This is the delta between the qemu and qemu-kvm v0.12.5 versions

Signed-off-by: Bruce Rogers <brogers@suse.com>
Update for 0.12.5 release
2018-01-22 14:00:07 -07:00 · 2010-07-22 14:39:04 +02:00 · 2010-07-22 14:37:23 +02:00 · 2010-07-14 13:09:24 +02:00 · 2010-07-14 13:09:24 +02:00 · 2010-07-14 13:08:45 +02:00
8589 changed files with 524945 additions and 2462324 deletions
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -1,42 +0,0 @@
 env:
  CIRRUS_CLONE_DEPTH: 1
 freebsd_12_task:
  freebsd_instance:
    image_family: freebsd-12-1
    cpu: 8
    memory: 8G
  install_script: ASSUME_ALWAYS_YES=yes pkg bootstrap -f ; pkg install -y
    bash curl cyrus-sasl git glib gmake gnutls gsed
    nettle perl5 pixman pkgconf png usbredir
  script:
    - mkdir build
    - cd build
    - ../configure || { cat config.log; exit 1; }
    - gmake -j8
    - gmake V=1 check
 macos_task:
  osx_instance:
    image: mojave-base
  install_script:
    - brew install pkg-config python gnu-sed glib pixman make sdl2 bash
  script:
    - mkdir build
    - cd build
    - ../configure --python=/usr/local/bin/python3 || { cat config.log; exit 1; }
    - gmake -j$(sysctl -n hw.ncpu)
    - gmake check
 macos_xcode_task:
  osx_instance:
    # this is an alias for the latest Xcode
    image: mojave-xcode
  install_script:
    - brew install pkg-config gnu-sed glib pixman make sdl2 bash
  script:
    - mkdir build
    - cd build
    - ../configure --cc=clang || { cat config.log; exit 1; }
    - gmake -j$(sysctl -n hw.ncpu)
    - gmake check
--- a/.dir-locals.el
+++ b/.dir-locals.el
@@ -1,2 +0,0 @@
 ((c-mode . ((c-file-style . "stroustrup")
 	    (indent-tabs-mode . nil))))
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,43 +0,0 @@
 # EditorConfig is a file format and collection of text editor plugins
 # for maintaining consistent coding styles between different editors
 # and IDEs. Most popular editors support this either natively or via
 # plugin.
 #
 # Check https://editorconfig.org for details.
 root = true
 [*]
 end_of_line = lf
 insert_final_newline = true
 charset = utf-8
 [*.mak]
 indent_style = tab
 indent_size = 8
 file_type_emacs = makefile
 [Makefile*]
 indent_style = tab
 indent_size = 8
 file_type_emacs = makefile
 [*.{c,h}]
 indent_style = space
 indent_size = 4
 [*.sh]
 indent_style = space
 indent_size = 4
 [*.{s,S}]
 indent_style = tab
 indent_size = 8
 file_type_emacs = asm
 [*.{vert,frag}]
 file_type_emacs = glsl
 [*.json]
 indent_style = space
 file_type_emacs = python
--- a/.exrc
+++ b/.exrc
@@ -1,7 +0,0 @@
 "VIM settings to match QEMU coding style.  They are activated by adding the
 "following settings (without the " symbol) as last two lines in $HOME/.vimrc:
 "set secure
 "set exrc
 set expandtab
 set shiftwidth=4
 set smarttab
--- a/.gdbinit
+++ b/.gdbinit
@@ -1,8 +0,0 @@
 # GDB may have ./.gdbinit loading disabled by default.  In that case you can
 # follow the instructions it prints.  They boil down to adding the following to
 # your home directory's ~/.gdbinit file:
 #
 #   add-auto-load-safe-path /path/to/qemu/.gdbinit
 # Load QEMU-specific sub-commands and settings
 source scripts/qemu-gdb.py
--- a/.github/lockdown.yml
+++ b/.github/lockdown.yml
@@ -1,34 +0,0 @@
 # Configuration for Repo Lockdown - https://github.com/dessant/repo-lockdown
 # Close issues and pull requests
 close: true
 # Lock issues and pull requests
 lock: true
 issues:
  comment: |
    Thank you for your interest in the QEMU project.
    This repository is a read-only mirror of the project's master
    repostories hosted on https://git.qemu.org/git/qemu.git.
    The project does not process issues filed on GitHub.
    The project issues are tracked on Launchpad:
    https://bugs.launchpad.net/qemu
    QEMU welcomes bug report contributions. You can file new ones on:
    https://bugs.launchpad.net/qemu/+filebug
 pulls:
  comment: |
    Thank you for your interest in the QEMU project.
    This repository is a read-only mirror of the project's master
    repostories hosted on https://git.qemu.org/git/qemu.git.
    The project does not process merge requests filed on GitHub.
    QEMU welcomes contributions of code (either fixing bugs or adding new
    functionality). However, we get a lot of patches, and so we have some
    guidelines about contributing on the project website:
    https://www.qemu.org/contribute/
--- a/.gitignore
+++ b/.gitignore
@@ -1,165 +1,52 @@
-/.doctrees
+config-devices.*
-/config-devices.*
+config-all-devices.*
-/config-all-devices.*
+config-host.*
-/config-all-disas.*
+config-target.*
-/config-host.*
+i386
-/config-target.*
+*-softmmu
-/config.status
+*-darwin-user
-/config-temp
+*-linux-user
-/tools/virtiofsd/50-qemu-virtiofsd.json
+*-bsd-user
-/elf2dmp
+libhw32
-/trace-events-all
+libhw64
-/trace/generated-events.h
+libuser
-/trace/generated-events.c
+qemu-doc.html
-/trace/generated-helpers-wrappers.h
+qemu-tech.html
-/trace/generated-helpers.h
+qemu-doc.info
-/trace/generated-helpers.c
+qemu-tech.info
-/trace/generated-tcg-tracers.h
+qemu.1
-/ui/shader/texture-blit-frag.h
+qemu.pod
-/ui/shader/texture-blit-vert.h
+qemu-img.1
-/ui/shader/texture-blit-flip-vert.h
+qemu-img.pod
-/ui/input-keymap-*.c
+qemu-img
-*-timestamp
+qemu-nbd
-/*-softmmu
+qemu-nbd.8
-/*-darwin-user
+qemu-nbd.pod
-/*-linux-user
+qemu-options.texi
-/*-bsd-user
+qemu-img-cmds.texi
-/ivshmem-client
+qemu-img-cmds.h
-/ivshmem-server
+qemu-io
-/libdis*
+qemu-monitor.texi
-/libuser
+.gdbinit
 /linux-headers/asm
 /qga/qapi-generated
 /qapi-gen-timestamp
 /qapi/qapi-builtin-types.[ch]
 /qapi/qapi-builtin-visit.[ch]
 /qapi/qapi-commands-*.[ch]
 **/qapi/qapi-commands.[ch]
 **/qapi/qapi-emit-events.[ch]
 /qapi/qapi-events-*.[ch]
 **/qapi/qapi-events.[ch]
 **/qapi/qapi-init-commands.[ch]
 **/qapi/qapi-introspect.[ch]
 /qapi/qapi-types-*.[ch]
 **/qapi/qapi-types.[ch]
 /qapi/qapi-visit-*.[ch]
 !/qapi/qapi-visit-core.c
 **/qapi/qapi-visit.[ch]
 **/qapi/qapi-doc.texi
 /qemu-edid
 /qemu-img
 /qemu-nbd
 /qemu-options.def
 /qemu-options.texi
 /qemu-img-cmds.texi
 /qemu-img-cmds.h
 /qemu-io
 /qemu-ga
 /qemu-bridge-helper
 /qemu-keymap
 /qemu-monitor.texi
 /qemu-monitor-info.texi
 /qemu-storage-daemon
 /qemu-version.h
 /qemu-version.h.tmp
 /module_block.h
 /scsi/qemu-pr-helper
 /vhost-user-scsi
 /vhost-user-blk
 /vhost-user-gpu
 /vhost-user-input
 /fsdev/virtfs-proxy-helper
 *.tmp
 *.[1-9]
 *.a
 *.aux
 *.cp
 *.dvi
 *.exe
 *.msi
 *.dll
 *.so
 *.mo
 *.fn
 *.ky
 *.log
 *.pdf
 *.pod
 *.cps
 *.fns
 *.kys
 *.pg
 *.pyc
 *.toc
 *.tp
 *.vr
 *.d
 !/.gitlab-ci.d
 !/scripts/qemu-guest-agent/fsfreeze-hook.d
 *.o
-.sdk
+.pc
-*.gcda
+patches
-*.gcno
+pc-bios/bios-pq/status
-*.gcov
+pc-bios/vgabios-pq/status
-/pc-bios/bios-pq/status
+pc-bios/optionrom/multiboot.bin
-/pc-bios/edk2-*.fd
+pc-bios/optionrom/multiboot.raw
-/pc-bios/vgabios-pq/status
+pc-bios/optionrom/extboot.bin
 /pc-bios/optionrom/linuxboot.asm
 /pc-bios/optionrom/linuxboot.bin
 /pc-bios/optionrom/linuxboot.raw
 /pc-bios/optionrom/linuxboot.img
 /pc-bios/optionrom/linuxboot_dma.asm
 /pc-bios/optionrom/linuxboot_dma.bin
 /pc-bios/optionrom/linuxboot_dma.raw
 /pc-bios/optionrom/linuxboot_dma.img
 /pc-bios/optionrom/pvh.asm
 /pc-bios/optionrom/pvh.bin
 /pc-bios/optionrom/pvh.raw
 /pc-bios/optionrom/pvh.img
 /pc-bios/optionrom/multiboot.asm
 /pc-bios/optionrom/multiboot.bin
 /pc-bios/optionrom/multiboot.raw
 /pc-bios/optionrom/multiboot.img
 /pc-bios/optionrom/kvmvapic.asm
 /pc-bios/optionrom/kvmvapic.bin
 /pc-bios/optionrom/kvmvapic.raw
 /pc-bios/optionrom/kvmvapic.img
 /pc-bios/s390-ccw/s390-ccw.elf
 /pc-bios/s390-ccw/s390-ccw.img
 /docs/built
 /docs/interop/qemu-ga-qapi.texi
 /docs/interop/qemu-ga-ref.html
 /docs/interop/qemu-ga-ref.info*
 /docs/interop/qemu-ga-ref.txt
 /docs/interop/qemu-qmp-qapi.texi
 /docs/interop/qemu-qmp-ref.html
 /docs/interop/qemu-qmp-ref.info*
 /docs/interop/qemu-qmp-ref.txt
 /docs/version.texi
 /contrib/vhost-user-gpu/50-qemu-gpu.json
 *.tps
 .stgit-*
 .git-submodule-status
 cscope.*
 tags
 TAGS
 docker-src.*
 *~
 *.ast_raw
 *.depend_raw
 trace.h
 trace.c
 trace-ust.h
 trace-ust.h
 trace-dtrace.h
 trace-dtrace.dtrace
 trace-root.h
 trace-root.c
 trace-ust-root.h
 trace-ust-root.h
 trace-ust-all.h
 trace-ust-all.c
 trace-dtrace-root.h
 trace-dtrace-root.dtrace
 trace-ust-all.h
 trace-ust-all.c
 /target/arm/decode-sve.inc.c
--- a/.gitlab-ci.d/containers.yml
+++ b/.gitlab-ci.d/containers.yml
@@ -1,264 +0,0 @@
 .container_job_template: &container_job_definition
  image: docker:stable
  stage: containers
  services:
    - docker:dind
  before_script:
    - export TAG="$CI_REGISTRY_IMAGE/qemu/$NAME:latest"
    - export COMMON_TAG="$CI_REGISTRY/qemu-project/qemu/$NAME:latest"
    - apk add python3
    - docker info
    - docker login registry.gitlab.com -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD"
  script:
    - echo "TAG:$TAG"
    - echo "COMMON_TAG:$COMMON_TAG"
    - docker pull "$TAG" || docker pull "$COMMON_TAG" || true
    - ./tests/docker/docker.py --engine docker build
          -t "qemu/$NAME" -f "tests/docker/dockerfiles/$NAME.docker"
          -r $CI_REGISTRY_IMAGE
    - docker tag "qemu/$NAME" "$TAG"
    - docker push "$TAG"
  after_script:
    - docker logout
  rules:
    - changes:
      - .gitlab-ci.d/containers.yml
      - tests/docker/*
      - tests/docker/dockerfiles/*
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_REF_NAME == "testing/next"'
 amd64-centos7-container:
  <<: *container_job_definition
  variables:
    NAME: centos7
 amd64-centos8-container:
  <<: *container_job_definition
  variables:
    NAME: centos8
 amd64-debian10-container:
  <<: *container_job_definition
  variables:
    NAME: debian10
 amd64-debian11-container:
  <<: *container_job_definition
  variables:
    NAME: debian11
 amd64-debian9-container:
  <<: *container_job_definition
  variables:
    NAME: debian9
 amd64-debian9-mxe-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian9-container']
  variables:
    NAME: debian9-mxe
 alpha-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-alpha-cross
 amd64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-amd64-cross
 amd64-debian-user-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-all-test-cross
 amd64-debian-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-amd64
 arm64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-arm64-cross
 arm64-test-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian11-container']
  variables:
    NAME: debian-arm64-test-cross
 armel-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-armel-cross
 armhf-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-armhf-cross
 hppa-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-hppa-cross
 m68k-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-m68k-cross
 mips64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-mips64-cross
 mips64el-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-mips64el-cross
 mips-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-mips-cross
 mipsel-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-mipsel-cross
 powerpc-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-powerpc-cross
 ppc64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-ppc64-cross
 ppc64el-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-ppc64el-cross
 riscv64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-riscv64-cross
 s390x-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-s390x-cross
 sh4-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-sh4-cross
 sparc64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian10-container']
  variables:
    NAME: debian-sparc64-cross
 tricore-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer2
  needs: ['amd64-debian9-container']
  variables:
    NAME: debian-tricore-cross
 win32-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer3
  needs: ['amd64-debian9-mxe-container']
  variables:
    NAME: debian-win32-cross
 win64-debian-cross-container:
  <<: *container_job_definition
  stage: containers-layer3
  needs: ['amd64-debian9-mxe-container']
  variables:
    NAME: debian-win64-cross
 xtensa-debian-cross-container:
  <<: *container_job_definition
  variables:
    NAME: debian-xtensa-cross
 cris-fedora-cross-container:
  <<: *container_job_definition
  variables:
    NAME: fedora-cris-cross
 amd64-fedora-container:
  <<: *container_job_definition
  variables:
    NAME: fedora
 i386-fedora-cross-container:
  <<: *container_job_definition
  variables:
    NAME: fedora-i386-cross
 amd64-ubuntu1804-container:
  <<: *container_job_definition
  variables:
    NAME: ubuntu1804
 amd64-ubuntu2004-container:
  <<: *container_job_definition
  variables:
    NAME: ubuntu2004
 amd64-ubuntu-container:
  <<: *container_job_definition
  variables:
    NAME: ubuntu
--- a/.gitlab-ci.d/edk2.yml
+++ b/.gitlab-ci.d/edk2.yml
@@ -1,50 +0,0 @@
 docker-edk2:
 stage: containers
 rules: # Only run this job when the Dockerfile is modified
 - changes:
   - .gitlab-ci.d/edk2.yml
   - .gitlab-ci.d/edk2/Dockerfile
   when: always
 image: docker:19.03.1
 services:
 - docker:19.03.1-dind
 variables:
  GIT_DEPTH: 3
  IMAGE_TAG: $CI_REGISTRY_IMAGE:edk2-cross-build
  # We don't use TLS
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""
 before_script:
 - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
 script:
 - docker pull $IMAGE_TAG || true
 - docker build --cache-from $IMAGE_TAG --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
                                        --tag $IMAGE_TAG .gitlab-ci.d/edk2
 - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
 - docker push $IMAGE_TAG
 build-edk2:
 stage: build
 rules: # Only run this job when ...
 - changes: # ... roms/edk2/ is modified (submodule updated)
   - roms/edk2/*
   when: always
 - if: '$CI_COMMIT_REF_NAME =~ /^edk2/' # or the branch/tag starts with 'edk2'
   when: always
 - if: '$CI_COMMIT_MESSAGE =~ /edk2/i' # or last commit description contains 'EDK2'
   when: always
 artifacts:
   paths: # 'artifacts.zip' will contains the following files:
   - pc-bios/edk2*bz2
   - pc-bios/edk2-licenses.txt
   - edk2-stdout.log
   - edk2-stderr.log
 image: $CI_REGISTRY_IMAGE:edk2-cross-build
 variables:
   GIT_DEPTH: 3
 script: # Clone the required submodules and build EDK2
 - git submodule update --init roms/edk2
 - git -C roms/edk2 submodule update --init
 - export JOBS=$(($(getconf _NPROCESSORS_ONLN) + 1))
 - echo "=== Using ${JOBS} simultaneous jobs ==="
 - make -j${JOBS} -C roms efi 2>&1 1>edk2-stdout.log | tee -a edk2-stderr.log >&2
--- a/.gitlab-ci.d/edk2/Dockerfile
+++ b/.gitlab-ci.d/edk2/Dockerfile
@@ -1,27 +0,0 @@
 #
 # Docker image to cross-compile EDK2 firmware binaries
 #
 FROM ubuntu:16.04
 MAINTAINER Philippe Mathieu-Daudé <philmd@redhat.com>
 # Install packages required to build EDK2
 RUN apt update \
    && \
    \
    DEBIAN_FRONTEND=noninteractive \
    apt install --assume-yes --no-install-recommends \
        build-essential \
        ca-certificates \
        dos2unix \
        gcc-aarch64-linux-gnu \
        gcc-arm-linux-gnueabi \
        git \
        iasl \
        make \
        nasm \
        python \
        uuid-dev \
    && \
    \
    rm -rf /var/lib/apt/lists/*
--- a/.gitlab-ci.d/opensbi.yml
+++ b/.gitlab-ci.d/opensbi.yml
@@ -1,64 +0,0 @@
 docker-opensbi:
 stage: containers
 rules: # Only run this job when the Dockerfile is modified
 - changes:
   - .gitlab-ci.d/opensbi.yml
   - .gitlab-ci.d/opensbi/Dockerfile
   when: always
 image: docker:19.03.1
 services:
 - docker:19.03.1-dind
 variables:
  GIT_DEPTH: 3
  IMAGE_TAG: $CI_REGISTRY_IMAGE:opensbi-cross-build
  # We don't use TLS
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""
 before_script:
 - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
 script:
 - docker pull $IMAGE_TAG || true
 - docker build --cache-from $IMAGE_TAG --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
                                        --tag $IMAGE_TAG .gitlab-ci.d/opensbi
 - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
 - docker push $IMAGE_TAG
 build-opensbi:
 stage: build
 rules: # Only run this job when ...
 - changes: # ... roms/opensbi/ is modified (submodule updated)
   - roms/opensbi/*
   when: always
 - if: '$CI_COMMIT_REF_NAME =~ /^opensbi/' # or the branch/tag starts with 'opensbi'
   when: always
 - if: '$CI_COMMIT_MESSAGE =~ /opensbi/i' # or last commit description contains 'OpenSBI'
   when: always
 artifacts:
   paths: # 'artifacts.zip' will contains the following files:
   - pc-bios/opensbi-riscv32-sifive_u-fw_jump.bin
   - pc-bios/opensbi-riscv32-virt-fw_jump.bin
   - pc-bios/opensbi-riscv64-sifive_u-fw_jump.bin
   - pc-bios/opensbi-riscv64-virt-fw_jump.bin
   - opensbi32-virt-stdout.log
   - opensbi32-virt-stderr.log
   - opensbi64-virt-stdout.log
   - opensbi64-virt-stderr.log
   - opensbi32-sifive_u-stdout.log
   - opensbi32-sifive_u-stderr.log
   - opensbi64-sifive_u-stdout.log
   - opensbi64-sifive_u-stderr.log
 image: $CI_REGISTRY_IMAGE:opensbi-cross-build
 variables:
   GIT_DEPTH: 3
 script: # Clone the required submodules and build OpenSBI
 - git submodule update --init roms/opensbi
 - export JOBS=$(($(getconf _NPROCESSORS_ONLN) + 1))
 - echo "=== Using ${JOBS} simultaneous jobs ==="
 - make -j${JOBS} -C roms/opensbi clean
 - make -j${JOBS} -C roms opensbi32-virt 2>&1 1>opensbi32-virt-stdout.log | tee -a opensbi32-virt-stderr.log >&2
 - make -j${JOBS} -C roms/opensbi clean
 - make -j${JOBS} -C roms opensbi64-virt 2>&1 1>opensbi64-virt-stdout.log | tee -a opensbi64-virt-stderr.log >&2
 - make -j${JOBS} -C roms/opensbi clean
 - make -j${JOBS} -C roms opensbi32-sifive_u 2>&1 1>opensbi32-sifive_u-stdout.log | tee -a opensbi32-sifive_u-stderr.log >&2
 - make -j${JOBS} -C roms/opensbi clean
 - make -j${JOBS} -C roms opensbi64-sifive_u 2>&1 1>opensbi64-sifive_u-stdout.log | tee -a opensbi64-sifive_u-stderr.log >&2
--- a/.gitlab-ci.d/opensbi/Dockerfile
+++ b/.gitlab-ci.d/opensbi/Dockerfile
@@ -1,33 +0,0 @@
 #
 # Docker image to cross-compile OpenSBI firmware binaries
 #
 FROM ubuntu:18.04
 MAINTAINER Bin Meng <bmeng.cn@gmail.com>
 # Install packages required to build OpenSBI
 RUN apt update \
    && \
    \
    DEBIAN_FRONTEND=noninteractive \
    apt install --assume-yes --no-install-recommends \
        build-essential \
        ca-certificates \
        git \
        make \
        wget \
    && \
    \
    rm -rf /var/lib/apt/lists/*
 # Manually install the kernel.org "Crosstool" based toolchains for gcc-8.3
 RUN wget -O - \
    https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.3.0/x86_64-gcc-8.3.0-nolibc-riscv32-linux.tar.xz \
    | tar -C /opt -xJ
 RUN wget -O - \
    https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.3.0/x86_64-gcc-8.3.0-nolibc-riscv64-linux.tar.xz \
    | tar -C /opt -xJ
 # Export the toolchains to the system path
 ENV PATH="/opt/gcc-8.3.0-nolibc/riscv32-linux/bin:${PATH}"
 ENV PATH="/opt/gcc-8.3.0-nolibc/riscv64-linux/bin:${PATH}"
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,202 +0,0 @@
 # Currently we have two build stages after our containers are built:
 #  - build (for traditional build and test or first stage build)
 #  - test (for test stages, using build artefacts from a build stage)
 stages:
  - containers
  - containers-layer2
  - containers-layer3
  - build
  - test
 # We assume GitLab has it's own caching set up for RPM/APT repositories so we
 # just take care of avocado assets here.
 cache:
  paths:
    - $HOME/avocado/data/cache
 include:
  - local: '/.gitlab-ci.d/edk2.yml'
  - local: '/.gitlab-ci.d/opensbi.yml'
  - local: '/.gitlab-ci.d/containers.yml'
 .native_build_job_template: &native_build_job_definition
  stage: build
  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
  before_script:
    - JOBS=$(expr $(nproc) + 1)
  script:
    - mkdir build
    - cd build
    - if test -n "$TARGETS";
      then
        ../configure --enable-werror $CONFIGURE_ARGS --target-list="$TARGETS" ;
      else
        ../configure --enable-werror $CONFIGURE_ARGS ;
      fi
    - make -j"$JOBS"
    - if test -n "$MAKE_CHECK_ARGS";
      then
        make -j"$JOBS" $MAKE_CHECK_ARGS ;
      fi
 .native_test_job_template: &native_test_job_definition
  stage: test
  image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:latest
  script:
    - cd build
    - find . -type f -exec touch {} +
    - make $MAKE_CHECK_ARGS
 .post_acceptance_template: &post_acceptance
  after_script:
    - cd build
    - python3 -c 'import json; r = json.load(open("tests/results/latest/results.json")); [print(t["logfile"]) for t in r["tests"] if t["status"] not in ("PASS", "SKIP")]' | xargs cat
    - du -chs $HOME/avocado/data/cache
 build-system-ubuntu-main:
  <<: *native_build_job_definition
  variables:
    IMAGE: ubuntu2004
    TARGETS: aarch64-softmmu alpha-softmmu cris-softmmu hppa-softmmu lm32-softmmu
      moxie-softmmu microblazeel-softmmu mips64el-softmmu m68k-softmmu ppc-softmmu
      riscv64-softmmu sparc-softmmu
    MAKE_CHECK_ARGS: check-build
  artifacts:
    paths:
      - build
 check-system-ubuntu-main:
  <<: *native_test_job_definition
  needs:
    - job: build-system-ubuntu-main
      artifacts: true
  variables:
    IMAGE: ubuntu2004
    MAKE_CHECK_ARGS: check
 acceptance-system-ubuntu-main:
  <<: *native_test_job_definition
  needs:
    - job: build-system-ubuntu-main
      artifacts: true
  variables:
    IMAGE: ubuntu2004
    MAKE_CHECK_ARGS: check-acceptance
  <<: *post_acceptance
 build-system-fedora-alt:
  <<: *native_build_job_definition
  variables:
    IMAGE: fedora
    TARGETS: tricore-softmmu unicore32-softmmu microblaze-softmmu mips-softmmu
      riscv32-softmmu s390x-softmmu sh4-softmmu sparc64-softmmu x86_64-softmmu
      xtensa-softmmu nios2-softmmu or1k-softmmu
    MAKE_CHECK_ARGS: check-build
  artifacts:
    paths:
      - build
 check-system-fedora-alt:
  <<: *native_test_job_definition
  needs:
    - job: build-system-fedora-alt
      artifacts: true
  variables:
    IMAGE: fedora
    MAKE_CHECK_ARGS: check
 acceptance-system-fedora-alt:
  <<: *native_test_job_definition
  needs:
    - job: build-system-fedora-alt
      artifacts: true
  variables:
    IMAGE: fedora
    MAKE_CHECK_ARGS: check-acceptance
  <<: *post_acceptance
 build-disabled:
  <<: *native_build_job_definition
  variables:
    IMAGE: fedora
    CONFIGURE_ARGS: --disable-rdma --disable-slirp --disable-curl
      --disable-capstone --disable-live-block-migration --disable-glusterfs
      --disable-replication --disable-coroutine-pool --disable-smartcard
      --disable-guest-agent --disable-curses --disable-libxml2 --disable-tpm
      --disable-qom-cast-debug --disable-spice --disable-vhost-vsock
      --disable-vhost-net --disable-vhost-crypto --disable-vhost-user
    TARGETS: i386-softmmu ppc64-softmmu mips64-softmmu i386-linux-user
    MAKE_CHECK_ARGS: check-qtest SPEED=slow
 build-tcg-disabled:
  <<: *native_build_job_definition
  variables:
    IMAGE: centos8
  script:
    - mkdir build
    - cd build
    - ../configure --disable-tcg --audio-drv-list=""
    - make -j"$JOBS"
    - make check-unit
    - make check-qapi-schema
    - cd tests/qemu-iotests/
    - ./check -raw 001 002 003 004 005 008 009 010 011 012 021 025 032 033 048
            052 063 077 086 101 104 106 113 148 150 151 152 157 159 160 163
            170 171 183 184 192 194 197 208 215 221 222 226 227 236 253 277
    - ./check -qcow2 028 051 056 057 058 065 067 068 082 085 091 095 096 102 122
            124 132 139 142 144 145 151 152 155 157 165 194 196 197 200 202
            208 209 215 216 218 222 227 234 246 247 248 250 254 255 257 258
            260 261 262 263 264 270 272 273 277 279
 build-user:
  <<: *native_build_job_definition
  variables:
    IMAGE: debian-all-test-cross
    CONFIGURE_ARGS: --disable-tools --disable-system
    MAKE_CHECK_ARGS: check-tcg
 build-clang:
  <<: *native_build_job_definition
  variables:
    IMAGE: fedora
    CONFIGURE_ARGS: --cc=clang --cxx=clang++
    TARGETS: alpha-softmmu arm-softmmu m68k-softmmu mips64-softmmu
      ppc-softmmu s390x-softmmu arm-linux-user
    MAKE_CHECK_ARGS: check
 build-oss-fuzz:
  <<: *native_build_job_definition
  variables:
    IMAGE: fedora
  script:
    - mkdir build-oss-fuzz
    - CC="clang" CXX="clang++" CFLAGS="-fsanitize=address"
      ./scripts/oss-fuzz/build.sh
    - for fuzzer in $(find ./build-oss-fuzz/DEST_DIR/ -executable -type f
                      | grep -v slirp); do
        grep "LLVMFuzzerTestOneInput" ${fuzzer} > /dev/null 2>&1 || continue ;
        echo Testing ${fuzzer} ... ;
        ASAN_OPTIONS="fast_unwind_on_malloc=0"
         "${fuzzer}" -runs=1000 -seed=1 || exit 1 ;
      done
 build-tci:
  <<: *native_build_job_definition
  variables:
    IMAGE: fedora
  script:
    - TARGETS="aarch64 alpha arm hppa m68k microblaze moxie ppc64 s390x x86_64"
    - mkdir build
    - cd build
    - ../configure --enable-tcg-interpreter
        --target-list="$(for tg in $TARGETS; do echo -n ${tg}'-softmmu '; done)"
    - make -j"$JOBS"
    - make run-tcg-tests-x86_64-softmmu
    - make tests/qtest/boot-serial-test tests/qtest/cdrom-test tests/qtest/pxe-test
    - for tg in $TARGETS ; do
        export QTEST_QEMU_BINARY="${tg}-softmmu/qemu-system-${tg}" ;
        ./tests/qtest/boot-serial-test || exit 1 ;
        ./tests/qtest/cdrom-test || exit 1 ;
      done
    - QTEST_QEMU_BINARY="x86_64-softmmu/qemu-system-x86_64" ./tests/qtest/pxe-test
    - QTEST_QEMU_BINARY="s390x-softmmu/qemu-system-s390x" ./tests/qtest/pxe-test -m slow
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,60 +1,6 @@
 [submodule "roms/vgabios"]
 	path = roms/vgabios
 	url = ../vgabios.git
 [submodule "roms/seabios"]
 	path = roms/seabios
-	url = https://git.qemu.org/git/seabios.git/
+	url = ../seabios.git
 [submodule "roms/SLOF"]
 	path = roms/SLOF
 	url = https://git.qemu.org/git/SLOF.git
 [submodule "roms/ipxe"]
 	path = roms/ipxe
 	url = https://git.qemu.org/git/ipxe.git
 [submodule "roms/openbios"]
 	path = roms/openbios
 	url = https://git.qemu.org/git/openbios.git
 [submodule "roms/qemu-palcode"]
 	path = roms/qemu-palcode
 	url = https://git.qemu.org/git/qemu-palcode.git
 [submodule "roms/sgabios"]
 	path = roms/sgabios
 	url = https://git.qemu.org/git/sgabios.git
 [submodule "dtc"]
 	path = dtc
 	url = https://git.qemu.org/git/dtc.git
 [submodule "roms/u-boot"]
 	path = roms/u-boot
 	url = https://git.qemu.org/git/u-boot.git
 [submodule "roms/skiboot"]
 	path = roms/skiboot
 	url = https://git.qemu.org/git/skiboot.git
 [submodule "roms/QemuMacDrivers"]
 	path = roms/QemuMacDrivers
 	url = https://git.qemu.org/git/QemuMacDrivers.git
 [submodule "ui/keycodemapdb"]
 	path = ui/keycodemapdb
 	url = https://git.qemu.org/git/keycodemapdb.git
 [submodule "capstone"]
 	path = capstone
 	url = https://git.qemu.org/git/capstone.git
 [submodule "roms/seabios-hppa"]
 	path = roms/seabios-hppa
 	url = https://git.qemu.org/git/seabios-hppa.git
 [submodule "roms/u-boot-sam460ex"]
 	path = roms/u-boot-sam460ex
 	url = https://git.qemu.org/git/u-boot-sam460ex.git
 [submodule "tests/fp/berkeley-testfloat-3"]
 	path = tests/fp/berkeley-testfloat-3
 	url = https://git.qemu.org/git/berkeley-testfloat-3.git
 [submodule "tests/fp/berkeley-softfloat-3"]
 	path = tests/fp/berkeley-softfloat-3
 	url = https://git.qemu.org/git/berkeley-softfloat-3.git
 [submodule "roms/edk2"]
 	path = roms/edk2
 	url = https://git.qemu.org/git/edk2.git
 [submodule "slirp"]
 	path = slirp
 	url = https://git.qemu.org/git/libslirp.git
 [submodule "roms/opensbi"]
 	path = roms/opensbi
 	url = 	https://git.qemu.org/git/opensbi.git
 [submodule "roms/qboot"]
 	path = roms/qboot
 	url = https://github.com/bonzini/qboot
--- a/.gitpublish
+++ b/.gitpublish
@@ -1,51 +0,0 @@
 #
 # Common git-publish profiles that can be used to send patches to QEMU upstream.
 #
 # See https://github.com/stefanha/git-publish for more information
 #
 [gitpublishprofile "default"]
 base = master
 to = qemu-devel@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "rfc"]
 base = master
 prefix = RFC PATCH
 to = qemu-devel@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "stable"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-stable@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "trivial"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-trivial@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "block"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-block@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "arm"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-arm@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "s390"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-s390@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 [gitpublishprofile "ppc"]
 base = master
 to = qemu-devel@nongnu.org
 cc = qemu-ppc@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
--- a/.mailmap
+++ b/.mailmap
@@ -1,170 +0,0 @@
 # This mailmap fixes up author names/addresses.
 #
 # If you are adding to this file consider if a similar change needs to
 # be made to contrib/gitdm/aliases. They are not however completely
 # analogous. .mailmap is concerned with fixing up damaged author
 # fields where as the gitdm equivalent is more concerned with making
 # sure multiple email addresses get mapped onto the same author.
 #
 # From man git-shortlog the forms are:
 #
 #  Proper Name <commit@email.xx>
 #  <proper@email.xx> <commit@email.xx>
 #  Proper Name <proper@email.xx> <commit@email.xx>
 #  Proper Name <proper@email.xx> Commit Name <commit@email.xx>
 #
 # The first section translates weird addresses from the original git import
 # into proper addresses so that they are counted properly by git shortlog.
 Andrzej Zaborowski <balrogg@gmail.com> balrog <balrog@c046a42c-6fe2-441c-8c8c-71466251a162>
 Anthony Liguori <anthony@codemonkey.ws> aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
 Aurelien Jarno <aurelien@aurel32.net> aurel32 <aurel32@c046a42c-6fe2-441c-8c8c-71466251a162>
 Blue Swirl <blauwirbel@gmail.com> blueswir1 <blueswir1@c046a42c-6fe2-441c-8c8c-71466251a162>
 Edgar E. Iglesias <edgar.iglesias@gmail.com> edgar_igl <edgar_igl@c046a42c-6fe2-441c-8c8c-71466251a162>
 Fabrice Bellard <fabrice@bellard.org> bellard <bellard@c046a42c-6fe2-441c-8c8c-71466251a162>
 Jocelyn Mayer <l_indien@magic.fr> j_mayer <j_mayer@c046a42c-6fe2-441c-8c8c-71466251a162>
 Paul Brook <paul@codesourcery.com> pbrook <pbrook@c046a42c-6fe2-441c-8c8c-71466251a162>
 Thiemo Seufer <ths@networkno.de> ths <ths@c046a42c-6fe2-441c-8c8c-71466251a162>
 malc <av1474@comtv.ru> malc <malc@c046a42c-6fe2-441c-8c8c-71466251a162>
 # There is also a:
 #    (no author) <(no author)@c046a42c-6fe2-441c-8c8c-71466251a162>
 # for the cvs2svn initialization commit e63c3dc74bf.
 # Next, translate a few commits where mailman rewrote the From: line due
 # to strict SPF, although we prefer to avoid adding more entries like that.
 Ed Swierk <eswierk@skyportsystems.com> Ed Swierk via Qemu-devel <qemu-devel@nongnu.org>
 Ian McKellar <ianloic@google.com> Ian McKellar via Qemu-devel <qemu-devel@nongnu.org>
 Julia Suvorova <jusual@mail.ru> Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>
 Justin Terry (VM) <juterry@microsoft.com> Justin Terry (VM) via Qemu-devel <qemu-devel@nongnu.org>
 # Next, replace old addresses by a more recent one.
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@mips.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@imgtec.com>
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <amarkovic@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <arikalo@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <aleksandar.rikalo@rt-rk.com>
 Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
 Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
 James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Leif Lindholm <leif@nuviainc.com> <leif.lindholm@linaro.org>
 Radoslaw Biernacki <rad@semihalf.com> <radoslaw.biernacki@linaro.org>
 Paul Burton <pburton@wavecomp.com> <paul.burton@mips.com>
 Paul Burton <pburton@wavecomp.com> <paul.burton@imgtec.com>
 Paul Burton <pburton@wavecomp.com> <paul@archlinuxmips.org>
 Philippe Mathieu-Daudé <philmd@redhat.com> <f4bug@amsat.org>
 Stefan Brankovic <stefan.brankovic@syrmia.com> <stefan.brankovic@rt-rk.com.com>
 Yongbok Kim <yongbok.kim@mips.com> <yongbok.kim@imgtec.com>
 # Also list preferred name forms where people have changed their
 # git author config, or had utf8/latin1 encoding issues.
 Aaron Lindsay <aaron@os.amperecomputing.com>
 Alexey Gerasimenko <x1917x@gmail.com>
 Alex Ivanov <void@aleksoft.net>
 Andreas Färber <afaerber@suse.de>
 Bandan Das <bsd@redhat.com>
 Benjamin MARSILI <mlspirat42@gmail.com>
 Benoît Canet <benoit.canet@gmail.com>
 Benoît Canet <benoit.canet@irqsave.net>
 Benoît Canet <benoit.canet@nodalink.com>
 Boqun Feng <boqun.feng@gmail.com>
 Boqun Feng <boqun.feng@intel.com>
 Brad Smith <brad@comstyle.com>
 Brijesh Singh <brijesh.singh@amd.com>
 Brilly Wu <brillywu@viatech.com.cn>
 Cédric Vincent <cedric.vincent@st.com>
 CheneyLin <linzc@zju.edu.cn>
 Chen Gang <chengang@emindsoft.com.cn>
 Chen Gang <gang.chen.5i5j@gmail.com>
 Chen Gang <gang.chen@sunrus.com.cn>
 Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
 Christophe Lyon <christophe.lyon@st.com>
 Collin L. Walling <walling@linux.ibm.com>
 Daniel P. Berrangé <berrange@redhat.com>
 Eduardo Otubo <otubo@redhat.com>
 Fabrice Desclaux <fabrice.desclaux@cea.fr>
 Fernando Luis Vázquez Cao <fernando_b1@lab.ntt.co.jp>
 Fernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
 Gautham R. Shenoy <ego@in.ibm.com>
 Gautham R. Shenoy <ego@linux.vnet.ibm.com>
 Gonglei (Arei) <arei.gonglei@huawei.com>
 Guang Wang <wang.guang55@zte.com.cn>
 Hailiang Zhang <zhang.zhanghailiang@huawei.com>
 Hervé Poussineau <hpoussin@reactos.org>
 Jakub Jermář <jakub@jermar.eu>
 Jakub Jermář <jakub.jermar@kernkonzept.com>
 Jean-Christophe Dubois <jcd@tribudubois.net>
 Jindřich Makovička <makovick@gmail.com>
 John Arbuckle <programmingkidx@gmail.com>
 Juha Riihimäki <juha.riihimaki@nokia.com>
 Juha Riihimäki <Juha.Riihimaki@nokia.com>
 Jun Li <junmuzi@gmail.com>
 Laurent Vivier <Laurent@lvivier.info>
 Leandro Lupori <leandro.lupori@gmail.com>
 Li Guang <lig.fnst@cn.fujitsu.com>
 Liming Wang <walimisdev@gmail.com>
 linzhecheng <linzc@zju.edu.cn>
 Liran Schour <lirans@il.ibm.com>
 Liu Yu <yu.liu@freescale.com>
 Liu Yu <Yu.Liu@freescale.com>
 Li Zhang <zhlcindy@gmail.com>
 Li Zhang <zhlcindy@linux.vnet.ibm.com>
 Lluís Vilanova <vilanova@ac.upc.edu>
 Lluís Vilanova <xscript@gmx.net>
 Longpeng (Mike) <longpeng2@huawei.com>
 Luc Michel <luc.michel@git.antfield.fr>
 Luc Michel <luc.michel@greensocs.com>
 Marc Marí <marc.mari.barcelo@gmail.com>
 Marc Marí <markmb@redhat.com>
 Michael Avdienko <whitearchey@gmail.com>
 Michael S. Tsirkin <mst@redhat.com>
 Munkyu Im <munkyu.im@samsung.com>
 Nicholas Bellinger <nab@linux-iscsi.org>
 Nicholas Thomas <nick@bytemark.co.uk>
 Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
 Orit Wasserman <owasserm@redhat.com>
 Paolo Bonzini <pbonzini@redhat.com>
 Pavel Dovgaluk <dovgaluk@ispras.ru>
 Pavel Dovgaluk <pavel.dovgaluk@gmail.com>
 Pavel Dovgaluk <Pavel.Dovgaluk@ispras.ru>
 Peter Crosthwaite <crosthwaite.peter@gmail.com>
 Peter Crosthwaite <peter.crosthwaite@petalogix.com>
 Peter Crosthwaite <peter.crosthwaite@xilinx.com>
 Prasad J Pandit <pjp@fedoraproject.org>
 Prasad J Pandit <ppandit@redhat.com>
 Qiao Nuohan <qiaonuohan@cn.fujitsu.com>
 Reimar Döffinger <Reimar.Doeffinger@gmx.de>
 Remy Noel <remy.noel@blade-group.com>
 Roger Pau Monné <roger.pau@citrix.com>
 Shin'ichiro Kawasaki <kawasaki@juno.dti.ne.jp>
 Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
 Sochin Jiang <sochin.jiang@huawei.com>
 Takashi Yoshii <takasi-y@ops.dti.ne.jp>
 Thomas Huth <thuth@redhat.com>
 Thomas Knych <thomaswk@google.com>
 Timothy Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
 Tony Nguyen <tony.nguyen@bt.com>
 Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com>
 Vibi Sreenivasan <vibi_sreenivasan@cms.com>
 Vijaya Kumar K <vijayak@cavium.com>
 Vijaya Kumar K <Vijaya.Kumar@cavium.com>
 Vijay Kumar <vijaykumar@bravegnu.org>
 Vijay Kumar <vijaykumar@zilogic.com>
 Wang Guang <wang.guang55@zte.com.cn>
 Wenchao Xia <xiawenc@linux.vnet.ibm.com>
 Wenshuang Ma <kevinnma@tencent.com>
 Xiaoqiang Zhao <zxq_yx_007@163.com>
 Xinhua Cao <caoxinhua@huawei.com>
 Xiong Zhang <xiong.y.zhang@intel.com>
 Yin Yin <yin.yin@cs2c.com.cn>
 Yu-Chen Lin <npes87184@gmail.com>
 Yu-Chen Lin <npes87184@gmail.com> <yuchenlin@synology.com>
 YunQiang Su <syq@debian.org>
 YunQiang Su <ysu@wavecomp.com>
 Yuri Pudgorodskiy <yur@virtuozzo.com>
 Zhengui Li <lizhengui@huawei.com>
 Zhenwei Pi <pizhenwei@bytedance.com>
 Zhenwei Pi <zhenwei.pi@youruncloud.com>
 Zhuang Yanying <ann.zhuangyanying@huawei.com>
--- a/.patchew.yml
+++ b/.patchew.yml
@@ -1,302 +0,0 @@
 ---
 # Note: this file is still unused.  It serves as a documentation for the
 # Patchew configuration in case patchew.org disappears or has to be
 # reinstalled.
 #
 # Patchew configuration is available to project administrators at
 # https://patchew.org/api/v1/projects/1/config/ and can be configured
 # to YAML using the following Python script:
 #
 #     import json
 #     import sys
 #     import ruamel.yaml
 #
 #     json_str = sys.stdin.read()
 #     yaml = ruamel.yaml.YAML()
 #     yaml.explicit_start = True
 #     data = json.loads(json_str, object_pairs_hook=ruamel.yaml.comments.CommentedMap)
 #     ruamel.yaml.scalarstring.walk_tree(data)
 #     yaml.dump(data, sys.stdout)
 email:
  notifications:
    timeouts:
      event: TestingReport
      enabled: true
      to_user: false
      reply_subject: true
      set_reply_to: true
      in_reply_to: true
      reply_to_all: false
      subject_template: none
      to: fam@euphon.net
      cc: ''
      body_template: |
        {% if not is_timeout %} {{ cancel }} {% endif %}
        Test '{{ test }}' timeout, log:
        {{ log }}
    ENOSPC:
      event: TestingReport
      enabled: true
      to_user: false
      reply_subject: false
      set_reply_to: false
      in_reply_to: true
      reply_to_all: false
      subject_template: Out of space error
      to: fam@euphon.net
      cc: ''
      body_template: |
        {% if passed %}
          {{ cancel }}
        {% endif %}
        {% if 'No space left on device' in log %}
        Tester {{ tester }} out of space when running {{ test }}
          {{ log }}
        {% else %}
          {{ cancel }}
        {% endif %}
    FailureShort:
      event: TestingReport
      enabled: true
      to_user: false
      reply_subject: true
      set_reply_to: true
      in_reply_to: true
      reply_to_all: true
      subject_template: Testing failed
      to: ''
      cc: ''
      body_template: |
        {% if passed or not obj.message_id or is_timeout %}
          {{ cancel }}
        {% endif %}
        {% if 'No space left on device' in log %}
          {{ cancel }}
        {% endif %}
        Patchew URL: https://patchew.org/QEMU/{{ obj.message_id }}/
        {% ansi2text log as logtext %}
        {% if test == "checkpatch" %}
        Hi,
        This series seems to have some coding style problems. See output below for
        more information:
        {{ logtext }}
        {% elif test == "docker-mingw@fedora" or test == "docker-quick@centos7" or test == "asan" %}
        Hi,
        This series failed the {{ test }} build test. Please find the testing commands and
        their output below. If you have Docker installed, you can probably reproduce it
        locally.
        {% lines_between logtext start="^=== TEST SCRIPT BEGIN ===$" stop="^=== TEST SCRIPT END ===$" %}
        {% lines_between logtext start="^=== OUTPUT BEGIN ===$" stop="=== OUTPUT END ===$" as output %}
        {% grep_C output regex="\b(FAIL|XPASS|ERROR|WARN|error:|warning:)" n=3 %}
        {% elif test == "s390x" or test == "FreeBSD" or test == "ppcle" or test == "ppcbe" %}
        Hi,
        This series failed build test on {{test}} host. Please find the details below.
        {% lines_between logtext start="^=== TEST SCRIPT BEGIN ===$" stop="^=== TEST SCRIPT END ===$" %}
        {% lines_between logtext start="^=== OUTPUT BEGIN ===$" stop="=== OUTPUT END ===$" as output %}
        {% grep_C output regex="\b(FAIL|XPASS|ERROR|WARN|error:|warning:)" n=3 %}
        {% else %}
        {{ cancel }}
        {% endif %}
        The full log is available at
        {{ log_url }}.
        ---
        Email generated automatically by Patchew [https://patchew.org/].
