkyy8EK0N
 #	make check || return 1
 
-	if [ -z "$_arch" ]; then
-		return 0
-	fi
+	[ -z "$_arch" ] && return 0
 
-	cd "$srcdir"/qemu-$pkgver/build-gtk
+	cd "$_builddir"/build-gtk
 	_compile \
 		--enable-gtk \
 		--with-gtkabi=3.0 \
@@ -210,16 +208,15 @@ build() {
 }
 
 package() {
-	cd "$srcdir"/qemu-$pkgver/build
+	cd "$_builddir"/build
 	make DESTDIR="$pkgdir" install || return 1
 	install -Dm644 "$srcdir"/80-kvm.rules \
 		"$pkgdir"/lib/udev/rules.d/80-kvm.rules || return 1
 	paxmark -m "$pkgdir"/usr/bin/qemu-system-* || return 1
 
-	if [ -z "$_arch" ]; then
-		return 0
-	fi
-	cd "$srcdir"/qemu-$pkgver/build-gtk
+	[ -z "$_arch" ] && return 0
+
+	cd "$_builddir"/build-gtk
 	install $_arch-softmmu/qemu-system-$_arch \
 		"$pkgdir"/usr/bin/qemu-system-$_arch-gtk
 }
@@ -314,33 +311,33 @@ guest() {
 	pkgdesc="QEMU guest agent"
 	mkdir -p "$subpkgdir"/usr/bin
 	mv "$pkgdir"/usr/bin/qemu-ga "$subpkgdir"/usr/bin/
-	install -Dm755 "$srcdir"/qemu-guest-agent.initd \
-		"$subpkgdir"/etc/init.d/qemu-guest-agent || return 1
-	install -Dm644 "$srcdir"/qemu-guest-agent.confd \
-		"$subpkgdir"/etc/conf.d/qemu-guest-agent || return 1
+	install -Dm755 "$srcdir"/$pkgname-guest-agent.initd \
+		"$subpkgdir"/etc/init.d/$pkgname-guest-agent || return 1
+	install -Dm644 "$srcdir"/$pkgname-guest-agent.confd \
+		"$subpkgdir"/etc/conf.d/$pkgname-guest-agent || return 1
 }
 
-md5sums="a895e93ec1dafc34bc64ed676f0d55a6  qemu-2.4.1.tar.bz2
+md5sums="f469f2330bbe76e3e39db10e9ac4f8db  qemu-2.5.0.tar.bz2
 672727bb1d8c8ab7b5def65dd1793c33  0001-elfload-load-PIE-executables-to-right-address.patch
 d364208c4847ad2baeb237900befecd1  0006-linux-user-signal.c-define-__SIGRTMIN-MAX-for-non-GN.patch
 bc5f2e41ed3b6d6d30b672adab82e3e1  musl-F_SHLCK-and-F_EXLCK.patch
 9afbd6c9586229ce64275f012d665e2a  fix-sigevent-and-sigval_t.patch
 1663bc6977f6886a58394155b1bf3676  qemu-guest-agent.confd
-4cb15a1c3de2691dd65842f2325dfe22  qemu-guest-agent.initd
+ea972f2fc5505488f68320bf386106bb  qemu-guest-agent.initd
 66660f143235201249dc0648b39b86ee  80-kvm.rules"
-sha256sums="e3d5cf4c8b1f9129c9c797329a515bfb6b3b1ded0ab8b394c8a316490fe3a177  qemu-2.4.1.tar.bz2
+sha256sums="3443887401619fe33bfa5d900a4f2d6a79425ae2b7e43d5b8c36eb7a683772d4  qemu-2.5.0.tar.bz2
 af35304b165622a53f7557b59ffd8da5030f5fd444e669c862f9410131f3b987  0001-elfload-load-PIE-executables-to-right-address.patch
 6af6cf9044997710a6d0fbdba30a35c8d775e30d30c032ec97db672f75ec88ac  0006-linux-user-signal.c-define-__SIGRTMIN-MAX-for-non-GN.patch
 eefd597197223899d3b12d8274af493153e270fd06ea8622e33d6eaeae063d40  musl-F_SHLCK-and-F_EXLCK.patch
 9abdf3410dea742cac3552363950c8a7fbcec8dd2bfd68e3c417a284f4e702f5  fix-sigevent-and-sigval_t.patch
 d84e53a94584f37f3bd1b21f44077b5de0d07094c6729f26ae20ab1f7b9cc298  qemu-guest-agent.confd
-91f5ba66b56bb9a3e0d134de3ea756794d5f09fe8a14a4b0d3d95f69a9245c60  qemu-guest-agent.initd
+5bef90ccab2e743868fd562eee9a3ded35c8d3e01fa387367ed55a0da95570d5  qemu-guest-agent.initd
 37f666f1cdb7d8a62171de69b531681dcb0fba74236729dac8b6c019232eba84  80-kvm.rules"
-sha512sums="fde32b71a50d888c1055e61f4e6dfc45bb97e8e9ebee490c545965fbdcbd5ffd859fbf20648abed1f4fa9fcc5635e9b22e1829bbe802fc8aaf989d6013235917  qemu-2.4.1.tar.bz2
+sha512sums="12153f94cc7f834fd6a85f25690c36f2331d88d414426fb8b9ac20a34e6f9222b1eda30b727674af583580fae90dfd6d0614a905dce1567d94cd049d426b9dd3  qemu-2.5.0.tar.bz2
 405008589cad1c8b609eca004d520bf944366e8525f85a19fc6e283c95b84b6c2429822ba064675823ab69f1406a57377266a65021623d1cd581e7db000134fd  0001-elfload-load-PIE-executables-to-right-address.patch
 ec84b27648c01c6e58781295dcd0c2ff8e5a635f9836ef50c1da5d0ed125db1afc4cb5b01cb97606d6dd8f417acba93e1560d9a32ca29161a4bb730b302440ea  0006-linux-user-signal.c-define-__SIGRTMIN-MAX-for-non-GN.patch
 5de10f7e8abae16d1d7521e5ca1bfb62a8f295b324bea84f122f882b7b9354c21e5a00b20a1c5484c1b737b937e53c4ca6979e55705522f0779a5669725369f5  musl-F_SHLCK-and-F_EXLCK.patch
 e3f006c28318669356cd5b778f26774f06b0a40a4ac852573379df63efcc8276869958faec16797a38bf96c6061dfc040309e462d8559984f67eaf4af701ca1a  fix-sigevent-and-sigval_t.patch
 d90c034cae3f9097466854ed1a9f32ab4b02089fcdf7320e8f4da13b2b1ff65067233f48809911485e4431d7ec1a22448b934121bc9522a2dc489009e87e2b1f  qemu-guest-agent.confd
-69457d757909b990f4fdfaef621696e5a5d287b42bc58e553cb52d85191788a269e91c0475bfb7223d3a9120c19cdf4d749b4d54013a644f33d0551517cdf094  qemu-guest-agent.initd
+316b40d97587fea717821852859d81039cfdcb276a658bb6e6fb554e321d5856a833ebb3778149c4732cea625bac320b1008d374c88a9aae35c0fb67977c01b7  qemu-guest-agent.initd
 9b7a89b20fcf737832cb7b4d5dc7d8301dd88169cbe5339eda69fbb51c2e537d8cb9ec7cf37600899e734209e63410d50d0821bce97e401421db39c294d97be2  80-kvm.rules"
diff --git a/main/qemu/CVE-2014-8106.patch b/main/qemu/CVE-2014-8106.patch
deleted file mode 100644
index 1bf83fd389..0000000000
--- a/main/qemu/CVE-2014-8106.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-http://bugs.alpinelinux.org/issues/3774
-
---- ./hw/display/cirrus_vga.c.orig
-+++ ./hw/display/cirrus_vga.c
-@@ -172,20 +172,6 @@
- 
- #define CIRRUS_PNPMMIO_SIZE         0x1000
- 
--#define BLTUNSAFE(s) \
--    ( \
--        ( /* check dst is within bounds */ \
--            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
--                + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
--                    (s)->vga.vram_size \
--        ) || \
--        ( /* check src is within bounds */ \
--            (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
--                + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
--                    (s)->vga.vram_size \
--        ) \
--    )
--
- struct CirrusVGAState;
- typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
-                                      uint8_t * dst, const uint8_t * src,
-@@ -278,6 +264,50 @@
-  *
-  ***************************************/
- 
-+static bool blit_region_is_unsafe(struct CirrusVGAState *s,
