summary refs log tree commit diff stats
diff options
context:
space:
mode:
-rw-r--r--audio/audio.h1
-rw-r--r--bsd-user/qemu.h3
-rwxr-xr-xconfigure20
-rw-r--r--contrib/ivshmem-client/ivshmem-client.h1
-rw-r--r--contrib/ivshmem-server/ivshmem-server.h3
-rw-r--r--disas/arm-a64.cc5
-rw-r--r--fsdev/file-op-9p.h3
-rw-r--r--hw/9pfs/9p-synth.h3
-rw-r--r--hw/9pfs/9p.h2
-rw-r--r--hw/audio/gusemu.h1
-rw-r--r--hw/display/vga_int.h1
-rw-r--r--hw/net/fsl_etsec/registers.h1
-rw-r--r--hw/ppc/spapr.c2
-rw-r--r--hw/ppc/spapr_hcall.c60
-rw-r--r--hw/timer/Makefile.objs1
-rw-r--r--hw/usb/Makefile.objs2
-rw-r--r--hw/usb/core.c18
-rw-r--r--hw/usb/desc.h1
-rw-r--r--hw/usb/dev-network.c12
-rw-r--r--hw/usb/hcd-ohci.c34
-rw-r--r--hw/usb/hcd-uhci.c22
-rw-r--r--hw/usb/tusb6010.c (renamed from hw/timer/tusb6010.c)0
-rw-r--r--hw/vfio/amd-xgbe.c1
-rw-r--r--include/block/accounting.h2
-rw-r--r--include/block/nbd.h1
-rw-r--r--include/block/snapshot.h1
-rw-r--r--include/block/write-threshold.h1
-rw-r--r--include/config.h1
-rw-r--r--include/crypto/cipher.h1
-rw-r--r--include/crypto/hash.h1
-rw-r--r--include/crypto/init.h1
-rw-r--r--include/crypto/secret.h1
-rw-r--r--include/crypto/tlscreds.h1
-rw-r--r--include/elf.h1
-rw-r--r--include/exec/cpu-all.h1
-rw-r--r--include/exec/cpu-defs.h3
-rw-r--r--include/exec/helper-head.h1
-rw-r--r--include/exec/memory.h3
-rw-r--r--include/exec/user/thunk.h1
-rw-r--r--include/fpu/softfloat.h3
-rw-r--r--include/hw/acpi/acpi.h1
-rw-r--r--include/hw/acpi/aml-build.h2
-rw-r--r--include/hw/acpi/bios-linker-loader.h2
-rw-r--r--include/hw/acpi/pcihp.h1
-rw-r--r--include/hw/block/block.h1
-rw-r--r--include/hw/i386/topology.h2
-rw-r--r--include/hw/isa/apm.h1
-rw-r--r--include/hw/nvram/fw_cfg.h2
-rw-r--r--include/hw/pci/pci.h1
-rw-r--r--include/hw/pci/shpc.h1
-rw-r--r--include/hw/qdev-core.h1
-rw-r--r--include/hw/virtio/vhost-backend.h1
-rw-r--r--include/hw/xen/xen.h1
-rw-r--r--include/hw/xen/xen_common.h3
-rw-r--r--include/io/channel.h1
-rw-r--r--include/io/task.h1
-rw-r--r--include/libdecnumber/dconfig.h1
-rw-r--r--include/libdecnumber/decContext.h3
-rw-r--r--include/libdecnumber/decNumberLocal.h2
-rw-r--r--include/migration/migration.h5
-rw-r--r--include/migration/qemu-file.h1
-rw-r--r--include/net/checksum.h1
-rw-r--r--include/net/eth.h2
-rw-r--r--include/qapi/error.h3
-rw-r--r--include/qapi/qmp-event.h1
-rw-r--r--include/qapi/qmp/dispatch.h1
-rw-r--r--include/qapi/qmp/json-lexer.h1
-rw-r--r--include/qapi/qmp/json-parser.h1
-rw-r--r--include/qapi/qmp/json-streamer.h2
-rw-r--r--include/qapi/qmp/qbool.h1
-rw-r--r--include/qapi/qmp/qdict.h2
-rw-r--r--include/qapi/qmp/qfloat.h1
-rw-r--r--include/qapi/qmp/qint.h1
-rw-r--r--include/qapi/qmp/qjson.h2
-rw-r--r--include/qapi/qmp/qobject.h2
-rw-r--r--include/qapi/qmp/qstring.h1
-rw-r--r--include/qapi/visitor-impl.h1
-rw-r--r--include/qapi/visitor.h2
-rw-r--r--include/qemu-common.h1
-rw-r--r--include/qemu/atomic.h1
-rw-r--r--include/qemu/bitmap.h3
-rw-r--r--include/qemu/bitops.h2
-rw-r--r--include/qemu/bswap.h5
-rw-r--r--include/qemu/compatfd.h1
-rw-r--r--include/qemu/compiler.h1
-rw-r--r--include/qemu/config-file.h2
-rw-r--r--include/qemu/coroutine.h1
-rw-r--r--include/qemu/error-report.h3
-rw-r--r--include/qemu/fprintf-fn.h2
-rw-r--r--include/qemu/hbitmap.h3
-rw-r--r--include/qemu/host-utils.h3
-rw-r--r--include/qemu/int128.h3
-rw-r--r--include/qemu/log.h4
-rw-r--r--include/qemu/memfd.h2
-rw-r--r--include/qemu/module.h1
-rw-r--r--include/qemu/option.h2
-rw-r--r--include/qemu/osdep.h17
-rw-r--r--include/qemu/range.h1
-rw-r--r--include/qemu/rcu.h7
-rw-r--r--include/qemu/sockets.h2
-rw-r--r--include/qemu/thread.h2
-rw-r--r--include/qemu/throttle.h1
-rw-r--r--include/qemu/timed-average.h1
-rw-r--r--include/qemu/xattr.h1
-rw-r--r--include/qom/cpu.h1
-rw-r--r--include/qom/object.h3
-rw-r--r--include/sysemu/block-backend.h1
-rw-r--r--include/sysemu/blockdev.h1
-rw-r--r--include/sysemu/dma.h1
-rw-r--r--include/sysemu/hostmem.h1
-rw-r--r--include/sysemu/kvm.h2
-rw-r--r--include/sysemu/numa.h1
-rw-r--r--include/sysemu/os-posix.h1
-rw-r--r--include/sysemu/qtest.h1
-rw-r--r--include/sysemu/replay.h3
-rw-r--r--include/sysemu/rng.h1
-rw-r--r--include/sysemu/seccomp.h1
-rw-r--r--include/sysemu/tpm_backend.h1
-rw-r--r--include/sysemu/xen-mapcache.h1
-rw-r--r--include/ui/console.h1
-rw-r--r--include/ui/egl-helpers.h13
-rw-r--r--include/ui/qemu-spice.h1
-rw-r--r--include/ui/spice-display.h16
-rw-r--r--io/channel-util.c1
-rw-r--r--linux-user/aarch64/syscall_nr.h61
-rw-r--r--linux-user/aarch64/target_syscall.h (renamed from linux-user/aarch64/syscall.h)5
-rw-r--r--linux-user/alpha/syscall_nr.h6
-rw-r--r--linux-user/alpha/target_syscall.h (renamed from linux-user/alpha/syscall.h)5
-rw-r--r--linux-user/arm/nwfpe/fpa11.h3
-rw-r--r--linux-user/arm/target_syscall.h (renamed from linux-user/arm/syscall.h)4
-rw-r--r--linux-user/cris/syscall_nr.h24
-rw-r--r--linux-user/cris/target_syscall.h (renamed from linux-user/cris/syscall.h)0
-rw-r--r--linux-user/i386/syscall_nr.h29
-rw-r--r--linux-user/i386/target_syscall.h (renamed from linux-user/i386/syscall.h)5
-rw-r--r--linux-user/m68k/syscall_nr.h2
-rw-r--r--linux-user/m68k/target_syscall.h (renamed from linux-user/m68k/syscall.h)4
-rw-r--r--linux-user/main.c2
-rw-r--r--linux-user/microblaze/syscall_nr.h8
-rw-r--r--linux-user/microblaze/target_syscall.h (renamed from linux-user/microblaze/syscall.h)0
-rw-r--r--linux-user/mips/target_syscall.h (renamed from linux-user/mips/syscall.h)4
-rw-r--r--linux-user/mips64/syscall_nr.h23
-rw-r--r--linux-user/mips64/target_syscall.h (renamed from linux-user/mips64/syscall.h)4
-rw-r--r--linux-user/openrisc/syscall_nr.h28
-rw-r--r--linux-user/openrisc/target_syscall.h (renamed from linux-user/openrisc/syscall.h)5
-rw-r--r--linux-user/ppc/syscall_nr.h26
-rw-r--r--linux-user/ppc/target_syscall.h (renamed from linux-user/ppc/syscall.h)5
-rw-r--r--linux-user/qemu.h5
-rw-r--r--linux-user/s390x/syscall_nr.h30
-rw-r--r--linux-user/s390x/target_syscall.h (renamed from linux-user/s390x/syscall.h)5
-rw-r--r--linux-user/sh4/syscall_nr.h2
-rw-r--r--linux-user/sh4/target_syscall.h (renamed from linux-user/sh4/syscall.h)5
-rw-r--r--linux-user/sparc/syscall_nr.h16
-rw-r--r--linux-user/sparc/target_syscall.h (renamed from linux-user/sparc/syscall.h)5
-rw-r--r--linux-user/sparc64/syscall_nr.h14
-rw-r--r--linux-user/sparc64/target_syscall.h (renamed from linux-user/sparc64/syscall.h)5
-rw-r--r--linux-user/syscall.c31
-rw-r--r--linux-user/tilegx/syscall_nr.h4
-rw-r--r--linux-user/tilegx/target_syscall.h (renamed from linux-user/tilegx/syscall.h)0
-rw-r--r--linux-user/unicore32/target_syscall.h (renamed from linux-user/unicore32/syscall.h)0
-rw-r--r--linux-user/x86_64/syscall_nr.h15
-rw-r--r--linux-user/x86_64/target_syscall.h (renamed from linux-user/x86_64/syscall.h)5
-rw-r--r--migration/migration.c14
-rw-r--r--nbd/nbd-internal.h4
-rw-r--r--net/tap-linux.h1
-rw-r--r--net/util.h1
-rw-r--r--pc-bios/README2
-rw-r--r--pc-bios/slof.binbin914712 -> 923832 bytes
-rw-r--r--qemu-nbd.c2
-rw-r--r--qemu-options.hx4
-rw-r--r--qemu-tech.texi2
-rw-r--r--qga/vss-win32.h1
-rw-r--r--qga/vss-win32/requester.h1
-rw-r--r--qga/vss-win32/vss-common.h1
-rw-r--r--qom/cpu.c1
-rw-r--r--replay/replay-internal.h1
m---------roms/SLOF0
-rwxr-xr-xscripts/clean-includes74
-rw-r--r--scripts/tracetool/format/ust_events_c.py2
-rw-r--r--slirp/slirp.h18
-rw-r--r--target-alpha/cpu.h1
-rw-r--r--target-arm/cpu.h1
-rw-r--r--target-arm/kvm-consts.h1
-rw-r--r--target-cris/cpu.h1
-rw-r--r--target-i386/cpu-qom.h1
-rw-r--r--target-i386/cpu.c5
-rw-r--r--target-i386/cpu.h1
-rw-r--r--target-i386/mpx_helper.c1
-rw-r--r--target-lm32/cpu.h1
-rw-r--r--target-m68k/cpu.h1
-rw-r--r--target-microblaze/cpu.h1
-rw-r--r--target-mips/cpu.h1
-rw-r--r--target-moxie/cpu.h1
-rw-r--r--target-openrisc/cpu.h1
-rw-r--r--target-ppc/cpu.h1
-rw-r--r--target-ppc/kvm.c11
-rw-r--r--target-ppc/kvm_ppc.h36
-rw-r--r--target-s390x/cpu.h1
-rw-r--r--target-sh4/cpu.h1
-rw-r--r--target-sparc/cpu.h1
-rw-r--r--target-sparc/translate.c204
-rw-r--r--target-tilegx/cpu.h1
-rw-r--r--target-tricore/cpu.h1
-rw-r--r--target-unicore32/cpu.h1
-rw-r--r--target-xtensa/cpu.h1
-rw-r--r--tcg/README5
-rw-r--r--tcg/aarch64/tcg-target.inc.c (renamed from tcg/aarch64/tcg-target.c)1
-rw-r--r--tcg/arm/tcg-target.inc.c (renamed from tcg/arm/tcg-target.c)1
-rw-r--r--tcg/i386/tcg-target.inc.c (renamed from tcg/i386/tcg-target.c)1
-rw-r--r--tcg/ia64/tcg-target.inc.c (renamed from tcg/ia64/tcg-target.c)0
-rw-r--r--tcg/mips/tcg-target.inc.c (renamed from tcg/mips/tcg-target.c)1
-rw-r--r--tcg/ppc/tcg-target.inc.c (renamed from tcg/ppc/tcg-target.c)1
-rw-r--r--tcg/s390/tcg-target.inc.c (renamed from tcg/s390/tcg-target.c)1
-rw-r--r--tcg/sparc/tcg-target.inc.c (renamed from tcg/sparc/tcg-target.c)1
-rw-r--r--tcg/tcg.c145
-rw-r--r--tcg/tcg.h4
-rw-r--r--tcg/tci/README4
-rw-r--r--tcg/tci/tcg-target.h1
-rw-r--r--tcg/tci/tcg-target.inc.c (renamed from tcg/tci/tcg-target.c)1
-rw-r--r--tests/boot-sector.c3
-rw-r--r--tests/libqos/ahci.h3
-rw-r--r--tests/libqos/fw_cfg.h2
-rw-r--r--tests/libqos/i2c.h1
-rw-r--r--tests/libqos/malloc.h2
-rw-r--r--tests/libqos/pci.h1
-rw-r--r--tests/libqtest.h6
-rw-r--r--tests/pxe-test.c3
-rw-r--r--trace/control-internal.h1
-rw-r--r--trace/ftrace.h1
-rw-r--r--trace/simple.h3
-rw-r--r--ui/egl-helpers.c129
-rw-r--r--ui/spice-core.c18
-rw-r--r--ui/spice-display.c152
-rw-r--r--ui/vnc-palette.h2
-rw-r--r--ui/vnc.h1
234 files changed, 1104 insertions, 596 deletions
diff --git a/audio/audio.h b/audio/audio.h
index e7ea39777e..b41a97053d 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -24,7 +24,6 @@
 #ifndef QEMU_AUDIO_H
 #define QEMU_AUDIO_H
 
-#include "config-host.h"
 #include "qemu/queue.h"
 
 typedef void (*audio_callback_fn) (void *opaque, int avail);
diff --git a/bsd-user/qemu.h b/bsd-user/qemu.h
index 735cb4042a..1b5f9983d1 100644
--- a/bsd-user/qemu.h
+++ b/bsd-user/qemu.h
@@ -17,15 +17,12 @@
 #ifndef QEMU_H
 #define QEMU_H
 
-#include <signal.h>
-#include <string.h>
 
 #include "cpu.h"
 #include "exec/cpu_ldst.h"
 
 #undef DEBUG_REMAP
 #ifdef DEBUG_REMAP
-#include <stdlib.h>
 #endif /* DEBUG_REMAP */
 
 #include "exec/user/abitypes.h"
diff --git a/configure b/configure
index 0aa249b788..0c0472a7da 100755
--- a/configure
+++ b/configure
@@ -279,6 +279,7 @@ smartcard=""
 libusb=""
 usb_redir=""
 opengl=""
+opengl_dmabuf="no"
 zlib="yes"
 lzo=""
 snappy=""
@@ -3274,7 +3275,7 @@ libs_softmmu="$libs_softmmu $fdt_libs"
 # opengl probe (for sdl2, gtk, milkymist-tmu2)
 
 if test "$opengl" != "no" ; then
-  opengl_pkgs="epoxy"
+  opengl_pkgs="epoxy libdrm gbm"
   if $pkg_config $opengl_pkgs x11; then
     opengl_cflags="$($pkg_config --cflags $opengl_pkgs) $x11_cflags"
     opengl_libs="$($pkg_config --libs $opengl_pkgs) $x11_libs"
@@ -3292,6 +3293,18 @@ if test "$opengl" != "no" ; then
   fi
 fi
 
+if test "$opengl" = "yes"; then
+  cat > $TMPC << EOF
+#include <epoxy/egl.h>
+#ifndef EGL_MESA_image_dma_buf_export
+# error mesa/epoxy lacks support for dmabufs (mesa 10.6+)
+#endif
+int main(void) { return 0; }
+EOF
+  if compile_prog "" "" ; then
+    opengl_dmabuf=yes
+  fi
+fi
 
 ##########################################
 # archipelago probe
@@ -4752,6 +4765,7 @@ echo "smartcard support $smartcard"
 echo "libusb            $libusb"
 echo "usb net redir     $usb_redir"
 echo "OpenGL support    $opengl"
+echo "OpenGL dmabufs    $opengl_dmabuf"
 echo "libiscsi support  $libiscsi"
 echo "libnfs support    $libnfs"
 echo "build guest agent $guest_agent"
@@ -5050,6 +5064,7 @@ if test "$gtk" = "yes" ; then
   echo "CONFIG_GTK=y" >> $config_host_mak
   echo "CONFIG_GTKABI=$gtkabi" >> $config_host_mak
   echo "GTK_CFLAGS=$gtk_cflags" >> $config_host_mak
+  echo "GTK_LIBS=$gtk_libs" >> $config_host_mak
   if test "$gtk_gl" = "yes" ; then
     echo "CONFIG_GTK_GL=y" >> $config_host_mak
   fi
@@ -5158,6 +5173,9 @@ if test "$opengl" = "yes" ; then
   echo "CONFIG_OPENGL=y" >> $config_host_mak
   echo "OPENGL_CFLAGS=$opengl_cflags" >> $config_host_mak
   echo "OPENGL_LIBS=$opengl_libs" >> $config_host_mak
+  if test "$opengl_dmabuf" = "yes" ; then
+    echo "CONFIG_OPENGL_DMABUF=y" >> $config_host_mak
+  fi
 fi
 
 if test "$lzo" = "yes" ; then
diff --git a/contrib/ivshmem-client/ivshmem-client.h b/contrib/ivshmem-client/ivshmem-client.h
index 3a4f809682..54cde17d93 100644
--- a/contrib/ivshmem-client/ivshmem-client.h
+++ b/contrib/ivshmem-client/ivshmem-client.h
@@ -19,7 +19,6 @@
  * purposes.
  */
 
-#include <limits.h>
 #include <sys/select.h>
 
 #include "qemu/queue.h"
diff --git a/contrib/ivshmem-server/ivshmem-server.h b/contrib/ivshmem-server/ivshmem-server.h
index c9359a0a8a..e9de8a369d 100644
--- a/contrib/ivshmem-server/ivshmem-server.h
+++ b/contrib/ivshmem-server/ivshmem-server.h
@@ -26,10 +26,7 @@
  * associated to the ivshmem shared memory.
  */
 
-#include <limits.h>
 #include <sys/select.h>
-#include <stdint.h>
-#include <stdbool.h>
 
 #include "qemu/event_notifier.h"
 #include "qemu/queue.h"
diff --git a/disas/arm-a64.cc b/disas/arm-a64.cc
index d4d46d5ff3..9280950ce3 100644
--- a/disas/arm-a64.cc
+++ b/disas/arm-a64.cc
@@ -17,12 +17,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "vixl/a64/disasm-a64.h"
-
 extern "C" {
+#include "qemu/osdep.h"
 #include "disas/bfd.h"
 }
 
+#include "vixl/a64/disasm-a64.h"
+
 using namespace vixl;
 
 static Decoder *vixl_decoder = NULL;
diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h
index 956fda0919..b8c26024a9 100644
--- a/fsdev/file-op-9p.h
+++ b/fsdev/file-op-9p.h
@@ -12,11 +12,8 @@
  */
 #ifndef _FILEOP_H
 #define _FILEOP_H
-#include <sys/types.h>
 #include <dirent.h>
-#include <sys/time.h>
 #include <utime.h>
-#include <sys/stat.h>
 #include <sys/uio.h>
 #include <sys/vfs.h>
 
diff --git a/hw/9pfs/9p-synth.h b/hw/9pfs/9p-synth.h
index eaf5a0c293..82962512a1 100644
--- a/hw/9pfs/9p-synth.h
+++ b/hw/9pfs/9p-synth.h
@@ -13,9 +13,6 @@
 #ifndef HW_9PFS_SYNTH_H
 #define HW_9PFS_SYNTH_H 1
 
-#include <unistd.h>
-#include <sys/types.h>
-#include <limits.h>
 
 typedef struct V9fsSynthNode V9fsSynthNode;
 typedef ssize_t (*v9fs_synth_read)(void *buf, int len, off_t offset,
diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
index edcd51be15..1a19418a8c 100644
--- a/hw/9pfs/9p.h
+++ b/hw/9pfs/9p.h
@@ -1,9 +1,7 @@
 #ifndef _QEMU_9P_H
 #define _QEMU_9P_H
 
-#include <sys/types.h>
 #include <dirent.h>
-#include <sys/time.h>
 #include <utime.h>
 #include <sys/resource.h>
 #include <glib.h>
diff --git a/hw/audio/gusemu.h b/hw/audio/gusemu.h
index 331bb6fec0..b7f0751268 100644
--- a/hw/audio/gusemu.h
+++ b/hw/audio/gusemu.h
@@ -34,7 +34,6 @@
  typedef signed char GUSchar;
  typedef signed short GUSsample;
 #else
- #include <stdint.h>
  typedef int8_t GUSchar;
  typedef uint8_t GUSbyte;
  typedef uint16_t GUSword;
diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
index 40ba6a4207..bdb43a5a34 100644
--- a/hw/display/vga_int.h
+++ b/hw/display/vga_int.h
@@ -25,7 +25,6 @@
 #define HW_VGA_INT_H 1
 
 #include <hw/hw.h>
-#include "qapi/error.h"
 #include "exec/memory.h"
 
 #define ST01_V_RETRACE      0x08
diff --git a/hw/net/fsl_etsec/registers.h b/hw/net/fsl_etsec/registers.h
index 7ad7686470..6fb96842b8 100644
--- a/hw/net/fsl_etsec/registers.h
+++ b/hw/net/fsl_etsec/registers.h
@@ -24,7 +24,6 @@
 #ifndef _ETSEC_REGISTERS_H_
 #define _ETSEC_REGISTERS_H_
 
-#include <stdint.h>
 
 enum eTSEC_Register_Access_Type {
     ACC_RW      = 1,            /* Read/Write */
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e214a34257..c119f55824 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1528,7 +1528,7 @@ static int htab_load(QEMUFile *f, void *opaque, int version_id)
     section_hdr = qemu_get_be32(f);
 
     if (section_hdr) {
-        Error *local_err;
+        Error *local_err = NULL;
 
         /* First section gives the htab size */
         spapr_reallocate_hpt(spapr, section_hdr, &local_err);
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 6e9b6be58c..1733482de6 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -386,6 +386,65 @@ static target_ulong h_set_xdabr(PowerPCCPU *cpu, sPAPRMachineState *spapr,
     return H_SUCCESS;
 }
 