        Please send your feedback to patchew-devel@redhat.com
 testing:
  tests:
    asan:
      enabled: true
      requirements: docker
      timeout: 3600
      script: |
        #!/bin/bash
        time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
    docker-quick@centos7:
      enabled: false
      requirements: docker,x86_64
      timeout: 3600
      script: |
        #!/bin/bash
        time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
    checkpatch:
      enabled: true
      requirements: ''
      timeout: 600
      script: |
        #!/bin/bash
        git rev-parse base > /dev/null || exit 0
        git config --local diff.renamelimit 0
        git config --local diff.renames True
        git config --local diff.algorithm histogram
        ./scripts/checkpatch.pl --mailback base..
    docker-mingw@fedora:
      enabled: true
      requirements: docker,x86_64
      timeout: 3600
      script: |
        #! /bin/bash
        test "$(uname -m)" = "x86_64"
    ppcle:
      enabled: false
      requirements: ppcle
      timeout: 3600
      script: |
        #!/bin/bash
        # Testing script will be invoked under the git checkout with
        # HEAD pointing to a commit that has the patches applied on top of "base"
        # branch
        set -e
        CC=$HOME/bin/cc
        INSTALL=$PWD/install
        BUILD=$PWD/build
        mkdir -p $BUILD $INSTALL
        SRC=$PWD
        cd $BUILD
        $SRC/configure --cc=$CC --prefix=$INSTALL
        make -j4
        # XXX: we need reliable clean up
        # make check -j4 V=1
        make install
        echo
        echo "=== ENV ==="
        env
        echo
        echo "=== PACKAGES ==="
        rpm -qa
    ppcbe:
      enabled: false
      requirements: ppcbe
      timeout: 3600
      script: |
        #!/bin/bash
        # Testing script will be invoked under the git checkout with
        # HEAD pointing to a commit that has the patches applied on top of "base"
        # branch
        set -e
        CC=$HOME/bin/cc
        INSTALL=$PWD/install
        BUILD=$PWD/build
        mkdir -p $BUILD $INSTALL
        SRC=$PWD
        cd $BUILD
        $SRC/configure --cc=$CC --prefix=$INSTALL
        make -j4
        # XXX: we need reliable clean up
        # make check -j4 V=1
        make install
        echo
        echo "=== ENV ==="
        env
        echo
        echo "=== PACKAGES ==="
        rpm -qa
    FreeBSD:
      enabled: true
      requirements: qemu-x86,x86_64,git
      timeout: 3600
      script: |
        #!/bin/bash
        # Testing script will be invoked under the git checkout with
        # HEAD pointing to a commit that has the patches applied on top of "base"
        # branch
        if qemu-system-x86_64 --help >/dev/null 2>&1; then
          QEMU=qemu-system-x86_64
        elif /usr/libexec/qemu-kvm --help >/dev/null 2>&1; then
          QEMU=/usr/libexec/qemu-kvm
        else
          exit 1
        fi
        make vm-build-freebsd J=21 QEMU=$QEMU
        exit 0
    docker-clang@ubuntu:
      enabled: true
      requirements: docker,x86_64
      timeout: 3600
      script: |
        #!/bin/bash
        time make docker-test-clang@ubuntu SHOW_ENV=1 J=14 NETWORK=1
    s390x:
      enabled: true
      requirements: s390x
      timeout: 3600
      script: |
        #!/bin/bash
        # Testing script will be invoked under the git checkout with
        # HEAD pointing to a commit that has the patches applied on top of "base"
        # branch
        set -e
        CC=$HOME/bin/cc
        INSTALL=$PWD/install
        BUILD=$PWD/build
        mkdir -p $BUILD $INSTALL
        SRC=$PWD
        cd $BUILD
        $SRC/configure --cc=$CC --prefix=$INSTALL
        make -j4
        # XXX: we need reliable clean up
        # make check -j4 V=1
        make install
        echo
        echo "=== ENV ==="
        env
        echo
        echo "=== PACKAGES ==="
        rpm -qa
  requirements:
    x86_64:
      script: |
        #! /bin/bash
        test "$(uname -m)" = "x86_64"
    qemu-x86:
      script: |
        #!/bin/bash
        if qemu-system-x86_64 --help >/dev/null 2>&1; then
          :
        elif /usr/libexec/qemu-kvm --help >/dev/null 2>&1; then
          :
        else
          exit 1
        fi
    ppcle:
      script: |
        #!/bin/bash
        test "$(uname -m)" = "ppc64le"
    ppcbe:
      script: |
        #!/bin/bash
        test "$(uname -m)" = "ppc64"
    git:
      script: |
        #! /bin/bash
        git config user.name > /dev/null 2>&1
    docker:
      script: |
        #!/bin/bash
        docker ps || sudo -n docker ps
    s390x:
      script: |
        #!/bin/bash
        test "$(uname -m)" = "s390x"
 git:
  push_to: git@github.com:patchew-project/qemu
  public_repo: https://github.com/patchew-project/qemu
  url_template: https://github.com/patchew-project/qemu/tree/%t
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -1,20 +0,0 @@
 # .readthedocs.yml
 # Read the Docs configuration file
 # See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
 # Required
 version: 2
 # Build documentation in the docs/ directory with Sphinx
 sphinx:
  configuration: docs/conf.py
 # We want all the document formats
 formats: all
 # For consistency, we require that QEMU's Sphinx extensions
 # run with at least the same minimum version of Python that
 # we require for other Python in our codebase (our conf.py
 # enforces this, and some code needs it.)
 python:
  version: 3.5
--- a/.shippable.yml
+++ b/.shippable.yml
@@ -1,39 +0,0 @@
 language: c
 git:
   submodules: false
 env:
  global:
    - LC_ALL=C
  matrix:
    - IMAGE=debian-amd64
      TARGET_LIST=x86_64-softmmu,x86_64-linux-user
    - IMAGE=debian-win32-cross
      TARGET_LIST=arm-softmmu,i386-softmmu,lm32-softmmu
    - IMAGE=debian-win64-cross
      TARGET_LIST=aarch64-softmmu,sparc64-softmmu,x86_64-softmmu
    - IMAGE=debian-armel-cross
      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
    - IMAGE=debian-armhf-cross
      TARGET_LIST=arm-softmmu,arm-linux-user,armeb-linux-user
    - IMAGE=debian-arm64-cross
      TARGET_LIST=aarch64-softmmu,aarch64-linux-user
    - IMAGE=debian-s390x-cross
      TARGET_LIST=s390x-softmmu,s390x-linux-user
    - IMAGE=debian-mips-cross
      TARGET_LIST=mips-softmmu,mipsel-linux-user
    - IMAGE=debian-mips64el-cross
      TARGET_LIST=mips64el-softmmu,mips64el-linux-user
    - IMAGE=debian-ppc64el-cross
      TARGET_LIST=ppc64-softmmu,ppc64-linux-user,ppc64abi32-linux-user
 build:
  pre_ci_boot:
    image_name: registry.gitlab.com/qemu-project/qemu/qemu/${IMAGE}
    image_tag: latest
    pull: true
    options: "-e HOME=/root"
  ci:
    - unset CC
    - mkdir build
    - cd build
    - ../configure --disable-docs ${QEMU_CONFIGURE_OPTS} --target-list=${TARGET_LIST}
    - make -j$(($(getconf _NPROCESSORS_ONLN) + 1))
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,579 +0,0 @@
 # The current Travis default is a VM based 16.04 Xenial on GCE
 # Additional builds with specific requirements for a full VM need to
 # be added as additional matrix: entries later on
 os: linux
 dist: xenial
 language: c
 compiler:
  - gcc
 cache:
  # There is one cache per branch and compiler version.
  # characteristics of each job are used to identify the cache:
  # - OS name (currently only linux)
  # - OS distribution (for Linux, xenial, trusty, or precise)
  # - Names and values of visible environment variables set in .travis.yml or Settings panel
  timeout: 1200
  ccache: true
  pip: true
  directories:
  - $HOME/avocado/data/cache
 addons:
  apt:
    packages:
      # Build dependencies
      - libaio-dev
      - libattr1-dev
      - libbrlapi-dev
      - libcap-ng-dev
      - libgcc-4.8-dev
      - libgnutls28-dev
      - libgtk-3-dev
      - libiscsi-dev
      - liblttng-ust-dev
      - libncurses5-dev
      - libnfs-dev
      - libnss3-dev
      - libpixman-1-dev
      - libpng-dev
      - librados-dev
      - libsdl2-dev
      - libsdl2-image-dev
      - libseccomp-dev
      - libspice-protocol-dev
      - libspice-server-dev
      - libssh-dev
      - liburcu-dev
      - libusb-1.0-0-dev
      - libvdeplug-dev
      - libvte-2.91-dev
      - libzstd-dev
      - sparse
      - uuid-dev
      - gcovr
      # Tests dependencies
      - genisoimage
 # The channel name "irc.oftc.net#qemu" is encrypted against qemu/qemu
 # to prevent IRC notifications from forks. This was created using:
 # $ travis encrypt -r "qemu/qemu" "irc.oftc.net#qemu"
 notifications:
  irc:
    channels:
      - secure: "F7GDRgjuOo5IUyRLqSkmDL7kvdU4UcH3Lm/W2db2JnDHTGCqgEdaYEYKciyCLZ57vOTsTsOgesN8iUT7hNHBd1KWKjZe9KDTZWppWRYVwAwQMzVeSOsbbU4tRoJ6Pp+3qhH1Z0eGYR9ZgKYAoTumDFgSAYRp4IscKS8jkoedOqM="
    on_success: change
    on_failure: always
 env:
  global:
    - SRC_DIR=".."
    - BUILD_DIR="build"
    - BASE_CONFIG="--disable-docs --disable-tools"
    - TEST_BUILD_CMD=""
    - TEST_CMD="make check V=1"
    # This is broadly a list of "mainline" softmmu targets which have support across the major distros
    - MAIN_SOFTMMU_TARGETS="aarch64-softmmu,mips64-softmmu,ppc64-softmmu,riscv64-softmmu,s390x-softmmu,x86_64-softmmu"
    - CCACHE_SLOPPINESS="include_file_ctime,include_file_mtime"
    - CCACHE_MAXSIZE=1G
    - G_MESSAGES_DEBUG=error
 git:
  # we want to do this ourselves
  submodules: false
 # Common first phase for all steps
 before_install:
  - if command -v ccache ; then ccache --zero-stats ; fi
  - export JOBS=$(($(getconf _NPROCESSORS_ONLN) + 1))
  - echo "=== Using ${JOBS} simultaneous jobs ==="
 # Configure step - may be overridden
 before_script:
  - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
  - ${SRC_DIR}/configure ${BASE_CONFIG} ${CONFIG} || { cat config.log && exit 1; }
 # Main build & test - rarely overridden - controlled by TEST_CMD
 script:
  - BUILD_RC=0 && make -j${JOBS} || BUILD_RC=$?
  - |
    if [ "$BUILD_RC" -eq 0 ] && [ -n "$TEST_BUILD_CMD" ]; then
        ${TEST_BUILD_CMD} || BUILD_RC=$?
    else
        $(exit $BUILD_RC);
    fi
  - |
    if [ "$BUILD_RC" -eq 0 ] ; then
        ${TEST_CMD} ;
    else
        $(exit $BUILD_RC);
    fi
 after_script:
  - df -h
  - if command -v ccache ; then ccache --show-stats ; fi
 jobs:
  include:
    - name: "GCC static (user)"
      env:
        - CONFIG="--disable-system --static"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
    # we split the system builds as it takes a while to build them all
    - name: "GCC (main-softmmu)"
      env:
        - CONFIG="--disable-user --target-list=${MAIN_SOFTMMU_TARGETS}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
    - name: "GCC (other-softmmu)"
      env:
       - CONFIG="--disable-user --target-list-exclude=${MAIN_SOFTMMU_TARGETS}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
    # Just build tools and run minimal unit and softfloat checks
    - name: "GCC check-softfloat (user)"
      env:
        - BASE_CONFIG="--enable-tools"
        - CONFIG="--disable-user --disable-system"
        - TEST_CMD="make check-unit check-softfloat -j${JOBS}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
    # --enable-debug implies --enable-debug-tcg, also runs quite a bit slower
    - name: "GCC debug (main-softmmu)"
      env:
        - CONFIG="--enable-debug --target-list=${MAIN_SOFTMMU_TARGETS}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug"
    # TCG debug can be run just on its own and is mostly agnostic to user/softmmu distinctions
    - name: "GCC debug (user)"
      env:
        - CONFIG="--enable-debug-tcg --disable-system"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug-tcg"
    - name: "GCC some libs disabled (main-softmmu)"
      env:
        - CONFIG="--disable-linux-aio --disable-cap-ng --disable-attr --disable-brlapi --disable-libusb --disable-replication --target-list=${MAIN_SOFTMMU_TARGETS}"
    # Module builds are mostly of interest to major distros
    - name: "GCC modules (main-softmmu)"
      env:
        - CONFIG="--enable-modules --target-list=${MAIN_SOFTMMU_TARGETS}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
    # Alternate coroutines implementations are only really of interest to KVM users
    # However we can't test against KVM on Travis so we can only run unit tests
    - name: "check-unit coroutine=ucontext"
      env:
        - CONFIG="--with-coroutine=ucontext --disable-tcg"
        - TEST_CMD="make check-unit -j${JOBS} V=1"
    - name: "check-unit coroutine=sigaltstack"
      env:
        - CONFIG="--with-coroutine=sigaltstack --disable-tcg"
        - TEST_CMD="make check-unit -j${JOBS} V=1"
    # Check we can build docs and tools (out of tree)
    - name: "tools and docs (bionic)"
      dist: bionic
      env:
        - BUILD_DIR="out-of-tree/build/dir" SRC_DIR="../../.."
        - BASE_CONFIG="--enable-tools --enable-docs"
        - CONFIG="--target-list=x86_64-softmmu,aarch64-linux-user"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
      addons:
        apt:
          packages:
            - python3-sphinx
            - texinfo
            - perl
    # Test with Clang for compile portability (Travis uses clang-5.0)
    - name: "Clang (user)"
      env:
        - CONFIG="--disable-system --host-cc=clang --cxx=clang++"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-clang-default"
      compiler: clang
    - name: "Clang (main-softmmu)"
      env:
        - CONFIG="--target-list=${MAIN_SOFTMMU_TARGETS}
                  --host-cc=clang --cxx=clang++"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-clang-sanitize"
      compiler: clang
      before_script:
        - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
        - ${SRC_DIR}/configure ${CONFIG} --extra-cflags="-fsanitize=undefined -Werror" || { cat config.log && exit 1; }
    - name: "Clang (other-softmmu)"
      env:
        - CONFIG="--disable-user --target-list-exclude=${MAIN_SOFTMMU_TARGETS}
                  --host-cc=clang --cxx=clang++"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-clang-default"
      compiler: clang
    # gprof/gcov are GCC features
    - name: "GCC gprof/gcov"
      env:
        - CONFIG="--enable-gprof --enable-gcov --disable-pie --target-list=${MAIN_SOFTMMU_TARGETS}"
      after_success:
        - ${SRC_DIR}/scripts/travis/coverage-summary.sh
    # We manually include builds which we disable "make check" for
    - name: "GCC without-default-devices (softmmu)"
      env:
        - CONFIG="--without-default-devices --disable-user"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
        - TEST_CMD=""
    # Check the TCG interpreter (TCI)
    - name: "GCC TCI"
      env:
        - CONFIG="--enable-debug-tcg --enable-tcg-interpreter --disable-kvm --disable-containers
            --target-list=alpha-softmmu,arm-softmmu,hppa-softmmu,m68k-softmmu,microblaze-softmmu,moxie-softmmu,ppc-softmmu,s390x-softmmu,x86_64-softmmu"
        - TEST_CMD="make check-qtest check-tcg V=1"
    # We don't need to exercise every backend with every front-end
    - name: "GCC trace log,simple,syslog (user)"
      env:
        - CONFIG="--enable-trace-backends=log,simple,syslog --disable-system"
        - TEST_CMD=""
    - name: "GCC trace ftrace (x86_64-softmmu)"
      env:
        - CONFIG="--enable-trace-backends=ftrace --target-list=x86_64-softmmu"
        - TEST_CMD=""
    - name: "GCC trace ust (x86_64-softmmu)"
      env:
        - CONFIG="--enable-trace-backends=ust --target-list=x86_64-softmmu"
        - TEST_CMD=""
    # Python builds
    - name: "GCC Python 3.5 (x86_64-softmmu)"
      env:
        - CONFIG="--target-list=x86_64-softmmu"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
      language: python
      python: 3.5
    - name: "GCC Python 3.6 (x86_64-softmmu)"
      env:
        - CONFIG="--target-list=x86_64-softmmu"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
      language: python
      python: 3.6
    # Using newer GCC with sanitizers
    - name: "GCC9 with sanitizers (softmmu)"
      addons:
        apt:
          update: true
          sources:
            # PPAs for newer toolchains
            - ubuntu-toolchain-r-test
          packages:
            # Extra toolchains
            - gcc-9
            - g++-9
            # Build dependencies
            - libaio-dev
            - libattr1-dev
            - libbrlapi-dev
            - libcap-ng-dev
            - libgnutls-dev
            - libgtk-3-dev
            - libiscsi-dev
            - liblttng-ust-dev
            - libnfs-dev
            - libncurses5-dev
            - libnss3-dev
            - libpixman-1-dev
            - libpng12-dev
            - librados-dev
            - libsdl2-dev
            - libsdl2-image-dev
            - libseccomp-dev
            - libspice-protocol-dev
            - libspice-server-dev
            - libssh-dev
            - liburcu-dev
            - libusb-1.0-0-dev
            - libvte-2.91-dev
            - sparse
            - uuid-dev
      language: generic
      compiler: none
      env:
        - COMPILER_NAME=gcc CXX=g++-9 CC=gcc-9
        - CONFIG="--cc=gcc-9 --cxx=g++-9 --disable-pie --disable-linux-user"
        - TEST_CMD=""
      before_script:
        - mkdir -p ${BUILD_DIR} && cd ${BUILD_DIR}
        - ${SRC_DIR}/configure ${CONFIG} --extra-cflags="-g3 -O0 -Wno-error=stringop-truncation -fsanitize=thread" --extra-ldflags="-fuse-ld=gold" || { cat config.log && exit 1; }
    # Run check-tcg against linux-user
    - name: "GCC check-tcg (user)"
      env:
        - CONFIG="--disable-system --enable-debug-tcg"
        - TEST_BUILD_CMD="make build-tcg"
        - TEST_CMD="make check-tcg"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug-tcg"
    # Run check-tcg against linux-user (with plugins)
    # we skip sparc64-linux-user until it has been fixed somewhat
    # we skip cris-linux-user as it doesn't use the common run loop
    # we skip ppc64abi32-linux-user as it seems to have a broken libc
    - name: "GCC plugins check-tcg (user)"
      env:
        - CONFIG="--disable-system --enable-plugins --enable-debug-tcg --target-list-exclude=sparc64-linux-user,cris-linux-user,ppc64abi32-linux-user"
        - TEST_BUILD_CMD="make build-tcg"
        - TEST_CMD="make check-tcg"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug-tcg"
    # Run check-tcg against softmmu targets
    - name: "GCC check-tcg (some-softmmu)"
      env:
        - CONFIG="--enable-debug-tcg --target-list=xtensa-softmmu,arm-softmmu,aarch64-softmmu,alpha-softmmu"
        - TEST_BUILD_CMD="make build-tcg"
        - TEST_CMD="make check-tcg"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug-tcg"
    # Run check-tcg against softmmu targets (with plugins)
    - name: "GCC plugins check-tcg (some-softmmu)"
      env:
        - CONFIG="--enable-plugins --enable-debug-tcg --target-list=xtensa-softmmu,arm-softmmu,aarch64-softmmu,alpha-softmmu"
        - TEST_BUILD_CMD="make build-tcg"
        - TEST_CMD="make check-tcg"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-debug-tcg"
    - name: "[aarch64] GCC check-tcg"
      arch: arm64
      dist: xenial
      addons:
        apt_packages:
          - libaio-dev
          - libattr1-dev
          - libbrlapi-dev
          - libcap-ng-dev
          - libgcrypt20-dev
          - libgnutls28-dev
          - libgtk-3-dev
          - libiscsi-dev
          - liblttng-ust-dev
          - libncurses5-dev
          - libnfs-dev
          - libnss3-dev
          - libpixman-1-dev
          - libpng-dev
          - librados-dev
          - libsdl2-dev
          - libseccomp-dev
          - liburcu-dev
          - libusb-1.0-0-dev
          - libvdeplug-dev
          - libvte-2.91-dev
          # Tests dependencies
          - genisoimage
      env:
        - TEST_CMD="make check check-tcg V=1"
        - CONFIG="--disable-containers --target-list=${MAIN_SOFTMMU_TARGETS}"
        - UNRELIABLE=true
    - name: "[ppc64] GCC check-tcg"
      arch: ppc64le
      dist: xenial
      addons:
        apt_packages:
          - libaio-dev
          - libattr1-dev
          - libbrlapi-dev
          - libcap-ng-dev
          - libgcrypt20-dev
          - libgnutls28-dev
          - libgtk-3-dev
          - libiscsi-dev
          - liblttng-ust-dev
          - libncurses5-dev
          - libnfs-dev
          - libnss3-dev
          - libpixman-1-dev
          - libpng-dev
          - librados-dev
          - libsdl2-dev
          - libseccomp-dev
          - liburcu-dev
          - libusb-1.0-0-dev
          - libvdeplug-dev
          - libvte-2.91-dev
          # Tests dependencies
          - genisoimage
      env:
        - TEST_CMD="make check check-tcg V=1"
        - CONFIG="--disable-containers --target-list=ppc64-softmmu,ppc64le-linux-user"
    - name: "[s390x] GCC check-tcg"
      arch: s390x
      dist: bionic
      addons:
        apt_packages:
          - libaio-dev
          - libattr1-dev
          - libbrlapi-dev
          - libcap-ng-dev
          - libgcrypt20-dev
          - libgnutls28-dev
          - libgtk-3-dev
          - libiscsi-dev
          - liblttng-ust-dev
          - libncurses5-dev
          - libnfs-dev
          - libnss3-dev
          - libpixman-1-dev
          - libpng-dev
          - librados-dev
          - libsdl2-dev
          - libseccomp-dev
          - liburcu-dev
          - libusb-1.0-0-dev
          - libvdeplug-dev
          - libvte-2.91-dev
          # Tests dependencies
          - genisoimage
      env:
        - TEST_CMD="make check check-tcg V=1"
        - CONFIG="--disable-containers --target-list=${MAIN_SOFTMMU_TARGETS},s390x-linux-user"
        - UNRELIABLE=true
      script:
        - BUILD_RC=0 && make -j${JOBS} || BUILD_RC=$?
        - |
          if [ "$BUILD_RC" -eq 0 ] ; then
              mv pc-bios/s390-ccw/*.img pc-bios/ ;
              ${TEST_CMD} ;
          else
              $(exit $BUILD_RC);
          fi
    - name: "[s390x] GCC (other-softmmu)"
      arch: s390x
      dist: bionic
      addons:
        apt_packages:
          - libaio-dev
          - libattr1-dev
          - libcap-ng-dev
          - libgnutls28-dev
          - libiscsi-dev
          - liblttng-ust-dev
          - liblzo2-dev
          - libncurses-dev
          - libnfs-dev
          - libnss3-dev
          - libpixman-1-dev
          - libsdl2-dev
          - libsdl2-image-dev
          - libseccomp-dev
          - libsnappy-dev
          - libzstd-dev
          - nettle-dev
          - xfslibs-dev
          # Tests dependencies
          - genisoimage
      env:
        - CONFIG="--disable-containers --audio-drv-list=sdl --disable-user
                  --target-list-exclude=${MAIN_SOFTMMU_TARGETS}"
    - name: "[s390x] GCC (user)"
      arch: s390x
      dist: bionic
      addons:
        apt_packages:
          - libgcrypt20-dev
          - libgnutls28-dev
      env:
        - CONFIG="--disable-containers --disable-system"
    - name: "[s390x] Clang (disable-tcg)"
      arch: s390x
      dist: bionic
      compiler: clang
      addons:
        apt_packages:
          - libaio-dev
          - libattr1-dev
          - libbrlapi-dev
          - libcap-ng-dev
          - libgcrypt20-dev
          - libgnutls28-dev
          - libgtk-3-dev
          - libiscsi-dev
          - liblttng-ust-dev
          - libncurses5-dev
          - libnfs-dev
          - libnss3-dev
          - libpixman-1-dev
          - libpng-dev
          - librados-dev
          - libsdl2-dev
          - libseccomp-dev
          - liburcu-dev
          - libusb-1.0-0-dev
          - libvdeplug-dev
          - libvte-2.91-dev
      env:
        - TEST_CMD="make check-unit"
        - CONFIG="--disable-containers --disable-tcg --enable-kvm
                  --disable-tools --host-cc=clang --cxx=clang++"
        - UNRELIABLE=true
    # Release builds
    # The make-release script expect a QEMU version, so our tag must start with a 'v'.
    # This is the case when release candidate tags are created.
    - name: "Release tarball"
      if: tag IS present AND tag =~ /^v\d+\.\d+(\.\d+)?(-\S*)?$/
      env:
        # We want to build from the release tarball
        - BUILD_DIR="release/build/dir" SRC_DIR="../../.."
        - BASE_CONFIG="--prefix=$PWD/dist"
        - CONFIG="--target-list=x86_64-softmmu,aarch64-softmmu,armeb-linux-user,ppc-linux-user"
        - TEST_CMD="make install -j${JOBS}"
        - QEMU_VERSION="${TRAVIS_TAG:1}"
        - CACHE_NAME="${TRAVIS_BRANCH}-linux-gcc-default"
      script:
        - make -C ${SRC_DIR} qemu-${QEMU_VERSION}.tar.bz2
        - ls -l ${SRC_DIR}/qemu-${QEMU_VERSION}.tar.bz2
        - tar -xf ${SRC_DIR}/qemu-${QEMU_VERSION}.tar.bz2 && cd qemu-${QEMU_VERSION}
        - mkdir -p release-build && cd release-build
        - ../configure ${BASE_CONFIG} ${CONFIG} || { cat config.log && exit 1; }
        - make install
  allow_failures:
    - env: UNRELIABLE=true
--- a/78
+++ b/78
@@ -0,0 +1,78 @@
 Qemu Coding Style
 =================
 1. Whitespace
 Of course, the most important aspect in any coding style is whitespace.
 Crusty old coders who have trouble spotting the glasses on their noses
 can tell the difference between a tab and eight spaces from a distance
 of approximately fifteen parsecs.  Many a flamewar have been fought and
 lost on this issue.
 QEMU indents are four spaces.  Tabs are never used, except in Makefiles
 where they have been irreversibly coded into the syntax.
 Spaces of course are superior to tabs because:
 - You have just one way to specify whitespace, not two.  Ambiguity breeds
   mistakes.
 - The confusion surrounding 'use tabs to indent, spaces to justify' is gone.
 - Tab indents push your code to the right, making your screen seriously
   unbalanced.
 - Tabs will be rendered incorrectly on editors who are misconfigured not
   to use tab stops of eight positions.
 - Tabs are rendered badly in patches, causing off-by-one errors in almost
   every line.
 - It is the QEMU coding style.
 Do not leave whitespace dangling off the ends of lines.
 2. Line width
 Lines are 80 characters; not longer.
 Rationale:
 - Some people like to tile their 24" screens with a 6x4 matrix of 80x24
   xterms and use vi in all of them.  The best way to punish them is to
   let them keep doing it.
 - Code and especially patches is much more readable if limited to a sane
   line length.  Eighty is traditional.
 - It is the QEMU coding style.
 3. Naming
 Variables are lower_case_with_underscores; easy to type and read.  Structured
 type names are in CamelCase; harder to type but standing out.  Scalar type
 names are lower_case_with_underscores_ending_with_a_t, like the POSIX
 uint64_t and family.  Note that this last convention contradicts POSIX
 and is therefore likely to be changed.
 Typedefs are used to eliminate the redundant 'struct' keyword.  It is the
 QEMU coding style.
 4. Block structure
 Every indented statement is braced; even if the block contains just one
 statement.  The opening brace is on the line that contains the control
 flow statement that introduces the new block; the closing brace is on the
 same line as the else keyword, or on a line by itself if there is no else
 keyword.  Example:
    if (a == 5) {
        printf("a was 5.\n");
    } else if (a == 6) {
        printf("a was 6.\n");
    } else {
        printf("a was something else entirely.\n");
    }
 An exception is the opening brace for a function; for reasons of tradition
 and clarity it comes on a line by itself:
    void a_function(void)
    {
        do_something();
    }
 Rationale: a consistent (except for functions...) bracing style reduces
 ambiguity and avoids needless churn when lines are added or removed.
 Furthermore, it is the QEMU coding style.
--- a/CODING_STYLE.rst
+++ b/CODING_STYLE.rst
@@ -1,641 +0,0 @@
 =================
 QEMU Coding Style
 =================
 .. contents:: Table of Contents
 Please use the script checkpatch.pl in the scripts directory to check
 patches before submitting.
 Formatting and style
 ********************
 Whitespace
 ==========
 Of course, the most important aspect in any coding style is whitespace.
 Crusty old coders who have trouble spotting the glasses on their noses
 can tell the difference between a tab and eight spaces from a distance
 of approximately fifteen parsecs.  Many a flamewar has been fought and
 lost on this issue.
 QEMU indents are four spaces.  Tabs are never used, except in Makefiles
 where they have been irreversibly coded into the syntax.
 Spaces of course are superior to tabs because:
 * You have just one way to specify whitespace, not two.  Ambiguity breeds
  mistakes.
 * The confusion surrounding 'use tabs to indent, spaces to justify' is gone.
 * Tab indents push your code to the right, making your screen seriously
  unbalanced.
 * Tabs will be rendered incorrectly on editors who are misconfigured not
  to use tab stops of eight positions.
 * Tabs are rendered badly in patches, causing off-by-one errors in almost
  every line.
 * It is the QEMU coding style.
 Do not leave whitespace dangling off the ends of lines.
 Multiline Indent
 ----------------
 There are several places where indent is necessary:
 * if/else
 * while/for
 * function definition & call
 When breaking up a long line to fit within line width, we need a proper indent
 for the following lines.
 In case of if/else, while/for, align the secondary lines just after the
 opening parenthesis of the first.
 For example:
 .. code-block:: c
    if (a == 1 &&
        b == 2) {
    while (a == 1 &&
           b == 2) {
 In case of function, there are several variants:
 * 4 spaces indent from the beginning
 * align the secondary lines just after the opening parenthesis of the first
 For example:
 .. code-block:: c
    do_something(x, y,
        z);
    do_something(x, y,
                 z);
    do_something(x, do_another(y,
                               z));
 Line width
 ==========
 Lines should be 80 characters; try not to make them longer.
 Sometimes it is hard to do, especially when dealing with QEMU subsystems
 that use long function or symbol names.  Even in that case, do not make
 lines much longer than 80 characters.
 Rationale:
 * Some people like to tile their 24" screens with a 6x4 matrix of 80x24
  xterms and use vi in all of them.  The best way to punish them is to
  let them keep doing it.
 * Code and especially patches is much more readable if limited to a sane
  line length.  Eighty is traditional.
 * The four-space indentation makes the most common excuse ("But look
  at all that white space on the left!") moot.
 * It is the QEMU coding style.
 Naming
 ======
 Variables are lower_case_with_underscores; easy to type and read.  Structured
 type names are in CamelCase; harder to type but standing out.  Enum type
 names and function type names should also be in CamelCase.  Scalar type
 names are lower_case_with_underscores_ending_with_a_t, like the POSIX
 uint64_t and family.  Note that this last convention contradicts POSIX
 and is therefore likely to be changed.
 When wrapping standard library functions, use the prefix ``qemu_`` to alert
 readers that they are seeing a wrapped version; otherwise avoid this prefix.
 Block structure
 ===============
 Every indented statement is braced; even if the block contains just one
 statement.  The opening brace is on the line that contains the control
 flow statement that introduces the new block; the closing brace is on the
 same line as the else keyword, or on a line by itself if there is no else
 keyword.  Example:
 .. code-block:: c
    if (a == 5) {
        printf("a was 5.\n");
    } else if (a == 6) {
        printf("a was 6.\n");
    } else {
        printf("a was something else entirely.\n");
    }
 Note that 'else if' is considered a single statement; otherwise a long if/
 else if/else if/.../else sequence would need an indent for every else
 statement.
 An exception is the opening brace for a function; for reasons of tradition
 and clarity it comes on a line by itself:
 .. code-block:: c
    void a_function(void)
    {
        do_something();
    }
 Rationale: a consistent (except for functions...) bracing style reduces
 ambiguity and avoids needless churn when lines are added or removed.
 Furthermore, it is the QEMU coding style.
 Declarations
 ============
 Mixed declarations (interleaving statements and declarations within
 blocks) are generally not allowed; declarations should be at the beginning
 of blocks.
 Every now and then, an exception is made for declarations inside a
 #ifdef or #ifndef block: if the code looks nicer, such declarations can
 be placed at the top of the block even if there are statements above.
 On the other hand, however, it's often best to move that #ifdef/#ifndef
 block to a separate function altogether.
 Conditional statements
 ======================
 When comparing a variable for (in)equality with a constant, list the
 constant on the right, as in:
 .. code-block:: c
    if (a == 1) {
        /* Reads like: "If a equals 1" */
        do_something();
    }
 Rationale: Yoda conditions (as in 'if (1 == a)') are awkward to read.
 Besides, good compilers already warn users when '==' is mis-typed as '=',
 even when the constant is on the right.
 Comment style
 =============
 We use traditional C-style /``*`` ``*``/ comments and avoid // comments.
 Rationale: The // form is valid in C99, so this is purely a matter of
 consistency of style. The checkpatch script will warn you about this.
 Multiline comment blocks should have a row of stars on the left,
 and the initial /``*`` and terminating ``*``/ both on their own lines:
 .. code-block:: c
    /*
     * like
     * this
     */
 This is the same format required by the Linux kernel coding style.
 (Some of the existing comments in the codebase use the GNU Coding
 Standards form which does not have stars on the left, or other
 variations; avoid these when writing new comments, but don't worry
 about converting to the preferred form unless you're editing that
 comment anyway.)
 Rationale: Consistency, and ease of visually picking out a multiline
 comment from the surrounding code.
 Language usage
 **************
 Preprocessor
 ============
 Variadic macros
 ---------------
 For variadic macros, stick with this C99-like syntax:
 .. code-block:: c
    #define DPRINTF(fmt, ...)                                       \
        do { printf("IRQ: " fmt, ## __VA_ARGS__); } while (0)
 Include directives
 ------------------
 Order include directives as follows:
 .. code-block:: c
    #include "qemu/osdep.h"  /* Always first... */
    #include <...>           /* then system headers... */
    #include "..."           /* and finally QEMU headers. */
 The "qemu/osdep.h" header contains preprocessor macros that affect the behavior
 of core system headers like <stdint.h>.  It must be the first include so that
 core system headers included by external libraries get the preprocessor macros
 that QEMU depends on.
 Do not include "qemu/osdep.h" from header files since the .c file will have
 already included it.
 C types
 =======
 It should be common sense to use the right type, but we have collected
 a few useful guidelines here.
 Scalars
 -------
 If you're using "int" or "long", odds are good that there's a better type.
 If a variable is counting something, it should be declared with an
 unsigned type.
 If it's host memory-size related, size_t should be a good choice (use
 ssize_t only if required). Guest RAM memory offsets must use ram_addr_t,
 but only for RAM, it may not cover whole guest address space.
 If it's file-size related, use off_t.
 If it's file-offset related (i.e., signed), use off_t.
 If it's just counting small numbers use "unsigned int";
 (on all but oddball embedded systems, you can assume that that
 type is at least four bytes wide).
 In the event that you require a specific width, use a standard type
 like int32_t, uint32_t, uint64_t, etc.  The specific types are
 mandatory for VMState fields.
 Don't use Linux kernel internal types like u32, __u32 or __le32.
 Use hwaddr for guest physical addresses except pcibus_t
 for PCI addresses.  In addition, ram_addr_t is a QEMU internal address
 space that maps guest RAM physical addresses into an intermediate
 address space that can map to host virtual address spaces.  Generally
 speaking, the size of guest memory can always fit into ram_addr_t but
 it would not be correct to store an actual guest physical address in a
 ram_addr_t.
 For CPU virtual addresses there are several possible types.
 vaddr is the best type to use to hold a CPU virtual address in
 target-independent code. It is guaranteed to be large enough to hold a
 virtual address for any target, and it does not change size from target
 to target. It is always unsigned.
 target_ulong is a type the size of a virtual address on the CPU; this means
 it may be 32 or 64 bits depending on which target is being built. It should
 therefore be used only in target-specific code, and in some
 performance-critical built-per-target core code such as the TLB code.
 There is also a signed version, target_long.
 abi_ulong is for the ``*``-user targets, and represents a type the size of
 'void ``*``' in that target's ABI. (This may not be the same as the size of a
 full CPU virtual address in the case of target ABIs which use 32 bit pointers
 on 64 bit CPUs, like sparc32plus.) Definitions of structures that must match
 the target's ABI must use this type for anything that on the target is defined
 to be an 'unsigned long' or a pointer type.
 There is also a signed version, abi_long.
 Of course, take all of the above with a grain of salt.  If you're about
 to use some system interface that requires a type like size_t, pid_t or
 off_t, use matching types for any corresponding variables.
 Also, if you try to use e.g., "unsigned int" as a type, and that
 conflicts with the signedness of a related variable, sometimes
 it's best just to use the *wrong* type, if "pulling the thread"
 and fixing all related variables would be too invasive.
 Finally, while using descriptive types is important, be careful not to
 go overboard.  If whatever you're doing causes warnings, or requires
 casts, then reconsider or ask for help.
 Pointers
 --------
 Ensure that all of your pointers are "const-correct".
 Unless a pointer is used to modify the pointed-to storage,
 give it the "const" attribute.  That way, the reader knows
 up-front that this is a read-only pointer.  Perhaps more
 importantly, if we're diligent about this, when you see a non-const
 pointer, you're guaranteed that it is used to modify the storage
 it points to, or it is aliased to another pointer that is.
 Typedefs
 --------
 Typedefs are used to eliminate the redundant 'struct' keyword, since type
 names have a different style than other identifiers ("CamelCase" versus
 "snake_case").  Each named struct type should have a CamelCase name and a
 corresponding typedef.
 Since certain C compilers choke on duplicated typedefs, you should avoid
 them and declare a typedef only in one header file.  For common types,
 you can use "include/qemu/typedefs.h" for example.  However, as a matter
 of convenience it is also perfectly fine to use forward struct
 definitions instead of typedefs in headers and function prototypes; this
 avoids problems with duplicated typedefs and reduces the need to include
 headers from other headers.
 Reserved namespaces in C and POSIX
 ----------------------------------
 Underscore capital, double underscore, and underscore 't' suffixes should be
 avoided.
 Low level memory management
 ===========================
 Use of the malloc/free/realloc/calloc/valloc/memalign/posix_memalign
 APIs is not allowed in the QEMU codebase. Instead of these routines,
 use the GLib memory allocation routines g_malloc/g_malloc0/g_new/
 g_new0/g_realloc/g_free or QEMU's qemu_memalign/qemu_blockalign/qemu_vfree
 APIs.
 Please note that g_malloc will exit on allocation failure, so there
 is no need to test for failure (as you would have to with malloc).
 Calling g_malloc with a zero size is valid and will return NULL.
 Prefer g_new(T, n) instead of g_malloc(sizeof(T) ``*`` n) for the following
 reasons:
 * It catches multiplication overflowing size_t;
 * It returns T ``*`` instead of void ``*``, letting compiler catch more type errors.
 Declarations like
 .. code-block:: c
    T *v = g_malloc(sizeof(*v))
 are acceptable, though.
 Memory allocated by qemu_memalign or qemu_blockalign must be freed with
 qemu_vfree, since breaking this will cause problems on Win32.
 String manipulation
 ===================
 Do not use the strncpy function.  As mentioned in the man page, it does *not*
 guarantee a NULL-terminated buffer, which makes it extremely dangerous to use.
 It also zeros trailing destination bytes out to the specified length.  Instead,
 use this similar function when possible, but note its different signature:
 .. code-block:: c
    void pstrcpy(char *dest, int dest_buf_size, const char *src)
 Don't use strcat because it can't check for buffer overflows, but:
 .. code-block:: c
    char *pstrcat(char *buf, int buf_size, const char *s)
 The same limitation exists with sprintf and vsprintf, so use snprintf and
 vsnprintf.
 QEMU provides other useful string functions:
 .. code-block:: c
    int strstart(const char *str, const char *val, const char **ptr)
    int stristart(const char *str, const char *val, const char **ptr)
    int qemu_strnlen(const char *s, int max_len)
 There are also replacement character processing macros for isxyz and toxyz,
 so instead of e.g. isalnum you should use qemu_isalnum.
 Because of the memory management rules, you must use g_strdup/g_strndup
 instead of plain strdup/strndup.
 Printf-style functions
 ======================
 Whenever you add a new printf-style function, i.e., one with a format
 string argument and following "..." in its prototype, be sure to use
 gcc's printf attribute directive in the prototype.
 This makes it so gcc's -Wformat and -Wformat-security options can do
 their jobs and cross-check format strings with the number and types
 of arguments.
 C standard, implementation defined and undefined behaviors
 ==========================================================
 C code in QEMU should be written to the C99 language specification. A copy
 of the final version of the C99 standard with corrigenda TC1, TC2, and TC3
 included, formatted as a draft, can be downloaded from:
    `<http://www.open-std.org/jtc1/sc22/WG14/www/docs/n1256.pdf>`_
 The C language specification defines regions of undefined behavior and
 implementation defined behavior (to give compiler authors enough leeway to
 produce better code).  In general, code in QEMU should follow the language
 specification and avoid both undefined and implementation defined
 constructs. ("It works fine on the gcc I tested it with" is not a valid
 argument...) However there are a few areas where we allow ourselves to
 assume certain behaviors because in practice all the platforms we care about
 behave in the same way and writing strictly conformant code would be
 painful. These are:
 * you may assume that integers are 2s complement representation
 * you may assume that right shift of a signed integer duplicates
  the sign bit (ie it is an arithmetic shift, not a logical shift)
 In addition, QEMU assumes that the compiler does not use the latitude
 given in C99 and C11 to treat aspects of signed '<<' as undefined, as
 documented in the GNU Compiler Collection manual starting at version 4.0.
 Automatic memory deallocation
 =============================
 QEMU has a mandatory dependency either the GCC or CLang compiler. As
 such it has the freedom to make use of a C language extension for
 automatically running a cleanup function when a stack variable goes
 out of scope. This can be used to simplify function cleanup paths,
 often allowing many goto jumps to be eliminated, through automatic
 free'ing of memory.
 The GLib2 library provides a number of functions/macros for enabling
 automatic cleanup:
  `<https://developer.gnome.org/glib/stable/glib-Miscellaneous-Macros.html>`_
 Most notably:
 * g_autofree - will invoke g_free() on the variable going out of scope
 * g_autoptr - for structs / objects, will invoke the cleanup func created
  by a previous use of G_DEFINE_AUTOPTR_CLEANUP_FUNC. This is
  supported for most GLib data types and GObjects
 For example, instead of
 .. code-block:: c
    int somefunc(void) {
        int ret = -1;
        char *foo = g_strdup_printf("foo%", "wibble");
        GList *bar = .....
        if (eek) {
           goto cleanup;
        }
        ret = 0;
      cleanup:
        g_free(foo);
        g_list_free(bar);
        return ret;
    }
 Using g_autofree/g_autoptr enables the code to be written as:
 .. code-block:: c
    int somefunc(void) {
        g_autofree char *foo = g_strdup_printf("foo%", "wibble");
        g_autoptr (GList) bar = .....
        if (eek) {
           return -1;
        }
        return 0;
    }
 While this generally results in simpler, less leak-prone code, there
 are still some caveats to beware of
 * Variables declared with g_auto* MUST always be initialized,
  otherwise the cleanup function will use uninitialized stack memory
 * If a variable declared with g_auto* holds a value which must
  live beyond the life of the function, that value must be saved
  and the original variable NULL'd out. This can be simpler using
  g_steal_pointer
 .. code-block:: c
    char *somefunc(void) {
        g_autofree char *foo = g_strdup_printf("foo%", "wibble");
        g_autoptr (GList) bar = .....
        if (eek) {
           return NULL;
        }
        return g_steal_pointer(&foo);
    }
 QEMU Specific Idioms
 ********************
 Error handling and reporting
 ============================
 Reporting errors to the human user
 ----------------------------------
 Do not use printf(), fprintf() or monitor_printf().  Instead, use
 error_report() or error_vreport() from error-report.h.  This ensures the
 error is reported in the right place (current monitor or stderr), and in
 a uniform format.
 Use error_printf() & friends to print additional information.
 error_report() prints the current location.  In certain common cases
 like command line parsing, the current location is tracked
 automatically.  To manipulate it manually, use the loc_``*``() from
 error-report.h.
 Propagating errors
 ------------------
 An error can't always be reported to the user right where it's detected,
 but often needs to be propagated up the call chain to a place that can
 handle it.  This can be done in various ways.
 The most flexible one is Error objects.  See error.h for usage
 information.
 Use the simplest suitable method to communicate success / failure to
 callers.  Stick to common methods: non-negative on success / -1 on
 error, non-negative / -errno, non-null / null, or Error objects.
 Example: when a function returns a non-null pointer on success, and it
 can fail only in one way (as far as the caller is concerned), returning
 null on failure is just fine, and certainly simpler and a lot easier on
 the eyes than propagating an Error object through an Error ``*````*`` parameter.
 Example: when a function's callers need to report details on failure
 only the function really knows, use Error ``*````*``, and set suitable errors.
 Do not report an error to the user when you're also returning an error
 for somebody else to handle.  Leave the reporting to the place that
 consumes the error returned.
 Handling errors
 ---------------
 Calling exit() is fine when handling configuration errors during
 startup.  It's problematic during normal operation.  In particular,
 monitor commands should never exit().
 Do not call exit() or abort() to handle an error that can be triggered
 by the guest (e.g., some unimplemented corner case in guest code
 translation or device emulation).  Guests should not be able to
 terminate QEMU.
 Note that &error_fatal is just another way to exit(1), and &error_abort
 is just another way to abort().
 trace-events style
 ==================
 0x prefix
 ---------
 In trace-events files, use a '0x' prefix to specify hex numbers, as in:
 .. code-block::
    some_trace(unsigned x, uint64_t y) "x 0x%x y 0x" PRIx64
 An exception is made for groups of numbers that are hexadecimal by
 convention and separated by the symbols '.', '/', ':', or ' ' (such as
 PCI bus id):
 .. code-block::
    another_trace(int cssid, int ssid, int dev_num) "bus id: %x.%x.%04x"
 However, you can use '0x' for such groups if you want. Anyway, be sure that
 it is obvious that numbers are in hex, ex.:
 .. code-block::
    data_dump(uint8_t c1, uint8_t c2, uint8_t c3) "bytes (in hex): %02x %02x %02x"
 Rationale: hex numbers are hard to read in logs when there is no 0x prefix,
 especially when (occasionally) the representation doesn't contain any letters
 and especially in one line with other decimal numbers. Number groups are allowed
 to not use '0x' because for some things notations like %x.%x.%x are used not
 only in Qemu. Also dumping raw data bytes with '0x' is less readable.
 '#' printf flag
 ---------------
 Do not use printf flag '#', like '%#x'.
 Rationale: there are two ways to add a '0x' prefix to printed number: '0x%...'
 and '%#...'. For consistency the only one way should be used. Arguments for
 '0x%' are:
 * it is more popular
 * '%#' omits the 0x for the value 0 which makes output inconsistent
--- a/COPYING.LIB
+++ b/COPYING.LIB
@@ -1,8 +1,8 @@
-                  GNU LESSER GENERAL PUBLIC LICENSE
+		  GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 2.1, February 1999
+		       Version 2.1, February 1999
 Copyright (C) 1991, 1999 Free Software Foundation, Inc.
- 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+	51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
@@ -10,7 +10,7 @@
 as the successor of the GNU Library Public License, version 2, hence
 the version number 2.1.]
-                            Preamble
+			    Preamble
  The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -112,7 +112,7 @@ modification follow.  Pay close attention to the difference between a
 former contains code derived from the library, whereas the latter must
 be combined with the library in order to run.
-                  GNU LESSER GENERAL PUBLIC LICENSE
+		  GNU LESSER GENERAL PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
  0. This License Agreement applies to any software library or other
@@ -146,7 +146,7 @@ such a program is covered only if its contents constitute a work based
 on the Library (independent of the use of the Library in a tool for
 writing it).  Whether that is true depends on what the Library does
 and what the program that uses the Library does.
-
+  
  1. You may copy and distribute verbatim copies of the Library's
 complete source code as you receive it, in any medium, provided that
 you conspicuously and appropriately publish on each copy an
@@ -432,7 +432,7 @@ decision will be guided by the two goals of preserving the free status
 of all derivatives of our free software and of promoting the sharing
 and reuse of software generally.
-                            NO WARRANTY
+			    NO WARRANTY
  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
 WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
@@ -455,7 +455,7 @@ FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
 SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
 DAMAGES.
