working log added

7 files changed, 515 insertions, 92 deletions

diff --git a/.vscode/configurationCache.log b/.vscode/configurationCache.log
index 906e5338ae..cf010e28a6 100644
--- a/.vscode/configurationCache.log
+++ b/.vscode/configurationCache.log
@@ -1 +1 @@
-{"buildTargets":["/home/xcd/qemu_uintr/qemu/docker-src.2022-05-03-04.14.13.74731","FORCE","Makefile","TAGS","all","check-help","clean","config-host.mak","configure","cscope","ctags","dist","distclean","docker","docker-all-tests","docker-clean","docker-exec-copy-test","docker-help","docker-image","docker-image-alpine","docker-image-debian-all-test-cross","docker-image-debian-alpha-cross","docker-image-debian-amd64","docker-image-debian-armel-cross","docker-image-debian-armhf-cross","docker-image-debian-hexagon-cross","docker-image-debian-hppa-cross","docker-image-debian-m68k-cross","docker-image-debian-microblaze-cross","docker-image-debian-mips-cross","docker-image-debian-mips64-cross","docker-image-debian-mips64el-cross","docker-image-debian-mipsel-cross","docker-image-debian-native","docker-image-debian-nios2-cross","docker-image-debian-powerpc-test-cross","docker-image-debian-ppc64el-cross","docker-image-debian-riscv64-test-cross","docker-image-debian-sh4-cross","docker-image-debian-sparc64-cross","docker-image-debian-tricore-cross","docker-image-debian10","docker-image-debian11","docker-qemu-src","docker-run","docker-test","docker-test-block","docker-test-block@alpine","docker-test-block@centos8","docker-test-block@debian-all-test-cross","docker-test-block@debian-amd64","docker-test-block@debian-arm64-cross","docker-test-block@debian-armel-cross","docker-test-block@debian-armhf-cross","docker-test-block@debian-hexagon-cross","docker-test-block@debian-mips-cross","docker-test-block@debian-mips64el-cross","docker-test-block@debian-mipsel-cross","docker-test-block@debian-native","docker-test-block@debian-ppc64el-cross","docker-test-block@debian-riscv64-cross","docker-test-block@debian-s390x-cross","docker-test-block@fedora","docker-test-block@fedora-i386-cross","docker-test-block@fedora-win32-cross","docker-test-block@fedora-win64-cross","docker-test-block@opensuse-leap","docker-test-block@python","docker-test-block@ubuntu1804","docker-test-block@ubuntu2004","docker-test-build","docker-test-build@alpine","docker-test-build@centos8","docker-test-build@debian-all-test-cross","docker-test-build@debian-amd64","docker-test-build@debian-arm64-cross","docker-test-build@debian-armel-cross","docker-test-build@debian-armhf-cross","docker-test-build@debian-hexagon-cross","docker-test-build@debian-mips-cross","docker-test-build@debian-mips64el-cross","docker-test-build@debian-mipsel-cross","docker-test-build@debian-native","docker-test-build@debian-ppc64el-cross","docker-test-build@debian-riscv64-cross","docker-test-build@debian-s390x-cross","docker-test-build@fedora","docker-test-build@fedora-i386-cross","docker-test-build@fedora-win32-cross","docker-test-build@fedora-win64-cross","docker-test-build@opensuse-leap","docker-test-build@python","docker-test-build@ubuntu1804","docker-test-build@ubuntu2004","docker-test-clang","docker-test-clang@alpine","docker-test-clang@centos8","docker-test-clang@debian-all-test-cross","docker-test-clang@debian-amd64","docker-test-clang@debian-arm64-cross","docker-test-clang@debian-armel-cross","docker-test-clang@debian-armhf-cross","docker-test-clang@debian-hexagon-cross","docker-test-clang@debian-mips-cross","docker-test-clang@debian-mips64el-cross","docker-test-clang@debian-mipsel-cross","docker-test-clang@debian-native","docker-test-clang@debian-ppc64el-cross","docker-test-clang@debian-riscv64-cross","docker-test-clang@debian-s390x-cross","docker-test-clang@fedora","docker-test-clang@fedora-i386-cross","docker-test-clang@fedora-win32-cross","docker-test-clang@fedora-win64-cross","docker-test-clang@opensuse-leap","docker-test-clang@python","docker-test-clang@ubuntu1804","docker-test-clang@ubuntu2004","docker-test-debug","docker-test-debug@alpine","docker-test-debug@centos8","docker-test-debug@debian-all-test-cross","docker-test-debug@debian-amd64","docker-test-debug@debian-arm64-cross","docker-test-debug@debian-armel-cross","docker-test-debug@debian-armhf-cross","docker-test-debug@debian-hexagon-cross","docker-test-debug@debian-mips-cross","docker-test-debug@debian-mips64el-cross","docker-test-debug@debian-mipsel-cross","docker-test-debug@debian-native","docker-test-debug@debian-ppc64el-cross","docker-test-debug@debian-riscv64-cross","docker-test-debug@debian-s390x-cross","docker-test-debug@fedora","docker-test-debug@fedora-i386-cross","docker-test-debug@fedora-win32-cross","docker-test-debug@fedora-win64-cross","docker-test-debug@opensuse-leap","docker-test-debug@python","docker-test-debug@ubuntu1804","docker-test-debug@ubuntu2004","docker-test-full","docker-test-full@alpine","docker-test-full@centos8","docker-test-full@debian-all-test-cross","docker-test-full@debian-amd64","docker-test-full@debian-arm64-cross","docker-test-full@debian-armel-cross","docker-test-full@debian-armhf-cross","docker-test-full@debian-hexagon-cross","docker-test-full@debian-mips-cross","docker-test-full@debian-mips64el-cross","docker-test-full@debian-mipsel-cross","docker-test-full@debian-native","docker-test-full@debian-ppc64el-cross","docker-test-full@debian-riscv64-cross","docker-test-full@debian-s390x-cross","docker-test-full@fedora","docker-test-full@fedora-i386-cross","docker-test-full@fedora-win32-cross","docker-test-full@fedora-win64-cross","docker-test-full@opensuse-leap","docker-test-full@python","docker-test-full@ubuntu1804","docker-test-full@ubuntu2004","docker-test-mingw","docker-test-mingw@alpine","docker-test-mingw@centos8","docker-test-mingw@debian-all-test-cross","docker-test-mingw@debian-amd64","docker-test-mingw@debian-arm64-cross","docker-test-mingw@debian-armel-cross","docker-test-mingw@debian-armhf-cross","docker-test-mingw@debian-hexagon-cross","docker-test-mingw@debian-mips-cross","docker-test-mingw@debian-mips64el-cross","docker-test-mingw@debian-mipsel-cross","docker-test-mingw@debian-native","docker-test-mingw@debian-ppc64el-cross","docker-test-mingw@debian-riscv64-cross","docker-test-mingw@debian-s390x-cross","docker-test-mingw@fedora","docker-test-mingw@fedora-i386-cross","docker-test-mingw@fedora-win32-cross","docker-test-mingw@fedora-win64-cross","docker-test-mingw@opensuse-leap","docker-test-mingw@python","docker-test-mingw@ubuntu1804","docker-test-mingw@ubuntu2004","docker-test-misc","docker-test-misc@alpine","docker-test-misc@centos8","docker-test-misc@debian-all-test-cross","docker-test-misc@debian-amd64","docker-test-misc@debian-arm64-cross","docker-test-misc@debian-armel-cross","docker-test-misc@debian-armhf-cross","docker-test-misc@debian-hexagon-cross","docker-test-misc@debian-mips-cross","docker-test-misc@debian-mips64el-cross","docker-test-misc@debian-mipsel-cross","docker-test-misc@debian-native","docker-test-misc@debian-ppc64el-cross","docker-test-misc@debian-riscv64-cross","docker-test-misc@debian-s390x-cross","docker-test-misc@fedora","docker-test-misc@fedora-i386-cross","docker-test-misc@fedora-win32-cross","docker-test-misc@fedora-win64-cross","docker-test-misc@opensuse-leap","docker-test-misc@python","docker-test-misc@ubuntu1804","docker-test-misc@ubuntu2004","docker-test-quick","docker-test-quick@alpine","docker-test-quick@centos8","docker-test-quick@debian-all-test-cross","docker-test-quick@debian-amd64","docker-test-quick@debian-arm64-cross","docker-test-quick@debian-armel-cross","docker-test-quick@debian-armhf-cross","docker-test-quick@debian-hexagon-cross","docker-test-quick@debian-mips-cross","docker-test-quick@debian-mips64el-cross","docker-test-quick@debian-mipsel-cross","docker-test-quick@debian-native","docker-test-quick@debian-ppc64el-cross","docker-test-quick@debian-riscv64-cross","docker-test-quick@debian-s390x-cross","docker-test-quick@fedora","docker-test-quick@fedora-i386-cross","docker-test-quick@fedora-win32-cross","docker-test-quick@fedora-win64-cross","docker-test-quick@opensuse-leap","docker-test-quick@python","docker-test-quick@ubuntu1804","docker-test-quick@ubuntu2004","docker-test-static","docker-test-static@alpine","docker-test-static@centos8","docker-test-static@debian-all-test-cross","docker-test-static@debian-amd64","docker-test-static@debian-arm64-cross","docker-test-static@debian-armel-cross","docker-test-static@debian-armhf-cross","docker-test-static@debian-hexagon-cross","docker-test-static@debian-mips-cross","docker-test-static@debian-mips64el-cross","docker-test-static@debian-mipsel-cross","docker-test-static@debian-native","docker-test-static@debian-ppc64el-cross","docker-test-static@debian-riscv64-cross","docker-test-static@debian-s390x-cross","docker-test-static@fedora","docker-test-static@fedora-i386-cross","docker-test-static@fedora-win32-cross","docker-test-static@fedora-win64-cross","docker-test-static@opensuse-leap","docker-test-static@python","docker-test-static@ubuntu1804","docker-test-static@ubuntu2004","docker-test-tcg","docker-test-tcg@alpine","docker-test-tcg@centos8","docker-test-tcg@debian-all-test-cross","docker-test-tcg@debian-amd64","docker-test-tcg@debian-arm64-cross","docker-test-tcg@debian-armel-cross","docker-test-tcg@debian-armhf-cross","docker-test-tcg@debian-hexagon-cross","docker-test-tcg@debian-mips-cross","docker-test-tcg@debian-mips64el-cross","docker-test-tcg@debian-mipsel-cross","docker-test-tcg@debian-native","docker-test-tcg@debian-ppc64el-cross","docker-test-tcg@debian-riscv64-cross","docker-test-tcg@debian-s390x-cross","docker-test-tcg@fedora","docker-test-tcg@fedora-i386-cross","docker-test-tcg@fedora-win32-cross","docker-test-tcg@fedora-win64-cross","docker-test-tcg@opensuse-leap","docker-test-tcg@python","docker-test-tcg@ubuntu1804","docker-test-tcg@ubuntu2004","docker-test-tsan","docker-test-tsan@alpine","docker-test-tsan@centos8","docker-test-tsan@debian-all-test-cross","docker-test-tsan@debian-amd64","docker-test-tsan@debian-arm64-cross","docker-test-tsan@debian-armel-cross","docker-test-tsan@debian-armhf-cross","docker-test-tsan@debian-hexagon-cross","docker-test-tsan@debian-mips-cross","docker-test-tsan@debian-mips64el-cross","docker-test-tsan@debian-mipsel-cross","docker-test-tsan@debian-native","docker-test-tsan@debian-ppc64el-cross","docker-test-tsan@debian-riscv64-cross","docker-test-tsan@debian-s390x-cross","docker-test-tsan@fedora","docker-test-tsan@fedora-i386-cross","docker-test-tsan@fedora-win32-cross","docker-test-tsan@fedora-win64-cross","docker-test-tsan@opensuse-leap","docker-test-tsan@python","docker-test-tsan@ubuntu1804","docker-test-tsan@ubuntu2004","docker-test-unit","docker-test-unit@alpine","docker-test-unit@centos8","docker-test-unit@debian-all-test-cross","docker-test-unit@debian-amd64","docker-test-unit@debian-arm64-cross","docker-test-unit@debian-armel-cross","docker-test-unit@debian-armhf-cross","docker-test-unit@debian-hexagon-cross","docker-test-unit@debian-mips-cross","docker-test-unit@debian-mips64el-cross","docker-test-unit@debian-mipsel-cross","docker-test-unit@debian-native","docker-test-unit@debian-ppc64el-cross","docker-test-unit@debian-riscv64-cross","docker-test-unit@debian-s390x-cross","docker-test-unit@fedora","docker-test-unit@fedora-i386-cross","docker-test-unit@fedora-win32-cross","docker-test-unit@fedora-win64-cross","docker-test-unit@opensuse-leap","docker-test-unit@python","docker-test-unit@ubuntu1804","docker-test-unit@ubuntu2004","gtags","help","lcitool","lcitool-help","lcitool-refresh","msi","recurse-all","recurse-clean","vm-build-all","vm-clean-all","vm-help","vm-test"],"launchTargets":[],"customConfigurationProvider":{"workspaceBrowse":{"browsePath":[],"compilerArgs":[]},"fileIndex":[]}}
\ No newline at end of file