+static target_ulong h_page_init(PowerPCCPU *cpu, sPAPRMachineState *spapr,
+                                target_ulong opcode, target_ulong *args)
+{
+    target_ulong flags = args[0];
+    hwaddr dst = args[1];
+    hwaddr src = args[2];
+    hwaddr len = TARGET_PAGE_SIZE;
+    uint8_t *pdst, *psrc;
+    target_long ret = H_SUCCESS;
+
+    if (flags & ~(H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE
+                  | H_COPY_PAGE | H_ZERO_PAGE)) {
+        qemu_log_mask(LOG_UNIMP, "h_page_init: Bad flags (" TARGET_FMT_lx "\n",
+                      flags);
+        return H_PARAMETER;
+    }
+
+    /* Map-in destination */
+    if (!is_ram_address(spapr, dst) || (dst & ~TARGET_PAGE_MASK) != 0) {
+        return H_PARAMETER;
+    }
+    pdst = cpu_physical_memory_map(dst, &len, 1);
+    if (!pdst || len != TARGET_PAGE_SIZE) {
+        return H_PARAMETER;
+    }
+
+    if (flags & H_COPY_PAGE) {
+        /* Map-in source, copy to destination, and unmap source again */
+        if (!is_ram_address(spapr, src) || (src & ~TARGET_PAGE_MASK) != 0) {
+            ret = H_PARAMETER;
+            goto unmap_out;
+        }
+        psrc = cpu_physical_memory_map(src, &len, 0);
+        if (!psrc || len != TARGET_PAGE_SIZE) {
+            ret = H_PARAMETER;
+            goto unmap_out;
+        }
+        memcpy(pdst, psrc, len);
+        cpu_physical_memory_unmap(psrc, len, 0, len);
+    } else if (flags & H_ZERO_PAGE) {
+        memset(pdst, 0, len);          /* Just clear the destination page */
+    }
+
+    if (kvm_enabled() && (flags & H_ICACHE_SYNCHRONIZE) != 0) {
+        kvmppc_dcbst_range(cpu, pdst, len);
+    }
+    if (flags & (H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE)) {
+        if (kvm_enabled()) {
+            kvmppc_icbi_range(cpu, pdst, len);
+        } else {
+            tb_flush(CPU(cpu));
+        }
+    }
+
+unmap_out:
+    cpu_physical_memory_unmap(pdst, TARGET_PAGE_SIZE, 1, len);
+    return ret;
+}
+
 #define FLAGS_REGISTER_VPA         0x0000200000000000ULL
 #define FLAGS_REGISTER_DTL         0x0000400000000000ULL
 #define FLAGS_REGISTER_SLBSHADOW   0x0000600000000000ULL
@@ -1045,6 +1104,7 @@ static void hypercall_register_types(void)
     spapr_register_hypercall(H_SET_SPRG0, h_set_sprg0);
     spapr_register_hypercall(H_SET_DABR, h_set_dabr);
     spapr_register_hypercall(H_SET_XDABR, h_set_xdabr);
+    spapr_register_hypercall(H_PAGE_INIT, h_page_init);
     spapr_register_hypercall(H_SET_MODE, h_set_mode);
 
     /* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
diff --git a/hw/timer/Makefile.objs b/hw/timer/Makefile.objs
index 133bd0d455..5cfea6e0da 100644
--- a/hw/timer/Makefile.objs
+++ b/hw/timer/Makefile.objs
@@ -25,7 +25,6 @@ obj-$(CONFIG_OMAP) += omap_gptimer.o
 obj-$(CONFIG_OMAP) += omap_synctimer.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_timer.o
 obj-$(CONFIG_SH4) += sh_timer.o
-obj-$(CONFIG_TUSB6010) += tusb6010.o
 obj-$(CONFIG_DIGIC) += digic-timer.o
 
 obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index 8f00fbd8f6..2717027d34 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -10,6 +10,8 @@ common-obj-$(CONFIG_USB_EHCI_SYSBUS) += hcd-ehci-sysbus.o
 common-obj-$(CONFIG_USB_XHCI) += hcd-xhci.o
 common-obj-$(CONFIG_USB_MUSB) += hcd-musb.o
 
+obj-$(CONFIG_TUSB6010) += tusb6010.o
+
 # emulated usb devices
 common-obj-$(CONFIG_USB) += dev-hub.o
 common-obj-$(CONFIG_USB) += dev-hid.o
diff --git a/hw/usb/core.c b/hw/usb/core.c
index bea5e1ee8b..45fa00c517 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -129,9 +129,16 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
     }
 
     usb_packet_copy(p, s->setup_buf, p->iov.size);
+    s->setup_index = 0;
     p->actual_length = 0;
     s->setup_len   = (s->setup_buf[7] << 8) | s->setup_buf[6];
-    s->setup_index = 0;
+    if (s->setup_len > sizeof(s->data_buf)) {
+        fprintf(stderr,
+                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
+                s->setup_len, sizeof(s->data_buf));
+        p->status = USB_RET_STALL;
+        return;
+    }
 
     request = (s->setup_buf[0] << 8) | s->setup_buf[1];
     value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
@@ -152,13 +159,6 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
         }
         s->setup_state = SETUP_STATE_DATA;
     } else {
-        if (s->setup_len > sizeof(s->data_buf)) {
-            fprintf(stderr,
-                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
-                s->setup_len, sizeof(s->data_buf));
-            p->status = USB_RET_STALL;
-            return;
-        }
         if (s->setup_len == 0)
             s->setup_state = SETUP_STATE_ACK;
         else
@@ -177,7 +177,7 @@ static void do_token_in(USBDevice *s, USBPacket *p)
     request = (s->setup_buf[0] << 8) | s->setup_buf[1];
     value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
     index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
- 
+
     switch(s->setup_state) {
     case SETUP_STATE_ACK:
         if (!(s->setup_buf[0] & USB_DIR_IN)) {
diff --git a/hw/usb/desc.h b/hw/usb/desc.h
index 8e8db03a0c..4d81c68e0e 100644
--- a/hw/usb/desc.h
+++ b/hw/usb/desc.h
@@ -1,7 +1,6 @@
 #ifndef QEMU_HW_USB_DESC_H
 #define QEMU_HW_USB_DESC_H
 
-#include <inttypes.h>
 #include <wchar.h>
 
 /* binary representation */
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 985a6298bf..c6abd38c2a 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -654,7 +654,8 @@ typedef struct USBNetState {
 
 static int is_rndis(USBNetState *s)
 {
-    return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
+    return s->dev.config ?
+            s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
 }
 
 static int ndis_query(USBNetState *s, uint32_t oid,
@@ -915,8 +916,9 @@ static int rndis_query_response(USBNetState *s,
 
     bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
     buflen = le32_to_cpu(buf->InformationBufferLength);
-    if (bufoffs + buflen > length)
+    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
         return USB_RET_STALL;
+    }
 
     infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
                             bufoffs + (uint8_t *) buf, buflen, infobuf,
@@ -961,8 +963,9 @@ static int rndis_set_response(USBNetState *s,
 
     bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
     buflen = le32_to_cpu(buf->InformationBufferLength);
-    if (bufoffs + buflen > length)
+    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
         return USB_RET_STALL;
+    }
 
     ret = ndis_set(s, le32_to_cpu(buf->OID),
                     bufoffs + (uint8_t *) buf, buflen);
@@ -1212,8 +1215,9 @@ static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)
     if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {
         uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
         uint32_t size = le32_to_cpu(msg->DataLength);
-        if (offs + size <= len)
+        if (offs < len && size < len && offs + size <= len) {
             qemu_send_packet(qemu_get_queue(s->nic), s->out_buf + offs, size);
+        }
     }
     s->out_ptr -= len;
     memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
diff --git a/hw/usb/hcd-ohci.c b/hw/usb/hcd-ohci.c
index bed55dda78..17ed4617ef 100644
--- a/hw/usb/hcd-ohci.c
+++ b/hw/usb/hcd-ohci.c
@@ -1347,16 +1347,6 @@ static void ohci_frame_boundary(void *opaque)
  */
 static int ohci_bus_start(OHCIState *ohci)
 {
-    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                    ohci_frame_boundary,
-                    ohci);
-
-    if (ohci->eof_timer == NULL) {
-        trace_usb_ohci_bus_eof_timer_failed(ohci->name);
-        ohci_die(ohci);
-        return 0;
-    }
-
     trace_usb_ohci_start(ohci->name);
 
     /* Delay the first SOF event by one frame time as
@@ -1373,11 +1363,7 @@ static int ohci_bus_start(OHCIState *ohci)
 static void ohci_bus_stop(OHCIState *ohci)
 {
     trace_usb_ohci_stop(ohci->name);
-    if (ohci->eof_timer) {
-        timer_del(ohci->eof_timer);
-        timer_free(ohci->eof_timer);
-    }
-    ohci->eof_timer = NULL;
+    timer_del(ohci->eof_timer);
 }
 
 /* Sets a flag in a port status register but only set it if the port is
@@ -1907,6 +1893,9 @@ static void usb_ohci_init(OHCIState *ohci, DeviceState *dev,
     usb_packet_init(&ohci->usb_packet);
 
     ohci->async_td = 0;
+
+    ohci->eof_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                   ohci_frame_boundary, ohci);
 }
 
 #define TYPE_PCI_OHCI "pci-ohci"
@@ -1976,6 +1965,9 @@ static void usb_ohci_exit(PCIDevice *dev)
     if (!ohci->masterbus) {
         usb_bus_release(&s->bus);
     }
+
+    timer_del(s->eof_timer);
+    timer_free(s->eof_timer);
 }
 
 static void usb_ohci_reset_pci(DeviceState *d)
@@ -2041,23 +2033,13 @@ static bool ohci_eof_timer_needed(void *opaque)
 {
     OHCIState *ohci = opaque;
 
-    return ohci->eof_timer != NULL;
-}
-
-static int ohci_eof_timer_pre_load(void *opaque)
-{
-    OHCIState *ohci = opaque;
-
-    ohci_bus_start(ohci);
-
-    return 0;
+    return timer_pending(ohci->eof_timer);
 }
 
 static const VMStateDescription vmstate_ohci_eof_timer = {
     .name = "ohci-core/eof-timer",
     .version_id = 1,
     .minimum_version_id = 1,
-    .pre_load = ohci_eof_timer_pre_load,
     .needed = ohci_eof_timer_needed,
     .fields = (VMStateField[]) {
         VMSTATE_TIMER_PTR(eof_timer, OHCIState),
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 5ccfb8395a..c370240be2 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -773,8 +773,22 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
     bool spd;
     bool queuing = (q != NULL);
     uint8_t pid = td->token & 0xff;
-    UHCIAsync *async = uhci_async_find_td(s, td_addr);
+    UHCIAsync *async;
+
+    switch (pid) {
+    case USB_TOKEN_OUT:
+    case USB_TOKEN_SETUP:
+    case USB_TOKEN_IN:
+        break;
+    default:
+        /* invalid pid : frame interrupted */
+        s->status |= UHCI_STS_HCPERR;
+        s->cmd &= ~UHCI_CMD_RS;
+        uhci_update_irq(s);
+        return TD_RESULT_STOP_FRAME;
+    }
 
+    async = uhci_async_find_td(s, td_addr);
     if (async) {
         if (uhci_queue_verify(async->queue, qh_addr, td, td_addr, queuing)) {
             assert(q == NULL || q == async->queue);
@@ -880,11 +894,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
         break;
 
     default:
-        /* invalid pid : frame interrupted */
-        uhci_async_free(async);
-        s->status |= UHCI_STS_HCPERR;
-        uhci_update_irq(s);
-        return TD_RESULT_STOP_FRAME;
+        abort(); /* Never to execute */
     }
 
     if (async->packet.status == USB_RET_ASYNC) {
diff --git a/hw/timer/tusb6010.c b/hw/usb/tusb6010.c
index 9f6af90806..9f6af90806 100644
--- a/hw/timer/tusb6010.c
+++ b/hw/usb/tusb6010.c
diff --git a/hw/vfio/amd-xgbe.c b/hw/vfio/amd-xgbe.c
index 53451eb22d..2c60310cf9 100644
--- a/hw/vfio/amd-xgbe.c
+++ b/hw/vfio/amd-xgbe.c
@@ -11,6 +11,7 @@
  *
  */
 
+#include "qemu/osdep.h"
 #include "hw/vfio/vfio-amd-xgbe.h"
 
 static void amd_xgbe_realize(DeviceState *dev, Error **errp)
diff --git a/include/block/accounting.h b/include/block/accounting.h
index 0f46cb4ec1..2db2a009a1 100644
--- a/include/block/accounting.h
+++ b/include/block/accounting.h
@@ -25,8 +25,6 @@
 #ifndef BLOCK_ACCOUNTING_H
 #define BLOCK_ACCOUNTING_H
 
-#include <stdint.h>
-#include <stdbool.h>
 
 #include "qemu/typedefs.h"
 #include "qemu/timed-average.h"
diff --git a/include/block/nbd.h b/include/block/nbd.h
index b197adca1c..b86a976984 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -19,7 +19,6 @@
 #ifndef NBD_H
 #define NBD_H
 
-#include <sys/types.h>
 
 #include "qemu-common.h"
 #include "qemu/option.h"
diff --git a/include/block/snapshot.h b/include/block/snapshot.h
index c6910da63a..e5c0553115 100644
--- a/include/block/snapshot.h
+++ b/include/block/snapshot.h
@@ -26,7 +26,6 @@
 #define SNAPSHOT_H
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qemu/option.h"
 
 
diff --git a/include/block/write-threshold.h b/include/block/write-threshold.h
index f1b899cd5f..8a79505ada 100644
--- a/include/block/write-threshold.h
+++ b/include/block/write-threshold.h
@@ -12,7 +12,6 @@
 #ifndef BLOCK_WRITE_THRESHOLD_H
 #define BLOCK_WRITE_THRESHOLD_H
 
-#include <stdint.h>
 
 #include "qemu/typedefs.h"
 #include "qemu-common.h"
diff --git a/include/config.h b/include/config.h
index e20f78696a..992d761053 100644
--- a/include/config.h
+++ b/include/config.h
@@ -1,2 +1 @@
-#include "config-host.h"
 #include "config-target.h"
diff --git a/include/crypto/cipher.h b/include/crypto/cipher.h
index f90ac79567..c04c3ac9b9 100644
--- a/include/crypto/cipher.h
+++ b/include/crypto/cipher.h
@@ -22,7 +22,6 @@
 #define QCRYPTO_CIPHER_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 typedef struct QCryptoCipher QCryptoCipher;
 
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index 5e8d9a1372..aebccd1386 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -22,7 +22,6 @@
 #define QCRYPTO_HASH_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 /* See also "QCryptoHashAlgorithm" defined in qapi/crypto.json */
 
diff --git a/include/crypto/init.h b/include/crypto/init.h
index 5fc510c4f8..4836a37e3f 100644
--- a/include/crypto/init.h
+++ b/include/crypto/init.h
@@ -22,7 +22,6 @@
 #define QCRYPTO_INIT_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 int qcrypto_init(Error **errp);
 
diff --git a/include/crypto/secret.h b/include/crypto/secret.h
index 913519ae27..60f2a502b7 100644
--- a/include/crypto/secret.h
+++ b/include/crypto/secret.h
@@ -22,7 +22,6 @@
 #define QCRYPTO_SECRET_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #define TYPE_QCRYPTO_SECRET "secret"
diff --git a/include/crypto/tlscreds.h b/include/crypto/tlscreds.h
index 21761b7ce1..4bf1d2e255 100644
--- a/include/crypto/tlscreds.h
+++ b/include/crypto/tlscreds.h
@@ -22,7 +22,6 @@
 #define QCRYPTO_TLSCRED_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #ifdef CONFIG_GNUTLS
diff --git a/include/elf.h b/include/elf.h
index 1098d217ec..28d448bbcc 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -1,7 +1,6 @@
 #ifndef _QEMU_ELF_H
 #define _QEMU_ELF_H
 
-#include <inttypes.h>
 
 /* 32-bit ELF base types. */
 typedef uint32_t Elf32_Addr;
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index 83b1781afc..08e5093d0e 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -154,7 +154,6 @@ static inline void tswap64s(uint64_t *s)
 /* MMU memory access macros */
 
 #if defined(CONFIG_USER_ONLY)
-#include <assert.h>
 #include "exec/user/abitypes.h"
 
 /* On some host systems the guest address space is reserved on the host.
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 5093be26ac..854e7e3566 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -23,9 +23,6 @@
 #error cpu.h included from common code
 #endif
 
-#include "config.h"
-#include <inttypes.h>
-#include "qemu/osdep.h"
 #include "qemu/queue.h"
 #include "tcg-target.h"
 #ifndef CONFIG_USER_ONLY
diff --git a/include/exec/helper-head.h b/include/exec/helper-head.h
index b009ccb11a..ec790432d5 100644
--- a/include/exec/helper-head.h
+++ b/include/exec/helper-head.h
@@ -18,7 +18,6 @@
 #ifndef DEF_HELPER_H
 #define DEF_HELPER_H 1
 
-#include "qemu/osdep.h"
 
 #define HELPER(name) glue(helper_, name)
 
diff --git a/include/exec/memory.h b/include/exec/memory.h
index c92734ae2b..d5f2b2ce6f 100644
--- a/include/exec/memory.h
+++ b/include/exec/memory.h
@@ -21,8 +21,6 @@
 #define DIRTY_MEMORY_MIGRATION 2
 #define DIRTY_MEMORY_NUM       3        /* num of dirty bits */
 
-#include <stdint.h>
-#include <stdbool.h>
 #include "exec/cpu-common.h"
 #ifndef CONFIG_USER_ONLY
 #include "exec/hwaddr.h"
@@ -31,7 +29,6 @@
 #include "qemu/queue.h"
 #include "qemu/int128.h"
 #include "qemu/notify.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 #include "qemu/rcu.h"
 
diff --git a/include/exec/user/thunk.h b/include/exec/user/thunk.h
index 3b67462726..ad1d60266e 100644
--- a/include/exec/user/thunk.h
+++ b/include/exec/user/thunk.h
@@ -19,7 +19,6 @@
 #ifndef THUNK_H
 #define THUNK_H
 
-#include <inttypes.h>
 #include "cpu.h"
 
 /* types enums definitions */
diff --git a/include/fpu/softfloat.h b/include/fpu/softfloat.h
index 624ed61661..c937062530 100644
--- a/include/fpu/softfloat.h
+++ b/include/fpu/softfloat.h
@@ -86,9 +86,6 @@ this code that are retained.
 #include <sunmath.h>
 #endif
 
-#include <inttypes.h>
-#include "config-host.h"
-#include "qemu/osdep.h"
 
 /* This 'flag' type must be able to hold at least 0 and 1. It should
  * probably be replaced with 'bool' but the uses would need to be audited
diff --git a/include/hw/acpi/acpi.h b/include/hw/acpi/acpi.h
index 2de30211f2..7462e20fe3 100644
--- a/include/hw/acpi/acpi.h
+++ b/include/hw/acpi/acpi.h
@@ -19,7 +19,6 @@
  * <http://www.gnu.org/licenses/>.
  */
 
-#include "qapi/error.h"
 #include "qemu/typedefs.h"
 #include "qemu/notify.h"
 #include "qemu/option.h"
diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
index aa29d30d1f..d3e0c8fe87 100644
--- a/include/hw/acpi/aml-build.h
+++ b/include/hw/acpi/aml-build.h
@@ -1,9 +1,7 @@
 #ifndef HW_ACPI_GEN_UTILS_H
 #define HW_ACPI_GEN_UTILS_H
 
-#include <stdint.h>
 #include <glib.h>
-#include "qemu/compiler.h"
 #include "hw/acpi/acpi-defs.h"
 
 /* Reserve RAM space for tables: add another order of magnitude. */
diff --git a/include/hw/acpi/bios-linker-loader.h b/include/hw/acpi/bios-linker-loader.h
index e54b6b4565..82f1af6433 100644
--- a/include/hw/acpi/bios-linker-loader.h
+++ b/include/hw/acpi/bios-linker-loader.h
@@ -2,8 +2,6 @@
 #define BIOS_LINKER_LOADER_H
 
 #include <glib.h>
-#include <stdbool.h>
-#include <inttypes.h>
 
 GArray *bios_linker_loader_init(void);
 
diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
index f3526d4aaf..31b7820b6f 100644
--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
@@ -27,7 +27,6 @@
 #ifndef HW_ACPI_PCIHP_H
 #define HW_ACPI_PCIHP_H
 
-#include <inttypes.h>
 #include <qemu/typedefs.h>
 #include "hw/acpi/acpi.h"
 #include "migration/vmstate.h"
diff --git a/include/hw/block/block.h b/include/hw/block/block.h
index 8d7c4b413f..984660efd6 100644
--- a/include/hw/block/block.h
+++ b/include/hw/block/block.h
@@ -12,7 +12,6 @@
 #define HW_BLOCK_COMMON_H
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 /* Configuration */
 
diff --git a/include/hw/i386/topology.h b/include/hw/i386/topology.h
index 148cc1bbc8..fc95572394 100644
--- a/include/hw/i386/topology.h
+++ b/include/hw/i386/topology.h
@@ -38,8 +38,6 @@
  *  CPUID Fn8000_0008_ECX[ApicIdCoreIdSize[3:0]] is set to apicid_core_width().
  */
 
-#include <stdint.h>
-#include <string.h>
 
 #include "qemu/bitops.h"
 
diff --git a/include/hw/isa/apm.h b/include/hw/isa/apm.h
index 3edea5f623..4839ff1df2 100644
--- a/include/hw/isa/apm.h
+++ b/include/hw/isa/apm.h
@@ -1,7 +1,6 @@
 #ifndef APM_H
 #define APM_H
 
-#include <stdint.h>
 #include "qemu-common.h"
 #include "hw/hw.h"
 #include "exec/memory.h"
diff --git a/include/hw/nvram/fw_cfg.h b/include/hw/nvram/fw_cfg.h
index 664eaf6452..5d19975df5 100644
--- a/include/hw/nvram/fw_cfg.h
+++ b/include/hw/nvram/fw_cfg.h
@@ -2,8 +2,6 @@
 #define FW_CFG_H
 
 #ifndef NO_QEMU_PROTOS
-#include <stdint.h>
-#include <stddef.h>
 
 #include "exec/hwaddr.h"
 #include "qemu/typedefs.h"
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index dedf277627..0be07c8352 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -6,7 +6,6 @@
 #include "hw/qdev.h"
 #include "exec/memory.h"
 #include "sysemu/dma.h"
-#include "qapi/error.h"
 
 /* PCI includes legacy ISA access.  */
 #include "hw/isa/isa.h"
diff --git a/include/hw/pci/shpc.h b/include/hw/pci/shpc.h
index 2c871b947b..b2085543d7 100644
--- a/include/hw/pci/shpc.h
+++ b/include/hw/pci/shpc.h
@@ -4,7 +4,6 @@
 #include "qemu-common.h"
 #include "exec/memory.h"
 #include "migration/vmstate.h"
-#include "qapi/error.h"
 #include "hw/hotplug.h"
 #include "hw/pci/pci.h"
 
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index abcdee852b..c3ff99f975 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -7,7 +7,6 @@
 #include "qemu/bitmap.h"
 #include "qom/object.h"
 #include "hw/irq.h"
-#include "qapi/error.h"
 #include "hw/hotplug.h"
 
 enum {
diff --git a/include/hw/virtio/vhost-backend.h b/include/hw/virtio/vhost-backend.h
index a6e5c97e3a..95fcc96676 100644
--- a/include/hw/virtio/vhost-backend.h
+++ b/include/hw/virtio/vhost-backend.h
@@ -11,7 +11,6 @@
 #ifndef VHOST_BACKEND_H_
 #define VHOST_BACKEND_H_
 
-#include <stdbool.h>
 
 typedef enum VhostBackendType {
     VHOST_BACKEND_TYPE_NONE = 0,
diff --git a/include/hw/xen/xen.h b/include/hw/xen/xen.h
index df334818c1..bf3fe97927 100644
--- a/include/hw/xen/xen.h
+++ b/include/hw/xen/xen.h
@@ -6,7 +6,6 @@
  *   must not depend on any xen headers being present in
  *   /usr/include/xen, so it can be included unconditionally.
  */
-#include <inttypes.h>
 
 #include "hw/irq.h"
 #include "qemu-common.h"
diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h
index 7a3cce0b8c..bd65e67054 100644
--- a/include/hw/xen/xen_common.h
+++ b/include/hw/xen/xen_common.h
@@ -1,10 +1,7 @@
 #ifndef QEMU_HW_XEN_COMMON_H
 #define QEMU_HW_XEN_COMMON_H 1
 
-#include "config-host.h"
 
-#include <stddef.h>
-#include <inttypes.h>
 
 /*
  * If we have new enough libxenctrl then we do not want/need these compat
diff --git a/include/io/channel.h b/include/io/channel.h
index 3e17fe7129..0a1f1ce7fc 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -22,7 +22,6 @@
 #define QIO_CHANNEL_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 #define TYPE_QIO_CHANNEL "qio-channel"
diff --git a/include/io/task.h b/include/io/task.h
index 2418714156..2e69d8a47f 100644
--- a/include/io/task.h
+++ b/include/io/task.h
@@ -22,7 +22,6 @@
 #define QIO_TASK_H__
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qom/object.h"
 
 typedef struct QIOTask QIOTask;
diff --git a/include/libdecnumber/dconfig.h b/include/libdecnumber/dconfig.h
index 2f0455a06a..0f7dccef1f 100644
--- a/include/libdecnumber/dconfig.h
+++ b/include/libdecnumber/dconfig.h
@@ -27,7 +27,6 @@
    Software Foundation, 51 Franklin Street, Fifth Floor, Boston, MA
    02110-1301, USA.  */
 
-#include "config-host.h"
 
 #if defined(HOST_WORDS_BIGENDIAN)
 #define WORDS_BIGENDIAN 1
diff --git a/include/libdecnumber/decContext.h b/include/libdecnumber/decContext.h
index c3e46f405f..01365e2313 100644
--- a/include/libdecnumber/decContext.h
+++ b/include/libdecnumber/decContext.h
@@ -56,9 +56,6 @@
   #define DECCFULLNAME "Decimal Context Descriptor"   /* Verbose name */
   #define DECCAUTHOR   "Mike Cowlishaw"		      /* Who to blame */
 