-                     END OF TERMS AND CONDITIONS
+		     END OF TERMS AND CONDITIONS
           How to Apply These Terms to Your New Libraries
@@ -476,7 +476,7 @@ convey the exclusion of warranty; and each file should have at least the
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
-    version 2.1 of the License, or (at your option) any later version.
+    version 2 of the License, or (at your option) any later version.
    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -485,7 +485,7 @@ convey the exclusion of warranty; and each file should have at least the
    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 Also add information on how to contact you by electronic and paper mail.
@@ -500,3 +500,5 @@ necessary.  Here is a sample; alter the names:
  Ty Coon, President of Vice
 That's all there is to it!
--- a/197
+++ b/197
@@ -1,8 +1,189 @@
-This file documents changes for QEMU releases 0.12 and earlier.
+version 0.12.5
-For changelog information for later releases, see
+ - audio/alsa: Handle SND_PCM_STATE_SETUP in alsa_poll_handler
-https://wiki.qemu.org/ChangeLog or look at the git history for
+ - block: Handle multiwrite errors only when all requests have completed
-more detailed information.
+ - block: Fix early failure in multiwrite
 - vpc: Use bdrv_(p)write_sync for metadata writes
 - vmdk: Use bdrv_(p)write_sync for metadata writes
 - qcow2: Use bdrv_(p)write_sync for metadata writes
 - qcow: Use bdrv_(p)write_sync for metadata writes
 - block: Add bdrv_(p)write_sync
 - qcow2: Restore L1 entry on l2_allocate failure
 - block/vdi: Fix image opening and creation for odd disk sizes
 - block/vpc: Fix conversion from size to disk geometry
 - qcow2: Remove abort on free_clusters failure
 - vmdk: Fix COW
 - qcow2: Fix creation of large images
 - vmdk: fix double free
 - qemu-options: add documentation for stdio signal=on|off
 - target-arm : fix parallel saturated subtraction implementation
 - target-arm : fix thumb2 parallel add/sub opcode decoding
 - target-arm: fix addsub/subadd implementation
 - target-i386: fix xchg rax,r8
 - block/vvfat.c: fix warnings with _FORTIFY_SOURCE
 - audio/alsa: Spelling typo (paramters)
 - target-mips: fix DINSU instruction
 - Correct definitions for FD_CMD_SAVE and FD_CMD_RESTORE
 - qcow2: Fix corruption after error in update_refcount
 - qcow2: Fix corruption after refblock allocation
 - block: Fix multiwrite with overlapping requests
 - qcow2: Fix error handling in l2_allocate
 - qcow2: Clear L2 table cache after write error
 - ide: Fix ide_dma_cancel
 - usb-bus: fix no params
 - Avoid crash on '-usbdevice <device>' without parameters
 - Fix -usbdevice crash
 - Fix multiboot compilation
 - Fix missing symbols in .rel/.rela.plt sections
 - target-ppc: fix RFI by clearing some bits of MSR
 - Fix typo in balloon help
 - arm_timer: fix oneshot mode
 - arm_timer: reload timer when enabled
 - qemu-sockets: avoid strlen of NULL pointer
 - block: fix aio_flush segfaults for read-only protocols (e.g. curl)
 - virtio-blk: fix barrier support
 - block: fix sector comparism in multiwrite_req_compare
 - pci: irq_state vmstate breakage
 - qemu-img: use the heap instead of the huge stack array for win32
 version 0.12.4
 - Workaround for broken OSS_GETVERSION on FreeBSD, part two (Juergen Lock)
 - oss: fix fragment setting (malc)
 - oss: issue OSS_GETVERSION ioctl only when needed (malc)
 - oss: refactor code around policy setting (malc)
 - oss: workaround for cases when OSS_GETVERSION is not defined (malc)
 - block: Free iovec arrays allocated by multiwrite_merge() (Stefan Hajnoczi)
 - lsi: fix segfault in lsi_command_complete (Gerd Hoffmann)
 - lsi: pass lsi_request to lsi_reselect (Gerd Hoffmann)
 - lsi: move dma_len+dma_buf into lsi_request (Gerd Hoffmann)
 - lsi: move current_dev into lsi_request (Gerd Hoffmann)
 - lsi: have lsi_request for the whole life time of the request. (Gerd Hoffmann)
 - lsi: use QTAILQ for lsi_queue (Gerd Hoffmann)
 - tcp/mips: Change TCG_AREG0 (fp -> s0) (Stefan Weil)
 - sh_pci: fix memory and I/O access (Aurelien Jarno)
 - Fix incoming migration with iothread (Marcelo Tosatti)
 - Fix SIGFPE for vnc display of width/height = 1 (Chris Webb)
 - net: remove broken net_set_boot_mask() boot device validation (Eduardo Habkost)
 - qcow2: Remove request from in-flight list after error (Kevin Wolf)
 - qcow2: Don't ignore immediate read/write failures (Kevin Wolf)
 - block: Fix multiwrite memory leak in error case (Kevin Wolf)
 - block: Fix error code in multiwrite for immediate failures (Kevin Wolf)
 - block: Fix multiwrite error handling (Kevin Wolf)
 - scsi-disk: fix buffer overflow (Gerd Hoffmann)
 - qcow2: Rewrite alloc_refcount_block/grow_refcount_table (Kevin Wolf)
 - qcow2: Factor next_refcount_table_size out (Kevin Wolf)
 - block: avoid creating too large iovecs in multiwrite_merge (Christoph Hellwig)
 - json-parser: Fix segfault on malformed input (Kevin Wolf)
 - linux-user: switch default ppc64 CPU to 970fx from 970 (Aurelien Jarno)
 - target-sh4: MMU: fix store queue addresses (Aurelien Jarno)
 - target-sh4: MMU: fix ITLB priviledge check (Aurelien Jarno)
 - target-sh4: MMU: fix mem_idx computation (Aurelien Jarno)
 - sh7750: handle MMUCR TI bit (Aurelien Jarno)
 - UHCI spurious interrut fix (Paul Brook)
 - tcg/mips: fix branch offset during retranslation (Aurelien Jarno)
 - tcg/arm: correctly save/restore registers in prologue/epilogue (Aurelien Jarno)
 - workaround for cmd646 bmdma register access while no dma is active (Igor V. Kovalenko)
 - Fix corner case in chardev udp: parameter (Jan Kiszka)
 - Don't set default monitor when there is a mux'ed one (Jan Kiszka)
 - spelling typo (compatibilty) in hw/fw_cfg.c (Vagrant Cascadian)
 - fdc: fix drive property handling. (Gerd Hoffmann)
 - target-i386: fix commit c22549204a6edc431e8e4358e61bd56386ff6957 (TeLeMan)
 - target-i386: fix SIB decoding with index = 4 (Aurelien Jarno)
 - Fix segfault with ram_size > 4095M without kvm (Ryan Harper)
 - target-i386: Fix long jumps/calls in long mode with REX.W set (malc)
 - target-i386: fix lddqu SSE instruction (Aurelien Jarno)
 - qemu-char.c: drop debug printfs from qemu_chr_parse_compat (Jan Kiszka)
 - fix undefined shifts by >32 (Paolo Bonzini)
 - Fix qemu -net user,hostfwd= example (Aurelien Jarno)
 version 0.12.3
  - kvm: Fix eflags corruption in kvm mode (Jan Kiszka)
  - qcow2: Fix access after end of array (Kevin Wolf)
  - ide save/restore pio/atapi cmd transfer fields and io buffer (Marcelo Tosatti)
  - net: Monitor command set_link finds only VLAN clients, fix (Markus Armbruster)
  - net: info network shows only VLAN clients, fix (Markus Armbruster)
  - net: net_check_clients() checks only VLAN clients, fix (Markus Armbruster)
  - net: Fix bogus "Warning: vlan 0 with no nics" with -device (Markus Armbruster)
  - net: net_check_clients() runs too early to see -device, fix (Markus Armbruster)
  - net: Remove unused net_client_uninit() (Markus Armbruster)
  - don't dereference NULL after failed strdup (Jim Meyering)
  - virtio-net: fix network stall under load (Tom Lendacky)
  - json: fix PRId64 on Win32 (Roy Tam)
  - fix inet_parse typo (Marcelo Tosatti)
  - iothread: fix vcpu stop with smp tcg (Marcelo Tosatti)
  - segfault due to buffer overrun in usb-serial (David S. Ahern)
  - qcow2: Fix signedness bugs (Kevin Wolf)
  - Do not ignore error, if open file failed (-serial /dev/tty) (Evgeniy Dushistov)
  - pc-bios: update to newer version of (stable) seabios (Anthony Liguori)
  - target-mips: fix ROTR and DROTR by zero (Aurelien Jarno)
  - target-mips: fix CpU exception for coprocessor 0 (Nathan Froyd)
  - tcg/mips: fix crash in tcg_out_qemu_ld() (Aurelien Jarno)
  - target-mips: don't call cpu_loop_exit() from helper.c (Aurelien Jarno)
  - virtio-blk: Fix error cases which ignored rerror/werror (Kevin Wolf)
  - virtio-blk: Fix restart after read error (Kevin Wolf)
  - virtio_blk: Factor virtio_blk_handle_request out (Kevin Wolf)
  - cirrus: Properly re-register cirrus_linear_io_addr on vram unmap (Jan Kiszka)
  - qcow2: Don't ignore qcow2_alloc_clusters return value (Kevin Wolf)
  - qcow2: Don't ignore update_refcount return value (Kevin Wolf)
  - qcow2: Allow updating no refcounts (Kevin Wolf)
  - qcow2: Improve error handling in update_refcount (Kevin Wolf)
  - qcow2: Fix error handling in grow_refcount_table (Kevin Wolf)
  - block: Return original error codes in bdrv_pread/write (Kevin Wolf)
  - qcow2: Return 0/-errno in qcow2_alloc_cluster_offset (Kevin Wolf)
  - qcow2: Return 0/-errno in get_cluster_table (Kevin Wolf)
  - qcow2: Fix error handling in qcow_save_vmstate (Kevin Wolf)
  - qcow2: Fix error handling in qcow2_grow_l1_table (Kevin Wolf)
  - win32/sdl: Fix toggle full screen (Herve Poussineau)
  - win32: pair qemu_memalign() with qemu_vfree() (Herve Poussineau)
  - vnc_refresh: calling vnc_update_client might free vs (Stefano Stabellini)
  - Musicpal: Fix descriptor walk in eth_send (Jan Kiszka)
  - Musicpal: Fix wm8750 I2C address (Jan Kiszka)
  - fix savevm command without id or tag (Marcelo Tosatti)
  - reduce number of reinjects on ACK (Gleb Natapov)
  - QMP: Fix asynchronous events delivery (Luiz Capitulino)
  - Documentation: Add missing documentation for qdev related command line options (Stefan Weil)
  - pc: add driver version compat properties (Gerd Hoffmann)
  - scsi: device version property (Gerd Hoffmann)
  - ide: device version property (Gerd Hoffmann)
  - QMP: Emit asynchronous events on all QMP monitors (Adam Litke)
  - Fix QEMU_WARN_UNUSED_RESULT (Kevin Wolf)
 version 0.12.2:
  - Qemu's internal TFTP server breaks lock-step-iness of TFTP (Milan Plzik)
  - osdep.c: Fix accept4 fallback (Kevin Wolf)
  - pc: add rombar to compat properties for pc-0.10 and pc-0.11 (Gerd Hoffmann)
  - pci: allow loading roms via fw_cfg. (Gerd Hoffmann)
  - roms: rework rom loading via fw (Gerd Hoffmann)
  - fw_cfg: rom loader tweaks. (Gerd Hoffmann)
  - roms: minor fixes and cleanups. (Gerd Hoffmann)
  - pc: add machine type for 0.12 (Gerd Hoffmann)
  - loader: more ignores for rom intended to be loaded by the bios (Aurelien Jarno)
  - vnc_refresh: return if vd->timer is NULL (Stefano Stabellini)
  - QMP: Don't free async event's 'data' (Luiz Capitulino)
  - Handle TFTP ERROR from client (Thomas Horsten)
  - dmg: fix ->open failure (Christoph Hellwig)
  - virtio-pci: thinko fix (Michael S. Tsirkin)
  - pc-bios: Update README (SeaBIOS) (Stefan Weil)
  - vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow (Roland Dreier)
  - remove pending exception on vcpu reset. (Gleb Natapov)
  - Fix CPU topology initialization (Jiri Denemark)
  - MCE: Fix bug of IA32_MCG_STATUS after system reset (Huang Ying)
  - linuxboot: fix gdt address calculation (Avi Kivity)
  - QMP: Drop wrong assert() (Luiz Capitulino)
  - vnc: Fix artifacts in hextile decoding (Anthony Liguori)
  - target-i386: Fix "call im" on x86_64 when executing 32-bit code (Aurelien Jarno)
  - Add missing newline at the end of options list (Michael Tokarev)
  - Don't load options roms intended to be loaded by the bios in qemu (Avi Kivity)
  - USB: Improve usbdevice error messages (Scott Tsai)
  - cpu-all.h: fix cpu_get_real_ticks() #ifdef (Aurelien Jarno)
  - alpha: fix compile (Blue Swirl)
  - user_only: compile everything with -fpie (Kirill A. Shutemov)
  - fdc/sparc32: don't hang on detection under OBP (Artyom Tarasenko)
  - scsi-disk: Inquiry with allocation length of CDB < 36 (v4) (Artyom Tarasenko)
  - e1000: fix init values for command register (Michael S. Tsirkin)
 version 0.12.1:
  - loader: fix rom loading at address 0 (fixes target-arm) (Aurelien Jarno)
  - loader: fix rom_copy (fixes multiboot) (Kevin Wolf)
 version 0.12.0:
@@ -78,7 +259,7 @@ version 0.10.2:
  - fix savevm/loadvm (Anthony Liguori)
  - live migration: fix dirty tracking windows (Glauber Costa)
-  - live migration: improve error propagation (Glauber Costa)
+  - live migration: improve error propogation (Glauber Costa)
  - qcow2: fix image creation for > ~2TB images (Chris Wright)
  - hotplug: fix error handling for if= parameter (Eduardo Habkost)
  - qcow2: fix data corruption (Nolan Leake)
@@ -386,7 +567,7 @@ version 0.5.3:
  - support of CD-ROM change
  - multiple network interface support
  - initial x86-64 host support (Gwenole Beauchesne)
-  - lret to outer privilege fix (OS/2 install fix)
+  - lret to outer priviledge fix (OS/2 install fix)
  - task switch fixes (SkyOS boot)
  - VM save/restore commands
  - new timer API
@@ -447,7 +628,7 @@ version 0.5.0:
  - multi-target build
  - fixed: no error code in hardware interrupts
  - fixed: pop ss, mov ss, x and sti disable hardware irqs for the next insn
-  - correct single stepping through string operations
+  - correct single stepping thru string operations
  - preliminary SPARC target support (Thomas M. Ogrisegg)
  - tun-fd option (Rusty Russell)
  - automatic IDE geometry detection
@@ -531,7 +712,7 @@ version 0.1.5:
 - ppc64 support + personality() patch (Rusty Russell)
 - first Alpha CPU patches (Falk Hueffner)
- - removed bfd.h dependency
+ - removed bfd.h dependancy
 - fixed shrd, shld, idivl and divl on PowerPC.
 - fixed buggy glibc PowerPC rint() function (test-i386 passes now on PowerPC).
--- a/2
+++ b/2
@@ -0,0 +1,2 @@
 seabios 9fb3f4d950744e97cc655b7d7b523d8bf101e4a0
 vgabios 6e62666cfc19e7fd45dd0d7c3ad62fd8d0b5f67a
--- a/1
+++ b/1
@@ -0,0 +1 @@
 qemu-kvm-0.12.5
--- a/4
+++ b/4
@@ -1,4 +0,0 @@
 source Kconfig.host
 source backends/Kconfig
 source accel/Kconfig
 source hw/Kconfig
--- a/Kconfig.host
+++ b/Kconfig.host
@@ -1,35 +0,0 @@
 # These are "proxy" symbols used to pass config-host.mak values
 # down to Kconfig.  See also MINIKCONF_ARGS in the Makefile:
 # these two need to be kept in sync.
 config LINUX
    bool
 config OPENGL
    bool
 config X11
    bool
 config SPICE
    bool
 config IVSHMEM
    bool
 config TPM
    bool
 config VHOST_USER
    bool
    select VHOST
 config VHOST_KERNEL
    bool
    select VHOST
 config VIRTFS
    bool
 config PVRDMA
    bool
--- a/31
+++ b/31
@@ -1,27 +1,18 @@
-The QEMU distribution includes both the QEMU emulator and
+The following points clarify the QEMU license:
 various firmware files.  These are separate programs that are
 distributed together for our users' convenience, and they have
 separate licenses.
-The following points clarify the license of the QEMU emulator:
+1) QEMU as a whole is released under the GNU General Public License
-1) The QEMU emulator as a whole is released under the GNU General
+2) Parts of QEMU have specific licenses which are compatible with the
-Public License, version 2.
+GNU General Public License. Hence each source file contains its own
 licensing information.
-2) Parts of the QEMU emulator have specific licenses which are compatible
+In particular, the QEMU virtual CPU core library (libqemu.a) is
-with the GNU General Public License, version 2. Hence each source file
+released under the GNU Lesser General Public License. Many hardware
-contains its own licensing information.  Source files with no licensing
+device emulation sources are released under the BSD license.
 information are released under the GNU General Public License, version
 2 or (at your option) any later version.
-As of July 2013, contributions under version 2 of the GNU General Public
+3) The Tiny Code Generator (TCG) is released under the BSD license
-License (and no later version) are only accepted for the following files
+   (see license headers in files).
 or directories: bsd-user/, linux-user/, hw/vfio/, hw/xen/xen_pt*.
 3) The Tiny Code Generator (TCG) is mostly under the BSD or MIT licenses;
   but some parts may be GPLv2 or other licenses. Again, see the
   specific licensing information in each source file.
 4) QEMU is a trademark of Fabrice Bellard.
-Fabrice Bellard and the QEMU team
+Fabrice Bellard.
--- a/3189
+++ b/3189
--- a/1523
+++ b/1523
--- a/Makefile.hw
+++ b/Makefile.hw
@@ -0,0 +1,55 @@
 # Makefile for qemu target independent devices.
 include ../config-host.mak
 include ../config-all-devices.mak
 include config.mak
 include $(SRC_PATH)/rules.mak
 .PHONY: all
 VPATH=$(SRC_PATH):$(SRC_PATH)/hw
 QEMU_CFLAGS+=-I.. -I$(SRC_PATH)/fpu
 obj-y =
 obj-y += loader.o
 obj-y += virtio.o
 obj-y += fw_cfg.o
 obj-y += watchdog.o
 obj-$(CONFIG_ECC) += ecc.o
 obj-$(CONFIG_NAND) += nand.o
 obj-$(CONFIG_M48T59) += m48t59.o
 obj-$(CONFIG_ESCC) += escc.o
 # PCI watchdog devices
 obj-y += wdt_i6300esb.o
 # MSI-X depends on kvm for interrupt injection,
 # so moved it from Makefile.hw to Makefile.target for now
 # obj-y += msix.o
 # PCI network cards
 obj-y += ne2000.o
 obj-$(CONFIG_SMC91C111) += smc91c111.o
 obj-$(CONFIG_LAN9118) += lan9118.o
 # SCSI layer
 obj-y += lsi53c895a.o
 obj-$(CONFIG_ESP) += esp.o
 obj-y += dma-helpers.o sysbus.o isa-bus.o
 obj-$(CONFIG_QDEV_ADDR) += qdev-addr.o
 all: $(HWLIB)
 # Dummy command so that make thinks it has done something
 	@true
 $(HWLIB): $(obj-y)
 clean:
 	rm -f *.o *.d *.a *~
 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -1,215 +0,0 @@
 #######################################################################
 # Common libraries for tools and emulators
 stub-obj-y = stubs/
 util-obj-y = crypto/ util/ qobject/ qapi/
 qom-obj-y = qom/
 #######################################################################
 # code used by both qemu system emulation and qemu-img
 ifeq ($(call lor,$(CONFIG_SOFTMMU),$(CONFIG_TOOLS)),y)
 chardev-obj-y = chardev/
 authz-obj-y = authz/
 block-obj-y = block/ nbd/ scsi/
 block-obj-y += block.o blockjob.o job.o
 block-obj-y += qemu-io-cmds.o
 block-obj-$(CONFIG_REPLICATION) += replication.o
 block-obj-m = block/
 crypto-obj-y = crypto/
 io-obj-y = io/
 endif # CONFIG_SOFTMMU or CONFIG_TOOLS
 #######################################################################
 # storage-daemon-obj-y is code used by qemu-storage-daemon (these objects are
 # used for system emulation, too, but specified separately there)
 storage-daemon-obj-y = block/ monitor/ qapi/ qom/ storage-daemon/
 storage-daemon-obj-y += blockdev.o blockdev-nbd.o iothread.o job-qmp.o
 storage-daemon-obj-$(CONFIG_WIN32) += os-win32.o
 storage-daemon-obj-$(CONFIG_POSIX) += os-posix.o
 ######################################################################
 # Target independent part of system emulation. The long term path is to
 # suppress *all* target specific code in case of system emulation, i.e. a
 # single QEMU executable should support all CPUs and machines.
 ifeq ($(CONFIG_SOFTMMU),y)
 common-obj-y = blockdev.o blockdev-nbd.o block/
 common-obj-y += bootdevice.o iothread.o
 common-obj-y += dump/
 common-obj-y += job-qmp.o
 common-obj-y += monitor/
 common-obj-y += net/
 common-obj-y += qdev-monitor.o
 common-obj-$(CONFIG_WIN32) += os-win32.o
 common-obj-$(CONFIG_POSIX) += os-posix.o
 common-obj-$(CONFIG_LINUX) += fsdev/
 common-obj-y += accel/
 common-obj-y += migration/
 common-obj-y += audio/
 common-obj-m += audio/
 common-obj-y += hw/
 common-obj-m += hw/
 common-obj-y += replay/
 common-obj-y += ui/
 common-obj-m += ui/
 common-obj-y += dma-helpers.o
 common-obj-$(CONFIG_TPM) += tpm.o
 common-obj-y += backends/
 common-obj-y += chardev/
 common-obj-m += chardev/
 common-obj-$(CONFIG_SECCOMP) += qemu-seccomp.o
 qemu-seccomp.o-cflags := $(SECCOMP_CFLAGS)
 qemu-seccomp.o-libs := $(SECCOMP_LIBS)
 common-obj-$(CONFIG_FDT) += device_tree.o
 common-obj-y += qapi/
 endif # CONFIG_SOFTMMU
 #######################################################################
 # Target-independent parts used in system and user emulation
 common-obj-y += cpus-common.o
 common-obj-y += hw/
 common-obj-y += qom/
 common-obj-y += disas/
 ######################################################################
 # Resource file for Windows executables
 version-obj-$(CONFIG_WIN32) += $(BUILD_DIR)/version.o
 ######################################################################
 # tracing
 util-obj-y +=  trace/
 ######################################################################
 # guest agent
 # FIXME: a few definitions from qapi/qapi-types.o and
 # qapi/qapi-visit.o are needed by libqemuutil.a.  These should be
 # extracted into a QAPI schema module, or perhaps a separate schema.
 qga-obj-y = qga/
 qga-vss-dll-obj-y = qga/
 ######################################################################
 # contrib
 elf2dmp-obj-y = contrib/elf2dmp/
 ivshmem-client-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-client/
 ivshmem-server-obj-$(CONFIG_IVSHMEM) = contrib/ivshmem-server/
 libvhost-user-obj-y = contrib/libvhost-user/
 vhost-user-scsi.o-cflags := $(LIBISCSI_CFLAGS)
 vhost-user-scsi.o-libs := $(LIBISCSI_LIBS)
 vhost-user-scsi-obj-y = contrib/vhost-user-scsi/
 vhost-user-blk-obj-y = contrib/vhost-user-blk/
 rdmacm-mux-obj-y = contrib/rdmacm-mux/
 vhost-user-input-obj-y = contrib/vhost-user-input/
 vhost-user-gpu-obj-y = contrib/vhost-user-gpu/
 virtiofsd-obj-y = tools/virtiofsd/
 ######################################################################
 trace-events-subdirs =
 trace-events-subdirs += accel/kvm
 trace-events-subdirs += accel/tcg
 trace-events-subdirs += backends
 trace-events-subdirs += backends/tpm
 trace-events-subdirs += crypto
 trace-events-subdirs += monitor
 ifeq ($(CONFIG_USER_ONLY),y)
 trace-events-subdirs += linux-user
 endif
 ifeq ($(CONFIG_BLOCK),y)
 trace-events-subdirs += authz
 trace-events-subdirs += block
 trace-events-subdirs += io
 trace-events-subdirs += nbd
 trace-events-subdirs += scsi
 endif
 ifeq ($(CONFIG_SOFTMMU),y)
 trace-events-subdirs += audio
 trace-events-subdirs += chardev
 trace-events-subdirs += hw/9pfs
 trace-events-subdirs += hw/acpi
 trace-events-subdirs += hw/alpha
 trace-events-subdirs += hw/arm
 trace-events-subdirs += hw/audio
 trace-events-subdirs += hw/block
 trace-events-subdirs += hw/block/dataplane
 trace-events-subdirs += hw/char
 trace-events-subdirs += hw/dma
 trace-events-subdirs += hw/hppa
 trace-events-subdirs += hw/hyperv
 trace-events-subdirs += hw/i2c
 trace-events-subdirs += hw/i386
 trace-events-subdirs += hw/i386/xen
 trace-events-subdirs += hw/ide
 trace-events-subdirs += hw/input
 trace-events-subdirs += hw/intc
 trace-events-subdirs += hw/isa
 trace-events-subdirs += hw/mem
 trace-events-subdirs += hw/mips
 trace-events-subdirs += hw/misc
 trace-events-subdirs += hw/misc/macio
 trace-events-subdirs += hw/net
 trace-events-subdirs += hw/nvram
 trace-events-subdirs += hw/pci
 trace-events-subdirs += hw/pci-host
 trace-events-subdirs += hw/ppc
 trace-events-subdirs += hw/rdma
 trace-events-subdirs += hw/rdma/vmw
 trace-events-subdirs += hw/rtc
 trace-events-subdirs += hw/s390x
 trace-events-subdirs += hw/scsi
 trace-events-subdirs += hw/sd
 trace-events-subdirs += hw/sparc
 trace-events-subdirs += hw/sparc64
 trace-events-subdirs += hw/ssi
 trace-events-subdirs += hw/timer
 trace-events-subdirs += hw/tpm
 trace-events-subdirs += hw/usb
 trace-events-subdirs += hw/vfio
 trace-events-subdirs += hw/virtio
 trace-events-subdirs += hw/watchdog
 trace-events-subdirs += hw/xen
 trace-events-subdirs += hw/gpio
 trace-events-subdirs += hw/riscv
 trace-events-subdirs += migration
 trace-events-subdirs += net
 trace-events-subdirs += ui
 endif
 trace-events-subdirs += hw/core
 trace-events-subdirs += hw/display
 trace-events-subdirs += qapi
 trace-events-subdirs += qom
 trace-events-subdirs += target/arm
 trace-events-subdirs += target/hppa
 trace-events-subdirs += target/i386
 trace-events-subdirs += target/mips
 trace-events-subdirs += target/ppc
 trace-events-subdirs += target/riscv
 trace-events-subdirs += target/s390x
 trace-events-subdirs += target/sparc
 trace-events-subdirs += util
 trace-events-files = $(SRC_PATH)/trace-events $(trace-events-subdirs:%=$(SRC_PATH)/%/trace-events)
 trace-obj-y = trace-root.o
 trace-obj-y += $(trace-events-subdirs:%=%/trace.o)
 trace-obj-$(CONFIG_TRACE_UST) += trace-ust-all.o
 trace-obj-$(CONFIG_TRACE_DTRACE) += trace-dtrace-root.o
 trace-obj-$(CONFIG_TRACE_DTRACE) += $(trace-events-subdirs:%=%/trace-dtrace.o)
--- a/Makefile.target
+++ b/Makefile.target
@@ -1,287 +1,368 @@
 # -*- Mode: makefile -*-
-BUILD_DIR?=$(CURDIR)/..
+# This needs to be defined before rules.mak
 GENERATED_HEADERS = config-target.h
 include ../config-host.mak
 include config-devices.mak
 include config-target.mak
 include $(SRC_PATH)/rules.mak
-ifdef CONFIG_SOFTMMU
+TARGET_PATH=$(SRC_PATH)/target-$(TARGET_BASE_ARCH)
-include config-devices.mak
+VPATH=$(SRC_PATH):$(TARGET_PATH):$(SRC_PATH)/hw
-endif
+QEMU_CFLAGS+= -I.. -I$(TARGET_PATH) -DNEED_CPU_H
 $(call set-vpath, $(SRC_PATH):$(BUILD_DIR))
 ifdef CONFIG_LINUX
 QEMU_CFLAGS += -isystem ../linux-headers
 endif
 QEMU_CFLAGS += -iquote .. -iquote $(SRC_PATH)/target/$(TARGET_BASE_ARCH) -DNEED_CPU_H
 QEMU_CFLAGS+=-iquote $(SRC_PATH)/include
 ifdef CONFIG_USER_ONLY
 # user emulator name
-QEMU_PROG=qemu-$(TARGET_NAME)
+QEMU_PROG=qemu-$(TARGET_ARCH2)
 QEMU_PROG_BUILD = $(QEMU_PROG)
 else
 # system emulator name
-QEMU_PROG=qemu-system-$(TARGET_NAME)$(EXESUF)
+ifeq ($(TARGET_ARCH), i386)
-ifneq (,$(findstring -mwindows,$(SDL_LIBS)))
+QEMU_PROG=qemu$(EXESUF)
 # Terminate program name with a 'w' because the linker builds a windows executable.
 QEMU_PROGW=qemu-system-$(TARGET_NAME)w$(EXESUF)
 $(QEMU_PROG): $(QEMU_PROGW)
 	$(call quiet-command,$(OBJCOPY) --subsystem console $(QEMU_PROGW) $(QEMU_PROG),"GEN","$(TARGET_DIR)$(QEMU_PROG)")
 QEMU_PROG_BUILD = $(QEMU_PROGW)
 else
-QEMU_PROG_BUILD = $(QEMU_PROG)
+QEMU_PROG=qemu-system-$(TARGET_ARCH2)$(EXESUF)
 endif
 endif
-PROGS=$(QEMU_PROG) $(QEMU_PROGW)
+PROGS=$(QEMU_PROG)
-STPFILES=
+
 LIBS+=-lm
 kvm.o kvm-all.o: QEMU_CFLAGS+=$(KVM_CFLAGS)
 CFLAGS += $(KVM_CFLAGS)
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak
-config-devices.h: config-devices.h-timestamp
+all: $(PROGS)
 config-devices.h-timestamp: config-devices.mak
 ifdef CONFIG_TRACE_SYSTEMTAP
 stap: $(QEMU_PROG).stp-installed $(QEMU_PROG).stp $(QEMU_PROG)-simpletrace.stp $(QEMU_PROG)-log.stp
 ifdef CONFIG_USER_ONLY
 TARGET_TYPE=user
 else
 TARGET_TYPE=system
 endif
 tracetool-y = $(SRC_PATH)/scripts/tracetool.py
 tracetool-y += $(shell find $(SRC_PATH)/scripts/tracetool -name "*.py")
 $(QEMU_PROG).stp-installed: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
 		--backends=$(TRACE_BACKENDS) \
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp-installed")
 $(QEMU_PROG).stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=stap \
 		--backends=$(TRACE_BACKENDS) \
 		--binary=$(realpath .)/$(QEMU_PROG) \
 		--target-name=$(TARGET_NAME) \
 		--target-type=$(TARGET_TYPE) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG).stp")
 $(QEMU_PROG)-simpletrace.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=simpletrace-stap \
 		--backends=$(TRACE_BACKENDS) \
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-simpletrace.stp")
 $(QEMU_PROG)-log.stp: $(BUILD_DIR)/trace-events-all $(tracetool-y)
 	$(call quiet-command,$(TRACETOOL) \
 		--group=all \
 		--format=log-stap \
 		--backends=$(TRACE_BACKENDS) \
 		--probe-prefix=qemu.$(TARGET_TYPE).$(TARGET_NAME) \
 		$< > $@,"GEN","$(TARGET_DIR)$(QEMU_PROG)-log.stp")
 else
 stap:
 endif
 .PHONY: stap
 all: $(PROGS) stap
 # Dummy command so that make thinks it has done something
 	@true
 obj-y += trace/
 #########################################################
 # cpu emulator library
-obj-y += exec.o exec-vary.o
+libobj-y = exec.o cpu-exec.o
-obj-y += accel/
+libobj-$(CONFIG_NO_CPU_EMULATION) += fake-exec.o
-obj-$(CONFIG_TCG) += tcg/tcg.o tcg/tcg-op.o tcg/tcg-op-vec.o tcg/tcg-op-gvec.o
+libobj-$(CONFIG_CPU_EMULATION) += translate-all.o translate.o
-obj-$(CONFIG_TCG) += tcg/tcg-common.o tcg/optimize.o
+libobj-$(CONFIG_CPU_EMULATION) += tcg/tcg.o
-obj-$(CONFIG_TCG_INTERPRETER) += tcg/tci.o
+libobj-$(CONFIG_SOFTFLOAT) += fpu/softfloat.o
-obj-$(CONFIG_TCG_INTERPRETER) += disas/tci.o
+libobj-$(CONFIG_NOSOFTFLOAT) += fpu/softfloat-native.o
-obj-$(CONFIG_TCG) += fpu/softfloat.o
+libobj-y += op_helper.o helper.o
-obj-y += target/$(TARGET_BASE_ARCH)/
+libobj-$(CONFIG_NEED_MMU) += mmu.o
 obj-y += disas.o
 obj-$(call notempty,$(TARGET_XML_FILES)) += gdbstub-xml.o
 LIBS := $(libs_cpu) $(LIBS)
-obj-$(CONFIG_PLUGIN) += plugins/
+libobj-$(CONFIG_KVM) += kvm-tpr-opt.o
 libobj-$(CONFIG_KVM) += qemu-kvm-helper.o
 libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
 libobj-$(TARGET_ALPHA) += alpha_palcode.o
 # NOTE: the disassembler code is only needed for debugging
 libobj-y += disas.o
 libobj-$(CONFIG_ALPHA_DIS) += alpha-dis.o
 libobj-$(CONFIG_ARM_DIS) += arm-dis.o
 libobj-$(CONFIG_CRIS_DIS) += cris-dis.o
 libobj-$(CONFIG_HPPA_DIS) += hppa-dis.o
 libobj-$(CONFIG_I386_DIS) += i386-dis.o
 libobj-$(CONFIG_M68K_DIS) += m68k-dis.o
 libobj-$(CONFIG_MICROBLAZE_DIS) += microblaze-dis.o
 libobj-$(CONFIG_MIPS_DIS) += mips-dis.o
 libobj-$(CONFIG_PPC_DIS) += ppc-dis.o
 libobj-$(CONFIG_S390_DIS) += s390-dis.o
 libobj-$(CONFIG_SH4_DIS) += sh4-dis.o
 libobj-$(CONFIG_SPARC_DIS) += sparc-dis.o
 # libqemu
 libqemu.a: $(libobj-y)
 translate.o: translate.c cpu.h
 translate-all.o: translate-all.c cpu.h
 tcg/tcg.o: cpu.h
 # HELPER_CFLAGS is used for all the code compiled with static register
 # variables
 op_helper.o cpu-exec.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 # Note: this is a workaround. The real fix is to avoid compiling
 # cpu_signal_handler() in cpu-exec.c.
 signal.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 qemu-kvm-helper.o: QEMU_CFLAGS += $(HELPER_CFLAGS)
 #########################################################
 # Linux user emulator target
 ifdef CONFIG_LINUX_USER
-QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR) \
+VPATH+=:$(SRC_PATH)/linux-user:$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
-             -I$(SRC_PATH)/linux-user/host/$(ARCH) \
+QEMU_CFLAGS+=-I$(SRC_PATH)/linux-user -I$(SRC_PATH)/linux-user/$(TARGET_ABI_DIR)
-             -I$(SRC_PATH)/linux-user \
+obj-y = main.o syscall.o strace.o mmap.o signal.o thunk.o \
-             -Ilinux-user/$(TARGET_ABI_DIR)
+      elfload.o linuxload.o uaccess.o gdbstub.o
-obj-y += linux-user/
+obj-$(TARGET_HAS_BFLT) += flatload.o
-obj-y += gdbstub.o thunk.o
+obj-$(TARGET_HAS_ELFLOAD32) += elfload32.o
 obj-$(TARGET_I386) += vm86.o
 obj-i386-y += ioport-user.o
 nwfpe-obj-y = fpa11.o fpa11_cpdo.o fpa11_cpdt.o fpa11_cprt.o fpopcode.o
 nwfpe-obj-y += single_cpdo.o double_cpdo.o extended_cpdo.o
 obj-arm-y +=  $(addprefix nwfpe/, $(nwfpe-obj-y))
 obj-arm-y += arm-semi.o
 obj-m68k-y += m68k-sim.o m68k-semi.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_LINUX_USER
 #########################################################
 # Darwin user emulator target
 ifdef CONFIG_DARWIN_USER
 VPATH+=:$(SRC_PATH)/darwin-user
 QEMU_CFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
 # Leave some space for the regular program loading zone
 LDFLAGS+=-Wl,-segaddr,__STD_PROG_ZONE,0x1000 -image_base 0x0e000000
 LIBS+=-lmx
 obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
        gdbstub.o
 obj-i386-y += ioport-user.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_DARWIN_USER
 #########################################################
 # BSD user emulator target
 ifdef CONFIG_BSD_USER
-QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ABI_DIR) \
+VPATH+=:$(SRC_PATH)/bsd-user
-			 -I$(SRC_PATH)/bsd-user/$(HOST_VARIANT_DIR)
+QEMU_CFLAGS+=-I$(SRC_PATH)/bsd-user -I$(SRC_PATH)/bsd-user/$(TARGET_ARCH)
-obj-y += bsd-user/
+obj-y = main.o bsdload.o elfload.o mmap.o signal.o strace.o syscall.o \
-obj-y += gdbstub.o
+        gdbstub.o uaccess.o
 obj-i386-y += ioport-user.o
 ARLIBS=../libuser/libuser.a libqemu.a
 endif #CONFIG_BSD_USER
 #########################################################
 # System emulator target
 ifdef CONFIG_SOFTMMU
-obj-y += softmmu/
+
-obj-y += gdbstub.o
+obj-y = vl.o async.o monitor.o pci.o pci_host.o pcie_host.o machine.o gdbstub.o
-obj-y += dump/
+# virtio has to be here due to weird dependency between PCI and virtio-net.
-obj-y += hw/
+# need to fix this properly
-obj-y += monitor/
+obj-y += virtio-blk.o virtio-balloon.o virtio-net.o virtio-console.o virtio-pci.o
-obj-y += qapi/
+obj-$(CONFIG_KVM) += kvm.o kvm-all.o
-obj-y += migration/ram.o
+# MSI-X depends on kvm for interrupt injection,
-LIBS := $(libs_softmmu) $(LIBS)
+# so moved it from Makefile.hw to Makefile.target for now
 obj-y += msix.o
 obj-$(CONFIG_ISA_MMIO) += isa_mmio.o
 LIBS+=-lz
 sound-obj-y =
 sound-obj-$(CONFIG_SB16) += sb16.o
 sound-obj-$(CONFIG_ES1370) += es1370.o
 sound-obj-$(CONFIG_AC97) += ac97.o
 sound-obj-$(CONFIG_ADLIB) += fmopl.o adlib.o
 sound-obj-$(CONFIG_GUS) += gus.o gusemu_hal.o gusemu_mixer.o
 sound-obj-$(CONFIG_CS4231A) += cs4231a.o
 adlib.o fmopl.o: QEMU_CFLAGS += -DBUILD_Y8950=0
 QEMU_CFLAGS += $(VNC_TLS_CFLAGS)
 QEMU_CFLAGS += $(VNC_SASL_CFLAGS)
 # xen backend driver support
 obj-$(CONFIG_XEN) += xen_machine_pv.o xen_domainbuild.o
 # USB layer
 obj-$(CONFIG_USB_OHCI) += usb-ohci.o
 # PCI network cards
 obj-y += eepro100.o
 obj-y += pcnet.o
 obj-y += rtl8139.o
 obj-y += e1000.o
 # Hardware support
-ifeq ($(TARGET_NAME), sparc64)
+obj-i386-y = ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/piix.o
-obj-y += hw/sparc64/
+obj-i386-y += pckbd.o $(sound-obj-y) dma.o
 obj-i386-y += vga.o vga-pci.o vga-isa.o
 obj-i386-y += fdc.o mc146818rtc.o serial.o i8259.o i8254.o pcspk.o pc.o
 obj-i386-y += cirrus_vga.o apic.o ioapic.o parallel.o acpi.o piix_pci.o
 obj-i386-y += usb-uhci.o vmmouse.o vmport.o vmware_vga.o hpet.o
 obj-i386-y += device-hotplug.o pci-hotplug.o smbios.o wdt_ib700.o
 obj-i386-y += extboot.o
 obj-i386-y += ne2000-isa.o
 obj-i386-y += testdev.o
 obj-i386-$(CONFIG_KVM_PIT) += i8254-kvm.o
 obj-i386-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o
 # Hardware support
 obj-ia64-y += ide.o pckbd.o vga.o $(SOUND_HW) dma.o $(AUDIODRV)
 obj-ia64-y += fdc.o mc146818rtc.o serial.o i8259.o ipf.o
 obj-ia64-y += cirrus_vga.o parallel.o acpi.o piix_pci.o
 obj-ia64-y += usb-uhci.o
 obj-ia64-$(CONFIG_KVM_DEVICE_ASSIGNMENT) += device-assignment.o
 # shared objects
 obj-ppc-y = ppc.o ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/macio.o
 obj-ppc-y += ide/cmd646.o
 obj-ppc-y += vga.o vga-pci.o $(sound-obj-y) dma.o openpic.o
 obj-ppc-y += cirrus_vga.o
 # PREP target
 obj-ppc-y += pckbd.o serial.o i8259.o i8254.o fdc.o mc146818rtc.o
 obj-ppc-y += prep_pci.o ppc_prep.o ne2000-isa.o
 # Mac shared devices
 obj-ppc-y += macio.o cuda.o adb.o mac_nvram.o mac_dbdma.o
 # OldWorld PowerMac
 obj-ppc-y += heathrow_pic.o grackle_pci.o ppc_oldworld.o
 # NewWorld PowerMac
 obj-ppc-y += unin_pci.o ppc_newworld.o
 # PowerPC 4xx boards
 obj-ppc-y += pflash_cfi02.o ppc4xx_devs.o ppc4xx_pci.o ppc405_uc.o ppc405_boards.o
 obj-ppc-y += ppc440.o ppc440_bamboo.o
 # PowerPC E500 boards
 obj-ppc-y += ppce500_pci.o ppce500_mpc8544ds.o
 obj-ppc-$(CONFIG_KVM) += kvm_ppc.o
 obj-ppc-$(CONFIG_FDT) += device_tree.o
 obj-mips-y = mips_r4k.o mips_jazz.o mips_malta.o mips_mipssim.o
 obj-mips-y += mips_timer.o mips_int.o dma.o vga.o serial.o i8254.o i8259.o rc4030.o
 obj-mips-y += vga-pci.o vga-isa.o vga-isa-mm.o
 obj-mips-y += g364fb.o jazz_led.o dp8393x.o
 obj-mips-y += ide/core.o ide/qdev.o ide/isa.o ide/pci.o ide/piix.o
 obj-mips-y += gt64xxx.o pckbd.o fdc.o mc146818rtc.o usb-uhci.o acpi.o ds1225y.o
 obj-mips-y += piix4.o parallel.o cirrus_vga.o pcspk.o $(sound-obj-y)
 obj-mips-y += mipsnet.o ne2000-isa.o
 obj-mips-y += pflash_cfi01.o
 obj-mips-y += vmware_vga.o
 obj-microblaze-y = petalogix_s3adsp1800_mmu.o
 obj-microblaze-y += microblaze_pic_cpu.o
 obj-microblaze-y += xilinx_intc.o
 obj-microblaze-y += xilinx_timer.o
 obj-microblaze-y += xilinx_uartlite.o
 obj-microblaze-y += xilinx_ethlite.o
 obj-microblaze-y += pflash_cfi02.o
 obj-microblaze-$(CONFIG_FDT) += device_tree.o
 # Boards
 obj-cris-y = cris_pic_cpu.o etraxfs.o axis_dev88.o
 # IO blocks
 obj-cris-y += etraxfs_dma.o
 obj-cris-y += etraxfs_pic.o
 obj-cris-y += etraxfs_eth.o
 obj-cris-y += etraxfs_timer.o
 obj-cris-y += etraxfs_ser.o
 obj-cris-y += pflash_cfi02.o
 ifeq ($(TARGET_ARCH), sparc64)
 obj-sparc-y = sun4u.o pckbd.o apb_pci.o
 obj-sparc-y += ide/core.o ide/qdev.o ide/pci.o ide/cmd646.o
 obj-sparc-y += vga.o vga-pci.o
 obj-sparc-y += fdc.o mc146818rtc.o serial.o
 obj-sparc-y += cirrus_vga.o parallel.o
 else
-obj-y += hw/$(TARGET_BASE_ARCH)/
+obj-sparc-y = sun4m.o lance.o tcx.o iommu.o slavio_intctl.o
 obj-sparc-y += slavio_timer.o slavio_misc.o fdc.o sparc32_dma.o
 obj-sparc-y += cs4231.o eccmemctl.o sbi.o sun4c_intctl.o
 endif
-generated-files-y += hmp-commands.h hmp-commands-info.h
+obj-arm-y = integratorcp.o versatilepb.o arm_pic.o arm_timer.o
-generated-files-y += config-devices.h
+obj-arm-y += arm_boot.o pl011.o pl031.o pl050.o pl080.o pl110.o pl181.o pl190.o
 obj-arm-y += versatile_pci.o
 obj-arm-y += realview_gic.o realview.o arm_sysctl.o arm11mpcore.o a9mpcore.o
 obj-arm-y += armv7m.o armv7m_nvic.o stellaris.o pl022.o stellaris_enet.o
 obj-arm-y += pl061.o
 obj-arm-y += arm-semi.o
 obj-arm-y += pxa2xx.o pxa2xx_pic.o pxa2xx_gpio.o pxa2xx_timer.o pxa2xx_dma.o
 obj-arm-y += pxa2xx_lcd.o pxa2xx_mmci.o pxa2xx_pcmcia.o pxa2xx_keypad.o
 obj-arm-y += pflash_cfi01.o gumstix.o
 obj-arm-y += zaurus.o ide/core.o ide/microdrive.o serial.o spitz.o tosa.o tc6393xb.o
 obj-arm-y += omap1.o omap_lcdc.o omap_dma.o omap_clk.o omap_mmc.o omap_i2c.o
 obj-arm-y += omap2.o omap_dss.o soc_dma.o
 obj-arm-y += omap_sx1.o palm.o tsc210x.o
 obj-arm-y += nseries.o blizzard.o onenand.o vga.o cbus.o tusb6010.o usb-musb.o
 obj-arm-y += mst_fpga.o mainstone.o
 obj-arm-y += musicpal.o pflash_cfi02.o bitbang_i2c.o marvell_88w8618_audio.o
 obj-arm-y += framebuffer.o
 obj-arm-y += syborg.o syborg_fb.o syborg_interrupt.o syborg_keyboard.o
 obj-arm-y += syborg_serial.o syborg_timer.o syborg_pointer.o syborg_rtc.o
 obj-arm-y += syborg_virtio.o
 obj-sh4-y = shix.o r2d.o sh7750.o sh7750_regnames.o tc58128.o
 obj-sh4-y += sh_timer.o sh_serial.o sh_intc.o sh_pci.o sm501.o serial.o
 obj-sh4-y += ide/core.o ide/mmio.o
 obj-m68k-y = an5206.o mcf5206.o mcf_uart.o mcf_intc.o mcf5208.o mcf_fec.o
 obj-m68k-y += m68k-semi.o dummy_m68k.o
 obj-s390x-y = s390-virtio-bus.o s390-virtio.o
 ifeq ($(TARGET_ARCH), ia64)
 firmware.o: firmware.c
 	$(CC) $(HELPER_CFLAGS) $(CPPFLAGS) $(BASE_CFLAGS) -c -o $@ $<
 endif
 main.o vl.o: QEMU_CFLAGS+=$(GPROF_CFLAGS)
 vl.o: QEMU_CFLAGS+=$(SDL_CFLAGS)
 vl.o: qemu-options.h
 monitor.o: qemu-monitor.h
 ARLIBS=../libqemu_common.a libqemu.a $(HWLIB)
 endif # CONFIG_SOFTMMU
-dummy := $(call unnest-vars,,obj-y)
+obj-$(CONFIG_GDBSTUB_XML) += gdbstub-xml.o
 all-obj-y := $(obj-y)
-#
+$(QEMU_PROG): $(obj-y) $(obj-$(TARGET_BASE_ARCH)-y) $(ARLIBS)
-# common-obj-m has some crap here, probably as side effect from
+	$(call LINK,$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y))
 # unnest-vars recursing into target directories to fill obj-y and not
 # properly handling the -m case.
 #
 # Clear common-obj-m as workaround.  Fixes suspious dependency errors
 # when building devices as modules.  A bit hackish, but should be ok
 # as long as we do not have any target-specific modules.
 #
 # The meson-based build system currently in development doesn't need
 # unnest-vars and will obsolete this workaround.
 #
 common-obj-m :=
 include $(SRC_PATH)/Makefile.objs
 dummy := $(call unnest-vars,.., \
               authz-obj-y \
               block-obj-y \
               block-obj-m \
               chardev-obj-y \
               crypto-obj-y \
               qom-obj-y \
               io-obj-y \
               common-obj-y \
               common-obj-m)
 all-obj-y += $(common-obj-y)
 all-obj-y += $(qom-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(authz-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(block-obj-y) $(chardev-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(crypto-obj-y)
 all-obj-$(CONFIG_SOFTMMU) += $(io-obj-y)
 ifdef CONFIG_SOFTMMU
 $(QEMU_PROG_BUILD): config-devices.mak
 endif
 COMMON_LDADDS = ../libqemuutil.a
 # build either PROG or PROGW
 $(QEMU_PROG_BUILD): $(all-obj-y) $(COMMON_LDADDS) $(softmmu-main-y)
 	$(call LINK, $(filter-out %.mak, $^))
 ifdef CONFIG_DARWIN
 	$(call quiet-command,Rez -append $(SRC_PATH)/pc-bios/qemu.rsrc -o $@,"REZ","$(TARGET_DIR)$@")
 	$(call quiet-command,SetFile -a C $@,"SETFILE","$(TARGET_DIR)$@")
 endif
 gdbstub-xml.c: $(TARGET_XML_FILES) $(SRC_PATH)/scripts/feature_to_c.sh
 	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/scripts/feature_to_c.sh $@ $(TARGET_XML_FILES),"GEN","$(TARGET_DIR)$@")
 hmp-commands.h: $(SRC_PATH)/hmp-commands.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
 hmp-commands-info.h: $(SRC_PATH)/hmp-commands-info.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -h < $< > $@,"GEN","$(TARGET_DIR)$@")
 clean: clean-target
 	rm -f *.a *~ $(PROGS)
 	rm -f $(shell find . -name '*.[od]')
 	rm -f hmp-commands.h gdbstub-xml.c
 	rm -f trace/generated-helpers.c trace/generated-helpers.c-timestamp
 ifdef CONFIG_TRACE_SYSTEMTAP
 	rm -f *.stp
 endif
 ifdef CONFIG_FUZZ
 include $(SRC_PATH)/tests/qtest/fuzz/Makefile.include
 include $(SRC_PATH)/tests/qtest/Makefile.include
 fuzz: fuzz-vars
 fuzz-vars: QEMU_CFLAGS := $(FUZZ_CFLAGS) $(QEMU_CFLAGS)
 fuzz-vars: QEMU_LDFLAGS := $(FUZZ_LDFLAGS) $(QEMU_LDFLAGS)
 fuzz-vars: $(QEMU_PROG_FUZZ)
 dummy := $(call unnest-vars,, fuzz-obj-y)
-$(QEMU_PROG_FUZZ): config-devices.mak $(all-obj-y) $(COMMON_LDADDS) $(fuzz-obj-y)
+gdbstub-xml.c: $(TARGET_XML_FILES) feature_to_c.sh
-	$(call LINK, $(filter-out %.mak, $^))
+	$(call quiet-command,rm -f $@ && $(SHELL) $(SRC_PATH)/feature_to_c.sh $@ $(TARGET_XML_FILES),"  GEN   $(TARGET_DIR)$@")
-endif
+qemu-options.h: $(SRC_PATH)/qemu-options.hx
 	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
 qemu-monitor.h: $(SRC_PATH)/qemu-monitor.hx
 	$(call quiet-command,sh $(SRC_PATH)/hxtool -h < $< > $@,"  GEN   $(TARGET_DIR)$@")
 clean:
 	rm -f *.o *.a *~ $(PROGS) nwfpe/*.o fpu/*.o
 	rm -f *.d */*.d tcg/*.o ide/*.o
 	rm -f qemu-options.h qemu-monitor.h gdbstub-xml.c
 install: all
 ifneq ($(PROGS),)
-	$(call install-prog,$(PROGS),$(DESTDIR)$(bindir))
+	$(INSTALL) -m 755 $(STRIP_OPT) $(PROGS) "$(DESTDIR)$(bindir)"
 endif
 ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset"
 	$(INSTALL_DATA) $(QEMU_PROG).stp-installed "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG).stp"
 	$(INSTALL_DATA) $(QEMU_PROG)-simpletrace.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-simpletrace.stp"
 	$(INSTALL_DATA) $(QEMU_PROG)-log.stp "$(DESTDIR)$(qemu_datadir)/../systemtap/tapset/$(QEMU_PROG)-log.stp"
 endif
-generated-files-y += config-target.h
+# Include automatically generated dependency files
-Makefile: $(generated-files-y)
+-include $(wildcard *.d */*.d)
 # Reports/Analysis
 #
 # The target specific coverage report only cares about target specific
 # blobs and not the shared code.
 #
 %/coverage-report.html:
 	@mkdir -p $*
 	$(call quiet-command,\
 		gcovr -r $(SRC_PATH) --object-directory $(CURDIR) \
 		-p --html --html-details -o $@, \
 		"GEN", "coverage-report.html")
 .PHONY: coverage-report
 coverage-report: $(CURDIR)/reports/coverage/coverage-report.html
--- a/Makefile.user
+++ b/Makefile.user
@@ -0,0 +1,32 @@
 # Makefile for qemu target independent user files.
 include ../config-host.mak
 include $(SRC_PATH)/rules.mak
 -include config.mak
 .PHONY: all
 # Do not take %.o from $(SRC_PATH), only %.c and %.h
 # All %.o for user targets should be built with -fpie, when
 # configured with --enable-user-pie, so we don't want to
 # take %.o from $(SRC_PATH), since they built without -fpie
 vpath %.c %.h $(SRC_PATH)
 QEMU_CFLAGS+=-I..