+{"buildTargets":["/home/xcd/qemu_uintr/qemu/docker-src.2022-05-07-01.18.52.14143","FORCE","Makefile","TAGS","all","check-help","clean","config-host.mak","configure","cscope","ctags","dist","distclean","docker","docker-all-tests","docker-clean","docker-exec-copy-test","docker-help","docker-image","docker-image-alpine","docker-image-debian-all-test-cross","docker-image-debian-alpha-cross","docker-image-debian-amd64","docker-image-debian-armel-cross","docker-image-debian-armhf-cross","docker-image-debian-hexagon-cross","docker-image-debian-hppa-cross","docker-image-debian-m68k-cross","docker-image-debian-microblaze-cross","docker-image-debian-mips-cross","docker-image-debian-mips64-cross","docker-image-debian-mips64el-cross","docker-image-debian-mipsel-cross","docker-image-debian-native","docker-image-debian-nios2-cross","docker-image-debian-powerpc-test-cross","docker-image-debian-ppc64el-cross","docker-image-debian-riscv64-test-cross","docker-image-debian-sh4-cross","docker-image-debian-sparc64-cross","docker-image-debian-tricore-cross","docker-image-debian10","docker-image-debian11","docker-qemu-src","docker-run","docker-test","docker-test-block","docker-test-block@alpine","docker-test-block@centos8","docker-test-block@debian-all-test-cross","docker-test-block@debian-amd64","docker-test-block@debian-arm64-cross","docker-test-block@debian-armel-cross","docker-test-block@debian-armhf-cross","docker-test-block@debian-hexagon-cross","docker-test-block@debian-mips-cross","docker-test-block@debian-mips64el-cross","docker-test-block@debian-mipsel-cross","docker-test-block@debian-native","docker-test-block@debian-ppc64el-cross","docker-test-block@debian-riscv64-cross","docker-test-block@debian-s390x-cross","docker-test-block@fedora","docker-test-block@fedora-i386-cross","docker-test-block@fedora-win32-cross","docker-test-block@fedora-win64-cross","docker-test-block@opensuse-leap","docker-test-block@python","docker-test-block@ubuntu1804","docker-test-block@ubuntu2004","docker-test-build","docker-test-build@alpine","docker-test-build@centos8","docker-test-build@debian-all-test-cross","docker-test-build@debian-amd64","docker-test-build@debian-arm64-cross","docker-test-build@debian-armel-cross","docker-test-build@debian-armhf-cross","docker-test-build@debian-hexagon-cross","docker-test-build@debian-mips-cross","docker-test-build@debian-mips64el-cross","docker-test-build@debian-mipsel-cross","docker-test-build@debian-native","docker-test-build@debian-ppc64el-cross","docker-test-build@debian-riscv64-cross","docker-test-build@debian-s390x-cross","docker-test-build@fedora","docker-test-build@fedora-i386-cross","docker-test-build@fedora-win32-cross","docker-test-build@fedora-win64-cross","docker-test-build@opensuse-leap","docker-test-build@python","docker-test-build@ubuntu1804","docker-test-build@ubuntu2004","docker-test-clang","docker-test-clang@alpine","docker-test-clang@centos8","docker-test-clang@debian-all-test-cross","docker-test-clang@debian-amd64","docker-test-clang@debian-arm64-cross","docker-test-clang@debian-armel-cross","docker-test-clang@debian-armhf-cross","docker-test-clang@debian-hexagon-cross","docker-test-clang@debian-mips-cross","docker-test-clang@debian-mips64el-cross","docker-test-clang@debian-mipsel-cross","docker-test-clang@debian-native","docker-test-clang@debian-ppc64el-cross","docker-test-clang@debian-riscv64-cross","docker-test-clang@debian-s390x-cross","docker-test-clang@fedora","docker-test-clang@fedora-i386-cross","docker-test-clang@fedora-win32-cross","docker-test-clang@fedora-win64-cross","docker-test-clang@opensuse-leap","docker-test-clang@python","docker-test-clang@ubuntu1804","docker-test-clang@ubuntu2004","docker-test-debug","docker-test-debug@alpine","docker-test-debug@centos8","docker-test-debug@debian-all-test-cross","docker-test-debug@debian-amd64","docker-test-debug@debian-arm64-cross","docker-test-debug@debian-armel-cross","docker-test-debug@debian-armhf-cross","docker-test-debug@debian-hexagon-cross","docker-test-debug@debian-mips-cross","docker-test-debug@debian-mips64el-cross","docker-test-debug@debian-mipsel-cross","docker-test-debug@debian-native","docker-test-debug@debian-ppc64el-cross","docker-test-debug@debian-riscv64-cross","docker-test-debug@debian-s390x-cross","docker-test-debug@fedora","docker-test-debug@fedora-i386-cross","docker-test-debug@fedora-win32-cross","docker-test-debug@fedora-win64-cross","docker-test-debug@opensuse-leap","docker-test-debug@python","docker-test-debug@ubuntu1804","docker-test-debug@ubuntu2004","docker-test-full","docker-test-full@alpine","docker-test-full@centos8","docker-test-full@debian-all-test-cross","docker-test-full@debian-amd64","docker-test-full@debian-arm64-cross","docker-test-full@debian-armel-cross","docker-test-full@debian-armhf-cross","docker-test-full@debian-hexagon-cross","docker-test-full@debian-mips-cross","docker-test-full@debian-mips64el-cross","docker-test-full@debian-mipsel-cross","docker-test-full@debian-native","docker-test-full@debian-ppc64el-cross","docker-test-full@debian-riscv64-cross","docker-test-full@debian-s390x-cross","docker-test-full@fedora","docker-test-full@fedora-i386-cross","docker-test-full@fedora-win32-cross","docker-test-full@fedora-win64-cross","docker-test-full@opensuse-leap","docker-test-full@python","docker-test-full@ubuntu1804","docker-test-full@ubuntu2004","docker-test-mingw","docker-test-mingw@alpine","docker-test-mingw@centos8","docker-test-mingw@debian-all-test-cross","docker-test-mingw@debian-amd64","docker-test-mingw@debian-arm64-cross","docker-test-mingw@debian-armel-cross","docker-test-mingw@debian-armhf-cross","docker-test-mingw@debian-hexagon-cross","docker-test-mingw@debian-mips-cross","docker-test-mingw@debian-mips64el-cross","docker-test-mingw@debian-mipsel-cross","docker-test-mingw@debian-native","docker-test-mingw@debian-ppc64el-cross","docker-test-mingw@debian-riscv64-cross","docker-test-mingw@debian-s390x-cross","docker-test-mingw@fedora","docker-test-mingw@fedora-i386-cross","docker-test-mingw@fedora-win32-cross","docker-test-mingw@fedora-win64-cross","docker-test-mingw@opensuse-leap","docker-test-mingw@python","docker-test-mingw@ubuntu1804","docker-test-mingw@ubuntu2004","docker-test-misc","docker-test-misc@alpine","docker-test-misc@centos8","docker-test-misc@debian-all-test-cross","docker-test-misc@debian-amd64","docker-test-misc@debian-arm64-cross","docker-test-misc@debian-armel-cross","docker-test-misc@debian-armhf-cross","docker-test-misc@debian-hexagon-cross","docker-test-misc@debian-mips-cross","docker-test-misc@debian-mips64el-cross","docker-test-misc@debian-mipsel-cross","docker-test-misc@debian-native","docker-test-misc@debian-ppc64el-cross","docker-test-misc@debian-riscv64-cross","docker-test-misc@debian-s390x-cross","docker-test-misc@fedora","docker-test-misc@fedora-i386-cross","docker-test-misc@fedora-win32-cross","docker-test-misc@fedora-win64-cross","docker-test-misc@opensuse-leap","docker-test-misc@python","docker-test-misc@ubuntu1804","docker-test-misc@ubuntu2004","docker-test-quick","docker-test-quick@alpine","docker-test-quick@centos8","docker-test-quick@debian-all-test-cross","docker-test-quick@debian-amd64","docker-test-quick@debian-arm64-cross","docker-test-quick@debian-armel-cross","docker-test-quick@debian-armhf-cross","docker-test-quick@debian-hexagon-cross","docker-test-quick@debian-mips-cross","docker-test-quick@debian-mips64el-cross","docker-test-quick@debian-mipsel-cross","docker-test-quick@debian-native","docker-test-quick@debian-ppc64el-cross","docker-test-quick@debian-riscv64-cross","docker-test-quick@debian-s390x-cross","docker-test-quick@fedora","docker-test-quick@fedora-i386-cross","docker-test-quick@fedora-win32-cross","docker-test-quick@fedora-win64-cross","docker-test-quick@opensuse-leap","docker-test-quick@python","docker-test-quick@ubuntu1804","docker-test-quick@ubuntu2004","docker-test-static","docker-test-static@alpine","docker-test-static@centos8","docker-test-static@debian-all-test-cross","docker-test-static@debian-amd64","docker-test-static@debian-arm64-cross","docker-test-static@debian-armel-cross","docker-test-static@debian-armhf-cross","docker-test-static@debian-hexagon-cross","docker-test-static@debian-mips-cross","docker-test-static@debian-mips64el-cross","docker-test-static@debian-mipsel-cross","docker-test-static@debian-native","docker-test-static@debian-ppc64el-cross","docker-test-static@debian-riscv64-cross","docker-test-static@debian-s390x-cross","docker-test-static@fedora","docker-test-static@fedora-i386-cross","docker-test-static@fedora-win32-cross","docker-test-static@fedora-win64-cross","docker-test-static@opensuse-leap","docker-test-static@python","docker-test-static@ubuntu1804","docker-test-static@ubuntu2004","docker-test-tcg","docker-test-tcg@alpine","docker-test-tcg@centos8","docker-test-tcg@debian-all-test-cross","docker-test-tcg@debian-amd64","docker-test-tcg@debian-arm64-cross","docker-test-tcg@debian-armel-cross","docker-test-tcg@debian-armhf-cross","docker-test-tcg@debian-hexagon-cross","docker-test-tcg@debian-mips-cross","docker-test-tcg@debian-mips64el-cross","docker-test-tcg@debian-mipsel-cross","docker-test-tcg@debian-native","docker-test-tcg@debian-ppc64el-cross","docker-test-tcg@debian-riscv64-cross","docker-test-tcg@debian-s390x-cross","docker-test-tcg@fedora","docker-test-tcg@fedora-i386-cross","docker-test-tcg@fedora-win32-cross","docker-test-tcg@fedora-win64-cross","docker-test-tcg@opensuse-leap","docker-test-tcg@python","docker-test-tcg@ubuntu1804","docker-test-tcg@ubuntu2004","docker-test-tsan","docker-test-tsan@alpine","docker-test-tsan@centos8","docker-test-tsan@debian-all-test-cross","docker-test-tsan@debian-amd64","docker-test-tsan@debian-arm64-cross","docker-test-tsan@debian-armel-cross","docker-test-tsan@debian-armhf-cross","docker-test-tsan@debian-hexagon-cross","docker-test-tsan@debian-mips-cross","docker-test-tsan@debian-mips64el-cross","docker-test-tsan@debian-mipsel-cross","docker-test-tsan@debian-native","docker-test-tsan@debian-ppc64el-cross","docker-test-tsan@debian-riscv64-cross","docker-test-tsan@debian-s390x-cross","docker-test-tsan@fedora","docker-test-tsan@fedora-i386-cross","docker-test-tsan@fedora-win32-cross","docker-test-tsan@fedora-win64-cross","docker-test-tsan@opensuse-leap","docker-test-tsan@python","docker-test-tsan@ubuntu1804","docker-test-tsan@ubuntu2004","docker-test-unit","docker-test-unit@alpine","docker-test-unit@centos8","docker-test-unit@debian-all-test-cross","docker-test-unit@debian-amd64","docker-test-unit@debian-arm64-cross","docker-test-unit@debian-armel-cross","docker-test-unit@debian-armhf-cross","docker-test-unit@debian-hexagon-cross","docker-test-unit@debian-mips-cross","docker-test-unit@debian-mips64el-cross","docker-test-unit@debian-mipsel-cross","docker-test-unit@debian-native","docker-test-unit@debian-ppc64el-cross","docker-test-unit@debian-riscv64-cross","docker-test-unit@debian-s390x-cross","docker-test-unit@fedora","docker-test-unit@fedora-i386-cross","docker-test-unit@fedora-win32-cross","docker-test-unit@fedora-win64-cross","docker-test-unit@opensuse-leap","docker-test-unit@python","docker-test-unit@ubuntu1804","docker-test-unit@ubuntu2004","gtags","help","lcitool","lcitool-help","lcitool-refresh","msi","recurse-all","recurse-clean","vm-build-all","vm-clean-all","vm-help","vm-test"],"launchTargets":[],"customConfigurationProvider":{"workspaceBrowse":{"browsePath":[],"compilerArgs":[]},"fileIndex":[]}}
\ No newline at end of file
diff --git a/.vscode/targets.log b/.vscode/targets.log
index e249f6ca15..ddd768c493 100644
--- a/.vscode/targets.log
+++ b/.vscode/targets.log
@@ -6,10 +6,11 @@ make all --print-data-base --no-builtin-variables --no-builtin-rules --question
 # This is free software: you are free to change and redistribute it.
 # There is NO WARRANTY, to the extent permitted by law.
 
