dst.Chmod(0500) // make executable

	// Clobber all the non-v1 opcodes.
	opcodes := map[string]bool{}
	var features []string
	for feature, opcodeList := range featureToOpcodes {
		if runtimeFeatures[feature] {
			features = append(features, fmt.Sprintf("cpu.%s=off", feature))
		}
		for _, op := range opcodeList {
			opcodes[op] = true
		}
	}
	clobber(t, os.Args[0], dst, opcodes)
	if err = dst.Close(); err != nil {

	// we can leave in the flags register at the end of the block. (There
	// is no place to put a flag regeneration instruction.)
	for _, b := range f.Blocks {
		if b.Kind == BlockDefer {
			// Defer blocks internally use/clobber the flags value.
			end[b.ID] = nil
			continue
		}
		for _, v := range b.ControlValues() {
			if v.Type.IsFlags() && end[b.ID] != v {
				end[b.ID] = nil
			}
		}
	}

		v = leftShift(loadBlock, pos, v, shift0-(n-1)*size*8)
	}

	// Install with (Copy v).
	root.reset(OpCopy)
	root.AddArg(v)

	// Clobber the loads, just to prevent additional work being done on
	// subtrees (which are now unreachable).
	for i := int64(0); i < n; i++ {
		clobber(r[i].load)
	}
	return true
}

func memcombineStores(f *Func) {
	mark := f.newSparseSet(f.NumValues())
	defer f.retSparseSet(mark)

	pc := uintptr(c.eip())
	sp := uintptr(c.esp())

	if shouldPushSigpanic(gp, pc, *(*uintptr)(unsafe.Pointer(sp))) {
		c.pushCall(abi.FuncPCABIInternal(sigpanic), pc)
	} else {
		// Not safe to push the call. Just clobber the frame.
		c.set_eip(uint32(abi.FuncPCABIInternal(sigpanic)))
	}
}

func (c *sigctxt) pushCall(targetPC, resumePC uintptr) {
	// Make it look like we called target at resumePC.
	sp := uintptr(c.esp())

		ctxt.mainInittasks = ctxt.inittaskSym([]string{fmt.Sprintf("%s..inittask", objabi.PathToPrefix(*flagPluginPath))}, "go:plugin.inittasks")
		// Make symbol local so multiple plugins don't clobber each other's inittask list.
		ctxt.loader.SetAttrLocal(ctxt.mainInittasks, true)
	case BuildModeShared:
		// For a shared library, all packages are roots.
		var roots []string
		for _, lib := range ctxt.Library {

	// cond: canMergeLoad(v, l) && clobber(l)
	// result: (CMPBload {sym} [off] ptr x mem)
	for {
		l := v_0
		if l.Op != OpAMD64MOVBload {
			break
		}
		off := auxIntToInt32(l.AuxInt)
		sym := auxToSym(l.Aux)
		mem := l.Args[1]
		ptr := l.Args[0]
		x := v_1
		if !(canMergeLoad(v, l) && clobber(l)) {
			break
		}
		v.reset(OpAMD64CMPBload)

	RLDCR	$0, R1, $~15, R1	// align SP to 16 bytes
	MOVD	FARG, CTR		// address of function to be called
	MOVD	R0, 0(R1)		// clear back chain pointer
	BL	(CTR)
	MOVD	$0, R0			// C code can clobber R0 set it back to 0
	MOVD	R16, R1			// restore R1;
	MOVD	runtime·tls_g(SB), R10	// find correct g
	MOVD	0(R10), g
	RET

// tls_g, g value for each thread in TLS

	// which takes care of that.
	if shouldPushSigpanic(gp, pc, *(*uintptr)(unsafe.Pointer(sp))) {
		c.pushCall(abi.FuncPCABI0(sigpanic0), pc)
	} else {
		// Not safe to push the call. Just clobber the frame.
		c.set_rip(uint64(abi.FuncPCABI0(sigpanic0)))
	}
}

func (c *sigctxt) pushCall(targetPC, resumePC uintptr) {
	// Make it look like we called target at resumePC.
	sp := uintptr(c.rsp())

	load_g
	MOVD	g_racectx(g), R0	// goroutine context
	BL	racecall<>(SB)
	MOVD	R21, R9	// restore the original function
	// Call the atomic function.
	// racecall will call LLVM race code which might clobber R28 (g)
	load_g
	MOVD	g_racectx(g), R0	// goroutine context
	MOVD	16(RSP), R1	// caller pc
	MOVD	R9, R2	// pc
	ADD	$40, RSP, R3	// arguments
	BL	racecall<>(SB)
	// Call __tsan_go_ignore_sync_end.

# * export DOCKER_ARCHITECTURES="linux/amd64,linux/arm64"
# Note: if you already have a container builder before running the qemu setup you will need to restart them
"${ROOT}/tools/docker" --push --no-cache --no-clobber --targets="${DOCKER_TARGETS}"

APKO_IMAGES=""
for h in ${HUBS}; do
  for t in ${TAGS:-$TAG}; do
    APKO_IMAGES+="${h}/iptables:$t "
  done
done