-  #include <stdint.h>
-  #include <stdio.h>		   /* for printf, etc.		      */
-  #include <signal.h>		   /* for traps			      */
 
   /* Extended flags setting -- set this to 0 to use only IEEE flags   */
   #define DECEXTFLAG 1		   /* 1=enable extended flags	      */
diff --git a/include/libdecnumber/decNumberLocal.h b/include/libdecnumber/decNumberLocal.h
index 71ed77bf21..94fb512923 100644
--- a/include/libdecnumber/decNumberLocal.h
+++ b/include/libdecnumber/decNumberLocal.h
@@ -42,8 +42,6 @@
   #define DECVERSION	"decNumber 3.53" /* Package Version [16 max.] */
   #define DECNLAUTHOR	"Mike Cowlishaw"	      /* Who to blame */
 
-  #include <stdlib.h>	      /* for abs			      */
-  #include <string.h>	      /* for memset, strcpy		      */
   #include "libdecnumber/dconfig.h"
 
   /* Conditional code flag -- set this to match hardware platform     */
diff --git a/include/migration/migration.h b/include/migration/migration.h
index 74684ad929..85b6026d10 100644
--- a/include/migration/migration.h
+++ b/include/migration/migration.h
@@ -18,7 +18,6 @@
 #include "qemu-common.h"
 #include "qemu/thread.h"
 #include "qemu/notify.h"
-#include "qapi/error.h"
 #include "migration/vmstate.h"
 #include "qapi-types.h"
 #include "exec/cpu-common.h"
@@ -159,6 +158,8 @@ struct MigrationState
 
     /* Flag set once the migration has been asked to enter postcopy */
     bool start_postcopy;
+    /* Flag set after postcopy has sent the device state */
+    bool postcopy_after_devices;
 
     /* Flag set once the migration thread is running (and needs joining) */
     bool migration_thread_running;
@@ -212,6 +213,8 @@ bool migration_has_finished(MigrationState *);
 bool migration_has_failed(MigrationState *);
 /* True if outgoing migration has entered postcopy phase */
 bool migration_in_postcopy(MigrationState *);
+/* ...and after the device transmission */
+bool migration_in_postcopy_after_devices(MigrationState *);
 MigrationState *migrate_get_current(void);
 
 void migrate_compress_threads_create(void);
diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index b5d08d217d..3f6b4ed581 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -25,7 +25,6 @@
 #define QEMU_FILE_H 1
 #include "exec/cpu-common.h"
 
-#include <stdint.h>
 
 /* This function writes a chunk of data to a file at the given position.
  * The pos argument can be ignored if the file is only being used for
diff --git a/include/net/checksum.h b/include/net/checksum.h
index 2d7a363d40..7de1acb79a 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -18,7 +18,6 @@
 #ifndef QEMU_NET_CHECKSUM_H
 #define QEMU_NET_CHECKSUM_H
 
-#include <stdint.h>
 struct iovec;
 
 uint32_t net_checksum_add_cont(int len, uint8_t *buf, int seq);
diff --git a/include/net/eth.h b/include/net/eth.h
index 84384febf2..18d0be3b16 100644
--- a/include/net/eth.h
+++ b/include/net/eth.h
@@ -26,8 +26,6 @@
 #ifndef QEMU_ETH_H
 #define QEMU_ETH_H
 
-#include <sys/types.h>
-#include <string.h>
 #include "qemu/bswap.h"
 #include "qemu/iov.h"
 
diff --git a/include/qapi/error.h b/include/qapi/error.h
index e64fe54cf9..02e9dd20a7 100644
--- a/include/qapi/error.h
+++ b/include/qapi/error.h
@@ -115,9 +115,6 @@
 #ifndef ERROR_H
 #define ERROR_H
 
-#include <stdarg.h>
-#include <stdbool.h>
-#include "qemu/compiler.h"
 #include "qapi-types.h"
 
 /*
diff --git a/include/qapi/qmp-event.h b/include/qapi/qmp-event.h
index 8a8ffb5718..40fe3cbc12 100644
--- a/include/qapi/qmp-event.h
+++ b/include/qapi/qmp-event.h
@@ -14,7 +14,6 @@
 #ifndef QMP_EVENT_H
 #define QMP_EVENT_H
 
-#include "qapi/error.h"
 #include "qapi/qmp/qdict.h"
 
 typedef void (*QMPEventFuncEmit)(unsigned event, QDict *dict, Error **errp);
diff --git a/include/qapi/qmp/dispatch.h b/include/qapi/qmp/dispatch.h
index e389697f19..495520994c 100644
--- a/include/qapi/qmp/dispatch.h
+++ b/include/qapi/qmp/dispatch.h
@@ -16,7 +16,6 @@
 
 #include "qapi/qmp/qobject.h"
 #include "qapi/qmp/qdict.h"
-#include "qapi/error.h"
 
 typedef void (QmpCommandFunc)(QDict *, QObject **, Error **);
 
diff --git a/include/qapi/qmp/json-lexer.h b/include/qapi/qmp/json-lexer.h
index cb456d53e5..afee7828cd 100644
--- a/include/qapi/qmp/json-lexer.h
+++ b/include/qapi/qmp/json-lexer.h
@@ -14,7 +14,6 @@
 #ifndef QEMU_JSON_LEXER_H
 #define QEMU_JSON_LEXER_H
 
-#include "glib-compat.h"
 
 typedef enum json_token_type {
     JSON_MIN = 100,
diff --git a/include/qapi/qmp/json-parser.h b/include/qapi/qmp/json-parser.h
index fea89f873a..9987f8ca85 100644
--- a/include/qapi/qmp/json-parser.h
+++ b/include/qapi/qmp/json-parser.h
@@ -16,7 +16,6 @@
 
 #include "qemu-common.h"
 #include "qapi/qmp/qlist.h"
-#include "qapi/error.h"
 
 QObject *json_parser_parse(GQueue *tokens, va_list *ap);
 QObject *json_parser_parse_err(GQueue *tokens, va_list *ap, Error **errp);
diff --git a/include/qapi/qmp/json-streamer.h b/include/qapi/qmp/json-streamer.h
index 09b3d3ec15..00d8a23af8 100644
--- a/include/qapi/qmp/json-streamer.h
+++ b/include/qapi/qmp/json-streamer.h
@@ -14,8 +14,6 @@
 #ifndef QEMU_JSON_STREAMER_H
 #define QEMU_JSON_STREAMER_H
 
-#include <stdint.h>
-#include "glib-compat.h"
 #include "qapi/qmp/json-lexer.h"
 
 typedef struct JSONToken {
diff --git a/include/qapi/qmp/qbool.h b/include/qapi/qmp/qbool.h
index 836d078866..a41111c309 100644
--- a/include/qapi/qmp/qbool.h
+++ b/include/qapi/qmp/qbool.h
@@ -14,7 +14,6 @@
 #ifndef QBOOL_H
 #define QBOOL_H
 
-#include <stdbool.h>
 #include "qapi/qmp/qobject.h"
 
 typedef struct QBool {
diff --git a/include/qapi/qmp/qdict.h b/include/qapi/qmp/qdict.h
index 6c2a0e501e..71b8eb0416 100644
--- a/include/qapi/qmp/qdict.h
+++ b/include/qapi/qmp/qdict.h
@@ -16,8 +16,6 @@
 #include "qapi/qmp/qobject.h"
 #include "qapi/qmp/qlist.h"
 #include "qemu/queue.h"
-#include <stdbool.h>
-#include <stdint.h>
 
 #define QDICT_BUCKET_MAX 512
 
diff --git a/include/qapi/qmp/qfloat.h b/include/qapi/qmp/qfloat.h
index a8af2a89b2..b5d15836b5 100644
--- a/include/qapi/qmp/qfloat.h
+++ b/include/qapi/qmp/qfloat.h
@@ -14,7 +14,6 @@
 #ifndef QFLOAT_H
 #define QFLOAT_H
 
-#include <stdint.h>
 #include "qapi/qmp/qobject.h"
 
 typedef struct QFloat {
diff --git a/include/qapi/qmp/qint.h b/include/qapi/qmp/qint.h
index 049e528079..3aaff768dd 100644
--- a/include/qapi/qmp/qint.h
+++ b/include/qapi/qmp/qint.h
@@ -13,7 +13,6 @@
 #ifndef QINT_H
 #define QINT_H
 
-#include <stdint.h>
 #include "qapi/qmp/qobject.h"
 
 typedef struct QInt {
diff --git a/include/qapi/qmp/qjson.h b/include/qapi/qmp/qjson.h
index ee4d31a46a..02b1f2ce31 100644
--- a/include/qapi/qmp/qjson.h
+++ b/include/qapi/qmp/qjson.h
@@ -14,8 +14,6 @@
 #ifndef QJSON_H
 #define QJSON_H
 
-#include <stdarg.h>
-#include "qemu/compiler.h"
 #include "qapi/qmp/qobject.h"
 #include "qapi/qmp/qstring.h"
 
diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h
index 74459ae14b..b8ddbca405 100644
--- a/include/qapi/qmp/qobject.h
+++ b/include/qapi/qmp/qobject.h
@@ -32,8 +32,6 @@
 #ifndef QOBJECT_H
 #define QOBJECT_H
 
-#include <stddef.h>
-#include <assert.h>
 #include "qapi-types.h"
 
 struct QObject {
diff --git a/include/qapi/qmp/qstring.h b/include/qapi/qmp/qstring.h
index df7df558b2..10076b7c8c 100644
--- a/include/qapi/qmp/qstring.h
+++ b/include/qapi/qmp/qstring.h
@@ -13,7 +13,6 @@
 #ifndef QSTRING_H
 #define QSTRING_H
 
-#include <stdint.h>
 #include "qapi/qmp/qobject.h"
 
 typedef struct QString {
diff --git a/include/qapi/visitor-impl.h b/include/qapi/visitor-impl.h
index 6a1ddfbd9a..2bd8f292b2 100644
--- a/include/qapi/visitor-impl.h
+++ b/include/qapi/visitor-impl.h
@@ -12,7 +12,6 @@
 #ifndef QAPI_VISITOR_IMPL_H
 #define QAPI_VISITOR_IMPL_H
 
-#include "qapi/error.h"
 #include "qapi/visitor.h"
 
 struct Visitor
diff --git a/include/qapi/visitor.h b/include/qapi/visitor.h
index 83cad74c88..1000da2bda 100644
--- a/include/qapi/visitor.h
+++ b/include/qapi/visitor.h
@@ -16,8 +16,6 @@
 
 #include "qemu/typedefs.h"
 #include "qapi/qmp/qobject.h"
-#include "qapi/error.h"
-#include <stdlib.h>
 
 /* This struct is layout-compatible with all other *List structs
  * created by the qapi generator.  It is used as a typical
diff --git a/include/qemu-common.h b/include/qemu-common.h
index f557be78e3..a85e9bf98a 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -12,7 +12,6 @@
 #ifndef QEMU_COMMON_H
 #define QEMU_COMMON_H
 
-#include "qemu/osdep.h"
 #include "qemu/typedefs.h"
 #include "qemu/fprintf-fn.h"
 
diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index 05b447c728..8f1d8d927d 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -15,7 +15,6 @@
 #ifndef __QEMU_ATOMIC_H
 #define __QEMU_ATOMIC_H 1
 
-#include "qemu/compiler.h"
 
 
 /* Compiler barrier */
diff --git a/include/qemu/bitmap.h b/include/qemu/bitmap.h
index 86dd9cd5fc..0e33fa5d9d 100644
--- a/include/qemu/bitmap.h
+++ b/include/qemu/bitmap.h
@@ -13,10 +13,7 @@
 #define BITMAP_H
 
 #include <glib.h>
-#include <string.h>
-#include <stdlib.h>
 
-#include "qemu/osdep.h"
 #include "qemu/bitops.h"
 
 /*
diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index 8164225152..755fdd1293 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -12,8 +12,6 @@
 #ifndef BITOPS_H
 #define BITOPS_H
 
-#include <stdint.h>
-#include <assert.h>
 
 #include "host-utils.h"
 #include "atomic.h"
diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index 07d88de746..95071ba9e8 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -1,15 +1,10 @@
 #ifndef BSWAP_H
 #define BSWAP_H
 
-#include "config-host.h"
-#include <inttypes.h>
-#include <limits.h>
-#include <string.h>
 #include "fpu/softfloat.h"
 
 #ifdef CONFIG_MACHINE_BSWAP_H
 # include <sys/endian.h>
-# include <sys/types.h>
 # include <machine/bswap.h>
 #elif defined(__FreeBSD__)
 # include <sys/endian.h>
diff --git a/include/qemu/compatfd.h b/include/qemu/compatfd.h
index fc3791520f..aa12ee9364 100644
--- a/include/qemu/compatfd.h
+++ b/include/qemu/compatfd.h
@@ -14,7 +14,6 @@
 #ifndef QEMU_COMPATFD_H
 #define QEMU_COMPATFD_H
 
-#include <signal.h>
 
 struct qemu_signalfd_siginfo {
     uint32_t ssi_signo;   /* Signal number */
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index c5fbe28b02..8f1cc7ba67 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -3,7 +3,6 @@
 #ifndef COMPILER_H
 #define COMPILER_H
 
-#include "config-host.h"
 
 /*----------------------------------------------------------------------------
 | The macro QEMU_GNUC_PREREQ tests for minimum version of the GNU C compiler.
diff --git a/include/qemu/config-file.h b/include/qemu/config-file.h
index d4ba20e049..3b8ecb0953 100644
--- a/include/qemu/config-file.h
+++ b/include/qemu/config-file.h
@@ -1,9 +1,7 @@
 #ifndef QEMU_CONFIG_H
 #define QEMU_CONFIG_H
 
-#include <stdio.h>
 #include "qemu/option.h"
-#include "qapi/error.h"
 #include "qapi/qmp/qdict.h"
 
 QemuOptsList *qemu_find_opts(const char *group);
diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index 20c027a7fd..99b939846b 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -15,7 +15,6 @@
 #ifndef QEMU_COROUTINE_H
 #define QEMU_COROUTINE_H
 
-#include <stdbool.h>
 #include "qemu/typedefs.h"
 #include "qemu/queue.h"
 #include "qemu/timer.h"
diff --git a/include/qemu/error-report.h b/include/qemu/error-report.h
index 7ab235590e..7a2a363fb3 100644
--- a/include/qemu/error-report.h
+++ b/include/qemu/error-report.h
@@ -13,9 +13,6 @@
 #ifndef QEMU_ERROR_H
 #define QEMU_ERROR_H
 
-#include <stdarg.h>
-#include <stdbool.h>
-#include "qemu/compiler.h"
 
 typedef struct Location {
     /* all members are private to qemu-error.c */
diff --git a/include/qemu/fprintf-fn.h b/include/qemu/fprintf-fn.h
index 9ddc90f1c5..b6bad35b1b 100644
--- a/include/qemu/fprintf-fn.h
+++ b/include/qemu/fprintf-fn.h
@@ -8,8 +8,6 @@
 #ifndef QEMU_FPRINTF_FN_H
 #define QEMU_FPRINTF_FN_H 1
 
-#include "qemu/compiler.h"
-#include <stdio.h>
 
 typedef int (*fprintf_function)(FILE *f, const char *fmt, ...)
     GCC_FMT_ATTR(2, 3);
diff --git a/include/qemu/hbitmap.h b/include/qemu/hbitmap.h
index bb94a00c5f..e29188c0ad 100644
--- a/include/qemu/hbitmap.h
+++ b/include/qemu/hbitmap.h
@@ -12,9 +12,6 @@
 #ifndef HBITMAP_H
 #define HBITMAP_H 1
 
-#include <limits.h>
-#include <stdint.h>
-#include <stdbool.h>
 #include "bitops.h"
 #include "host-utils.h"
 
diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index 3ef97d503d..1cdae0d0ed 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -25,10 +25,7 @@
 #ifndef HOST_UTILS_H
 #define HOST_UTILS_H 1
 
-#include "qemu/compiler.h"   /* QEMU_GNUC_PREREQ */
 #include "qemu/bswap.h"
-#include <limits.h>
-#include <stdbool.h>
 
 #ifdef CONFIG_INT128
 static inline void mulu64(uint64_t *plow, uint64_t *phigh,
diff --git a/include/qemu/int128.h b/include/qemu/int128.h
index fb782aaddd..c5988813df 100644
--- a/include/qemu/int128.h
+++ b/include/qemu/int128.h
@@ -1,9 +1,6 @@
 #ifndef INT128_H
 #define INT128_H
 
-#include <assert.h>
-#include <stdint.h>
-#include <stdbool.h>
 
 typedef struct Int128 Int128;
 
diff --git a/include/qemu/log.h b/include/qemu/log.h
index 30817f7b42..1afac63760 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -1,10 +1,6 @@
 #ifndef QEMU_LOG_H
 #define QEMU_LOG_H
 
-#include <stdarg.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include "qemu/compiler.h"
 
 /* Private global variables, don't use */
 extern FILE *qemu_logfile;
diff --git a/include/qemu/memfd.h b/include/qemu/memfd.h
index 53858ed43c..745a8c501e 100644
--- a/include/qemu/memfd.h
+++ b/include/qemu/memfd.h
@@ -1,8 +1,6 @@
 #ifndef QEMU_MEMFD_H
 #define QEMU_MEMFD_H
 
-#include "config-host.h"
-#include <stdbool.h>
 
 #ifndef F_LINUX_SPECIFIC_BASE
 #define F_LINUX_SPECIFIC_BASE 1024
diff --git a/include/qemu/module.h b/include/qemu/module.h
index 72d94984a2..85fafa2e79 100644
--- a/include/qemu/module.h
+++ b/include/qemu/module.h
@@ -14,7 +14,6 @@
 #ifndef QEMU_MODULE_H
 #define QEMU_MODULE_H
 
-#include "qemu/osdep.h"
 
 #define DSO_STAMP_FUN         glue(qemu_stamp, CONFIG_STAMP)
 #define DSO_STAMP_FUN_STR     stringify(DSO_STAMP_FUN)
diff --git a/include/qemu/option.h b/include/qemu/option.h
index 71f5f27ec8..8809ce1e75 100644
--- a/include/qemu/option.h
+++ b/include/qemu/option.h
@@ -26,9 +26,7 @@
 #ifndef QEMU_OPTIONS_H
 #define QEMU_OPTIONS_H
 
-#include <stdint.h>
 #include "qemu/queue.h"
-#include "qapi/error.h"
 #include "qapi/qmp/qdict.h"
 #include "qemu/typedefs.h"
 
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 431cf71364..4538fdca42 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -26,8 +26,25 @@
 #define QEMU_OSDEP_H
 
 #include "config-host.h"
+#ifdef NEED_CPU_H
+#include "config-target.h"
+#endif
 #include "qemu/compiler.h"
 
+/* Older versions of C++ don't get definitions of various macros from
+ * stdlib.h unless we define these macros before first inclusion of
+ * that system header.
+ */
+#ifndef __STDC_CONSTANT_MACROS
+#define __STDC_CONSTANT_MACROS
+#endif
+#ifndef __STDC_LIMIT_MACROS
+#define __STDC_LIMIT_MACROS
+#endif
+#ifndef __STDC_FORMAT_MACROS
+#define __STDC_FORMAT_MACROS
+#endif
+
 /* The following block of code temporarily renames the daemon() function so the
  * compiler does not see the warning associated with it in stdlib.h on OSX
  */
diff --git a/include/qemu/range.h b/include/qemu/range.h
index cfa021fd48..9fc547b9cb 100644
--- a/include/qemu/range.h
+++ b/include/qemu/range.h
@@ -1,7 +1,6 @@
 #ifndef QEMU_RANGE_H
 #define QEMU_RANGE_H
 
-#include <inttypes.h>
 #include <qemu/typedefs.h>
 #include "qemu/queue.h"
 
diff --git a/include/qemu/rcu.h b/include/qemu/rcu.h
index 7c7cca7f6f..56d3a682a9 100644
--- a/include/qemu/rcu.h
+++ b/include/qemu/rcu.h
@@ -23,15 +23,8 @@
  * IBM's contributions to this file may be relicensed under LGPLv2 or later.
  */
 
-#include <stdlib.h>
-#include <assert.h>
-#include <limits.h>
-#include <unistd.h>
-#include <stdint.h>
-#include <stdbool.h>
 #include <glib.h>
 
-#include "qemu/compiler.h"
 #include "qemu/thread.h"
 #include "qemu/queue.h"
 #include "qemu/atomic.h"
diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index cde2f5e0d6..0be68de87d 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -13,7 +13,6 @@ int inet_aton(const char *cp, struct in_addr *ia);
 
 #else
 
-#include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
@@ -26,7 +25,6 @@ int inet_aton(const char *cp, struct in_addr *ia);
 
 #endif /* !_WIN32 */
 
-#include "qapi/error.h"
 #include "qapi-types.h"
 
 /* misc helpers */
diff --git a/include/qemu/thread.h b/include/qemu/thread.h
index 5114ec8e79..bdae6dfdbe 100644
--- a/include/qemu/thread.h
+++ b/include/qemu/thread.h
@@ -1,8 +1,6 @@
 #ifndef __QEMU_THREAD_H
 #define __QEMU_THREAD_H 1
 
-#include <inttypes.h>
-#include <stdbool.h>
 
 typedef struct QemuMutex QemuMutex;
 typedef struct QemuCond QemuCond;
diff --git a/include/qemu/throttle.h b/include/qemu/throttle.h
index 63df69070a..9109657609 100644
--- a/include/qemu/throttle.h
+++ b/include/qemu/throttle.h
@@ -25,7 +25,6 @@
 #ifndef THROTTLE_H
 #define THROTTLE_H
 
-#include <stdint.h>
 #include "qemu-common.h"
 #include "qemu/timer.h"
 
diff --git a/include/qemu/timed-average.h b/include/qemu/timed-average.h
index 364bf88f70..08245e7a10 100644
--- a/include/qemu/timed-average.h
+++ b/include/qemu/timed-average.h
@@ -25,7 +25,6 @@
 #ifndef TIMED_AVERAGE_H
 #define TIMED_AVERAGE_H
 
-#include <stdint.h>
 
 #include "qemu/timer.h"
 
diff --git a/include/qemu/xattr.h b/include/qemu/xattr.h
index f910d96eaf..83cf98cbd8 100644
--- a/include/qemu/xattr.h
+++ b/include/qemu/xattr.h
@@ -18,7 +18,6 @@
  * in /usr/include/sys, and don't have ENOATTR.
  */
 
-#include "config-host.h"
 
 #ifdef CONFIG_LIBATTR
 #  include <attr/xattr.h>
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index ff54600e71..1df7cb4073 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -20,7 +20,6 @@
 #ifndef QEMU_CPU_H
 #define QEMU_CPU_H
 
-#include <signal.h>
 #include <setjmp.h>
 #include "hw/qdev-core.h"
 #include "disas/bfd.h"
diff --git a/include/qom/object.h b/include/qom/object.h
index 33abce930b..eda16df005 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -15,11 +15,8 @@
 #define QEMU_OBJECT_H
 
 #include <glib.h>
-#include <stdint.h>
-#include <stdbool.h>
 #include "qemu/queue.h"
 #include "qemu/typedefs.h"
-#include "qapi/error.h"
 
 struct TypeImpl;
 typedef struct TypeImpl *Type;
diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
index ec303316bb..66c5cf22e1 100644
--- a/include/sysemu/block-backend.h
+++ b/include/sysemu/block-backend.h
@@ -14,7 +14,6 @@
 #define BLOCK_BACKEND_H
 
 #include "qemu/typedefs.h"
-#include "qapi/error.h"
 
 /*
  * TODO Have to include block/block.h for a bunch of block layer
diff --git a/include/sysemu/blockdev.h b/include/sysemu/blockdev.h
index b06a0607a9..16432f3508 100644
--- a/include/sysemu/blockdev.h
+++ b/include/sysemu/blockdev.h
@@ -11,7 +11,6 @@
 #define BLOCKDEV_H
 
 #include "block/block.h"
-#include "qapi/error.h"
 #include "qemu/queue.h"
 
 void blockdev_mark_auto_del(BlockBackend *blk);
diff --git a/include/sysemu/dma.h b/include/sysemu/dma.h
index efa8b9993a..b0fbb9bb35 100644
--- a/include/sysemu/dma.h
+++ b/include/sysemu/dma.h
@@ -10,7 +10,6 @@
 #ifndef DMA_H
 #define DMA_H
 