 obj-y =
 obj-y += envlist.o path.o
 obj-y += tcg-runtime.o host-utils.o
 obj-y += cutils.o cache-utils.o
 all: libuser.a
 # Dummy command so that make thinks it has done something
 	@true
 libuser.a: $(obj-y)
 clean:
 	rm -f *.o *.d *.a *~
 # Include automatically generated dependency files
 -include $(wildcard *.d */*.d)
--- a/QMP/README
+++ b/QMP/README
@@ -0,0 +1,63 @@
                          QEMU Monitor Protocol
                          =====================
 Introduction
 -------------
 The QEMU Monitor Protocol (QMP) allows applications to communicate with
 QEMU's Monitor.
 QMP is JSON[1] based and has the following features:
 - Lightweight, text-based, easy to parse data format
 - Asynchronous events support 
 - Stability
 For more information, please, refer to the following files:
 o qmp-spec.txt    QEMU Monitor Protocol current specification
 o qmp-events.txt  List of available asynchronous events
 There are also two simple Python scripts available:
 o qmp-shell       A shell
 o vm-info         Show some information about the Virtual Machine
 [1] http://www.json.org
 Usage
 -----
 To enable QMP, QEMU has to be started in "control mode". There are
 two ways of doing this, the simplest one is using the the '-qmp'
 command-line option.
 For example:
 $ qemu [...] -qmp tcp:localhost:4444,server
 Will start QEMU in control mode, waiting for a client TCP connection
 on localhost port 4444.
 It is also possible to use the '-mon' command-line option to have
 more complex combinations. Please, refer to the QEMU's manpage for
 more information.
 Simple Testing
 --------------
 To manually test QMP one can connect with telnet and issue commands:
 $ telnet localhost 4444
 Trying 127.0.0.1...
 Connected to localhost.
 Escape character is '^]'.
 {"QMP": {"capabilities": []}}
 { "execute": "query-version" }
 {"return": {"qemu": "0.11.50", "package": ""}}
 Contact
 -------
 http://www.linux-kvm.org/page/MonitorProtocol
 Luiz Fernando N. Capitulino <lcapitulino@redhat.com>
--- a/QMP/qmp-events.txt
+++ b/QMP/qmp-events.txt
@@ -0,0 +1,26 @@
                   QEMU Monitor Protocol: Events
                   =============================
 1 SHUTDOWN
 -----------
 Description: Issued when the Virtual Machine is powered down.
 Data: None.
 2 RESET
 -------
 Description: Issued when the Virtual Machine is reseted.
 Data: None.
 3 STOP
 ------
 Description: Issued when the Virtual Machine is stopped.
 Data: None.
 4 DEBUG
 -------
 Description: Issued when the Virtual Machine enters debug mode.
 Data: None.
--- a/QMP/qmp-shell
+++ b/QMP/qmp-shell
@@ -0,0 +1,72 @@
 #!/usr/bin/python
 #
 # Simple QEMU shell on top of QMP
 #
 # Copyright (C) 2009 Red Hat Inc.
 #
 # Authors:
 #  Luiz Capitulino <lcapitulino@redhat.com>
 #
 # This work is licensed under the terms of the GNU GPL, version 2.  See
 # the COPYING file in the top-level directory.
 #
 # Usage:
 #
 # Start QEMU with:
 #
 # $ qemu [...] -monitor control,unix:./qmp,server
 #
 # Run the shell:
 #
 # $ qmp-shell ./qmp
 #
 # Commands have the following format:
 #
 # < command-name > [ arg-name1=arg1 ] ... [ arg-nameN=argN ]
 #
 # For example:
 #
 # (QEMU) info item=network
 import qmp
 import readline
 from sys import argv,exit
 def shell_help():
    print 'bye  exit from the shell'
 def main():
    if len(argv) != 2:
        print 'qemu-shell <unix-socket>'
        exit(1)
    qemu = qmp.QEMUMonitorProtocol(argv[1])
    qemu.connect()
    print 'Connected!'
    while True:
        try:
            cmd = raw_input('(QEMU) ')
        except EOFError:
            print
            break
        if cmd == '':
            continue
        elif cmd == 'bye':
            break
        elif cmd == 'help':
            shell_help()
        else:
            try:
                resp = qemu.send(cmd)
                if resp == None:
                    print 'Disconnected'
                    break
                print resp
            except IndexError:
                print '-> command format: <command-name> ',
                print '[arg-name1=arg1] ... [arg-nameN=argN]'
 if __name__ == '__main__':
    main()
--- a/QMP/qmp-spec.txt
+++ b/QMP/qmp-spec.txt
@@ -0,0 +1,203 @@
           QEMU Monitor Protocol Specification - Version 0.1
 1. Introduction
 ===============
 This document specifies the QEMU Monitor Protocol (QMP), a JSON-based protocol
 which is available for applications to control QEMU at the machine-level.
 To enable QMP support, QEMU has to be run in "control mode". This is done by
 starting QEMU with the appropriate command-line options. Please, refer to the
 QEMU manual page for more information.
 2. Protocol Specification
 =========================
 This section details the protocol format. For the purpose of this document
 "Client" is any application which is communicating with QEMU in control mode,
 and "Server" is QEMU itself.
 JSON data structures, when mentioned in this document, are always in the
 following format:
    json-DATA-STRUCTURE-NAME
 Where DATA-STRUCTURE-NAME is any valid JSON data structure, as defined by
 the JSON standard:
 http://www.ietf.org/rfc/rfc4627.txt
 For convenience, json-object members and json-array elements mentioned in
 this document will be in a certain order. However, in real protocol usage
 they can be in ANY order, thus no particular order should be assumed.
 2.1 General Definitions
 -----------------------
 2.1.1 All interactions transmitted by the Server are json-objects, always
      terminating with CRLF
 2.1.2 All json-objects members are mandatory when not specified otherwise
 2.2 Server Greeting
 -------------------
 Right when connected the Server will issue a greeting message, which signals
 that the connection has been successfully established and that the Server is
 waiting for commands.
 The format is:
 { "QMP": { "capabilities": json-array } }
 Where,
 - The "capabilities" member specify the availability of features beyond the
  baseline specification
 2.3 Issuing Commands
 --------------------
 The format for command execution is:
 { "execute": json-string, "arguments": json-object, "id": json-value }
 Where,
 - The "execute" member identifies the command to be executed by the Server
 - The "arguments" member is used to pass any arguments required for the
  execution of the command, it is optional when no arguments are required
 - The "id" member is a transaction identification associated with the
  command execution, it is optional and will be part of the response if
  provided
 2.4 Commands Responses
 ----------------------
 There are two possible responses which the Server will issue as the result
 of a command execution: success or error.
 2.4.1 success
 -------------
 The success response is issued when the command execution has finished
 without errors.
 The format is:
 { "return": json-object, "id": json-value }
 Where,
 - The "return" member contains the command returned data, which is defined
  in a per-command basis or an empty json-object if the command does not
  return data
 - The "id" member contains the transaction identification associated
  with the command execution (if issued by the Client)
 2.4.2 error
 -----------
 The error response is issued when the command execution could not be
 completed because of an error condition.
 The format is:
 { "error": { "class": json-string, "data": json-object, "desc": json-string },
  "id": json-value }
 Where,
 - The "class" member contains the error class name (eg. "ServiceUnavailable")
 - The "data" member contains specific error data and is defined in a
  per-command basis, it will be an empty json-object if the error has no data
 - The "desc" member is a human-readable error message. Clients should
  not attempt to parse this message.
 - The "id" member contains the transaction identification associated with
  the command execution (if issued by the Client)
 NOTE: Some errors can occur before the Server is able to read the "id" member,
 in these cases the "id" member will not be part of the error response, even
 if provided by the client.
 2.5 Asynchronous events
 -----------------------
 As a result of state changes, the Server may send messages unilaterally
 to the Client at any time. They are called 'asynchronous events'.
 The format is:
 { "event": json-string, "data": json-object,
  "timestamp": { "seconds": json-number, "microseconds": json-number } }
 Where,
 - The "event" member contains the event's name
 - The "data" member contains event specific data, which is defined in a
  per-event basis, it is optional
 - The "timestamp" member contains the exact time of when the event occurred
  in the Server. It is a fixed json-object with time in seconds and
  microseconds
 For a listing of supported asynchronous events, please, refer to the
 qmp-events.txt file.
 3. QMP Examples
 ===============
 This section provides some examples of real QMP usage, in all of them
 'C' stands for 'Client' and 'S' stands for 'Server'.
 3.1 Server greeting
 -------------------
 S: {"QMP": {"capabilities": []}}
 3.2 Simple 'stop' execution
 ---------------------------
 C: { "execute": "stop" }
 S: {"return": {}}
 3.3 KVM information
 -------------------
 C: { "execute": "query-kvm", "id": "example" }
 S: {"return": {"enabled": true, "present": true}, "id": "example"}
 3.4 Parsing error
 ------------------
 C: { "execute": }
 S: {"error": {"class": "JSONParsing", "desc": "Invalid JSON syntax", "data":
 {}}}
 3.5 Powerdown event
 -------------------
 S: {"timestamp": {"seconds": 1258551470, "microseconds": 802384}, "event":
 "POWERDOWN"}
 4. Compatibility Considerations
 --------------------------------
 In order to achieve maximum compatibility between versions, Clients must not 
 assume any particular:
 - Size of json-objects or length of json-arrays
 - Order of json-object members or json-array elements
 - Amount of errors generated by a command, that is, new errors can be added
  to any existing command in newer versions of the Server
 Additionally, Clients should always:
 - Check the capabilities json-array at connection time
 - Check the availability of commands with 'query-commands' before issuing them
 5. Recommendations to Client implementors
 -----------------------------------------
 5.1 The Server should be always started in pause mode, thus the Client is
    able to perform any setup procedure without the risk of race conditions
    and related problems
--- a/QMP/qmp.py
+++ b/QMP/qmp.py
@@ -0,0 +1,72 @@
 # QEMU Monitor Protocol Python class
 # 
 # Copyright (C) 2009 Red Hat Inc.
 #
 # Authors:
 #  Luiz Capitulino <lcapitulino@redhat.com>
 #
 # This work is licensed under the terms of the GNU GPL, version 2.  See
 # the COPYING file in the top-level directory.
 import socket, json
 class QMPError(Exception):
    pass
 class QMPConnectError(QMPError):
    pass
 class QEMUMonitorProtocol:
    def connect(self):
        self.sock.connect(self.filename)
        data = self.__json_read()
        if data == None:
            raise QMPConnectError
        if not data.has_key('QMP'):
            raise QMPConnectError
        return data['QMP']['capabilities']
    def close(self):
        self.sock.close()
    def send_raw(self, line):
        self.sock.send(str(line))
        return self.__json_read()
    def send(self, cmdline):
        cmd = self.__build_cmd(cmdline)
        self.__json_send(cmd)
        resp = self.__json_read()
        if resp == None:
            return
        elif resp.has_key('error'):
            return resp['error']
        else:
            return resp['return']
    def __build_cmd(self, cmdline):
        cmdargs = cmdline.split()
        qmpcmd = { 'execute': cmdargs[0], 'arguments': {} }
        for arg in cmdargs[1:]:
            opt = arg.split('=')
            try:
                value = int(opt[1])
            except ValueError:
                value = opt[1]
            qmpcmd['arguments'][opt[0]] = value
        return qmpcmd
    def __json_send(self, cmd):
        # XXX: We have to send any additional char, otherwise
        # the Server won't read our input
        self.sock.send(json.dumps(cmd) + ' ')
    def __json_read(self):
        try:
            return json.loads(self.sock.recv(1024))
        except ValueError:
            return
    def __init__(self, filename):
        self.filename = filename
        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
--- a/QMP/vm-info
+++ b/QMP/vm-info
@@ -0,0 +1,32 @@
 #!/usr/bin/python
 #
 # Print Virtual Machine information
 #
 # Usage:
 #
 # Start QEMU with:
 #
 # $ qemu [...] -monitor control,unix:./qmp,server
 #
 # Run vm-info:
 #
 # $ vm-info ./qmp
 #
 # Luiz Capitulino <lcapitulino@redhat.com>
 import qmp
 from sys import argv,exit
 def main():
    if len(argv) != 2:
        print 'vm-info <unix-socket>'
        exit(1)
    qemu = qmp.QEMUMonitorProtocol(argv[1])
    qemu.connect()
    for cmd in [ 'version', 'hpet', 'kvm', 'status', 'uuid', 'balloon' ]:
        print cmd + ': ' + str(qemu.send('query-' + cmd))
 if __name__ == '__main__':
    main()
--- a/3
+++ b/3
@@ -0,0 +1,3 @@
 Read the documentation in qemu-doc.html.
 Fabrice Bellard.
--- a/README.rst
+++ b/README.rst
@@ -1,150 +0,0 @@
 ===========
 QEMU README
 ===========
 QEMU is a generic and open source machine & userspace emulator and
 virtualizer.
 QEMU is capable of emulating a complete machine in software without any
 need for hardware virtualization support. By using dynamic translation,
 it achieves very good performance. QEMU can also integrate with the Xen
 and KVM hypervisors to provide emulated hardware while allowing the
 hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
 near native performance for CPUs. When QEMU emulates CPUs directly it is
 capable of running operating systems made for one machine (e.g. an ARMv7
 board) on a different machine (e.g. an x86_64 PC board).
 QEMU is also capable of providing userspace API virtualization for Linux
 and BSD kernel interfaces. This allows binaries compiled against one
 architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
 different architecture ABI (e.g. the Linux x86_64 ABI). This does not
 involve any hardware emulation, simply CPU and syscall emulation.
 QEMU aims to fit into a variety of use cases. It can be invoked directly
 by users wishing to have full control over its behaviour and settings.
 It also aims to facilitate integration into higher level management
 layers, by providing a stable command line interface and monitor API.
 It is commonly invoked indirectly via the libvirt library when using
 open source applications such as oVirt, OpenStack and virt-manager.
 QEMU as a whole is released under the GNU General Public License,
 version 2. For full licensing details, consult the LICENSE file.
 Building
 ========
 QEMU is multi-platform software intended to be buildable on all modern
 Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
 of other UNIX targets. The simple steps to build QEMU are:
 .. code-block:: shell
  mkdir build
  cd build
  ../configure
  make
 Additional information can also be found online via the QEMU website:
 * `<https://qemu.org/Hosts/Linux>`_
 * `<https://qemu.org/Hosts/Mac>`_
 * `<https://qemu.org/Hosts/W32>`_
 Submitting patches
 ==================
 The QEMU source code is maintained under the GIT version control system.
 .. code-block:: shell
   git clone https://git.qemu.org/git/qemu.git
 When submitting patches, one common approach is to use 'git
 format-patch' and/or 'git send-email' to format & send the mail to the
 qemu-devel@nongnu.org mailing list. All patches submitted must contain
 a 'Signed-off-by' line from the author. Patches should follow the
 guidelines set out in the CODING_STYLE.rst file.
 Additional information on submitting patches can be found online via
 the QEMU website
 * `<https://qemu.org/Contribute/SubmitAPatch>`_
 * `<https://qemu.org/Contribute/TrivialPatches>`_
 The QEMU website is also maintained under source control.
 .. code-block:: shell
  git clone https://git.qemu.org/git/qemu-web.git
 * `<https://www.qemu.org/2017/02/04/the-new-qemu-website-is-up/>`_
 A 'git-publish' utility was created to make above process less
 cumbersome, and is highly recommended for making regular contributions,
 or even just for sending consecutive patch series revisions. It also
 requires a working 'git send-email' setup, and by default doesn't
 automate everything, so you may want to go through the above steps
 manually for once.
 For installation instructions, please go to
 *  `<https://github.com/stefanha/git-publish>`_
 The workflow with 'git-publish' is:
 .. code-block:: shell
  $ git checkout master -b my-feature
  $ # work on new commits, add your 'Signed-off-by' lines to each
  $ git publish
 Your patch series will be sent and tagged as my-feature-v1 if you need to refer
 back to it in the future.
 Sending v2:
 .. code-block:: shell
  $ git checkout my-feature # same topic branch
  $ # making changes to the commits (using 'git rebase', for example)
  $ git publish
 Your patch series will be sent with 'v2' tag in the subject and the git tip
 will be tagged as my-feature-v2.
 Bug reporting
 =============
 The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
 found when running code built from QEMU git or upstream released sources
 should be reported via:
 * `<https://bugs.launchpad.net/qemu/>`_
 If using QEMU via an operating system vendor pre-built binary package, it
 is preferable to report bugs to the vendor's own bug tracker first. If
 the bug is also known to affect latest upstream code, it can also be
 reported via launchpad.
 For additional information on bug reporting consult:
 * `<https://qemu.org/Contribute/ReportABug>`_
 Contact
 =======
 The QEMU community can be contacted in a number of ways, with the two
 main methods being email and IRC
 * `<mailto:qemu-devel@nongnu.org>`_
 * `<https://lists.nongnu.org/mailman/listinfo/qemu-devel>`_
 * #qemu on irc.oftc.net
 Information on additional methods of contacting the community can be
 found online via the QEMU website:
 * `<https://qemu.org/Contribute/StartHere>`_
--- a/37
+++ b/37
@@ -0,0 +1,37 @@
 General:
 -------
 - cycle counter for all archs
 - cpu_interrupt() win32/SMP fix
 - merge PIC spurious interrupt patch
 - warning for OS/2: must not use 128 MB memory (merge bochs cmos patch ?)
 - config file (at least for windows/Mac OS X)
 - update doc: PCI infos.
 - basic VGA optimizations
 - better code fetch
 - do not resize vga if invalid size.
 - TLB code protection support for PPC
 - disable SMC handling for ARM/SPARC/PPC (not finished)
 - see undefined flags for BTx insn
 - keyboard output buffer filling timing emulation
 - tests for each target CPU
 - fix all remaining thread lock issues (must put TBs in a specific invalid
  state, find a solution for tb_flush()).
 ppc specific:
 ------------
 - TLB invalidate not needed if msr_pr changes
 - enable shift optimizations ?
 linux-user specific:
 -------------------
 - remove threading support as it cannot work at this point
 - improve IPC syscalls
 - more syscalls (in particular all 64 bit ones, IPCs, fix 64 bit
  issues, fix 16 bit uid issues)
 - use kernel traps for unaligned accesses on ARM ?
 lower priority:
 --------------
 - int15 ah=86: use better timing
 - use -msoft-float on ARM
--- a/2
+++ b/2
@@ -1 +1 @@
-5.0.92
+0.12.5
--- a/a.out.h
+++ b/a.out.h
@@ -0,0 +1,430 @@
 /* a.out.h
   Copyright 1997, 1998, 1999, 2001 Red Hat, Inc.
 This file is part of Cygwin.
 This software is a copyrighted work licensed under the terms of the
 Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
 details. */
 #ifndef _A_OUT_H_
 #define _A_OUT_H_
 #ifdef __cplusplus
 extern "C" {
 #endif
 #define COFF_IMAGE_WITH_PE
 #define COFF_LONG_SECTION_NAMES
 /*** coff information for Intel 386/486.  */
 /********************** FILE HEADER **********************/
 struct external_filehdr {
  short f_magic;	/* magic number			*/
  short f_nscns;	/* number of sections		*/
  host_ulong f_timdat;	/* time & date stamp		*/
  host_ulong f_symptr;	/* file pointer to symtab	*/
  host_ulong f_nsyms;	/* number of symtab entries	*/
  short f_opthdr;	/* sizeof(optional hdr)		*/
  short f_flags;	/* flags			*/
 };
 /* Bits for f_flags:
 *	F_RELFLG	relocation info stripped from file
 *	F_EXEC		file is executable (no unresolved external references)
 *	F_LNNO		line numbers stripped from file
 *	F_LSYMS		local symbols stripped from file
 *	F_AR32WR	file has byte ordering of an AR32WR machine (e.g. vax)
 */
 #define F_RELFLG	(0x0001)
 #define F_EXEC		(0x0002)
 #define F_LNNO		(0x0004)
 #define F_LSYMS		(0x0008)
 #define	I386MAGIC	0x14c
 #define I386PTXMAGIC	0x154
 #define I386AIXMAGIC	0x175
 /* This is Lynx's all-platform magic number for executables. */
 #define LYNXCOFFMAGIC	0415
 #define I386BADMAG(x) (((x).f_magic != I386MAGIC) \
 		       && (x).f_magic != I386AIXMAGIC \
 		       && (x).f_magic != I386PTXMAGIC \
 		       && (x).f_magic != LYNXCOFFMAGIC)
 #define	FILHDR	struct external_filehdr
 #define	FILHSZ	20
 /********************** AOUT "OPTIONAL HEADER"=
 **********************/
 typedef struct
 {
  unsigned short magic;		/* type of file				*/
  unsigned short vstamp;	/* version stamp			*/
  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
  host_ulong	dsize;		/* initialized data "  "		*/
  host_ulong	bsize;		/* uninitialized data "   "		*/
  host_ulong	entry;		/* entry pt.				*/
  host_ulong text_start;	/* base of text used for this file */
  host_ulong data_start;	/* base of data used for this file=
 */
 }
 AOUTHDR;
 #define AOUTSZ 28
 #define AOUTHDRSZ 28
 #define OMAGIC          0404    /* object files, eg as output */
 #define ZMAGIC          0413    /* demand load format, eg normal ld output */
 #define STMAGIC		0401	/* target shlib */
 #define SHMAGIC		0443	/* host   shlib */
 /* define some NT default values */
 /*  #define NT_IMAGE_BASE        0x400000 moved to internal.h */
 #define NT_SECTION_ALIGNMENT 0x1000
 #define NT_FILE_ALIGNMENT    0x200
 #define NT_DEF_RESERVE       0x100000
 #define NT_DEF_COMMIT        0x1000
 /********************** SECTION HEADER **********************/
 struct external_scnhdr {
  char		s_name[8];	/* section name			*/
  host_ulong	s_paddr;	/* physical address, offset
 				   of last addr in scn */
  host_ulong	s_vaddr;	/* virtual address		*/
  host_ulong	s_size;		/* section size			*/
  host_ulong	s_scnptr;	/* file ptr to raw data for section */
  host_ulong	s_relptr;	/* file ptr to relocation	*/
  host_ulong	s_lnnoptr;	/* file ptr to line numbers	*/
  unsigned short s_nreloc;	/* number of relocation entries	*/
  unsigned short s_nlnno;	/* number of line number entries*/
  host_ulong	s_flags;	/* flags			*/
 };
 #define	SCNHDR	struct external_scnhdr
 #define	SCNHSZ	40
 /*
 * names of "special" sections
 */
 #define _TEXT	".text"
 #define _DATA	".data"
 #define _BSS	".bss"
 #define _COMMENT ".comment"
 #define _LIB ".lib"
 /********************** LINE NUMBERS **********************/
 /* 1 line number entry for every "breakpointable" source line in a section.
 * Line numbers are grouped on a per function basis; first entry in a function
 * grouping will have l_lnno = 0 and in place of physical address will be the
 * symbol table index of the function name.
 */
 struct external_lineno {
  union {
    host_ulong l_symndx; /* function name symbol index, iff l_lnno 0 */
    host_ulong l_paddr;	/* (physical) address of line number	*/
  } l_addr;
  unsigned short l_lnno;	/* line number		*/
 };
 #define	LINENO	struct external_lineno
 #define	LINESZ	6
 /********************** SYMBOLS **********************/
 #define E_SYMNMLEN	8	/* # characters in a symbol name	*/
 #define E_FILNMLEN	14	/* # characters in a file name		*/
 #define E_DIMNUM	4	/* # array dimensions in auxiliary entry */
 struct __attribute__((packed)) external_syment
 {
  union {
    char e_name[E_SYMNMLEN];
    struct {
      host_ulong e_zeroes;
      host_ulong e_offset;
    } e;
  } e;
  host_ulong e_value;
  unsigned short e_scnum;
  unsigned short e_type;
  char e_sclass[1];
  char e_numaux[1];
 };
 #define N_BTMASK	(0xf)
 #define N_TMASK		(0x30)
 #define N_BTSHFT	(4)
 #define N_TSHIFT	(2)
 union external_auxent {
  struct {
    host_ulong x_tagndx;	/* str, un, or enum tag indx */
    union {
      struct {
 	unsigned short  x_lnno; /* declaration line number */
 	unsigned short  x_size; /* str/union/array size */
      } x_lnsz;
      host_ulong x_fsize;	/* size of function */
    } x_misc;
    union {
      struct {			/* if ISFCN, tag, or .bb */
 	host_ulong x_lnnoptr;/* ptr to fcn line # */
 	host_ulong x_endndx;	/* entry ndx past block end */
      } x_fcn;
      struct {			/* if ISARY, up to 4 dimen. */
 	char x_dimen[E_DIMNUM][2];
      } x_ary;
    } x_fcnary;
    unsigned short x_tvndx;	/* tv index */
  } x_sym;
  union {
    char x_fname[E_FILNMLEN];
    struct {
      host_ulong x_zeroes;
      host_ulong x_offset;
    } x_n;
  } x_file;
  struct {
    host_ulong x_scnlen;	/* section length */
    unsigned short x_nreloc;	/* # relocation entries */
    unsigned short x_nlinno;	/* # line numbers */
    host_ulong x_checksum;	/* section COMDAT checksum */
    unsigned short x_associated;/* COMDAT associated section index */
    char x_comdat[1];		/* COMDAT selection number */
  } x_scn;
  struct {
    host_ulong x_tvfill;	/* tv fill value */
    unsigned short x_tvlen;	/* length of .tv */
    char x_tvran[2][2];		/* tv range */
  } x_tv;	/* info about .tv section (in auxent of symbol .tv)) */
 };
 #define	SYMENT	struct external_syment
 #define	SYMESZ	18
 #define	AUXENT	union external_auxent
 #define	AUXESZ	18
 #define _ETEXT	"etext"
 /********************** RELOCATION DIRECTIVES **********************/
 struct external_reloc {
  char r_vaddr[4];
  char r_symndx[4];
  char r_type[2];
 };
 #define RELOC struct external_reloc
 #define RELSZ 10
 /* end of coff/i386.h */
 /* PE COFF header information */
 #ifndef _PE_H
 #define _PE_H
 /* NT specific file attributes */
 #define IMAGE_FILE_RELOCS_STRIPPED           0x0001
 #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
 #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
 #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
 #define IMAGE_FILE_32BIT_MACHINE             0x0100
 #define IMAGE_FILE_DEBUG_STRIPPED            0x0200
 #define IMAGE_FILE_SYSTEM                    0x1000
 #define IMAGE_FILE_DLL                       0x2000
 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
 /* additional flags to be set for section headers to allow the NT loader to
   read and write to the section data (to replace the addresses of data in
   dlls for one thing); also to execute the section in .text's case=
 */
 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
 #define IMAGE_SCN_MEM_EXECUTE     0x20000000
 #define IMAGE_SCN_MEM_READ        0x40000000
 #define IMAGE_SCN_MEM_WRITE       0x80000000
 /*
 * Section characteristics added for ppc-nt
 */
 #define IMAGE_SCN_TYPE_NO_PAD                0x00000008  /* Reserved.  */
 #define IMAGE_SCN_CNT_CODE                   0x00000020  /* Section contains code. */
 #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  /* Section contains initialized data. */
 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  /* Section contains uninitialized data. */
 #define IMAGE_SCN_LNK_OTHER                  0x00000100  /* Reserved.  */
 #define IMAGE_SCN_LNK_INFO                   0x00000200  /* Section contains comments or some other type of information. */
 #define IMAGE_SCN_LNK_REMOVE                 0x00000800  /* Section contents will not become part of image. */
 #define IMAGE_SCN_LNK_COMDAT                 0x00001000  /* Section contents comdat. */
 #define IMAGE_SCN_MEM_FARDATA                0x00008000
 #define IMAGE_SCN_MEM_PURGEABLE              0x00020000
 #define IMAGE_SCN_MEM_16BIT                  0x00020000
 #define IMAGE_SCN_MEM_LOCKED                 0x00040000
 #define IMAGE_SCN_MEM_PRELOAD                0x00080000
 #define IMAGE_SCN_ALIGN_1BYTES               0x00100000
 #define IMAGE_SCN_ALIGN_2BYTES               0x00200000
 #define IMAGE_SCN_ALIGN_4BYTES               0x00300000
 #define IMAGE_SCN_ALIGN_8BYTES               0x00400000
 #define IMAGE_SCN_ALIGN_16BYTES              0x00500000  /* Default alignment if no others are specified. */
 #define IMAGE_SCN_ALIGN_32BYTES              0x00600000
 #define IMAGE_SCN_ALIGN_64BYTES              0x00700000
 #define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  /* Section contains extended relocations. */
 #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  /* Section is not cachable.               */
 #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  /* Section is not pageable.               */
 #define IMAGE_SCN_MEM_SHARED                 0x10000000  /* Section is shareable.                  */
 /* COMDAT selection codes.  */
 #define IMAGE_COMDAT_SELECT_NODUPLICATES     (1) /* Warn if duplicates.  */
 #define IMAGE_COMDAT_SELECT_ANY		     (2) /* No warning.  */
 #define IMAGE_COMDAT_SELECT_SAME_SIZE	     (3) /* Warn if different size.  */
 #define IMAGE_COMDAT_SELECT_EXACT_MATCH	     (4) /* Warn if different.  */
 #define IMAGE_COMDAT_SELECT_ASSOCIATIVE	     (5) /* Base on other section.  */
 /* Magic values that are true for all dos/nt implementations */
 #define DOSMAGIC       0x5a4d
 #define NT_SIGNATURE   0x00004550
 /* NT allows long filenames, we want to accommodate this.  This may break
     some of the bfd functions */
 #undef  FILNMLEN
 #define FILNMLEN	18	/* # characters in a file name		*/
 #ifdef COFF_IMAGE_WITH_PE
 /* The filehdr is only weired in images */
 #undef FILHDR
 struct external_PE_filehdr
 {
  /* DOS header fields */
  unsigned short e_magic;	/* Magic number, 0x5a4d */
  unsigned short e_cblp;	/* Bytes on last page of file, 0x90 */
  unsigned short e_cp;		/* Pages in file, 0x3 */
  unsigned short e_crlc;	/* Relocations, 0x0 */
  unsigned short e_cparhdr;	/* Size of header in paragraphs, 0x4 */
  unsigned short e_minalloc;	/* Minimum extra paragraphs needed, 0x0 */
  unsigned short e_maxalloc;	/* Maximum extra paragraphs needed, 0xFFFF */
  unsigned short e_ss;		/* Initial (relative) SS value, 0x0 */
  unsigned short e_sp;		/* Initial SP value, 0xb8 */
  unsigned short e_csum;	/* Checksum, 0x0 */
  unsigned short e_ip;		/* Initial IP value, 0x0 */
  unsigned short e_cs;		/* Initial (relative) CS value, 0x0 */
  unsigned short e_lfarlc;	/* File address of relocation table, 0x40 */
  unsigned short e_ovno;	/* Overlay number, 0x0 */
  char e_res[4][2];		/* Reserved words, all 0x0 */
  unsigned short e_oemid;	/* OEM identifier (for e_oeminfo), 0x0 */
  unsigned short e_oeminfo;	/* OEM information; e_oemid specific, 0x0 */
  char e_res2[10][2];		/* Reserved words, all 0x0 */
  host_ulong e_lfanew;	/* File address of new exe header, 0x80 */
  char dos_message[16][4];	/* other stuff, always follow DOS header */
  unsigned int nt_signature;	/* required NT signature, 0x4550 */
  /* From standard header */
  unsigned short f_magic;	/* magic number			*/
  unsigned short f_nscns;	/* number of sections		*/
  host_ulong f_timdat;	/* time & date stamp		*/
  host_ulong f_symptr;	/* file pointer to symtab	*/
  host_ulong f_nsyms;	/* number of symtab entries	*/
  unsigned short f_opthdr;	/* sizeof(optional hdr)		*/
  unsigned short f_flags;	/* flags			*/
 };
 #define FILHDR struct external_PE_filehdr
 #undef FILHSZ
 #define FILHSZ 152
 #endif
 typedef struct
 {
  unsigned short magic;		/* type of file				*/
  unsigned short vstamp;	/* version stamp			*/
  host_ulong	tsize;		/* text size in bytes, padded to FW bdry*/
  host_ulong	dsize;		/* initialized data "  "		*/
  host_ulong	bsize;		/* uninitialized data "   "		*/
  host_ulong	entry;		/* entry pt.				*/
  host_ulong text_start;	/* base of text used for this file */
  host_ulong data_start;	/* base of all data used for this file */
  /* NT extra fields; see internal.h for descriptions */
  host_ulong  ImageBase;
  host_ulong  SectionAlignment;
  host_ulong  FileAlignment;
  unsigned short  MajorOperatingSystemVersion;
  unsigned short  MinorOperatingSystemVersion;
  unsigned short  MajorImageVersion;
  unsigned short  MinorImageVersion;
  unsigned short  MajorSubsystemVersion;
  unsigned short  MinorSubsystemVersion;
  char  Reserved1[4];
  host_ulong  SizeOfImage;
  host_ulong  SizeOfHeaders;
  host_ulong  CheckSum;
  unsigned short Subsystem;
  unsigned short DllCharacteristics;
  host_ulong  SizeOfStackReserve;
  host_ulong  SizeOfStackCommit;
  host_ulong  SizeOfHeapReserve;
  host_ulong  SizeOfHeapCommit;
  host_ulong  LoaderFlags;
  host_ulong  NumberOfRvaAndSizes;
  /* IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; */
  char  DataDirectory[16][2][4]; /* 16 entries, 2 elements/entry, 4 chars */
 } PEAOUTHDR;
 #undef AOUTSZ
 #define AOUTSZ (AOUTHDRSZ + 196)
 #undef  E_FILNMLEN
 #define E_FILNMLEN	18	/* # characters in a file name		*/
 #endif
 /* end of coff/pe.h */
 #define DT_NON		(0)	/* no derived type */
 #define DT_PTR		(1)	/* pointer */
 #define DT_FCN		(2)	/* function */
 #define DT_ARY		(3)	/* array */
 #define ISPTR(x)	(((x) & N_TMASK) == (DT_PTR << N_BTSHFT))
 #define ISFCN(x)	(((x) & N_TMASK) == (DT_FCN << N_BTSHFT))
 #define ISARY(x)	(((x) & N_TMASK) == (DT_ARY << N_BTSHFT))
 #ifdef __cplusplus
 }
 #endif
 #endif /* _A_OUT_H_ */
--- a/accel/Kconfig
+++ b/accel/Kconfig
@@ -1,9 +0,0 @@
 config TCG
    bool
 config KVM
    bool
 config XEN
    bool
    select FSDEV_9P if VIRTFS
--- a/accel/Makefile.objs
+++ b/accel/Makefile.objs
@@ -1,6 +0,0 @@
 common-obj-$(CONFIG_SOFTMMU) += accel.o
 obj-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_POSIX)) += qtest.o
 obj-$(CONFIG_KVM) += kvm/
 obj-$(CONFIG_TCG) += tcg/
 obj-$(CONFIG_XEN) += xen/
 obj-y += stubs/
--- a/accel/accel.c
+++ b/accel/accel.c
@@ -1,85 +0,0 @@
 /*
 * QEMU System Emulator, accelerator interfaces
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 * Copyright (c) 2014 Red Hat Inc.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "sysemu/accel.h"
 #include "hw/boards.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
 #include "qom/object.h"
 static const TypeInfo accel_type = {
    .name = TYPE_ACCEL,
    .parent = TYPE_OBJECT,
    .class_size = sizeof(AccelClass),
    .instance_size = sizeof(AccelState),
 };
 /* Lookup AccelClass from opt_name. Returns NULL if not found */
 AccelClass *accel_find(const char *opt_name)
 {
    char *class_name = g_strdup_printf(ACCEL_CLASS_NAME("%s"), opt_name);
    AccelClass *ac = ACCEL_CLASS(object_class_by_name(class_name));
    g_free(class_name);
    return ac;
 }
 int accel_init_machine(AccelState *accel, MachineState *ms)
 {
    AccelClass *acc = ACCEL_GET_CLASS(accel);
    int ret;
    ms->accelerator = accel;
    *(acc->allowed) = true;
    ret = acc->init_machine(ms);
    if (ret < 0) {
        ms->accelerator = NULL;
        *(acc->allowed) = false;
        object_unref(OBJECT(accel));
    } else {
        object_set_accelerator_compat_props(acc->compat_props);
    }
    return ret;
 }
 AccelState *current_accel(void)
 {
    return current_machine->accelerator;
 }
 void accel_setup_post(MachineState *ms)
 {
    AccelState *accel = ms->accelerator;
    AccelClass *acc = ACCEL_GET_CLASS(accel);
    if (acc->setup_post) {
        acc->setup_post(ms, accel);
    }
 }
 static void register_accel_types(void)
 {
    type_register_static(&accel_type);
 }
 type_init(register_accel_types);
--- a/accel/kvm/Makefile.objs
+++ b/accel/kvm/Makefile.objs
@@ -1,2 +0,0 @@
 obj-y += kvm-all.o
 obj-$(call lnot,$(CONFIG_SEV)) += sev-stub.o
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
--- a/accel/kvm/sev-stub.c
+++ b/accel/kvm/sev-stub.c
@@ -1,26 +0,0 @@
 /*
 * QEMU SEV stub
 *
 * Copyright Advanced Micro Devices 2018
 *
 * Authors:
 *      Brijesh Singh <brijesh.singh@amd.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "sysemu/sev.h"
 int sev_encrypt_data(void *handle, uint8_t *ptr, uint64_t len)
 {
    abort();
 }
 void *sev_guest_init(const char *id)
 {
    return NULL;
 }
--- a/accel/kvm/trace-events
+++ b/accel/kvm/trace-events
@@ -1,20 +0,0 @@
 # See docs/devel/tracing.txt for syntax documentation.
 # kvm-all.c
 kvm_ioctl(int type, void *arg) "type 0x%x, arg %p"
 kvm_vm_ioctl(int type, void *arg) "type 0x%x, arg %p"
 kvm_vcpu_ioctl(int cpu_index, int type, void *arg) "cpu_index %d, type 0x%x, arg %p"
 kvm_run_exit(int cpu_index, uint32_t reason) "cpu_index %d, reason %d"
 kvm_device_ioctl(int fd, int type, void *arg) "dev fd %d, type 0x%x, arg %p"
 kvm_failed_reg_get(uint64_t id, const char *msg) "Warning: Unable to retrieve ONEREG %" PRIu64 " from KVM: %s"
 kvm_failed_reg_set(uint64_t id, const char *msg) "Warning: Unable to set ONEREG %" PRIu64 " to KVM: %s"
 kvm_irqchip_commit_routes(void) ""
 kvm_irqchip_add_msi_route(char *name, int vector, int virq) "dev %s vector %d virq %d"
 kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
 kvm_irqchip_release_virq(int virq) "virq %d"
 kvm_set_ioeventfd_mmio(int fd, uint64_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%" PRIx64 " val=0x%x assign: %d size: %d match: %d"
 kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%x val=0x%x assign: %d size: %d match: %d"
 kvm_set_user_memory(uint32_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"
 kvm_clear_dirty_log(uint32_t slot, uint64_t start, uint32_t size) "slot#%"PRId32" start 0x%"PRIx64" size 0x%"PRIx32
 kvm_resample_fd_notify(int gsi) "gsi %d"
--- a/accel/qtest.c
+++ b/accel/qtest.c
@@ -1,54 +0,0 @@
 /*
 * QTest accelerator code
 *
 * Copyright IBM, Corp. 2011
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/config-file.h"
 #include "sysemu/accel.h"
 #include "sysemu/qtest.h"
 #include "sysemu/cpus.h"
 static int qtest_init_accel(MachineState *ms)
 {
    QemuOpts *opts = qemu_opts_create(qemu_find_opts("icount"), NULL, 0,
                                      &error_abort);
    qemu_opt_set(opts, "shift", "0", &error_abort);
    configure_icount(opts, &error_abort);
    qemu_opts_del(opts);
    return 0;
 }
 static void qtest_accel_class_init(ObjectClass *oc, void *data)
 {
    AccelClass *ac = ACCEL_CLASS(oc);
    ac->name = "QTest";
    ac->init_machine = qtest_init_accel;
    ac->allowed = &qtest_allowed;
 }
 #define TYPE_QTEST_ACCEL ACCEL_CLASS_NAME("qtest")
 static const TypeInfo qtest_accel_type = {
    .name = TYPE_QTEST_ACCEL,
    .parent = TYPE_ACCEL,
    .class_init = qtest_accel_class_init,
 };
 static void qtest_type_init(void)
 {
    type_register_static(&qtest_accel_type);
 }
 type_init(qtest_type_init);
--- a/accel/stubs/Makefile.objs
+++ b/accel/stubs/Makefile.objs
@@ -1,6 +0,0 @@
 obj-$(call lnot,$(CONFIG_HAX))  += hax-stub.o
 obj-$(call lnot,$(CONFIG_HVF))  += hvf-stub.o
 obj-$(call lnot,$(CONFIG_WHPX)) += whpx-stub.o
 obj-$(call lnot,$(CONFIG_KVM))  += kvm-stub.o
 obj-$(call lnot,$(CONFIG_TCG))  += tcg-stub.o
 obj-$(call lnot,$(CONFIG_XEN))  += xen-stub.o
--- a/accel/stubs/hax-stub.c
+++ b/accel/stubs/hax-stub.c
@@ -1,33 +0,0 @@
 /*
 * QEMU HAXM support
 *
 * Copyright (c) 2015, Intel Corporation
 *
 * Copyright 2016 Google, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "sysemu/hax.h"
 int hax_sync_vcpus(void)
 {
    return 0;
 }
 int hax_init_vcpu(CPUState *cpu)
 {
    return -ENOSYS;
 }
 int hax_smp_cpu_exec(CPUState *cpu)
 {
    return -ENOSYS;
 }
--- a/accel/stubs/hvf-stub.c
+++ b/accel/stubs/hvf-stub.c
@@ -1,30 +0,0 @@
 /*
 * QEMU HVF support
 *
 * Copyright 2017 Red Hat, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2 or later, as published by the Free Software Foundation,
 * and may be copied, distributed, and modified under those terms.