-+                                  int32_t pitch, int32_t addr)
-+{
-+    if (pitch < 0) {
-+        int64_t min = addr
-+            + ((int64_t)s->cirrus_blt_height-1) * pitch;
-+        int32_t max = addr
-+            + s->cirrus_blt_width;
-+        if (min < 0 || max >= s->vga.vram_size) {
-+            return true;
-+        }
-+    } else {
-+        int64_t max = addr
-+            + ((int64_t)s->cirrus_blt_height-1) * pitch
-+            + s->cirrus_blt_width;
-+        if (max >= s->vga.vram_size) {
-+            return true;
-+        }
-+    }
-+    return false;
-+}
-+
-+static bool blit_is_unsafe(struct CirrusVGAState *s)
-+{
-+    /* should be the case, see cirrus_bitblt_start */
-+    assert(s->cirrus_blt_width > 0);
-+    assert(s->cirrus_blt_height > 0);
-+
-+    if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
-+        return true;
-+    }
-+
-+    if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
-+                              s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
-+        return true;
-+    }
-+    if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
-+                              s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
-+        return true;
-+    }
-+
-+    return false;
-+}
-+
- static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
-                                   uint8_t *dst,const uint8_t *src,
-                                   int dstpitch,int srcpitch,
-@@ -635,7 +665,7 @@
- 
-     dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
- 
--    if (BLTUNSAFE(s))
-+    if (blit_is_unsafe(s))
-         return 0;
- 
-     (*s->cirrus_rop) (s, dst, src,
-@@ -653,8 +683,9 @@
- {
-     cirrus_fill_t rop_func;
- 
--    if (BLTUNSAFE(s))
-+    if (blit_is_unsafe(s)) {
-         return 0;
-+    }
-     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
-     rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
-              s->cirrus_blt_dstpitch,
-@@ -751,7 +782,7 @@
- 
- static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
- {
--    if (BLTUNSAFE(s))
-+    if (blit_is_unsafe(s))
-         return 0;
- 
-     cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,
diff --git a/main/qemu/CVE-2015-3456.patch b/main/qemu/CVE-2015-3456.patch
deleted file mode 100644
index 50c19d9f08..0000000000
--- a/main/qemu/CVE-2015-3456.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From e907746266721f305d67bc0718795fedee2e824c Mon Sep 17 00:00:00 2001
-From: Petr Matousek <pmatouse@redhat.com>
-Date: Wed, 6 May 2015 09:48:59 +0200
-Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated buffer
-
-During processing of certain commands such as FD_CMD_READ_ID and
-FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
-get out of bounds leading to memory corruption with values coming
-from the guest.
-
-Fix this by making sure that the index is always bounded by the
-allocated memory.
-
-This is CVE-2015-3456.
-
-Signed-off-by: Petr Matousek <pmatouse@redhat.com>
-Reviewed-by: John Snow <jsnow@redhat.com>
-Signed-off-by: John Snow <jsnow@redhat.com>
----
- hw/block/fdc.c |   17 +++++++++++------
- 1 files changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index f72a392..d8a8edd 100644
---- a/hw/block/fdc.c
-+++ b/hw/block/fdc.c
-@@ -1497,7 +1497,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
- {
-     FDrive *cur_drv;
-     uint32_t retval = 0;
--    int pos;
-+    uint32_t pos;
- 
-     cur_drv = get_cur_drv(fdctrl);
-     fdctrl->dsr &= ~FD_DSR_PWRDOWN;
-@@ -1506,8 +1506,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
-         return 0;
-     }
-     pos = fdctrl->data_pos;
-+    pos %= FD_SECTOR_LEN;
-     if (fdctrl->msr & FD_MSR_NONDMA) {
--        pos %= FD_SECTOR_LEN;
-         if (pos == 0) {
-             if (fdctrl->data_pos != 0)
-                 if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
-@@ -1852,10 +1852,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int direction)
- static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
- {
-     FDrive *cur_drv = get_cur_drv(fdctrl);
-+    uint32_t pos;
- 
--    if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
-+    pos = fdctrl->data_pos - 1;
-+    pos %= FD_SECTOR_LEN;
-+    if (fdctrl->fifo[pos] & 0x80) {
-         /* Command parameters done */
--        if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
-+        if (fdctrl->fifo[pos] & 0x40) {
-             fdctrl->fifo[0] = fdctrl->fifo[1];
-             fdctrl->fifo[2] = 0;
-             fdctrl->fifo[3] = 0;
-@@ -1955,7 +1958,7 @@ static uint8_t command_to_handler[256];
- static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
- {
-     FDrive *cur_drv;
--    int pos;
-+    uint32_t pos;
- 
-     /* Reset mode */
-     if (!(fdctrl->dor & FD_DOR_nRESET)) {
-@@ -2004,7 +2007,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
-     }
- 
-     FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
--    fdctrl->fifo[fdctrl->data_pos++] = value;
-+    pos = fdctrl->data_pos++;
-+    pos %= FD_SECTOR_LEN;
-+    fdctrl->fifo[pos] = value;
-     if (fdctrl->data_pos == fdctrl->data_len) {
-         /* We now have all parameters
-          * and will be able to treat the command
--- 
-1.7.0.4
-
diff --git a/main/qemu/CVE-2015-4037.patch b/main/qemu/CVE-2015-4037.patch
deleted file mode 100644
index fb36234531..0000000000
--- a/main/qemu/CVE-2015-4037.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Michael Tokarev <mjt@tls.msk.ru>
-Date: Thu, 28 May 2015 14:12:26 +0300
-Subject: [PATCH] slirp: use less predictable directory name in /tmp for smb
- config (CVE-2015-4037)
-
-In this version I used mkdtemp(3) which is:
-
-        _BSD_SOURCE
-        || /* Since glibc 2.10: */
-            (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
-
-(POSIX.1-2008), so should be available on systems we care about.