-# Make data base, printed on Tue May  3 04:14:13 2022
+# Make data base, printed on Sat May  7 01:18:52 2022
 
 # Variables
 
+ 
 # automatic
 <D = $(patsubst %/,%,$(dir $<))
 # automatic
@@ -71,7 +72,7 @@ VSCODE_CWD = /home/xcd
 # makefile (from 'tests/docker/Makefile.include', line 103)
 USER_TCG_TARGETS = $(patsubst %-linux-user,qemu-%,$(filter %-linux-user,$(TARGET_DIRS)))
 # environment
-SSH_CONNECTION = 183.172.199.208 65387 10.0.0.4 22
+SSH_CONNECTION = 183.172.195.169 52202 10.0.0.4 22
 # environment
 PATH = /home/xcd/.vscode-server/bin/dfd34e8260c270da74b5c2d86d61aee4b6d56977/bin/remote-cli:/home/xcd/miniconda3/bin:/home/xcd/miniconda3/condabin:/home/xcd/.cargo/bin:/home/xcd/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
 # makefile (from 'Makefile', line 27)
@@ -93,7 +94,7 @@ CONDA_PREFIX = /home/xcd/miniconda3
 # environment
 VSCODE_LOG_STACK = false
 # environment
-VSCODE_IPC_HOOK_CLI = /run/user/1000/vscode-ipc-99b8081b-fcaa-4176-a822-8e7fc79d1fec.sock
+VSCODE_IPC_HOOK_CLI = /run/user/1000/vscode-ipc-38df301f-5569-4bfd-9062-3f72322a8e08.sock
 # default
 .FEATURES := target-specific order-only second-expansion else-if shortest-stem undefine oneshell archives jobserver output-sync check-symlink load
 # environment
@@ -101,7 +102,7 @@ LS_COLORS =
 # automatic
 %F = $(notdir $%)
 # makefile (from 'tests/docker/Makefile.include', line 40)
-CUR_TIME := 2022-05-03-04.14.13.74731
+CUR_TIME := 2022-05-07-01.18.52.14143
 # environment
 CONDA_EXE = /home/xcd/miniconda3/bin/conda
 # environment
@@ -120,6 +121,8 @@ IMAGE_FILES :=  /home/xcd/.cache/qemu-vm/images/freebsd.img  /home/xcd/.cache/qe
 VSCODE_AMD_ENTRYPOINT = vs/workbench/api/node/extensionHostProcess
 # environment
 HOME = /home/xcd
+# environment
+LD_LIBRARY_PATH = :
 # makefile (from 'Makefile', line 193)
 ROM_DIRS = $(addprefix pc-bios/, $(ROMS))
 # environment
@@ -159,7 +162,7 @@ DOCKER_SUFFIX := .docker
 # makefile (from 'Makefile', line 8)
 BUILD_DIR = $(CURDIR)
 # environment
-XDG_SESSION_ID = 4
+XDG_SESSION_ID = 13
 # environment
 USER = xcd
 # makefile (from 'tests/docker/Makefile.include', line 22)
@@ -195,7 +198,8 @@ MAKEFLAGS = pqrR
 # environment
 MFLAGS = -pqrR
 # environment
-SSH_CLIENT = 183.172.199.208 65387 22
+ 
+SSH_CLIENT = 183.172.195.169 52202 22
 # automatic
 +D = $(patsubst %/,%,$(dir $+))
 # makefile (from 'tests/docker/Makefile.include', line 36)
@@ -217,7 +221,7 @@ HOST_ARCH = $(if $(ARCH),$(ARCH),$(shell uname -m))
 # makefile (from 'tests/docker/Makefile.include', line 201)
 debian-toolchain = $(call debian-toolchain-run,$(patsubst docker-image-%,%,$1))
 # makefile (from 'tests/docker/Makefile.include', line 41)
-DOCKER_SRC_COPY := /home/xcd/qemu_uintr/qemu/docker-src.2022-05-03-04.14.13.74731
+DOCKER_SRC_COPY := /home/xcd/qemu_uintr/qemu/docker-src.2022-05-07-01.18.52.14143
 # makefile (from 'tests/docker/Makefile.include', line 23)
 DOCKER_IMAGES :=  alpine centos8 debian-all-test-cross debian-alpha-cross debian-amd64 debian-amd64-cross debian-arm64-cross debian-armel-cross debian-armhf-cross debian-hexagon-cross debian-hppa-cross debian-m68k-cross debian-mips-cross debian-mips64-cross debian-mips64el-cross debian-mipsel-cross debian-native debian-powerpc-test-cross debian-ppc64el-cross debian-riscv64-cross debian-riscv64-test-cross debian-s390x-cross debian-sh4-cross debian-sparc64-cross debian-tricore-cross debian-xtensa-cross debian10 debian11 fedora fedora-cris-cross fedora-i386-cross fedora-win32-cross fedora-win64-cross opensuse-leap python ubuntu1804 ubuntu2004
 # makefile (from 'tests/docker/Makefile.include', line 28)
@@ -267,7 +271,7 @@ _CE_CONDA =
 # makefile (from 'Makefile', line 26)
 quiet-@ = $(if $(V),,@)
 # variable set hash-table stats:
-# Load=128/1024=12%, Rehash=0, Collisions=21/366=6%
+# Load=129/1024=13%, Rehash=0, Collisions=21/367=6%
 