 *
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "sysemu/hvf.h"
 int hvf_init_vcpu(CPUState *cpu)
 {
    return -ENOSYS;
 }
 int hvf_vcpu_exec(CPUState *cpu)
 {
    return -ENOSYS;
 }
 void hvf_vcpu_destroy(CPUState *cpu)
 {
 }
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -1,184 +0,0 @@
 /*
 * QEMU KVM stub
 *
 * Copyright Red Hat, Inc. 2010
 *
 * Author: Paolo Bonzini     <pbonzini@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "sysemu/kvm.h"
 #ifndef CONFIG_USER_ONLY
 #include "hw/pci/msi.h"
 #endif
 KVMState *kvm_state;
 bool kvm_kernel_irqchip;
 bool kvm_async_interrupts_allowed;
 bool kvm_eventfds_allowed;
 bool kvm_irqfds_allowed;
 bool kvm_resamplefds_allowed;
 bool kvm_msi_via_irqfd_allowed;
 bool kvm_gsi_routing_allowed;
 bool kvm_gsi_direct_mapping;
 bool kvm_allowed;
 bool kvm_readonly_mem_allowed;
 bool kvm_ioeventfd_any_length_allowed;
 bool kvm_msi_use_devid;
 int kvm_destroy_vcpu(CPUState *cpu)
 {
    return -ENOSYS;
 }
 int kvm_init_vcpu(CPUState *cpu)
 {
    return -ENOSYS;
 }
 void kvm_flush_coalesced_mmio_buffer(void)
 {
 }
 void kvm_cpu_synchronize_state(CPUState *cpu)
 {
 }
 void kvm_cpu_synchronize_post_reset(CPUState *cpu)
 {
 }
 void kvm_cpu_synchronize_post_init(CPUState *cpu)
 {
 }
 int kvm_cpu_exec(CPUState *cpu)
 {
    abort();
 }
 bool kvm_has_sync_mmu(void)
 {
    return false;
 }
 int kvm_has_many_ioeventfds(void)
 {
    return 0;
 }
 int kvm_update_guest_debug(CPUState *cpu, unsigned long reinject_trap)
 {
    return -ENOSYS;
 }
 int kvm_insert_breakpoint(CPUState *cpu, target_ulong addr,
                          target_ulong len, int type)
 {
    return -EINVAL;
 }
 int kvm_remove_breakpoint(CPUState *cpu, target_ulong addr,
                          target_ulong len, int type)
 {
    return -EINVAL;
 }
 void kvm_remove_all_breakpoints(CPUState *cpu)
 {
 }
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
 {
    return 1;
 }
 int kvm_on_sigbus(int code, void *addr)
 {
    return 1;
 }
 bool kvm_memcrypt_enabled(void)
 {
    return false;
 }
 int kvm_memcrypt_encrypt_data(uint8_t *ptr, uint64_t len)
 {
  return 1;
 }
 #ifndef CONFIG_USER_ONLY
 int kvm_irqchip_add_msi_route(KVMState *s, int vector, PCIDevice *dev)
 {
    return -ENOSYS;
 }
 void kvm_init_irq_routing(KVMState *s)
 {
 }
 void kvm_irqchip_release_virq(KVMState *s, int virq)
 {
 }
 int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg,
                                 PCIDevice *dev)
 {
    return -ENOSYS;
 }
 void kvm_irqchip_commit_routes(KVMState *s)
 {
 }
 void kvm_irqchip_add_change_notifier(Notifier *n)
 {
 }
 void kvm_irqchip_remove_change_notifier(Notifier *n)
 {
 }
 void kvm_irqchip_change_notify(void)
 {
 }
 int kvm_irqchip_add_adapter_route(KVMState *s, AdapterInfo *adapter)
 {
    return -ENOSYS;
 }
 int kvm_irqchip_add_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
                                       EventNotifier *rn, int virq)
 {
    return -ENOSYS;
 }
 int kvm_irqchip_remove_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
                                          int virq)
 {
    return -ENOSYS;
 }
 bool kvm_has_free_slot(MachineState *ms)
 {
    return false;
 }
 void kvm_init_cpu_signals(CPUState *cpu)
 {
    abort();
 }
 bool kvm_arm_supports_user_irq(void)
 {
    return false;
 }
 #endif
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -1,31 +0,0 @@
 /*
 * QEMU TCG accelerator stub
 *
 * Copyright Red Hat, Inc. 2013
 *
 * Author: Paolo Bonzini     <pbonzini@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "tcg/tcg.h"
 #include "exec/exec-all.h"
 void tb_flush(CPUState *cpu)
 {
 }
 void tlb_set_dirty(CPUState *cpu, target_ulong vaddr)
 {
 }
 void *probe_access(CPUArchState *env, target_ulong addr, int size,
                   MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 {
     /* Handled by hardware accelerator. */
     g_assert_not_reached();
 }
--- a/accel/stubs/whpx-stub.c
+++ b/accel/stubs/whpx-stub.c
@@ -1,47 +0,0 @@
 /*
 * QEMU Windows Hypervisor Platform accelerator (WHPX) stub
 *
 * Copyright Microsoft Corp. 2017
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 *
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "sysemu/whpx.h"
 int whpx_init_vcpu(CPUState *cpu)
 {
    return -1;
 }
 int whpx_vcpu_exec(CPUState *cpu)
 {
    return -1;
 }
 void whpx_destroy_vcpu(CPUState *cpu)
 {
 }
 void whpx_vcpu_kick(CPUState *cpu)
 {
 }
 void whpx_cpu_synchronize_state(CPUState *cpu)
 {
 }
 void whpx_cpu_synchronize_post_reset(CPUState *cpu)
 {
 }
 void whpx_cpu_synchronize_post_init(CPUState *cpu)
 {
 }
 void whpx_cpu_synchronize_pre_loadvm(CPUState *cpu)
 {
 }
--- a/accel/stubs/xen-stub.c
+++ b/accel/stubs/xen-stub.c
@@ -1,53 +0,0 @@
 /*
 * Copyright (C) 2014       Citrix Systems UK Ltd.
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "hw/xen/xen.h"
 #include "qapi/qapi-commands-misc.h"
 void xenstore_store_pv_console_info(int i, Chardev *chr)
 {
 }
 int xen_pci_slot_get_pirq(PCIDevice *pci_dev, int irq_num)
 {
    return -1;
 }
 void xen_piix3_set_irq(void *opaque, int irq_num, int level)
 {
 }
 void xen_piix_pci_write_config_client(uint32_t address, uint32_t val, int len)
 {
 }
 void xen_hvm_inject_msi(uint64_t addr, uint32_t data)
 {
 }
 int xen_is_pirq_msi(uint32_t msi_data)
 {
    return 0;
 }
 qemu_irq *xen_interrupt_controller_init(void)
 {
    return NULL;
 }
 void xen_register_framebuffer(MemoryRegion *mr)
 {
 }
 void xen_hvm_init(PCMachineState *pcms, MemoryRegion **ram_memory)
 {
 }
 void qmp_xen_set_global_dirty_log(bool enable, Error **errp)
 {
 }
--- a/accel/tcg/Makefile.objs
+++ b/accel/tcg/Makefile.objs
@@ -1,9 +0,0 @@
 obj-$(CONFIG_SOFTMMU) += tcg-all.o
 obj-$(CONFIG_SOFTMMU) += cputlb.o
 obj-y += tcg-runtime.o tcg-runtime-gvec.o
 obj-y += cpu-exec.o cpu-exec-common.o translate-all.o
 obj-y += translator.o
 obj-$(CONFIG_USER_ONLY) += user-exec.o
 obj-$(call lnot,$(CONFIG_SOFTMMU)) += user-exec-stub.o
 obj-$(CONFIG_PLUGIN) += plugin-gen.o
--- a/accel/tcg/atomic_common.inc.c
+++ b/accel/tcg/atomic_common.inc.c
@@ -1,54 +0,0 @@
 /*
 * Common Atomic Helper Functions
 *
 * This file should be included before the various instantiations of
 * the atomic_template.h helpers.
 *
 * Copyright (c) 2019 Linaro
 * Written by Alex Bennée <alex.bennee@linaro.org>
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 static inline
 void atomic_trace_rmw_pre(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    CPUState *cpu = env_cpu(env);
    trace_guest_mem_before_exec(cpu, addr, info);
    trace_guest_mem_before_exec(cpu, addr, info | TRACE_MEM_ST);
 }
 static inline void
 atomic_trace_rmw_post(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, info);
    qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, info | TRACE_MEM_ST);
 }
 static inline
 void atomic_trace_ld_pre(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    trace_guest_mem_before_exec(env_cpu(env), addr, info);
 }
 static inline
 void atomic_trace_ld_post(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, info);
 }
 static inline
 void atomic_trace_st_pre(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    trace_guest_mem_before_exec(env_cpu(env), addr, info);
 }
 static inline
 void atomic_trace_st_post(CPUArchState *env, target_ulong addr, uint16_t info)
 {
    qemu_plugin_vcpu_mem_cb(env_cpu(env), addr, info);
 }
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -1,371 +0,0 @@
 /*
 * Atomic helper templates
 * Included from tcg-runtime.c and cputlb.c.
 *
 * Copyright (c) 2016 Red Hat, Inc
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
 #include "qemu/plugin.h"
 #include "trace/mem.h"
 #if DATA_SIZE == 16
 # define SUFFIX     o
 # define DATA_TYPE  Int128
 # define BSWAP      bswap128
 # define SHIFT      4
 #elif DATA_SIZE == 8
 # define SUFFIX     q
 # define DATA_TYPE  uint64_t
 # define SDATA_TYPE int64_t
 # define BSWAP      bswap64
 # define SHIFT      3
 #elif DATA_SIZE == 4
 # define SUFFIX     l
 # define DATA_TYPE  uint32_t
 # define SDATA_TYPE int32_t
 # define BSWAP      bswap32
 # define SHIFT      2
 #elif DATA_SIZE == 2
 # define SUFFIX     w
 # define DATA_TYPE  uint16_t
 # define SDATA_TYPE int16_t
 # define BSWAP      bswap16
 # define SHIFT      1
 #elif DATA_SIZE == 1
 # define SUFFIX     b
 # define DATA_TYPE  uint8_t
 # define SDATA_TYPE int8_t
 # define BSWAP
 # define SHIFT      0
 #else
 # error unsupported data size
 #endif
 #if DATA_SIZE >= 4
 # define ABI_TYPE  DATA_TYPE
 #else
 # define ABI_TYPE  uint32_t
 #endif
 /* Define host-endian atomic operations.  Note that END is used within
   the ATOMIC_NAME macro, and redefined below.  */
 #if DATA_SIZE == 1
 # define END
 #elif defined(HOST_WORDS_BIGENDIAN)
 # define END  _be
 #else
 # define END  _le
 #endif
 ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    DATA_TYPE ret;
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_rmw_pre(env, addr, info);
 #if DATA_SIZE == 16
    ret = atomic16_cmpxchg(haddr, cmpv, newv);
 #else
    ret = atomic_cmpxchg__nocheck(haddr, cmpv, newv);
 #endif
    ATOMIC_MMU_CLEANUP;
    atomic_trace_rmw_post(env, addr, info);
    return ret;
 }
 #if DATA_SIZE >= 16
 #if HAVE_ATOMIC128
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_ld_pre(env, addr, info);
    val = atomic16_read(haddr);
    ATOMIC_MMU_CLEANUP;
    atomic_trace_ld_post(env, addr, info);
    return val;
 }
 void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                     ABI_TYPE val EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, true,
                                         ATOMIC_MMU_IDX);
    atomic_trace_st_pre(env, addr, info);
    atomic16_set(haddr, val);
    ATOMIC_MMU_CLEANUP;
    atomic_trace_st_post(env, addr, info);
 }
 #endif
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                           ABI_TYPE val EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    DATA_TYPE ret;
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_rmw_pre(env, addr, info);
    ret = atomic_xchg__nocheck(haddr, val);
    ATOMIC_MMU_CLEANUP;
    atomic_trace_rmw_post(env, addr, info);
    return ret;
 }
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                        ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
    ATOMIC_MMU_DECLS;                                               \
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
    DATA_TYPE ret;                                                  \
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                         ATOMIC_MMU_IDX);           \
    atomic_trace_rmw_pre(env, addr, info);                          \
    ret = atomic_##X(haddr, val);                                   \
    ATOMIC_MMU_CLEANUP;                                             \
    atomic_trace_rmw_post(env, addr, info);                         \
    return ret;                                                     \
 }
 GEN_ATOMIC_HELPER(fetch_add)
 GEN_ATOMIC_HELPER(fetch_and)
 GEN_ATOMIC_HELPER(fetch_or)
 GEN_ATOMIC_HELPER(fetch_xor)
 GEN_ATOMIC_HELPER(add_fetch)
 GEN_ATOMIC_HELPER(and_fetch)
 GEN_ATOMIC_HELPER(or_fetch)
 GEN_ATOMIC_HELPER(xor_fetch)
 #undef GEN_ATOMIC_HELPER
 /* These helpers are, as a whole, full barriers.  Within the helper,
 * the leading barrier is explicit and the trailing barrier is within
 * cmpxchg primitive.
 *
 * Trace this load + RMW loop as a single RMW op. This way, regardless
 * of CF_PARALLEL's value, we'll trace just a read and a write.
 */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                        ABI_TYPE xval EXTRA_ARGS)                   \
 {                                                                   \
    ATOMIC_MMU_DECLS;                                               \
    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
    XDATA_TYPE cmp, old, new, val = xval;                           \
    uint16_t info = trace_mem_build_info(SHIFT, false, 0, false,    \
                                         ATOMIC_MMU_IDX);           \
    atomic_trace_rmw_pre(env, addr, info);                          \
    smp_mb();                                                       \
    cmp = atomic_read__nocheck(haddr);                              \
    do {                                                            \
        old = cmp; new = FN(old, val);                              \
        cmp = atomic_cmpxchg__nocheck(haddr, old, new);             \
    } while (cmp != old);                                           \
    ATOMIC_MMU_CLEANUP;                                             \
    atomic_trace_rmw_post(env, addr, info);                         \
    return RET;                                                     \
 }
 GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 #undef GEN_ATOMIC_HELPER_FN
 #endif /* DATA SIZE >= 16 */
 #undef END
 #if DATA_SIZE > 1
 /* Define reverse-host-endian atomic operations.  Note that END is used
   within the ATOMIC_NAME macro.  */
 #ifdef HOST_WORDS_BIGENDIAN
 # define END  _le
 #else
 # define END  _be
 #endif
 ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, target_ulong addr,
                              ABI_TYPE cmpv, ABI_TYPE newv EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    DATA_TYPE ret;
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_rmw_pre(env, addr, info);
 #if DATA_SIZE == 16
    ret = atomic16_cmpxchg(haddr, BSWAP(cmpv), BSWAP(newv));
 #else
    ret = atomic_cmpxchg__nocheck(haddr, BSWAP(cmpv), BSWAP(newv));
 #endif
    ATOMIC_MMU_CLEANUP;
    atomic_trace_rmw_post(env, addr, info);
    return BSWAP(ret);
 }
 #if DATA_SIZE >= 16
 #if HAVE_ATOMIC128
 ABI_TYPE ATOMIC_NAME(ld)(CPUArchState *env, target_ulong addr EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE val, *haddr = ATOMIC_MMU_LOOKUP;
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_ld_pre(env, addr, info);
    val = atomic16_read(haddr);
    ATOMIC_MMU_CLEANUP;
    atomic_trace_ld_post(env, addr, info);
    return BSWAP(val);
 }
 void ATOMIC_NAME(st)(CPUArchState *env, target_ulong addr,
                     ABI_TYPE val EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, true,
                                         ATOMIC_MMU_IDX);
    val = BSWAP(val);
    atomic_trace_st_pre(env, addr, info);
    val = BSWAP(val);
    atomic16_set(haddr, val);
    ATOMIC_MMU_CLEANUP;
    atomic_trace_st_post(env, addr, info);
 }
 #endif
 #else
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
                           ABI_TYPE val EXTRA_ARGS)
 {
    ATOMIC_MMU_DECLS;
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
    ABI_TYPE ret;
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP, false,
                                         ATOMIC_MMU_IDX);
    atomic_trace_rmw_pre(env, addr, info);
    ret = atomic_xchg__nocheck(haddr, BSWAP(val));
    ATOMIC_MMU_CLEANUP;
    atomic_trace_rmw_post(env, addr, info);
    return BSWAP(ret);
 }
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                        ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
    ATOMIC_MMU_DECLS;                                               \
    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
    DATA_TYPE ret;                                                  \
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                         false, ATOMIC_MMU_IDX);    \
    atomic_trace_rmw_pre(env, addr, info);                          \
    ret = atomic_##X(haddr, BSWAP(val));                            \
    ATOMIC_MMU_CLEANUP;                                             \
    atomic_trace_rmw_post(env, addr, info);                         \
    return BSWAP(ret);                                              \
 }
 GEN_ATOMIC_HELPER(fetch_and)
 GEN_ATOMIC_HELPER(fetch_or)
 GEN_ATOMIC_HELPER(fetch_xor)
 GEN_ATOMIC_HELPER(and_fetch)
 GEN_ATOMIC_HELPER(or_fetch)
 GEN_ATOMIC_HELPER(xor_fetch)
 #undef GEN_ATOMIC_HELPER
 /* These helpers are, as a whole, full barriers.  Within the helper,
 * the leading barrier is explicit and the trailing barrier is within
 * cmpxchg primitive.
 *
 * Trace this load + RMW loop as a single RMW op. This way, regardless
 * of CF_PARALLEL's value, we'll trace just a read and a write.
 */
 #define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
                        ABI_TYPE xval EXTRA_ARGS)                   \
 {                                                                   \
    ATOMIC_MMU_DECLS;                                               \
    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
    XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
    uint16_t info = trace_mem_build_info(SHIFT, false, MO_BSWAP,    \
                                         false, ATOMIC_MMU_IDX);    \
    atomic_trace_rmw_pre(env, addr, info);                          \
    smp_mb();                                                       \
    ldn = atomic_read__nocheck(haddr);                              \
    do {                                                            \
        ldo = ldn; old = BSWAP(ldo); new = FN(old, val);            \
        ldn = atomic_cmpxchg__nocheck(haddr, ldo, BSWAP(new));      \
    } while (ldo != ldn);                                           \
    ATOMIC_MMU_CLEANUP;                                             \
    atomic_trace_rmw_post(env, addr, info);                         \
    return RET;                                                     \
 }
 GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 /* Note that for addition, we need to use a separate cmpxchg loop instead
   of bswaps for the reverse-host-endian helpers.  */
 #define ADD(X, Y)   (X + Y)
 GEN_ATOMIC_HELPER_FN(fetch_add, ADD, DATA_TYPE, old)
 GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
 #undef ADD
 #undef GEN_ATOMIC_HELPER_FN
 #endif /* DATA_SIZE >= 16 */
 #undef END
 #endif /* DATA_SIZE > 1 */
 #undef BSWAP
 #undef ABI_TYPE
 #undef DATA_TYPE
 #undef SDATA_TYPE
 #undef SUFFIX
 #undef DATA_SIZE
 #undef SHIFT
--- a/accel/tcg/cpu-exec-common.c
+++ b/accel/tcg/cpu-exec-common.c
@@ -1,84 +0,0 @@
 /*
 *  emulator main execution loop
 *
 *  Copyright (c) 2003-2005 Fabrice Bellard
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "sysemu/cpus.h"
 #include "sysemu/tcg.h"
 #include "exec/exec-all.h"
 bool tcg_allowed;
 /* exit the current TB, but without causing any exception to be raised */
 void cpu_loop_exit_noexc(CPUState *cpu)
 {
    cpu->exception_index = -1;
    cpu_loop_exit(cpu);
 }
 #if defined(CONFIG_SOFTMMU)
 void cpu_reloading_memory_map(void)
 {
    if (qemu_in_vcpu_thread() && current_cpu->running) {
        /* The guest can in theory prolong the RCU critical section as long
         * as it feels like. The major problem with this is that because it
         * can do multiple reconfigurations of the memory map within the
         * critical section, we could potentially accumulate an unbounded
         * collection of memory data structures awaiting reclamation.
         *
         * Because the only thing we're currently protecting with RCU is the
         * memory data structures, it's sufficient to break the critical section
         * in this callback, which we know will get called every time the
         * memory map is rearranged.
         *
         * (If we add anything else in the system that uses RCU to protect
         * its data structures, we will need to implement some other mechanism
         * to force TCG CPUs to exit the critical section, at which point this
         * part of this callback might become unnecessary.)
         *
         * This pair matches cpu_exec's rcu_read_lock()/rcu_read_unlock(), which
         * only protects cpu->as->dispatch. Since we know our caller is about
         * to reload it, it's safe to split the critical section.
         */
        rcu_read_unlock();
        rcu_read_lock();
    }
 }
 #endif
 void cpu_loop_exit(CPUState *cpu)
 {
    /* Undo the setting in cpu_tb_exec.  */
    cpu->can_do_io = 1;
    siglongjmp(cpu->jmp_env, 1);
 }
 void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
 {
    if (pc) {
        cpu_restore_state(cpu, pc, true);
    }
    cpu_loop_exit(cpu);
 }
 void cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc)
 {
    cpu->exception_index = EXCP_ATOMIC;
    cpu_loop_exit_restore(cpu, pc);
 }
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -1,760 +0,0 @@
 /*
 *  emulator main execution loop
 *
 *  Copyright (c) 2003-2005 Fabrice Bellard
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "cpu.h"
 #include "trace.h"
 #include "disas/disas.h"
 #include "exec/exec-all.h"
 #include "tcg/tcg.h"
 #include "qemu/atomic.h"
 #include "sysemu/qtest.h"
 #include "qemu/timer.h"
 #include "qemu/rcu.h"
 #include "exec/tb-hash.h"
 #include "exec/tb-lookup.h"
 #include "exec/log.h"
 #include "qemu/main-loop.h"
 #if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
 #include "hw/i386/apic.h"
 #endif
 #include "sysemu/cpus.h"
 #include "sysemu/replay.h"
 /* -icount align implementation. */
 typedef struct SyncClocks {
    int64_t diff_clk;
    int64_t last_cpu_icount;
    int64_t realtime_clock;
 } SyncClocks;
 #if !defined(CONFIG_USER_ONLY)
 /* Allow the guest to have a max 3ms advance.
 * The difference between the 2 clocks could therefore
 * oscillate around 0.
 */
 #define VM_CLOCK_ADVANCE 3000000
 #define THRESHOLD_REDUCE 1.5
 #define MAX_DELAY_PRINT_RATE 2000000000LL
 #define MAX_NB_PRINTS 100
 static void align_clocks(SyncClocks *sc, CPUState *cpu)
 {
    int64_t cpu_icount;
    if (!icount_align_option) {
        return;
    }
    cpu_icount = cpu->icount_extra + cpu_neg(cpu)->icount_decr.u16.low;
    sc->diff_clk += cpu_icount_to_ns(sc->last_cpu_icount - cpu_icount);
    sc->last_cpu_icount = cpu_icount;
    if (sc->diff_clk > VM_CLOCK_ADVANCE) {
 #ifndef _WIN32
        struct timespec sleep_delay, rem_delay;
        sleep_delay.tv_sec = sc->diff_clk / 1000000000LL;
        sleep_delay.tv_nsec = sc->diff_clk % 1000000000LL;
        if (nanosleep(&sleep_delay, &rem_delay) < 0) {
            sc->diff_clk = rem_delay.tv_sec * 1000000000LL + rem_delay.tv_nsec;
        } else {
            sc->diff_clk = 0;
        }
 #else
        Sleep(sc->diff_clk / SCALE_MS);
        sc->diff_clk = 0;
 #endif
    }
 }
 static void print_delay(const SyncClocks *sc)
 {
    static float threshold_delay;
    static int64_t last_realtime_clock;
    static int nb_prints;
    if (icount_align_option &&
        sc->realtime_clock - last_realtime_clock >= MAX_DELAY_PRINT_RATE &&
        nb_prints < MAX_NB_PRINTS) {
        if ((-sc->diff_clk / (float)1000000000LL > threshold_delay) ||
            (-sc->diff_clk / (float)1000000000LL <
             (threshold_delay - THRESHOLD_REDUCE))) {
            threshold_delay = (-sc->diff_clk / 1000000000LL) + 1;
            printf("Warning: The guest is now late by %.1f to %.1f seconds\n",
                   threshold_delay - 1,
                   threshold_delay);
            nb_prints++;
            last_realtime_clock = sc->realtime_clock;
        }
    }
 }
 static void init_delay_params(SyncClocks *sc, CPUState *cpu)
 {
    if (!icount_align_option) {
        return;
    }
    sc->realtime_clock = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL_RT);
    sc->diff_clk = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - sc->realtime_clock;
    sc->last_cpu_icount
        = cpu->icount_extra + cpu_neg(cpu)->icount_decr.u16.low;
    if (sc->diff_clk < max_delay) {
        max_delay = sc->diff_clk;
    }
    if (sc->diff_clk > max_advance) {
        max_advance = sc->diff_clk;
    }
    /* Print every 2s max if the guest is late. We limit the number
       of printed messages to NB_PRINT_MAX(currently 100) */
    print_delay(sc);
 }
 #else
 static void align_clocks(SyncClocks *sc, const CPUState *cpu)
 {
 }
 static void init_delay_params(SyncClocks *sc, const CPUState *cpu)
 {
 }
 #endif /* CONFIG USER ONLY */
 /* Execute a TB, and fix up the CPU state afterwards if necessary */
 static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
 {
    CPUArchState *env = cpu->env_ptr;
    uintptr_t ret;
    TranslationBlock *last_tb;
    int tb_exit;
    uint8_t *tb_ptr = itb->tc.ptr;
    qemu_log_mask_and_addr(CPU_LOG_EXEC, itb->pc,
                           "Trace %d: %p ["
                           TARGET_FMT_lx "/" TARGET_FMT_lx "/%#x] %s\n",
                           cpu->cpu_index, itb->tc.ptr,
                           itb->cs_base, itb->pc, itb->flags,
                           lookup_symbol(itb->pc));
 #if defined(DEBUG_DISAS)
    if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
        && qemu_log_in_addr_range(itb->pc)) {
        FILE *logfile = qemu_log_lock();
        int flags = 0;
        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
            flags |= CPU_DUMP_FPU;
        }
 #if defined(TARGET_I386)
        flags |= CPU_DUMP_CCOP;
 #endif
        log_cpu_state(cpu, flags);
        qemu_log_unlock(logfile);
    }
 #endif /* DEBUG_DISAS */
    ret = tcg_qemu_tb_exec(env, tb_ptr);
    cpu->can_do_io = 1;
    last_tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK);
    tb_exit = ret & TB_EXIT_MASK;
    trace_exec_tb_exit(last_tb, tb_exit);
    if (tb_exit > TB_EXIT_IDX1) {
        /* We didn't start executing this TB (eg because the instruction
         * counter hit zero); we must restore the guest PC to the address
         * of the start of the TB.
         */
        CPUClass *cc = CPU_GET_CLASS(cpu);
        qemu_log_mask_and_addr(CPU_LOG_EXEC, last_tb->pc,
                               "Stopped execution of TB chain before %p ["
                               TARGET_FMT_lx "] %s\n",
                               last_tb->tc.ptr, last_tb->pc,
                               lookup_symbol(last_tb->pc));
        if (cc->synchronize_from_tb) {
            cc->synchronize_from_tb(cpu, last_tb);
        } else {
            assert(cc->set_pc);
            cc->set_pc(cpu, last_tb->pc);
        }
    }
    return ret;
 }
 #ifndef CONFIG_USER_ONLY
 /* Execute the code without caching the generated code. An interpreter
   could be used if available. */
 static void cpu_exec_nocache(CPUState *cpu, int max_cycles,
                             TranslationBlock *orig_tb, bool ignore_icount)
 {
    TranslationBlock *tb;
    uint32_t cflags = curr_cflags() | CF_NOCACHE;
    if (ignore_icount) {
        cflags &= ~CF_USE_ICOUNT;
    }
    /* Should never happen.
       We only end up here when an existing TB is too long.  */
    cflags |= MIN(max_cycles, CF_COUNT_MASK);
    mmap_lock();
    tb = tb_gen_code(cpu, orig_tb->pc, orig_tb->cs_base,
                     orig_tb->flags, cflags);
    tb->orig_tb = orig_tb;
    mmap_unlock();
    /* execute the generated code */
    trace_exec_tb_nocache(tb, tb->pc);
    cpu_tb_exec(cpu, tb);
    mmap_lock();
    tb_phys_invalidate(tb, -1);
    mmap_unlock();
    tcg_tb_remove(tb);
 }
 #endif
 void cpu_exec_step_atomic(CPUState *cpu)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
    uint32_t cflags = 1;
    uint32_t cf_mask = cflags & CF_HASH_MASK;
    if (sigsetjmp(cpu->jmp_env, 0) == 0) {
        start_exclusive();
        tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
        if (tb == NULL) {
            mmap_lock();
            tb = tb_gen_code(cpu, pc, cs_base, flags, cflags);
            mmap_unlock();
        }
        /* Since we got here, we know that parallel_cpus must be true.  */
        parallel_cpus = false;
        cc->cpu_exec_enter(cpu);
        /* execute the generated code */
        trace_exec_tb(tb, pc);
        cpu_tb_exec(cpu, tb);
        cc->cpu_exec_exit(cpu);
    } else {
        /*
         * The mmap_lock is dropped by tb_gen_code if it runs out of
         * memory.
         */
 #ifndef CONFIG_SOFTMMU
        tcg_debug_assert(!have_mmap_lock());
 #endif
        if (qemu_mutex_iothread_locked()) {
            qemu_mutex_unlock_iothread();
        }
        assert_no_pages_locked();
        qemu_plugin_disable_mem_helpers(cpu);
    }
    /*
     * As we start the exclusive region before codegen we must still
     * be in the region if we longjump out of either the codegen or
     * the execution.
     */
    g_assert(cpu_in_exclusive_context(cpu));
    parallel_cpus = true;
    end_exclusive();
 }
 struct tb_desc {
    target_ulong pc;
    target_ulong cs_base;
    CPUArchState *env;
    tb_page_addr_t phys_page1;
    uint32_t flags;
    uint32_t cf_mask;
    uint32_t trace_vcpu_dstate;
 };
 static bool tb_lookup_cmp(const void *p, const void *d)
 {
    const TranslationBlock *tb = p;
    const struct tb_desc *desc = d;
    if (tb->pc == desc->pc &&
        tb->page_addr[0] == desc->phys_page1 &&
        tb->cs_base == desc->cs_base &&
        tb->flags == desc->flags &&
        tb->trace_vcpu_dstate == desc->trace_vcpu_dstate &&
        (tb_cflags(tb) & (CF_HASH_MASK | CF_INVALID)) == desc->cf_mask) {
        /* check next page if needed */
        if (tb->page_addr[1] == -1) {
            return true;
        } else {
            tb_page_addr_t phys_page2;
            target_ulong virt_page2;
            virt_page2 = (desc->pc & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;
            phys_page2 = get_page_addr_code(desc->env, virt_page2);
            if (tb->page_addr[1] == phys_page2) {
                return true;
            }
        }
    }
    return false;
 }
 TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
                                   target_ulong cs_base, uint32_t flags,
                                   uint32_t cf_mask)
 {
    tb_page_addr_t phys_pc;
    struct tb_desc desc;
    uint32_t h;
    desc.env = (CPUArchState *)cpu->env_ptr;
    desc.cs_base = cs_base;
    desc.flags = flags;
    desc.cf_mask = cf_mask;
    desc.trace_vcpu_dstate = *cpu->trace_dstate;
    desc.pc = pc;
    phys_pc = get_page_addr_code(desc.env, pc);
    if (phys_pc == -1) {
        return NULL;
    }
    desc.phys_page1 = phys_pc & TARGET_PAGE_MASK;
    h = tb_hash_func(phys_pc, pc, flags, cf_mask, *cpu->trace_dstate);
    return qht_lookup_custom(&tb_ctx.htable, &desc, h, tb_lookup_cmp);
 }
 void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
 {
    if (TCG_TARGET_HAS_direct_jump) {
        uintptr_t offset = tb->jmp_target_arg[n];
        uintptr_t tc_ptr = (uintptr_t)tb->tc.ptr;
        tb_target_set_jmp_target(tc_ptr, tc_ptr + offset, addr);
    } else {
        tb->jmp_target_arg[n] = addr;
    }
 }
 static inline void tb_add_jump(TranslationBlock *tb, int n,
                               TranslationBlock *tb_next)
 {
    uintptr_t old;
    assert(n < ARRAY_SIZE(tb->jmp_list_next));
    qemu_spin_lock(&tb_next->jmp_lock);
    /* make sure the destination TB is valid */
    if (tb_next->cflags & CF_INVALID) {
        goto out_unlock_next;
    }
    /* Atomically claim the jump destination slot only if it was NULL */
    old = atomic_cmpxchg(&tb->jmp_dest[n], (uintptr_t)NULL, (uintptr_t)tb_next);
    if (old) {
        goto out_unlock_next;
    }
    /* patch the native jump address */
    tb_set_jmp_target(tb, n, (uintptr_t)tb_next->tc.ptr);
    /* add in TB jmp list */
    tb->jmp_list_next[n] = tb_next->jmp_list_head;
    tb_next->jmp_list_head = (uintptr_t)tb | n;
    qemu_spin_unlock(&tb_next->jmp_lock);
    qemu_log_mask_and_addr(CPU_LOG_EXEC, tb->pc,
                           "Linking TBs %p [" TARGET_FMT_lx
                           "] index %d -> %p [" TARGET_FMT_lx "]\n",
                           tb->tc.ptr, tb->pc, n,
                           tb_next->tc.ptr, tb_next->pc);
    return;
 out_unlock_next:
    qemu_spin_unlock(&tb_next->jmp_lock);
    return;
 }
 static inline TranslationBlock *tb_find(CPUState *cpu,
                                        TranslationBlock *last_tb,
                                        int tb_exit, uint32_t cf_mask)
 {
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
    tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, cf_mask);
    if (tb == NULL) {
        mmap_lock();
        tb = tb_gen_code(cpu, pc, cs_base, flags, cf_mask);
        mmap_unlock();
        /* We add the TB in the virtual pc hash table for the fast lookup */
        atomic_set(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)], tb);
    }
 #ifndef CONFIG_USER_ONLY
    /* We don't take care of direct jumps when address mapping changes in
     * system emulation. So it's not safe to make a direct jump to a TB
     * spanning two pages because the mapping for the second page can change.
     */
    if (tb->page_addr[1] != -1) {
        last_tb = NULL;
    }
 #endif
    /* See if we can patch the calling TB. */
    if (last_tb) {
        tb_add_jump(last_tb, tb_exit, tb);
    }
    return tb;
 }
 static inline bool cpu_handle_halt(CPUState *cpu)
 {
    if (cpu->halted) {
 #if defined(TARGET_I386) && !defined(CONFIG_USER_ONLY)
        if ((cpu->interrupt_request & CPU_INTERRUPT_POLL)
            && replay_interrupt()) {
            X86CPU *x86_cpu = X86_CPU(cpu);
            qemu_mutex_lock_iothread();
            apic_poll_irq(x86_cpu->apic_state);
            cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
            qemu_mutex_unlock_iothread();
        }
 #endif
        if (!cpu_has_work(cpu)) {
            return true;
        }
        cpu->halted = 0;
    }
    return false;
 }
 static inline void cpu_handle_debug_exception(CPUState *cpu)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
    CPUWatchpoint *wp;
    if (!cpu->watchpoint_hit) {
        QTAILQ_FOREACH(wp, &cpu->watchpoints, entry) {
            wp->flags &= ~BP_WATCHPOINT_HIT;
        }
    }
    cc->debug_excp_handler(cpu);
 }
 static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 {
    if (cpu->exception_index < 0) {
 #ifndef CONFIG_USER_ONLY
        if (replay_has_exception()
            && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0) {
            /* try to cause an exception pending in the log */
            cpu_exec_nocache(cpu, 1, tb_find(cpu, NULL, 0, curr_cflags()), true);
        }
 #endif
        if (cpu->exception_index < 0) {
            return false;
        }
    }
    if (cpu->exception_index >= EXCP_INTERRUPT) {
        /* exit request from the cpu execution loop */
        *ret = cpu->exception_index;
        if (*ret == EXCP_DEBUG) {
            cpu_handle_debug_exception(cpu);
        }
        cpu->exception_index = -1;
        return true;
    } else {
 #if defined(CONFIG_USER_ONLY)
        /* if user mode only, we simulate a fake exception
           which will be handled outside the cpu execution
           loop */
 #if defined(TARGET_I386)
        CPUClass *cc = CPU_GET_CLASS(cpu);
        cc->do_interrupt(cpu);
 #endif
        *ret = cpu->exception_index;
        cpu->exception_index = -1;
        return true;
 #else
        if (replay_exception()) {
            CPUClass *cc = CPU_GET_CLASS(cpu);
            qemu_mutex_lock_iothread();
            cc->do_interrupt(cpu);
            qemu_mutex_unlock_iothread();
            cpu->exception_index = -1;
            if (unlikely(cpu->singlestep_enabled)) {
                /*
                 * After processing the exception, ensure an EXCP_DEBUG is
                 * raised when single-stepping so that GDB doesn't miss the
                 * next instruction.
                 */
                *ret = EXCP_DEBUG;
                cpu_handle_debug_exception(cpu);
                return true;
            }
        } else if (!replay_has_interrupt()) {
            /* give a chance to iothread in replay mode */
            *ret = EXCP_INTERRUPT;
            return true;
        }
 #endif
    }
    return false;
 }
 static inline bool cpu_handle_interrupt(CPUState *cpu,
                                        TranslationBlock **last_tb)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
    /* Clear the interrupt flag now since we're processing
     * cpu->interrupt_request and cpu->exit_request.
     * Ensure zeroing happens before reading cpu->exit_request or
     * cpu->interrupt_request (see also smp_wmb in cpu_exit())
     */
    atomic_mb_set(&cpu_neg(cpu)->icount_decr.u16.high, 0);
    if (unlikely(atomic_read(&cpu->interrupt_request))) {
        int interrupt_request;
        qemu_mutex_lock_iothread();
        interrupt_request = cpu->interrupt_request;
        if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) {
            /* Mask out external interrupts for this step. */
            interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
        }
        if (interrupt_request & CPU_INTERRUPT_DEBUG) {
            cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
            cpu->exception_index = EXCP_DEBUG;
            qemu_mutex_unlock_iothread();
            return true;
        }
        if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) {
            /* Do nothing */
        } else if (interrupt_request & CPU_INTERRUPT_HALT) {
            replay_interrupt();
            cpu->interrupt_request &= ~CPU_INTERRUPT_HALT;
            cpu->halted = 1;
            cpu->exception_index = EXCP_HLT;
            qemu_mutex_unlock_iothread();
            return true;
        }
 #if defined(TARGET_I386)
        else if (interrupt_request & CPU_INTERRUPT_INIT) {
            X86CPU *x86_cpu = X86_CPU(cpu);
            CPUArchState *env = &x86_cpu->env;
            replay_interrupt();
            cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0, 0);
            do_cpu_init(x86_cpu);
            cpu->exception_index = EXCP_HALTED;
            qemu_mutex_unlock_iothread();
            return true;
        }
 #else
        else if (interrupt_request & CPU_INTERRUPT_RESET) {
            replay_interrupt();
            cpu_reset(cpu);
            qemu_mutex_unlock_iothread();
            return true;
        }
 #endif
        /* The target hook has 3 exit conditions:
           False when the interrupt isn't processed,
           True when it is, and we should restart on a new TB,
           and via longjmp via cpu_loop_exit.  */
        else {
            if (cc->cpu_exec_interrupt(cpu, interrupt_request)) {
                replay_interrupt();
                /*
                 * After processing the interrupt, ensure an EXCP_DEBUG is
                 * raised when single-stepping so that GDB doesn't miss the
                 * next instruction.
                 */
                cpu->exception_index =
                    (cpu->singlestep_enabled ? EXCP_DEBUG : -1);
                *last_tb = NULL;
            }
            /* The target hook may have updated the 'cpu->interrupt_request';
             * reload the 'interrupt_request' value */
            interrupt_request = cpu->interrupt_request;
        }
        if (interrupt_request & CPU_INTERRUPT_EXITTB) {
            cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
            /* ensure that no TB jump will be modified as
               the program flow was changed */
            *last_tb = NULL;
        }
        /* If we exit via cpu_loop_exit/longjmp it is reset in cpu_exec */
        qemu_mutex_unlock_iothread();
    }
    /* Finally, check if we need to exit to the main loop.  */
    if (unlikely(atomic_read(&cpu->exit_request))
        || (use_icount
            && cpu_neg(cpu)->icount_decr.u16.low + cpu->icount_extra == 0)) {
        atomic_set(&cpu->exit_request, 0);
        if (cpu->exception_index == -1) {
            cpu->exception_index = EXCP_INTERRUPT;
        }
        return true;
    }
    return false;
 }
 static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
                                    TranslationBlock **last_tb, int *tb_exit)
 {
    uintptr_t ret;
    int32_t insns_left;
    trace_exec_tb(tb, tb->pc);
    ret = cpu_tb_exec(cpu, tb);
    tb = (TranslationBlock *)(ret & ~TB_EXIT_MASK);
    *tb_exit = ret & TB_EXIT_MASK;
    if (*tb_exit != TB_EXIT_REQUESTED) {
        *last_tb = tb;
        return;
    }
    *last_tb = NULL;
    insns_left = atomic_read(&cpu_neg(cpu)->icount_decr.u32);
    if (insns_left < 0) {
        /* Something asked us to stop executing chained TBs; just
         * continue round the main loop. Whatever requested the exit
         * will also have set something else (eg exit_request or
         * interrupt_request) which will be handled by
         * cpu_handle_interrupt.  cpu_handle_interrupt will also
         * clear cpu->icount_decr.u16.high.
         */
        return;
    }
    /* Instruction counter expired.  */
    assert(use_icount);
 #ifndef CONFIG_USER_ONLY
    /* Ensure global icount has gone forward */
    cpu_update_icount(cpu);
    /* Refill decrementer and continue execution.  */
    insns_left = MIN(0xffff, cpu->icount_budget);
    cpu_neg(cpu)->icount_decr.u16.low = insns_left;
    cpu->icount_extra = cpu->icount_budget - insns_left;
    if (!cpu->icount_extra) {
        /* Execute any remaining instructions, then let the main loop
         * handle the next event.
         */
        if (insns_left > 0) {
            cpu_exec_nocache(cpu, insns_left, tb, false);
        }
    }
 #endif
 }
 /* main execution loop */
 int cpu_exec(CPUState *cpu)
 {
    CPUClass *cc = CPU_GET_CLASS(cpu);
    int ret;
    SyncClocks sc = { 0 };
    /* replay_interrupt may need current_cpu */
    current_cpu = cpu;
    if (cpu_handle_halt(cpu)) {
        return EXCP_HALTED;
    }
    rcu_read_lock();
    cc->cpu_exec_enter(cpu);
    /* Calculate difference between guest clock and host clock.
     * This delay includes the delay of the last cycle, so
     * what we have to do is sleep until it is 0. As for the
     * advance/delay we gain here, we try to fix it next time.
     */
    init_delay_params(&sc, cpu);
    /* prepare setjmp context for exception handling */
    if (sigsetjmp(cpu->jmp_env, 0) != 0) {
 #if defined(__clang__) || !QEMU_GNUC_PREREQ(4, 6)
        /* Some compilers wrongly smash all local variables after
         * siglongjmp. There were bug reports for gcc 4.5.0 and clang.
         * Reload essential local variables here for those compilers.
         * Newer versions of gcc would complain about this code (-Wclobbered). */
        cpu = current_cpu;
        cc = CPU_GET_CLASS(cpu);
 #else /* buggy compiler */
        /* Assert that the compiler does not smash local variables. */
        g_assert(cpu == current_cpu);
        g_assert(cc == CPU_GET_CLASS(cpu));
 #endif /* buggy compiler */
 #ifndef CONFIG_SOFTMMU
        tcg_debug_assert(!have_mmap_lock());
 #endif
        if (qemu_mutex_iothread_locked()) {
            qemu_mutex_unlock_iothread();
        }
        qemu_plugin_disable_mem_helpers(cpu);
        assert_no_pages_locked();
    }
    /* if an exception is pending, we execute it here */
    while (!cpu_handle_exception(cpu, &ret)) {
        TranslationBlock *last_tb = NULL;
        int tb_exit = 0;
        while (!cpu_handle_interrupt(cpu, &last_tb)) {
            uint32_t cflags = cpu->cflags_next_tb;
            TranslationBlock *tb;
            /* When requested, use an exact setting for cflags for the next
               execution.  This is used for icount, precise smc, and stop-
               after-access watchpoints.  Since this request should never
               have CF_INVALID set, -1 is a convenient invalid value that
               does not require tcg headers for cpu_common_reset.  */
            if (cflags == -1) {
                cflags = curr_cflags();
            } else {
                cpu->cflags_next_tb = -1;
            }
            tb = tb_find(cpu, last_tb, tb_exit, cflags);
            cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
            /* Try to align the host and virtual clocks
               if the guest is in advance */
            align_clocks(&sc, cpu);
        }
    }
    cc->cpu_exec_exit(cpu);
    rcu_read_unlock();
    return ret;
 }
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -1,932 +0,0 @@
 /*
 * plugin-gen.c - TCG-related bits of plugin infrastructure
 *
 * Copyright (C) 2018, Emilio G. Cota <cota@braap.org>
 * License: GNU GPL, version 2 or later.
 *   See the COPYING file in the top-level directory.
 *
 * We support instrumentation at an instruction granularity. That is,
 * if a plugin wants to instrument the memory accesses performed by a
 * particular instruction, it can just do that instead of instrumenting
 * all memory accesses. Thus, in order to do this we first have to
 * translate a TB, so that plugins can decide what/where to instrument.
 *
 * Injecting the desired instrumentation could be done with a second
 * translation pass that combined the instrumentation requests, but that
 * would be ugly and inefficient since we would decode the guest code twice.
 * Instead, during TB translation we add "empty" instrumentation calls for all
 * possible instrumentation events, and then once we collect the instrumentation
 * requests from plugins, we either "fill in" those empty events or remove them
 * if they have no requests.
 *
 * When "filling in" an event we first copy the empty callback's TCG ops. This
 * might seem unnecessary, but it is done to support an arbitrary number
 * of callbacks per event. Take for example a regular instruction callback.
 * We first generate a callback to an empty helper function. Then, if two
 * plugins register one callback each for this instruction, we make two copies
 * of the TCG ops generated for the empty callback, substituting the function
 * pointer that points to the empty helper function with the plugins' desired
 * callback functions. After that we remove the empty callback's ops.
 *
 * Note that the location in TCGOp.args[] of the pointer to a helper function
 * varies across different guest and host architectures. Instead of duplicating
 * the logic that figures this out, we rely on the fact that the empty
 * callbacks point to empty functions that are unique pointers in the program.
 * Thus, to find the right location we just have to look for a match in
 * TCGOp.args[]. This is the main reason why we first copy an empty callback's
 * TCG ops and then fill them in; regardless of whether we have one or many
 * callbacks for that event, the logic to add all of them is the same.
 *
 * When generating more than one callback per event, we make a small
 * optimization to avoid generating redundant operations. For instance, for the
 * second and all subsequent callbacks of an event, we do not need to reload the
 * CPU's index into a TCG temp, since the first callback did it already.
 */
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "tcg/tcg.h"
 #include "tcg/tcg-op.h"
 #include "trace/mem.h"
 #include "exec/exec-all.h"
 #include "exec/plugin-gen.h"
 #include "exec/translator.h"
 #ifdef CONFIG_SOFTMMU
 # define CONFIG_SOFTMMU_GATE 1
 #else
 # define CONFIG_SOFTMMU_GATE 0
 #endif
 /*
 * plugin_cb_start TCG op args[]:
 * 0: enum plugin_gen_from
 * 1: enum plugin_gen_cb
 * 2: set to 1 for mem callback that is a write, 0 otherwise.