-
-While at it, reset the resulting directory name within smb structure
-on error so cleanup function wont try to remove directory which we
-failed to create.
-
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-(cherry picked from commit 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3)
----
- net/slirp.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/net/slirp.c b/net/slirp.c
-index 9bbed74..3090c10 100644
---- a/net/slirp.c
-+++ b/net/slirp.c
-@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
- static int slirp_smb(SlirpState* s, const char *exported_dir,
-                      struct in_addr vserver_addr)
- {
--    static int instance;
-     char smb_conf[128];
-     char smb_cmdline[128];
-     struct passwd *passwd;
-@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
-         return -1;
-     }
- 
--    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
--             (long)getpid(), instance++);
--    if (mkdir(s->smb_dir, 0700) < 0) {
-+    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX");
-+    if (!mkdtemp(s->smb_dir)) {
-         error_report("could not create samba server dir '%s'", s->smb_dir);
-+        s->smb_dir[0] = 0;
-         return -1;
-     }
-     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
diff --git a/main/qemu/CVE-2015-5154.patch b/main/qemu/CVE-2015-5154.patch
deleted file mode 100644
index 75e155079d..0000000000
--- a/main/qemu/CVE-2015-5154.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From a9de14175548c04e0f8be7fae219246509ba46a9 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 3 Jun 2015 14:13:31 +0200
-Subject: [PATCH 1/3] ide: Check array bounds before writing to io_buffer
- (CVE-2015-5154)
-
-If the end_transfer_func of a command is called because enough data has
-been read or written for the current PIO transfer, and it fails to
-correctly call the command completion functions, the DRQ bit in the
-status register and s->end_transfer_func may remain set. This allows the
-guest to access further bytes in s->io_buffer beyond s->data_end, and
-eventually overflowing the io_buffer.
-
-One case where this currently happens is emulation of the ATAPI command
-START STOP UNIT.
-
-This patch fixes the problem by adding explicit array bounds checks
-before accessing the buffer instead of relying on end_transfer_func to
-function correctly.
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/ide/core.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index 122e955..44fcc23 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -2021,6 +2021,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
-     }
- 
-     p = s->data_ptr;
-+    if (p + 2 > s->data_end) {
-+        return;
-+    }
-+
-     *(uint16_t *)p = le16_to_cpu(val);
-     p += 2;
-     s->data_ptr = p;
-@@ -2042,6 +2046,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr)
-     }
- 
-     p = s->data_ptr;
-+    if (p + 2 > s->data_end) {
-+        return 0;
-+    }
-+
-     ret = cpu_to_le16(*(uint16_t *)p);
-     p += 2;
-     s->data_ptr = p;
-@@ -2063,6 +2071,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
-     }
- 
-     p = s->data_ptr;
-+    if (p + 4 > s->data_end) {
-+        return;
-+    }
-+
-     *(uint32_t *)p = le32_to_cpu(val);
-     p += 4;
-     s->data_ptr = p;
-@@ -2084,6 +2096,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr)
-     }
- 
-     p = s->data_ptr;
-+    if (p + 4 > s->data_end) {
-+        return 0;
-+    }
-+
-     ret = cpu_to_le32(*(uint32_t *)p);
-     p += 4;
-     s->data_ptr = p;
--- 
-1.8.3.1
-From aa851d30acfbb9580098ac1dc82885530cb8b3c1 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 3 Jun 2015 14:17:46 +0200
-Subject: [PATCH 2/3] ide/atapi: Fix START STOP UNIT command completion
-
-The command must be completed on all code paths. START STOP UNIT with
-pwrcnd set should succeed without doing anything.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/ide/atapi.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
-index 950e311..79dd167 100644
---- a/hw/ide/atapi.c
-+++ b/hw/ide/atapi.c
-@@ -983,6 +983,7 @@ static void cmd_start_stop_unit(IDEState *s, uint8_t* buf)
-
-     if (pwrcnd) {
-         /* eject/load only happens for power condition == 0 */
-+        ide_atapi_cmd_ok(s);
-         return;
-     }
-
---
-1.8.3.1
-
-From 1d3c2268f8708126a34064c2e0c1000b40e6f3e5 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 3 Jun 2015 14:41:27 +0200
-Subject: [PATCH 3/3] ide: Clear DRQ after handling all expected accesses
-
-This is additional hardening against an end_transfer_func that fails to
-clear the DRQ status bit. The bit must be unset as soon as the PIO
-transfer has completed, so it's better to do this in a central place
-instead of duplicating the code in all commands (and forgetting it in
-some).