 # Pattern-specific Variable Values
 
@@ -283,10 +287,10 @@ docker-run-% :
 # Directories
 
 # /home/xcd/.cache/qemu-vm/images: could not be stat'd.
-# . (device 2049, inode 1307653): 128 files, no impossibilities.
-# tests/vm (device 2049, inode 2636756): No files, no impossibilities so far.
-# ./tests/docker/dockerfiles (device 2049, inode 2634004): 46 files, no impossibilities.
-# tests/docker/dockerfiles (device 2049, inode 2634004): 46 files, no impossibilities.
+# . (device 2065, inode 1307653): 128 files, no impossibilities.
+# tests/vm (device 2065, inode 2636756): No files, no impossibilities so far.
+# ./tests/docker/dockerfiles (device 2065, inode 2634004): 46 files, no impossibilities.
+# tests/docker/dockerfiles (device 2065, inode 2634004): 46 files, no impossibilities.
 
 # 220 files, no impossibilities in 5 directories.
 
@@ -486,6 +490,7 @@ docker-test-tcg@debian-mipsel-cross: docker-image-debian-mipsel-cross docker-run
 #  Implicit rule search has not been done.
 #  File does not exist.
 #  File has not been updated.
+ 
 
 # Not a target:
 docker-run-test-tsan@debian-mips-cross:
@@ -546,7 +551,6 @@ docker-run-test-static@fedora-win64-cross:
 #  Modification time never checked.
 #  File has not been updated.
 
- 
 # Not a target:
 docker-run-test-debug@alpine:
 #  Implicit rule search has not been done.
@@ -571,6 +575,7 @@ docker-run-test-tcg@centos8:
 #  Modification time never checked.
 #  File has not been updated.
 
+ 
 docker-test-build: docker-test-build@alpine docker-test-build@centos8 docker-test-build@debian-all-test-cross docker-test-build@debian-amd64 docker-test-build@debian-arm64-cross docker-test-build@debian-armel-cross docker-test-build@debian-armhf-cross docker-test-build@debian-hexagon-cross docker-test-build@debian-mips-cross docker-test-build@debian-mips64el-cross docker-test-build@debian-mipsel-cross docker-test-build@debian-native docker-test-build@debian-ppc64el-cross docker-test-build@debian-riscv64-cross docker-test-build@debian-s390x-cross docker-test-build@fedora docker-test-build@fedora-i386-cross docker-test-build@fedora-win32-cross docker-test-build@fedora-win64-cross docker-test-build@opensuse-leap docker-test-build@python docker-test-build@ubuntu1804 docker-test-build@ubuntu2004
 #  Implicit rule search has not been done.
 #  Modification time never checked.
@@ -580,6 +585,7 @@ docker-test-build: docker-test-build@alpine docker-test-build@centos8 docker-tes
 docker-run-test-build@fedora-i386-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
+ 
 #  File has not been updated.
 
 # Not a target:
@@ -655,6 +661,7 @@ docker-run-test-block@debian-amd64:
 #  File has not been updated.
 
 docker-test-build@ubuntu2004: docker-image-ubuntu2004 docker-run-test-build@ubuntu2004
+ 
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -822,8 +829,8 @@ lcitool:
 	@echo '    lcitool:             Print this help.'
 	@echo '    lcitool-refresh:     Re-generate all build environment manifests.'
 	@echo
-
  
+
 # Not a target:
 docker-run-test-static@debian-ppc64el-cross:
 #  Implicit rule search has not been done.
@@ -943,6 +950,7 @@ docker-run-test-clang@debian-mips64el-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
+ 
 
 # Not a target:
 docker-run-test-static@python:
@@ -1063,12 +1071,6 @@ docker-run-test-debug@fedora-win64-cross:
 #  Modification time never checked.
 #  File has not been updated.
 
-docker-test-tsan@python: docker-image-python docker-run-test-tsan@python
-#  Phony target (prerequisite of .PHONY).
-#  Implicit rule search has not been done.
-#  File does not exist.
-#  File has not been updated.
-
 docker-test-unit@debian-mips64el-cross: docker-image-debian-mips64el-cross docker-run-test-unit@debian-mips64el-cross
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
@@ -1086,7 +1088,6 @@ docker-run-test-tcg@debian-mips-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
- 
 
 docker-test-tcg@debian-armhf-cross: docker-image-debian-armhf-cross docker-run-test-tcg@debian-armhf-cross
 #  Phony target (prerequisite of .PHONY).
@@ -1213,6 +1214,7 @@ docker-test-build@debian-s390x-cross: docker-image-debian-s390x-cross docker-run
 #  File has not been updated.
 
 docker-test-debug@debian-amd64: docker-image-debian-amd64 docker-run-test-debug@debian-amd64
+ 
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -1365,7 +1367,6 @@ docker-run-test-clang@debian-armhf-cross:
 docker-test-static@debian-native: docker-image-debian-native docker-run-test-static@debian-native
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
- 
 #  File does not exist.
 #  File has not been updated.
 
@@ -1492,6 +1493,7 @@ docker-run-test-full@fedora-win64-cross:
 #  File has not been updated.
 
 docker-test-tcg@debian-amd64: docker-image-debian-amd64 docker-run-test-tcg@debian-amd64
+ 
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -1770,6 +1772,7 @@ docker-test-unit@debian-riscv64-cross: docker-image-debian-riscv64-cross docker-
 
 # Not a target:
 docker-run-test-tcg@debian-native:
+ 
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
@@ -1856,7 +1859,6 @@ docker-run-test-misc@alpine:
 
 docker-test-tsan@fedora-win64-cross: docker-image-fedora-win64-cross docker-run-test-tsan@fedora-win64-cross
 #  Phony target (prerequisite of .PHONY).
- 
 #  Implicit rule search has not been done.
 #  File does not exist.
 #  File has not been updated.
@@ -2050,6 +2052,7 @@ docker-run-test-tcg@fedora-win32-cross:
 #  File has not been updated.
 
 docker-test-clang@debian-arm64-cross: docker-image-debian-arm64-cross docker-run-test-clang@debian-arm64-cross
+ 
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -2138,7 +2141,6 @@ docker-run-test-tsan@debian-armel-cross:
 #  File has not been updated.
 
 # Not a target:
- 
 docker-run-test-debug@debian-s390x-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
@@ -2156,7 +2158,7 @@ recurse-clean:
 #  File does not exist.
 #  File has not been updated.
 
-docker-qemu-src: /home/xcd/qemu_uintr/qemu/docker-src.2022-05-03-04.14.13.74731
+docker-qemu-src: /home/xcd/qemu_uintr/qemu/docker-src.2022-05-07-01.18.52.14143
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -2346,6 +2348,7 @@ docker-run-test-mingw@fedora-i386-cross:
 help:
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
+ 
 #  File does not exist.
 #  File has not been updated.
 #  recipe to execute (from 'Makefile', line 298):
@@ -2434,7 +2437,6 @@ docker-test-quick@debian-ppc64el-cross: docker-image-debian-ppc64el-cross docker
 #  Implicit rule search has not been done.
 #  File does not exist.
 #  File has not been updated.
- 
 
 # Not a target:
 docker-run-test-debug@debian-armel-cross:
@@ -2625,13 +2627,14 @@ docker-test-full@debian-mips-cross: docker-image-debian-mips-cross docker-run-te
 #  File does not exist.
 #  File has not been updated.
 
+ 
 # Not a target:
 docker-run-test-unit@debian-ppc64el-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
 
-docker-test-mingw@python: docker-image-python docker-run-test-mingw@python
+docker-test-tsan@python: docker-image-python docker-run-test-tsan@python
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -2711,7 +2714,6 @@ docker-run-test-full@fedora-win32-cross:
 #  File has not been updated.
 
 # Not a target:
- 
 docker-run-test-tsan@opensuse-leap:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
@@ -2900,6 +2902,7 @@ recurse-all:
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
+ 
 #  File has been updated.
 #  Successfully updated.
 
@@ -2988,7 +2991,6 @@ docker-test-misc@alpine: docker-image-alpine docker-run-test-misc@alpine
 #  File does not exist.
 #  File has not been updated.
 
- 
 # Not a target:
 docker-run-test-block@ubuntu1804:
 #  Implicit rule search has not been done.
@@ -3054,6 +3056,20 @@ docker-run-test-block@debian-armel-cross:
 #  Modification time never checked.
 #  File has not been updated.
 