-#include <stdio.h>
 #include "exec/memory.h"
 #include "exec/address-spaces.h"
 #include "hw/hw.h"
diff --git a/include/sysemu/hostmem.h b/include/sysemu/hostmem.h
index 1ce439415d..a19801d20b 100644
--- a/include/sysemu/hostmem.h
+++ b/include/sysemu/hostmem.h
@@ -14,7 +14,6 @@
 
 #include "sysemu/sysemu.h" /* for MAX_NODES */
 #include "qom/object.h"
-#include "qapi/error.h"
 #include "exec/memory.h"
 #include "qemu/option.h"
 #include "qemu/bitmap.h"
diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index 7741f91f9c..6695fa7cfd 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -14,8 +14,6 @@
 #ifndef QEMU_KVM_H
 #define QEMU_KVM_H
 
-#include <errno.h>
-#include "config-host.h"
 #include "qemu/queue.h"
 #include "qom/cpu.h"
 #include "exec/memattrs.h"
diff --git a/include/sysemu/numa.h b/include/sysemu/numa.h
index a6392bc50f..bb184c9cfe 100644
--- a/include/sysemu/numa.h
+++ b/include/sysemu/numa.h
@@ -1,7 +1,6 @@
 #ifndef SYSEMU_NUMA_H
 #define SYSEMU_NUMA_H
 
-#include <stdint.h>
 #include "qemu/bitmap.h"
 #include "qemu/option.h"
 #include "sysemu/sysemu.h"
diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
index f1315213f1..5b9c4d6143 100644
--- a/include/sysemu/os-posix.h
+++ b/include/sysemu/os-posix.h
@@ -26,7 +26,6 @@
 #ifndef QEMU_OS_POSIX_H
 #define QEMU_OS_POSIX_H
 
-#include <sys/time.h>
 
 void os_set_line_buffering(void);
 void os_set_proc_name(const char *s);
diff --git a/include/sysemu/qtest.h b/include/sysemu/qtest.h
index 05473b75a5..70aa40aa72 100644
--- a/include/sysemu/qtest.h
+++ b/include/sysemu/qtest.h
@@ -15,7 +15,6 @@
 #define QTEST_H
 
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 extern bool qtest_allowed;
 
diff --git a/include/sysemu/replay.h b/include/sysemu/replay.h
index abb4688200..e4108e8b1a 100644
--- a/include/sysemu/replay.h
+++ b/include/sysemu/replay.h
@@ -12,10 +12,7 @@
  *
  */
 
-#include <stdbool.h>
-#include <stdint.h>
 #include "qapi-types.h"
-#include "qapi/error.h"
 #include "qemu/typedefs.h"
 
 /* replay clock kinds */
diff --git a/include/sysemu/rng.h b/include/sysemu/rng.h
index 0a27c9b88c..858be8cef4 100644
--- a/include/sysemu/rng.h
+++ b/include/sysemu/rng.h
@@ -15,7 +15,6 @@
 
 #include "qom/object.h"
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 #define TYPE_RNG_BACKEND "rng-backend"
 #define RNG_BACKEND(obj) \
diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h
index 1189fa241d..cfc06008cb 100644
--- a/include/sysemu/seccomp.h
+++ b/include/sysemu/seccomp.h
@@ -16,7 +16,6 @@
 #define QEMU_SECCOMP_H
 
 #include <seccomp.h>
-#include "qemu/osdep.h"
 
 int seccomp_start(void);
 #endif
diff --git a/include/sysemu/tpm_backend.h b/include/sysemu/tpm_backend.h
index 0a366be0f2..e3ec80020f 100644
--- a/include/sysemu/tpm_backend.h
+++ b/include/sysemu/tpm_backend.h
@@ -15,7 +15,6 @@
 
 #include "qom/object.h"
 #include "qemu-common.h"
-#include "qapi/error.h"
 #include "qapi-types.h"
 #include "qemu/option.h"
 #include "sysemu/tpm.h"
diff --git a/include/sysemu/xen-mapcache.h b/include/sysemu/xen-mapcache.h
index c59804060b..c849489fb2 100644
--- a/include/sysemu/xen-mapcache.h
+++ b/include/sysemu/xen-mapcache.h
@@ -9,7 +9,6 @@
 #ifndef XEN_MAPCACHE_H
 #define XEN_MAPCACHE_H
 
-#include <stdlib.h>
 
 typedef hwaddr (*phys_offset_to_gaddr_t)(hwaddr start_addr,
                                                      ram_addr_t size,
diff --git a/include/ui/console.h b/include/ui/console.h
index c8f9f7e65e..6631b9690a 100644
--- a/include/ui/console.h
+++ b/include/ui/console.h
@@ -7,7 +7,6 @@
 #include "qemu/notify.h"
 #include "qemu/typedefs.h"
 #include "qapi-types.h"
-#include "qapi/error.h"
 
 #ifdef CONFIG_OPENGL
 # include <epoxy/gl.h>
diff --git a/include/ui/egl-helpers.h b/include/ui/egl-helpers.h
index 8c84398001..03fcf4bba2 100644
--- a/include/ui/egl-helpers.h
+++ b/include/ui/egl-helpers.h
@@ -3,10 +3,23 @@
 
 #include <epoxy/gl.h>
 #include <epoxy/egl.h>
+#include <gbm.h>
 
 extern EGLDisplay *qemu_egl_display;
 extern EGLConfig qemu_egl_config;
 
+#ifdef CONFIG_OPENGL_DMABUF
+
+extern int qemu_egl_rn_fd;
+extern struct gbm_device *qemu_egl_rn_gbm_dev;
+extern EGLContext qemu_egl_rn_ctx;
+
+int qemu_egl_rendernode_open(void);
+int egl_rendernode_init(void);
+int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc);
+
+#endif
+
 EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, Window win);
 
 int qemu_egl_init_dpy(EGLNativeDisplayType dpy, bool gles, bool debug);
diff --git a/include/ui/qemu-spice.h b/include/ui/qemu-spice.h
index f9ce357ff3..2dabe49f41 100644
--- a/include/ui/qemu-spice.h
+++ b/include/ui/qemu-spice.h
@@ -18,7 +18,6 @@
 #ifndef QEMU_SPICE_H
 #define QEMU_SPICE_H
 
-#include "config-host.h"
 
 #ifdef CONFIG_SPICE
 
diff --git a/include/ui/spice-display.h b/include/ui/spice-display.h
index b25328a6ba..69a222b543 100644
--- a/include/ui/spice-display.h
+++ b/include/ui/spice-display.h
@@ -24,6 +24,14 @@
 #include "ui/console.h"
 #include "sysemu/sysemu.h"
 
+#if defined(CONFIG_OPENGL_DMABUF)
+# if SPICE_SERVER_VERSION >= 0x000d00 /* release 0.13.0 */
+#  define HAVE_SPICE_GL 1
+#  include "ui/egl-helpers.h"
+#  include "ui/egl-context.h"
+# endif
+#endif
+
 #define NUM_MEMSLOTS 8
 #define MEMSLOT_GENERATION_BITS 8
 #define MEMSLOT_SLOT_BITS 8
@@ -50,6 +58,7 @@ enum {
     QXL_COOKIE_TYPE_IO,
     QXL_COOKIE_TYPE_RENDER_UPDATE_AREA,
     QXL_COOKIE_TYPE_POST_LOAD_MONITORS_CONFIG,
+    QXL_COOKIE_TYPE_GL_DRAW_DONE,
 };
 
 typedef struct QXLCookie {
@@ -104,6 +113,13 @@ struct SimpleSpiceDisplay {
     QEMUCursor *cursor;
     int mouse_x, mouse_y;
     QEMUBH *cursor_bh;
+
+#ifdef HAVE_SPICE_GL
+    /* opengl rendering */
+    QEMUBH *gl_unblock_bh;
+    QEMUTimer *gl_unblock_timer;
+    int dmabuf_fd;
+#endif
 };
 
 struct SimpleSpiceUpdate {
diff --git a/io/channel-util.c b/io/channel-util.c
index f96907cb5c..0fb4bd0837 100644
--- a/io/channel-util.c
+++ b/io/channel-util.c
@@ -18,6 +18,7 @@
  *
  */
 
+#include "qemu/osdep.h"
 #include "io/channel-util.h"
 #include "io/channel-file.h"
 #include "io/channel-socket.h"
diff --git a/linux-user/aarch64/syscall_nr.h b/linux-user/aarch64/syscall_nr.h
index 74f42758fb..59511d855d 100644
--- a/linux-user/aarch64/syscall_nr.h
+++ b/linux-user/aarch64/syscall_nr.h
@@ -262,7 +262,6 @@
 #define TARGET_NR_process_vm_writev 271
 #define TARGET_NR_kcmp 272
 #define TARGET_NR_finit_module 273
-
 #define TARGET_NR_sched_setattr 274
 #define TARGET_NR_sched_getattr 275
 #define TARGET_NR_renameat2 276
@@ -274,63 +273,5 @@
 #define TARGET_NR_userfaultfd 282
 #define TARGET_NR_membarrier 283
 #define TARGET_NR_mlock2 284
+#define TARGET_NR_copy_file_range 285
 
-#define TARGET_NR_open 1024
-#define TARGET_NR_link 1025
-#define TARGET_NR_unlink 1026
-#define TARGET_NR_mknod 1027
-#define TARGET_NR_chmod 1028
-#define TARGET_NR_chown 1029
-#define TARGET_NR_mkdir 1030
-#define TARGET_NR_rmdir 1031
-#define TARGET_NR_lchown 1032
-#define TARGET_NR_access 1033
-#define TARGET_NR_rename 1034
-#define TARGET_NR_readlink 1035
-#define TARGET_NR_symlink 1036
-#define TARGET_NR_utimes 1037
-#define TARGET_NR_stat 1038
-#define TARGET_NR_lstat 1039
-#define TARGET_NR_pipe 1040
-#define TARGET_NR_dup2 1041
-#define TARGET_NR_epoll_create 1042
-#define TARGET_NR_inotify_init 1043
-#define TARGET_NR_eventfd 1044
-#define TARGET_NR_signalfd 1045
-#define TARGET_NR_sendfile64 1046
-#define TARGET_NR_ftruncate64 1047
-#define TARGET_NR_truncate64 1048
-#define TARGET_NR_stat64 1049
-#define TARGET_NR_lstat64 1050
-#define TARGET_NR_fstat64 1051
-#define TARGET_NR_fcntl64 1052
-/* #define TARGET_NR_fadvise64 1053 */
-#define TARGET_NR_newfstatat 1054
-#define TARGET_NR_fstatfs64 1055
-#define TARGET_NR_statfs64 1056
-#define TARGET_NR_lseek64 1057
-#define TARGET_NR_mmap64 1058
-#define TARGET_NR_alarm 1059
-#define TARGET_NR_getpgrp 1060
-#define TARGET_NR_pause 1061
-#define TARGET_NR_time 1062
-#define TARGET_NR_utime 1063
-#define TARGET_NR_creat 1064
-#define TARGET_NR_getdents 1065
-#define TARGET_NR_futimesat 1066
-#define TARGET_NR_select 1067
-#define TARGET_NR_poll 1068
-#define TARGET_NR_epoll_wait 1069
-#define TARGET_NR_ustat 1070
-#define TARGET_NR_vfork 1071
-#define TARGET_NR_oldwait4 1072
-#define TARGET_NR_recv 1073
-#define TARGET_NR_send 1074
-#define TARGET_NR_bdflush 1075
-#define TARGET_NR_umount 1076
-#define TARGET_NR_uselib 1077
-#define TARGET_NR__sysctl 1078
-#define TARGET_NR_fork 1079
-#define TARGET_NR_syscalls (__NR_fork+1)
-
-#define TARGET_NR_sigreturn 1999
diff --git a/linux-user/aarch64/syscall.h b/linux-user/aarch64/target_syscall.h
index dc72a15c5e..f458018048 100644
--- a/linux-user/aarch64/syscall.h
+++ b/linux-user/aarch64/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 struct target_pt_regs {
     uint64_t        regs[31];
     uint64_t        sp;
@@ -11,3 +14,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ       2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/alpha/syscall_nr.h b/linux-user/alpha/syscall_nr.h
index dde8d5c6ad..00e14bb6b3 100644
--- a/linux-user/alpha/syscall_nr.h
+++ b/linux-user/alpha/syscall_nr.h
@@ -444,3 +444,9 @@
 #define TARGET_NR_process_vm_writev             505
 #define TARGET_NR_kcmp                          506
 #define TARGET_NR_finit_module                  507
+#define TARGET_NR_sched_setattr                 508
+#define TARGET_NR_sched_getattr                 509
+#define TARGET_NR_renameat2                     510
+#define TARGET_NR_getrandom                     511
+#define TARGET_NR_memfd_create                  512
+#define TARGET_NR_execveat                      513
diff --git a/linux-user/alpha/syscall.h b/linux-user/alpha/target_syscall.h
index 245cff2545..3db4b16f6b 100644
--- a/linux-user/alpha/syscall.h
+++ b/linux-user/alpha/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 /* default linux values for the selectors */
 #define __USER_DS	(1)
 
@@ -255,3 +258,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ              4096
 #define TARGET_MLOCKALL_MCL_CURRENT     0x2000
 #define TARGET_MLOCKALL_MCL_FUTURE      0x4000
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/arm/nwfpe/fpa11.h b/linux-user/arm/nwfpe/fpa11.h
index bb9ac6554e..7e114eee8a 100644
--- a/linux-user/arm/nwfpe/fpa11.h
+++ b/linux-user/arm/nwfpe/fpa11.h
@@ -21,9 +21,6 @@
 #ifndef __FPA11_H__
 #define __FPA11_H__
 
-#include <stdlib.h>
-#include <stdio.h>
-#include <errno.h>
 
 #include <cpu.h>
 
diff --git a/linux-user/arm/syscall.h b/linux-user/arm/target_syscall.h
index 3844a96112..ea863db0b9 100644
--- a/linux-user/arm/syscall.h
+++ b/linux-user/arm/target_syscall.h
@@ -1,3 +1,5 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
 
 /* this struct defines the way the registers are stored on the
    stack during a system call. */
@@ -48,3 +50,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/cris/syscall_nr.h b/linux-user/cris/syscall_nr.h
index 694bd02fa5..44f0b645b4 100644
--- a/linux-user/cris/syscall_nr.h
+++ b/linux-user/cris/syscall_nr.h
@@ -336,3 +336,27 @@
 #define TARGET_NR_preadv             333
 #define TARGET_NR_pwritev            334
 #define TARGET_NR_setns              335
+#define TARGET_NR_name_to_handle_at  336
+#define TARGET_NR_open_by_handle_at  337
+#define TARGET_NR_rt_tgsigqueueinfo  338
+#define TARGET_NR_perf_event_open    339
+#define TARGET_NR_recvmmsg           340
+#define TARGET_NR_accept4            341
+#define TARGET_NR_fanotify_init      342
+#define TARGET_NR_fanotify_mark      343
+#define TARGET_NR_prlimit64          344
+#define TARGET_NR_clock_adjtime      345
+#define TARGET_NR_syncfs             346
+#define TARGET_NR_sendmmsg           347
+#define TARGET_NR_process_vm_readv   348
+#define TARGET_NR_process_vm_writev  349
+#define TARGET_NR_kcmp               350
+#define TARGET_NR_finit_module       351
+#define TARGET_NR_sched_setattr      352
+#define TARGET_NR_sched_getattr      353
+#define TARGET_NR_renameat2          354
+#define TARGET_NR_seccomp            355
+#define TARGET_NR_getrandom          356
+#define TARGET_NR_memfd_create       357
+#define TARGET_NR_bpf                358
+#define TARGET_NR_execveat           359
diff --git a/linux-user/cris/syscall.h b/linux-user/cris/target_syscall.h
index 2957b0d6ae..2957b0d6ae 100644
--- a/linux-user/cris/syscall.h
+++ b/linux-user/cris/target_syscall.h
diff --git a/linux-user/i386/syscall_nr.h b/linux-user/i386/syscall_nr.h
index c8f7302194..bc1bc233ed 100644
--- a/linux-user/i386/syscall_nr.h
+++ b/linux-user/i386/syscall_nr.h
@@ -324,7 +324,7 @@
 #define TARGET_NR_epoll_pwait	319
 #define TARGET_NR_utimensat		320
 #define TARGET_NR_signalfd		321
-#define TARGET_NR_timerfd		322
+#define TARGET_NR_timerfd_create	322
 #define TARGET_NR_eventfd		323
 #define TARGET_NR_fallocate		324
 #define TARGET_NR_timerfd_settime	325
@@ -353,3 +353,30 @@
 #define TARGET_NR_process_vm_writev     348
 #define TARGET_NR_kcmp                  349
 #define TARGET_NR_finit_module          350
+#define TARGET_NR_sched_setattr         351
+#define TARGET_NR_sched_getattr         352
+#define TARGET_NR_renameat2             353
+#define TARGET_NR_seccomp               354
+#define TARGET_NR_getrandom             355
+#define TARGET_NR_memfd_create          356
+#define TARGET_NR_bpf                   357
+#define TARGET_NR_execveat              358
+#define TARGET_NR_socket                359
+#define TARGET_NR_socketpair            360
+#define TARGET_NR_bind                  361
+#define TARGET_NR_connect               362
+#define TARGET_NR_listen                363
+#define TARGET_NR_accept4               364
+#define TARGET_NR_getsockopt            365
+#define TARGET_NR_setsockopt            366
+#define TARGET_NR_getsockname           367
+#define TARGET_NR_getpeername           368
+#define TARGET_NR_sendto                369
+#define TARGET_NR_sendmsg               370
+#define TARGET_NR_recvfrom              371
+#define TARGET_NR_recvmsg               372
+#define TARGET_NR_shutdown              373
+#define TARGET_NR_userfaultfd           374
+#define TARGET_NR_membarrier            375
+#define TARGET_NR_mlock2                376
+#define TARGET_NR_copy_file_range       377
diff --git a/linux-user/i386/syscall.h b/linux-user/i386/target_syscall.h
index 906aaac0b1..0ac84dc02f 100644
--- a/linux-user/i386/syscall.h
+++ b/linux-user/i386/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 /* default linux values for the selectors */
 #define __USER_CS	(0x23)
 #define __USER_DS	(0x2B)
@@ -150,3 +153,5 @@ struct target_vm86plus_struct {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/m68k/syscall_nr.h b/linux-user/m68k/syscall_nr.h
index a2daba034a..4b50fb29b6 100644
--- a/linux-user/m68k/syscall_nr.h
+++ b/linux-user/m68k/syscall_nr.h
@@ -317,7 +317,7 @@
 #define TARGET_NR_epoll_pwait	315
 #define TARGET_NR_utimensat		316
 #define TARGET_NR_signalfd		317
-#define TARGET_NR_timerfd		318
+#define TARGET_NR_timerfd_create	318
 #define TARGET_NR_eventfd		319
 #define TARGET_NR_fallocate		320
 #define TARGET_NR_timerfd_settime	321
diff --git a/linux-user/m68k/syscall.h b/linux-user/m68k/target_syscall.h
index 9218493a44..97a4cc0cbd 100644
--- a/linux-user/m68k/syscall.h
+++ b/linux-user/m68k/target_syscall.h
@@ -1,3 +1,5 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
 
 /* this struct defines the way the registers are stored on the
    stack during a system call. */
@@ -23,3 +25,5 @@ struct target_pt_regs {
 #define TARGET_MLOCKALL_MCL_FUTURE  2
 
 void do_m68k_simcall(CPUM68KState *, int);
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/main.c b/linux-user/main.c
index e719a2da02..2a692e0f0b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -4160,7 +4160,7 @@ int main(int argc, char **argv, char **envp)
         cpu_model = "or1200";
 #elif defined(TARGET_PPC)
 # ifdef TARGET_PPC64
-        cpu_model = "POWER7";
+        cpu_model = "POWER8";
 # else
         cpu_model = "750";
 # endif
diff --git a/linux-user/microblaze/syscall_nr.h b/linux-user/microblaze/syscall_nr.h
index 6f530f9d1e..0704449bae 100644
--- a/linux-user/microblaze/syscall_nr.h
+++ b/linux-user/microblaze/syscall_nr.h
@@ -382,3 +382,11 @@
 #define TARGET_NR_process_vm_writev     378
 #define TARGET_NR_kcmp                  379
 #define TARGET_NR_finit_module          380
+#define TARGET_NR_sched_setattr         381
+#define TARGET_NR_sched_getattr         382
+#define TARGET_NR_renameat2             383
+#define TARGET_NR_seccomp               384
+#define TARGET_NR_getrandom             385
+#define TARGET_NR_memfd_create          386
+#define TARGET_NR_bpf                   387
+#define TARGET_NR_execveat              388
diff --git a/linux-user/microblaze/syscall.h b/linux-user/microblaze/target_syscall.h
index 3c1ed27c04..3c1ed27c04 100644
--- a/linux-user/microblaze/syscall.h
+++ b/linux-user/microblaze/target_syscall.h
diff --git a/linux-user/mips/syscall.h b/linux-user/mips/target_syscall.h
index 35ca23b166..68db160e53 100644
--- a/linux-user/mips/syscall.h
+++ b/linux-user/mips/target_syscall.h
@@ -1,3 +1,5 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
 
 /* this struct defines the way the registers are stored on the
    stack during a system call. */
@@ -231,3 +233,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/mips64/syscall_nr.h b/linux-user/mips64/syscall_nr.h
index 004232a8a2..746cc267e9 100644
--- a/linux-user/mips64/syscall_nr.h
+++ b/linux-user/mips64/syscall_nr.h
@@ -316,6 +316,18 @@
 #define TARGET_NR_process_vm_writev     (TARGET_NR_Linux + 310)
 #define TARGET_NR_kcmp                  (TARGET_NR_Linux + 311)
 #define TARGET_NR_finit_module          (TARGET_NR_Linux + 312)
+#define TARGET_NR_sched_setattr         (TARGET_NR_Linux + 313)
+#define TARGET_NR_sched_getattr         (TARGET_NR_Linux + 314)
+#define TARGET_NR_renameat2             (TARGET_NR_Linux + 315)
+#define TARGET_NR_seccomp               (TARGET_NR_Linux + 316)
+#define TARGET_NR_getrandom             (TARGET_NR_Linux + 317)
+#define TARGET_NR_memfd_create          (TARGET_NR_Linux + 318)
+#define TARGET_NR_bpf                   (TARGET_NR_Linux + 319)
+#define TARGET_NR_execveat              (TARGET_NR_Linux + 320)
+#define TARGET_NR_userfaultfd           (TARGET_NR_Linux + 321)
+#define TARGET_NR_membarrier            (TARGET_NR_Linux + 322)
+#define TARGET_NR_mlock2                (TARGET_NR_Linux + 323)
+
 #else
 /*
  * Linux 64-bit syscalls are in the range from 5000 to 5999.
@@ -630,4 +642,15 @@
 #define TARGET_NR_kcmp                  (TARGET_NR_Linux + 306)
 #define TARGET_NR_finit_module          (TARGET_NR_Linux + 307)
 #define TARGET_NR_getdents64            (TARGET_NR_Linux + 308)
+#define TARGET_NR_sched_setattr         (TARGET_NR_Linux + 309)
+#define TARGET_NR_sched_getattr         (TARGET_NR_Linux + 310)
+#define TARGET_NR_renameat2             (TARGET_NR_Linux + 311)
+#define TARGET_NR_seccomp               (TARGET_NR_Linux + 312)
+#define TARGET_NR_getrandom             (TARGET_NR_Linux + 313)
+#define TARGET_NR_memfd_create          (TARGET_NR_Linux + 314)
+#define TARGET_NR_bpf                   (TARGET_NR_Linux + 315)
+#define TARGET_NR_execveat              (TARGET_NR_Linux + 316)
+#define TARGET_NR_userfaultfd           (TARGET_NR_Linux + 317)
+#define TARGET_NR_membarrier            (TARGET_NR_Linux + 318)
+#define TARGET_NR_mlock2                (TARGET_NR_Linux + 319)
 #endif
diff --git a/linux-user/mips64/syscall.h b/linux-user/mips64/target_syscall.h
index 6733107ddb..0e0c2d232f 100644
--- a/linux-user/mips64/syscall.h
+++ b/linux-user/mips64/target_syscall.h
@@ -1,3 +1,5 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
 