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/ide/core.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index 44fcc23..50449ca 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -2028,8 +2028,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val)
-     *(uint16_t *)p = le16_to_cpu(val);
-     p += 2;
-     s->data_ptr = p;
--    if (p >= s->data_end)
-+    if (p >= s->data_end) {
-+        s->status &= ~DRQ_STAT;
-         s->end_transfer_func(s);
-+    }
- }
-
- uint32_t ide_data_readw(void *opaque, uint32_t addr)
-@@ -2053,8 +2055,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr)
-     ret = cpu_to_le16(*(uint16_t *)p);
-     p += 2;
-     s->data_ptr = p;
--    if (p >= s->data_end)
-+    if (p >= s->data_end) {
-+        s->status &= ~DRQ_STAT;
-         s->end_transfer_func(s);
-+    }
-     return ret;
- }
-
-@@ -2078,8 +2082,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val)
-     *(uint32_t *)p = le32_to_cpu(val);
-     p += 4;
-     s->data_ptr = p;
--    if (p >= s->data_end)
-+    if (p >= s->data_end) {
-+        s->status &= ~DRQ_STAT;
-         s->end_transfer_func(s);
-+    }
- }
-
- uint32_t ide_data_readl(void *opaque, uint32_t addr)
-@@ -2103,8 +2109,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr)
-     ret = cpu_to_le32(*(uint32_t *)p);
-     p += 4;
-     s->data_ptr = p;
--    if (p >= s->data_end)
-+    if (p >= s->data_end) {
-+        s->status &= ~DRQ_STAT;
-         s->end_transfer_func(s);
-+    }
-     return ret;
- }
-
---
-1.8.3.1
-
diff --git a/main/qemu/kqemu.c b/main/qemu/kqemu.c
deleted file mode 100644
index 035d310ab9..0000000000
--- a/main/qemu/kqemu.c
+++ /dev/null
@@ -1,997 +0,0 @@
-/*
- *  KQEMU support
- *
- *  Copyright (c) 2005-2008 Fabrice Bellard
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA  02110-1301 USA
- */
-#include "config.h"
-#ifdef _WIN32
-#define WIN32_LEAN_AND_MEAN
-#include <windows.h>
-#include <winioctl.h>
-#else
-#include <sys/types.h>
-#include <sys/mman.h>
-#include <sys/ioctl.h>
-#endif
-#ifdef HOST_SOLARIS
-#include <sys/ioccom.h>
-#endif
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <inttypes.h>
-
-#include "cpu.h"
-#include "exec-all.h"
-#include "qemu-common.h"
-
-#ifdef USE_KQEMU
-
-#define DEBUG
-//#define PROFILE
-
-
-#ifdef DEBUG
-#  define LOG_INT(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
-#  define LOG_INT_STATE(env) log_cpu_state_mask(CPU_LOG_INT, (env), 0)
-#else
-#  define LOG_INT(...) do { } while (0)
-#  define LOG_INT_STATE(env) do { } while (0)
-#endif
-
-#include <unistd.h>
-#include <fcntl.h>
-#include "kqemu.h"
-
-#ifdef _WIN32
-#define KQEMU_DEVICE "\\\\.\\kqemu"
-#else
-#define KQEMU_DEVICE "/dev/kqemu"
-#endif
-
-static void qpi_init(void);
-
-#ifdef _WIN32
-#define KQEMU_INVALID_FD INVALID_HANDLE_VALUE
-HANDLE kqemu_fd = KQEMU_INVALID_FD;
-#define kqemu_closefd(x) CloseHandle(x)
-#else
-#define KQEMU_INVALID_FD -1
-int kqemu_fd = KQEMU_INVALID_FD;
-#define kqemu_closefd(x) close(x)
-#endif
-
-/* 0 = not allowed
-   1 = user kqemu
-   2 = kernel kqemu
-*/
-int kqemu_allowed = 1;
-uint64_t *pages_to_flush;
-unsigned int nb_pages_to_flush;
-uint64_t *ram_pages_to_update;
-unsigned int nb_ram_pages_to_update;
-uint64_t *modified_ram_pages;
-unsigned int nb_modified_ram_pages;
-uint8_t *modified_ram_pages_table;
-int qpi_io_memory;
-uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
-
-#define cpuid(index, eax, ecx, edx) \
-  asm volatile ("cpuid" \
-                : "=a" (eax), "=c" (ecx), "=d" (edx) \
-                : "0" (index))
-
-#ifdef __x86_64__
-static int is_cpuid_supported(void)
-{
-    return 1;
-}
-#else
-static int is_cpuid_supported(void)
-{
-    int v0, v1;
-    asm volatile ("pushf\n"
-                  "popl %0\n"
-                  "movl %0, %1\n"
-                  "xorl $0x00200000, %0\n"
-                  "pushl %0\n"
-                  "popf\n"
-                  "pushf\n"
-                  "popl %0\n"
-                  : "=a" (v0), "=d" (v1)
-                  :
-                  : "cc");
-    return (v0 != v1);
-}
-#endif
-
-static void kqemu_update_cpuid(CPUState *env)
-{
-    int critical_features_mask, features, ext_features, ext_features_mask;
-    uint32_t eax, ecx, edx;
-
-    /* the following features are kept identical on the host and
-       target cpus because they are important for user code. Strictly
-       speaking, only SSE really matters because the OS must support
-       it if the user code uses it. */
-    critical_features_mask =
-        CPUID_CMOV | CPUID_CX8 |
-        CPUID_FXSR | CPUID_MMX | CPUID_SSE |
-        CPUID_SSE2 | CPUID_SEP;
-    ext_features_mask = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR;
-    if (!is_cpuid_supported()) {
-        features = 0;
-        ext_features = 0;
-    } else {
-        cpuid(1, eax, ecx, edx);
-        features = edx;
-        ext_features = ecx;
-    }
-#ifdef __x86_64__
-    /* NOTE: on x86_64 CPUs, SYSENTER is not supported in
-       compatibility mode, so in order to have the best performances
-       it is better not to use it */
-    features &= ~CPUID_SEP;
-#endif
-    env->cpuid_features = (env->cpuid_features & ~critical_features_mask) |
-        (features & critical_features_mask);
-    env->cpuid_ext_features = (env->cpuid_ext_features & ~ext_features_mask) |
-        (ext_features & ext_features_mask);
-    /* XXX: we could update more of the target CPUID state so that the
-       non accelerated code sees exactly the same CPU features as the
-       accelerated code */
-}
-
-int kqemu_init(CPUState *env)
-{
-    struct kqemu_init kinit;
-    int ret, version;
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-    if (!kqemu_allowed)
-        return -1;
-
-#ifdef _WIN32
-    kqemu_fd = CreateFile(KQEMU_DEVICE, GENERIC_WRITE | GENERIC_READ,
-                          FILE_SHARE_READ | FILE_SHARE_WRITE,
-                          NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
-                          NULL);
-    if (kqemu_fd == KQEMU_INVALID_FD) {
-        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %lu\n",
-                KQEMU_DEVICE, GetLastError());
-        return -1;
-    }