+/home/xcd/qemu_uintr/qemu/docker-src.2022-05-07-01.18.52.14143:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  recipe to execute (from 'tests/docker/Makefile.include', line 45):
+	@mkdir $@
+	$(if $(SRC_ARCHIVE), \
+		$(call quiet-command, cp "$(SRC_ARCHIVE)" $@/qemu.tar, \
+			"CP", "$@/qemu.tar"), \
+		$(call quiet-command, cd $(SRC_PATH) && scripts/archive-source.sh $@/qemu.tar, \
+			"GEN", "$@/qemu.tar"))
+	$(call quiet-command, cp $(SRC_PATH)/tests/docker/run $@/run, \
+		"COPY","RUNNER")
+
 # Not a target:
 docker-run-test-block@ubuntu2004:
 #  Implicit rule search has not been done.
@@ -3148,6 +3164,7 @@ docker-test-block@debian-amd64: docker-image-debian-amd64 docker-run-test-block@
 #  Implicit rule search has not been done.
 #  File does not exist.
 #  File has not been updated.
+ 
 
 # Not a target:
 docker-run-test-quick@debian-all-test-cross:
@@ -3424,6 +3441,7 @@ docker-run-test-quick@debian-mipsel-cross:
 #  File has not been updated.
 
 docker-test-misc@fedora-win64-cross: docker-image-fedora-win64-cross docker-run-test-misc@fedora-win64-cross
+ 
 #  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
 #  File does not exist.
@@ -3462,7 +3480,6 @@ docker:
 	@echo
 	@echo 'Available tests:'
 	@echo '    $(DOCKER_TESTS)'
- 
 	@echo
 	@echo 'Special variables:'
 	@echo '    TARGET_LIST=a,b,c    Override target list in builds.'
@@ -3701,6 +3718,7 @@ docker-test-clang@alpine: docker-image-alpine docker-run-test-clang@alpine
 docker-run-test-misc@debian-mips-cross:
 #  Implicit rule search has not been done.
 #  Modification time never checked.
+ 
 #  File has not been updated.
 
 # Not a target:
@@ -3739,7 +3757,6 @@ docker-run-test-full@debian-mipsel-cross:
 #  Modification time never checked.
 #  File has not been updated.
 
- 
 # Not a target:
 docker-run-test-quick@debian-mips64el-cross:
 #  Implicit rule search has not been done.
@@ -3933,19 +3950,11 @@ docker-run-test-full@ubuntu2004:
 #  Modification time never checked.
 #  File has not been updated.
 
-/home/xcd/qemu_uintr/qemu/docker-src.2022-05-03-04.14.13.74731:
+docker-test-mingw@python: docker-image-python docker-run-test-mingw@python
+#  Phony target (prerequisite of .PHONY).
 #  Implicit rule search has not been done.
-#  Modification time never checked.
+#  File does not exist.
 #  File has not been updated.
-#  recipe to execute (from 'tests/docker/Makefile.include', line 45):
-	@mkdir $@
-	$(if $(SRC_ARCHIVE), \
-		$(call quiet-command, cp "$(SRC_ARCHIVE)" $@/qemu.tar, \
-			"CP", "$@/qemu.tar"), \
-		$(call quiet-command, cd $(SRC_PATH) && scripts/archive-source.sh $@/qemu.tar, \
-			"GEN", "$@/qemu.tar"))
-	$(call quiet-command, cp $(SRC_PATH)/tests/docker/run $@/run, \
-		"COPY","RUNNER")
 
 docker-test-full@ubuntu1804: docker-image-ubuntu1804 docker-run-test-full@ubuntu1804
 #  Phony target (prerequisite of .PHONY).
@@ -3991,6 +4000,7 @@ docker-run-test-unit@debian-mipsel-cross:
 
 # Not a target:
 docker-run-test-debug@fedora-win32-cross:
+ 
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
@@ -4152,7 +4162,7 @@ docker-run-test-unit@debian-hexagon-cross:
 #  Modification time never checked.
 #  File has not been updated.
 
-.DELETE_ON_ERROR: /home/xcd/qemu_uintr/qemu/docker-src.2022-05-03-04.14.13.74731
+.DELETE_ON_ERROR: /home/xcd/qemu_uintr/qemu/docker-src.2022-05-07-01.18.52.14143
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
@@ -4284,6 +4294,7 @@ docker-run-test-clang@debian-hexagon-cross:
 # Not a target:
 docker-run-test-tcg@debian-armhf-cross:
 #  Implicit rule search has not been done.
+ 
 #  Modification time never checked.
 #  File has not been updated.
 
@@ -4563,6 +4574,7 @@ docker-test-tsan@fedora: docker-image-fedora docker-run-test-tsan@fedora
 #  File has not been updated.
 
 docker-image-debian-microblaze-cross: tests/docker/dockerfiles/debian-toolchain.docker tests/docker/dockerfiles/debian-microblaze-cross.d/build-toolchain.sh docker-image-debian10
+ 
 #  Implicit rule search has not been done.
 #  Modification time never checked.
 #  File has not been updated.
@@ -4666,7 +4678,7 @@ docker-test-build@fedora-win32-cross: docker-image-fedora-win32-cross docker-run
 #  File has not been updated.
 
 # files hash-table stats:
-# Load=663/1024=65%, Rehash=0, Collisions=1344/3310=41%
+# Load=663/1024=65%, Rehash=0, Collisions=1315/3310=40%
 # VPATH Search Paths
 
 # No 'vpath' search paths.
@@ -4681,6 +4693,6 @@ docker-test-build@fedora-win32-cross: docker-image-fedora-win32-cross docker-run
 # strcache performance: lookups = 4045 / hit rate = 78%
 # hash-table stats:
 # Load=852/8192=10%, Rehash=0, Collisions=131/4045=3%
-# Finished Make data base on Tue May  3 04:14:13 2022
+# Finished Make data base on Sat May  7 01:18:52 2022
 
  
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index c997c2e8e0..b3daae43be 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -851,7 +851,7 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
     }
 
     *last_tb = NULL;
-    insns_left = qatomic_read(&cpu_neg(cpu)->icount_decr.u32);
+    insns_left = qatomic_read(&cpu_neg(cpu)->icount_decr.u32); // 出错位点
     if (insns_left < 0) {
         /* Something asked us to stop executing chained TBs; just
          * continue round the main loop. Whatever requested the exit
@@ -888,6 +888,7 @@ static inline void cpu_loop_exec_tb(CPUState *cpu, TranslationBlock *tb,
 
 /* main execution loop */
 
+// static int block_id = 0;
 int cpu_exec(CPUState *cpu)
 {
     int ret;
@@ -1002,7 +1003,8 @@ int cpu_exec(CPUState *cpu)
             if (last_tb) {
                 tb_add_jump(last_tb, tb_exit, tb);
             }
-
+            // if (block_id > 10000)qemu_log("BLOCK: %d  size:%d  icont:%d  \n", block_id,tb->size,tb->icount);
+            // block_id ++;
             cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit);
 
             /* Try to align the host and virtual clocks
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 04fcda816e..23ced7a76e 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -864,38 +864,38 @@ static inline target_ulong get_rsp_from_tss(CPUX86State *env, int level)
 
 static bool Debug = true;
 void helper_rrnzero(CPUX86State *env){ // 改
-    if(Debug)printf("rrnzero called handler: 0x%lx  rr: 0x%lx\n", env->uintr_handler,env->uintr_rr);
+    if(Debug)qemu_log("rrnzero called handler: 0x%lx  rr: 0x%lx\n", env->uintr_handler,env->uintr_rr);
     target_ulong temprsp = env->regs[R_ESP];
-    printf("qemu:origin exp 0x%lx   eip 0x%lx  eflags: 0x%lx\n",env->regs[R_ESP], env->eip, env->eflags);
+    qemu_log("qemu:origin exp 0x%lx   eip 0x%lx  eflags: 0x%lx\n",env->regs[R_ESP], env->eip, env->eflags);
     if(env->uintr_stackadjust &1){ // adjust[0] = 1
         env->regs[R_ESP] = env->uintr_stackadjust;
-        printf("qemu:set  statck 0x%lx\n",env->regs[R_ESP]);
+        qemu_log("qemu:set  statck 0x%lx\n",env->regs[R_ESP]);
     }else{
         env->regs[R_ESP] -= env->uintr_stackadjust;
-        printf("qemu:move statck 0x%lx\n",env->regs[R_ESP]);
+        qemu_log("qemu:move statck 0x%lx\n",env->regs[R_ESP]);
     }
     env->regs[R_ESP] &= ~0xfLL; /* align stack */
     target_ulong esp = env->regs[R_ESP];
-    printf("qemu:after align statck 0x%lx\n",env->regs[R_ESP]);
+    qemu_log("qemu:after align statck 0x%lx\n",env->regs[R_ESP]);
     PUSHQ(esp, temprsp);
-    // printf("qemu: pushed rsp\n");
+    // qemu_log("qemu: pushed rsp\n");
     PUSHQ(esp, env->eflags); // PUSHQ(esp, cpu_compute_eflags(env));
-    // printf("qemu: pushed eflags\n");
+    // qemu_log("qemu: pushed eflags\n");
     PUSHQ(esp, env->eip);
-    // printf("the uirr is 0x%016lx \n", env->uintr_rr);
+    // qemu_log("the uirr is 0x%016lx \n", env->uintr_rr);
     PUSHQ(esp, env->uintr_rr & 0x3f); // // 64-bit push; upper 58 bits pushed as 0
-    printf("qemu:push finish now esp is: 0x%lx",esp);
+    qemu_log("qemu:push finish now esp is: 0x%lx",esp);
     env->uintr_rr = 0; // clear rr
     env->regs[R_ESP] = esp;
     env->eflags &= ~(TF_MASK | RF_MASK);
     env->eip = env->uintr_handler;
     env->uintr_uif = 0;
-    printf("qemu: eip: 0x%lx\n",env->eip);
+    qemu_log("qemu: eip: 0x%lx\n",env->eip);
 }
 