 */
 enum plugin_gen_from {
    PLUGIN_GEN_FROM_TB,
    PLUGIN_GEN_FROM_INSN,
    PLUGIN_GEN_FROM_MEM,
    PLUGIN_GEN_AFTER_INSN,
    PLUGIN_GEN_N_FROMS,
 };
 enum plugin_gen_cb {
    PLUGIN_GEN_CB_UDATA,
    PLUGIN_GEN_CB_INLINE,
    PLUGIN_GEN_CB_MEM,
    PLUGIN_GEN_ENABLE_MEM_HELPER,
    PLUGIN_GEN_DISABLE_MEM_HELPER,
    PLUGIN_GEN_N_CBS,
 };
 /*
 * These helpers are stubs that get dynamically switched out for calls
 * direct to the plugin if they are subscribed to.
 */
 void HELPER(plugin_vcpu_udata_cb)(uint32_t cpu_index, void *udata)
 { }
 void HELPER(plugin_vcpu_mem_cb)(unsigned int vcpu_index,
                                qemu_plugin_meminfo_t info, uint64_t vaddr,
                                void *userdata)
 { }
 static void do_gen_mem_cb(TCGv vaddr, uint32_t info)
 {
    TCGv_i32 cpu_index = tcg_temp_new_i32();
    TCGv_i32 meminfo = tcg_const_i32(info);
    TCGv_i64 vaddr64 = tcg_temp_new_i64();
    TCGv_ptr udata = tcg_const_ptr(NULL);
    tcg_gen_ld_i32(cpu_index, cpu_env,
                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
    tcg_gen_extu_tl_i64(vaddr64, vaddr);
    gen_helper_plugin_vcpu_mem_cb(cpu_index, meminfo, vaddr64, udata);
    tcg_temp_free_ptr(udata);
    tcg_temp_free_i64(vaddr64);
    tcg_temp_free_i32(meminfo);
    tcg_temp_free_i32(cpu_index);
 }
 static void gen_empty_udata_cb(void)
 {
    TCGv_i32 cpu_index = tcg_temp_new_i32();
    TCGv_ptr udata = tcg_const_ptr(NULL); /* will be overwritten later */
    tcg_gen_ld_i32(cpu_index, cpu_env,
                   -offsetof(ArchCPU, env) + offsetof(CPUState, cpu_index));
    gen_helper_plugin_vcpu_udata_cb(cpu_index, udata);
    tcg_temp_free_ptr(udata);
    tcg_temp_free_i32(cpu_index);
 }
 /*
 * For now we only support addi_i64.
 * When we support more ops, we can generate one empty inline cb for each.
 */
 static void gen_empty_inline_cb(void)
 {
    TCGv_i64 val = tcg_temp_new_i64();
    TCGv_ptr ptr = tcg_const_ptr(NULL); /* overwritten later */
    tcg_gen_ld_i64(val, ptr, 0);
    /* pass an immediate != 0 so that it doesn't get optimized away */
    tcg_gen_addi_i64(val, val, 0xdeadface);
    tcg_gen_st_i64(val, ptr, 0);
    tcg_temp_free_ptr(ptr);
    tcg_temp_free_i64(val);
 }
 static void gen_empty_mem_cb(TCGv addr, uint32_t info)
 {
    do_gen_mem_cb(addr, info);
 }
 /*
 * Share the same function for enable/disable. When enabling, the NULL
 * pointer will be overwritten later.
 */
 static void gen_empty_mem_helper(void)
 {
    TCGv_ptr ptr;
    ptr = tcg_const_ptr(NULL);
    tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) -
                                 offsetof(ArchCPU, env));
    tcg_temp_free_ptr(ptr);
 }
 static inline
 void gen_plugin_cb_start(enum plugin_gen_from from,
                         enum plugin_gen_cb type, unsigned wr)
 {
    TCGOp *op;
    tcg_gen_plugin_cb_start(from, type, wr);
    op = tcg_last_op();
    QSIMPLEQ_INSERT_TAIL(&tcg_ctx->plugin_ops, op, plugin_link);
 }
 static void gen_wrapped(enum plugin_gen_from from,
                        enum plugin_gen_cb type, void (*func)(void))
 {
    gen_plugin_cb_start(from, type, 0);
    func();
    tcg_gen_plugin_cb_end();
 }
 static inline void plugin_gen_empty_callback(enum plugin_gen_from from)
 {
    switch (from) {
    case PLUGIN_GEN_AFTER_INSN:
        gen_wrapped(from, PLUGIN_GEN_DISABLE_MEM_HELPER,
                    gen_empty_mem_helper);
        break;
    case PLUGIN_GEN_FROM_INSN:
        /*
         * Note: plugin_gen_inject() relies on ENABLE_MEM_HELPER being
         * the first callback of an instruction
         */
        gen_wrapped(from, PLUGIN_GEN_ENABLE_MEM_HELPER,
                    gen_empty_mem_helper);
        /* fall through */
    case PLUGIN_GEN_FROM_TB:
        gen_wrapped(from, PLUGIN_GEN_CB_UDATA, gen_empty_udata_cb);
        gen_wrapped(from, PLUGIN_GEN_CB_INLINE, gen_empty_inline_cb);
        break;
    default:
        g_assert_not_reached();
    }
 }
 union mem_gen_fn {
    void (*mem_fn)(TCGv, uint32_t);
    void (*inline_fn)(void);
 };
 static void gen_mem_wrapped(enum plugin_gen_cb type,
                            const union mem_gen_fn *f, TCGv addr,
                            uint32_t info, bool is_mem)
 {
    int wr = !!(info & TRACE_MEM_ST);
    gen_plugin_cb_start(PLUGIN_GEN_FROM_MEM, type, wr);
    if (is_mem) {
        f->mem_fn(addr, info);
    } else {
        f->inline_fn();
    }
    tcg_gen_plugin_cb_end();
 }
 void plugin_gen_empty_mem_callback(TCGv addr, uint32_t info)
 {
    union mem_gen_fn fn;
    fn.mem_fn = gen_empty_mem_cb;
    gen_mem_wrapped(PLUGIN_GEN_CB_MEM, &fn, addr, info, true);
    fn.inline_fn = gen_empty_inline_cb;
    gen_mem_wrapped(PLUGIN_GEN_CB_INLINE, &fn, 0, info, false);
 }
 static TCGOp *find_op(TCGOp *op, TCGOpcode opc)
 {
    while (op) {
        if (op->opc == opc) {
            return op;
        }
        op = QTAILQ_NEXT(op, link);
    }
    return NULL;
 }
 static TCGOp *rm_ops_range(TCGOp *begin, TCGOp *end)
 {
    TCGOp *ret = QTAILQ_NEXT(end, link);
    QTAILQ_REMOVE_SEVERAL(&tcg_ctx->ops, begin, end, link);
    return ret;
 }
 /* remove all ops until (and including) plugin_cb_end */
 static TCGOp *rm_ops(TCGOp *op)
 {
    TCGOp *end_op = find_op(op, INDEX_op_plugin_cb_end);
    tcg_debug_assert(end_op);
    return rm_ops_range(op, end_op);
 }
 static TCGOp *copy_op_nocheck(TCGOp **begin_op, TCGOp *op)
 {
    *begin_op = QTAILQ_NEXT(*begin_op, link);
    tcg_debug_assert(*begin_op);
    op = tcg_op_insert_after(tcg_ctx, op, (*begin_op)->opc);
    memcpy(op->args, (*begin_op)->args, sizeof(op->args));
    return op;
 }
 static TCGOp *copy_op(TCGOp **begin_op, TCGOp *op, TCGOpcode opc)
 {
    op = copy_op_nocheck(begin_op, op);
    tcg_debug_assert((*begin_op)->opc == opc);
    return op;
 }
 static TCGOp *copy_extu_i32_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* mov_i32 */
        op = copy_op(begin_op, op, INDEX_op_mov_i32);
        /* movi_i32 */
        op = copy_op(begin_op, op, INDEX_op_movi_i32);
    } else {
        /* extu_i32_i64 */
        op = copy_op(begin_op, op, INDEX_op_extu_i32_i64);
    }
    return op;
 }
 static TCGOp *copy_mov_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* 2x mov_i32 */
        op = copy_op(begin_op, op, INDEX_op_mov_i32);
        op = copy_op(begin_op, op, INDEX_op_mov_i32);
    } else {
        /* mov_i64 */
        op = copy_op(begin_op, op, INDEX_op_mov_i64);
    }
    return op;
 }
 static TCGOp *copy_movi_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* 2x movi_i32 */
        op = copy_op(begin_op, op, INDEX_op_movi_i32);
        op->args[1] = v;
        op = copy_op(begin_op, op, INDEX_op_movi_i32);
        op->args[1] = v >> 32;
    } else {
        /* movi_i64 */
        op = copy_op(begin_op, op, INDEX_op_movi_i64);
        op->args[1] = v;
    }
    return op;
 }
 static TCGOp *copy_const_ptr(TCGOp **begin_op, TCGOp *op, void *ptr)
 {
    if (UINTPTR_MAX == UINT32_MAX) {
        /* movi_i32 */
        op = copy_op(begin_op, op, INDEX_op_movi_i32);
        op->args[1] = (uintptr_t)ptr;
    } else {
        /* movi_i64 */
        op = copy_movi_i64(begin_op, op, (uint64_t)(uintptr_t)ptr);
    }
    return op;
 }
 static TCGOp *copy_const_i64(TCGOp **begin_op, TCGOp *op, uint64_t v)
 {
    return copy_movi_i64(begin_op, op, v);
 }
 static TCGOp *copy_extu_tl_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TARGET_LONG_BITS == 32) {
        /* extu_i32_i64 */
        op = copy_extu_i32_i64(begin_op, op);
    } else {
        /* mov_i64 */
        op = copy_mov_i64(begin_op, op);
    }
    return op;
 }
 static TCGOp *copy_ld_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* 2x ld_i32 */
        op = copy_op(begin_op, op, INDEX_op_ld_i32);
        op = copy_op(begin_op, op, INDEX_op_ld_i32);
    } else {
        /* ld_i64 */
        op = copy_op(begin_op, op, INDEX_op_ld_i64);
    }
    return op;
 }
 static TCGOp *copy_st_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* 2x st_i32 */
        op = copy_op(begin_op, op, INDEX_op_st_i32);
        op = copy_op(begin_op, op, INDEX_op_st_i32);
    } else {
        /* st_i64 */
        op = copy_op(begin_op, op, INDEX_op_st_i64);
    }
    return op;
 }
 static TCGOp *copy_add_i64(TCGOp **begin_op, TCGOp *op)
 {
    if (TCG_TARGET_REG_BITS == 32) {
        /* all 32-bit backends must implement add2_i32 */
        g_assert(TCG_TARGET_HAS_add2_i32);
        op = copy_op(begin_op, op, INDEX_op_add2_i32);
    } else {
        op = copy_op(begin_op, op, INDEX_op_add_i64);
    }
    return op;
 }
 static TCGOp *copy_st_ptr(TCGOp **begin_op, TCGOp *op)
 {
    if (UINTPTR_MAX == UINT32_MAX) {
        /* st_i32 */
        op = copy_op(begin_op, op, INDEX_op_st_i32);
    } else {
        /* st_i64 */
        op = copy_st_i64(begin_op, op);
    }
    return op;
 }
 static TCGOp *copy_call(TCGOp **begin_op, TCGOp *op, void *empty_func,
                        void *func, unsigned tcg_flags, int *cb_idx)
 {
    /* copy all ops until the call */
    do {
        op = copy_op_nocheck(begin_op, op);
    } while (op->opc != INDEX_op_call);
    /* fill in the op call */
    op->param1 = (*begin_op)->param1;
    op->param2 = (*begin_op)->param2;
    tcg_debug_assert(op->life == 0);
    if (*cb_idx == -1) {
        int i;
        /*
         * Instead of working out the position of the callback in args[], just
         * look for @empty_func, since it should be a unique pointer.
         */
        for (i = 0; i < MAX_OPC_PARAM_ARGS; i++) {
            if ((uintptr_t)(*begin_op)->args[i] == (uintptr_t)empty_func) {
                *cb_idx = i;
                break;
            }
        }
        tcg_debug_assert(i < MAX_OPC_PARAM_ARGS);
    }
    op->args[*cb_idx] = (uintptr_t)func;
    op->args[*cb_idx + 1] = tcg_flags;
    return op;
 }
 static TCGOp *append_udata_cb(const struct qemu_plugin_dyn_cb *cb,
                              TCGOp *begin_op, TCGOp *op, int *cb_idx)
 {
    /* const_ptr */
    op = copy_const_ptr(&begin_op, op, cb->userp);
    /* copy the ld_i32, but note that we only have to copy it once */
    begin_op = QTAILQ_NEXT(begin_op, link);
    tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
    if (*cb_idx == -1) {
        op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32);
        memcpy(op->args, begin_op->args, sizeof(op->args));
    }
    /* call */
    op = copy_call(&begin_op, op, HELPER(plugin_vcpu_udata_cb),
                   cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
    return op;
 }
 static TCGOp *append_inline_cb(const struct qemu_plugin_dyn_cb *cb,
                               TCGOp *begin_op, TCGOp *op,
                               int *unused)
 {
    /* const_ptr */
    op = copy_const_ptr(&begin_op, op, cb->userp);
    /* ld_i64 */
    op = copy_ld_i64(&begin_op, op);
    /* const_i64 */
    op = copy_const_i64(&begin_op, op, cb->inline_insn.imm);
    /* add_i64 */
    op = copy_add_i64(&begin_op, op);
    /* st_i64 */
    op = copy_st_i64(&begin_op, op);
    return op;
 }
 static TCGOp *append_mem_cb(const struct qemu_plugin_dyn_cb *cb,
                            TCGOp *begin_op, TCGOp *op, int *cb_idx)
 {
    enum plugin_gen_cb type = begin_op->args[1];
    tcg_debug_assert(type == PLUGIN_GEN_CB_MEM);
    /* const_i32 == movi_i32 ("info", so it remains as is) */
    op = copy_op(&begin_op, op, INDEX_op_movi_i32);
    /* const_ptr */
    op = copy_const_ptr(&begin_op, op, cb->userp);
    /* copy the ld_i32, but note that we only have to copy it once */
    begin_op = QTAILQ_NEXT(begin_op, link);
    tcg_debug_assert(begin_op && begin_op->opc == INDEX_op_ld_i32);
    if (*cb_idx == -1) {
        op = tcg_op_insert_after(tcg_ctx, op, INDEX_op_ld_i32);
        memcpy(op->args, begin_op->args, sizeof(op->args));
    }
    /* extu_tl_i64 */
    op = copy_extu_tl_i64(&begin_op, op);
    if (type == PLUGIN_GEN_CB_MEM) {
        /* call */
        op = copy_call(&begin_op, op, HELPER(plugin_vcpu_mem_cb),
                       cb->f.vcpu_udata, cb->tcg_flags, cb_idx);
    }
    return op;
 }
 typedef TCGOp *(*inject_fn)(const struct qemu_plugin_dyn_cb *cb,
                            TCGOp *begin_op, TCGOp *op, int *intp);
 typedef bool (*op_ok_fn)(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb);
 static bool op_ok(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
 {
    return true;
 }
 static bool op_rw(const TCGOp *op, const struct qemu_plugin_dyn_cb *cb)
 {
    int w;
    w = op->args[2];
    return !!(cb->rw & (w + 1));
 }
 static inline
 void inject_cb_type(const GArray *cbs, TCGOp *begin_op, inject_fn inject,
                    op_ok_fn ok)
 {
    TCGOp *end_op;
    TCGOp *op;
    int cb_idx = -1;
    int i;
    if (!cbs || cbs->len == 0) {
        rm_ops(begin_op);
        return;
    }
    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
    tcg_debug_assert(end_op);
    op = end_op;
    for (i = 0; i < cbs->len; i++) {
        struct qemu_plugin_dyn_cb *cb =
            &g_array_index(cbs, struct qemu_plugin_dyn_cb, i);
        if (!ok(begin_op, cb)) {
            continue;
        }
        op = inject(cb, begin_op, op, &cb_idx);
    }
    rm_ops_range(begin_op, end_op);
 }
 static void
 inject_udata_cb(const GArray *cbs, TCGOp *begin_op)
 {
    inject_cb_type(cbs, begin_op, append_udata_cb, op_ok);
 }
 static void
 inject_inline_cb(const GArray *cbs, TCGOp *begin_op, op_ok_fn ok)
 {
    inject_cb_type(cbs, begin_op, append_inline_cb, ok);
 }
 static void
 inject_mem_cb(const GArray *cbs, TCGOp *begin_op)
 {
    inject_cb_type(cbs, begin_op, append_mem_cb, op_rw);
 }
 /* we could change the ops in place, but we can reuse more code by copying */
 static void inject_mem_helper(TCGOp *begin_op, GArray *arr)
 {
    TCGOp *orig_op = begin_op;
    TCGOp *end_op;
    TCGOp *op;
    end_op = find_op(begin_op, INDEX_op_plugin_cb_end);
    tcg_debug_assert(end_op);
    /* const ptr */
    op = copy_const_ptr(&begin_op, end_op, arr);
    /* st_ptr */
    op = copy_st_ptr(&begin_op, op);
    rm_ops_range(orig_op, end_op);
 }
 /*
 * Tracking memory accesses performed from helpers requires extra work.
 * If an instruction is emulated with helpers, we do two things:
 * (1) copy the CB descriptors, and keep track of it so that they can be
 * freed later on, and (2) point CPUState.plugin_mem_cbs to the descriptors, so
 * that we can read them at run-time (i.e. when the helper executes).
 * This run-time access is performed from qemu_plugin_vcpu_mem_cb.
 *
 * Note that plugin_gen_disable_mem_helpers undoes (2). Since it
 * is possible that the code we generate after the instruction is
 * dead, we also add checks before generating tb_exit etc.
 */
 static void inject_mem_enable_helper(struct qemu_plugin_insn *plugin_insn,
                                     TCGOp *begin_op)
 {
    GArray *cbs[2];
    GArray *arr;
    size_t n_cbs, i;
    cbs[0] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR];
    cbs[1] = plugin_insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
    n_cbs = 0;
    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
        n_cbs += cbs[i]->len;
    }
    plugin_insn->mem_helper = plugin_insn->calls_helpers && n_cbs;
    if (likely(!plugin_insn->mem_helper)) {
        rm_ops(begin_op);
        return;
    }
    arr = g_array_sized_new(false, false,
                            sizeof(struct qemu_plugin_dyn_cb), n_cbs);
    for (i = 0; i < ARRAY_SIZE(cbs); i++) {
        g_array_append_vals(arr, cbs[i]->data, cbs[i]->len);
    }
    qemu_plugin_add_dyn_cb_arr(arr);
    inject_mem_helper(begin_op, arr);
 }
 static void inject_mem_disable_helper(struct qemu_plugin_insn *plugin_insn,
                                      TCGOp *begin_op)
 {
    if (likely(!plugin_insn->mem_helper)) {
        rm_ops(begin_op);
        return;
    }
    inject_mem_helper(begin_op, NULL);
 }
 /* called before finishing a TB with exit_tb, goto_tb or goto_ptr */
 void plugin_gen_disable_mem_helpers(void)
 {
    TCGv_ptr ptr;
    if (likely(tcg_ctx->plugin_insn == NULL ||
               !tcg_ctx->plugin_insn->mem_helper)) {
        return;
    }
    ptr = tcg_const_ptr(NULL);
    tcg_gen_st_ptr(ptr, cpu_env, offsetof(CPUState, plugin_mem_cbs) -
                                 offsetof(ArchCPU, env));
    tcg_temp_free_ptr(ptr);
    tcg_ctx->plugin_insn->mem_helper = false;
 }
 static void plugin_gen_tb_udata(const struct qemu_plugin_tb *ptb,
                                TCGOp *begin_op)
 {
    inject_udata_cb(ptb->cbs[PLUGIN_CB_REGULAR], begin_op);
 }
 static void plugin_gen_tb_inline(const struct qemu_plugin_tb *ptb,
                                 TCGOp *begin_op)
 {
    inject_inline_cb(ptb->cbs[PLUGIN_CB_INLINE], begin_op, op_ok);
 }
 static void plugin_gen_insn_udata(const struct qemu_plugin_tb *ptb,
                                  TCGOp *begin_op, int insn_idx)
 {
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    inject_udata_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_REGULAR], begin_op);
 }
 static void plugin_gen_insn_inline(const struct qemu_plugin_tb *ptb,
                                   TCGOp *begin_op, int insn_idx)
 {
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    inject_inline_cb(insn->cbs[PLUGIN_CB_INSN][PLUGIN_CB_INLINE],
                     begin_op, op_ok);
 }
 static void plugin_gen_mem_regular(const struct qemu_plugin_tb *ptb,
                                   TCGOp *begin_op, int insn_idx)
 {
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    inject_mem_cb(insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_REGULAR], begin_op);
 }
 static void plugin_gen_mem_inline(const struct qemu_plugin_tb *ptb,
                                  TCGOp *begin_op, int insn_idx)
 {
    const GArray *cbs;
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    cbs = insn->cbs[PLUGIN_CB_MEM][PLUGIN_CB_INLINE];
    inject_inline_cb(cbs, begin_op, op_rw);
 }
 static void plugin_gen_enable_mem_helper(const struct qemu_plugin_tb *ptb,
                                         TCGOp *begin_op, int insn_idx)
 {
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    inject_mem_enable_helper(insn, begin_op);
 }
 static void plugin_gen_disable_mem_helper(const struct qemu_plugin_tb *ptb,
                                          TCGOp *begin_op, int insn_idx)
 {
    struct qemu_plugin_insn *insn = g_ptr_array_index(ptb->insns, insn_idx);
    inject_mem_disable_helper(insn, begin_op);
 }
 static void plugin_inject_cb(const struct qemu_plugin_tb *ptb, TCGOp *begin_op,
                             int insn_idx)
 {
    enum plugin_gen_from from = begin_op->args[0];
    enum plugin_gen_cb type = begin_op->args[1];
    switch (from) {
    case PLUGIN_GEN_FROM_TB:
        switch (type) {
        case PLUGIN_GEN_CB_UDATA:
            plugin_gen_tb_udata(ptb, begin_op);
            return;
        case PLUGIN_GEN_CB_INLINE:
            plugin_gen_tb_inline(ptb, begin_op);
            return;
        default:
            g_assert_not_reached();
        }
    case PLUGIN_GEN_FROM_INSN:
        switch (type) {
        case PLUGIN_GEN_CB_UDATA:
            plugin_gen_insn_udata(ptb, begin_op, insn_idx);
            return;
        case PLUGIN_GEN_CB_INLINE:
            plugin_gen_insn_inline(ptb, begin_op, insn_idx);
            return;
        case PLUGIN_GEN_ENABLE_MEM_HELPER:
            plugin_gen_enable_mem_helper(ptb, begin_op, insn_idx);
            return;
        default:
            g_assert_not_reached();
        }
    case PLUGIN_GEN_FROM_MEM:
        switch (type) {
        case PLUGIN_GEN_CB_MEM:
            plugin_gen_mem_regular(ptb, begin_op, insn_idx);
            return;
        case PLUGIN_GEN_CB_INLINE:
            plugin_gen_mem_inline(ptb, begin_op, insn_idx);
            return;
        default:
            g_assert_not_reached();
        }
    case PLUGIN_GEN_AFTER_INSN:
        switch (type) {
        case PLUGIN_GEN_DISABLE_MEM_HELPER:
            plugin_gen_disable_mem_helper(ptb, begin_op, insn_idx);
            return;
        default:
            g_assert_not_reached();
        }
    default:
        g_assert_not_reached();
    }
 }
 /* #define DEBUG_PLUGIN_GEN_OPS */
 static void pr_ops(void)
 {
 #ifdef DEBUG_PLUGIN_GEN_OPS
    TCGOp *op;
    int i = 0;
    QTAILQ_FOREACH(op, &tcg_ctx->ops, link) {
        const char *name = "";
        const char *type = "";
        if (op->opc == INDEX_op_plugin_cb_start) {
            switch (op->args[0]) {
            case PLUGIN_GEN_FROM_TB:
                name = "tb";
                break;
            case PLUGIN_GEN_FROM_INSN:
                name = "insn";
                break;
            case PLUGIN_GEN_FROM_MEM:
                name = "mem";
                break;
            case PLUGIN_GEN_AFTER_INSN:
                name = "after insn";
                break;
            default:
                break;
            }
            switch (op->args[1]) {
            case PLUGIN_GEN_CB_UDATA:
                type = "udata";
                break;
            case PLUGIN_GEN_CB_INLINE:
                type = "inline";
                break;
            case PLUGIN_GEN_CB_MEM:
                type = "mem";
                break;
            case PLUGIN_GEN_ENABLE_MEM_HELPER:
                type = "enable mem helper";
                break;
            case PLUGIN_GEN_DISABLE_MEM_HELPER:
                type = "disable mem helper";
                break;
            default:
                break;
            }
        }
        printf("op[%2i]: %s %s %s\n", i, tcg_op_defs[op->opc].name, name, type);
        i++;
    }
 #endif
 }
 static void plugin_gen_inject(const struct qemu_plugin_tb *plugin_tb)
 {
    TCGOp *op;
    int insn_idx;
    pr_ops();
    insn_idx = -1;
    QSIMPLEQ_FOREACH(op, &tcg_ctx->plugin_ops, plugin_link) {
        enum plugin_gen_from from = op->args[0];
        enum plugin_gen_cb type = op->args[1];
        tcg_debug_assert(op->opc == INDEX_op_plugin_cb_start);
        /* ENABLE_MEM_HELPER is the first callback of an instruction */
        if (from == PLUGIN_GEN_FROM_INSN &&
            type == PLUGIN_GEN_ENABLE_MEM_HELPER) {
            insn_idx++;
        }
        plugin_inject_cb(plugin_tb, op, insn_idx);
    }
    pr_ops();
 }
 bool plugin_gen_tb_start(CPUState *cpu, const TranslationBlock *tb)
 {
    struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
    bool ret = false;
    if (test_bit(QEMU_PLUGIN_EV_VCPU_TB_TRANS, cpu->plugin_mask)) {
        ret = true;
        QSIMPLEQ_INIT(&tcg_ctx->plugin_ops);
        ptb->vaddr = tb->pc;
        ptb->vaddr2 = -1;
        get_page_addr_code_hostp(cpu->env_ptr, tb->pc, &ptb->haddr1);
        ptb->haddr2 = NULL;
        plugin_gen_empty_callback(PLUGIN_GEN_FROM_TB);
    }
    return ret;
 }
 void plugin_gen_insn_start(CPUState *cpu, const DisasContextBase *db)
 {
    struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
    struct qemu_plugin_insn *pinsn;
    pinsn = qemu_plugin_tb_insn_get(ptb);
    tcg_ctx->plugin_insn = pinsn;
    pinsn->vaddr = db->pc_next;
    plugin_gen_empty_callback(PLUGIN_GEN_FROM_INSN);
    /*
     * Detect page crossing to get the new host address.
     * Note that we skip this when haddr1 == NULL, e.g. when we're
     * fetching instructions from a region not backed by RAM.
     */
    if (likely(ptb->haddr1 != NULL && ptb->vaddr2 == -1) &&
        unlikely((db->pc_next & TARGET_PAGE_MASK) !=
                 (db->pc_first & TARGET_PAGE_MASK))) {
        get_page_addr_code_hostp(cpu->env_ptr, db->pc_next,
                                 &ptb->haddr2);
        ptb->vaddr2 = db->pc_next;
    }
    if (likely(ptb->vaddr2 == -1)) {
        pinsn->haddr = ptb->haddr1 + pinsn->vaddr - ptb->vaddr;
    } else {
        pinsn->haddr = ptb->haddr2 + pinsn->vaddr - ptb->vaddr2;
    }
 }
 void plugin_gen_insn_end(void)
 {
    plugin_gen_empty_callback(PLUGIN_GEN_AFTER_INSN);
 }
 void plugin_gen_tb_end(CPUState *cpu)
 {
    struct qemu_plugin_tb *ptb = tcg_ctx->plugin_tb;
    int i;
    /* collect instrumentation requests */
    qemu_plugin_tb_trans_cb(cpu, ptb);
    /* inject the instrumentation at the appropriate places */
    plugin_gen_inject(ptb);
    /* clean up */
    for (i = 0; i < PLUGIN_N_CB_SUBTYPES; i++) {
        if (ptb->cbs[i]) {
            g_array_set_size(ptb->cbs[i], 0);
        }
    }
    ptb->n = 0;
    tcg_ctx->plugin_insn = NULL;
 }
--- a/accel/tcg/plugin-helpers.h
+++ b/accel/tcg/plugin-helpers.h
@@ -1,5 +0,0 @@
 #ifdef CONFIG_PLUGIN
 /* Note: no TCG flags because those are overwritten later */
 DEF_HELPER_2(plugin_vcpu_udata_cb, void, i32, ptr)
 DEF_HELPER_4(plugin_vcpu_mem_cb, void, i32, i32, i64, ptr)
 #endif
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -1,226 +0,0 @@
 /*
 * QEMU System Emulator, accelerator interfaces
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 * Copyright (c) 2014 Red Hat Inc.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "sysemu/accel.h"
 #include "sysemu/tcg.h"
 #include "qom/object.h"
 #include "cpu.h"
 #include "sysemu/cpus.h"
 #include "qemu/main-loop.h"
 #include "tcg/tcg.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "qapi/qapi-builtin-visit.h"
 typedef struct TCGState {
    AccelState parent_obj;
    bool mttcg_enabled;
    unsigned long tb_size;
 } TCGState;
 #define TYPE_TCG_ACCEL ACCEL_CLASS_NAME("tcg")
 #define TCG_STATE(obj) \
        OBJECT_CHECK(TCGState, (obj), TYPE_TCG_ACCEL)
 /* mask must never be zero, except for A20 change call */
 static void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
    int old_mask;
    g_assert(qemu_mutex_iothread_locked());
    old_mask = cpu->interrupt_request;
    cpu->interrupt_request |= mask;
    /*
     * If called from iothread context, wake the target cpu in
     * case its halted.
     */
    if (!qemu_cpu_is_self(cpu)) {
        qemu_cpu_kick(cpu);
    } else {
        atomic_set(&cpu_neg(cpu)->icount_decr.u16.high, -1);
        if (use_icount &&
            !cpu->can_do_io
            && (mask & ~old_mask) != 0) {
            cpu_abort(cpu, "Raised interrupt while not in I/O function");
        }
    }
 }
 /*
 * We default to false if we know other options have been enabled
 * which are currently incompatible with MTTCG. Otherwise when each
 * guest (target) has been updated to support:
 *   - atomic instructions
 *   - memory ordering primitives (barriers)
 * they can set the appropriate CONFIG flags in ${target}-softmmu.mak
 *
 * Once a guest architecture has been converted to the new primitives
 * there are two remaining limitations to check.
 *
 * - The guest can't be oversized (e.g. 64 bit guest on 32 bit host)
 * - The host must have a stronger memory order than the guest
 *
 * It may be possible in future to support strong guests on weak hosts
 * but that will require tagging all load/stores in a guest with their
 * implicit memory order requirements which would likely slow things
 * down a lot.
 */
 static bool check_tcg_memory_orders_compatible(void)
 {
 #if defined(TCG_GUEST_DEFAULT_MO) && defined(TCG_TARGET_DEFAULT_MO)
    return (TCG_GUEST_DEFAULT_MO & ~TCG_TARGET_DEFAULT_MO) == 0;
 #else
    return false;
 #endif
 }
 static bool default_mttcg_enabled(void)
 {
    if (use_icount || TCG_OVERSIZED_GUEST) {
        return false;
    } else {
 #ifdef TARGET_SUPPORTS_MTTCG
        return check_tcg_memory_orders_compatible();
 #else
        return false;
 #endif
    }
 }
 static void tcg_accel_instance_init(Object *obj)
 {
    TCGState *s = TCG_STATE(obj);
    s->mttcg_enabled = default_mttcg_enabled();
 }
 static int tcg_init(MachineState *ms)
 {
    TCGState *s = TCG_STATE(current_accel());
    tcg_exec_init(s->tb_size * 1024 * 1024);
    cpu_interrupt_handler = tcg_handle_interrupt;
    mttcg_enabled = s->mttcg_enabled;
    return 0;
 }
 static char *tcg_get_thread(Object *obj, Error **errp)
 {
    TCGState *s = TCG_STATE(obj);
    return g_strdup(s->mttcg_enabled ? "multi" : "single");
 }
 static void tcg_set_thread(Object *obj, const char *value, Error **errp)
 {
    TCGState *s = TCG_STATE(obj);
    if (strcmp(value, "multi") == 0) {
        if (TCG_OVERSIZED_GUEST) {
            error_setg(errp, "No MTTCG when guest word size > hosts");
        } else if (use_icount) {
            error_setg(errp, "No MTTCG when icount is enabled");
        } else {
 #ifndef TARGET_SUPPORTS_MTTCG
            warn_report("Guest not yet converted to MTTCG - "
                        "you may get unexpected results");
 #endif
            if (!check_tcg_memory_orders_compatible()) {
                warn_report("Guest expects a stronger memory ordering "
                            "than the host provides");
                error_printf("This may cause strange/hard to debug errors\n");
            }
            s->mttcg_enabled = true;
        }
    } else if (strcmp(value, "single") == 0) {
        s->mttcg_enabled = false;
    } else {
        error_setg(errp, "Invalid 'thread' setting %s", value);
    }
 }
 static void tcg_get_tb_size(Object *obj, Visitor *v,
                            const char *name, void *opaque,
                            Error **errp)
 {
    TCGState *s = TCG_STATE(obj);
    uint32_t value = s->tb_size;
    visit_type_uint32(v, name, &value, errp);
 }
 static void tcg_set_tb_size(Object *obj, Visitor *v,
                            const char *name, void *opaque,
                            Error **errp)
 {
    TCGState *s = TCG_STATE(obj);
    uint32_t value;
    if (!visit_type_uint32(v, name, &value, errp)) {
        return;
    }
    s->tb_size = value;
 }
 static void tcg_accel_class_init(ObjectClass *oc, void *data)
 {
    AccelClass *ac = ACCEL_CLASS(oc);
    ac->name = "tcg";
    ac->init_machine = tcg_init;
    ac->allowed = &tcg_allowed;
    object_class_property_add_str(oc, "thread",
                                  tcg_get_thread,
                                  tcg_set_thread);
    object_class_property_add(oc, "tb-size", "int",
        tcg_get_tb_size, tcg_set_tb_size,
        NULL, NULL);
    object_class_property_set_description(oc, "tb-size",
        "TCG translation block cache size");
 }
 static const TypeInfo tcg_accel_type = {
    .name = TYPE_TCG_ACCEL,
    .parent = TYPE_ACCEL,
    .instance_init = tcg_accel_instance_init,
    .class_init = tcg_accel_class_init,
    .instance_size = sizeof(TCGState),
 };
 static void register_accel_types(void)
 {
    type_register_static(&tcg_accel_type);
 }
 type_init(register_accel_types);
--- a/accel/tcg/tcg-runtime-gvec.c
+++ b/accel/tcg/tcg-runtime-gvec.c
--- a/accel/tcg/tcg-runtime.c
+++ b/accel/tcg/tcg-runtime.c
@@ -1,170 +0,0 @@
 /*
 * Tiny Code Generator for QEMU
 *
 * Copyright (c) 2008 Fabrice Bellard
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
 #include "exec/exec-all.h"
 #include "exec/tb-lookup.h"
 #include "disas/disas.h"
 #include "exec/log.h"
 #include "tcg/tcg.h"
 /* 32-bit helpers */
 int32_t HELPER(div_i32)(int32_t arg1, int32_t arg2)
 {
    return arg1 / arg2;
 }
 int32_t HELPER(rem_i32)(int32_t arg1, int32_t arg2)
 {
    return arg1 % arg2;
 }
 uint32_t HELPER(divu_i32)(uint32_t arg1, uint32_t arg2)
 {
    return arg1 / arg2;
 }
 uint32_t HELPER(remu_i32)(uint32_t arg1, uint32_t arg2)
 {
    return arg1 % arg2;
 }
 /* 64-bit helpers */
 uint64_t HELPER(shl_i64)(uint64_t arg1, uint64_t arg2)
 {
    return arg1 << arg2;
 }
 uint64_t HELPER(shr_i64)(uint64_t arg1, uint64_t arg2)
 {
    return arg1 >> arg2;
 }
 int64_t HELPER(sar_i64)(int64_t arg1, int64_t arg2)
 {
    return arg1 >> arg2;
 }
 int64_t HELPER(div_i64)(int64_t arg1, int64_t arg2)
 {
    return arg1 / arg2;
 }
 int64_t HELPER(rem_i64)(int64_t arg1, int64_t arg2)
 {
    return arg1 % arg2;
 }
 uint64_t HELPER(divu_i64)(uint64_t arg1, uint64_t arg2)
 {
    return arg1 / arg2;
 }
 uint64_t HELPER(remu_i64)(uint64_t arg1, uint64_t arg2)
 {
    return arg1 % arg2;
 }
 uint64_t HELPER(muluh_i64)(uint64_t arg1, uint64_t arg2)
 {
    uint64_t l, h;
    mulu64(&l, &h, arg1, arg2);
    return h;
 }
 int64_t HELPER(mulsh_i64)(int64_t arg1, int64_t arg2)
 {
    uint64_t l, h;
    muls64(&l, &h, arg1, arg2);
    return h;
 }
 uint32_t HELPER(clz_i32)(uint32_t arg, uint32_t zero_val)
 {
    return arg ? clz32(arg) : zero_val;
 }
 uint32_t HELPER(ctz_i32)(uint32_t arg, uint32_t zero_val)
 {
    return arg ? ctz32(arg) : zero_val;
 }
 uint64_t HELPER(clz_i64)(uint64_t arg, uint64_t zero_val)
 {
    return arg ? clz64(arg) : zero_val;
 }
 uint64_t HELPER(ctz_i64)(uint64_t arg, uint64_t zero_val)
 {
    return arg ? ctz64(arg) : zero_val;
 }
 uint32_t HELPER(clrsb_i32)(uint32_t arg)
 {
    return clrsb32(arg);
 }
 uint64_t HELPER(clrsb_i64)(uint64_t arg)
 {
    return clrsb64(arg);
 }
 uint32_t HELPER(ctpop_i32)(uint32_t arg)
 {
    return ctpop32(arg);
 }
 uint64_t HELPER(ctpop_i64)(uint64_t arg)
 {
    return ctpop64(arg);
 }
 void *HELPER(lookup_tb_ptr)(CPUArchState *env)
 {
    CPUState *cpu = env_cpu(env);
    TranslationBlock *tb;
    target_ulong cs_base, pc;
    uint32_t flags;
    tb = tb_lookup__cpu_state(cpu, &pc, &cs_base, &flags, curr_cflags());
    if (tb == NULL) {
        return tcg_ctx->code_gen_epilogue;
    }
    qemu_log_mask_and_addr(CPU_LOG_EXEC, pc,
                           "Chain %d: %p ["
                           TARGET_FMT_lx "/" TARGET_FMT_lx "/%#x] %s\n",
                           cpu->cpu_index, tb->tc.ptr, cs_base, pc, flags,
                           lookup_symbol(pc));
    return tb->tc.ptr;
 }
 void HELPER(exit_atomic)(CPUArchState *env)
 {
    cpu_loop_exit_atomic(env_cpu(env), GETPC());
 }
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -1,322 +0,0 @@
 DEF_HELPER_FLAGS_2(div_i32, TCG_CALL_NO_RWG_SE, s32, s32, s32)
 DEF_HELPER_FLAGS_2(rem_i32, TCG_CALL_NO_RWG_SE, s32, s32, s32)
 DEF_HELPER_FLAGS_2(divu_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(remu_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(div_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_2(rem_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_2(divu_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(remu_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(shl_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(shr_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sar_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_2(mulsh_i64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_2(muluh_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(clz_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(ctz_i32, TCG_CALL_NO_RWG_SE, i32, i32, i32)
 DEF_HELPER_FLAGS_2(clz_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(ctz_i64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_1(clrsb_i32, TCG_CALL_NO_RWG_SE, i32, i32)
 DEF_HELPER_FLAGS_1(clrsb_i64, TCG_CALL_NO_RWG_SE, i64, i64)
 DEF_HELPER_FLAGS_1(ctpop_i32, TCG_CALL_NO_RWG_SE, i32, i32)
 DEF_HELPER_FLAGS_1(ctpop_i64, TCG_CALL_NO_RWG_SE, i64, i64)
 DEF_HELPER_FLAGS_1(lookup_tb_ptr, TCG_CALL_NO_WG_SE, ptr, env)
 DEF_HELPER_FLAGS_1(exit_atomic, TCG_CALL_NO_WG, noreturn, env)
 #ifdef CONFIG_SOFTMMU
 DEF_HELPER_FLAGS_5(atomic_cmpxchgb, TCG_CALL_NO_WG,
                   i32, env, tl, i32, i32, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgw_be, TCG_CALL_NO_WG,
                   i32, env, tl, i32, i32, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgw_le, TCG_CALL_NO_WG,
                   i32, env, tl, i32, i32, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgl_be, TCG_CALL_NO_WG,
                   i32, env, tl, i32, i32, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgl_le, TCG_CALL_NO_WG,
                   i32, env, tl, i32, i32, i32)
 #ifdef CONFIG_ATOMIC64
 DEF_HELPER_FLAGS_5(atomic_cmpxchgq_be, TCG_CALL_NO_WG,
                   i64, env, tl, i64, i64, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgq_le, TCG_CALL_NO_WG,
                   i64, env, tl, i64, i64, i32)
 #endif
 #ifdef CONFIG_ATOMIC64
 #define GEN_ATOMIC_HELPERS(NAME)                                  \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), b),              \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_le),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_be),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_le),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_be),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), q_le),           \
                       TCG_CALL_NO_WG, i64, env, tl, i64, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), q_be),           \
                       TCG_CALL_NO_WG, i64, env, tl, i64, i32)
 #else
 #define GEN_ATOMIC_HELPERS(NAME)                                  \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), b),              \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_le),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), w_be),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_le),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)    \
    DEF_HELPER_FLAGS_4(glue(glue(atomic_, NAME), l_be),           \
                       TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 #endif /* CONFIG_ATOMIC64 */
 #else
 DEF_HELPER_FLAGS_4(atomic_cmpxchgb, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 DEF_HELPER_FLAGS_4(atomic_cmpxchgw_be, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 DEF_HELPER_FLAGS_4(atomic_cmpxchgw_le, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 DEF_HELPER_FLAGS_4(atomic_cmpxchgl_be, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 DEF_HELPER_FLAGS_4(atomic_cmpxchgl_le, TCG_CALL_NO_WG, i32, env, tl, i32, i32)
 #ifdef CONFIG_ATOMIC64
 DEF_HELPER_FLAGS_4(atomic_cmpxchgq_be, TCG_CALL_NO_WG, i64, env, tl, i64, i64)
 DEF_HELPER_FLAGS_4(atomic_cmpxchgq_le, TCG_CALL_NO_WG, i64, env, tl, i64, i64)
 #endif
 #ifdef CONFIG_ATOMIC64
 #define GEN_ATOMIC_HELPERS(NAME)                             \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), b),         \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_le),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_be),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_le),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_be),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), q_le),      \
                       TCG_CALL_NO_WG, i64, env, tl, i64)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), q_be),      \
                       TCG_CALL_NO_WG, i64, env, tl, i64)
 #else
 #define GEN_ATOMIC_HELPERS(NAME)                             \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), b),         \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_le),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), w_be),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_le),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)    \
    DEF_HELPER_FLAGS_3(glue(glue(atomic_, NAME), l_be),      \
                       TCG_CALL_NO_WG, i32, env, tl, i32)
 #endif /* CONFIG_ATOMIC64 */
 #endif /* CONFIG_SOFTMMU */
 GEN_ATOMIC_HELPERS(fetch_add)
 GEN_ATOMIC_HELPERS(fetch_and)
 GEN_ATOMIC_HELPERS(fetch_or)
 GEN_ATOMIC_HELPERS(fetch_xor)
 GEN_ATOMIC_HELPERS(fetch_smin)
 GEN_ATOMIC_HELPERS(fetch_umin)
 GEN_ATOMIC_HELPERS(fetch_smax)
 GEN_ATOMIC_HELPERS(fetch_umax)
 GEN_ATOMIC_HELPERS(add_fetch)
 GEN_ATOMIC_HELPERS(and_fetch)
 GEN_ATOMIC_HELPERS(or_fetch)
 GEN_ATOMIC_HELPERS(xor_fetch)
 GEN_ATOMIC_HELPERS(smin_fetch)
 GEN_ATOMIC_HELPERS(umin_fetch)
 GEN_ATOMIC_HELPERS(smax_fetch)
 GEN_ATOMIC_HELPERS(umax_fetch)
 GEN_ATOMIC_HELPERS(xchg)
 #undef GEN_ATOMIC_HELPERS
 DEF_HELPER_FLAGS_3(gvec_mov, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_dup8, TCG_CALL_NO_RWG, void, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(gvec_dup16, TCG_CALL_NO_RWG, void, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(gvec_dup32, TCG_CALL_NO_RWG, void, ptr, i32, i32)
 DEF_HELPER_FLAGS_3(gvec_dup64, TCG_CALL_NO_RWG, void, ptr, i32, i64)
 DEF_HELPER_FLAGS_4(gvec_add8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_add16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_add32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_add64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_adds8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_adds16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_adds32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_adds64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_sub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_subs8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_subs16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_subs32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_subs64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_mul8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_mul16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_mul32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_mul64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_muls8, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_muls16, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_muls32, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_muls64, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_ssadd8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ssadd16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ssadd32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ssadd64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sssub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sssub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sssub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sssub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_usadd8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_usadd16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_usadd32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_usadd64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ussub64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_smax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umin8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umin16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umin32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umin64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umax8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umax16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umax32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_umax64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg8, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg16, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg32, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_neg64, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_abs8, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_abs16, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_abs32, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_abs64, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_not, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_and, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_or, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_xor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_andc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_orc, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_nand, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_nor, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_eqv, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ands, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_xors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_4(gvec_ors, TCG_CALL_NO_RWG, void, ptr, ptr, i64, i32)
 DEF_HELPER_FLAGS_3(gvec_shl8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shl16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shl32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shl64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shr8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shr16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shr32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_shr64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_sar8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_sar16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_sar32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_sar64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_rotl8i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_rotl16i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_rotl32i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(gvec_rotl64i, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shl8v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shl16v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shl32v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shl64v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shr8v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shr16v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shr32v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_shr64v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sar8v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sar16v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sar32v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_sar64v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotl8v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotl16v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotl32v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotl64v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotr8v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotr16v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotr32v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_rotr64v, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_eq8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_eq16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_eq32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_eq64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ne8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ne16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ne32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ne64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_lt8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_lt16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_lt32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_lt64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_le8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_le16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_le32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_le64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ltu8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ltu16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ltu32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_ltu64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_leu8, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_leu16, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_leu32, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(gvec_leu64, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_bitsel, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, ptr, i32)
--- a/accel/tcg/trace-events
+++ b/accel/tcg/trace-events
@@ -1,10 +0,0 @@
 # See docs/devel/tracing.txt for syntax documentation.
 # TCG related tracing
 # cpu-exec.c
 exec_tb(void *tb, uintptr_t pc) "tb:%p pc=0x%"PRIxPTR
 exec_tb_nocache(void *tb, uintptr_t pc) "tb:%p pc=0x%"PRIxPTR
 exec_tb_exit(void *last_tb, unsigned int flags) "tb:%p flags=0x%x"
 # translate-all.c
 translate_block(void *tb, uintptr_t pc, uint8_t *tb_code) "tb:%p, pc:0x%"PRIxPTR", tb_code:%p"
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
--- a/accel/tcg/translate-all.h
+++ b/accel/tcg/translate-all.h
@@ -1,39 +0,0 @@
 /*
 *  Translated block handling
 *
 *  Copyright (c) 2003 Fabrice Bellard
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */
 #ifndef TRANSLATE_ALL_H
 #define TRANSLATE_ALL_H
 #include "exec/exec-all.h"
 /* translate-all.c */
 struct page_collection *page_collection_lock(tb_page_addr_t start,
                                             tb_page_addr_t end);
 void page_collection_unlock(struct page_collection *set);
 void tb_invalidate_phys_page_fast(struct page_collection *pages,
                                  tb_page_addr_t start, int len,
                                  uintptr_t retaddr);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end);
 void tb_check_watchpoint(CPUState *cpu, uintptr_t retaddr);
 #ifdef CONFIG_USER_ONLY
 int page_unprotect(target_ulong address, uintptr_t pc);
 #endif
 #endif /* TRANSLATE_ALL_H */
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -1,148 +0,0 @@
 /*
 * Generic intermediate code generation.