-#else
-    kqemu_fd = open(KQEMU_DEVICE, O_RDWR);
-    if (kqemu_fd == KQEMU_INVALID_FD) {
-        fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %s\n",
-                KQEMU_DEVICE, strerror(errno));
-        return -1;
-    }
-#endif
-    version = 0;
-#ifdef _WIN32
-    DeviceIoControl(kqemu_fd, KQEMU_GET_VERSION, NULL, 0,
-                    &version, sizeof(version), &temp, NULL);
-#else
-    ioctl(kqemu_fd, KQEMU_GET_VERSION, &version);
-#endif
-    if (version != KQEMU_VERSION) {
-        fprintf(stderr, "Version mismatch between kqemu module and qemu (%08x %08x) - disabling kqemu use\n",
-                version, KQEMU_VERSION);
-        goto fail;
-    }
-
-    pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH *
-                                  sizeof(uint64_t));
-    if (!pages_to_flush)
-        goto fail;
-
-    ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE *
-                                       sizeof(uint64_t));
-    if (!ram_pages_to_update)
-        goto fail;
-
-    modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES *
-                                      sizeof(uint64_t));
-    if (!modified_ram_pages)
-        goto fail;
-    modified_ram_pages_table = qemu_mallocz(phys_ram_size >> TARGET_PAGE_BITS);
-    if (!modified_ram_pages_table)
-        goto fail;
-
-    memset(&kinit, 0, sizeof(kinit)); /* set the paddings to zero */
-    kinit.ram_base = phys_ram_base;
-    kinit.ram_size = phys_ram_size;
-    kinit.ram_dirty = phys_ram_dirty;
-    kinit.pages_to_flush = pages_to_flush;
-    kinit.ram_pages_to_update = ram_pages_to_update;
-    kinit.modified_ram_pages = modified_ram_pages;
-#ifdef _WIN32
-    ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &kinit, sizeof(kinit),
-                          NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
-#else
-    ret = ioctl(kqemu_fd, KQEMU_INIT, &kinit);
-#endif
-    if (ret < 0) {
-        fprintf(stderr, "Error %d while initializing QEMU acceleration layer - disabling it for now\n", ret);
-    fail:
-        kqemu_closefd(kqemu_fd);
-        kqemu_fd = KQEMU_INVALID_FD;
-        return -1;
-    }
-    kqemu_update_cpuid(env);
-    env->kqemu_enabled = kqemu_allowed;
-    nb_pages_to_flush = 0;
-    nb_ram_pages_to_update = 0;
-
-    qpi_init();
-    return 0;
-}
-
-void kqemu_flush_page(CPUState *env, target_ulong addr)
-{
-    LOG_INT("kqemu_flush_page: addr=" TARGET_FMT_lx "\n", addr);
-    if (nb_pages_to_flush >= KQEMU_MAX_PAGES_TO_FLUSH)
-        nb_pages_to_flush = KQEMU_FLUSH_ALL;
-    else
-        pages_to_flush[nb_pages_to_flush++] = addr;
-}
-
-void kqemu_flush(CPUState *env, int global)
-{
-    LOG_INT("kqemu_flush:\n");
-    nb_pages_to_flush = KQEMU_FLUSH_ALL;
-}
-
-void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr)
-{
-    LOG_INT("kqemu_set_notdirty: addr=%08lx\n", 
-                (unsigned long)ram_addr);
-    /* we only track transitions to dirty state */
-    if (phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] != 0xff)
-        return;
-    if (nb_ram_pages_to_update >= KQEMU_MAX_RAM_PAGES_TO_UPDATE)
-        nb_ram_pages_to_update = KQEMU_RAM_PAGES_UPDATE_ALL;
-    else
-        ram_pages_to_update[nb_ram_pages_to_update++] = ram_addr;
-}
-
-static void kqemu_reset_modified_ram_pages(void)
-{
-    int i;
-    unsigned long page_index;
-
-    for(i = 0; i < nb_modified_ram_pages; i++) {
-        page_index = modified_ram_pages[i] >> TARGET_PAGE_BITS;
-        modified_ram_pages_table[page_index] = 0;
-    }
-    nb_modified_ram_pages = 0;
-}
-
-void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
-{
-    unsigned long page_index;
-    int ret;
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-    page_index = ram_addr >> TARGET_PAGE_BITS;
-    if (!modified_ram_pages_table[page_index]) {
-#if 0
-        printf("%d: modify_page=%08lx\n", nb_modified_ram_pages, ram_addr);
-#endif
-        modified_ram_pages_table[page_index] = 1;
-        modified_ram_pages[nb_modified_ram_pages++] = ram_addr;
-        if (nb_modified_ram_pages >= KQEMU_MAX_MODIFIED_RAM_PAGES) {
-            /* flush */
-#ifdef _WIN32
-            ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
-                                  &nb_modified_ram_pages,
-                                  sizeof(nb_modified_ram_pages),
-                                  NULL, 0, &temp, NULL);
-#else
-            ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
-                        &nb_modified_ram_pages);
-#endif
-            kqemu_reset_modified_ram_pages();
-        }
-    }
-}
-
-void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, 
-                        ram_addr_t phys_offset)
-{
-    struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1;
-    uint64_t end;
-    int ret, io_index;
-
-    end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
-    start_addr &= TARGET_PAGE_MASK;
-    kphys_mem->phys_addr = start_addr;
-    kphys_mem->size = end - start_addr;
-    kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK;
-    io_index = phys_offset & ~TARGET_PAGE_MASK;
-    switch(io_index) {
-    case IO_MEM_RAM:
-        kphys_mem->io_index = KQEMU_IO_MEM_RAM;
-        break;
-    case IO_MEM_ROM:
-        kphys_mem->io_index = KQEMU_IO_MEM_ROM;
-        break;
-    default:
-        if (qpi_io_memory == io_index) {
-            kphys_mem->io_index = KQEMU_IO_MEM_COMM;
-        } else {
-            kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED;
-        }
-        break;
-    }
-#ifdef _WIN32
-    {
-        DWORD temp;
-        ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM, 
-                              kphys_mem, sizeof(*kphys_mem),
-                              NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
-    }
-#else
-    ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem);
-#endif
-    if (ret < 0) {
-        fprintf(stderr, "kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016" PRIx64 " size=0x%08lx phys_offset=0x%08lx\n",
-                ret, start_addr, 
-                (unsigned long)size, (unsigned long)phys_offset);
-    }
-}
-
-struct fpstate {
-    uint16_t fpuc;