 void helper_uiret(CPUX86State *env){
-    if(Debug)printf("helper uiret called, now eip: 0x%lx\n", env->eip);
-    printf("qemu: now esp is: 0x%lx\n",env->regs[R_ESP]);
+    if(Debug)qemu_log("helper uiret called, now eip: 0x%lx\n", env->eip);
+    qemu_log("qemu: now esp is: 0x%lx\n",env->regs[R_ESP]);
     target_ulong temprip, temprfalgs, temprsp, uirrv;
     target_ulong esp = env->regs[R_ESP];
     esp += 0x60;
@@ -903,7 +903,7 @@ void helper_uiret(CPUX86State *env){
     POPQ(esp, temprip);
     POPQ(esp, temprfalgs);
     POPQ(esp, temprsp);
-    printf("qemu:poped values:uirrv:0x%lx rip:0x%lx   eflags:0x%lx  rsp:0x%lx \n",uirrv,temprip, temprfalgs, temprsp);
+    qemu_log("qemu:poped values:uirrv:0x%lx rip:0x%lx   eflags:0x%lx  rsp:0x%lx \n",uirrv,temprip, temprfalgs, temprsp);
     env->eip = temprip;
     env->regs[R_ESP] = temprsp;
     env->eflags = (env->eflags & ~0x254dd5) |(temprfalgs & 0x254dd5);
@@ -935,10 +935,10 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int,
         old_eip = env->eip;
     }
     if(intno == UINTR_UINV ){
-        printf("recognize uintr\n");
+        qemu_log("recognize uintr\n");
 
         if(env->uintr_uif == 0){
-            printf("--uif not zero, return\n");
+            qemu_log("--uif not zero, return\n");
             return;
         }
         // 清除apic的
@@ -956,16 +956,21 @@ static void do_interrupt64(CPUX86State *env, int intno, int is_int,
             send = true;
         }
         cpu_physical_memory_rw(upid_phyaddress, &upid, 16, true);
+
+
         uint64_t APICaddress = get_hphys2(cs, APIC_DEFAULT_ADDRESS, MMU_DATA_LOAD, &prot);
         uint64_t EOI;
         uint64_t zero = 0;
         cpu_physical_memory_rw(APICaddress + 0xb0, &EOI, 8, false);
-        printf("the physical address of APIC 0x%lx   the EOI content: 0x%lx\n", APICaddress,EOI);
+        qemu_log("the physical address of APIC 0x%lx   the EOI content: 0x%lx\n", APICaddress,EOI);
         cpu_physical_memory_rw(APICaddress + 0xb0, &zero, 4, true);
+        // apic_mem_write(cs, )
         // uint64_t EOI;       
         // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, &EOI, 8, false);
-        // printf("\n\n the EOI content: 0x%lx\n\n",EOI);
+        // qemu_log("\n\n the EOI content: 0x%lx\n\n",EOI);
         // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, 0, 4, true);
+
+
         if(send)helper_rrnzero(env);
         return;
     }
@@ -1207,7 +1212,7 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
     if (env->cr[0] & CR0_PE_MASK) { // 改， 中断具体分发，应该不涉及user only
 #if !defined(CONFIG_USER_ONLY)
         if (env->hflags & HF_GUEST_MASK) {
-            printf("HF_GUEST_MASK even \n");
+            qemu_log("HF_GUEST_MASK even \n");
             handle_even_inj(env, intno, is_int, error_code, is_hw, 0);
         }
 #endif
@@ -1217,14 +1222,14 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
         } else
 #endif
         {   
-            printf("interrupt protected \n");
+            qemu_log("interrupt protected \n");
             do_interrupt_protected(env, intno, is_int, error_code, next_eip,
                                    is_hw);
         }
     } else {
 #if !defined(CONFIG_USER_ONLY)
         if (env->hflags & HF_GUEST_MASK) {
-            printf("HF_GUEST_MASK even inj \n");
+            qemu_log("HF_GUEST_MASK even inj \n");
             handle_even_inj(env, intno, is_int, error_code, is_hw, 1);
         }
 #endif  
@@ -1233,7 +1238,7 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
 
 #if !defined(CONFIG_USER_ONLY)
     if (env->hflags & HF_GUEST_MASK) {
-        printf("HF_GUEST_MASK do real \n");
+        qemu_log("HF_GUEST_MASK do real \n");
         CPUState *cs = CPU(cpu);
         uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb +
                                       offsetof(struct vmcb,
diff --git a/target/i386/tcg/sysemu/misc_helper.c b/target/i386/tcg/sysemu/misc_helper.c
index f6ff914522..3007ee14e7 100644
--- a/target/i386/tcg/sysemu/misc_helper.c
+++ b/target/i386/tcg/sysemu/misc_helper.c
@@ -422,7 +422,7 @@ void helper_rdmsr(CPUX86State *env)
         val = env->uintr_misc;
         rdcount ++;
         // printf("qemu:rdmsr misc 0x%016lx eip: 0x%016lx\n",val,env->eip);
-        if(rdcount > 2000) exit(2);
+        if(rdcount > 200) exit(2);
         break;
     case MSR_IA32_UINTR_PD:
         val = env->uintr_pd;
diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index cc648a9515..31bcdbed6c 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -1505,7 +1505,7 @@ static void gen_inc(DisasContext *s1, MemOp ot, int d, int c)
             gen_illegal_opcode(s1);
             return;
         }
-        // if(Debug) printf("mem mov\n"); //？？？
+        // if(Debug) qemu_log("mem mov\n"); //？？？
         tcg_gen_movi_tl(s1->T0, c > 0 ? 1 : -1);
         tcg_gen_atomic_add_fetch_tl(s1->T0, s1->A0, s1->T0,
                                     s1->mem_index, ot | MO_LE);
@@ -2761,13 +2761,13 @@ static inline void gen_op_movo(DisasContext *s, int d_offset, int s_offset)
 }
 
 static inline void gen_op_movq(DisasContext *s, int d_offset, int s_offset)
-{   if(Debug) printf("qemu: movq %d %d\n",d_offset,s_offset);
+{   if(Debug) qemu_log("qemu: movq %d %d\n",d_offset,s_offset);
     tcg_gen_ld_i64(s->tmp1_i64, cpu_env, s_offset);
     tcg_gen_st_i64(s->tmp1_i64, cpu_env, d_offset);
 }
 
 static inline void gen_op_movl(DisasContext *s, int d_offset, int s_offset)
-{   if(Debug) printf("qemu: movl %d %d\n",d_offset,s_offset);
+{   if(Debug) qemu_log("qemu: movl %d %d\n",d_offset,s_offset);
     tcg_gen_ld_i32(s->tmp2_i32, cpu_env, s_offset);
     tcg_gen_st_i32(s->tmp2_i32, cpu_env, d_offset);
 }
@@ -5404,41 +5404,41 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
     case 0x1c7: /* cmpxchg8b */
         if(prefixes & PREFIX_REPZ){
             modrm = x86_ldub_code(env, s);
-            printf("\n\n--------------\n");
-            printf("qemu: caught 0xf30fc7 SENDUIPI\n "); // 改 Debug
+            qemu_log("\n\n--------------\n");
+            qemu_log("qemu: caught 0xf30fc7 SENDUIPI\n "); // 改 Debug
             // CPUState *cs = env_cpu(env);
             // int prot;
             // uint64_t APICaddress = get_hphys2(cs, APIC_DEFAULT_ADDRESS, MMU_DATA_LOAD, &prot);
             // uint64_t EOI;
             // cpu_physical_memory_rw(APICaddress + 0xb0, &EOI, 8, false);
-            // printf("the physical address of APIC 0x%lx   the EOI content: 0x%lx\n", APICaddress,EOI);
+            // qemu_log("the physical address of APIC 0x%lx   the EOI content: 0x%lx\n", APICaddress,EOI);
 
 
             // s->tmp1_i64 = env->uintr_tt; //地址
             // tcg_gen_qemu_ld_i64(s->tmp1_i64, s->A0 , 0, MO_LEUQ);
-            // printf("qemu: loaded 0x%lx A0: 0x%lx\n",(uint64_t)((void*)s->tmp1_i64),(uint64_t)s->A0);
+            // qemu_log("qemu: loaded 0x%lx A0: 0x%lx\n",(uint64_t)((void*)s->tmp1_i64),(uint64_t)s->A0);
 
 
             // uint64_t content[10]; // read all zero
             // cpu_physical_memory_rw((env->uintr_tt>>3)<<3,&content,16,false);
-            // if(Debug) printf("0x%lx    xxx               %lx \n %lx \n\n",(env->uintr_tt>>3)<<3, content[0],content[1]);
+            // if(Debug) qemu_log("0x%lx    xxx               %lx \n %lx \n\n",(env->uintr_tt>>3)<<3, content[0],content[1]);
 
             // int mem_idx = cpu_mmu_index(env, false);  // system segfault
             // MemOpIdx oi0 = make_memop_idx(MO_LEUQ | MO_ALIGN_16, mem_idx);
             // uint64_t content = cpu_ldq_le_mmu(env, (env->uintr_tt>>3)<<3, oi0, 0);
-            // if(Debug) printf(" %lx \n\n\n",content);
+            // if(Debug) qemu_log(" %lx \n\n\n",content);
 