 *
 * Copyright (C) 2016-2017 Lluís Vilanova <vilanova@ac.upc.edu>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 * See the COPYING file in the top-level directory.
 */
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "cpu.h"
 #include "tcg/tcg.h"
 #include "tcg/tcg-op.h"
 #include "exec/exec-all.h"
 #include "exec/gen-icount.h"
 #include "exec/log.h"
 #include "exec/translator.h"
 #include "exec/plugin-gen.h"
 /* Pairs with tcg_clear_temp_count.
   To be called by #TranslatorOps.{translate_insn,tb_stop} if
   (1) the target is sufficiently clean to support reporting,
   (2) as and when all temporaries are known to be consumed.
   For most targets, (2) is at the end of translate_insn.  */
 void translator_loop_temp_check(DisasContextBase *db)
 {
    if (tcg_check_temp_count()) {
        qemu_log("warning: TCG temporary leaks before "
                 TARGET_FMT_lx "\n", db->pc_next);
    }
 }
 void translator_loop(const TranslatorOps *ops, DisasContextBase *db,
                     CPUState *cpu, TranslationBlock *tb, int max_insns)
 {
    int bp_insn = 0;
    bool plugin_enabled;
    /* Initialize DisasContext */
    db->tb = tb;
    db->pc_first = tb->pc;
    db->pc_next = db->pc_first;
    db->is_jmp = DISAS_NEXT;
    db->num_insns = 0;
    db->max_insns = max_insns;
    db->singlestep_enabled = cpu->singlestep_enabled;
    ops->init_disas_context(db, cpu);
    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
    /* Reset the temp count so that we can identify leaks */
    tcg_clear_temp_count();
    /* Start translating.  */
    gen_tb_start(db->tb);
    ops->tb_start(db, cpu);
    tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
    plugin_enabled = plugin_gen_tb_start(cpu, tb);
    while (true) {
        db->num_insns++;
        ops->insn_start(db, cpu);
        tcg_debug_assert(db->is_jmp == DISAS_NEXT);  /* no early exit */
        if (plugin_enabled) {
            plugin_gen_insn_start(cpu, db);
        }
        /* Pass breakpoint hits to target for further processing */
        if (!db->singlestep_enabled
            && unlikely(!QTAILQ_EMPTY(&cpu->breakpoints))) {
            CPUBreakpoint *bp;
            QTAILQ_FOREACH(bp, &cpu->breakpoints, entry) {
                if (bp->pc == db->pc_next) {
                    if (ops->breakpoint_check(db, cpu, bp)) {
                        bp_insn = 1;
                        break;
                    }
                }
            }
            /* The breakpoint_check hook may use DISAS_TOO_MANY to indicate
               that only one more instruction is to be executed.  Otherwise
               it should use DISAS_NORETURN when generating an exception,
               but may use a DISAS_TARGET_* value for Something Else.  */
            if (db->is_jmp > DISAS_TOO_MANY) {
                break;
            }
        }
        /* Disassemble one instruction.  The translate_insn hook should
           update db->pc_next and db->is_jmp to indicate what should be
           done next -- either exiting this loop or locate the start of
           the next instruction.  */
        if (db->num_insns == db->max_insns
            && (tb_cflags(db->tb) & CF_LAST_IO)) {
            /* Accept I/O on the last instruction.  */
            gen_io_start();
            ops->translate_insn(db, cpu);
        } else {
            ops->translate_insn(db, cpu);
        }
        /* Stop translation if translate_insn so indicated.  */
        if (db->is_jmp != DISAS_NEXT) {
            break;
        }
        /*
         * We can't instrument after instructions that change control
         * flow although this only really affects post-load operations.
         */
        if (plugin_enabled) {
            plugin_gen_insn_end();
        }
        /* Stop translation if the output buffer is full,
           or we have executed all of the allowed instructions.  */
        if (tcg_op_buf_full() || db->num_insns >= db->max_insns) {
            db->is_jmp = DISAS_TOO_MANY;
            break;
        }
    }
    /* Emit code to exit the TB, as indicated by db->is_jmp.  */
    ops->tb_stop(db, cpu);
    gen_tb_end(db->tb, db->num_insns - bp_insn);
    if (plugin_enabled) {
        plugin_gen_tb_end(cpu);
    }
    /* The disas_log hook may use these values rather than recompute.  */
    db->tb->size = db->pc_next - db->pc_first;
    db->tb->icount = db->num_insns;
 #ifdef DEBUG_DISAS
    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)
        && qemu_log_in_addr_range(db->pc_first)) {
        FILE *logfile = qemu_log_lock();
        qemu_log("----------------\n");
        ops->disas_log(db, cpu);
        qemu_log("\n");
        qemu_log_unlock(logfile);
    }
 #endif
 }
--- a/accel/tcg/user-exec-stub.c
+++ b/accel/tcg/user-exec-stub.c
@@ -1,36 +0,0 @@
 #include "qemu/osdep.h"
 #include "hw/core/cpu.h"
 #include "sysemu/replay.h"
 #include "sysemu/sysemu.h"
 bool enable_cpu_pm = false;
 void cpu_resume(CPUState *cpu)
 {
 }
 void qemu_init_vcpu(CPUState *cpu)
 {
 }
 /* User mode emulation does not support record/replay yet.  */
 bool replay_exception(void)
 {
    return true;
 }
 bool replay_has_exception(void)
 {
    return false;
 }
 bool replay_interrupt(void)
 {
    return true;
 }
 bool replay_has_interrupt(void)
 {
    return false;
 }
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
--- a/accel/xen/Makefile.objs
+++ b/accel/xen/Makefile.objs
@@ -1 +0,0 @@
 obj-y += xen-all.o
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -1,227 +0,0 @@
 /*
 * Copyright (C) 2014       Citrix Systems UK Ltd.
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 * Contributions after 2012-01-13 are licensed under the terms of the
 * GNU GPL, version 2 or (at your option) any later version.
 */
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "hw/xen/xen-legacy-backend.h"
 #include "hw/xen/xen_pt.h"
 #include "chardev/char.h"
 #include "sysemu/accel.h"
 #include "sysemu/xen.h"
 #include "sysemu/runstate.h"
 #include "migration/misc.h"
 #include "migration/global_state.h"
 #include "hw/boards.h"
 //#define DEBUG_XEN
 #ifdef DEBUG_XEN
 #define DPRINTF(fmt, ...) \
    do { fprintf(stderr, "xen: " fmt, ## __VA_ARGS__); } while (0)
 #else
 #define DPRINTF(fmt, ...) \
    do { } while (0)
 #endif
 static bool xen_allowed;
 bool xen_enabled(void)
 {
    return xen_allowed;
 }
 xc_interface *xen_xc;
 xenforeignmemory_handle *xen_fmem;
 xendevicemodel_handle *xen_dmod;
 static int store_dev_info(int domid, Chardev *cs, const char *string)
 {
    struct xs_handle *xs = NULL;
    char *path = NULL;
    char *newpath = NULL;
    char *pts = NULL;
    int ret = -1;
    /* Only continue if we're talking to a pty. */
    if (!CHARDEV_IS_PTY(cs)) {
        return 0;
    }
    pts = cs->filename + 4;
    /* We now have everything we need to set the xenstore entry. */
    xs = xs_open(0);
    if (xs == NULL) {
        fprintf(stderr, "Could not contact XenStore\n");
        goto out;
    }
    path = xs_get_domain_path(xs, domid);
    if (path == NULL) {
        fprintf(stderr, "xs_get_domain_path() error\n");
        goto out;
    }
    newpath = realloc(path, (strlen(path) + strlen(string) +
                strlen("/tty") + 1));
    if (newpath == NULL) {
        fprintf(stderr, "realloc error\n");
        goto out;
    }
    path = newpath;
    strcat(path, string);
    strcat(path, "/tty");
    if (!xs_write(xs, XBT_NULL, path, pts, strlen(pts))) {
        fprintf(stderr, "xs_write for '%s' fail", string);
        goto out;
    }
    ret = 0;
 out:
    free(path);
    xs_close(xs);
    return ret;
 }
 void xenstore_store_pv_console_info(int i, Chardev *chr)
 {
    if (i == 0) {
        store_dev_info(xen_domid, chr, "/console");
    } else {
        char buf[32];
        snprintf(buf, sizeof(buf), "/device/console/%d", i);
        store_dev_info(xen_domid, chr, buf);
    }
 }
 static void xenstore_record_dm_state(struct xs_handle *xs, const char *state)
 {
    char path[50];
    if (xs == NULL) {
        error_report("xenstore connection not initialized");
        exit(1);
    }
    snprintf(path, sizeof (path), "device-model/%u/state", xen_domid);
    /*
     * This call may fail when running restricted so don't make it fatal in
     * that case. Toolstacks should instead use QMP to listen for state changes.
     */
    if (!xs_write(xs, XBT_NULL, path, state, strlen(state)) &&
            !xen_domid_restrict) {
        error_report("error recording dm state");
        exit(1);
    }
 }
 static void xen_change_state_handler(void *opaque, int running,
                                     RunState state)
 {
    if (running) {
        /* record state running */
        xenstore_record_dm_state(xenstore, "running");
    }
 }
 static bool xen_get_igd_gfx_passthru(Object *obj, Error **errp)
 {
    return xen_igd_gfx_pt_enabled();
 }
 static void xen_set_igd_gfx_passthru(Object *obj, bool value, Error **errp)
 {
    xen_igd_gfx_pt_set(value, errp);
 }
 static void xen_setup_post(MachineState *ms, AccelState *accel)
 {
    int rc;
    if (xen_domid_restrict) {
        rc = xen_restrict(xen_domid);
        if (rc < 0) {
            perror("xen: failed to restrict");
            exit(1);
        }
    }
 }
 static int xen_init(MachineState *ms)
 {
    MachineClass *mc = MACHINE_GET_CLASS(ms);
    xen_xc = xc_interface_open(0, 0, 0);
    if (xen_xc == NULL) {
        xen_pv_printf(NULL, 0, "can't open xen interface\n");
        return -1;
    }
    xen_fmem = xenforeignmemory_open(0, 0);
    if (xen_fmem == NULL) {
        xen_pv_printf(NULL, 0, "can't open xen fmem interface\n");
        xc_interface_close(xen_xc);
        return -1;
    }
    xen_dmod = xendevicemodel_open(0, 0);
    if (xen_dmod == NULL) {
        xen_pv_printf(NULL, 0, "can't open xen devicemodel interface\n");
        xenforeignmemory_close(xen_fmem);
        xc_interface_close(xen_xc);
        return -1;
    }
    qemu_add_vm_change_state_handler(xen_change_state_handler, NULL);
    /*
     * opt out of system RAM being allocated by generic code
     */
    mc->default_ram_id = NULL;
    return 0;
 }
 static void xen_accel_class_init(ObjectClass *oc, void *data)
 {
    AccelClass *ac = ACCEL_CLASS(oc);
    static GlobalProperty compat[] = {
        { "migration", "store-global-state", "off" },
        { "migration", "send-configuration", "off" },
        { "migration", "send-section-footer", "off" },
    };
    ac->name = "Xen";
    ac->init_machine = xen_init;
    ac->setup_post = xen_setup_post;
    ac->allowed = &xen_allowed;
    ac->compat_props = g_ptr_array_new();
    compat_props_add(ac->compat_props, compat, G_N_ELEMENTS(compat));
    object_class_property_add_bool(oc, "igd-passthru",
        xen_get_igd_gfx_passthru, xen_set_igd_gfx_passthru);
    object_class_property_set_description(oc, "igd-passthru",
        "Set on/off to enable/disable igd passthrou");
 }
 #define TYPE_XEN_ACCEL ACCEL_CLASS_NAME("xen")
 static const TypeInfo xen_accel_type = {
    .name = TYPE_XEN_ACCEL,
    .parent = TYPE_ACCEL,
    .class_init = xen_accel_class_init,
 };
 static void xen_type_init(void)
 {
    type_register_static(&xen_accel_type);
 }
 type_init(xen_type_init);
--- a/acl.c
+++ b/acl.c
@@ -0,0 +1,185 @@
 /*
 * QEMU access control list management
 *
 * Copyright (C) 2009 Red Hat, Inc
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
 #include "sysemu.h"
 #include "acl.h"
 #ifdef CONFIG_FNMATCH
 #include <fnmatch.h>
 #endif
 static unsigned int nacls = 0;
 static qemu_acl **acls = NULL;
 qemu_acl *qemu_acl_find(const char *aclname)
 {
    int i;
    for (i = 0 ; i < nacls ; i++) {
        if (strcmp(acls[i]->aclname, aclname) == 0)
            return acls[i];
    }
    return NULL;
 }
 qemu_acl *qemu_acl_init(const char *aclname)
 {
    qemu_acl *acl;
    acl = qemu_acl_find(aclname);
    if (acl)
        return acl;
    acl = qemu_malloc(sizeof(*acl));
    acl->aclname = qemu_strdup(aclname);
    /* Deny by default, so there is no window of "open
     * access" between QEMU starting, and the user setting
     * up ACLs in the monitor */
    acl->defaultDeny = 1;
    acl->nentries = 0;
    QTAILQ_INIT(&acl->entries);
    acls = qemu_realloc(acls, sizeof(*acls) * (nacls +1));
    acls[nacls] = acl;
    nacls++;
    return acl;
 }
 int qemu_acl_party_is_allowed(qemu_acl *acl,
                              const char *party)
 {
    qemu_acl_entry *entry;
    QTAILQ_FOREACH(entry, &acl->entries, next) {
 #ifdef CONFIG_FNMATCH
        if (fnmatch(entry->match, party, 0) == 0)
            return entry->deny ? 0 : 1;
 #else
        /* No fnmatch, so fallback to exact string matching
         * instead of allowing wildcards */
        if (strcmp(entry->match, party) == 0)
            return entry->deny ? 0 : 1;
 #endif
    }
    return acl->defaultDeny ? 0 : 1;
 }
 void qemu_acl_reset(qemu_acl *acl)
 {
    qemu_acl_entry *entry;
    /* Put back to deny by default, so there is no window
     * of "open access" while the user re-initializes the
     * access control list */
    acl->defaultDeny = 1;
    QTAILQ_FOREACH(entry, &acl->entries, next) {
        QTAILQ_REMOVE(&acl->entries, entry, next);
        free(entry->match);
        free(entry);
    }
    acl->nentries = 0;
 }
 int qemu_acl_append(qemu_acl *acl,
                    int deny,
                    const char *match)
 {
    qemu_acl_entry *entry;
    entry = qemu_malloc(sizeof(*entry));
    entry->match = qemu_strdup(match);
    entry->deny = deny;
    QTAILQ_INSERT_TAIL(&acl->entries, entry, next);
    acl->nentries++;
    return acl->nentries;
 }
 int qemu_acl_insert(qemu_acl *acl,
                    int deny,
                    const char *match,
                    int index)
 {
    qemu_acl_entry *entry;
    qemu_acl_entry *tmp;
    int i = 0;
    if (index <= 0)
        return -1;
    if (index >= acl->nentries)
        return qemu_acl_append(acl, deny, match);
    entry = qemu_malloc(sizeof(*entry));
    entry->match = qemu_strdup(match);
    entry->deny = deny;
    QTAILQ_FOREACH(tmp, &acl->entries, next) {
        i++;
        if (i == index) {
            QTAILQ_INSERT_BEFORE(tmp, entry, next);
            acl->nentries++;
            break;
        }
    }
    return i;
 }
 int qemu_acl_remove(qemu_acl *acl,
                    const char *match)
 {
    qemu_acl_entry *entry;
    int i = 0;
    QTAILQ_FOREACH(entry, &acl->entries, next) {
        i++;
        if (strcmp(entry->match, match) == 0) {
            QTAILQ_REMOVE(&acl->entries, entry, next);
            return i;
        }
    }
    return -1;
 }
 /*
 * Local variables:
 *  c-indent-level: 4
 *  c-basic-offset: 4
 *  tab-width: 8
 * End:
 */
--- a/acl.h
+++ b/acl.h
@@ -0,0 +1,74 @@
 /*
 * QEMU access control list management
 *
 * Copyright (C) 2009 Red Hat, Inc
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef __QEMU_ACL_H__
 #define __QEMU_ACL_H__
 #include "qemu-queue.h"
 typedef struct qemu_acl_entry qemu_acl_entry;
 typedef struct qemu_acl qemu_acl;
 struct qemu_acl_entry {
    char *match;
    int deny;
    QTAILQ_ENTRY(qemu_acl_entry) next;
 };
 struct qemu_acl {
    char *aclname;
    unsigned int nentries;
    QTAILQ_HEAD(,qemu_acl_entry) entries;
    int defaultDeny;
 };
 qemu_acl *qemu_acl_init(const char *aclname);
 qemu_acl *qemu_acl_find(const char *aclname);
 int qemu_acl_party_is_allowed(qemu_acl *acl,
 			      const char *party);
 void qemu_acl_reset(qemu_acl *acl);
 int qemu_acl_append(qemu_acl *acl,
 		    int deny,
 		    const char *match);
 int qemu_acl_insert(qemu_acl *acl,
 		    int deny,
 		    const char *match,
 		    int index);
 int qemu_acl_remove(qemu_acl *acl,
 		    const char *match);
 #endif /* __QEMU_ACL_H__ */
 /*
 * Local variables:
 *  c-indent-level: 4
 *  c-basic-offset: 4
 *  tab-width: 8
 * End:
 */
--- a/aes.c
+++ b/aes.c
--- a/aes.h
+++ b/aes.h
@@ -0,0 +1,26 @@
 #ifndef QEMU_AES_H
 #define QEMU_AES_H
 #define AES_MAXNR 14
 #define AES_BLOCK_SIZE 16
 struct aes_key_st {
    uint32_t rd_key[4 *(AES_MAXNR + 1)];
    int rounds;
 };
 typedef struct aes_key_st AES_KEY;
 int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
 	AES_KEY *key);
 int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
 	AES_KEY *key);
 void AES_encrypt(const unsigned char *in, unsigned char *out,
 	const AES_KEY *key);
 void AES_decrypt(const unsigned char *in, unsigned char *out,
 	const AES_KEY *key);
 void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
 		     const unsigned long length, const AES_KEY *key,
 		     unsigned char *ivec, const int enc);
 #endif
--- a/aio.c
+++ b/aio.c
@@ -0,0 +1,230 @@
 /*
 * QEMU aio implementation
 *
 * Copyright IBM, Corp. 2008
 *
 * Authors:
 *  Anthony Liguori   <aliguori@us.ibm.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2.  See
 * the COPYING file in the top-level directory.
 *
 */
 #include "qemu-common.h"
 #include "block.h"
 #include "qemu-queue.h"
 #include "qemu_socket.h"
 typedef struct AioHandler AioHandler;
 /* The list of registered AIO handlers */
 static QLIST_HEAD(, AioHandler) aio_handlers;
 /* This is a simple lock used to protect the aio_handlers list.  Specifically,
 * it's used to ensure that no callbacks are removed while we're walking and
 * dispatching callbacks.
 */
 static int walking_handlers;
 struct AioHandler
 {
    int fd;
    IOHandler *io_read;
    IOHandler *io_write;
    AioFlushHandler *io_flush;
    AioProcessQueue *io_process_queue;
    int deleted;
    void *opaque;
    QLIST_ENTRY(AioHandler) node;
 };
 static AioHandler *find_aio_handler(int fd)
 {
    AioHandler *node;
    QLIST_FOREACH(node, &aio_handlers, node) {
        if (node->fd == fd)
            if (!node->deleted)
                return node;
    }
    return NULL;
 }
 int qemu_aio_set_fd_handler(int fd,
                            IOHandler *io_read,
                            IOHandler *io_write,
                            AioFlushHandler *io_flush,
                            AioProcessQueue *io_process_queue,
                            void *opaque)
 {
    AioHandler *node;
    node = find_aio_handler(fd);
    /* Are we deleting the fd handler? */
    if (!io_read && !io_write) {
        if (node) {
            /* If the lock is held, just mark the node as deleted */
            if (walking_handlers)
                node->deleted = 1;
            else {
                /* Otherwise, delete it for real.  We can't just mark it as
                 * deleted because deleted nodes are only cleaned up after
                 * releasing the walking_handlers lock.
                 */
                QLIST_REMOVE(node, node);
                qemu_free(node);
            }
        }
    } else {
        if (node == NULL) {
            /* Alloc and insert if it's not already there */
            node = qemu_mallocz(sizeof(AioHandler));
            node->fd = fd;
            QLIST_INSERT_HEAD(&aio_handlers, node, node);
        }
        /* Update handler with latest information */
        node->io_read = io_read;
        node->io_write = io_write;
        node->io_flush = io_flush;
        node->io_process_queue = io_process_queue;
        node->opaque = opaque;
    }
    qemu_set_fd_handler2(fd, NULL, io_read, io_write, opaque);
    return 0;
 }
 void qemu_aio_flush(void)
 {
    AioHandler *node;
    int ret;
    do {
        ret = 0;
 	/*
 	 * If there are pending emulated aio start them now so flush
 	 * will be able to return 1.
 	 */
        qemu_aio_wait();
        QLIST_FOREACH(node, &aio_handlers, node) {
            if (node->io_flush) {
                ret |= node->io_flush(node->opaque);
            }
        }
    } while (qemu_bh_poll() || ret > 0);
 }
 int qemu_aio_process_queue(void)
 {
    AioHandler *node;
    int ret = 0;
    walking_handlers = 1;
    QLIST_FOREACH(node, &aio_handlers, node) {
        if (node->io_process_queue) {
            if (node->io_process_queue(node->opaque)) {
                ret = 1;
            }
        }
    }
    walking_handlers = 0;
    return ret;
 }
 void qemu_aio_wait(void)
 {
    int ret;
    if (qemu_bh_poll())
        return;
    /*
     * If there are callbacks left that have been queued, we need to call then.
     * Return afterwards to avoid waiting needlessly in select().
     */
    if (qemu_aio_process_queue())
        return;
    do {
        AioHandler *node;
        fd_set rdfds, wrfds;
        int max_fd = -1;
        walking_handlers = 1;
        FD_ZERO(&rdfds);
        FD_ZERO(&wrfds);
        /* fill fd sets */
        QLIST_FOREACH(node, &aio_handlers, node) {
            /* If there aren't pending AIO operations, don't invoke callbacks.
             * Otherwise, if there are no AIO requests, qemu_aio_wait() would
             * wait indefinitely.
             */
            if (node->io_flush && node->io_flush(node->opaque) == 0)
                continue;
            if (!node->deleted && node->io_read) {
                FD_SET(node->fd, &rdfds);
                max_fd = MAX(max_fd, node->fd + 1);
            }
            if (!node->deleted && node->io_write) {
                FD_SET(node->fd, &wrfds);
                max_fd = MAX(max_fd, node->fd + 1);
            }
        }
        walking_handlers = 0;
        /* No AIO operations?  Get us out of here */
        if (max_fd == -1)
            break;
        /* wait until next event */
        ret = select(max_fd, &rdfds, &wrfds, NULL, NULL);
        if (ret == -1 && errno == EINTR)
            continue;
        /* if we have any readable fds, dispatch event */
        if (ret > 0) {
            walking_handlers = 1;
            /* we have to walk very carefully in case
             * qemu_aio_set_fd_handler is called while we're walking */
            node = QLIST_FIRST(&aio_handlers);
            while (node) {
                AioHandler *tmp;
                if (!node->deleted &&
                    FD_ISSET(node->fd, &rdfds) &&
                    node->io_read) {
                    node->io_read(node->opaque);
                }
                if (!node->deleted &&
                    FD_ISSET(node->fd, &wrfds) &&
                    node->io_write) {
                    node->io_write(node->opaque);
                }
                tmp = node;
                node = QLIST_NEXT(node, node);
                if (tmp->deleted) {
                    QLIST_REMOVE(tmp, node);
                    qemu_free(tmp);
                }
            }
            walking_handlers = 0;
        }
    } while (ret == 0);
 }
--- a/alpha-dis.c
+++ b/alpha-dis.c
--- a/alpha.ld
+++ b/alpha.ld
@@ -0,0 +1,127 @@
 OUTPUT_FORMAT("elf64-alpha", "elf64-alpha",
 	      "elf64-alpha")
 OUTPUT_ARCH(alpha)
 ENTRY(__start)
 SECTIONS
 {
  /* Read-only sections, merged into text segment: */
  . = 0x60000000 + SIZEOF_HEADERS;
  .interp     : { *(.interp) 	}
  .hash          : { *(.hash)		}
  .dynsym        : { *(.dynsym)		}
  .dynstr        : { *(.dynstr)		}
  .gnu.version   : { *(.gnu.version)	}
  .gnu.version_d   : { *(.gnu.version_d)	}
  .gnu.version_r   : { *(.gnu.version_r)	}
  .rel.text      :
    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
  .rela.text     :
    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
  .rel.data      :
    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
  .rela.data     :
    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
  .rel.rodata    :
    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
  .rela.rodata   :
    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
  .rel.got       : { *(.rel.got)		}
  .rela.got      : { *(.rela.got)		}
  .rel.ctors     : { *(.rel.ctors)	}
  .rela.ctors    : { *(.rela.ctors)	}
  .rel.dtors     : { *(.rel.dtors)	}
  .rela.dtors    : { *(.rela.dtors)	}
  .rel.init      : { *(.rel.init)	}
  .rela.init     : { *(.rela.init)	}
  .rel.fini      : { *(.rel.fini)	}
  .rela.fini     : { *(.rela.fini)	}
  .rel.bss       : { *(.rel.bss)		}
  .rela.bss      : { *(.rela.bss)		}
  .rel.plt       : { *(.rel.plt)		}
  .rela.plt      : { *(.rela.plt)		}
  .init          : { *(.init)	} =0x47ff041f
  .text      :
  {
    *(.text)
    /* .gnu.warning sections are handled specially by elf32.em.  */
    *(.gnu.warning)
    *(.gnu.linkonce.t*)
  } =0x47ff041f
  _etext = .;
  PROVIDE (etext = .);
  .fini      : { *(.fini)    } =0x47ff041f
  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
  .rodata1   : { *(.rodata1) }
  .reginfo : { *(.reginfo) }
  /* Adjust the address for the data segment.  We want to adjust up to
     the same address within the page on the next page up.  */
  . = ALIGN(0x100000) + (. & (0x100000 - 1));
  .data    :
  {
    *(.data)
    *(.gnu.linkonce.d*)
    CONSTRUCTORS
  }
  .data1   : { *(.data1) }
  .ctors         :
  {
    *(.ctors)
  }
  .dtors         :
  {
    *(.dtors)
  }
  .plt      : { *(.plt)	}
  .got           : { *(.got.plt) *(.got) }
  .dynamic       : { *(.dynamic) }
  /* We want the small data sections together, so single-instruction offsets
     can access them all, and initialized data all before uninitialized, so
     we can shorten the on-disk segment size.  */
  .sdata     : { *(.sdata) }
  _edata  =  .;
  PROVIDE (edata = .);
  __bss_start = .;
  .sbss      : { *(.sbss) *(.scommon) }
  .bss       :
  {
   *(.dynbss)
   *(.bss)
   *(COMMON)
  }
  _end = . ;
  PROVIDE (end = .);
  /* Stabs debugging sections.  */
  .stab 0 : { *(.stab) }
  .stabstr 0 : { *(.stabstr) }
  .stab.excl 0 : { *(.stab.excl) }
  .stab.exclstr 0 : { *(.stab.exclstr) }
  .stab.index 0 : { *(.stab.index) }
  .stab.indexstr 0 : { *(.stab.indexstr) }
  .comment 0 : { *(.comment) }
  /* DWARF debug sections.
     Symbols in the DWARF debugging sections are relative to the beginning
     of the section so we begin them at 0.  */
  /* DWARF 1 */
  .debug          0 : { *(.debug) }
  .line           0 : { *(.line) }
  /* GNU DWARF 1 extensions */
  .debug_srcinfo  0 : { *(.debug_srcinfo) }
  .debug_sfnames  0 : { *(.debug_sfnames) }
  /* DWARF 1.1 and DWARF 2 */
  .debug_aranges  0 : { *(.debug_aranges) }
  .debug_pubnames 0 : { *(.debug_pubnames) }
  /* DWARF 2 */
  .debug_info     0 : { *(.debug_info) }
  .debug_abbrev   0 : { *(.debug_abbrev) }
  .debug_line     0 : { *(.debug_line) }
  .debug_frame    0 : { *(.debug_frame) }
  .debug_str      0 : { *(.debug_str) }
  .debug_loc      0 : { *(.debug_loc) }
  .debug_macinfo  0 : { *(.debug_macinfo) }
  /* SGI/MIPS DWARF 2 extensions */
  .debug_weaknames 0 : { *(.debug_weaknames) }
  .debug_funcnames 0 : { *(.debug_funcnames) }
  .debug_typenames 0 : { *(.debug_typenames) }
  .debug_varnames  0 : { *(.debug_varnames) }
  /* These must appear regardless of  .  */
 }
--- a/arm-dis.c
+++ b/arm-dis.c
--- a/arm-semi.c
+++ b/arm-semi.c
@@ -0,0 +1,468 @@
 /*
 *  Arm "Angel" semihosting syscalls
 *
 *  Copyright (c) 2005, 2007 CodeSourcery.
 *  Written by Paul Brook.
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
 */
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <time.h>
 #include "cpu.h"
 #ifdef CONFIG_USER_ONLY
 #include "qemu.h"
 #define ARM_ANGEL_HEAP_SIZE (128 * 1024 * 1024)
 #else
 #include "qemu-common.h"
 #include "sysemu.h"
 #include "gdbstub.h"
 #endif
 #define SYS_OPEN        0x01
 #define SYS_CLOSE       0x02
 #define SYS_WRITEC      0x03
 #define SYS_WRITE0      0x04
 #define SYS_WRITE       0x05
 #define SYS_READ        0x06
 #define SYS_READC       0x07
 #define SYS_ISTTY       0x09
 #define SYS_SEEK        0x0a
 #define SYS_FLEN        0x0c
 #define SYS_TMPNAM      0x0d
 #define SYS_REMOVE      0x0e
 #define SYS_RENAME      0x0f
 #define SYS_CLOCK       0x10
 #define SYS_TIME        0x11
 #define SYS_SYSTEM      0x12
 #define SYS_ERRNO       0x13
 #define SYS_GET_CMDLINE 0x15
 #define SYS_HEAPINFO    0x16
 #define SYS_EXIT        0x18
 #ifndef O_BINARY
 #define O_BINARY 0
 #endif
 #define GDB_O_RDONLY  0x000
 #define GDB_O_WRONLY  0x001
 #define GDB_O_RDWR    0x002
 #define GDB_O_APPEND  0x008
 #define GDB_O_CREAT   0x200
 #define GDB_O_TRUNC   0x400
 #define GDB_O_BINARY  0
 static int gdb_open_modeflags[12] = {
    GDB_O_RDONLY,
    GDB_O_RDONLY | GDB_O_BINARY,
    GDB_O_RDWR,
    GDB_O_RDWR | GDB_O_BINARY,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_TRUNC | GDB_O_BINARY,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND,
    GDB_O_WRONLY | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
    GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND | GDB_O_BINARY
 };
 static int open_modeflags[12] = {
    O_RDONLY,
    O_RDONLY | O_BINARY,
    O_RDWR,
    O_RDWR | O_BINARY,
    O_WRONLY | O_CREAT | O_TRUNC,
    O_WRONLY | O_CREAT | O_TRUNC | O_BINARY,
    O_RDWR | O_CREAT | O_TRUNC,
    O_RDWR | O_CREAT | O_TRUNC | O_BINARY,
    O_WRONLY | O_CREAT | O_APPEND,
    O_WRONLY | O_CREAT | O_APPEND | O_BINARY,
    O_RDWR | O_CREAT | O_APPEND,
    O_RDWR | O_CREAT | O_APPEND | O_BINARY
 };
 #ifdef CONFIG_USER_ONLY
 static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
 {
    if (code == (uint32_t)-1)
        ts->swi_errno = errno;
    return code;
 }
 #else
 static inline uint32_t set_swi_errno(CPUState *env, uint32_t code)
 {
    return code;
 }
 #include "softmmu-semi.h"
 #endif
 static target_ulong arm_semi_syscall_len;
 #if !defined(CONFIG_USER_ONLY)
 static target_ulong syscall_err;
 #endif
 static void arm_semi_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
 #endif
    if (ret == (target_ulong)-1) {
 #ifdef CONFIG_USER_ONLY
        ts->swi_errno = err;
 #else
 	syscall_err = err;
 #endif
        env->regs[0] = ret;
    } else {
        /* Fixup syscalls that use nonstardard return conventions.  */
        switch (env->regs[0]) {
        case SYS_WRITE:
        case SYS_READ:
            env->regs[0] = arm_semi_syscall_len - ret;
            break;
        case SYS_SEEK:
            env->regs[0] = 0;
            break;
        default:
            env->regs[0] = ret;
            break;
        }
    }
 }
 static void arm_semi_flen_cb(CPUState *env, target_ulong ret, target_ulong err)
 {
    /* The size is always stored in big-endian order, extract
       the value. We assume the size always fit in 32 bits.  */
    uint32_t size;
    cpu_memory_rw_debug(env, env->regs[13]-64+32, (uint8_t *)&size, 4, 0);
    env->regs[0] = be32_to_cpu(size);
 #ifdef CONFIG_USER_ONLY
    ((TaskState *)env->opaque)->swi_errno = err;
 #else
    syscall_err = err;
 #endif
 }
 #define ARG(n)					\
 ({						\
    target_ulong __arg;				\
    /* FIXME - handle get_user() failure */	\
    get_user_ual(__arg, args + (n) * 4);	\
    __arg;					\
 })
 #define SET_ARG(n, val) put_user_ual(val, args + (n) * 4)
 uint32_t do_arm_semihosting(CPUState *env)
 {
    target_ulong args;
    char * s;
    int nr;
    uint32_t ret;
    uint32_t len;
 #ifdef CONFIG_USER_ONLY
    TaskState *ts = env->opaque;
 #else
    CPUState *ts = env;
 #endif
    nr = env->regs[0];
    args = env->regs[1];
    switch (nr) {
    case SYS_OPEN:
        if (!(s = lock_user_string(ARG(0))))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
        if (ARG(1) >= 12)
            return (uint32_t)-1;
        if (strcmp(s, ":tt") == 0) {
            if (ARG(1) < 4)
                return STDIN_FILENO;
            else
                return STDOUT_FILENO;
        }
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
 			   (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
            return env->regs[0];
        } else {
            ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
        }
        unlock_user(s, ARG(0), 0);
        return ret;
    case SYS_CLOSE:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "close,%x", ARG(0));
            return env->regs[0];
        } else {
            return set_swi_errno(ts, close(ARG(0)));
        }
    case SYS_WRITEC:
        {
          char c;
          if (get_user_u8(c, args))
              /* FIXME - should this error code be -TARGET_EFAULT ? */
              return (uint32_t)-1;
          /* Write to debug console.  stderr is near enough.  */
          if (use_gdb_syscalls()) {
                gdb_do_syscall(arm_semi_cb, "write,2,%x,1", args);
                return env->regs[0];
          } else {
                return write(STDERR_FILENO, &c, 1);
          }
        }
    case SYS_WRITE0:
        if (!(s = lock_user_string(args)))
            /* FIXME - should this error code be -TARGET_EFAULT ? */
            return (uint32_t)-1;
        len = strlen(s);
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "write,2,%x,%x\n", args, len);
            ret = env->regs[0];
        } else {
            ret = write(STDERR_FILENO, s, len);
        }
        unlock_user(s, args, 0);
        return ret;
    case SYS_WRITE:
        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
            gdb_do_syscall(arm_semi_cb, "write,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
            if (!(s = lock_user(VERIFY_READ, ARG(1), len, 1)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret = set_swi_errno(ts, write(ARG(0), s, len));
            unlock_user(s, ARG(1), 0);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case SYS_READ:
        len = ARG(2);
        if (use_gdb_syscalls()) {
            arm_semi_syscall_len = len;
            gdb_do_syscall(arm_semi_cb, "read,%x,%x,%x", ARG(0), ARG(1), len);
            return env->regs[0];
        } else {
            if (!(s = lock_user(VERIFY_WRITE, ARG(1), len, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            do
              ret = set_swi_errno(ts, read(ARG(0), s, len));
            while (ret == -1 && errno == EINTR);
            unlock_user(s, ARG(1), len);
            if (ret == (uint32_t)-1)
                return -1;
            return len - ret;
        }
    case SYS_READC:
       /* XXX: Read from debug cosole. Not implemented.  */
        return 0;
    case SYS_ISTTY:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "isatty,%x", ARG(0));
            return env->regs[0];
        } else {
            return isatty(ARG(0));
        }
    case SYS_SEEK:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "lseek,%x,%x,0", ARG(0), ARG(1));
            return env->regs[0];
        } else {
            ret = set_swi_errno(ts, lseek(ARG(0), ARG(1), SEEK_SET));
            if (ret == (uint32_t)-1)
              return -1;
            return 0;
        }
    case SYS_FLEN:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_flen_cb, "fstat,%x,%x",
 			   ARG(0), env->regs[13]-64);
            return env->regs[0];
        } else {
            struct stat buf;
            ret = set_swi_errno(ts, fstat(ARG(0), &buf));
            if (ret == (uint32_t)-1)
                return -1;
            return buf.st_size;
        }
    case SYS_TMPNAM:
        /* XXX: Not implemented.  */
        return -1;
    case SYS_REMOVE:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "unlink,%s", ARG(0), (int)ARG(1)+1);
            ret = env->regs[0];
        } else {
            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret =  set_swi_errno(ts, remove(s));
            unlock_user(s, ARG(0), 0);
        }
        return ret;
    case SYS_RENAME:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "rename,%s,%s",
                           ARG(0), (int)ARG(1)+1, ARG(2), (int)ARG(3)+1);
            return env->regs[0];
        } else {
            char *s2;
            s = lock_user_string(ARG(0));
            s2 = lock_user_string(ARG(2));
            if (!s || !s2)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                ret = (uint32_t)-1;
            else
                ret = set_swi_errno(ts, rename(s, s2));
            if (s2)
                unlock_user(s2, ARG(2), 0);
            if (s)
                unlock_user(s, ARG(0), 0);
            return ret;
        }
    case SYS_CLOCK:
        return clock() / (CLOCKS_PER_SEC / 100);
    case SYS_TIME:
        return set_swi_errno(ts, time(NULL));
    case SYS_SYSTEM:
        if (use_gdb_syscalls()) {
            gdb_do_syscall(arm_semi_cb, "system,%s", ARG(0), (int)ARG(1)+1);
            return env->regs[0];
        } else {
            if (!(s = lock_user_string(ARG(0))))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ret = set_swi_errno(ts, system(s));
            unlock_user(s, ARG(0), 0);
            return ret;
        }
    case SYS_ERRNO:
 #ifdef CONFIG_USER_ONLY
        return ts->swi_errno;
 #else
        return syscall_err;
 #endif
    case SYS_GET_CMDLINE:
 #ifdef CONFIG_USER_ONLY
        /* Build a commandline from the original argv.  */
        {
            char **arg = ts->info->host_argv;
            int len = ARG(1);
            /* lock the buffer on the ARM side */
            char *cmdline_buffer = (char*)lock_user(VERIFY_WRITE, ARG(0), len, 0);
            if (!cmdline_buffer)
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            s = cmdline_buffer;
            while (*arg && len > 2) {
                int n = strlen(*arg);
                if (s != cmdline_buffer) {
                    *(s++) = ' ';
                    len--;
                }
                if (n >= len)
                    n = len - 1;
                memcpy(s, *arg, n);
                s += n;
                len -= n;
                arg++;
            }
            /* Null terminate the string.  */
            *s = 0;
            len = s - cmdline_buffer;
            /* Unlock the buffer on the ARM side.  */
            unlock_user(cmdline_buffer, ARG(0), len);
            /* Adjust the commandline length argument.  */
            SET_ARG(1, len);
            /* Return success if commandline fit into buffer.  */
            return *arg ? -1 : 0;
        }
 #else
      return -1;
 #endif
    case SYS_HEAPINFO:
        {
            uint32_t *ptr;
            uint32_t limit;
 #ifdef CONFIG_USER_ONLY
            /* Some C libraries assume the heap immediately follows .bss, so
               allocate it using sbrk.  */
            if (!ts->heap_limit) {
                long ret;
                ts->heap_base = do_brk(0);
                limit = ts->heap_base + ARM_ANGEL_HEAP_SIZE;
                /* Try a big heap, and reduce the size if that fails.  */
                for (;;) {
                    ret = do_brk(limit);
                    if (ret != -1)
                        break;
                    limit = (ts->heap_base >> 1) + (limit >> 1);
                }
                ts->heap_limit = limit;
            }
            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            ptr[0] = tswap32(ts->heap_base);
            ptr[1] = tswap32(ts->heap_limit);
            ptr[2] = tswap32(ts->stack_base);
            ptr[3] = tswap32(0); /* Stack limit.  */
            unlock_user(ptr, ARG(0), 16);
 #else
            limit = ram_size;
            if (!(ptr = lock_user(VERIFY_WRITE, ARG(0), 16, 0)))
                /* FIXME - should this error code be -TARGET_EFAULT ? */
                return (uint32_t)-1;
            /* TODO: Make this use the limit of the loaded application.  */
            ptr[0] = tswap32(limit / 2);
            ptr[1] = tswap32(limit);
            ptr[2] = tswap32(limit); /* Stack base */
            ptr[3] = tswap32(0); /* Stack limit.  */
            unlock_user(ptr, ARG(0), 16);
 #endif
            return 0;
        }
    case SYS_EXIT:
        exit(0);
    default:
        fprintf(stderr, "qemu: Unsupported SemiHosting SWI 0x%02x\n", nr);
        cpu_dump_state(env, stderr, fprintf, 0);
        abort();
    }
 }
--- a/arm.ld
+++ b/arm.ld
@@ -0,0 +1,153 @@
 OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm",
 	      "elf32-littlearm")
 OUTPUT_ARCH(arm)
 ENTRY(_start)
 SECTIONS
 {
  /* Read-only sections, merged into text segment: */
  . = 0x60000000 + SIZEOF_HEADERS;
  .interp     : { *(.interp) 	}
  .hash          : { *(.hash)		}
  .dynsym        : { *(.dynsym)		}
  .dynstr        : { *(.dynstr)		}
  .gnu.version   : { *(.gnu.version)	}
  .gnu.version_d   : { *(.gnu.version_d)	}
  .gnu.version_r   : { *(.gnu.version_r)	}
  .rel.text      :
    { *(.rel.text) *(.rel.gnu.linkonce.t*) }
  .rela.text     :
    { *(.rela.text) *(.rela.gnu.linkonce.t*) }
  .rel.data      :
    { *(.rel.data) *(.rel.gnu.linkonce.d*) }
  .rela.data     :
    { *(.rela.data) *(.rela.gnu.linkonce.d*) }
  .rel.rodata    :
    { *(.rel.rodata) *(.rel.gnu.linkonce.r*) }
  .rela.rodata   :
    { *(.rela.rodata) *(.rela.gnu.linkonce.r*) }
  .rel.got       : { *(.rel.got)		}
  .rela.got      : { *(.rela.got)		}
  .rel.ctors     : { *(.rel.ctors)	}
  .rela.ctors    : { *(.rela.ctors)	}
  .rel.dtors     : { *(.rel.dtors)	}
  .rela.dtors    : { *(.rela.dtors)	}
  .rel.init      : { *(.rel.init)	}
  .rela.init     : { *(.rela.init)	}
  .rel.fini      : { *(.rel.fini)	}
  .rela.fini     : { *(.rela.fini)	}
  .rel.bss       : { *(.rel.bss)		}
  .rela.bss      : { *(.rela.bss)		}
  .rel.plt       : { *(.rel.plt)		}
  .rela.plt      : { *(.rela.plt)		}
  .init          : { *(.init)	} =0x47ff041f
  .text      :
  {
    *(.text)
    /* .gnu.warning sections are handled specially by elf32.em.  */
    *(.gnu.warning)
    *(.gnu.linkonce.t*)
  } =0x47ff041f
  _etext = .;
  PROVIDE (etext = .);
  .fini      : { *(.fini)    } =0x47ff041f
  .rodata    : { *(.rodata) *(.gnu.linkonce.r*) }
  .rodata1   : { *(.rodata1) }
  .ARM.extab   : { *(.ARM.extab* .gnu.linkonce.armextab.*) }
   __exidx_start = .;
  .ARM.exidx   : { *(.ARM.exidx* .gnu.linkonce.armexidx.*) }
   __exidx_end = .;
  .reginfo : { *(.reginfo) }
  /* Adjust the address for the data segment.  We want to adjust up to
     the same address within the page on the next page up.  */
  . = ALIGN(0x100000) + (. & (0x100000 - 1));
  .data    :
  {
    *(.gen_code)
    *(.data)
    *(.gnu.linkonce.d*)
    CONSTRUCTORS
  }
  .tbss           : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
  .data1   : { *(.data1) }
  .preinit_array     :
  {
    PROVIDE_HIDDEN (__preinit_array_start = .);
    KEEP (*(.preinit_array))
    PROVIDE_HIDDEN (__preinit_array_end = .);
  }
  .init_array     :
  {
     PROVIDE_HIDDEN (__init_array_start = .);
     KEEP (*(SORT(.init_array.*)))
     KEEP (*(.init_array))
     PROVIDE_HIDDEN (__init_array_end = .);
  }
  .fini_array     :
  {
    PROVIDE_HIDDEN (__fini_array_start = .);
    KEEP (*(.fini_array))
    KEEP (*(SORT(.fini_array.*)))
    PROVIDE_HIDDEN (__fini_array_end = .);
  }
  .ctors         :
  {
    *(.ctors)
  }
  .dtors         :
  {
    *(.dtors)
  }
  .plt      : { *(.plt)	}
  .got           : { *(.got.plt) *(.got) }
  .dynamic       : { *(.dynamic) }
  /* We want the small data sections together, so single-instruction offsets
     can access them all, and initialized data all before uninitialized, so
     we can shorten the on-disk segment size.  */
  .sdata     : { *(.sdata) }
  _edata  =  .;
  PROVIDE (edata = .);
  __bss_start = .;
  .sbss      : { *(.sbss) *(.scommon) }
  .bss       :
  {
   *(.dynbss)
   *(.bss)
   *(COMMON)
  }
  _end = . ;
  PROVIDE (end = .);
  /* Stabs debugging sections.  */
  .stab 0 : { *(.stab) }
  .stabstr 0 : { *(.stabstr) }
  .stab.excl 0 : { *(.stab.excl) }
  .stab.exclstr 0 : { *(.stab.exclstr) }
  .stab.index 0 : { *(.stab.index) }
  .stab.indexstr 0 : { *(.stab.indexstr) }
  .comment 0 : { *(.comment) }
  /* DWARF debug sections.
     Symbols in the DWARF debugging sections are relative to the beginning
     of the section so we begin them at 0.  */
  /* DWARF 1 */
  .debug          0 : { *(.debug) }
  .line           0 : { *(.line) }
  /* GNU DWARF 1 extensions */
  .debug_srcinfo  0 : { *(.debug_srcinfo) }
  .debug_sfnames  0 : { *(.debug_sfnames) }
  /* DWARF 1.1 and DWARF 2 */
  .debug_aranges  0 : { *(.debug_aranges) }
  .debug_pubnames 0 : { *(.debug_pubnames) }
  /* DWARF 2 */
  .debug_info     0 : { *(.debug_info) }
  .debug_abbrev   0 : { *(.debug_abbrev) }
  .debug_line     0 : { *(.debug_line) }
  .debug_frame    0 : { *(.debug_frame) }
  .debug_str      0 : { *(.debug_str) }
  .debug_loc      0 : { *(.debug_loc) }
  .debug_macinfo  0 : { *(.debug_macinfo) }
  /* SGI/MIPS DWARF 2 extensions */
  .debug_weaknames 0 : { *(.debug_weaknames) }
  .debug_funcnames 0 : { *(.debug_funcnames) }
  .debug_typenames 0 : { *(.debug_typenames) }
  .debug_varnames  0 : { *(.debug_varnames) }
  /* These must appear regardless of  .  */
 }
--- a/async.c
+++ b/async.c
@@ -0,0 +1,216 @@
 /*
 * QEMU System Emulator
 *
 * Copyright (c) 2003-2008 Fabrice Bellard
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu-common.h"
 #include "qemu-aio.h"
 /*
 * An AsyncContext protects the callbacks of AIO requests and Bottom Halves
 * against interfering with each other. A typical example is qcow2 that accepts
 * asynchronous requests, but relies for manipulation of its metadata on
 * synchronous bdrv_read/write that doesn't trigger any callbacks.