-    uint16_t dummy1;
-    uint16_t fpus;
-    uint16_t dummy2;
-    uint16_t fptag;
-    uint16_t dummy3;
-
-    uint32_t fpip;
-    uint32_t fpcs;
-    uint32_t fpoo;
-    uint32_t fpos;
-    uint8_t fpregs1[8 * 10];
-};
-
-struct fpxstate {
-    uint16_t fpuc;
-    uint16_t fpus;
-    uint16_t fptag;
-    uint16_t fop;
-    uint32_t fpuip;
-    uint16_t cs_sel;
-    uint16_t dummy0;
-    uint32_t fpudp;
-    uint16_t ds_sel;
-    uint16_t dummy1;
-    uint32_t mxcsr;
-    uint32_t mxcsr_mask;
-    uint8_t fpregs1[8 * 16];
-    uint8_t xmm_regs[16 * 16];
-    uint8_t dummy2[96];
-};
-
-static struct fpxstate fpx1 __attribute__((aligned(16)));
-
-static void restore_native_fp_frstor(CPUState *env)
-{
-    int fptag, i, j;
-    struct fpstate fp1, *fp = &fp1;
-
-    fp->fpuc = env->fpuc;
-    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for (i=7; i>=0; i--) {
-	fptag <<= 2;
-	if (env->fptags[i]) {
-            fptag |= 3;
-        } else {
-            /* the FPU automatically computes it */
-        }
-    }
-    fp->fptag = fptag;
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&fp->fpregs1[i * 10], &env->fpregs[j].d, 10);
-        j = (j + 1) & 7;
-    }
-    asm volatile ("frstor %0" : "=m" (*fp));
-}
-
-static void save_native_fp_fsave(CPUState *env)
-{
-    int fptag, i, j;
-    uint16_t fpuc;
-    struct fpstate fp1, *fp = &fp1;
-
-    asm volatile ("fsave %0" : : "m" (*fp));
-    env->fpuc = fp->fpuc;
-    env->fpstt = (fp->fpus >> 11) & 7;
-    env->fpus = fp->fpus & ~0x3800;
-    fptag = fp->fptag;
-    for(i = 0;i < 8; i++) {
-        env->fptags[i] = ((fptag & 3) == 3);
-        fptag >>= 2;
-    }
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 10], 10);
-        j = (j + 1) & 7;
-    }
-    /* we must restore the default rounding state */
-    fpuc = 0x037f | (env->fpuc & (3 << 10));
-    asm volatile("fldcw %0" : : "m" (fpuc));
-}
-
-static void restore_native_fp_fxrstor(CPUState *env)
-{
-    struct fpxstate *fp = &fpx1;
-    int i, j, fptag;
-
-    fp->fpuc = env->fpuc;
-    fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
-    fptag = 0;
-    for(i = 0; i < 8; i++)
-        fptag |= (env->fptags[i] << i);
-    fp->fptag = fptag ^ 0xff;
-
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&fp->fpregs1[i * 16], &env->fpregs[j].d, 10);
-        j = (j + 1) & 7;
-    }
-    if (env->cpuid_features & CPUID_SSE) {
-        fp->mxcsr = env->mxcsr;
-        /* XXX: check if DAZ is not available */
-        fp->mxcsr_mask = 0xffff;
-        memcpy(fp->xmm_regs, env->xmm_regs, CPU_NB_REGS * 16);
-    }
-    asm volatile ("fxrstor %0" : "=m" (*fp));
-}
-
-static void save_native_fp_fxsave(CPUState *env)
-{
-    struct fpxstate *fp = &fpx1;
-    int fptag, i, j;
-    uint16_t fpuc;
-
-    asm volatile ("fxsave %0" : : "m" (*fp));
-    env->fpuc = fp->fpuc;
-    env->fpstt = (fp->fpus >> 11) & 7;
-    env->fpus = fp->fpus & ~0x3800;
-    fptag = fp->fptag ^ 0xff;
-    for(i = 0;i < 8; i++) {
-        env->fptags[i] = (fptag >> i) & 1;
-    }
-    j = env->fpstt;
-    for(i = 0;i < 8; i++) {
-        memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 16], 10);
-        j = (j + 1) & 7;
-    }
-    if (env->cpuid_features & CPUID_SSE) {
-        env->mxcsr = fp->mxcsr;
-        memcpy(env->xmm_regs, fp->xmm_regs, CPU_NB_REGS * 16);
-    }
-
-    /* we must restore the default rounding state */
-    asm volatile ("fninit");
-    fpuc = 0x037f | (env->fpuc & (3 << 10));
-    asm volatile("fldcw %0" : : "m" (fpuc));
-}
-
-static int do_syscall(CPUState *env,
-                      struct kqemu_cpu_state *kenv)
-{
-    int selector;
-
-    selector = (env->star >> 32) & 0xffff;
-#ifdef TARGET_X86_64
-    if (env->hflags & HF_LMA_MASK) {
-        int code64;
-
-        env->regs[R_ECX] = kenv->next_eip;
-        env->regs[11] = env->eflags;
-
-        code64 = env->hflags & HF_CS64_MASK;
-
-        cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_W_MASK | DESC_A_MASK);
-        env->eflags &= ~env->fmask;
-        if (code64)
-            env->eip = env->lstar;
-        else
-            env->eip = env->cstar;
-    } else
-#endif
-    {
-        env->regs[R_ECX] = (uint32_t)kenv->next_eip;
-
-        cpu_x86_set_cpl(env, 0);
-        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
-                           0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
-        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
-                               0, 0xffffffff,
-                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
-                               DESC_S_MASK |
-                               DESC_W_MASK | DESC_A_MASK);
-        env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
-        env->eip = (uint32_t)env->star;
-    }
-    return 2;
-}
-
-#ifdef CONFIG_PROFILER
-
-#define PC_REC_SIZE 1
-#define PC_REC_HASH_BITS 16
-#define PC_REC_HASH_SIZE (1 << PC_REC_HASH_BITS)
-
-typedef struct PCRecord {
-    unsigned long pc;
-    int64_t count;
-    struct PCRecord *next;
-} PCRecord;
-
-static PCRecord *pc_rec_hash[PC_REC_HASH_SIZE];
-static int nb_pc_records;
-
-static void kqemu_record_pc(unsigned long pc)
-{
-    unsigned long h;
-    PCRecord **pr, *r;
-
-    h = pc / PC_REC_SIZE;
-    h = h ^ (h >> PC_REC_HASH_BITS);
-    h &= (PC_REC_HASH_SIZE - 1);
-    pr = &pc_rec_hash[h];
-    for(;;) {
-        r = *pr;
-        if (r == NULL)
-            break;
-        if (r->pc == pc) {
-            r->count++;
-            return;
-        }
-        pr = &r->next;
-    }
-    r = malloc(sizeof(PCRecord));
-    r->count = 1;
-    r->pc = pc;
-    r->next = NULL;
-    *pr = r;
-    nb_pc_records++;
-}
-
-static int pc_rec_cmp(const void *p1, const void *p2)
-{
-    PCRecord *r1 = *(PCRecord **)p1;
-    PCRecord *r2 = *(PCRecord **)p2;
-    if (r1->count < r2->count)
-        return 1;
-    else if (r1->count == r2->count)
-        return 0;
-    else
-        return -1;
-}
-
-static void kqemu_record_flush(void)
-{
-    PCRecord *r, *r_next;
-    int h;
-
-    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
-        for(r = pc_rec_hash[h]; r != NULL; r = r_next) {
-            r_next = r->next;
-            free(r);