 /* this struct defines the way the registers are stored on the
    stack during a system call. */
@@ -228,3 +230,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ      2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/openrisc/syscall_nr.h b/linux-user/openrisc/syscall_nr.h
index 4c386eae98..6b1c7d265e 100644
--- a/linux-user/openrisc/syscall_nr.h
+++ b/linux-user/openrisc/syscall_nr.h
@@ -382,9 +382,18 @@
 #define TARGET_NR_process_vm_writev 271
 #define TARGET_NR_kcmp 272
 #define TARGET_NR_finit_module 273
-
-#undef TARGET_NR_syscalls
-#define TARGET_NR_syscalls 274
+#define TARGET_NR_sched_setattr 274
+#define TARGET_NR_sched_getattr 275
+#define TARGET_NR_renameat2 276
+#define TARGET_NR_seccomp 277
+#define TARGET_NR_getrandom 278
+#define TARGET_NR_memfd_create 279
+#define TARGET_NR_bpf 280
+#define TARGET_NR_execveat 281
+#define TARGET_NR_userfaultfd 282
+#define TARGET_NR_membarrier 283
+#define TARGET_NR_mlock2 284
+#define TARGET_NR_copy_file_range 285
 
 /*
  * All syscalls below here should go away really,
@@ -411,9 +420,6 @@
 #define TARGET_NR_3264_stat 1038
 #define TARGET_NR_3264_lstat 1039
 
-#undef TARGET_NR_syscalls
-#define TARGET_NR_syscalls (TARGET_NR_3264_lstat+1)
-
 #define TARGET_NR_pipe 1040
 #define TARGET_NR_dup2 1041
 #define TARGET_NR_epoll_create 1042
@@ -421,10 +427,6 @@
 #define TARGET_NR_eventfd 1044
 #define TARGET_NR_signalfd 1045
 
-#undef TARGET_NR_syscalls
-#define TARGET_NR_syscalls (TARGET_NR_signalfd+1)
-
-
 #define TARGET_NR_sendfile 1046
 #define TARGET_NR_ftruncate 1047
 #define TARGET_NR_truncate 1048
@@ -441,9 +443,6 @@
 #define TARGET_NR_lseek 1057
 #define TARGET_NR_mmap 1058
 
-#undef TARGET_NR_syscalls
-#define TARGET_NR_syscalls (TARGET_NR_mmap+1)
-
 #define TARGET_NR_alarm 1059
 #define __ARCH_WANT_SYS_ALARM
 #define TARGET_NR_getpgrp 1060
@@ -477,9 +476,6 @@
 
 #define TARGET_NR_fork 1079
 
-#undef TARGET_NR_syscalls
-#define TARGET_NR_syscalls (TARGET_NR_fork+1)
-
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-user/openrisc/syscall.h b/linux-user/openrisc/target_syscall.h
index 8ac03656d4..19aeffc95d 100644
--- a/linux-user/openrisc/syscall.h
+++ b/linux-user/openrisc/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 struct target_pt_regs {
     union {
         struct {
@@ -27,3 +30,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/ppc/syscall_nr.h b/linux-user/ppc/syscall_nr.h
index 1e1736e11d..46ed8a68ce 100644
--- a/linux-user/ppc/syscall_nr.h
+++ b/linux-user/ppc/syscall_nr.h
@@ -319,7 +319,7 @@
 #define TARGET_NR_epoll_pwait	303
 #define TARGET_NR_utimensat		304
 #define TARGET_NR_signalfd		305
-#define TARGET_NR_timerfd		306
+#define TARGET_NR_timerfd_create	306
 #define TARGET_NR_eventfd		307
 #define TARGET_NR_sync_file_range2	308
 #define TARGET_NR_fallocate		309
@@ -368,3 +368,27 @@
 #define TARGET_NR_process_vm_writev     352
 #define TARGET_NR_finit_module          353
 #define TARGET_NR_kcmp                  354
+#define TARGET_NR_sched_setattr         355
+#define TARGET_NR_sched_getattr         356
+#define TARGET_NR_renameat2             357
+#define TARGET_NR_seccomp               358
+#define TARGET_NR_getrandom             359
+#define TARGET_NR_memfd_create          360
+#define TARGET_NR_bpf                   361
+#define TARGET_NR_execveat              362
+#define TARGET_NR_switch_endian         363
+#define TARGET_NR_userfaultfd           364
+#define TARGET_NR_membarrier            365
+#define TARGET_NR_semop                 366
+#define TARGET_NR_semget                367
+#define TARGET_NR_semctl                368
+#define TARGET_NR_semtimedop            369
+#define TARGET_NR_msgsnd                370
+#define TARGET_NR_msgrcv                371
+#define TARGET_NR_msgget                372
+#define TARGET_NR_msgctl                373
+#define TARGET_NR_shmat                 374
+#define TARGET_NR_shmdt                 375
+#define TARGET_NR_shmget                376
+#define TARGET_NR_shmctl                377
+#define TARGET_NR_mlock2                378
diff --git a/linux-user/ppc/syscall.h b/linux-user/ppc/target_syscall.h
index 0daf5cd2df..35cab59462 100644
--- a/linux-user/ppc/syscall.h
+++ b/linux-user/ppc/target_syscall.h
@@ -17,6 +17,9 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 /* XXX: ABSOLUTELY BUGGY:
  * for now, this is quite just a cut-and-paste from i386 target...
  */
@@ -73,3 +76,5 @@ struct target_revectored_struct {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 0x2000
 #define TARGET_MLOCKALL_MCL_FUTURE  0x4000
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index bd90cc3799..26b0ba2736 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -1,22 +1,19 @@
 #ifndef QEMU_H
 #define QEMU_H
 
-#include <signal.h>
-#include <string.h>
 
 #include "cpu.h"
 #include "exec/cpu_ldst.h"
 
 #undef DEBUG_REMAP
 #ifdef DEBUG_REMAP
-#include <stdlib.h>
 #endif /* DEBUG_REMAP */
 
 #include "exec/user/abitypes.h"
 
 #include "exec/user/thunk.h"
 #include "syscall_defs.h"
-#include "syscall.h"
+#include "target_syscall.h"
 #include "exec/gdbstub.h"
 #include "qemu/queue.h"
 
diff --git a/linux-user/s390x/syscall_nr.h b/linux-user/s390x/syscall_nr.h
index 7c0b8b2eaa..1a66c5561d 100644
--- a/linux-user/s390x/syscall_nr.h
+++ b/linux-user/s390x/syscall_nr.h
@@ -271,6 +271,36 @@
 #define TARGET_NR_s390_runtime_instr    342
 #define TARGET_NR_kcmp                  343
 #define TARGET_NR_finit_module          344
+#define TARGET_NR_sched_setattr         345
+#define TARGET_NR_sched_getattr         346
+#define TARGET_NR_renameat2             347
+#define TARGET_NR_seccomp               348
+#define TARGET_NR_getrandom             349
+#define TARGET_NR_memfd_create          350
+#define TARGET_NR_bpf                   351
+#define TARGET_NR_s390_pci_mmio_write   352
+#define TARGET_NR_s390_pci_mmio_read    353
+#define TARGET_NR_execveat              354
+#define TARGET_NR_userfaultfd           355
+#define TARGET_NR_membarrier            356
+#define TARGET_NR_recvmmsg              357
+#define TARGET_NR_sendmmsg              358
+#define TARGET_NR_socket                359
+#define TARGET_NR_socketpair            360
+#define TARGET_NR_bind                  361
+#define TARGET_NR_connect               362
+#define TARGET_NR_listen                363
+#define TARGET_NR_accept4               364
+#define TARGET_NR_getsockopt            365
+#define TARGET_NR_setsockopt            366
+#define TARGET_NR_getsockname           367
+#define TARGET_NR_getpeername           368
+#define TARGET_NR_sendto                369
+#define TARGET_NR_sendmsg               370
+#define TARGET_NR_recvfrom              371
+#define TARGET_NR_recvmsg               372
+#define TARGET_NR_shutdown              373
+#define TARGET_NR_mlock2                374
 
 /*
  * There are some system calls that are not present on 64 bit, some
diff --git a/linux-user/s390x/syscall.h b/linux-user/s390x/target_syscall.h
index 35f170af25..02061efc78 100644
--- a/linux-user/s390x/syscall.h
+++ b/linux-user/s390x/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 /* this typedef defines how a Program Status Word looks like */
 typedef struct {
     abi_ulong mask;
@@ -27,3 +30,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ        2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/sh4/syscall_nr.h b/linux-user/sh4/syscall_nr.h
index bdf8742c69..50099846d2 100644
--- a/linux-user/sh4/syscall_nr.h
+++ b/linux-user/sh4/syscall_nr.h
@@ -323,7 +323,7 @@
 #define TARGET_NR_epoll_pwait	319
 #define TARGET_NR_utimensat		320
 #define TARGET_NR_signalfd		321
-#define TARGET_NR_timerfd		322
+#define TARGET_NR_timerfd_create	322
 #define TARGET_NR_eventfd		323
 #define TARGET_NR_fallocate		324
 #define TARGET_NR_timerfd_settime	325
diff --git a/linux-user/sh4/syscall.h b/linux-user/sh4/target_syscall.h
index 7aa4f239c5..9f3381bc9b 100644
--- a/linux-user/sh4/syscall.h
+++ b/linux-user/sh4/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 struct target_pt_regs {
         unsigned long regs[16];
         unsigned long pc;
@@ -15,3 +18,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/sparc/syscall_nr.h b/linux-user/sparc/syscall_nr.h
index 181cd32653..732b1052a4 100644
--- a/linux-user/sparc/syscall_nr.h
+++ b/linux-user/sparc/syscall_nr.h
@@ -278,7 +278,7 @@
 #define TARGET_NR_epoll_pwait	309
 #define TARGET_NR_utimensat		310
 #define TARGET_NR_signalfd		311
-#define TARGET_NR_timerfd		312
+#define TARGET_NR_timerfd_create	312
 #define TARGET_NR_eventfd		313
 #define TARGET_NR_fallocate		314
 #define TARGET_NR_timerfd_settime	315
@@ -309,3 +309,17 @@
 #define TARGET_NR_kern_features         340
 #define TARGET_NR_kcmp                  341
 #define TARGET_NR_finit_module          342
+#define TARGET_NR_sched_setattr         343
+#define TARGET_NR_sched_getattr         344
+#define TARGET_NR_renameat2             345
+#define TARGET_NR_seccomp               346
+#define TARGET_NR_getrandom             347
+#define TARGET_NR_memfd_create          348
+#define TARGET_NR_bpf                   349
+#define TARGET_NR_execveat              350
+#define TARGET_NR_membarrier            351
+#define TARGET_NR_userfaultfd           352
+#define TARGET_NR_bind                  353
+#define TARGET_NR_listen                354
+#define TARGET_NR_setsockopt            355
+#define TARGET_NR_mlock2                356
diff --git a/linux-user/sparc/syscall.h b/linux-user/sparc/target_syscall.h
index 58573b92ea..a73fa6dae1 100644
--- a/linux-user/sparc/syscall.h
+++ b/linux-user/sparc/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 struct target_pt_regs {
 	abi_ulong psr;
 	abi_ulong pc;
@@ -18,3 +21,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ      4096
 #define TARGET_MLOCKALL_MCL_CURRENT 0x2000
 #define TARGET_MLOCKALL_MCL_FUTURE  0x4000
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/sparc64/syscall_nr.h b/linux-user/sparc64/syscall_nr.h
index 34a984cc88..2b49ead267 100644
--- a/linux-user/sparc64/syscall_nr.h
+++ b/linux-user/sparc64/syscall_nr.h
@@ -341,3 +341,17 @@
 #define TARGET_NR_kern_features         340
 #define TARGET_NR_kcmp                  341
 #define TARGET_NR_finit_module          342
+#define TARGET_NR_sched_setattr         343
+#define TARGET_NR_sched_getattr         344
+#define TARGET_NR_renameat2             345
+#define TARGET_NR_seccomp               346
+#define TARGET_NR_getrandom             347
+#define TARGET_NR_memfd_create          348
+#define TARGET_NR_bpf                   349
+#define TARGET_NR_execveat              350
+#define TARGET_NR_membarrier            351
+#define TARGET_NR_userfaultfd           352
+#define TARGET_NR_bind                  353
+#define TARGET_NR_listen                354
+#define TARGET_NR_setsockopt            355
+#define TARGET_NR_mlock2                356
diff --git a/linux-user/sparc64/syscall.h b/linux-user/sparc64/target_syscall.h
index 8398d3f463..eb827fcac1 100644
--- a/linux-user/sparc64/syscall.h
+++ b/linux-user/sparc64/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 struct target_pt_regs {
 	abi_ulong u_regs[16];
 	abi_ulong tstate;
@@ -19,3 +22,5 @@ struct target_pt_regs {
 #define TARGET_MINSIGSTKSZ      4096
 #define TARGET_MLOCKALL_MCL_CURRENT 0x2000
 #define TARGET_MLOCKALL_MCL_FUTURE  0x4000
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 54ce14a611..951753143c 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -249,6 +249,9 @@ _syscall2(int, ioprio_get, int, which, int, who)
 #if defined(TARGET_NR_ioprio_set) && defined(__NR_ioprio_set)
 _syscall3(int, ioprio_set, int, which, int, who, int, ioprio)
 #endif
+#if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
+_syscall3(int, getrandom, void *, buf, size_t, buflen, unsigned int, flags)
+#endif
 
 static bitmask_transtbl fcntl_flags_tbl[] = {
   { TARGET_O_ACCMODE,   TARGET_O_WRONLY,    O_ACCMODE,   O_WRONLY,    },
@@ -318,8 +321,8 @@ static void fd_trans_register(int fd, TargetFdTrans *trans)
     if (fd >= target_fd_max) {
         oldmax = target_fd_max;
         target_fd_max = ((fd >> 6) + 1) << 6; /* by slice of 64 entries */
-        target_fd_trans = g_realloc(target_fd_trans,
-                                    target_fd_max * sizeof(TargetFdTrans));
+        target_fd_trans = g_renew(TargetFdTrans *,
+                                  target_fd_trans, target_fd_max);
         memset((void *)(target_fd_trans + oldmax), 0,
                (target_fd_max - oldmax) * sizeof(TargetFdTrans *));
     }
@@ -2598,8 +2601,9 @@ static abi_long do_socketcall(int num, abi_ulong vptr)
 #define N_SHM_REGIONS	32
 
 static struct shm_region {
-    abi_ulong	start;
-    abi_ulong	size;
+    abi_ulong start;
+    abi_ulong size;
+    bool in_use;
 } shm_regions[N_SHM_REGIONS];
 
 struct target_semid_ds
@@ -3291,7 +3295,8 @@ static inline abi_ulong do_shmat(int shmid, abi_ulong shmaddr, int shmflg)
                    ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
 
     for (i = 0; i < N_SHM_REGIONS; i++) {
-        if (shm_regions[i].start == 0) {
+        if (!shm_regions[i].in_use) {
+            shm_regions[i].in_use = true;
             shm_regions[i].start = raddr;
             shm_regions[i].size = shm_info.shm_segsz;
             break;
@@ -3308,8 +3313,8 @@ static inline abi_long do_shmdt(abi_ulong shmaddr)
     int i;
 
     for (i = 0; i < N_SHM_REGIONS; ++i) {
-        if (shm_regions[i].start == shmaddr) {
-            shm_regions[i].start = 0;
+        if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
+            shm_regions[i].in_use = false;
             page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
             break;
         }
@@ -5229,7 +5234,6 @@ static inline int target_to_host_mlockall_arg(int arg)
 }
 #endif
 
-#if defined(TARGET_NR_stat64) || defined(TARGET_NR_newfstatat)
 static inline abi_long host_to_target_stat64(void *cpu_env,
                                              abi_ulong target_addr,
                                              struct stat *host_st)
@@ -5292,7 +5296,6 @@ static inline abi_long host_to_target_stat64(void *cpu_env,
 
     return 0;
 }
-#endif
 
 /* ??? Using host futex calls even when target atomic operations
    are not really atomic probably breaks things.  However implementing
@@ -7541,6 +7544,16 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
         ret = get_errno(shutdown(arg1, arg2));
         break;
 #endif
+#if defined(TARGET_NR_getrandom) && defined(__NR_getrandom)
+    case TARGET_NR_getrandom:
+        p = lock_user(VERIFY_WRITE, arg1, arg2, 0);
+        if (!p) {
+            goto efault;
+        }
+        ret = get_errno(getrandom(p, arg2, arg3));
+        unlock_user(p, arg1, ret);
+        break;
+#endif
 #ifdef TARGET_NR_socket
     case TARGET_NR_socket:
         ret = do_socket(arg1, arg2, arg3);
diff --git a/linux-user/tilegx/syscall_nr.h b/linux-user/tilegx/syscall_nr.h
index 1dca348378..87fb72c554 100644
--- a/linux-user/tilegx/syscall_nr.h
+++ b/linux-user/tilegx/syscall_nr.h
@@ -274,6 +274,10 @@
 #define TARGET_NR_memfd_create                  279
 #define TARGET_NR_bpf                           280
 #define TARGET_NR_execveat                      281
+#define TARGET_NR_userfaultfd                   282
+#define TARGET_NR_membarrier                    283
+#define TARGET_NR_mlock2                        284
+#define TARGET_NR_copy_file_range               285
 
 #define TARGET_NR_open                          1024
 #define TARGET_NR_link                          1025
diff --git a/linux-user/tilegx/syscall.h b/linux-user/tilegx/target_syscall.h
index a938d4e90c..a938d4e90c 100644
--- a/linux-user/tilegx/syscall.h
+++ b/linux-user/tilegx/target_syscall.h
diff --git a/linux-user/unicore32/syscall.h b/linux-user/unicore32/target_syscall.h
index 385a97562d..385a97562d 100644
--- a/linux-user/unicore32/syscall.h
+++ b/linux-user/unicore32/target_syscall.h
diff --git a/linux-user/x86_64/syscall_nr.h b/linux-user/x86_64/syscall_nr.h
index 7c59e3a09e..16397b3e8f 100644
--- a/linux-user/x86_64/syscall_nr.h
+++ b/linux-user/x86_64/syscall_nr.h
@@ -281,7 +281,7 @@
 #define TARGET_NR_utimensat		280
 #define TARGET_NR_epoll_pwait	281
 #define TARGET_NR_signalfd		282
-#define TARGET_NR_timerfd		283
+#define TARGET_NR_timerfd_create	283
 #define TARGET_NR_eventfd		284
 #define TARGET_NR_fallocate		285
 #define TARGET_NR_timerfd_settime	286
@@ -312,3 +312,16 @@
 #define TARGET_NR_process_vm_writev     311
 #define TARGET_NR_kcmp                  312
 #define TARGET_NR_finit_module          313
+#define TARGET_NR_sched_setattr         314
+#define TARGET_NR_sched_getattr         315
+#define TARGET_NR_renameat2             316
+#define TARGET_NR_seccomp               317
+#define TARGET_NR_getrandom             318
+#define TARGET_NR_memfd_create          319
+#define TARGET_NR_kexec_file_load       320
+#define TARGET_NR_bpf                   321
+#define TARGET_NR_execveat              322
+#define TARGET_NR_userfaultfd           323
+#define TARGET_NR_membarrier            324
+#define TARGET_NR_mlock2                325
+#define TARGET_NR_copy_file_range       326
diff --git a/linux-user/x86_64/syscall.h b/linux-user/x86_64/target_syscall.h
index 88b3c3fe31..feecd32d50 100644
--- a/linux-user/x86_64/syscall.h
+++ b/linux-user/x86_64/target_syscall.h
@@ -1,3 +1,6 @@
+#ifndef TARGET_SYSCALL_H
+#define TARGET_SYSCALL_H
+
 #define __USER_CS	(0x33)
 #define __USER_DS	(0x2B)
 
@@ -100,3 +103,5 @@ struct target_msqid64_ds {
 #define TARGET_MINSIGSTKSZ 2048
 #define TARGET_MLOCKALL_MCL_CURRENT 1
 #define TARGET_MLOCKALL_MCL_FUTURE  2
+
+#endif  /* TARGET_SYSCALL_H */
diff --git a/migration/migration.c b/migration/migration.c
index a64cfcdb07..fc5e50b0be 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -905,6 +905,11 @@ bool migration_in_postcopy(MigrationState *s)
     return (s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
 }
 
+bool migration_in_postcopy_after_devices(MigrationState *s)
+{
+    return migration_in_postcopy(s) && s->postcopy_after_devices;
+}
+
 MigrationState *migrate_init(const MigrationParams *params)
 {
     MigrationState *s = migrate_get_current();
@@ -930,6 +935,7 @@ MigrationState *migrate_init(const MigrationParams *params)
     s->setup_time = 0;
     s->dirty_sync_count = 0;
     s->start_postcopy = false;
+    s->postcopy_after_devices = false;
     s->migration_thread_running = false;
     s->last_req_rb = NULL;
 
@@ -1489,6 +1495,14 @@ static int postcopy_start(MigrationState *ms, bool *old_vm_running)
         goto fail_closefb;
     }
     qemu_fclose(fb);
+
+    /* Send a notify to give a chance for anything that needs to happen
+     * at the transition to postcopy and after the device state; in particular
+     * spice needs to trigger a transition now
+     */
+    ms->postcopy_after_devices = true;
+    notifier_list_notify(&migration_state_notifiers, ms);
+
     ms->downtime =  qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - time_at_stop;
 
     qemu_mutex_unlock_iothread();
diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
index db6ab65ced..d09b4ee308 100644
--- a/nbd/nbd-internal.h
+++ b/nbd/nbd-internal.h
@@ -16,16 +16,12 @@
 #include "qemu/coroutine.h"
 #include "qemu/iov.h"
 
-#include <errno.h>
-#include <string.h>
 #ifndef _WIN32
 #include <sys/ioctl.h>
 #endif
 #if defined(__sun__) || defined(__HAIKU__)
 #include <sys/ioccom.h>
 #endif
-#include <ctype.h>
-#include <inttypes.h>
 
 #ifdef __linux__
 #include <linux/fs.h>
diff --git a/net/tap-linux.h b/net/tap-linux.h
index 01dc6f8a2d..1dc3a9f279 100644
--- a/net/tap-linux.h
+++ b/net/tap-linux.h
@@ -16,7 +16,6 @@
 #ifndef QEMU_TAP_LINUX_H
 #define QEMU_TAP_LINUX_H
 
-#include <stdint.h>
 #ifdef __linux__
 
 #include <linux/ioctl.h>
diff --git a/net/util.h b/net/util.h
index 10c7da95f0..60b73d372d 100644
--- a/net/util.h
+++ b/net/util.h
@@ -25,7 +25,6 @@
 #ifndef QEMU_NET_UTIL_H
 #define QEMU_NET_UTIL_H
 
-#include <stdint.h>
 
 int net_parse_macaddr(uint8_t *macaddr, const char *p);
 
diff --git a/pc-bios/README b/pc-bios/README
index 9f65ffa46f..5a8a93193e 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -17,7 +17,7 @@
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
   https://github.com/aik/SLOF, and the image currently in qemu is
-  built from git tag qemu-slof-20151103.
+  built from git tag qemu-slof-20160223.
 
 - sgabios (the Serial Graphics Adapter option ROM) provides a means for
   legacy x86 software to communicate with an attached serial console as
diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin
index 90f30996f9..f2384939ef 100644
--- a/pc-bios/slof.bin
+++ b/pc-bios/slof.bin
Binary files differdiff --git a/qemu-nbd.c b/qemu-nbd.c
index efc427c4f4..5fe94d0e7b 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -31,8 +31,6 @@
 #include "io/channel-socket.h"
 
 #include <getopt.h>
-#include <sys/types.h>
-#include <signal.h>
 #include <libgen.h>
 #include <pthread.h>
 
diff --git a/qemu-options.hx b/qemu-options.hx
index 2f0465eeb1..f528405810 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1051,6 +1051,7 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice,
     "       [,streaming-video=[off|all|filter]][,disable-copy-paste]\n"
     "       [,disable-agent-file-xfer][,agent-mouse=[on|off]]\n"
     "       [,playback-compression=[on|off]][,seamless-migration=[on|off]]\n"
+    "       [,gl=[on|off]]\n"
     "   enable spice\n"
     "   at least one of {port, tls-port} is mandatory\n",
     QEMU_ARCH_ALL)
@@ -1142,6 +1143,9 @@ Enable/disable audio stream compression (using celt 0.5.1).  Default is on.
 @item seamless-migration=[on|off]
 Enable/disable spice seamless migration. Default is off.
 
+@item gl=[on|off]
+Enable/disable OpenGL context. Default is off.
+
 @end table
 ETEXI
 
diff --git a/qemu-tech.texi b/qemu-tech.texi
index 022017d55d..bdb2285f4e 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -385,7 +385,7 @@ ops (see @code{target-i386/translate.c}). Some optimizations can be
 performed at this stage, including liveness analysis and trivial
 constant expression evaluation. TCG ops are then implemented in the
 host CPU back end, also known as TCG target (see
-@code{tcg/i386/tcg-target.c}). For more information, please take a
+@code{tcg/i386/tcg-target.inc.c}). For more information, please take a
 look at @code{tcg/README}.
 