 *
 * However, these functions are often emulated using AIO which means that AIO
 * callbacks must be run - but at the same time we must not run callbacks of
 * other requests as they might start to modify metadata and corrupt the
 * internal state of the caller of bdrv_read/write.
 *
 * To achieve the desired semantics we switch into a new AsyncContext.
 * Callbacks must only be run if they belong to the current AsyncContext.
 * Otherwise they need to be queued until their own context is active again.
 * This is how you can make qemu_aio_wait() wait only for your own callbacks.
 *
 * The AsyncContexts form a stack. When you leave a AsyncContexts, you always
 * return to the old ("parent") context.
 */
 struct AsyncContext {
    /* Consecutive number of the AsyncContext (position in the stack) */
    int id;
    /* Anchor of the list of Bottom Halves belonging to the context */
    struct QEMUBH *first_bh;
    /* Link to parent context */
    struct AsyncContext *parent;
 };
 /* The currently active AsyncContext */
 static struct AsyncContext *async_context = &(struct AsyncContext) { 0 };
 /*
 * Enter a new AsyncContext. Already scheduled Bottom Halves and AIO callbacks
 * won't be called until this context is left again.
 */
 void async_context_push(void)
 {
    struct AsyncContext *new = qemu_mallocz(sizeof(*new));
    new->parent = async_context;
    new->id = async_context->id + 1;
    async_context = new;
 }
 /* Run queued AIO completions and destroy Bottom Half */
 static void bh_run_aio_completions(void *opaque)
 {
    QEMUBH **bh = opaque;
    qemu_bh_delete(*bh);
    qemu_free(bh);
    qemu_aio_process_queue();
 }
 /*
 * Leave the currently active AsyncContext. All Bottom Halves belonging to the
 * old context are executed before changing the context.
 */
 void async_context_pop(void)
 {
    struct AsyncContext *old = async_context;
    QEMUBH **bh;
    /* Flush the bottom halves, we don't want to lose them */
    while (qemu_bh_poll());
    /* Switch back to the parent context */
    async_context = async_context->parent;
    qemu_free(old);
    if (async_context == NULL) {
        abort();
    }
    /* Schedule BH to run any queued AIO completions as soon as possible */
    bh = qemu_malloc(sizeof(*bh));
    *bh = qemu_bh_new(bh_run_aio_completions, bh);
    qemu_bh_schedule(*bh);
 }
 /*
 * Returns the ID of the currently active AsyncContext
 */
 int get_async_context_id(void)
 {
    return async_context->id;
 }
 /***********************************************************/
 /* bottom halves (can be seen as timers which expire ASAP) */
 struct QEMUBH {
    QEMUBHFunc *cb;
    void *opaque;
    int scheduled;
    int idle;
    int deleted;
    QEMUBH *next;
 };
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
 {
    QEMUBH *bh;
    bh = qemu_mallocz(sizeof(QEMUBH));
    bh->cb = cb;
    bh->opaque = opaque;
    bh->next = async_context->first_bh;
    async_context->first_bh = bh;
    return bh;
 }
 int qemu_bh_poll(void)
 {
    QEMUBH *bh, **bhp;
    int ret;
    ret = 0;
    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            bh->scheduled = 0;
            if (!bh->idle)
                ret = 1;
            bh->idle = 0;
            bh->cb(bh->opaque);
        }
    }
    /* remove deleted bhs */
    bhp = &async_context->first_bh;
    while (*bhp) {
        bh = *bhp;
        if (bh->deleted) {
            *bhp = bh->next;
            qemu_free(bh);
        } else
            bhp = &bh->next;
    }
    return ret;
 }
 void qemu_bh_schedule_idle(QEMUBH *bh)
 {
    if (bh->scheduled)
        return;
    bh->scheduled = 1;
    bh->idle = 1;
 }
 void qemu_bh_schedule(QEMUBH *bh)
 {
    if (bh->scheduled)
        return;
    bh->scheduled = 1;
    bh->idle = 0;
    /* stop the currently executing CPU to execute the BH ASAP */
    qemu_notify_event();
 }
 void qemu_bh_cancel(QEMUBH *bh)
 {
    bh->scheduled = 0;
 }
 void qemu_bh_delete(QEMUBH *bh)
 {
    bh->scheduled = 0;
    bh->deleted = 1;
 }
 void qemu_bh_update_timeout(int *timeout)
 {
    QEMUBH *bh;
    for (bh = async_context->first_bh; bh; bh = bh->next) {
        if (!bh->deleted && bh->scheduled) {
            if (bh->idle) {
                /* idle bottom halves will be polled at least
                 * every 10ms */
                *timeout = MIN(10, *timeout);
            } else {
                /* non-idle bottom halves will be executed
                 * immediately */
                *timeout = 0;
                break;
            }
        }
    }
 }
--- a/audio/Makefile.objs
+++ b/audio/Makefile.objs
@@ -1,35 +0,0 @@
 common-obj-y = audio.o audio_legacy.o noaudio.o wavaudio.o mixeng.o
 common-obj-$(CONFIG_SPICE) += spiceaudio.o
 common-obj-$(CONFIG_AUDIO_COREAUDIO) += coreaudio.o
 common-obj-$(CONFIG_AUDIO_DSOUND) += dsoundaudio.o
 common-obj-$(CONFIG_AUDIO_WIN_INT) += audio_win_int.o
 common-obj-y += wavcapture.o
 coreaudio.o-libs := $(COREAUDIO_LIBS)
 dsoundaudio.o-libs := $(DSOUND_LIBS)
 # alsa module
 common-obj-$(CONFIG_AUDIO_ALSA) += alsa.mo
 alsa.mo-objs = alsaaudio.o
 alsa.mo-libs := $(ALSA_LIBS)
 # oss module
 common-obj-$(CONFIG_AUDIO_OSS) += oss.mo
 oss.mo-objs = ossaudio.o
 oss.mo-libs := $(OSS_LIBS)
 # pulseaudio module
 common-obj-$(CONFIG_AUDIO_PA) += pa.mo
 pa.mo-objs = paaudio.o
 pa.mo-libs := $(PULSE_LIBS)
 # sdl module
 common-obj-$(CONFIG_AUDIO_SDL) += sdl.mo
 sdl.mo-objs = sdlaudio.o
 sdl.mo-cflags := $(SDL_CFLAGS)
 sdl.mo-libs := $(SDL_LIBS)
 # jack module
 common-obj-$(CONFIG_AUDIO_JACK) += jack.mo
 jack.mo-objs = jackaudio.o
 jack.mo-libs := $(JACK_LIBS)
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
--- a/audio/audio.c
+++ b/audio/audio.c
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -21,37 +21,35 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef QEMU_AUDIO_H
 #define QEMU_AUDIO_H
-#include "qemu/queue.h"
+#include "config-host.h"
-#include "qapi/qapi-types-audio.h"
+#include "qemu-queue.h"
 #include "hw/qdev-properties.h"
 typedef void (*audio_callback_fn) (void *opaque, int avail);
 typedef enum {
    AUD_FMT_U8,
    AUD_FMT_S8,
    AUD_FMT_U16,
    AUD_FMT_S16,
    AUD_FMT_U32,
    AUD_FMT_S32
 } audfmt_e;
 #ifdef HOST_WORDS_BIGENDIAN
 #define AUDIO_HOST_ENDIANNESS 1
 #else
 #define AUDIO_HOST_ENDIANNESS 0
 #endif
-typedef struct audsettings {
+struct audsettings {
    int freq;
    int nchannels;
-    AudioFormat fmt;
+    audfmt_e fmt;
    int endianness;
-} audsettings;
+};
 audsettings audiodev_to_audsettings(AudiodevPerDirectionOptions *pdo);
 int audioformat_bytes_per_sample(AudioFormat fmt);
 int audio_buffer_frames(AudiodevPerDirectionOptions *pdo,
                        audsettings *as, int def_usecs);
 int audio_buffer_samples(AudiodevPerDirectionOptions *pdo,
                         audsettings *as, int def_usecs);
 int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
                       audsettings *as, int def_usecs);
 typedef enum {
    AUD_CNOTIFY_ENABLE,
@@ -60,7 +58,7 @@ typedef enum {
 struct audio_capture_ops {
    void (*notify) (void *opaque, audcnotification_e cmd);
-    void (*capture) (void *opaque, const void *buf, int size);
+    void (*capture) (void *opaque, void *buf, int size);
    void (*destroy) (void *opaque);
 };
@@ -79,10 +77,8 @@ typedef struct SWVoiceOut SWVoiceOut;
 typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
 typedef struct AudioState AudioState;
 typedef struct QEMUSoundCard {
    char *name;
    AudioState *state;
    QLIST_ENTRY (QEMUSoundCard) entries;
 } QEMUSoundCard;
@@ -90,13 +86,17 @@ typedef struct QEMUAudioTimeStamp {
    uint64_t old_ts;
 } QEMUAudioTimeStamp;
-void AUD_vlog (const char *cap, const char *fmt, va_list ap) GCC_FMT_ATTR(2, 0);
+void AUD_vlog (const char *cap, const char *fmt, va_list ap);
-void AUD_log (const char *cap, const char *fmt, ...) GCC_FMT_ATTR(2, 3);
+void AUD_log (const char *cap, const char *fmt, ...)
 #ifdef __GNUC__
    __attribute__ ((__format__ (__printf__, 2, 3)))
 #endif
    ;
 void AUD_help (void);
 void AUD_register_card (const char *name, QEMUSoundCard *card);
 void AUD_remove_card (QEMUSoundCard *card);
-CaptureVoiceOut *AUD_add_capture(
+CaptureVoiceOut *AUD_add_capture (
    AudioState *s,
    struct audsettings *as,
    struct audio_capture_ops *ops,
    void *opaque
@@ -113,7 +113,7 @@ SWVoiceOut *AUD_open_out (
    );
 void AUD_close_out (QEMUSoundCard *card, SWVoiceOut *sw);
-size_t AUD_write (SWVoiceOut *sw, void *pcm_buf, size_t size);
+int  AUD_write (SWVoiceOut *sw, void *pcm_buf, int size);
 int  AUD_get_buffer_size_out (SWVoiceOut *sw);
 void AUD_set_active_out (SWVoiceOut *sw, int on);
 int  AUD_is_active_out (SWVoiceOut *sw);
@@ -124,16 +124,6 @@ uint64_t AUD_get_elapsed_usec_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol);
 void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol);
 #define AUDIO_MAX_CHANNELS 16
 typedef struct Volume {
    bool mute;
    int channels;
    uint8_t vol[AUDIO_MAX_CHANNELS];
 } Volume;
 void audio_set_volume_out(SWVoiceOut *sw, Volume *vol);
 void audio_set_volume_in(SWVoiceIn *sw, Volume *vol);
 SWVoiceIn *AUD_open_in (
    QEMUSoundCard *card,
    SWVoiceIn *sw,
@@ -144,7 +134,7 @@ SWVoiceIn *AUD_open_in (
    );
 void AUD_close_in (QEMUSoundCard *card, SWVoiceIn *sw);
-size_t AUD_read (SWVoiceIn *sw, void *pcm_buf, size_t size);
+int  AUD_read (SWVoiceIn *sw, void *pcm_buf, int size);
 void AUD_set_active_in (SWVoiceIn *sw, int on);
 int  AUD_is_active_in (SWVoiceIn *sw);
@@ -157,25 +147,24 @@ static inline void *advance (void *p, int incr)
    return (d + incr);
 }
-int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
+#ifdef __GNUC__
-                      int freq, int bits, int nchannels);
+#define audio_MIN(a, b) ( __extension__ ({      \
    __typeof (a) ta = a;                        \
    __typeof (b) tb = b;                        \
    ((ta)>(tb)?(tb):(ta));                      \
 }))
-bool audio_is_cleaning_up(void);
+#define audio_MAX(a, b) ( __extension__ ({      \
-void audio_cleanup(void);
+    __typeof (a) ta = a;                        \
    __typeof (b) tb = b;                        \
    ((ta)<(tb)?(tb):(ta));                      \
 }))
 #else
 #define audio_MIN(a, b) ((a)>(b)?(b):(a))
 #define audio_MAX(a, b) ((a)<(b)?(b):(a))
 #endif
-void audio_sample_to_uint64(const void *samples, int pos,
+int wav_start_capture (CaptureState *s, const char *path, int freq,
-                            uint64_t *left, uint64_t *right);
+                       int bits, int nchannels);
 void audio_sample_from_uint64(void *samples, int pos,
                            uint64_t left, uint64_t right);
-void audio_parse_option(const char *opt);
+#endif  /* audio.h */
 void audio_init_audiodevs(void);
 void audio_legacy_help(void);
 AudioState *audio_state_by_name(const char *name);
 const char *audio_get_id(QEMUSoundCard *card);
 #define DEFINE_AUDIO_PROPERTIES(_s, _f)         \
    DEFINE_PROP_AUDIODEV("audiodev", _s, _f)
 #endif /* QEMU_AUDIO_H */
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -21,11 +21,10 @@
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #ifndef QEMU_AUDIO_INT_H
 #define QEMU_AUDIO_INT_H
-#ifdef CONFIG_AUDIO_COREAUDIO
+#ifdef CONFIG_COREAUDIO
 #define FLOAT_MIXENG
 /* #define RECIPROCAL */
 #endif
@@ -33,6 +32,22 @@
 struct audio_pcm_ops;
 typedef enum {
    AUD_OPT_INT,
    AUD_OPT_FMT,
    AUD_OPT_STR,
    AUD_OPT_BOOL
 } audio_option_tag_e;
 struct audio_option {
    const char *name;
    audio_option_tag_e tag;
    void *valp;
    const char *descr;
    int *overriddenp;
    int overridden;
 };
 struct audio_callback {
    void *opaque;
    audio_callback_fn fn;
@@ -40,38 +55,31 @@ struct audio_callback {
 struct audio_pcm_info {
    int bits;
-    bool is_signed;
+    int sign;
    bool is_float;
    int freq;
    int nchannels;
-    int bytes_per_frame;
+    int align;
    int shift;
    int bytes_per_second;
    int swap_endianness;
 };
 typedef struct AudioState AudioState;
 typedef struct SWVoiceCap SWVoiceCap;
 typedef struct STSampleBuffer {
    size_t pos, size;
    st_sample samples[];
 } STSampleBuffer;
 typedef struct HWVoiceOut {
    AudioState *s;
    int enabled;
    int poll_mode;
    int pending_disable;
    struct audio_pcm_info info;
    f_sample *clip;
    int rpos;
    uint64_t ts_helper;
-    STSampleBuffer *mix_buf;
+    struct st_sample *mix_buf;
    void *buf_emul;
    size_t pos_emul, pending_emul, size_emul;
-    size_t samples;
+    int samples;
    QLIST_HEAD (sw_out_listhead, SWVoiceOut) sw_head;
    QLIST_HEAD (sw_cap_listhead, SWVoiceCap) cap_head;
    struct audio_pcm_ops *pcm_ops;
@@ -79,21 +87,19 @@ typedef struct HWVoiceOut {
 } HWVoiceOut;
 typedef struct HWVoiceIn {
    AudioState *s;
    int enabled;
    int poll_mode;
    struct audio_pcm_info info;
    t_sample *conv;
-    size_t total_samples_captured;
+    int wpos;
    int total_samples_captured;
    uint64_t ts_helper;
-    STSampleBuffer *conv_buf;
+    struct st_sample *conv_buf;
    void *buf_emul;
    size_t pos_emul, pending_emul, size_emul;
-    size_t samples;
+    int samples;
    QLIST_HEAD (sw_in_listhead, SWVoiceIn) sw_head;
    struct audio_pcm_ops *pcm_ops;
    QLIST_ENTRY (HWVoiceIn) entries;
@@ -101,13 +107,12 @@ typedef struct HWVoiceIn {
 struct SWVoiceOut {
    QEMUSoundCard *card;
    AudioState *s;
    struct audio_pcm_info info;
    t_sample *conv;
    int64_t ratio;
    struct st_sample *buf;
    void *rate;
-    size_t total_hw_samples_mixed;
+    int total_hw_samples_mixed;
    int active;
    int empty;
    HWVoiceOut *hw;
@@ -119,12 +124,11 @@ struct SWVoiceOut {
 struct SWVoiceIn {
    QEMUSoundCard *card;
    AudioState *s;
    int active;
    struct audio_pcm_info info;
    int64_t ratio;
    void *rate;
-    size_t total_hw_samples_acquired;
+    int total_hw_samples_acquired;
    struct st_sample *buf;
    f_sample *clip;
    HWVoiceIn *hw;
@@ -134,11 +138,11 @@ struct SWVoiceIn {
    QLIST_ENTRY (SWVoiceIn) entries;
 };
 typedef struct audio_driver audio_driver;
 struct audio_driver {
    const char *name;
    const char *descr;
-    void *(*init) (Audiodev *);
+    struct audio_option *options;
    void *(*init) (void);
    void (*fini) (void *);
    struct audio_pcm_ops *pcm_ops;
    int can_be_default;
@@ -146,46 +150,22 @@ struct audio_driver {
    int max_voices_in;
    int voice_size_out;
    int voice_size_in;
    QLIST_ENTRY(audio_driver) next;
 };
 struct audio_pcm_ops {
-    int    (*init_out)(HWVoiceOut *hw, audsettings *as, void *drv_opaque);
+    int  (*init_out)(HWVoiceOut *hw, struct audsettings *as);
-    void   (*fini_out)(HWVoiceOut *hw);
+    void (*fini_out)(HWVoiceOut *hw);
-    size_t (*write)   (HWVoiceOut *hw, void *buf, size_t size);
+    int  (*run_out) (HWVoiceOut *hw, int live);
-    void   (*run_buffer_out)(HWVoiceOut *hw);
+    int  (*write)   (SWVoiceOut *sw, void *buf, int size);
-    /*
+    int  (*ctl_out) (HWVoiceOut *hw, int cmd, ...);
     * get a buffer that after later can be passed to put_buffer_out; optional
     * returns the buffer, and writes it's size to size (in bytes)
     * this is unrelated to the above buffer_size_out function
     */
    void  *(*get_buffer_out)(HWVoiceOut *hw, size_t *size);
    /*
     * put back the buffer returned by get_buffer_out; optional
     * buf must be equal the pointer returned by get_buffer_out,
     * size may be smaller
     */
    size_t (*put_buffer_out)(HWVoiceOut *hw, void *buf, size_t size);
    void   (*enable_out)(HWVoiceOut *hw, bool enable);
    void   (*volume_out)(HWVoiceOut *hw, Volume *vol);
-    int    (*init_in) (HWVoiceIn *hw, audsettings *as, void *drv_opaque);
+    int  (*init_in) (HWVoiceIn *hw, struct audsettings *as);
-    void   (*fini_in) (HWVoiceIn *hw);
+    void (*fini_in) (HWVoiceIn *hw);
-    size_t (*read)    (HWVoiceIn *hw, void *buf, size_t size);
+    int  (*run_in)  (HWVoiceIn *hw);
-    void  *(*get_buffer_in)(HWVoiceIn *hw, size_t *size);
+    int  (*read)    (SWVoiceIn *sw, void *buf, int size);
-    void   (*put_buffer_in)(HWVoiceIn *hw, void *buf, size_t size);
+    int  (*ctl_in)  (HWVoiceIn *hw, int cmd, ...);
    void   (*enable_in)(HWVoiceIn *hw, bool enable);
    void   (*volume_in)(HWVoiceIn *hw, Volume *vol);
 };
 void *audio_generic_get_buffer_in(HWVoiceIn *hw, size_t *size);
 void audio_generic_put_buffer_in(HWVoiceIn *hw, void *buf, size_t size);
 void audio_generic_run_buffer_out(HWVoiceOut *hw);
 void *audio_generic_get_buffer_out(HWVoiceOut *hw, size_t *size);
 size_t audio_generic_put_buffer_out(HWVoiceOut *hw, void *buf, size_t size);
 size_t audio_generic_write(HWVoiceOut *hw, void *buf, size_t size);
 size_t audio_generic_read(HWVoiceIn *hw, void *buf, size_t size);
 struct capture_callback {
    struct audio_capture_ops ops;
    void *opaque;
@@ -205,9 +185,8 @@ struct SWVoiceCap {
    QLIST_ENTRY (SWVoiceCap) entries;
 };
-typedef struct AudioState {
+struct AudioState {
    struct audio_driver *drv;
    Audiodev *dev;
    void *drv_opaque;
    QEMUTimer *ts;
@@ -218,66 +197,93 @@ typedef struct AudioState {
    int nb_hw_voices_out;
    int nb_hw_voices_in;
    int vm_running;
-    int64_t period_ticks;
+};
-    bool timer_running;
+extern struct audio_driver no_audio_driver;
-    uint64_t timer_last;
+extern struct audio_driver oss_audio_driver;
-
+extern struct audio_driver sdl_audio_driver;
-    QTAILQ_ENTRY(AudioState) list;
+extern struct audio_driver wav_audio_driver;
-} AudioState;
+extern struct audio_driver fmod_audio_driver;
-
+extern struct audio_driver alsa_audio_driver;
-extern const struct mixeng_volume nominal_volume;
+extern struct audio_driver coreaudio_audio_driver;
-
+extern struct audio_driver dsound_audio_driver;
-extern const char *audio_prio_list[];
+extern struct audio_driver esd_audio_driver;
-
+extern struct audio_driver pa_audio_driver;
-void audio_driver_register(audio_driver *drv);
+extern struct audio_driver winwave_audio_driver;
-audio_driver *audio_driver_lookup(const char *name);
+extern struct mixeng_volume nominal_volume;
 void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as);
 void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len);
 int  audio_pcm_sw_write (SWVoiceOut *sw, void *buf, int len);
 int  audio_pcm_hw_get_live_in (HWVoiceIn *hw);
 int  audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int len);
 int audio_pcm_hw_clip_out (HWVoiceOut *hw, void *pcm_buf,
                           int live, int pending);
 int audio_bug (const char *funcname, int cond);
 void *audio_calloc (const char *funcname, int nmemb, size_t size);
-void audio_run(AudioState *s, const char *msg);
+void audio_run (const char *msg);
-typedef struct RateCtl {
+#define VOICE_ENABLE 1
-    int64_t start_ticks;
+#define VOICE_DISABLE 2
    int64_t bytes_sent;
 } RateCtl;
-void audio_rate_start(RateCtl *rate);
+static inline int audio_ring_dist (int dst, int src, int len)
 size_t audio_rate_get_bytes(struct audio_pcm_info *info, RateCtl *rate,
                            size_t bytes_avail);
 static inline size_t audio_ring_dist(size_t dst, size_t src, size_t len)
 {
    return (dst >= src) ? (dst - src) : (len - src + dst);
 }
-#define dolog(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
+#if defined __GNUC__
 #define GCC_ATTR __attribute__ ((__unused__, __format__ (__printf__, 1, 2)))
 #define GCC_FMT_ATTR(n, m) __attribute__ ((__format__ (__printf__, n, m)))
 #else
 #define GCC_ATTR /**/
 #define GCC_FMT_ATTR(n, m)
 #endif
 static void GCC_ATTR dolog (const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
 }
 #ifdef DEBUG
-#define ldebug(fmt, ...) AUD_log(AUDIO_CAP, fmt, ## __VA_ARGS__)
+static void GCC_ATTR ldebug (const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (AUDIO_CAP, fmt, ap);
    va_end (ap);
 }
 #else
-#define ldebug(fmt, ...) (void)0
+#if defined NDEBUG && defined __GNUC__
 #define ldebug(...)
 #elif defined NDEBUG && defined _MSC_VER
 #define ldebug __noop
 #else
 static void GCC_ATTR ldebug (const char *fmt, ...)
 {
    (void) fmt;
 }
 #endif
 #endif
 #undef GCC_ATTR
 #define AUDIO_STRINGIFY_(n) #n
 #define AUDIO_STRINGIFY(n) AUDIO_STRINGIFY_(n)
-typedef struct AudiodevListEntry {
+#if defined _MSC_VER || defined __GNUC__
-    Audiodev *dev;
+#define AUDIO_FUNC __FUNCTION__
-    QSIMPLEQ_ENTRY(AudiodevListEntry) next;
+#else
-} AudiodevListEntry;
+#define AUDIO_FUNC __FILE__ ":" AUDIO_STRINGIFY (__LINE__)
 #endif
-typedef QSIMPLEQ_HEAD(, AudiodevListEntry) AudiodevListHead;
+#endif /* audio_int.h */
 AudiodevListHead audio_handle_legacy_opts(void);
 void audio_free_audiodev_list(AudiodevListHead *head);
 void audio_create_pdos(Audiodev *dev);
 AudiodevPerDirectionOptions *audio_get_pdo_in(Audiodev *dev);
 AudiodevPerDirectionOptions *audio_get_pdo_out(Audiodev *dev);
 #endif /* QEMU_AUDIO_INT_H */
--- a/audio/audio_legacy.c
+++ b/audio/audio_legacy.c
@@ -1,554 +0,0 @@
 /*
 * QEMU Audio subsystem: legacy configuration handling
 *
 * Copyright (c) 2015-2019 Zoltán Kővágó <DirtY.iCE.hu@gmail.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
 #include "qemu/osdep.h"
 #include "audio.h"
 #include "audio_int.h"
 #include "qemu/cutils.h"
 #include "qemu/timer.h"
 #include "qapi/error.h"
 #include "qapi/qapi-visit-audio.h"
 #include "qapi/visitor-impl.h"
 #define AUDIO_CAP "audio-legacy"
 #include "audio_int.h"
 static uint32_t toui32(const char *str)
 {
    unsigned long long ret;
    if (parse_uint_full(str, &ret, 10) || ret > UINT32_MAX) {
        dolog("Invalid integer value `%s'\n", str);
        exit(1);
    }
    return ret;
 }
 /* helper functions to convert env variables */
 static void get_bool(const char *env, bool *dst, bool *has_dst)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = toui32(val) != 0;
        *has_dst = true;
    }
 }
 static void get_int(const char *env, uint32_t *dst, bool *has_dst)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = toui32(val);
        *has_dst = true;
    }
 }
 static void get_str(const char *env, char **dst, bool *has_dst)
 {
    const char *val = getenv(env);
    if (val) {
        if (*has_dst) {
            g_free(*dst);
        }
        *dst = g_strdup(val);
        *has_dst = true;
    }
 }
 static void get_fmt(const char *env, AudioFormat *dst, bool *has_dst)
 {
    const char *val = getenv(env);
    if (val) {
        size_t i;
        for (i = 0; AudioFormat_lookup.size; ++i) {
            if (strcasecmp(val, AudioFormat_lookup.array[i]) == 0) {
                *dst = i;
                *has_dst = true;
                return;
            }
        }
        dolog("Invalid audio format `%s'\n", val);
        exit(1);
    }
 }
 static void get_millis_to_usecs(const char *env, uint32_t *dst, bool *has_dst)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = toui32(val) * 1000;
        *has_dst = true;
    }
 }
 static uint32_t frames_to_usecs(uint32_t frames,
                                AudiodevPerDirectionOptions *pdo)
 {
    uint32_t freq = pdo->has_frequency ? pdo->frequency : 44100;
    return (frames * 1000000 + freq / 2) / freq;
 }
 static void get_frames_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
                                AudiodevPerDirectionOptions *pdo)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = frames_to_usecs(toui32(val), pdo);
        *has_dst = true;
    }
 }
 static uint32_t samples_to_usecs(uint32_t samples,
                                 AudiodevPerDirectionOptions *pdo)
 {
    uint32_t channels = pdo->has_channels ? pdo->channels : 2;
    return frames_to_usecs(samples / channels, pdo);
 }
 static void get_samples_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
                                 AudiodevPerDirectionOptions *pdo)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = samples_to_usecs(toui32(val), pdo);
        *has_dst = true;
    }
 }
 static uint32_t bytes_to_usecs(uint32_t bytes, AudiodevPerDirectionOptions *pdo)
 {
    AudioFormat fmt = pdo->has_format ? pdo->format : AUDIO_FORMAT_S16;
    uint32_t bytes_per_sample = audioformat_bytes_per_sample(fmt);
    return samples_to_usecs(bytes / bytes_per_sample, pdo);
 }
 static void get_bytes_to_usecs(const char *env, uint32_t *dst, bool *has_dst,
                               AudiodevPerDirectionOptions *pdo)
 {
    const char *val = getenv(env);
    if (val) {
        *dst = bytes_to_usecs(toui32(val), pdo);
        *has_dst = true;
    }
 }
 /* backend specific functions */
 /* ALSA */
 static void handle_alsa_per_direction(
    AudiodevAlsaPerDirectionOptions *apdo, const char *prefix)
 {
    char buf[64];
    size_t len = strlen(prefix);
    bool size_in_usecs = false;
    bool dummy;
    memcpy(buf, prefix, len);
    strcpy(buf + len, "TRY_POLL");
    get_bool(buf, &apdo->try_poll, &apdo->has_try_poll);
    strcpy(buf + len, "DEV");
    get_str(buf, &apdo->dev, &apdo->has_dev);
    strcpy(buf + len, "SIZE_IN_USEC");
    get_bool(buf, &size_in_usecs, &dummy);
    strcpy(buf + len, "PERIOD_SIZE");
    get_int(buf, &apdo->period_length, &apdo->has_period_length);
    if (apdo->has_period_length && !size_in_usecs) {
        apdo->period_length = frames_to_usecs(
            apdo->period_length,
            qapi_AudiodevAlsaPerDirectionOptions_base(apdo));
    }
    strcpy(buf + len, "BUFFER_SIZE");
    get_int(buf, &apdo->buffer_length, &apdo->has_buffer_length);
    if (apdo->has_buffer_length && !size_in_usecs) {
        apdo->buffer_length = frames_to_usecs(
            apdo->buffer_length,
            qapi_AudiodevAlsaPerDirectionOptions_base(apdo));
    }
 }
 static void handle_alsa(Audiodev *dev)
 {
    AudiodevAlsaOptions *aopt = &dev->u.alsa;
    handle_alsa_per_direction(aopt->in, "QEMU_ALSA_ADC_");
    handle_alsa_per_direction(aopt->out, "QEMU_ALSA_DAC_");
    get_millis_to_usecs("QEMU_ALSA_THRESHOLD",
                        &aopt->threshold, &aopt->has_threshold);
 }
 /* coreaudio */
 static void handle_coreaudio(Audiodev *dev)
 {
    get_frames_to_usecs(
        "QEMU_COREAUDIO_BUFFER_SIZE",
        &dev->u.coreaudio.out->buffer_length,
        &dev->u.coreaudio.out->has_buffer_length,
        qapi_AudiodevCoreaudioPerDirectionOptions_base(dev->u.coreaudio.out));
    get_int("QEMU_COREAUDIO_BUFFER_COUNT",
            &dev->u.coreaudio.out->buffer_count,
            &dev->u.coreaudio.out->has_buffer_count);
 }
 /* dsound */
 static void handle_dsound(Audiodev *dev)
 {
    get_millis_to_usecs("QEMU_DSOUND_LATENCY_MILLIS",
                        &dev->u.dsound.latency, &dev->u.dsound.has_latency);
    get_bytes_to_usecs("QEMU_DSOUND_BUFSIZE_OUT",
                       &dev->u.dsound.out->buffer_length,
                       &dev->u.dsound.out->has_buffer_length,
                       dev->u.dsound.out);
    get_bytes_to_usecs("QEMU_DSOUND_BUFSIZE_IN",
                       &dev->u.dsound.in->buffer_length,
                       &dev->u.dsound.in->has_buffer_length,
                       dev->u.dsound.in);
 }
 /* OSS */
 static void handle_oss_per_direction(
    AudiodevOssPerDirectionOptions *opdo, const char *try_poll_env,
    const char *dev_env)
 {
    get_bool(try_poll_env, &opdo->try_poll, &opdo->has_try_poll);
    get_str(dev_env, &opdo->dev, &opdo->has_dev);
    get_bytes_to_usecs("QEMU_OSS_FRAGSIZE",
                       &opdo->buffer_length, &opdo->has_buffer_length,
                       qapi_AudiodevOssPerDirectionOptions_base(opdo));
    get_int("QEMU_OSS_NFRAGS", &opdo->buffer_count,
            &opdo->has_buffer_count);
 }
 static void handle_oss(Audiodev *dev)
 {
    AudiodevOssOptions *oopt = &dev->u.oss;
    handle_oss_per_direction(oopt->in, "QEMU_AUDIO_ADC_TRY_POLL",
                             "QEMU_OSS_ADC_DEV");
    handle_oss_per_direction(oopt->out, "QEMU_AUDIO_DAC_TRY_POLL",
                             "QEMU_OSS_DAC_DEV");
    get_bool("QEMU_OSS_MMAP", &oopt->try_mmap, &oopt->has_try_mmap);
    get_bool("QEMU_OSS_EXCLUSIVE", &oopt->exclusive, &oopt->has_exclusive);
    get_int("QEMU_OSS_POLICY", &oopt->dsp_policy, &oopt->has_dsp_policy);
 }
 /* pulseaudio */
 static void handle_pa_per_direction(
    AudiodevPaPerDirectionOptions *ppdo, const char *env)
 {
    get_str(env, &ppdo->name, &ppdo->has_name);
 }
 static void handle_pa(Audiodev *dev)
 {
    handle_pa_per_direction(dev->u.pa.in, "QEMU_PA_SOURCE");
    handle_pa_per_direction(dev->u.pa.out, "QEMU_PA_SINK");
    get_samples_to_usecs(
        "QEMU_PA_SAMPLES", &dev->u.pa.in->buffer_length,
        &dev->u.pa.in->has_buffer_length,
        qapi_AudiodevPaPerDirectionOptions_base(dev->u.pa.in));
    get_samples_to_usecs(
        "QEMU_PA_SAMPLES", &dev->u.pa.out->buffer_length,
        &dev->u.pa.out->has_buffer_length,
        qapi_AudiodevPaPerDirectionOptions_base(dev->u.pa.out));
    get_str("QEMU_PA_SERVER", &dev->u.pa.server, &dev->u.pa.has_server);
 }
 /* SDL */
 static void handle_sdl(Audiodev *dev)
 {
    /* SDL is output only */
    get_samples_to_usecs("QEMU_SDL_SAMPLES", &dev->u.sdl.out->buffer_length,
                         &dev->u.sdl.out->has_buffer_length, dev->u.sdl.out);
 }
 /* wav */
 static void handle_wav(Audiodev *dev)
 {
    get_int("QEMU_WAV_FREQUENCY",
            &dev->u.wav.out->frequency, &dev->u.wav.out->has_frequency);
    get_fmt("QEMU_WAV_FORMAT", &dev->u.wav.out->format,
            &dev->u.wav.out->has_format);
    get_int("QEMU_WAV_DAC_FIXED_CHANNELS",
            &dev->u.wav.out->channels, &dev->u.wav.out->has_channels);
    get_str("QEMU_WAV_PATH", &dev->u.wav.path, &dev->u.wav.has_path);
 }
 /* general */
 static void handle_per_direction(
    AudiodevPerDirectionOptions *pdo, const char *prefix)
 {
    char buf[64];
    size_t len = strlen(prefix);
    memcpy(buf, prefix, len);
    strcpy(buf + len, "FIXED_SETTINGS");
    get_bool(buf, &pdo->fixed_settings, &pdo->has_fixed_settings);
    strcpy(buf + len, "FIXED_FREQ");
    get_int(buf, &pdo->frequency, &pdo->has_frequency);
    strcpy(buf + len, "FIXED_FMT");
    get_fmt(buf, &pdo->format, &pdo->has_format);
    strcpy(buf + len, "FIXED_CHANNELS");
    get_int(buf, &pdo->channels, &pdo->has_channels);
    strcpy(buf + len, "VOICES");
    get_int(buf, &pdo->voices, &pdo->has_voices);
 }
 static AudiodevListEntry *legacy_opt(const char *drvname)
 {
    AudiodevListEntry *e = g_malloc0(sizeof(AudiodevListEntry));
    e->dev = g_malloc0(sizeof(Audiodev));
    e->dev->id = g_strdup(drvname);
    e->dev->driver = qapi_enum_parse(
        &AudiodevDriver_lookup, drvname, -1, &error_abort);
    audio_create_pdos(e->dev);
    handle_per_direction(audio_get_pdo_in(e->dev), "QEMU_AUDIO_ADC_");
    handle_per_direction(audio_get_pdo_out(e->dev), "QEMU_AUDIO_DAC_");
    /* Original description: Timer period in HZ (0 - use lowest possible) */
    get_int("QEMU_AUDIO_TIMER_PERIOD",
            &e->dev->timer_period, &e->dev->has_timer_period);
    if (e->dev->has_timer_period && e->dev->timer_period) {
        e->dev->timer_period = NANOSECONDS_PER_SECOND / 1000 /
                               e->dev->timer_period;
    }
    switch (e->dev->driver) {
    case AUDIODEV_DRIVER_ALSA:
        handle_alsa(e->dev);
        break;
    case AUDIODEV_DRIVER_COREAUDIO:
        handle_coreaudio(e->dev);
        break;
    case AUDIODEV_DRIVER_DSOUND:
        handle_dsound(e->dev);
        break;
    case AUDIODEV_DRIVER_OSS:
        handle_oss(e->dev);
        break;
    case AUDIODEV_DRIVER_PA:
        handle_pa(e->dev);
        break;
    case AUDIODEV_DRIVER_SDL:
        handle_sdl(e->dev);
        break;
    case AUDIODEV_DRIVER_WAV:
        handle_wav(e->dev);
        break;
    default:
        break;
    }
    return e;
 }
 AudiodevListHead audio_handle_legacy_opts(void)
 {
    const char *drvname = getenv("QEMU_AUDIO_DRV");
    AudiodevListHead head = QSIMPLEQ_HEAD_INITIALIZER(head);
    if (drvname) {
        AudiodevListEntry *e;
        audio_driver *driver = audio_driver_lookup(drvname);
        if (!driver) {
            dolog("Unknown audio driver `%s'\n", drvname);
            exit(1);
        }
        e = legacy_opt(drvname);
        QSIMPLEQ_INSERT_TAIL(&head, e, next);
    } else {
        for (int i = 0; audio_prio_list[i]; i++) {
            audio_driver *driver = audio_driver_lookup(audio_prio_list[i]);
            if (driver && driver->can_be_default) {
                AudiodevListEntry *e = legacy_opt(driver->name);
                QSIMPLEQ_INSERT_TAIL(&head, e, next);
            }
        }
        if (QSIMPLEQ_EMPTY(&head)) {
            dolog("Internal error: no default audio driver available\n");
            exit(1);
        }
    }
    return head;
 }
 /* visitor to print -audiodev option */
 typedef struct {
    Visitor visitor;
    bool comma;
    GList *path;
 } LegacyPrintVisitor;
 static bool lv_start_struct(Visitor *v, const char *name, void **obj,
                            size_t size, Error **errp)
 {
    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
    lv->path = g_list_append(lv->path, g_strdup(name));
    return true;
 }
 static void lv_end_struct(Visitor *v, void **obj)
 {
    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
    lv->path = g_list_delete_link(lv->path, g_list_last(lv->path));
 }
 static void lv_print_key(Visitor *v, const char *name)
 {
    GList *e;
    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
    if (lv->comma) {
        putchar(',');
    } else {
        lv->comma = true;
    }
    for (e = lv->path; e; e = e->next) {
        if (e->data) {
            printf("%s.", (const char *) e->data);
        }
    }
    printf("%s=", name);
 }
 static bool lv_type_int64(Visitor *v, const char *name, int64_t *obj,
                          Error **errp)
 {
    lv_print_key(v, name);
    printf("%" PRIi64, *obj);
    return true;
 }
 static bool lv_type_uint64(Visitor *v, const char *name, uint64_t *obj,
                           Error **errp)
 {
    lv_print_key(v, name);
    printf("%" PRIu64, *obj);
    return true;
 }
 static bool lv_type_bool(Visitor *v, const char *name, bool *obj, Error **errp)
 {
    lv_print_key(v, name);
    printf("%s", *obj ? "on" : "off");
    return true;
 }
 static bool lv_type_str(Visitor *v, const char *name, char **obj, Error **errp)
 {
    const char *str = *obj;
    lv_print_key(v, name);
    while (*str) {
        if (*str == ',') {
            putchar(',');
        }
        putchar(*str++);
    }
    return true;
 }
 static void lv_complete(Visitor *v, void *opaque)
 {
    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
    assert(lv->path == NULL);
 }
 static void lv_free(Visitor *v)
 {
    LegacyPrintVisitor *lv = (LegacyPrintVisitor *) v;
    g_list_free_full(lv->path, g_free);
    g_free(lv);
 }
 static Visitor *legacy_visitor_new(void)
 {
    LegacyPrintVisitor *lv = g_malloc0(sizeof(LegacyPrintVisitor));
    lv->visitor.start_struct = lv_start_struct;
    lv->visitor.end_struct = lv_end_struct;
    /* lists not supported */
    lv->visitor.type_int64 = lv_type_int64;
    lv->visitor.type_uint64 = lv_type_uint64;
    lv->visitor.type_bool = lv_type_bool;
    lv->visitor.type_str = lv_type_str;
    lv->visitor.type = VISITOR_OUTPUT;
    lv->visitor.complete = lv_complete;
    lv->visitor.free = lv_free;
    return &lv->visitor;
 }
 void audio_legacy_help(void)
 {
    AudiodevListHead head;
    AudiodevListEntry *e;
    printf("Environment variable based configuration deprecated.\n");
    printf("Please use the new -audiodev option.\n");
    head = audio_handle_legacy_opts();
    printf("\nEquivalent -audiodev to your current environment variables:\n");
    if (!getenv("QEMU_AUDIO_DRV")) {
        printf("(Since you didn't specify QEMU_AUDIO_DRV, I'll list all "
               "possibilities)\n");
    }
    QSIMPLEQ_FOREACH(e, &head, next) {
        Visitor *v;
        Audiodev *dev = e->dev;
        printf("-audiodev ");
        v = legacy_visitor_new();
        visit_type_Audiodev(v, NULL, &dev, &error_abort);
        visit_free(v);
        printf("\n");
    }
    audio_free_audiodev_list(&head);
 }
--- a/audio/audio_pt_int.c
+++ b/audio/audio_pt_int.c
@@ -0,0 +1,149 @@
 #include "qemu-common.h"
 #include "audio.h"
 #define AUDIO_CAP "audio-pt"
 #include "audio_int.h"
 #include "audio_pt_int.h"
 static void logerr (struct audio_pt *pt, int err, const char *fmt, ...)
 {
    va_list ap;
    va_start (ap, fmt);
    AUD_vlog (pt->drv, fmt, ap);
    va_end (ap);
    AUD_log (NULL, "\n");
    AUD_log (pt->drv, "Reason: %s\n", strerror (err));
 }
 int audio_pt_init (struct audio_pt *p, void *(*func) (void *),
                   void *opaque, const char *drv, const char *cap)
 {
    int err, err2;
    const char *efunc;
    p->drv = drv;
    err = pthread_mutex_init (&p->mutex, NULL);
    if (err) {
        efunc = "pthread_mutex_init";
        goto err0;
    }
    err = pthread_cond_init (&p->cond, NULL);
    if (err) {
        efunc = "pthread_cond_init";
        goto err1;
    }
    err = pthread_create (&p->thread, NULL, func, opaque);
    if (err) {
        efunc = "pthread_create";
        goto err2;
    }
    return 0;
 err2:
    err2 = pthread_cond_destroy (&p->cond);
    if (err2) {
        logerr (p, err2, "%s(%s): pthread_cond_destroy failed", cap, AUDIO_FUNC);
    }
 err1:
    err2 = pthread_mutex_destroy (&p->mutex);
    if (err2) {
        logerr (p, err2, "%s(%s): pthread_mutex_destroy failed", cap, AUDIO_FUNC);
    }
 err0:
    logerr (p, err, "%s(%s): %s failed", cap, AUDIO_FUNC, efunc);
    return -1;
 }
 int audio_pt_fini (struct audio_pt *p, const char *cap)
 {
    int err, ret = 0;
    err = pthread_cond_destroy (&p->cond);
    if (err) {
        logerr (p, err, "%s(%s): pthread_cond_destroy failed", cap, AUDIO_FUNC);
        ret = -1;
    }
    err = pthread_mutex_destroy (&p->mutex);
    if (err) {
        logerr (p, err, "%s(%s): pthread_mutex_destroy failed", cap, AUDIO_FUNC);
        ret = -1;
    }
    return ret;
 }
 int audio_pt_lock (struct audio_pt *p, const char *cap)
 {
    int err;
    err = pthread_mutex_lock (&p->mutex);
    if (err) {
        logerr (p, err, "%s(%s): pthread_mutex_lock failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
 }
 int audio_pt_unlock (struct audio_pt *p, const char *cap)
 {
    int err;
    err = pthread_mutex_unlock (&p->mutex);
    if (err) {
        logerr (p, err, "%s(%s): pthread_mutex_unlock failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
 }
 int audio_pt_wait (struct audio_pt *p, const char *cap)
 {
    int err;
    err = pthread_cond_wait (&p->cond, &p->mutex);
    if (err) {
        logerr (p, err, "%s(%s): pthread_cond_wait failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
 }
 int audio_pt_unlock_and_signal (struct audio_pt *p, const char *cap)
 {
    int err;
    err = pthread_mutex_unlock (&p->mutex);
    if (err) {
        logerr (p, err, "%s(%s): pthread_mutex_unlock failed", cap, AUDIO_FUNC);
        return -1;
    }
    err = pthread_cond_signal (&p->cond);
    if (err) {
        logerr (p, err, "%s(%s): pthread_cond_signal failed", cap, AUDIO_FUNC);
        return -1;
    }
    return 0;
 }
 int audio_pt_join (struct audio_pt *p, void **arg, const char *cap)
 {
    int err;
    void *ret;
    err = pthread_join (p->thread, &ret);
    if (err) {
        logerr (p, err, "%s(%s): pthread_join failed", cap, AUDIO_FUNC);
        return -1;
    }
    *arg = ret;
    return 0;
 }
--- a/audio/audio_pt_int.h
+++ b/audio/audio_pt_int.h
@@ -0,0 +1,22 @@
 #ifndef QEMU_AUDIO_PT_INT_H
 #define QEMU_AUDIO_PT_INT_H
 #include <pthread.h>
 struct audio_pt {
    const char *drv;
    pthread_t thread;
    pthread_cond_t cond;
    pthread_mutex_t mutex;
 };
 int audio_pt_init (struct audio_pt *, void *(*) (void *), void *,
                   const char *, const char *);
 int audio_pt_fini (struct audio_pt *, const char *);
 int audio_pt_lock (struct audio_pt *, const char *);
 int audio_pt_unlock (struct audio_pt *, const char *);
 int audio_pt_wait (struct audio_pt *, const char *);
 int audio_pt_unlock_and_signal (struct audio_pt *, const char *);
 int audio_pt_join (struct audio_pt *, void **, const char *);
 #endif /* audio_pt_int.h */
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`((c-mode . ((c-file-style . "stroustrup")`
			`(indent-tabs-mode . nil))))`
		`@@ -0,0 +1,2 @@`
							`seabios 9fb3f4d950744e97cc655b7d7b523d8bf101e4a0`
							`vgabios 6e62666cfc19e7fd45dd0d7c3ad62fd8d0b5f67a`
		`@@ -0,0 +1,3 @@`
							`Read the documentation in qemu-doc.html.`

							`Fabrice Bellard.`
		`@@ -1,2 +0,0 @@`
			`obj-y += kvm-all.o`
			`obj-$(call lnot,$(CONFIG_SEV)) += sev-stub.o`