-        }
-        pc_rec_hash[h] = NULL;
-    }
-    nb_pc_records = 0;
-}
-
-void kqemu_record_dump(void)
-{
-    PCRecord **pr, *r;
-    int i, h;
-    FILE *f;
-    int64_t total, sum;
-
-    pr = malloc(sizeof(PCRecord *) * nb_pc_records);
-    i = 0;
-    total = 0;
-    for(h = 0; h < PC_REC_HASH_SIZE; h++) {
-        for(r = pc_rec_hash[h]; r != NULL; r = r->next) {
-            pr[i++] = r;
-            total += r->count;
-        }
-    }
-    qsort(pr, nb_pc_records, sizeof(PCRecord *), pc_rec_cmp);
-
-    f = fopen("/tmp/kqemu.stats", "w");
-    if (!f) {
-        perror("/tmp/kqemu.stats");
-        exit(1);
-    }
-    fprintf(f, "total: %" PRId64 "\n", total);
-    sum = 0;
-    for(i = 0; i < nb_pc_records; i++) {
-        r = pr[i];
-        sum += r->count;
-        fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n",
-                r->pc,
-                r->count,
-                (double)r->count / (double)total * 100.0,
-                (double)sum / (double)total * 100.0);
-    }
-    fclose(f);
-    free(pr);
-
-    kqemu_record_flush();
-}
-#endif
-
-static inline void kqemu_load_seg(struct kqemu_segment_cache *ksc,
-                                  const SegmentCache *sc)
-{
-    ksc->selector = sc->selector;
-    ksc->flags = sc->flags;
-    ksc->limit = sc->limit;
-    ksc->base = sc->base;
-}
-
-static inline void kqemu_save_seg(SegmentCache *sc,
-                                  const struct kqemu_segment_cache *ksc)
-{
-    sc->selector = ksc->selector;
-    sc->flags = ksc->flags;
-    sc->limit = ksc->limit;
-    sc->base = ksc->base;
-}
-
-int kqemu_cpu_exec(CPUState *env)
-{
-    struct kqemu_cpu_state kcpu_state, *kenv = &kcpu_state;
-    int ret, cpl, i;
-#ifdef CONFIG_PROFILER
-    int64_t ti;
-#endif
-#ifdef _WIN32
-    DWORD temp;
-#endif
-
-#ifdef CONFIG_PROFILER
-    ti = profile_getclock();
-#endif
-    LOG_INT("kqemu: cpu_exec: enter\n");
-    LOG_INT_STATE(env);
-    for(i = 0; i < CPU_NB_REGS; i++)
-        kenv->regs[i] = env->regs[i];
-    kenv->eip = env->eip;
-    kenv->eflags = env->eflags;
-    for(i = 0; i < 6; i++)
-        kqemu_load_seg(&kenv->segs[i], &env->segs[i]);
-    kqemu_load_seg(&kenv->ldt, &env->ldt);
-    kqemu_load_seg(&kenv->tr, &env->tr);
-    kqemu_load_seg(&kenv->gdt, &env->gdt);
-    kqemu_load_seg(&kenv->idt, &env->idt);
-    kenv->cr0 = env->cr[0];
-    kenv->cr2 = env->cr[2];
-    kenv->cr3 = env->cr[3];
-    kenv->cr4 = env->cr[4];
-    kenv->a20_mask = env->a20_mask;
-    kenv->efer = env->efer;
-    kenv->tsc_offset = 0;
-    kenv->star = env->star;
-    kenv->sysenter_cs = env->sysenter_cs;
-    kenv->sysenter_esp = env->sysenter_esp;
-    kenv->sysenter_eip = env->sysenter_eip;
-#ifdef TARGET_X86_64
-    kenv->lstar = env->lstar;
-    kenv->cstar = env->cstar;
-    kenv->fmask = env->fmask;
-    kenv->kernelgsbase = env->kernelgsbase;
-#endif
-    if (env->dr[7] & 0xff) {
-        kenv->dr7 = env->dr[7];
-        kenv->dr0 = env->dr[0];
-        kenv->dr1 = env->dr[1];
-        kenv->dr2 = env->dr[2];
-        kenv->dr3 = env->dr[3];
-    } else {
-        kenv->dr7 = 0;
-    }
-    kenv->dr6 = env->dr[6];
-    cpl = (env->hflags & HF_CPL_MASK);
-    kenv->cpl = cpl;
-    kenv->nb_pages_to_flush = nb_pages_to_flush;
-    kenv->user_only = (env->kqemu_enabled == 1);
-    kenv->nb_ram_pages_to_update = nb_ram_pages_to_update;
-    nb_ram_pages_to_update = 0;
-    kenv->nb_modified_ram_pages = nb_modified_ram_pages;
-
-    kqemu_reset_modified_ram_pages();
-
-    if (env->cpuid_features & CPUID_FXSR)
-        restore_native_fp_fxrstor(env);
-    else
-        restore_native_fp_frstor(env);
-
-#ifdef _WIN32
-    if (DeviceIoControl(kqemu_fd, KQEMU_EXEC,
-                        kenv, sizeof(struct kqemu_cpu_state),
-                        kenv, sizeof(struct kqemu_cpu_state),
-                        &temp, NULL)) {
-        ret = kenv->retval;
-    } else {
-        ret = -1;
-    }
-#else
-    ioctl(kqemu_fd, KQEMU_EXEC, kenv);
-    ret = kenv->retval;
-#endif
-    if (env->cpuid_features & CPUID_FXSR)
-        save_native_fp_fxsave(env);
-    else
-        save_native_fp_fsave(env);
-
-    for(i = 0; i < CPU_NB_REGS; i++)
-        env->regs[i] = kenv->regs[i];
-    env->eip = kenv->eip;
-    env->eflags = kenv->eflags;
-    for(i = 0; i < 6; i++)
-        kqemu_save_seg(&env->segs[i], &kenv->segs[i]);
-    cpu_x86_set_cpl(env, kenv->cpl);
-    kqemu_save_seg(&env->ldt, &kenv->ldt);
-    env->cr[0] = kenv->cr0;
-    env->cr[4] = kenv->cr4;
-    env->cr[3] = kenv->cr3;
-    env->cr[2] = kenv->cr2;
-    env->dr[6] = kenv->dr6;
-#ifdef TARGET_X86_64
-    env->kernelgsbase = kenv->kernelgsbase;
-#endif
-
-    /* flush pages as indicated by kqemu */
-    if (kenv->nb_pages_to_flush >= KQEMU_FLUSH_ALL) {
-        tlb_flush(env, 1);
-    } else {
-        for(i = 0; i < kenv->nb_pages_to_flush; i++) {
-            tlb_flush_page(env, pages_to_flush[i]);
-        }
-    }
-    nb_pages_to_flush = 0;
-
-#ifdef CONFIG_PROFILER
-    kqemu_time += profile_getclock() - ti;
-    kqemu_exec_count++;
-#endif
-
-    if (kenv->nb_ram_pages_to_update > 0) {
-        cpu_tlb_update_dirty(env);
-    }
-
-    if (kenv->nb_modified_ram_pages > 0) {
-        for(i = 0; i < kenv->nb_modified_ram_pages; i++) {
-            unsigned long addr;
-            addr = modified_ram_pages[i];
-            tb_invalidate_phys_page_range(addr, addr + TARGET_PAGE_SIZE, 0);
-        }
-    }
-
-    /* restore the hidden flags */
-    {
-        unsigned int new_hflags;
-#ifdef TARGET_X86_64
-        if ((env->hflags & HF_LMA_MASK) &&
-            (env->segs[R_CS].flags & DESC_L_MASK)) {
-            /* long mode */
-            new_hflags = HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
-        } else
-#endif
-        {
-            /* legacy / compatibility case */
-            new_hflags = (env->segs[R_CS].flags & DESC_B_MASK)
-                >> (DESC_B_SHIFT - HF_CS32_SHIFT);
-            new_hflags |= (env->segs[R_SS].flags & DESC_B_MASK)
-                >> (DESC_B_SHIFT - HF_SS32_SHIFT);
-            if (!(env->cr[0] & CR0_PE_MASK) ||
-                   (env->eflags & VM_MASK) ||