 
             // TCGv t0;
             // t0 = tcg_temp_local_new();
             // s->A0 = (TCGv)(env->uintr_tt>>3)<<3;
-            // if(Debug)printf("debug: memindex: %x \n",s->mem_index);
-            // if(Debug){printf("debug: before t0: %llx   A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);}
+            // if(Debug)qemu_log("debug: memindex: %x \n",s->mem_index);
+            // if(Debug){qemu_log("debug: before t0: %llx   A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);}
             // gen_op_ld_v(s, ot, t0, s->A0);
-            // if(Debug){printf("debug: after  t0: %llx   A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);}
+            // if(Debug){qemu_log("debug: after  t0: %llx   A0: %llx\n",(long long unsigned)t0,(long long unsigned)s->A0);}
             // tcg_temp_free(t0);
             gen_helper_senduipi(cpu_env, tcg_const_i32(modrm));
-            printf("--------------\n\n\n");
+            qemu_log("--------------\n\n\n");
             break;
         }
         modrm = x86_ldub_code(env, s);
@@ -5619,7 +5619,7 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
         break;
     case 0xc6:
     case 0xc7: /* mov Ev, Iv */ 
-        // if(Debug)printf("0xc7 \n"); //改
+        // if(Debug)qemu_log("0xc7 \n"); //改
         ot = mo_b_d(b, dflag);
         modrm = x86_ldub_code(env, s);
         mod = (modrm >> 6) & 3;
@@ -7746,7 +7746,7 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
             break;
         case 0xee: /* rdpkru */
             if(prefixes & PREFIX_REPZ){
-                printf("qemu:caught 0xf30fee CLUI\n"); // 改
+                qemu_log("qemu:caught 0xf30fee CLUI\n"); // 改
                 env->uintr_uif = 0;
                 break;
             }
@@ -7759,24 +7759,33 @@ static inline void gen_op_ld_v(DisasContext *s, int idx, TCGv t0, TCGv a0)
             break;
         case 0xec:
             if (prefixes & PREFIX_REPZ){
-                printf("--------------\n\n\n");
-                printf("qemu:caught 0xf30f01ec UIRET\n"); // 改
+                qemu_log("--------------\n\n\n");
+                qemu_log("qemu:caught 0xf30f01ec UIRET\n"); // 改
+                qemu_log("before:  pc_start: 0x%lx  sc_base:%lx   pc: 0x%lx  pc.next:0x%lx  rip:0x%lx\n",s->pc_start,s->cs_base, s->pc,s->base.pc_next, env->eip);
+                
+
                 helper_uiret(env);
-                printf("--------------\n\n\n");
+                // gen_jmp_im(s, env->eip);
+                qemu_log("pc_start: 0x%lx  sc_base:%lx   pc: 0x%lx  rip:0x%lx\n",s->pc_start,s->cs_base, s->pc, env->eip);
+                s->pc = env->eip;
+                tcg_gen_exit_tb(NULL, 0);
+                s->base.is_jmp = DISAS_NORETURN;
+                // s->pc = env->eip;
+                qemu_log("-------------\n\n\n");
                 // exit(12);
             }
             break;
         case 0xed:
             if (prefixes & PREFIX_REPZ){
-                printf("qemu:caught 0xf30f01ed TESTUI\n"); // 改
+                qemu_log("qemu:caught 0xf30f01ed TESTUI\n"); // 改
             }
             break;
         case 0xef: /* wrpkru */
             if(prefixes & PREFIX_REPZ){
-                printf("--------------\n\n\n");
-                printf("qemu:caught 0xf30f01ef STUI\n"); // 改
+                qemu_log("--------------\n\n\n");
+                qemu_log("qemu:caught 0xf30f01ef STUI\n"); // 改
                 env->uintr_uif = 1;
-                printf("--------------\n\n\n");
+                qemu_log("--------------\n\n\n");
                 break;
             }
             if (prefixes & PREFIX_LOCK) {
diff --git a/worklog5-6.md b/worklog5-6.md
new file mode 100644
index 0000000000..56514c4b15
--- /dev/null
+++ b/worklog5-6.md
@@ -0,0 +1,395 @@
+# 工作概要
+
+
+
+## 中断定位和控制流跳转
+
+### 中断定位部分
+
+通过添加输出的方式来定位中断触发的位置
+
+```c
+void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
+                      int error_code, target_ulong next_eip, int is_hw) // 接收方执行中断？
+{
+    CPUX86State *env = &cpu->env;
+    if (qemu_loglevel_mask(CPU_LOG_INT)) {
+        if ((env->cr[0] & CR0_PE_MASK)) {
+            static int count;
+
+            qemu_log("%6d: v=%02x e=%04x i=%d cpl=%d IP=%04x:" TARGET_FMT_lx
+                     " pc=" TARGET_FMT_lx " SP=%04x:" TARGET_FMT_lx,
+                     count, intno, error_code, is_int,
+                     env->hflags & HF_CPL_MASK,
+                     env->segs[R_CS].selector, env->eip,
+                     (int)env->segs[R_CS].base + env->eip,
+                     env->segs[R_SS].selector, env->regs[R_ESP]);
+            if (intno == 0x0e) {
+                qemu_log(" CR2=" TARGET_FMT_lx, env->cr[2]);
+            } else {
+                qemu_log(" env->regs[R_EAX]=" TARGET_FMT_lx, env->regs[R_EAX]);
+            }
+            qemu_log("\n");
+            log_cpu_state(CPU(cpu), CPU_DUMP_CCOP);
+#if 0
+            {
+                int i;
+                target_ulong ptr;
+
+                qemu_log("       code=");
+                ptr = env->segs[R_CS].base + env->eip;
+                for (i = 0; i < 16; i++) {
+                    qemu_log(" %02x", ldub(ptr + i));
+                }
+                qemu_log("\n");
+            }
+#endif
+            count++;
+        }
+    }
+    if (env->cr[0] & CR0_PE_MASK) { // 改， 中断具体分发，应该不涉及user only
+#if !defined(CONFIG_USER_ONLY)
+        if (env->hflags & HF_GUEST_MASK) {
+            qemu_log("HF_GUEST_MASK even \n");
+            handle_even_inj(env, intno, is_int, error_code, is_hw, 0);
+        }
+#endif
+#ifdef TARGET_X86_64
+        if (env->hflags & HF_LMA_MASK) {
+            do_interrupt64(env, intno, is_int, error_code, next_eip, is_hw);
+        } else
+#endif
+        {   
+            qemu_log("interrupt protected \n");
+            do_interrupt_protected(env, intno, is_int, error_code, next_eip,
+                                   is_hw);
+        }
+    } else {
+#if !defined(CONFIG_USER_ONLY)
+        if (env->hflags & HF_GUEST_MASK) {
+            qemu_log("HF_GUEST_MASK even inj \n");
+            handle_even_inj(env, intno, is_int, error_code, is_hw, 1);
+        }
+#endif  
+        do_interrupt_real(env, intno, is_int, error_code, next_eip);
+    }
+
+#if !defined(CONFIG_USER_ONLY)
+    if (env->hflags & HF_GUEST_MASK) {
+        qemu_log("HF_GUEST_MASK do real \n");
+        CPUState *cs = CPU(cpu);
+        uint32_t event_inj = x86_ldl_phys(cs, env->vm_vmcb +
+                                      offsetof(struct vmcb,
+                                               control.event_inj));
+
+        x86_stl_phys(cs,
+                 env->vm_vmcb + offsetof(struct vmcb, control.event_inj),
+                 event_inj & ~SVM_EVTINJ_VALID);
+    }
+#endif
+}
+```
+
+
+
+
+
+### 中断识别部分
+
+```c
+//target/i386/tcg/seg_helper.c
+#define UINTR_UINV 0xec
+static void do_interrupt64(CPUX86State *env, int intno, int is_int,
+                           int error_code, target_ulong next_eip, int is_hw) // 在用户态中断中 is_hw = 1
+{
+    SegmentCache *dt;
+    target_ulong ptr;
+    int type, dpl, selector, cpl, ist;
+    int has_error_code, new_stack;
+    uint32_t e1, e2, e3, ss;
+    target_ulong old_eip, esp, offset;
+
+    has_error_code = 0;
+    if (!is_int && !is_hw) {
+        has_error_code = exception_has_error_code(intno);
+    }
+    if (is_int) {
+        old_eip = next_eip;
+    } else {
+        old_eip = env->eip;
+    }
+    if(intno == UINTR_UINV ){
+        qemu_log("recognize uintr\n");
+
+        if(env->uintr_uif == 0){
+            qemu_log("--uif not zero, return\n");
+            return;
+        }
+        int prot;
+        CPUState *cs = env_cpu(env);
+        bool send = false;
+        uint64_t upid_phyaddress = get_hphys2(cs, env->uintr_pd, MMU_DATA_LOAD, &prot);
+        uintr_upid upid;
+        cpu_physical_memory_rw(upid_phyaddress, &upid, 16, false);
+        upid.nc.status &= (~1); // clear on
+        if(upid.puir != 0){
+            env->uintr_rr = upid.puir;
+            upid.puir = 0; // clear puir
+            cpu_physical_memory_rw(upid_phyaddress, &upid, 16, true); // write back
+            send = true;
+        }
+        cpu_physical_memory_rw(upid_phyaddress, &upid, 16, true);
+
+
+        uint64_t APICaddress = get_hphys2(cs, APIC_DEFAULT_ADDRESS, MMU_DATA_LOAD, &prot);
+        uint64_t EOI;
+        uint64_t zero = 0;
+        cpu_physical_memory_rw(APICaddress + 0xb0, &EOI, 8, false);