 @node Condition code optimisations
diff --git a/qga/vss-win32.h b/qga/vss-win32.h
index 298927dfa5..4d1d15081e 100644
--- a/qga/vss-win32.h
+++ b/qga/vss-win32.h
@@ -13,7 +13,6 @@
 #ifndef VSS_WIN32_H
 #define VSS_WIN32_H
 
-#include "qapi/error.h"
 
 bool vss_init(bool init_requester);
 void vss_deinit(bool deinit_requester);
diff --git a/qga/vss-win32/requester.h b/qga/vss-win32/requester.h
index c3093cf4b6..ad2bf3df61 100644
--- a/qga/vss-win32/requester.h
+++ b/qga/vss-win32/requester.h
@@ -14,7 +14,6 @@
 #define VSS_WIN32_REQUESTER_H
 
 #include <basetyps.h>           /* STDAPI */
-#include "qemu/compiler.h"
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/qga/vss-win32/vss-common.h b/qga/vss-win32/vss-common.h
index ce14e14290..91dae0c38d 100644
--- a/qga/vss-win32/vss-common.h
+++ b/qga/vss-win32/vss-common.h
@@ -14,7 +14,6 @@
 #define VSS_WIN32_H
 
 #define __MIDL_user_allocate_free_DEFINED__
-#include "config-host.h"
 #include <windows.h>
 #include <shlwapi.h>
 
diff --git a/qom/cpu.c b/qom/cpu.c
index aeb32f1b6e..c45d0bb6de 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -18,6 +18,7 @@
  * <http://www.gnu.org/licenses/gpl-2.0.html>
  */
 
+#include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qom/cpu.h"
 #include "sysemu/kvm.h"
diff --git a/replay/replay-internal.h b/replay/replay-internal.h
index 77e0d292c7..5438ebdb9c 100644
--- a/replay/replay-internal.h
+++ b/replay/replay-internal.h
@@ -12,7 +12,6 @@
  *
  */
 
-#include <stdio.h>
 
 enum ReplayEvents {
     /* for instruction event */
diff --git a/roms/SLOF b/roms/SLOF
-Subproject b4c93802a5b2c72f096649c497ec9ff5708e445
+Subproject e3d05727a074619fc12d0a67f05cf2c42c875cc
diff --git a/scripts/clean-includes b/scripts/clean-includes
index 1af1f824b8..a1faa60710 100755
--- a/scripts/clean-includes
+++ b/scripts/clean-includes
@@ -1,7 +1,8 @@
 #!/bin/sh -e
 #
 # Clean up QEMU #include lines by ensuring that qemu/osdep.h
-# is the first include listed.
+# is the first include listed in .c files, and no headers provided
+# by osdep.h itself are redundantly included in either .c or .h files.
 #
 # Copyright (c) 2015 Linaro Limited
 #
@@ -14,14 +15,25 @@
 
 # Usage:
 #   clean-includes [--git subjectprefix] file ...
+# or
+#   clean-includes [--git subjectprefix] --all
 #
 # If the --git subjectprefix option is given, then after making
 # the changes to the files this script will create a git commit
 # with the subject line "subjectprefix: Clean up includes"
 # and a boilerplate commit message.
+#
+# Using --all will cause clean-includes to run on the whole source
+# tree (excluding certain directories which are known not to need
+# handling).
 
 # This script requires Coccinelle to be installed.
 
+# .c files will have the osdep.h included added, and redundant
+# includes removed.
+# .h files will have redundant includes (including includes of osdep.h)
+# removed.
+# Other files (including C++ and ObjectiveC) can't be handled by this script.
 
 # The following one-liner may be handy for finding files to run this on.
 # However some caution is required regarding files that might be part
@@ -34,6 +46,9 @@
 
 GIT=no
 
+# Extended regular expression defining files to ignore when using --all
+XDIRREGEX='^(tests/tcg|tests/multiboot|pc-bios|disas/libvixl)'
+
 if [ $# -ne 0 ] && [ "$1" = "--git" ]; then
     if [ $# -eq 1 ]; then
         echo "--git option requires an argument"
@@ -46,11 +61,16 @@ if [ $# -ne 0 ] && [ "$1" = "--git" ]; then
 fi
 
 if [ $# -eq 0 ]; then
-    echo "Usage: clean-includes [--git subjectprefix] foo.c ..."
+    echo "Usage: clean-includes [--git subjectprefix] [--all | foo.c ...]"
     echo "(modifies the files in place)"
     exit 1
 fi
 
+if [ "$1" = "--all" ]; then
+    # We assume there are no files in the tree with spaces in their name
+    set -- $(git ls-files '*.[ch]' | grep -E -v "$XDIRREGEX")
+fi
+
 # Annoyingly coccinelle won't read a scriptfile unless its
 # name ends '.cocci', so write it out to a tempfile with the
 # right kind of name.
@@ -73,13 +93,49 @@ EOT
 
 
 for f in "$@"; do
-  # First, use coccinelle to add qemu/osdep.h before the first existing include
-  # (this will add two lines if the file uses both "..." and <...> #includes,
-  # but we will remove the extras in the next step)
-  spatch  --in-place --no-show-diff --cocci-file "$COCCIFILE" "$f"
-
-  # Now remove any duplicate osdep.h includes
-  perl -n -i  -e 'print if !/#include "qemu\/osdep.h"/ || !$n++;' "$f"
+  case "$f" in
+    *.inc.c)
+      # These aren't standalone C source files
+      echo "SKIPPING $f (not a standalone source file)"
+      continue
+      ;;
+    *.c)
+      MODE=c
+      ;;
+    *include/qemu/osdep.h | \
+    *include/qemu/compiler.h | \
+    *include/config.h | \
+    *include/standard-headers/ )
+      # Removing include lines from osdep.h itself would be counterproductive.
+      echo "SKIPPING $f (special case header)"
+      continue
+      ;;
+    *include/standard-headers/*)
+      echo "SKIPPING $f (autogenerated header)"
+      continue
+      ;;
+    *.h)
+      MODE=h
+      ;;
+    *)
+      echo "WARNING: ignoring $f (cannot handle non-C files)"
+      continue
+      ;;
+  esac
+
+  if [ "$MODE" = "c" ]; then
+    # First, use Coccinelle to add qemu/osdep.h before the first existing include
+    # (this will add two lines if the file uses both "..." and <...> #includes,
+    # but we will remove the extras in the next step)
+    spatch  --in-place --no-show-diff --cocci-file "$COCCIFILE" "$f"
+
+    # Now remove any duplicate osdep.h includes
+    perl -n -i -e 'print if !/#include "qemu\/osdep.h"/ || !$n++;' "$f"
+  else
+    # Remove includes of osdep.h itself
+    perl -n -i -e 'print if !/\s*#\s*include\s*(["<][^>"]*[">])/ ||
+                            ! (grep { $_ eq $1 } qw ("qemu/osdep.h"))' "$f"
+  fi
 
   # Remove includes that osdep.h already provides
   perl -n -i -e 'print if !/\s*#\s*include\s*(["<][^>"]*[">])/ ||
diff --git a/scripts/tracetool/format/ust_events_c.py b/scripts/tracetool/format/ust_events_c.py
index bc970936be..9967c7a82e 100644
--- a/scripts/tracetool/format/ust_events_c.py
+++ b/scripts/tracetool/format/ust_events_c.py
@@ -22,6 +22,8 @@ def generate(events, backend):
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
         '',
+        '#include "qemu/osdep.h"',
+        '',
         '#define TRACEPOINT_DEFINE',
         '#define TRACEPOINT_CREATE_PROBES',
         '',
diff --git a/slirp/slirp.h b/slirp/slirp.h
index 239fe2917a..07c13b4725 100644
--- a/slirp/slirp.h
+++ b/slirp/slirp.h
@@ -1,11 +1,9 @@
 #ifndef __COMMON_H__
 #define __COMMON_H__
 
-#include "config-host.h"
 #include "slirp_config.h"
 
 #ifdef _WIN32
-# include <inttypes.h>
 
 typedef char *caddr_t;
 
@@ -23,43 +21,31 @@ typedef char *caddr_t;
 # endif
 #endif
 
-#include <sys/types.h>
 #ifdef HAVE_SYS_BITYPES_H
 # include <sys/bitypes.h>
 #endif
 
-#include <sys/time.h>
 
 #ifdef HAVE_UNISTD_H
-# include <unistd.h>
 #endif
 
 #ifdef HAVE_STDLIB_H
-# include <stdlib.h>
 #endif
 
-#include <stdio.h>
-#include <errno.h>
 
 #ifndef HAVE_MEMMOVE
 #define memmove(x, y, z) bcopy(y, x, z)
 #endif
 
 #if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
 #else
 # ifdef HAVE_SYS_TIME_H
-#  include <sys/time.h>
 # else
-#  include <time.h>
 # endif
 #endif
 
 #ifdef HAVE_STRING_H
-# include <string.h>
 #else
-# include <strings.h>
 #endif
 
 #ifndef _WIN32
@@ -82,11 +68,9 @@ void *malloc(size_t arg);
 void free(void *ptr);
 #endif
 
-#include <fcntl.h>
 #ifndef NO_UNIX_SOCKETS
 #include <sys/un.h>
 #endif
-#include <signal.h>
 #ifdef HAVE_SYS_SIGNAL_H
 # include <sys/signal.h>
 #endif
@@ -115,12 +99,10 @@ void free(void *ptr);
 #endif
 
 #ifdef __STDC__
-#include <stdarg.h>
 #else
 #include <varargs.h>
 #endif
 
-#include <sys/stat.h>
 
 /* Avoid conflicting with the libc insque() and remque(), which
    have different prototypes. */
diff --git a/target-alpha/cpu.h b/target-alpha/cpu.h
index bcd8076abb..420f2a53fe 100644
--- a/target-alpha/cpu.h
+++ b/target-alpha/cpu.h
@@ -20,7 +20,6 @@
 #if !defined (__CPU_ALPHA_H__)
 #define __CPU_ALPHA_H__
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 64
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 16238216f4..3cbda73578 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -19,7 +19,6 @@
 #ifndef CPU_ARM_H
 #define CPU_ARM_H
 
-#include "config.h"
 
 #include "kvm-consts.h"
 
diff --git a/target-arm/kvm-consts.h b/target-arm/kvm-consts.h
index 943bf8980a..a2c9518592 100644
--- a/target-arm/kvm-consts.h
+++ b/target-arm/kvm-consts.h
@@ -15,7 +15,6 @@
 #define ARM_KVM_CONSTS_H
 
 #ifdef CONFIG_KVM
-#include "qemu/compiler.h"
 #include <linux/kvm.h>
 #include <linux/psci.h>
 
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index 32204607ca..415cf91436 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -20,7 +20,6 @@
 #ifndef CPU_CRIS_H
 #define CPU_CRIS_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 32
diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 5f9d960b25..cb750176c0 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -22,7 +22,6 @@
 
 #include "qom/cpu.h"
 #include "cpu.h"
-#include "qapi/error.h"
 #include "qemu/notify.h"
 
 #ifdef TARGET_X86_64
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 0af43a3ae1..c78f824678 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -16,10 +16,7 @@
  * You should have received a copy of the GNU Lesser General Public
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <inttypes.h>
+#include "qemu/osdep.h"
 
 #include "cpu.h"
 #include "sysemu/kvm.h"
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 94cb4db27d..7febc3f5ec 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -19,7 +19,6 @@
 #ifndef CPU_I386_H
 #define CPU_I386_H
 
-#include "config.h"
 #include "qemu-common.h"
 #include "standard-headers/asm-x86/hyperv.h"
 
diff --git a/target-i386/mpx_helper.c b/target-i386/mpx_helper.c
index 1bf717af05..052a69c52f 100644
--- a/target-i386/mpx_helper.c
+++ b/target-i386/mpx_helper.c
@@ -17,6 +17,7 @@
  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  */
 
+#include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/helper-proto.h"
 #include "exec/cpu_ldst.h"
diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index 2b7620c7da..f220fc0bb9 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -24,7 +24,6 @@
 
 #define CPUArchState struct CPULM32State
 
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 struct CPULM32State;
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index 224c16967c..48b4c872fc 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -24,7 +24,6 @@
 
 #define CPUArchState struct CPUM68KState
 
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 6b212ab7f0..2f7335eaa7 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -19,7 +19,6 @@
 #ifndef CPU_MICROBLAZE_H
 #define CPU_MICROBLAZE_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 32
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 86b6333634..bd23c2a054 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -7,7 +7,6 @@
 
 #define CPUArchState struct CPUMIPSState
 
-#include "config.h"
 #include "qemu-common.h"
 #include "mips-defs.h"
 #include "exec/cpu-defs.h"
diff --git a/target-moxie/cpu.h b/target-moxie/cpu.h
index a612744011..4ee207796c 100644
--- a/target-moxie/cpu.h
+++ b/target-moxie/cpu.h
@@ -19,7 +19,6 @@
 #ifndef _CPU_MOXIE_H
 #define _CPU_MOXIE_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 32
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index eb71607395..4b63f25804 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -27,7 +27,6 @@
 /* cpu_openrisc_map_address_* in CPUOpenRISCTLBContext need this decl.  */
 struct OpenRISCCPU;
 
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
index 892f4dc949..2b10597fa9 100644
--- a/target-ppc/cpu.h
+++ b/target-ppc/cpu.h
@@ -19,7 +19,6 @@
 #if !defined (__CPU_PPC_H__)
 #define __CPU_PPC_H__
 
-#include "config.h"
 #include "qemu-common.h"
 
 //#define PPC_EMULATE_32BITS_HYPV
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 70ca29637f..d67c169ba3 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -23,6 +23,7 @@
 #include <linux/kvm.h>
 
 #include "qemu-common.h"
+#include "qemu/error-report.h"
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
@@ -512,6 +513,10 @@ int kvm_arch_init_vcpu(CPUState *cs)
     /* Synchronize sregs with kvm */
     ret = kvm_arch_sync_sregs(cpu);
     if (ret) {
+        if (ret == -EINVAL) {
+            error_report("Register sync failed... If you're using kvm-hv.ko,"
+                         " only \"-cpu host\" is possible");
+        }
         return ret;
     }
 
@@ -1993,7 +1998,8 @@ void kvmppc_set_papr(PowerPCCPU *cpu)
 
     ret = kvm_vcpu_enable_cap(cs, KVM_CAP_PPC_PAPR, 0);
     if (ret) {
-        cpu_abort(cs, "This KVM version does not support PAPR\n");
+        error_report("This vCPU type or KVM version does not support PAPR");
+        exit(1);
     }
 
     /* Update the capability flag so we sync the right information
@@ -2013,7 +2019,8 @@ void kvmppc_set_mpic_proxy(PowerPCCPU *cpu, int mpic_proxy)
 
     ret = kvm_vcpu_enable_cap(cs, KVM_CAP_PPC_EPR, 0, mpic_proxy);
     if (ret && mpic_proxy) {
-        cpu_abort(cs, "This KVM version does not support EPR\n");
+        error_report("This KVM version does not support EPR");
+        exit(1);
     }
 }
 
diff --git a/target-ppc/kvm_ppc.h b/target-ppc/kvm_ppc.h
index aaa828c055..fd64c44f4d 100644
--- a/target-ppc/kvm_ppc.h
+++ b/target-ppc/kvm_ppc.h
@@ -249,15 +249,47 @@ static inline int kvmppc_enable_hwrng(void)
 #endif
 
 #ifndef CONFIG_KVM
+
 #define kvmppc_eieio() do { } while (0)
-#else
+
+static inline void kvmppc_dcbst_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+}
+
+static inline void kvmppc_icbi_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+}
+
+#else   /* CONFIG_KVM */
+
 #define kvmppc_eieio() \
     do {                                          \
         if (kvm_enabled()) {                          \
             asm volatile("eieio" : : : "memory"); \
         } \
     } while (0)
-#endif
+
+/* Store data cache blocks back to memory */
+static inline void kvmppc_dcbst_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+    uint8_t *p;
+
+    for (p = addr; p < addr + len; p += cpu->env.dcache_line_size) {
+        asm volatile("dcbst 0,%0" : : "r"(p) : "memory");
+    }
+}
+
+/* Invalidate instruction cache blocks */
+static inline void kvmppc_icbi_range(PowerPCCPU *cpu, uint8_t *addr, int len)
+{
+    uint8_t *p;
+
+    for (p = addr; p < addr + len; p += cpu->env.icache_line_size) {
+        asm volatile("icbi 0,%0" : : "r"(p));
+    }
+}
+
+#endif  /* CONFIG_KVM */
 
 #ifndef KVM_INTERRUPT_SET
 #define KVM_INTERRUPT_SET -1
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 06ca60b25f..6ae5699e0b 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -22,7 +22,6 @@
 #ifndef CPU_S390X_H
 #define CPU_S390X_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 64
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index 5b022c5973..3b23e967bb 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -19,7 +19,6 @@
 #ifndef _CPU_SH4_H
 #define _CPU_SH4_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 32
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 58ff4743b4..dc46122758 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -1,7 +1,6 @@
 #ifndef CPU_SPARC_H
 #define CPU_SPARC_H
 
-#include "config.h"
 #include "qemu-common.h"
 #include "qemu/bswap.h"
 
diff --git a/target-sparc/translate.c b/target-sparc/translate.c
index 536c4b50d5..00d61ee16a 100644
--- a/target-sparc/translate.c
+++ b/target-sparc/translate.c
@@ -43,7 +43,8 @@ static TCGv_ptr cpu_env, cpu_regwptr;
 static TCGv cpu_cc_src, cpu_cc_src2, cpu_cc_dst;
 static TCGv_i32 cpu_cc_op;
 static TCGv_i32 cpu_psr;
-static TCGv cpu_fsr, cpu_pc, cpu_npc, cpu_gregs[8];
+static TCGv cpu_fsr, cpu_pc, cpu_npc;
+static TCGv cpu_regs[32];
 static TCGv cpu_y;
 #ifndef CONFIG_USER_ONLY
 static TCGv cpu_tbr;
@@ -273,36 +274,31 @@ static inline void gen_address_mask(DisasContext *dc, TCGv addr)
 
 static inline TCGv gen_load_gpr(DisasContext *dc, int reg)
 {
-    if (reg == 0 || reg >= 8) {
+    if (reg > 0) {
+        assert(reg < 32);
+        return cpu_regs[reg];
+    } else {
         TCGv t = get_temp_tl(dc);
-        if (reg == 0) {
-            tcg_gen_movi_tl(t, 0);
-        } else {
-            tcg_gen_ld_tl(t, cpu_regwptr, (reg - 8) * sizeof(target_ulong));
-        }
+        tcg_gen_movi_tl(t, 0);
         return t;
-    } else {
-        return cpu_gregs[reg];
     }
 }
 
 static inline void gen_store_gpr(DisasContext *dc, int reg, TCGv v)
 {
     if (reg > 0) {
-        if (reg < 8) {
-            tcg_gen_mov_tl(cpu_gregs[reg], v);
-        } else {
-            tcg_gen_st_tl(v, cpu_regwptr, (reg - 8) * sizeof(target_ulong));
-        }
+        assert(reg < 32);
+        tcg_gen_mov_tl(cpu_regs[reg], v);
     }
 }
 
 static inline TCGv gen_dest_gpr(DisasContext *dc, int reg)
 {
-    if (reg == 0 || reg >= 8) {
-        return get_temp_tl(dc);
+    if (reg > 0) {
+        assert(reg < 32);
+        return cpu_regs[reg];
     } else {
-        return cpu_gregs[reg];
+        return get_temp_tl(dc);
     }
 }
 
@@ -2158,9 +2154,13 @@ static inline void gen_ldda_asi(DisasContext *dc, TCGv hi, TCGv addr,
     tcg_temp_free_i32(r_size);
     tcg_temp_free_i32(r_asi);
 
-    t = gen_dest_gpr(dc, rd + 1);
+    /* ??? Work around an apparent bug in Ubuntu gcc 4.8.2-10ubuntu2+12,
+       whereby "rd + 1" elicits "error: array subscript is above array".
+       Since we have already asserted that rd is even, the semantics
+       are unchanged.  */
+    t = gen_dest_gpr(dc, rd | 1);
     tcg_gen_trunc_i64_tl(t, t64);
-    gen_store_gpr(dc, rd + 1, t);
+    gen_store_gpr(dc, rd | 1, t);
 
     tcg_gen_shri_i64(t64, t64, 32);
     tcg_gen_trunc_i64_tl(hi, t64);
@@ -5329,106 +5329,98 @@ void gen_intermediate_code(CPUSPARCState * env, TranslationBlock * tb)
 
 void gen_intermediate_code_init(CPUSPARCState *env)
 {
-    unsigned int i;
     static int inited;
-    static const char * const gregnames[8] = {
-        NULL, // g0 not used
-        "g1",
-        "g2",
-        "g3",
-        "g4",
-        "g5",
-        "g6",
-        "g7",
+    static const char gregnames[32][4] = {
+        "g0", "g1", "g2", "g3", "g4", "g5", "g6", "g7",
+        "o0", "o1", "o2", "o3", "o4", "o5", "o6", "o7",
+        "l0", "l1", "l2", "l3", "l4", "l5", "l6", "l7",
+        "i0", "i1", "i2", "i3", "i4", "i5", "i6", "i7",
     };
-    static const char * const fregnames[32] = {
+    static const char fregnames[32][4] = {
         "f0", "f2", "f4", "f6", "f8", "f10", "f12", "f14",
         "f16", "f18", "f20", "f22", "f24", "f26", "f28", "f30",
         "f32", "f34", "f36", "f38", "f40", "f42", "f44", "f46",
         "f48", "f50", "f52", "f54", "f56", "f58", "f60", "f62",
     };
 