-                   !(env->hflags & HF_CS32_MASK)) {
-                /* XXX: try to avoid this test. The problem comes from the
-                   fact that is real mode or vm86 mode we only modify the
-                   'base' and 'selector' fields of the segment cache to go
-                   faster. A solution may be to force addseg to one in
-                   translate-i386.c. */
-                new_hflags |= HF_ADDSEG_MASK;
-            } else {
-                new_hflags |= ((env->segs[R_DS].base |
-                                env->segs[R_ES].base |
-                                env->segs[R_SS].base) != 0) <<
-                    HF_ADDSEG_SHIFT;
-            }
-        }
-        env->hflags = (env->hflags &
-           ~(HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)) |
-            new_hflags;
-    }
-    /* update FPU flags */
-    env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |
-        ((env->cr[0] << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));
-    if (env->cr[4] & CR4_OSFXSR_MASK)
-        env->hflags |= HF_OSFXSR_MASK;
-    else
-        env->hflags &= ~HF_OSFXSR_MASK;
-
-    LOG_INT("kqemu: kqemu_cpu_exec: ret=0x%x\n", ret);
-    if (ret == KQEMU_RET_SYSCALL) {
-        /* syscall instruction */
-        return do_syscall(env, kenv);
-    } else
-    if ((ret & 0xff00) == KQEMU_RET_INT) {
-        env->exception_index = ret & 0xff;
-        env->error_code = 0;
-        env->exception_is_int = 1;
-        env->exception_next_eip = kenv->next_eip;
-#ifdef CONFIG_PROFILER
-        kqemu_ret_int_count++;
-#endif
-        LOG_INT("kqemu: interrupt v=%02x:\n", env->exception_index);
-        LOG_INT_STATE(env);
-        return 1;
-    } else if ((ret & 0xff00) == KQEMU_RET_EXCEPTION) {
-        env->exception_index = ret & 0xff;
-        env->error_code = kenv->error_code;
-        env->exception_is_int = 0;
-        env->exception_next_eip = 0;
-#ifdef CONFIG_PROFILER
-        kqemu_ret_excp_count++;
-#endif
-        LOG_INT("kqemu: exception v=%02x e=%04x:\n",
-                    env->exception_index, env->error_code);
-        LOG_INT_STATE(env);
-        return 1;
-    } else if (ret == KQEMU_RET_INTR) {
-#ifdef CONFIG_PROFILER
-        kqemu_ret_intr_count++;
-#endif
-        LOG_INT_STATE(env);
-        return 0;
-    } else if (ret == KQEMU_RET_SOFTMMU) {
-#ifdef CONFIG_PROFILER
-        {
-            unsigned long pc = env->eip + env->segs[R_CS].base;
-            kqemu_record_pc(pc);
-        }
-#endif
-        LOG_INT_STATE(env);
-        return 2;
-    } else {
-        cpu_dump_state(env, stderr, fprintf, 0);
-        fprintf(stderr, "Unsupported return value: 0x%x\n", ret);
-        exit(1);
-    }
-    return 0;
-}
-
-void kqemu_cpu_interrupt(CPUState *env)
-{
-#if defined(_WIN32)
-    /* cancelling the I/O request causes KQEMU to finish executing the
-       current block and successfully returning. */
-    CancelIo(kqemu_fd);
-#endif
-}
-
-/* 
-   QEMU paravirtualization interface. The current interface only
-   allows to modify the IF and IOPL flags when running in
-   kqemu.
-
-   At this point it is not very satisfactory. I leave it for reference
-   as it adds little complexity.
-*/
-
-#define QPI_COMM_PAGE_PHYS_ADDR 0xff000000
-
-static uint32_t qpi_mem_readb(void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static uint32_t qpi_mem_readw(void *opaque, target_phys_addr_t addr)
-{
-    return 0;
-}
-
-static void qpi_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-}
-
-static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-}
-
-static uint32_t qpi_mem_readl(void *opaque, target_phys_addr_t addr)
-{
-    CPUState *env;
-
-    env = cpu_single_env;
-    if (!env)
-        return 0;
-    return env->eflags & (IF_MASK | IOPL_MASK);
-}
-
-/* Note: after writing to this address, the guest code must make sure
-   it is exiting the current TB. pushf/popf can be used for that
-   purpose. */
-static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    CPUState *env;
-
-    env = cpu_single_env;
-    if (!env)
-        return;
-    env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) | 
-        (val & (IF_MASK | IOPL_MASK));
-}
-
-static CPUReadMemoryFunc *qpi_mem_read[3] = {
-    qpi_mem_readb,
-    qpi_mem_readw,
-    qpi_mem_readl,
-};
-
-static CPUWriteMemoryFunc *qpi_mem_write[3] = {
-    qpi_mem_writeb,
-    qpi_mem_writew,
-    qpi_mem_writel,
-};
-
-static void qpi_init(void)
-{
-    kqemu_comm_base = 0xff000000 | 1;
-    qpi_io_memory = cpu_register_io_memory(0, 
-                                           qpi_mem_read, 
-                                           qpi_mem_write, NULL);
-    cpu_register_physical_memory(kqemu_comm_base & ~0xfff, 
-                                 0x1000, qpi_io_memory);
-}
-#endif
diff --git a/main/qemu/qemu-guest-agent.initd b/main/qemu/qemu-guest-agent.initd
index b5bfca7225..4f4a57420b 100644
--- a/main/qemu/qemu-guest-agent.initd
+++ b/main/qemu/qemu-guest-agent.initd
@@ -1,25 +1,6 @@
 #!/sbin/openrc-run
-# Copyright 1999-2012 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-guest-agent/files/qemu-ga.init,v 1.2 2012/10/30 21:12:20 cardoe Exp $
 
-start() {
-    GA_METHOD=${GA_METHOD:-virtio-serial}
-    GA_PATH=${GA_PATH:-/dev/virtio-ports/org.qemu.guest_agent.0}
-
-    ebegin "Starting QEMU Guest Agent"
-
-    start-stop-daemon --start --pidfile /var/run/qemu-ga.pid \
-        --exec /usr/bin/qemu-ga -- -m ${GA_METHOD} -p ${GA_PATH} \
-        -l /var/log/qemu-ga.log -d
-
-    eend $?
-}
-
-stop() {
-    ebegin "Stopping QEMU Guest Agent"
-
-    start-stop-daemon --stop --pidfile /var/run/qemu-ga.pid
-
-    eend $?
-}
+name="QEMU Guest Agent"
+pidfile=/var/run/qemu-ga.pid
+command=/usr/bin/qemu-ga
+command_args="-m ${GA_METHOD:-virtio-serial} -p ${GA_PATH:-/dev/virtio-ports/org.qemu.guest_agent.0} -l /var/log/qemu-ga.log -d"
diff --git a/main/qemu/qemu.pre-install b/main/qemu/qemu.pre-install
index 68d7043acc..ffee1f8708 100644
--- a/main/qemu/qemu.pre-install
+++ b/main/qemu/qemu.pre-install
@@ -1,6 +1,3 @@
 #!/bin/sh
 
-if ! getent group kvm >/dev/null; then
-	addgroup -g 34 -S kvm
-fi
-
+getent group kvm >/dev/null || addgroup -g 34 -S kvm