+        qemu_log("the physical address of APIC 0x%lx   the EOI content: 0x%lx\n", APICaddress,EOI);
+        cpu_physical_memory_rw(APICaddress + 0xb0, &zero, 4, true);
+        // apic_mem_write(cs, )
+        // uint64_t EOI;       
+        // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, &EOI, 8, false);
+        // qemu_log("\n\n the EOI content: 0x%lx\n\n",EOI);
+        // cpu_physical_memory_rw(APIC_DEFAULT_ADDRESS + 0xb0, 0, 4, true);
+        if(send)helper_rrnzero(env);
+        return;
+    }
+ 
+  
+```
+
+
+
+### 中断控制和跳转部分
+
+```c
+static bool Debug = true;
+void helper_rrnzero(CPUX86State *env){ // 改
+    if(Debug)qemu_log("rrnzero called handler: 0x%lx  rr: 0x%lx\n", env->uintr_handler,env->uintr_rr);
+    target_ulong temprsp = env->regs[R_ESP];
+    qemu_log("qemu:origin exp 0x%lx   eip 0x%lx  eflags: 0x%lx\n",env->regs[R_ESP], env->eip, env->eflags);
+    if(env->uintr_stackadjust &1){ // adjust[0] = 1
+        env->regs[R_ESP] = env->uintr_stackadjust;
+        qemu_log("qemu:set  statck 0x%lx\n",env->regs[R_ESP]);
+    }else{
+        env->regs[R_ESP] -= env->uintr_stackadjust;
+        qemu_log("qemu:move statck 0x%lx\n",env->regs[R_ESP]);
+    }
+    env->regs[R_ESP] &= ~0xfLL; /* align stack */
+    target_ulong esp = env->regs[R_ESP];
+    qemu_log("qemu:after align statck 0x%lx\n",env->regs[R_ESP]);
+    PUSHQ(esp, temprsp);
+    // qemu_log("qemu: pushed rsp\n");
+    PUSHQ(esp, env->eflags); // PUSHQ(esp, cpu_compute_eflags(env));
+    // qemu_log("qemu: pushed eflags\n");
+    PUSHQ(esp, env->eip);
+    // qemu_log("the uirr is 0x%016lx \n", env->uintr_rr);
+    PUSHQ(esp, env->uintr_rr & 0x3f); // // 64-bit push; upper 58 bits pushed as 0
+    qemu_log("qemu:push finish now esp is: 0x%lx",esp);
+    env->uintr_rr = 0; // clear rr
+    env->regs[R_ESP] = esp;
+    env->eflags &= ~(TF_MASK | RF_MASK);
+    env->eip = env->uintr_handler;
+    env->uintr_uif = 0;
+    qemu_log("qemu: eip: 0x%lx\n",env->eip);
+}
+
+void helper_uiret(CPUX86State *env){
+    if(Debug)qemu_log("helper uiret called, now eip: 0x%lx\n", env->eip);
+    qemu_log("qemu: now esp is: 0x%lx\n",env->regs[R_ESP]);
+    target_ulong temprip, temprfalgs, temprsp, uirrv;
+    target_ulong esp = env->regs[R_ESP];
+    esp += 0x60;
+    POPQ(esp, uirrv);
+    POPQ(esp, temprip);
+    POPQ(esp, temprfalgs);
+    POPQ(esp, temprsp);
+    qemu_log("qemu:poped values:uirrv:0x%lx rip:0x%lx   eflags:0x%lx  rsp:0x%lx \n",uirrv,temprip, temprfalgs, temprsp);
+    env->eip = temprip;
+    env->regs[R_ESP] = temprsp;
+    env->eflags = (env->eflags & ~0x254dd5) |(temprfalgs & 0x254dd5);
+    env->uintr_uif = 1;
+}
+```
+
+
+
+
+
+
+
+
+
+## XSAVE的实现
+
+搜索xsave, 找到如下引用:
+
+```c
+//target/i386/cpu.h
+#define XSTATE_FP_BIT                   0
+#define XSTATE_SSE_BIT                  1
+#define XSTATE_YMM_BIT                  2
+#define XSTATE_BNDREGS_BIT              3
+#define XSTATE_BNDCSR_BIT               4
+#define XSTATE_OPMASK_BIT               5
+#define XSTATE_ZMM_Hi256_BIT            6
+#define XSTATE_Hi16_ZMM_BIT             7
+#define XSTATE_PKRU_BIT                 9
+#define XSTATE_UINTR_BIT                14
+//改 XSTAVE 根据手册,添加对应的bitmap标识
+#define XSTATE_XTILE_CFG_BIT            17
+#define XSTATE_XTILE_DATA_BIT           18
+#define XSTATE_UINTR_MASK               (1ULL << XSTATE_UINTR_BIT)
+#define XSTATE_FP_MASK                  (1ULL << XSTATE_FP_BIT)
+#define XSTATE_SSE_MASK                 (1ULL << XSTATE_SSE_BIT)
+#define XSTATE_YMM_MASK                 (1ULL << XSTATE_YMM_BIT)
+#define XSTATE_BNDREGS_MASK             (1ULL << XSTATE_BNDREGS_BIT)
+#define XSTATE_BNDCSR_MASK              (1ULL << XSTATE_BNDCSR_BIT)
+#define XSTATE_OPMASK_MASK              (1ULL << XSTATE_OPMASK_BIT)
+#define XSTATE_ZMM_Hi256_MASK           (1ULL << XSTATE_ZMM_Hi256_BIT)
+#define XSTATE_Hi16_ZMM_MASK            (1ULL << XSTATE_Hi16_ZMM_BIT)
+#define XSTATE_PKRU_MASK                (1ULL << XSTATE_PKRU_BIT)
+#define XSTATE_XTILE_CFG_MASK           (1ULL << XSTATE_XTILE_CFG_BIT)
+#define XSTATE_XTILE_DATA_MASK          (1ULL << XSTATE_XTILE_DATA_BIT)
+
+//target/i386/tcg/fpuhelper.c
+static bool Debug = true;
+static void do_xsave(CPUX86State *env, target_ulong ptr, uint64_t rfbm,
+                     uint64_t inuse, uint64_t opt, uintptr_t ra)
+{
+    uint64_t old_bv, new_bv;
+    if(Debug)printf("do xsave called\n"); // 改 xsave
+    /* The OS must have enabled XSAVE.  */
+    if (!(env->cr[4] & CR4_OSXSAVE_MASK)) {
+        raise_exception_ra(env, EXCP06_ILLOP, ra);
+    }
+
+    /* The operand must be 64 byte aligned.  */
+    if (ptr & 63) {
+        raise_exception_ra(env, EXCP0D_GPF, ra);
+    }
+    /* Never save anything not enabled by XCR0.  */
+    rfbm &= env->xcr0;
+    opt &= rfbm;
+    if (opt & XSTATE_FP_MASK) {
+        do_xsave_fpu(env, ptr, ra);
+    }
+    if (rfbm & XSTATE_SSE_MASK) {
+        /* Note that saving MXCSR is not suppressed by XSAVEOPT.  */
+        do_xsave_mxcsr(env, ptr, ra);
+    }
+    if (opt & XSTATE_SSE_MASK) {
+        do_xsave_sse(env, ptr, ra);
+    }
+    if (opt & XSTATE_BNDREGS_MASK) {
+        do_xsave_bndregs(env, ptr + XO(bndreg_state), ra);
+    }
+    if (opt & XSTATE_BNDCSR_MASK) {
+        do_xsave_bndcsr(env, ptr + XO(bndcsr_state), ra);
+    }
+    if (opt & XSTATE_PKRU_MASK) {
+        do_xsave_pkru(env, ptr + XO(pkru_state), ra);
+    }
+    if (opt & XSTATE_UINTR_MASK) {// 改 
+        do_xsave_uintr(env, ptr , ra);
+    }
+
+    /* Update the XSTATE_BV field.  */
+    old_bv = cpu_ldq_data_ra(env, ptr + XO(header.xstate_bv), ra);
+    new_bv = (old_bv & ~rfbm) | (inuse & rfbm);
+    cpu_stq_data_ra(env, ptr + XO(header.xstate_bv), new_bv, ra);
+}
+
+/*
+在这里介绍一下一个红展开
+#define XO(X)  offsetof(X86XSaveArea, X)
+#define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER)
+__builtin_offsetof 的作用是什么?
+这里使用的是一个利用编译器技术的小技巧，即先求得结构成员变量在结构体中的相对于结构体的首地址的偏移地址，然后根据结构体的首地址为0，从而得出该偏移地址就是该结构体变量在该结构体中的偏移，即：该结构体成员变量距离结构体首的距离。
+*/
+
+static void do_xsave_uintr(CPUX86State *env, target_ulong ptr, uintptr_t ra){ //改
+    cpu_stq_data_ra(env, ptr, env->uintr_handler, ra);
+    cpu_stq_data_ra(env, ptr+8, env->uintr_stackadjust, ra);
+    cpu_stq_data_ra(env, ptr+16, env->uintr_misc, ra);
+    cpu_stq_data_ra(env, ptr+24, env->uintr_pd, ra);
+    cpu_stq_data_ra(env, ptr+32, env->uintr_rr, ra);
+    cpu_stq_data_ra(env, ptr+40, env->uintr_tt, ra);
+}
+
+static void do_xrstor_uintr(CPUX86State *env, target_ulong ptr, uintptr_t ra){ //改
+    env->uintr_handler = cpu_ldq_data_ra(env, ptr, ra);
+    env->uintr_stackadjust = cpu_ldq_data_ra(env, ptr+8, ra);
+    env->uintr_misc = cpu_ldq_data_ra(env, ptr+16, ra);
+    env->uintr_pd = cpu_ldq_data_ra(env, ptr+24, ra);
+    env->uintr_rr = cpu_ldq_data_ra(env, ptr+32, ra);
+    env->uintr_tt = cpu_ldq_data_ra(env, ptr+40, ra);
+}
+
+static void clear_uintr_reg(CPUX86State *env){ // 改
+    env->uintr_handler=0;
+    env->uintr_stackadjust=0;
+    env->uintr_misc=0;
+    env->uintr_pd=0;
+    env->uintr_rr=0;
+    env->uintr_tt=0;
+}
+
+//在helper_xrstor中添加如下
+	if (rfbm & XSTATE_UINTR_MASK){ // 改
+        if (xstate_bv & XSTATE_UINTR_MASK) {
+            do_xrstor_uintr(env, ptr + XO(uintr_state), ra);
+        } else {
+            clear_uintr_reg(env);
+        }
+  }
+
+//target/i386/tcg/tcg-cpu.h
+typedef struct X86XSaveArea {
+    X86LegacyXSaveArea legacy;
+    X86XSaveHeader header;
+
+    /* Extended save areas: startoffset:0x240 */
+
+    /* AVX State: */
+    XSaveAVX avx_state;
+
+    /* Ensure that XSaveBNDREG is properly aligned. */
+    uint8_t padding[XSAVE_BNDREG_OFFSET
+                    - sizeof(X86LegacyXSaveArea)
+                    - sizeof(X86XSaveHeader)
+                    - sizeof(XSaveAVX)];
+    /* MPX State: */
+    XSaveBNDREG bndreg_state;
+    XSaveBNDCSR bndcsr_state;
+    /* AVX-512 State: */
+    XSaveOpmask opmask_state;
+    XSaveZMM_Hi256 zmm_hi256_state;
+    XSaveHi16_ZMM hi16_zmm_state;
+    /* PKRU State: */
+    XSavePKRU pkru_state;
+    XSaveUINTR uintr_state; // 改
+} X86XSaveArea;
+
+
+//target/i386/cpu.h 添加如下区域
+/* Ext. save area 14: UINTR state*/ 
+typedef struct XSaveUINTR {
+    uint64_t handler;
+    uint64_t stack_adjust;
+    struct{
+        uint32_t uittsz;
+        uint8_t uinv;
+        uint16_t reserved;
+        uint8_t uif; // bit7 is the uif
+    };
+    uint64_t upidaddr;
+    uint64_t uirr;
+    uint64_t uittaddr;
+    
+}XSaveUINTR;
+
+```
+
+