-    /* init various static tables */
-    if (!inited) {
-        inited = 1;
-
-        cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
-        cpu_regwptr = tcg_global_mem_new_ptr(cpu_env,
-                                             offsetof(CPUSPARCState, regwptr),
-                                             "regwptr");
+    static const struct { TCGv_i32 *ptr; int off; const char *name; } r32[] = {
 #ifdef TARGET_SPARC64
-        cpu_xcc = tcg_global_mem_new_i32(cpu_env, offsetof(CPUSPARCState, xcc),
-                                         "xcc");
-        cpu_asi = tcg_global_mem_new_i32(cpu_env, offsetof(CPUSPARCState, asi),
-                                         "asi");
-        cpu_fprs = tcg_global_mem_new_i32(cpu_env,
-                                          offsetof(CPUSPARCState, fprs),
-                                          "fprs");
-        cpu_gsr = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, gsr),
-                                     "gsr");
-        cpu_tick_cmpr = tcg_global_mem_new(cpu_env,
-                                           offsetof(CPUSPARCState, tick_cmpr),
-                                           "tick_cmpr");
-        cpu_stick_cmpr = tcg_global_mem_new(cpu_env,
-                                            offsetof(CPUSPARCState, stick_cmpr),
-                                            "stick_cmpr");
-        cpu_hstick_cmpr = tcg_global_mem_new(cpu_env,
-                                             offsetof(CPUSPARCState, hstick_cmpr),
-                                             "hstick_cmpr");
-        cpu_hintp = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, hintp),
-                                       "hintp");
-        cpu_htba = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, htba),
-                                      "htba");
-        cpu_hver = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, hver),
-                                      "hver");
-        cpu_ssr = tcg_global_mem_new(cpu_env,
-                                     offsetof(CPUSPARCState, ssr), "ssr");
-        cpu_ver = tcg_global_mem_new(cpu_env,
-                                     offsetof(CPUSPARCState, version), "ver");
-        cpu_softint = tcg_global_mem_new_i32(cpu_env,
-                                             offsetof(CPUSPARCState, softint),
-                                             "softint");
+        { &cpu_xcc, offsetof(CPUSPARCState, xcc), "xcc" },
+        { &cpu_asi, offsetof(CPUSPARCState, asi), "asi" },
+        { &cpu_fprs, offsetof(CPUSPARCState, fprs), "fprs" },
+        { &cpu_softint, offsetof(CPUSPARCState, softint), "softint" },
 #else
-        cpu_wim = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, wim),
-                                     "wim");
+        { &cpu_wim, offsetof(CPUSPARCState, wim), "wim" },
 #endif
-        cpu_cond = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, cond),
-                                      "cond");
-        cpu_cc_src = tcg_global_mem_new(cpu_env,
-                                        offsetof(CPUSPARCState, cc_src),
-                                        "cc_src");
-        cpu_cc_src2 = tcg_global_mem_new(cpu_env,
-                                         offsetof(CPUSPARCState, cc_src2),
-                                         "cc_src2");
-        cpu_cc_dst = tcg_global_mem_new(cpu_env,
-                                        offsetof(CPUSPARCState, cc_dst),
-                                        "cc_dst");
-        cpu_cc_op = tcg_global_mem_new_i32(cpu_env,
-                                           offsetof(CPUSPARCState, cc_op),
-                                           "cc_op");
-        cpu_psr = tcg_global_mem_new_i32(cpu_env, offsetof(CPUSPARCState, psr),
-                                         "psr");
-        cpu_fsr = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, fsr),
-                                     "fsr");
-        cpu_pc = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, pc),
-                                    "pc");
-        cpu_npc = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, npc),
-                                     "npc");
-        cpu_y = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, y), "y");
+        { &cpu_cc_op, offsetof(CPUSPARCState, cc_op), "cc_op" },
+        { &cpu_psr, offsetof(CPUSPARCState, psr), "psr" },
+    };
+
+    static const struct { TCGv *ptr; int off; const char *name; } rtl[] = {
+#ifdef TARGET_SPARC64
+        { &cpu_gsr, offsetof(CPUSPARCState, gsr), "gsr" },
+        { &cpu_tick_cmpr, offsetof(CPUSPARCState, tick_cmpr), "tick_cmpr" },
+        { &cpu_stick_cmpr, offsetof(CPUSPARCState, stick_cmpr), "stick_cmpr" },
+        { &cpu_hstick_cmpr, offsetof(CPUSPARCState, hstick_cmpr),
+          "hstick_cmpr" },
+        { &cpu_hintp, offsetof(CPUSPARCState, hintp), "hintp" },
+        { &cpu_htba, offsetof(CPUSPARCState, htba), "htba" },
+        { &cpu_hver, offsetof(CPUSPARCState, hver), "hver" },
+        { &cpu_ssr, offsetof(CPUSPARCState, ssr), "ssr" },
+        { &cpu_ver, offsetof(CPUSPARCState, version), "ver" },
+#endif
+        { &cpu_cond, offsetof(CPUSPARCState, cond), "cond" },
+        { &cpu_cc_src, offsetof(CPUSPARCState, cc_src), "cc_src" },
+        { &cpu_cc_src2, offsetof(CPUSPARCState, cc_src2), "cc_src2" },
+        { &cpu_cc_dst, offsetof(CPUSPARCState, cc_dst), "cc_dst" },
+        { &cpu_fsr, offsetof(CPUSPARCState, fsr), "fsr" },
+        { &cpu_pc, offsetof(CPUSPARCState, pc), "pc" },
+        { &cpu_npc, offsetof(CPUSPARCState, npc), "npc" },
+        { &cpu_y, offsetof(CPUSPARCState, y), "y" },
 #ifndef CONFIG_USER_ONLY
-        cpu_tbr = tcg_global_mem_new(cpu_env, offsetof(CPUSPARCState, tbr),
-                                     "tbr");
+        { &cpu_tbr, offsetof(CPUSPARCState, tbr), "tbr" },
 #endif
-        for (i = 1; i < 8; i++) {
-            cpu_gregs[i] = tcg_global_mem_new(cpu_env,
-                                              offsetof(CPUSPARCState, gregs[i]),
-                                              gregnames[i]);
-        }
-        for (i = 0; i < TARGET_DPREGS; i++) {
-            cpu_fpr[i] = tcg_global_mem_new_i64(cpu_env,
-                                                offsetof(CPUSPARCState, fpr[i]),
-                                                fregnames[i]);
-        }
+    };
+
+    unsigned int i;
+
+    /* init various static tables */
+    if (inited) {
+        return;
+    }
+    inited = 1;
+
+    cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
+
+    cpu_regwptr = tcg_global_mem_new_ptr(cpu_env,
+                                         offsetof(CPUSPARCState, regwptr),
+                                         "regwptr");
+
+    for (i = 0; i < ARRAY_SIZE(r32); ++i) {
+        *r32[i].ptr = tcg_global_mem_new_i32(cpu_env, r32[i].off, r32[i].name);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(rtl); ++i) {
+        *rtl[i].ptr = tcg_global_mem_new(cpu_env, rtl[i].off, rtl[i].name);
+    }
+
+    TCGV_UNUSED(cpu_regs[0]);
+    for (i = 1; i < 8; ++i) {
+        cpu_regs[i] = tcg_global_mem_new(cpu_env,
+                                         offsetof(CPUSPARCState, gregs[i]),
+                                         gregnames[i]);
+    }
+
+    for (i = 8; i < 32; ++i) {
+        cpu_regs[i] = tcg_global_mem_new(cpu_regwptr,
+                                         (i - 8) * sizeof(target_ulong),
+                                         gregnames[i]);
+    }
+
+    for (i = 0; i < TARGET_DPREGS; i++) {
+        cpu_fpr[i] = tcg_global_mem_new_i64(cpu_env,
+                                            offsetof(CPUSPARCState, fpr[i]),
+                                            fregnames[i]);
     }
 }
 
diff --git a/target-tilegx/cpu.h b/target-tilegx/cpu.h
index 03df107a67..022cad186a 100644
--- a/target-tilegx/cpu.h
+++ b/target-tilegx/cpu.h
@@ -19,7 +19,6 @@
 #ifndef CPU_TILEGX_H
 #define CPU_TILEGX_H
 
-#include "config.h"
 #include "qemu-common.h"
 
 #define TARGET_LONG_BITS 64
diff --git a/target-tricore/cpu.h b/target-tricore/cpu.h
index 20a12f3a40..be6f12170d 100644
--- a/target-tricore/cpu.h
+++ b/target-tricore/cpu.h
@@ -20,7 +20,6 @@
 #define __TRICORE_CPU_H__
 
 #include "tricore-defs.h"
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
diff --git a/target-unicore32/cpu.h b/target-unicore32/cpu.h
index 01c370c30d..9c1fbf9b77 100644
--- a/target-unicore32/cpu.h
+++ b/target-unicore32/cpu.h
@@ -19,7 +19,6 @@
 
 #define CPUArchState                struct CPUUniCore32State
 
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
diff --git a/target-xtensa/cpu.h b/target-xtensa/cpu.h
index 15ce0107d6..d0bd9dada8 100644
--- a/target-xtensa/cpu.h
+++ b/target-xtensa/cpu.h
@@ -33,7 +33,6 @@
 
 #define CPUArchState struct CPUXtensaState
 
-#include "config.h"
 #include "qemu-common.h"
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
diff --git a/tcg/README b/tcg/README
index 34c0775cff..f4a8ac170b 100644
--- a/tcg/README
+++ b/tcg/README
@@ -460,8 +460,9 @@ function tcg_gen_xxx(args).
 
 4) Backend
 
-tcg-target.h contains the target specific definitions. tcg-target.c
-contains the target specific code.
+tcg-target.h contains the target specific definitions. tcg-target.inc.c
+contains the target specific code; it is #included by tcg/tcg.c, rather
+than being a standalone C file.
 
 4.1) Assumptions
 
diff --git a/tcg/aarch64/tcg-target.c b/tcg/aarch64/tcg-target.inc.c
index 8467d5d8b9..0ed10a9741 100644
--- a/tcg/aarch64/tcg-target.c
+++ b/tcg/aarch64/tcg-target.inc.c
@@ -10,7 +10,6 @@
  * See the COPYING file in the top-level directory for details.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-ldst.h"
 #include "qemu/bitops.h"
 
diff --git a/tcg/arm/tcg-target.c b/tcg/arm/tcg-target.inc.c
index 146ac00f63..3edf6a6f97 100644
--- a/tcg/arm/tcg-target.c
+++ b/tcg/arm/tcg-target.inc.c
@@ -22,7 +22,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "elf.h"
 #include "tcg-be-ldst.h"
 
diff --git a/tcg/i386/tcg-target.c b/tcg/i386/tcg-target.inc.c
index d90636cb4e..9187d34caf 100644
--- a/tcg/i386/tcg-target.c
+++ b/tcg/i386/tcg-target.inc.c
@@ -22,7 +22,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-ldst.h"
 
 #ifndef NDEBUG
diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.inc.c
index 62d654943c..62d654943c 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.inc.c
diff --git a/tcg/mips/tcg-target.c b/tcg/mips/tcg-target.inc.c
index 2dc4998719..297bd00910 100644
--- a/tcg/mips/tcg-target.c
+++ b/tcg/mips/tcg-target.inc.c
@@ -24,7 +24,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-ldst.h"
 
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/tcg/ppc/tcg-target.c b/tcg/ppc/tcg-target.inc.c
index c593344db1..8c1c2dfa9b 100644
--- a/tcg/ppc/tcg-target.c
+++ b/tcg/ppc/tcg-target.inc.c
@@ -22,7 +22,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-ldst.h"
 
 #if defined _CALL_DARWIN || defined __APPLE__
diff --git a/tcg/s390/tcg-target.c b/tcg/s390/tcg-target.inc.c
index 58520fa22b..fbf97bb2e1 100644
--- a/tcg/s390/tcg-target.c
+++ b/tcg/s390/tcg-target.inc.c
@@ -24,7 +24,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-ldst.h"
 
 /* We only support generating code for 64-bit mode.  */
diff --git a/tcg/sparc/tcg-target.c b/tcg/sparc/tcg-target.inc.c
index d3100ab557..54df1bc424 100644
--- a/tcg/sparc/tcg-target.c
+++ b/tcg/sparc/tcg-target.inc.c
@@ -22,7 +22,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-null.h"
 
 #ifndef NDEBUG
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 0317c9e199..550671b94d 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -62,7 +62,8 @@
 #include "elf.h"
 #include "exec/log.h"
 
-/* Forward declarations for functions declared in tcg-target.c and used here. */
+/* Forward declarations for functions declared in tcg-target.inc.c and
+   used here. */
 static void tcg_target_init(TCGContext *s);
 static void tcg_target_qemu_prologue(TCGContext *s);
 static void patch_reloc(tcg_insn_unit *code_ptr, int type,
@@ -96,7 +97,7 @@ static void tcg_register_jit_int(void *buf, size_t size,
                                  size_t debug_frame_size)
     __attribute__((unused));
 
-/* Forward declarations for functions declared and used in tcg-target.c. */
+/* Forward declarations for functions declared and used in tcg-target.inc.c. */
 static int target_parse_constraint(TCGArgConstraint *ct, const char **pct_str);
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg1,
                        intptr_t arg2);
@@ -250,7 +251,7 @@ TCGLabel *gen_new_label(void)
     return l;
 }
 
-#include "tcg-target.c"
+#include "tcg-target.inc.c"
 
 /* pool based memory allocation */
 void *tcg_malloc_internal(TCGContext *s, int size)
@@ -318,6 +319,8 @@ static const TCGHelperInfo all_helpers[] = {
 #include "exec/helper-tcg.h"
 };
 
+static int indirect_reg_alloc_order[ARRAY_SIZE(tcg_target_reg_alloc_order)];
+
 void tcg_context_init(TCGContext *s)
 {
     int op, total_args, n, i;
@@ -360,6 +363,21 @@ void tcg_context_init(TCGContext *s)
     }
 
     tcg_target_init(s);
+
+    /* Reverse the order of the saved registers, assuming they're all at
+       the start of tcg_target_reg_alloc_order.  */
+    for (n = 0; n < ARRAY_SIZE(tcg_target_reg_alloc_order); ++n) {
+        int r = tcg_target_reg_alloc_order[n];
+        if (tcg_regset_test_reg(tcg_target_call_clobber_regs, r)) {
+            break;
+        }
+    }
+    for (i = 0; i < n; ++i) {
+        indirect_reg_alloc_order[i] = tcg_target_reg_alloc_order[n - 1 - i];
+    }
+    for (; i < ARRAY_SIZE(tcg_target_reg_alloc_order); ++i) {
+        indirect_reg_alloc_order[i] = tcg_target_reg_alloc_order[i];
+    }
 }
 
 void tcg_prologue_init(TCGContext *s)
@@ -506,17 +524,23 @@ int tcg_global_mem_new_internal(TCGType type, TCGv_ptr base,
     TCGContext *s = &tcg_ctx;
     TCGTemp *base_ts = &s->temps[GET_TCGV_PTR(base)];
     TCGTemp *ts = tcg_global_alloc(s);
-    int bigendian = 0;
+    int indirect_reg = 0, bigendian = 0;
 #ifdef HOST_WORDS_BIGENDIAN
     bigendian = 1;
 #endif
 
+    if (!base_ts->fixed_reg) {
+        indirect_reg = 1;
+        base_ts->indirect_base = 1;
+    }
+
     if (TCG_TARGET_REG_BITS == 32 && type == TCG_TYPE_I64) {
         TCGTemp *ts2 = tcg_global_alloc(s);
         char buf[64];
 
         ts->base_type = TCG_TYPE_I64;
         ts->type = TCG_TYPE_I32;
+        ts->indirect_reg = indirect_reg;
         ts->mem_allocated = 1;
         ts->mem_base = base_ts;
         ts->mem_offset = offset + bigendian * 4;
@@ -527,6 +551,7 @@ int tcg_global_mem_new_internal(TCGType type, TCGv_ptr base,
         tcg_debug_assert(ts2 == ts + 1);
         ts2->base_type = TCG_TYPE_I64;
         ts2->type = TCG_TYPE_I32;
+        ts2->indirect_reg = indirect_reg;
         ts2->mem_allocated = 1;
         ts2->mem_base = base_ts;
         ts2->mem_offset = offset + (1 - bigendian) * 4;
@@ -536,6 +561,7 @@ int tcg_global_mem_new_internal(TCGType type, TCGv_ptr base,
     } else {
         ts->base_type = type;
         ts->type = type;
+        ts->indirect_reg = indirect_reg;
         ts->mem_allocated = 1;
         ts->mem_base = base_ts;
         ts->mem_offset = offset;
@@ -1602,7 +1628,7 @@ static void dump_regs(TCGContext *s)
 
 static void check_regs(TCGContext *s)
 {
-    TCGReg reg;
+    int reg;
     int k;
     TCGTemp *ts;
     char buf[64];
@@ -1652,8 +1678,10 @@ static void temp_allocate_frame(TCGContext *s, int temp)
     s->current_frame_offset += sizeof(tcg_target_long);
 }
 
+static void temp_load(TCGContext *, TCGTemp *, TCGRegSet, TCGRegSet);
+
 /* sync register 'reg' by saving it to the corresponding temporary */
-static inline void tcg_reg_sync(TCGContext *s, TCGReg reg)
+static void tcg_reg_sync(TCGContext *s, TCGReg reg, TCGRegSet allocated_regs)
 {
     TCGTemp *ts = s->reg_to_temp[reg];
 
@@ -1661,6 +1689,11 @@ static inline void tcg_reg_sync(TCGContext *s, TCGReg reg)
     if (!ts->mem_coherent && !ts->fixed_reg) {
         if (!ts->mem_allocated) {
             temp_allocate_frame(s, temp_idx(s, ts));
+        } else if (ts->indirect_reg) {
+            tcg_regset_set_reg(allocated_regs, ts->reg);
+            temp_load(s, ts->mem_base,
+                      tcg_target_available_regs[TCG_TYPE_PTR],
+                      allocated_regs);
         }
         tcg_out_st(s, ts->type, reg, ts->mem_base->reg, ts->mem_offset);
     }
@@ -1668,38 +1701,41 @@ static inline void tcg_reg_sync(TCGContext *s, TCGReg reg)
 }
 
 /* free register 'reg' by spilling the corresponding temporary if necessary */
-static void tcg_reg_free(TCGContext *s, TCGReg reg)
+static void tcg_reg_free(TCGContext *s, TCGReg reg, TCGRegSet allocated_regs)
 {
     TCGTemp *ts = s->reg_to_temp[reg];
 
     if (ts != NULL) {
-        tcg_reg_sync(s, reg);
+        tcg_reg_sync(s, reg, allocated_regs);
         ts->val_type = TEMP_VAL_MEM;
         s->reg_to_temp[reg] = NULL;
     }
 }
 
 /* Allocate a register belonging to reg1 & ~reg2 */
-static TCGReg tcg_reg_alloc(TCGContext *s, TCGRegSet reg1, TCGRegSet reg2)
+static TCGReg tcg_reg_alloc(TCGContext *s, TCGRegSet desired_regs,
+                            TCGRegSet allocated_regs, bool rev)
 {
-    int i;
+    int i, n = ARRAY_SIZE(tcg_target_reg_alloc_order);
+    const int *order;
     TCGReg reg;
     TCGRegSet reg_ct;
 
-    tcg_regset_andnot(reg_ct, reg1, reg2);
+    tcg_regset_andnot(reg_ct, desired_regs, allocated_regs);
+    order = rev ? indirect_reg_alloc_order : tcg_target_reg_alloc_order;
 
     /* first try free registers */
-    for(i = 0; i < ARRAY_SIZE(tcg_target_reg_alloc_order); i++) {
-        reg = tcg_target_reg_alloc_order[i];
+    for(i = 0; i < n; i++) {
+        reg = order[i];
         if (tcg_regset_test_reg(reg_ct, reg) && s->reg_to_temp[reg] == NULL)
             return reg;
     }
 
     /* XXX: do better spill choice */
-    for(i = 0; i < ARRAY_SIZE(tcg_target_reg_alloc_order); i++) {
-        reg = tcg_target_reg_alloc_order[i];
+    for(i = 0; i < n; i++) {
+        reg = order[i];
         if (tcg_regset_test_reg(reg_ct, reg)) {
-            tcg_reg_free(s, reg);
+            tcg_reg_free(s, reg, allocated_regs);
             return reg;
         }
     }
@@ -1718,12 +1754,18 @@ static void temp_load(TCGContext *s, TCGTemp *ts, TCGRegSet desired_regs,
     case TEMP_VAL_REG:
         return;
     case TEMP_VAL_CONST:
-        reg = tcg_reg_alloc(s, desired_regs, allocated_regs);
+        reg = tcg_reg_alloc(s, desired_regs, allocated_regs, ts->indirect_base);
         tcg_out_movi(s, ts->type, reg, ts->val);
         ts->mem_coherent = 0;
         break;
     case TEMP_VAL_MEM:
-        reg = tcg_reg_alloc(s, desired_regs, allocated_regs);
+        reg = tcg_reg_alloc(s, desired_regs, allocated_regs, ts->indirect_base);
+        if (ts->indirect_reg) {
+            tcg_regset_set_reg(allocated_regs, reg);
+            temp_load(s, ts->mem_base,
+                      tcg_target_available_regs[TCG_TYPE_PTR],
+                      allocated_regs);
+        }
         tcg_out_ld(s, ts->type, reg, ts->mem_base->reg, ts->mem_offset);
         ts->mem_coherent = 1;
         break;
@@ -1761,7 +1803,7 @@ static void temp_sync(TCGContext *s, TCGTemp *ts, TCGRegSet allocated_regs)
         temp_load(s, ts, tcg_target_available_regs[ts->type], allocated_regs);
         /* fallthrough */
     case TEMP_VAL_REG:
-        tcg_reg_sync(s, ts->reg);
+        tcg_reg_sync(s, ts->reg, allocated_regs);
         break;
     case TEMP_VAL_DEAD:
     case TEMP_VAL_MEM:
@@ -1777,13 +1819,16 @@ static inline void temp_save(TCGContext *s, TCGTemp *ts,
                              TCGRegSet allocated_regs)
 {
 #ifdef USE_LIVENESS_ANALYSIS
-    /* The liveness analysis already ensures that globals are back
-       in memory. Keep an assert for safety. */
-    tcg_debug_assert(ts->val_type == TEMP_VAL_MEM || ts->fixed_reg);
-#else
+    /* ??? Liveness does not yet incorporate indirect bases.  */
+    if (!ts->indirect_base) {
+        /* The liveness analysis already ensures that globals are back
+           in memory. Keep an assert for safety. */
+        tcg_debug_assert(ts->val_type == TEMP_VAL_MEM || ts->fixed_reg);
+        return;
+    }
+#endif
     temp_sync(s, ts, allocated_regs);
     temp_dead(s, ts);
-#endif
 }
 
 /* save globals to their canonical location and assume they can be
@@ -1808,12 +1853,15 @@ static void sync_globals(TCGContext *s, TCGRegSet allocated_regs)
     for (i = 0; i < s->nb_globals; i++) {
         TCGTemp *ts = &s->temps[i];
 #ifdef USE_LIVENESS_ANALYSIS
-        tcg_debug_assert(ts->val_type != TEMP_VAL_REG
-                         || ts->fixed_reg
-                         || ts->mem_coherent);
-#else
-        temp_sync(s, ts, allocated_regs);
+        /* ??? Liveness does not yet incorporate indirect bases.  */
+        if (!ts->indirect_base) {
+            tcg_debug_assert(ts->val_type != TEMP_VAL_REG
+                             || ts->fixed_reg
+                             || ts->mem_coherent);
+            continue;
+        }
 #endif
+        temp_sync(s, ts, allocated_regs);
     }
 }
 
@@ -1829,12 +1877,15 @@ static void tcg_reg_alloc_bb_end(TCGContext *s, TCGRegSet allocated_regs)
             temp_save(s, ts, allocated_regs);
         } else {
 #ifdef USE_LIVENESS_ANALYSIS
-            /* The liveness analysis already ensures that temps are dead.
-               Keep an assert for safety. */
-            assert(ts->val_type == TEMP_VAL_DEAD);
-#else
-            temp_dead(s, ts);
+            /* ??? Liveness does not yet incorporate indirect bases.  */
+            if (!ts->indirect_base) {
+                /* The liveness analysis already ensures that temps are dead.
+                   Keep an assert for safety. */
+                assert(ts->val_type == TEMP_VAL_DEAD);
+                continue;
+            }
 #endif
+            temp_dead(s, ts);
         }
     }
 
@@ -1907,6 +1958,12 @@ static void tcg_reg_alloc_mov(TCGContext *s, const TCGOpDef *def,
         if (!ots->mem_allocated) {
             temp_allocate_frame(s, args[0]);
         }
+        if (ots->indirect_reg) {
+            tcg_regset_set_reg(allocated_regs, ts->reg);
+            temp_load(s, ots->mem_base,
+                      tcg_target_available_regs[TCG_TYPE_PTR],
+                      allocated_regs);
+        }
         tcg_out_st(s, otype, ts->reg, ots->mem_base->reg, ots->mem_offset);
         if (IS_DEAD_ARG(1)) {
             temp_dead(s, ts);
@@ -1939,7 +1996,7 @@ static void tcg_reg_alloc_mov(TCGContext *s, const TCGOpDef *def,
                    input one. */
                 tcg_regset_set_reg(allocated_regs, ts->reg);
                 ots->reg = tcg_reg_alloc(s, tcg_target_available_regs[otype],
-                                         allocated_regs);
+                                         allocated_regs, ots->indirect_base);
             }
             tcg_out_mov(s, otype, ots->reg, ts->reg);
         }
@@ -1947,7 +2004,7 @@ static void tcg_reg_alloc_mov(TCGContext *s, const TCGOpDef *def,
         ots->mem_coherent = 0;
         s->reg_to_temp[ots->reg] = ots;
         if (NEED_SYNC_ARG(0)) {
-            tcg_reg_sync(s, ots->reg);
+            tcg_reg_sync(s, ots->reg, allocated_regs);
         }
     }
 }
@@ -2024,7 +2081,8 @@ static void tcg_reg_alloc_op(TCGContext *s,
         allocate_in_reg:
             /* allocate a new register matching the constraint 
                and move the temporary register into it */
-            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+            reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs,
+                                ts->indirect_base);
             tcg_out_mov(s, ts->type, reg, ts->reg);
         }
         new_args[i] = reg;
@@ -2047,7 +2105,7 @@ static void tcg_reg_alloc_op(TCGContext *s,
             /* XXX: permit generic clobber register list ? */ 
             for (i = 0; i < TCG_TARGET_NB_REGS; i++) {
                 if (tcg_regset_test_reg(tcg_target_call_clobber_regs, i)) {
-                    tcg_reg_free(s, i);
+                    tcg_reg_free(s, i, allocated_regs);
                 }
             }
         }
@@ -2073,7 +2131,8 @@ static void tcg_reg_alloc_op(TCGContext *s,
                     tcg_regset_test_reg(arg_ct->u.regs, reg)) {
                     goto oarg_end;
                 }
-                reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs);
+                reg = tcg_reg_alloc(s, arg_ct->u.regs, allocated_regs,
+                                    ts->indirect_base);
             }
             tcg_regset_set_reg(allocated_regs, reg);
             /* if a fixed register is used, then a move will be done afterwards */
@@ -2104,7 +2163,7 @@ static void tcg_reg_alloc_op(TCGContext *s,
             tcg_out_mov(s, ts->type, ts->reg, reg);
         }
         if (NEED_SYNC_ARG(i)) {
-            tcg_reg_sync(s, reg);
+            tcg_reg_sync(s, reg, allocated_regs);
         }
         if (IS_DEAD_ARG(i)) {
             temp_dead(s, ts);
@@ -2175,7 +2234,7 @@ static void tcg_reg_alloc_call(TCGContext *s, int nb_oargs, int nb_iargs,
         if (arg != TCG_CALL_DUMMY_ARG) {
             ts = &s->temps[arg];
             reg = tcg_target_call_iarg_regs[i];
-            tcg_reg_free(s, reg);
+            tcg_reg_free(s, reg, allocated_regs);
 
             if (ts->val_type == TEMP_VAL_REG) {
                 if (ts->reg != reg) {
@@ -2203,7 +2262,7 @@ static void tcg_reg_alloc_call(TCGContext *s, int nb_oargs, int nb_iargs,
     /* clobber call registers */
     for (i = 0; i < TCG_TARGET_NB_REGS; i++) {
         if (tcg_regset_test_reg(tcg_target_call_clobber_regs, i)) {
-            tcg_reg_free(s, i);
+            tcg_reg_free(s, i, allocated_regs);
         }
     }
 
@@ -2239,7 +2298,7 @@ static void tcg_reg_alloc_call(TCGContext *s, int nb_oargs, int nb_iargs,
             ts->mem_coherent = 0;
             s->reg_to_temp[reg] = ts;
             if (NEED_SYNC_ARG(i)) {
-                tcg_reg_sync(s, reg);
+                tcg_reg_sync(s, reg, allocated_regs);
             }
             if (IS_DEAD_ARG(i)) {
                 temp_dead(s, ts);
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 83da5fb3f0..c45329a7cb 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -453,6 +453,8 @@ typedef struct TCGTemp {
     TCGType base_type:8;
     TCGType type:8;
     unsigned int fixed_reg:1;
+    unsigned int indirect_reg:1;
+    unsigned int indirect_base:1;
     unsigned int mem_coherent:1;
     unsigned int mem_allocated:1;
     unsigned int temp_local:1; /* If true, the temp is saved across
@@ -566,7 +568,7 @@ struct TCGContext {
 
     TBContext tb_ctx;
 
-    /* The TCGBackendData structure is private to tcg-target.c.  */
+    /* The TCGBackendData structure is private to tcg-target.inc.c.  */
     struct TCGBackendData *be;
 
     TCGTempSet free_temps[TCG_TYPE_COUNT * 2];
diff --git a/tcg/tci/README b/tcg/tci/README
index dc57f076b5..3786b0915b 100644
--- a/tcg/tci/README
+++ b/tcg/tci/README
@@ -21,7 +21,7 @@ This is what TCI (Tiny Code Interpreter) does.
 2) Implementation
 
 Like each TCG host frontend, TCI implements the code generator in
-tcg-target.c, tcg-target.h. Both files are in directory tcg/tci.
+tcg-target.inc.c, tcg-target.h. Both files are in directory tcg/tci.
 
 The additional file tcg/tci.c adds the interpreter.
 
@@ -123,7 +123,7 @@ u1 = linux-user-test works
   would also improve speed for hosts which support byte alignment).
 
 * A better disassembler for the pseudo code would be nice (a very primitive
-  disassembler is included in tcg-target.c).
+  disassembler is included in tcg-target.inc.c).
 
 * It might be useful to have a runtime option which selects the native TCG
   or TCI, so QEMU would have to include two TCGs. Today, selecting TCI
diff --git a/tcg/tci/tcg-target.h b/tcg/tci/tcg-target.h
index 77e5952781..3942f9cccf 100644
--- a/tcg/tci/tcg-target.h
+++ b/tcg/tci/tcg-target.h
@@ -40,7 +40,6 @@
 #if !defined(TCG_TARGET_H)
 #define TCG_TARGET_H
 
-#include "config-host.h"
 
 #define TCG_TARGET_INTERPRETER 1
 #define TCG_TARGET_INSN_UNIT_SIZE 1
diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.inc.c
index 16ce048361..4afe4d7a8d 100644
--- a/tcg/tci/tcg-target.c
+++ b/tcg/tci/tcg-target.inc.c
@@ -22,7 +22,6 @@
  * THE SOFTWARE.
  */
 
-#include "qemu/osdep.h"
 #include "tcg-be-null.h"
 
 /* TODO list:
diff --git a/tests/boot-sector.c b/tests/boot-sector.c
index 0b48bb34bf..3ffe2987ff 100644
--- a/tests/boot-sector.c
+++ b/tests/boot-sector.c
@@ -10,9 +10,8 @@
  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  * See the COPYING file in the top-level directory.
  */
+#include "qemu/osdep.h"
 #include "boot-sector.h"
-#include <string.h>
-#include <stdio.h>
 #include "qemu-common.h"
 #include "libqtest.h"
 
diff --git a/tests/libqos/ahci.h b/tests/libqos/ahci.h
index 69dc4d7ca9..71dd7a6e5a 100644
--- a/tests/libqos/ahci.h
+++ b/tests/libqos/ahci.h
@@ -25,9 +25,6 @@
  * THE SOFTWARE.
  */
 
-#include <stdint.h>
-#include <stdlib.h>
-#include <stdbool.h>
 #include "libqos/libqos.h"
 #include "libqos/pci.h"
 #include "libqos/malloc-pc.h"
diff --git a/tests/libqos/fw_cfg.h b/tests/libqos/fw_cfg.h
index 61b1548b4e..e8371b2317 100644
--- a/tests/libqos/fw_cfg.h
+++ b/tests/libqos/fw_cfg.h
@@ -13,8 +13,6 @@
 #ifndef LIBQOS_FW_CFG_H
 #define LIBQOS_FW_CFG_H
 
-#include <stdint.h>
-#include <sys/types.h>
 
 typedef struct QFWCFG QFWCFG;
 
diff --git a/tests/libqos/i2c.h b/tests/libqos/i2c.h
index c21f1dcbd5..6e648f922a 100644
--- a/tests/libqos/i2c.h
+++ b/tests/libqos/i2c.h
@@ -9,7 +9,6 @@
 #ifndef LIBQOS_I2C_H
 #define LIBQOS_I2C_H
 
-#include <stdint.h>
 
 typedef struct I2CAdapter I2CAdapter;
 struct I2CAdapter {
diff --git a/tests/libqos/malloc.h b/tests/libqos/malloc.h
index 0c6c9b7f30..ae9dac8f61 100644
--- a/tests/libqos/malloc.h
+++ b/tests/libqos/malloc.h
@@ -13,8 +13,6 @@
 #ifndef LIBQOS_MALLOC_H
 #define LIBQOS_MALLOC_H
 
-#include <stdint.h>
-#include <sys/types.h>
 #include "qemu/queue.h"
 
 typedef enum {
diff --git a/tests/libqos/pci.h b/tests/libqos/pci.h
index dfaee9ec37..c06add8dbf 100644
--- a/tests/libqos/pci.h
+++ b/tests/libqos/pci.h
@@ -13,7 +13,6 @@
 #ifndef LIBQOS_PCI_H
 #define LIBQOS_PCI_H
 
-#include <stdint.h>
 #include "libqtest.h"
 
 #define QPCI_DEVFN(dev, fn) (((dev) << 3) | (fn))
diff --git a/tests/libqtest.h b/tests/libqtest.h
index ebdd5bbe53..37f37adbf7 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -17,13 +17,7 @@
 #ifndef LIBQTEST_H
 #define LIBQTEST_H
 
-#include <stddef.h>
-#include <stdint.h>
-#include <stdbool.h>
-#include <stdarg.h>
-#include <sys/types.h>
 #include "qapi/qmp/qdict.h"
-#include "glib-compat.h"
 
 typedef struct QTestState QTestState;
 
diff --git a/tests/pxe-test.c b/tests/pxe-test.c
index fa430958ea..875e4c4a26 100644
--- a/tests/pxe-test.c
+++ b/tests/pxe-test.c
@@ -11,8 +11,7 @@
  * See the COPYING file in the top-level directory.
  */
 
-#include <string.h>
-#include <stdio.h>
+#include "qemu/osdep.h"
 #include <glib.h>
 #include <glib/gstdio.h>
 #include "qemu-common.h"
diff --git a/trace/control-internal.h b/trace/control-internal.h
index 07cb1c1685..dcf67f505a 100644
--- a/trace/control-internal.h
+++ b/trace/control-internal.h
@@ -10,7 +10,6 @@
 #ifndef TRACE__CONTROL_INTERNAL_H
 #define TRACE__CONTROL_INTERNAL_H
 
-#include <string.h>
 
 
 extern TraceEvent trace_events[];
diff --git a/trace/ftrace.h b/trace/ftrace.h
index 863e052e90..92372e3caa 100644
--- a/trace/ftrace.h
+++ b/trace/ftrace.h
@@ -1,7 +1,6 @@
 #ifndef TRACE_FTRACE_H
 #define TRACE_FTRACE_H
 
-#include <stdbool.h>
 
 
 #define MAX_TRACE_STRLEN 512
diff --git a/trace/simple.h b/trace/simple.h
index 8d1a32eba0..1e7de45575 100644
--- a/trace/simple.h
+++ b/trace/simple.h
@@ -11,9 +11,6 @@
 #ifndef TRACE_SIMPLE_H
 #define TRACE_SIMPLE_H
 
-#include <stdint.h>
-#include <stdbool.h>
-#include <stdio.h>
 
 #include "trace/generated-events.h"
 
diff --git a/ui/egl-helpers.c b/ui/egl-helpers.c
index 4c83834615..54be44ccea 100644
--- a/ui/egl-helpers.c
+++ b/ui/egl-helpers.c
@@ -1,6 +1,8 @@
 #include "qemu/osdep.h"
 #include <glob.h>
+#include <dirent.h>
 
+#include "config-host.h"
 #include "ui/egl-helpers.h"
 
 EGLDisplay *qemu_egl_display;
@@ -20,6 +22,133 @@ static int egl_debug;
 
 /* ---------------------------------------------------------------------- */
 
+#ifdef CONFIG_OPENGL_DMABUF
+
+int qemu_egl_rn_fd;
+struct gbm_device *qemu_egl_rn_gbm_dev;
+EGLContext qemu_egl_rn_ctx;
+
+int qemu_egl_rendernode_open(void)
+{
+    DIR *dir;
+    struct dirent *e;
+    int r, fd;
+    char *p;
+
+    dir = opendir("/dev/dri");
+    if (!dir) {
+        return -1;
+    }
+
+    fd = -1;
+    while ((e = readdir(dir))) {
+        if (e->d_type != DT_CHR) {
+            continue;
+        }
+
+        if (strncmp(e->d_name, "renderD", 7)) {
+            continue;
+        }
+
+        r = asprintf(&p, "/dev/dri/%s", e->d_name);
+        if (r < 0) {
+            return -1;
+        }
+
+        r = open(p, O_RDWR | O_CLOEXEC | O_NOCTTY | O_NONBLOCK);
+        if (r < 0) {
+            free(p);
+            continue;
+        }
+        fd = r;
+        free(p);
+        break;
+    }
+
+    closedir(dir);
+    if (fd < 0) {
+        return -1;
+    }
+    return fd;
+}
+
+int egl_rendernode_init(void)
+{
+    qemu_egl_rn_fd = -1;
+
+    qemu_egl_rn_fd = qemu_egl_rendernode_open();
+    if (qemu_egl_rn_fd == -1) {
+        fprintf(stderr, "egl: no drm render node available\n");
+        goto err;
+    }
+
+    qemu_egl_rn_gbm_dev = gbm_create_device(qemu_egl_rn_fd);
+    if (!qemu_egl_rn_gbm_dev) {
+        fprintf(stderr, "egl: gbm_create_device failed\n");
+        goto err;
+    }
+
+    qemu_egl_init_dpy((EGLNativeDisplayType)qemu_egl_rn_gbm_dev, false, false);
+
+    if (!epoxy_has_egl_extension(qemu_egl_display,
+                                 "EGL_KHR_surfaceless_context")) {
+        fprintf(stderr, "egl: EGL_KHR_surfaceless_context not supported\n");
+        goto err;
+    }
+    if (!epoxy_has_egl_extension(qemu_egl_display,
+                                 "EGL_MESA_image_dma_buf_export")) {
+        fprintf(stderr, "egl: EGL_MESA_image_dma_buf_export not supported\n");
+        goto err;
+    }
+
+    qemu_egl_rn_ctx = qemu_egl_init_ctx();
+    if (!qemu_egl_rn_ctx) {
+        fprintf(stderr, "egl: egl_init_ctx failed\n");
+        goto err;
+    }
+
+    return 0;
+
+err:
+    if (qemu_egl_rn_gbm_dev) {
+        gbm_device_destroy(qemu_egl_rn_gbm_dev);
+    }
+    if (qemu_egl_rn_fd != -1) {
+        close(qemu_egl_rn_fd);
+    }
+
+    return -1;
+}
+
+int egl_get_fd_for_texture(uint32_t tex_id, EGLint *stride, EGLint *fourcc)
+{
+    EGLImageKHR image;
+    EGLint num_planes, fd;
+
+    image = eglCreateImageKHR(qemu_egl_display, eglGetCurrentContext(),
+                              EGL_GL_TEXTURE_2D_KHR,
+                              (EGLClientBuffer)(unsigned long)tex_id,
+                              NULL);
+    if (!image) {
+        return -1;
+    }
+
+    eglExportDMABUFImageQueryMESA(qemu_egl_display, image, fourcc,
+                                  &num_planes, NULL);
+    if (num_planes != 1) {
+        eglDestroyImageKHR(qemu_egl_display, image);
+        return -1;
+    }
+    eglExportDMABUFImageMESA(qemu_egl_display, image, &fd, stride, NULL);
+    eglDestroyImageKHR(qemu_egl_display, image);
+
+    return fd;
+}
+
+#endif /* CONFIG_OPENGL_DMABUF */
+
+/* ---------------------------------------------------------------------- */
+
 EGLSurface qemu_egl_init_surface_x11(EGLContext ectx, Window win)
 {
     EGLSurface esurface;
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 4dbd99ab19..a68a665a9a 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -494,9 +494,14 @@ static QemuOptsList qemu_spice_opts = {
         },{
             .name = "playback-compression",
             .type = QEMU_OPT_BOOL,
-        }, {
+        },{
             .name = "seamless-migration",
             .type = QEMU_OPT_BOOL,
+#ifdef HAVE_SPICE_GL
+        },{
+            .name = "gl",
+            .type = QEMU_OPT_BOOL,
+#endif
         },
         { /* end of list */ }
     },
@@ -568,7 +573,8 @@ static void migration_state_notifier(Notifier *notifier, void *data)
 
     if (migration_in_setup(s)) {
         spice_server_migrate_start(spice_server);
-    } else if (migration_has_finished(s)) {
+    } else if (migration_has_finished(s) ||
+               migration_in_postcopy_after_devices(s)) {
         spice_server_migrate_end(spice_server, true);
         spice_have_target_host = false;
     } else if (migration_has_failed(s)) {
@@ -819,6 +825,14 @@ void qemu_spice_init(void)
 #if SPICE_SERVER_VERSION >= 0x000c02
     qemu_spice_register_ports();
 #endif
+
+#ifdef HAVE_SPICE_GL
+    if (qemu_opt_get_bool(opts, "gl", 0)) {
+        if (egl_rendernode_init() == 0) {
+            display_opengl = 1;
+        }
+    }
+#endif
 }
 
 int qemu_spice_add_interface(SpiceBaseInstance *sin)
diff --git a/ui/spice-display.c b/ui/spice-display.c
index 8a5b3258bd..242ab5f468 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -460,6 +460,13 @@ void qemu_spice_display_switch(SimpleSpiceDisplay *ssd,
 
     memset(&ssd->dirty, 0, sizeof(ssd->dirty));
     ssd->notify++;
+
+    qemu_mutex_lock(&ssd->lock);
+    if (ssd->cursor) {
+        g_free(ssd->ptr_define);
+        ssd->ptr_define = qemu_spice_create_cursor_update(ssd, ssd->cursor, 0);
+    }
+    qemu_mutex_unlock(&ssd->lock);
 }
 
 static void qemu_spice_cursor_refresh_unlocked(SimpleSpiceDisplay *ssd)
@@ -467,8 +474,6 @@ static void qemu_spice_cursor_refresh_unlocked(SimpleSpiceDisplay *ssd)
     if (ssd->cursor) {
         assert(ssd->dcl.con);
         dpy_cursor_define(ssd->dcl.con, ssd->cursor);
-        cursor_put(ssd->cursor);
-        ssd->cursor = NULL;
     }
     if (ssd->mouse_x != -1 && ssd->mouse_y != -1) {
         assert(ssd->dcl.con);
@@ -563,7 +568,7 @@ static int interface_get_command(QXLInstance *sin, QXLCommandExt *ext)
 
 static int interface_req_cmd_notification(QXLInstance *sin)
 {
-    dprint(1, "%s/%d:\n", __func__, sin->id);
+    dprint(2, "%s/%d:\n", __func__, sin->id);
     return 1;
 }
 
@@ -616,7 +621,7 @@ static int interface_get_cursor_command(QXLInstance *sin, QXLCommandExt *ext)
 
 static int interface_req_cursor_notification(QXLInstance *sin)
 {
-    dprint(1, "%s:\n", __FUNCTION__);
+    dprint(2, "%s:\n", __func__);
     return 1;
 }
 
@@ -645,9 +650,23 @@ static void interface_update_area_complete(QXLInstance *sin,
 /* called from spice server thread context only */
 static void interface_async_complete(QXLInstance *sin, uint64_t cookie_token)
 {
-    /* should never be called, used in qxl native mode only */
-    fprintf(stderr, "%s: abort()\n", __func__);
-    abort();
+    QXLCookie *cookie = (QXLCookie *)(uintptr_t)cookie_token;
+
+    switch (cookie->type) {
+#ifdef HAVE_SPICE_GL
+    case QXL_COOKIE_TYPE_GL_DRAW_DONE:
+    {
+        SimpleSpiceDisplay *ssd = container_of(sin, SimpleSpiceDisplay, qxl);
+        qemu_bh_schedule(ssd->gl_unblock_bh);
+        break;
+    }
+#endif
+    default:
+        /* should never be called, used in qxl native mode only */
+        fprintf(stderr, "%s: abort()\n", __func__);
+        abort();
+    }
+    g_free(cookie);
 }
 
 static void interface_set_client_capabilities(QXLInstance *sin,
@@ -750,6 +769,11 @@ static void display_mouse_define(DisplayChangeListener *dcl,
     SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
 
     qemu_mutex_lock(&ssd->lock);
+    if (c) {
+        cursor_get(c);
+    }
+    cursor_put(ssd->cursor);
+    ssd->cursor = c;
     ssd->hot_x = c->hot_x;
     ssd->hot_y = c->hot_y;
     g_free(ssd->ptr_move);
@@ -769,20 +793,128 @@ static const DisplayChangeListenerOps display_listener_ops = {
     .dpy_cursor_define    = display_mouse_define,
 };
 
+#ifdef HAVE_SPICE_GL
+
+static void qemu_spice_gl_block(SimpleSpiceDisplay *ssd, bool block)
+{
+    uint64_t timeout;
+
+    if (block) {
+        timeout = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
+        timeout += 1000; /* one sec */
+        timer_mod(ssd->gl_unblock_timer, timeout);
+    } else {
+        timer_del(ssd->gl_unblock_timer);
+    }
+    graphic_hw_gl_block(ssd->dcl.con, block);
+}
+
+static void qemu_spice_gl_unblock_bh(void *opaque)
+{
+    SimpleSpiceDisplay *ssd = opaque;
+
+    qemu_spice_gl_block(ssd, false);
+}
+
+static void qemu_spice_gl_block_timer(void *opaque)
+{
+    fprintf(stderr, "WARNING: spice: no gl-draw-done within one second\n");
+}
+
+static QEMUGLContext qemu_spice_gl_create_context(DisplayChangeListener *dcl,
+                                                  QEMUGLParams *params)
+{
+    eglMakeCurrent(qemu_egl_display, EGL_NO_SURFACE, EGL_NO_SURFACE,
+                   qemu_egl_rn_ctx);
+    return qemu_egl_create_context(dcl, params);
+}
+
+static void qemu_spice_gl_scanout(DisplayChangeListener *dcl,
+                                  uint32_t tex_id,
+                                  bool y_0_top,
+                                  uint32_t x, uint32_t y,
+                                  uint32_t w, uint32_t h)
+{
+    SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
+    EGLint stride = 0, fourcc = 0;
+    int fd = -1;
+
+    if (tex_id) {
+        fd = egl_get_fd_for_texture(tex_id, &stride, &fourcc);
+        if (fd < 0) {
+            fprintf(stderr, "%s: failed to get fd for texture\n", __func__);
+            return;
+        }
+        dprint(1, "%s: %dx%d (stride %d, fourcc 0x%x)\n", __func__,
+               w, h, stride, fourcc);
+    } else {
+        dprint(1, "%s: no texture (no framebuffer)\n", __func__);
+    }
+
+    assert(!tex_id || fd >= 0);
+
+    /* note: spice server will close the fd */
+    spice_qxl_gl_scanout(&ssd->qxl, fd,
+                         surface_width(ssd->ds),
+                         surface_height(ssd->ds),
+                         stride, fourcc, y_0_top);
+}
+
+static void qemu_spice_gl_update(DisplayChangeListener *dcl,
+                                 uint32_t x, uint32_t y, uint32_t w, uint32_t h)
+{
+    SimpleSpiceDisplay *ssd = container_of(dcl, SimpleSpiceDisplay, dcl);
+    uint64_t cookie;
+
+    dprint(2, "%s: %dx%d+%d+%d\n", __func__, w, h, x, y);
+    qemu_spice_gl_block(ssd, true);
+    cookie = (uintptr_t)qxl_cookie_new(QXL_COOKIE_TYPE_GL_DRAW_DONE, 0);
+    spice_qxl_gl_draw_async(&ssd->qxl, x, y, w, h, cookie);
+}
+
+static const DisplayChangeListenerOps display_listener_gl_ops = {
+    .dpy_name             = "spice-egl",
+    .dpy_gfx_update       = display_update,
+    .dpy_gfx_switch       = display_switch,
+    .dpy_gfx_check_format = qemu_pixman_check_format,
+    .dpy_refresh          = display_refresh,
+    .dpy_mouse_set        = display_mouse_set,
+    .dpy_cursor_define    = display_mouse_define,
+
+    .dpy_gl_ctx_create       = qemu_spice_gl_create_context,
+    .dpy_gl_ctx_destroy      = qemu_egl_destroy_context,
+    .dpy_gl_ctx_make_current = qemu_egl_make_context_current,
+    .dpy_gl_ctx_get_current  = qemu_egl_get_current_context,
+
+    .dpy_gl_scanout          = qemu_spice_gl_scanout,
+    .dpy_gl_update           = qemu_spice_gl_update,
+};
+
+#endif /* HAVE_SPICE_GL */
+
 static void qemu_spice_display_init_one(QemuConsole *con)
 {
     SimpleSpiceDisplay *ssd = g_new0(SimpleSpiceDisplay, 1);
 
     qemu_spice_display_init_common(ssd);
 
+    ssd->dcl.ops = &display_listener_ops;
+#ifdef HAVE_SPICE_GL
+    if (display_opengl) {
+        ssd->dcl.ops = &display_listener_gl_ops;
+        ssd->dmabuf_fd = -1;
+        ssd->gl_unblock_bh = qemu_bh_new(qemu_spice_gl_unblock_bh, ssd);
+        ssd->gl_unblock_timer = timer_new_ms(QEMU_CLOCK_REALTIME,
+                                             qemu_spice_gl_block_timer, ssd);
+    }
+#endif
+    ssd->dcl.con = con;
+
     ssd->qxl.base.sif = &dpy_interface.base;
     qemu_spice_add_display_interface(&ssd->qxl, con);
     assert(ssd->worker);
-
     qemu_spice_create_host_memslot(ssd);
 
-    ssd->dcl.ops = &display_listener_ops;
-    ssd->dcl.con = con;
     register_displaychangelistener(&ssd->dcl);
 }
 
diff --git a/ui/vnc-palette.h b/ui/vnc-palette.h
index d02f0236c1..1bd4318f53 100644
--- a/ui/vnc-palette.h
+++ b/ui/vnc-palette.h
@@ -31,8 +31,6 @@
 
 #include "qapi/qmp/qlist.h"
 #include "qemu/queue.h"
-#include <stdint.h>
-#include <stdbool.h>
 
 #define VNC_PALETTE_HASH_SIZE 256
 #define VNC_PALETTE_MAX_SIZE  256
diff --git a/ui/vnc.h b/ui/vnc.h
index a95cc15678..81a326116b 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -38,7 +38,6 @@
 #include "io/channel-socket.h"
 #include "io/channel-tls.h"
 #include <zlib.h>
-#include <stdbool.h>
 
 #include "keymaps.h"
 #include "vnc-palette.h"